From bd9c30eafeede0723f167dd25d5fc306754806ee Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 30 May 2026 21:56:03 +0100 Subject: [PATCH 01/15] =?UTF-8?q?feat(deno):=20migrate=20fogbinder=20npm?= =?UTF-8?q?=20=E2=86=92=20Deno=20(standards#253)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Class B (npm-wrapper via Deno) — simplest case. Deletes package.json stub (rescript-toolchain devDeps only, zero scripts, private:true). deno.json carries npm:rescript via imports map. Refs: standards#253 STEP 3 (smallest-first batch). Co-Authored-By: Claude Opus 4.7 (1M context) --- .gitignore | 8 ++++++++ fogbinder/package.json | 9 --------- 2 files changed, 8 insertions(+), 9 deletions(-) delete mode 100644 fogbinder/package.json diff --git a/.gitignore b/.gitignore index 7e34210..2a9f07b 100644 --- a/.gitignore +++ b/.gitignore @@ -40,6 +40,14 @@ build/ /vendor/ /deps/ +# npm-avoidant (standards#67) +package-lock.json +**/package-lock.json +bun.lockb +yarn.lock +pnpm-lock.yaml +.npmrc + # Secrets .env .env.* diff --git a/fogbinder/package.json b/fogbinder/package.json deleted file mode 100644 index d7fc6c7..0000000 --- a/fogbinder/package.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "name": "fogbinder", - "version": "0.1.0", - "private": true, - "type": "module", - "devDependencies": { - "rescript": "^12.0.0" - } -} From c87de1c4018ea129ad08547db8e46882adb390ce Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 1 Jun 2026 01:10:05 +0100 Subject: [PATCH 02/15] ci: fix CI/CD configuration (campaigns C001-C005) - C001: CodeQL language fixes - C002: License identifier standardization - C003: Outdated actions audit - C004: Pin standards refs to SHA 861b5e9 - C005: Add workflow-level permissions --- .github/workflows/governance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index b0b1ed6..b4062e0 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -23,4 +23,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 From 41b89af5ad8acc607558bb03cda5c2cf5a8c3e2e Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 1 Jun 2026 03:21:19 +0100 Subject: [PATCH 03/15] ci: fix CI/CD configuration (campaigns C001-C005) --- .github/copilot/coding-agent.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .github/copilot/coding-agent.yml diff --git a/.github/copilot/coding-agent.yml b/.github/copilot/coding-agent.yml new file mode 100644 index 0000000..a719a77 --- /dev/null +++ b/.github/copilot/coding-agent.yml @@ -0,0 +1,6 @@ +mcp_servers: + boj-server: + command: npx + args: ["-y", "@hyperpolymath/boj-server@latest"] + env: + BOJ_URL: http://localhost:7700 From 951864f228d37316bd0645f6bc3f5bfe828d85d5 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 1 Jun 2026 03:23:06 +0100 Subject: [PATCH 04/15] ci: fix CI/CD configuration (campaigns C001-C005) --- fogbinder/.github/workflows/codeql.yml | 1 + fogbinder/.github/workflows/governance.yml | 2 +- formbd/.github/workflows/codeql.yml | 1 + formbd/.github/workflows/governance.yml | 2 +- librarian/.github/workflows/codeql.yml | 1 + librarian/.github/workflows/governance.yml | 2 +- nesy/.github/workflows/codeql.yml | 1 + nesy/.github/workflows/governance.yml | 2 +- rescript-templater/.github/workflows/codeql.yml | 1 + safe-storage/.github/workflows/codeql.yml | 1 + safe-storage/.github/workflows/governance.yml | 2 +- voyant-export/.github/workflows/codeql.yml | 1 + voyant-export/.github/workflows/governance.yml | 2 +- zoterho-template/.github/workflows/codeql.yml | 1 + zoterho-template/.github/workflows/governance.yml | 2 +- zoterho/.github/workflows/codeql.yml | 1 + zoterho/.github/workflows/governance.yml | 2 +- zotpress/.github/workflows/codeql.yml | 1 + zotpress/.github/workflows/governance.yml | 2 +- 19 files changed, 19 insertions(+), 9 deletions(-) diff --git a/fogbinder/.github/workflows/codeql.yml b/fogbinder/.github/workflows/codeql.yml index e5d80e7..ad4866a 100644 --- a/fogbinder/.github/workflows/codeql.yml +++ b/fogbinder/.github/workflows/codeql.yml @@ -9,6 +9,7 @@ on: schedule: - cron: '0 6 * * 1' + permissions: read-all jobs: diff --git a/fogbinder/.github/workflows/governance.yml b/fogbinder/.github/workflows/governance.yml index b0b1ed6..b4062e0 100644 --- a/fogbinder/.github/workflows/governance.yml +++ b/fogbinder/.github/workflows/governance.yml @@ -23,4 +23,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/formbd/.github/workflows/codeql.yml b/formbd/.github/workflows/codeql.yml index b317db1..97bb6c2 100644 --- a/formbd/.github/workflows/codeql.yml +++ b/formbd/.github/workflows/codeql.yml @@ -9,6 +9,7 @@ on: schedule: - cron: '0 6 * * 1' + permissions: read-all jobs: diff --git a/formbd/.github/workflows/governance.yml b/formbd/.github/workflows/governance.yml index b0b1ed6..b4062e0 100644 --- a/formbd/.github/workflows/governance.yml +++ b/formbd/.github/workflows/governance.yml @@ -23,4 +23,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/librarian/.github/workflows/codeql.yml b/librarian/.github/workflows/codeql.yml index b317db1..97bb6c2 100644 --- a/librarian/.github/workflows/codeql.yml +++ b/librarian/.github/workflows/codeql.yml @@ -9,6 +9,7 @@ on: schedule: - cron: '0 6 * * 1' + permissions: read-all jobs: diff --git a/librarian/.github/workflows/governance.yml b/librarian/.github/workflows/governance.yml index b0b1ed6..b4062e0 100644 --- a/librarian/.github/workflows/governance.yml +++ b/librarian/.github/workflows/governance.yml @@ -23,4 +23,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/nesy/.github/workflows/codeql.yml b/nesy/.github/workflows/codeql.yml index b7e4e30..f72ca6a 100644 --- a/nesy/.github/workflows/codeql.yml +++ b/nesy/.github/workflows/codeql.yml @@ -9,6 +9,7 @@ on: schedule: - cron: '0 6 * * 1' + permissions: read-all jobs: diff --git a/nesy/.github/workflows/governance.yml b/nesy/.github/workflows/governance.yml index b0b1ed6..b4062e0 100644 --- a/nesy/.github/workflows/governance.yml +++ b/nesy/.github/workflows/governance.yml @@ -23,4 +23,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/rescript-templater/.github/workflows/codeql.yml b/rescript-templater/.github/workflows/codeql.yml index 5a90214..b20ebad 100644 --- a/rescript-templater/.github/workflows/codeql.yml +++ b/rescript-templater/.github/workflows/codeql.yml @@ -9,6 +9,7 @@ on: schedule: - cron: '0 6 * * 1' + permissions: read-all jobs: diff --git a/safe-storage/.github/workflows/codeql.yml b/safe-storage/.github/workflows/codeql.yml index 50b98c8..489b82c 100644 --- a/safe-storage/.github/workflows/codeql.yml +++ b/safe-storage/.github/workflows/codeql.yml @@ -9,6 +9,7 @@ on: schedule: - cron: '0 6 * * 1' + permissions: read-all jobs: diff --git a/safe-storage/.github/workflows/governance.yml b/safe-storage/.github/workflows/governance.yml index b0b1ed6..b4062e0 100644 --- a/safe-storage/.github/workflows/governance.yml +++ b/safe-storage/.github/workflows/governance.yml @@ -23,4 +23,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/voyant-export/.github/workflows/codeql.yml b/voyant-export/.github/workflows/codeql.yml index b7e4e30..f72ca6a 100644 --- a/voyant-export/.github/workflows/codeql.yml +++ b/voyant-export/.github/workflows/codeql.yml @@ -9,6 +9,7 @@ on: schedule: - cron: '0 6 * * 1' + permissions: read-all jobs: diff --git a/voyant-export/.github/workflows/governance.yml b/voyant-export/.github/workflows/governance.yml index b0b1ed6..b4062e0 100644 --- a/voyant-export/.github/workflows/governance.yml +++ b/voyant-export/.github/workflows/governance.yml @@ -23,4 +23,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/zoterho-template/.github/workflows/codeql.yml b/zoterho-template/.github/workflows/codeql.yml index 56eb7cf..da2a9b6 100644 --- a/zoterho-template/.github/workflows/codeql.yml +++ b/zoterho-template/.github/workflows/codeql.yml @@ -9,6 +9,7 @@ on: schedule: - cron: '0 6 * * 1' + permissions: read-all jobs: diff --git a/zoterho-template/.github/workflows/governance.yml b/zoterho-template/.github/workflows/governance.yml index b0b1ed6..b4062e0 100644 --- a/zoterho-template/.github/workflows/governance.yml +++ b/zoterho-template/.github/workflows/governance.yml @@ -23,4 +23,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/zoterho/.github/workflows/codeql.yml b/zoterho/.github/workflows/codeql.yml index 50b98c8..489b82c 100644 --- a/zoterho/.github/workflows/codeql.yml +++ b/zoterho/.github/workflows/codeql.yml @@ -9,6 +9,7 @@ on: schedule: - cron: '0 6 * * 1' + permissions: read-all jobs: diff --git a/zoterho/.github/workflows/governance.yml b/zoterho/.github/workflows/governance.yml index b0b1ed6..b4062e0 100644 --- a/zoterho/.github/workflows/governance.yml +++ b/zoterho/.github/workflows/governance.yml @@ -23,4 +23,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/zotpress/.github/workflows/codeql.yml b/zotpress/.github/workflows/codeql.yml index fdd5315..02646db 100644 --- a/zotpress/.github/workflows/codeql.yml +++ b/zotpress/.github/workflows/codeql.yml @@ -9,6 +9,7 @@ on: schedule: - cron: '0 6 * * 1' + permissions: read-all jobs: diff --git a/zotpress/.github/workflows/governance.yml b/zotpress/.github/workflows/governance.yml index b0b1ed6..b4062e0 100644 --- a/zotpress/.github/workflows/governance.yml +++ b/zotpress/.github/workflows/governance.yml @@ -23,4 +23,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 From 0203aaff2704e296d71e866c63c883fb0f649bd5 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 3 Jun 2026 14:47:04 +0100 Subject: [PATCH 05/15] docs: add OpenSSF Best Practices registration badge --- README.adoc | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/README.adoc b/README.adoc index d4cf028..55a48ed 100644 --- a/README.adoc +++ b/README.adoc @@ -1,5 +1,10 @@ -= zotero-tools // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell += zotero-tools +image:https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=openssourcesecurity[OpenSSF Best Practices,link="https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/zotero-tools"] + +image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[License: MPL-2.0,link="https://opensource.org/licenses/MPL-2.0"] + :author: Jonathan D.A. Jewell Zotero reference management extensions and integrations. @@ -18,7 +23,9 @@ Zotero reference management extensions and integrations. == License -MPL-2.0 +This project is licensed under the Mozilla Public License, v. 2.0. See the `LICENSE` file for details. + +SPDX-License-Identifier: MPL-2.0 == Architecture From 86cf48730f8faf2ce49fa08fcfcc25b857679ac6 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 4 Jun 2026 17:49:46 +0100 Subject: [PATCH 06/15] chore: rename k9 directories to self-validating for clarity --- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 2 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 3 +- .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/scorecard-enforcer.yml | 3 + .github/workflows/secret-scanner.yml | 1 + .machine_readable/6a2/0-AI-MANIFEST.a2ml | 31 +++ .machine_readable/6a2/README.adoc | 30 +++ .../6a2/anchor/0-AI-MANIFEST.a2ml | 21 ++ .../{anchors => 6a2/anchor}/ANCHOR.a2ml | 0 .machine_readable/6a2/anchor/README.adoc | 25 +++ .../agent_instructions/README.adoc | 2 +- CHANGELOG.md | 3 +- CODE_OF_CONDUCT.md | 4 + CONTRIBUTING.md | 4 + EXPLAINME.adoc | 10 + LICENSE | 165 +++++++--------- PROOF-NEEDS.md | 4 + QUICKSTART-DEV.adoc | 1 + QUICKSTART-MAINTAINER.adoc | 1 + QUICKSTART-USER.adoc | 1 + SECURITY.md | 4 + TEST-NEEDS.md | 4 + TOPOLOGY.md | 5 +- docs/architecture.adoc | 1 + docs/contributing.adoc | 1 + docs/decisions/0001-template.adoc | 1 + docs/tech-debt-2026-05-26.md | 3 +- docs/troubleshooting.adoc | 1 + docs/usage.adoc | 1 + fogbinder/.claude/CLAUDE.md | 18 +- .../.github/ISSUE_TEMPLATE/bug_report.md | 4 + fogbinder/.github/ISSUE_TEMPLATE/custom.md | 4 + .../.github/ISSUE_TEMPLATE/documentation.md | 4 + .../.github/ISSUE_TEMPLATE/feature_request.md | 4 + fogbinder/.github/ISSUE_TEMPLATE/question.md | 4 + fogbinder/.github/workflows/ci.yml | 8 + fogbinder/.github/workflows/codeql.yml | 1 + fogbinder/.github/workflows/governance.yml | 1 + fogbinder/.github/workflows/hypatia-scan.yml | 1 + fogbinder/.github/workflows/instant-sync.yml | 1 + .../.github/workflows/jekyll-gh-pages.yml | 2 + fogbinder/.github/workflows/mirror.yml | 7 + .../.github/workflows/rescript-deno-ci.yml | 2 + .../.github/workflows/scorecard-enforcer.yml | 2 + fogbinder/.github/workflows/scorecard.yml | 1 + .../.github/workflows/secret-scanner.yml | 3 + fogbinder/ABI-FFI-README.md | 4 + fogbinder/API.adoc | 2 + fogbinder/ARCHITECTURE_RESCRIPT_WASM.adoc | 2 + fogbinder/CHANGELOG.adoc | 2 + fogbinder/CODE_OF_CONDUCT.md | 5 +- fogbinder/CONTRIBUTING.adoc | 2 + fogbinder/CONTRIBUTING.md | 4 + fogbinder/DEVELOPMENT.adoc | 2 + fogbinder/GITHUB_PROTECTION_RULES.adoc | 2 + fogbinder/LICENSE_DUAL.adoc | 6 +- fogbinder/LICENSE_TLDR.adoc | 3 +- fogbinder/MAINTAINERS.adoc | 2 + fogbinder/PALIMPSEST.adoc | 2 + fogbinder/PHILOSOPHY.adoc | 2 + fogbinder/README.adoc | 2 + fogbinder/ROADMAP.adoc | 1 + fogbinder/RSR_ACHIEVEMENT.adoc | 2 + fogbinder/RSR_AUDIT.adoc | 2 + fogbinder/RSR_COMPLIANCE_REPORT.adoc | 2 + fogbinder/RSR_FINAL_STATUS.adoc | 2 + fogbinder/RSR_OUTLINE.adoc | 2 + fogbinder/RSR_PLATINUM_ACHIEVEMENT.adoc | 2 + fogbinder/RSR_v3.0_CANONICAL.adoc | 2 + fogbinder/RSR_v3.0_STANDARD.adoc | 2 + fogbinder/SECURITY.md | 4 + fogbinder/SUMMARY.adoc | 2 + fogbinder/TESTING-REPORT.adoc | 2 + fogbinder/TPCF.adoc | 2 + fogbinder/badges/README.adoc | 2 + fogbinder/benchmarks/README.adoc | 2 + fogbinder/bootstrap.js | 1 + fogbinder/contractiles/README.adoc | 2 + .../{k9 => self-validating}/README.adoc | 1 + .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 fogbinder/docs/CITATIONS.adoc | 2 + fogbinder/docs/PROPERTY_TESTING.adoc | 2 + .../docs/cookbooks/BEGINNER_COOKBOOK.adoc | 2 + .../docs/cookbooks/INTERMEDIATE_COOKBOOK.adoc | 2 + fogbinder/docs/cookbooks/README.adoc | 2 + fogbinder/ffi/zig/build.zig | 3 +- fogbinder/ffi/zig/src/main.zig | 3 +- fogbinder/ffi/zig/test/integration_test.zig | 3 +- fogbinder/formal-verification/README.adoc | 2 + fogbinder/security/AUDIT_CHECKLIST.adoc | 2 + .../security/BROWSER_FUTUREPROOFING.adoc | 2 + fogbinder/security/CRYPTOGRAPHY.adoc | 2 + fogbinder/security/GIT_SSH_CONFIG.adoc | 2 + fogbinder/security/README.adoc | 2 + fogbinder/security/TLS_SSL_CONFIG.adoc | 2 + fogbinder/src/Fogbinder.bs.js | 4 +- fogbinder/src/core/EpistemicState.bs.js | 5 +- fogbinder/src/core/EpistemicState.test.bs.js | 4 +- fogbinder/src/core/FamilyResemblance.bs.js | 5 +- .../src/core/FamilyResemblance.test.bs.js | 4 +- fogbinder/src/core/SpeechAct.bs.js | 5 +- fogbinder/src/core/SpeechAct.test.bs.js | 4 +- .../src/engine/ContradictionDetector.bs.js | 4 +- fogbinder/src/engine/FogTrailVisualizer.bs.js | 4 +- fogbinder/src/engine/MoodScorer.bs.js | 4 +- fogbinder/src/engine/MysteryClustering.bs.js | 4 +- fogbinder/src/main.js | 2 + .../wasm/contradiction_detector/src/lib.rs | 2 + fogbinder/src/wasm/crypto/src/lib.rs | 2 + .../src/wasm/graph_algorithms/src/lib.rs | 2 + .../src/wasm/string_similarity/src/lib.rs | 2 + fogbinder/src/zotero/ZoteroBindings.bs.js | 4 +- fogbinder/src/zotero/zotero_api.js | 2 +- formbd/.github/workflows/casket-pages.yml | 2 + formbd/.github/workflows/codeql.yml | 1 + formbd/.github/workflows/governance.yml | 1 + formbd/.github/workflows/hypatia-scan.yml | 1 + formbd/.github/workflows/scorecard.yml | 1 + formbd/ABI-FFI-README.md | 4 + formbd/CODE_OF_CONDUCT.md | 4 + formbd/CONTRIBUTING.md | 4 + formbd/MAINTAINERS.adoc | 1 + formbd/README.adoc | 3 +- formbd/ROADMAP.adoc | 1 + formbd/RSR_OUTLINE.adoc | 2 + formbd/SECURITY.md | 4 + formbd/contractiles/README.adoc | 2 + .../{k9 => self-validating}/README.adoc | 1 + .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 formbd/docs/CITATIONS.adoc | 2 + formbd/ffi/zig/build.zig | 3 +- formbd/ffi/zig/src/main.zig | 3 +- formbd/ffi/zig/test/integration_test.zig | 3 +- librarian/.github/workflows/casket-pages.yml | 2 + librarian/.github/workflows/codeql.yml | 1 + librarian/.github/workflows/governance.yml | 1 + librarian/.github/workflows/hypatia-scan.yml | 1 + librarian/.github/workflows/scorecard.yml | 1 + librarian/ABI-FFI-README.md | 4 + librarian/CODE_OF_CONDUCT.md | 4 + librarian/CONTRIBUTING.md | 4 + librarian/MAINTAINERS.adoc | 1 + librarian/README.adoc | 3 +- librarian/ROADMAP.adoc | 1 + librarian/RSR_OUTLINE.adoc | 2 + librarian/SECURITY.md | 4 + librarian/contractiles/README.adoc | 2 + .../{k9 => self-validating}/README.adoc | 1 + .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 librarian/docs/CITATIONS.adoc | 2 + librarian/ffi/zig/build.zig | 3 +- librarian/ffi/zig/src/main.zig | 3 +- librarian/ffi/zig/test/integration_test.zig | 3 +- llm-warmup-dev.md | 4 + llm-warmup-user.md | 4 + nesy/.claude/CLAUDE.md | 18 +- nesy/.github/ISSUE_TEMPLATE/bug_report.md | 4 + nesy/.github/ISSUE_TEMPLATE/custom.md | 4 + nesy/.github/ISSUE_TEMPLATE/documentation.md | 4 + .../.github/ISSUE_TEMPLATE/feature_request.md | 4 + nesy/.github/ISSUE_TEMPLATE/question.md | 4 + nesy/.github/workflows/ci.yml | 7 + nesy/.github/workflows/codeql.yml | 1 + .../workflows/comprehensive-quality.yml | 11 ++ nesy/.github/workflows/governance.yml | 1 + nesy/.github/workflows/hypatia-scan.yml | 1 + nesy/.github/workflows/instant-sync.yml | 1 + nesy/.github/workflows/jekyll-gh-pages.yml | 2 + nesy/.github/workflows/mirror.yml | 7 + nesy/.github/workflows/rescript-deno-ci.yml | 2 + nesy/.github/workflows/scorecard-enforcer.yml | 2 + nesy/.github/workflows/scorecard.yml | 1 + nesy/.github/workflows/secret-scanner.yml | 3 + nesy/ABI-FFI-README.md | 4 + nesy/CHANGELOG.adoc | 3 +- nesy/CLAUDE.md | 4 + nesy/CODE_OF_CONDUCT.md | 4 + nesy/CONTRIBUTING.adoc | 3 +- nesy/CONTRIBUTING.md | 4 + nesy/FOGBINDER-HANDOFF.md | 4 + nesy/MAINTAINERS.adoc | 3 +- nesy/MAINTAINERS.md | 4 + nesy/PALIMPSEST.adoc | 2 + nesy/PHILOSOPHY.md | 4 + nesy/README.adoc | 3 +- nesy/ROADMAP.adoc | 1 + nesy/RSR-COMPLIANCE.md | 4 + nesy/RSR_OUTLINE.adoc | 2 + nesy/SECURITY.md | 4 + nesy/TPCF.md | 4 + nesy/contractiles/README.adoc | 2 + .../{k9 => self-validating}/README.adoc | 1 + .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 nesy/docs/CITATIONS.adoc | 2 + .../00-NEUROSYMBOLIC-PLATFORM-OVERVIEW.md | 4 + nesy/ffi/zig/build.zig | 3 +- nesy/ffi/zig/src/main.zig | 3 +- nesy/ffi/zig/test/integration_test.zig | 3 +- nesy/vite.config.js | 2 + nesy/vitest.config.js | 2 + rescript-templater/.claude/CLAUDE.md | 20 +- .../.github/ISSUE_TEMPLATE/bug_report.md | 4 + .../.github/ISSUE_TEMPLATE/custom.md | 4 + .../.github/ISSUE_TEMPLATE/documentation.md | 4 + .../.github/ISSUE_TEMPLATE/feature_request.md | 4 + .../.github/ISSUE_TEMPLATE/question.md | 4 + .../.github/pull_request_template.md | 4 + rescript-templater/.github/workflows/ci.yml | 10 + .../.github/workflows/codeql.yml | 1 + .../workflows/comprehensive-quality.yml | 11 ++ .../.github/workflows/guix-nix-policy.yml | 1 + .../.github/workflows/hypatia-scan.yml | 1 + .../.github/workflows/instant-sync.yml | 1 + .../.github/workflows/jekyll-gh-pages.yml | 2 + .../.github/workflows/mirror.yml | 7 + .../.github/workflows/npm-bun-blocker.yml | 1 + .../.github/workflows/publish.yml | 6 + .../.github/workflows/quality.yml | 2 + .../.github/workflows/release.yml | 4 + .../.github/workflows/rsr-antipattern.yml | 82 +------- .../.github/workflows/scorecard-enforcer.yml | 2 + .../.github/workflows/scorecard.yml | 1 + .../.github/workflows/secret-scanner.yml | 3 + .../.github/workflows/security-policy.yml | 1 + .../.github/workflows/ts-blocker.yml | 1 + .../workflows/wellknown-enforcement.yml | 1 + .../.github/workflows/workflow-linter.yml | 1 + rescript-templater/ABI-FFI-README.md | 4 + rescript-templater/ARCHIVAL.md | 4 + rescript-templater/CHANGELOG.adoc | 1 + rescript-templater/CLAUDE.md | 4 + rescript-templater/CODE_OF_CONDUCT.md | 4 + rescript-templater/CONTRIBUTING.adoc | 1 + rescript-templater/CONTRIBUTING.md | 4 + rescript-templater/FORMAL_VERIFICATION.md | 4 + rescript-templater/GPG_SIGNING.md | 4 + rescript-templater/MAINTAINERS.adoc | 1 + rescript-templater/MAINTAINERS.md | 4 + rescript-templater/PALIMPSEST.adoc | 2 + rescript-templater/PUBLISHING.md | 4 + rescript-templater/README.adoc | 3 +- rescript-templater/ROADMAP.adoc | 1 + rescript-templater/RSR_COMPLIANCE.md | 4 + rescript-templater/RSR_COMPLIANCE_ACTUAL.md | 4 + rescript-templater/RSR_OUTLINE.adoc | 2 + rescript-templater/SECURITY.md | 4 + rescript-templater/TPCF.md | 4 + rescript-templater/contractiles/README.adoc | 2 + .../contractiles/k9/README.adoc | 178 ----------------- .../contractiles/self-validating/README.adoc | 179 ++++++++++++++++++ .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 rescript-templater/docs/CITATIONS.adoc | 2 + rescript-templater/ffi/zig/build.zig | 3 +- rescript-templater/ffi/zig/src/main.zig | 3 +- .../ffi/zig/test/integration_test.zig | 3 +- safe-storage/.claude/CLAUDE.md | 4 + .../.github/ISSUE_TEMPLATE/bug_report.md | 4 + safe-storage/.github/ISSUE_TEMPLATE/custom.md | 4 + .../.github/ISSUE_TEMPLATE/feature_request.md | 4 + safe-storage/.github/workflows/codeql.yml | 1 + safe-storage/.github/workflows/governance.yml | 1 + .../.github/workflows/hypatia-scan.yml | 1 + safe-storage/.github/workflows/mirror.yml | 7 + safe-storage/.github/workflows/scorecard.yml | 1 + .../.github/workflows/secret-scanner.yml | 3 + safe-storage/ABI-FFI-README.md | 4 + safe-storage/CODE_OF_CONDUCT.md | 4 + safe-storage/CONTRIBUTING.md | 4 + safe-storage/MAINTAINERS.adoc | 1 + safe-storage/PALIMPSEST.adoc | 2 + safe-storage/README.adoc | 2 + safe-storage/ROADMAP.adoc | 2 + safe-storage/RSR_OUTLINE.adoc | 2 + safe-storage/SECURITY.md | 4 + safe-storage/contractiles/README.adoc | 2 + safe-storage/contractiles/k9/README.adoc | 178 ----------------- .../contractiles/self-validating/README.adoc | 179 ++++++++++++++++++ .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 safe-storage/docs/CITATIONS.adoc | 2 + safe-storage/ffi/zig/build.zig | 3 +- safe-storage/ffi/zig/src/main.zig | 3 +- .../ffi/zig/test/integration_test.zig | 3 +- voyant-export/.claude/CLAUDE.md | 18 +- .../.github/ISSUE_TEMPLATE/bug_report.md | 4 + .../.github/ISSUE_TEMPLATE/custom.md | 4 + .../.github/ISSUE_TEMPLATE/documentation.md | 4 + .../.github/ISSUE_TEMPLATE/feature_request.md | 4 + .../.github/ISSUE_TEMPLATE/question.md | 4 + voyant-export/.github/workflows/codeql.yml | 1 + .../workflows/comprehensive-quality.yml | 11 ++ .../.github/workflows/governance.yml | 1 + .../.github/workflows/hypatia-scan.yml | 1 + .../.github/workflows/instant-sync.yml | 1 + .../.github/workflows/jekyll-gh-pages.yml | 2 + voyant-export/.github/workflows/mirror.yml | 7 + .../.github/workflows/scorecard-enforcer.yml | 2 + voyant-export/.github/workflows/scorecard.yml | 1 + .../.github/workflows/secret-scanner.yml | 3 + voyant-export/ABI-FFI-README.md | 4 + voyant-export/CODE_OF_CONDUCT.md | 5 +- voyant-export/CONTRIBUTING.adoc | 3 +- voyant-export/CONTRIBUTING.md | 4 + voyant-export/DEVELOPMENT.adoc | 2 + .../ECHIDNA_ARCHITECTURE_UPDATE_3LANG.md | 6 +- voyant-export/HANDOVER_UPDATE_3LANG.md | 4 + voyant-export/MAINTAINERS.adoc | 3 +- voyant-export/MANIFEST_V3_MIGRATION.adoc | 2 + voyant-export/NEXT_STEPS.md | 4 + voyant-export/PALIMPSEST.adoc | 2 + voyant-export/README.adoc | 3 +- voyant-export/README.v3.adoc | 2 + voyant-export/ROADMAP.adoc | 3 +- voyant-export/RSR_OUTLINE.adoc | 2 + voyant-export/SECURITY.md | 5 +- .../accessibility-tools/PROPOSED_STANDARDS.md | 4 + voyant-export/accessibility-tools/README.md | 4 + .../adoption-tracker/scanner.js | 2 + .../accessibility-tools/api-server/server.js | 2 + .../browser-extension/background.js | 2 + .../browser-extension/content.js | 2 + .../browser-extension/popup.js | 2 + .../browser-extension/scanner.js | 2 + .../accessibility-tools/dashboard/scanner.js | 2 + .../github-action/index.js | 2 + voyant-export/bootstrap.js | 1 + voyant-export/contractiles/README.adoc | 2 + voyant-export/contractiles/k9/README.adoc | 178 ----------------- .../contractiles/self-validating/README.adoc | 179 ++++++++++++++++++ .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 voyant-export/docs/CITATIONS.adoc | 2 + voyant-export/ffi/zig/build.zig | 3 +- voyant-export/ffi/zig/src/main.zig | 3 +- .../ffi/zig/test/integration_test.zig | 3 +- voyant-export/old-src/exporter.js | 2 + voyant-export/old-src/format.js | 2 + voyant-export/old-src/index.js | 2 + voyant-export/old-src/test/test-format.js | 2 + voyant-export/old-src/ui.js | 2 + voyant-export/old-src/utils.js | 2 + voyant-export/old-src/zotero.js | 2 + zoterho-template/.claude/CLAUDE.md | 18 +- .../.github/ISSUE_TEMPLATE/bug_report.md | 4 + .../.github/ISSUE_TEMPLATE/custom.md | 4 + .../.github/ISSUE_TEMPLATE/documentation.md | 4 + .../.github/ISSUE_TEMPLATE/feature_request.md | 4 + .../.github/ISSUE_TEMPLATE/question.md | 4 + zoterho-template/.github/workflows/codeql.yml | 1 + .../.github/workflows/governance.yml | 1 + .../.github/workflows/hypatia-scan.yml | 1 + .../.github/workflows/instant-sync.yml | 1 + zoterho-template/.github/workflows/mirror.yml | 7 + .../.github/workflows/rescript-deno-ci.yml | 2 + .../.github/workflows/scorecard.yml | 1 + .../.github/workflows/secret-scanner.yml | 3 + zoterho-template/ABI-FFI-README.md | 4 + zoterho-template/CODE_OF_CONDUCT.md | 5 +- zoterho-template/CONTRIBUTING.adoc | 3 +- zoterho-template/CONTRIBUTING.md | 4 + zoterho-template/MAINTAINERS.adoc | 3 +- zoterho-template/README.adoc | 2 + zoterho-template/ROADMAP.adoc | 3 +- zoterho-template/RSR_OUTLINE.adoc | 2 + zoterho-template/SECURITY.md | 5 +- zoterho-template/contractiles/README.adoc | 2 + zoterho-template/contractiles/k9/README.adoc | 178 ----------------- .../contractiles/self-validating/README.adoc | 179 ++++++++++++++++++ .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 zoterho-template/docs/CITATIONS.adoc | 2 + zoterho-template/ffi/zig/build.zig | 3 +- zoterho-template/ffi/zig/src/main.zig | 3 +- .../ffi/zig/test/integration_test.zig | 3 +- zoterho/.claude/CLAUDE.md | 18 +- zoterho/.github/workflows/codeql.yml | 1 + zoterho/.github/workflows/governance.yml | 1 + zoterho/.github/workflows/hypatia-scan.yml | 1 + zoterho/.github/workflows/instant-sync.yml | 1 + zoterho/.github/workflows/mirror.yml | 7 + zoterho/.github/workflows/policy-check.yml | 2 + zoterho/.github/workflows/scorecard.yml | 1 + zoterho/.github/workflows/secret-scanner.yml | 3 + zoterho/.github/workflows/semgrep.yml | 1 + zoterho/ABI-FFI-README.md | 4 + zoterho/CODE_OF_CONDUCT.md | 5 +- zoterho/CONTRIBUTING.adoc | 1 + zoterho/CONTRIBUTING.md | 4 + zoterho/MAINTAINERS.adoc | 1 + zoterho/README.adoc | 1 + zoterho/ROADMAP.adoc | 1 + zoterho/RSR_OUTLINE.adoc | 2 + zoterho/SECURITY.md | 5 +- zoterho/contractiles/README.adoc | 2 + zoterho/contractiles/k9/README.adoc | 178 ----------------- .../contractiles/self-validating/README.adoc | 179 ++++++++++++++++++ .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 zoterho/docs/CITATIONS.adoc | 2 + zoterho/ffi/zig/build.zig | 3 +- zoterho/ffi/zig/src/main.zig | 3 +- zoterho/ffi/zig/test/integration_test.zig | 3 +- zoterho/src/abi/Foreign.idr | 2 + zoterho/src/abi/Layout.idr | 2 + zoterho/src/abi/Types.idr | 2 + zotpress/.claude/CLAUDE.md | 18 +- zotpress/.github/ISSUE_TEMPLATE/bug_report.md | 4 + zotpress/.github/ISSUE_TEMPLATE/custom.md | 4 + .../.github/ISSUE_TEMPLATE/documentation.md | 4 + .../.github/ISSUE_TEMPLATE/feature_request.md | 4 + zotpress/.github/ISSUE_TEMPLATE/question.md | 4 + zotpress/.github/workflows/casket-pages.yml | 2 + zotpress/.github/workflows/codeql.yml | 1 + zotpress/.github/workflows/governance.yml | 1 + zotpress/.github/workflows/hypatia-scan.yml | 1 + zotpress/.github/workflows/instant-sync.yml | 1 + .../.github/workflows/jekyll-gh-pages.yml | 2 + zotpress/.github/workflows/mirror.yml | 7 + zotpress/.github/workflows/php-standards.yml | 7 + .../.github/workflows/scorecard-enforcer.yml | 2 + zotpress/.github/workflows/scorecard.yml | 1 + zotpress/.github/workflows/secret-scanner.yml | 3 + .../.github/workflows/security-analysis.yml | 2 + zotpress/.github/workflows/test.yml | 6 + zotpress/.meta/REQUIRED-FILES.md | 4 + zotpress/ABI-FFI-README.md | 4 + zotpress/CHANGELOG.adoc | 1 + zotpress/CODE_OF_CONDUCT.md | 4 + zotpress/CONTRIBUTING.md | 4 + zotpress/MAINTAINERS.adoc | 1 + zotpress/PALIMPSEST.adoc | 2 + zotpress/PRIORITY.adoc | 1 + zotpress/README.adoc | 2 + zotpress/ROADMAP.adoc | 1 + zotpress/RSR_OUTLINE.adoc | 2 + zotpress/SECURITY.md | 4 + zotpress/contractiles/README.adoc | 2 + zotpress/contractiles/k9/README.adoc | 178 ----------------- .../contractiles/self-validating/README.adoc | 179 ++++++++++++++++++ .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 zotpress/demo/README.md | 4 + zotpress/docs/CITATIONS.adoc | 2 + zotpress/docs/SECURITY-INTEGRATION-REPORT.md | 4 + zotpress/ffi/zig/build.zig | 3 +- zotpress/ffi/zig/src/main.zig | 3 +- zotpress/ffi/zig/test/integration_test.zig | 3 +- zotpress/scripts/build-css.js | 2 + zotpress/scripts/build-js.js | 2 + zotpress/scripts/build.js | 2 + 498 files changed, 2388 insertions(+), 1390 deletions(-) create mode 100644 .machine_readable/6a2/0-AI-MANIFEST.a2ml create mode 100644 .machine_readable/6a2/README.adoc create mode 100644 .machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml rename .machine_readable/{anchors => 6a2/anchor}/ANCHOR.a2ml (100%) create mode 100644 .machine_readable/6a2/anchor/README.adoc rename fogbinder/contractiles/{k9 => self-validating}/README.adoc (98%) rename fogbinder/contractiles/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename fogbinder/contractiles/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename fogbinder/contractiles/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename fogbinder/contractiles/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename fogbinder/contractiles/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename fogbinder/contractiles/{k9 => self-validating}/template-yard.k9.ncl (100%) rename formbd/contractiles/{k9 => self-validating}/README.adoc (98%) rename formbd/contractiles/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename formbd/contractiles/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename formbd/contractiles/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename formbd/contractiles/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename formbd/contractiles/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename formbd/contractiles/{k9 => self-validating}/template-yard.k9.ncl (100%) rename librarian/contractiles/{k9 => self-validating}/README.adoc (98%) rename librarian/contractiles/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename librarian/contractiles/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename librarian/contractiles/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename librarian/contractiles/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename librarian/contractiles/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename librarian/contractiles/{k9 => self-validating}/template-yard.k9.ncl (100%) rename nesy/contractiles/{k9 => self-validating}/README.adoc (98%) rename nesy/contractiles/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename nesy/contractiles/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename nesy/contractiles/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename nesy/contractiles/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename nesy/contractiles/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename nesy/contractiles/{k9 => self-validating}/template-yard.k9.ncl (100%) delete mode 100644 rescript-templater/contractiles/k9/README.adoc create mode 100644 rescript-templater/contractiles/self-validating/README.adoc rename rescript-templater/contractiles/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename rescript-templater/contractiles/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename rescript-templater/contractiles/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename rescript-templater/contractiles/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename rescript-templater/contractiles/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename rescript-templater/contractiles/{k9 => self-validating}/template-yard.k9.ncl (100%) delete mode 100644 safe-storage/contractiles/k9/README.adoc create mode 100644 safe-storage/contractiles/self-validating/README.adoc rename safe-storage/contractiles/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename safe-storage/contractiles/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename safe-storage/contractiles/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename safe-storage/contractiles/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename safe-storage/contractiles/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename safe-storage/contractiles/{k9 => self-validating}/template-yard.k9.ncl (100%) delete mode 100644 voyant-export/contractiles/k9/README.adoc create mode 100644 voyant-export/contractiles/self-validating/README.adoc rename voyant-export/contractiles/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename voyant-export/contractiles/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename voyant-export/contractiles/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename voyant-export/contractiles/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename voyant-export/contractiles/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename voyant-export/contractiles/{k9 => self-validating}/template-yard.k9.ncl (100%) delete mode 100644 zoterho-template/contractiles/k9/README.adoc create mode 100644 zoterho-template/contractiles/self-validating/README.adoc rename zoterho-template/contractiles/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename zoterho-template/contractiles/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename zoterho-template/contractiles/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename zoterho-template/contractiles/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename zoterho-template/contractiles/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename zoterho-template/contractiles/{k9 => self-validating}/template-yard.k9.ncl (100%) delete mode 100644 zoterho/contractiles/k9/README.adoc create mode 100644 zoterho/contractiles/self-validating/README.adoc rename zoterho/contractiles/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename zoterho/contractiles/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename zoterho/contractiles/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename zoterho/contractiles/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename zoterho/contractiles/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename zoterho/contractiles/{k9 => self-validating}/template-yard.k9.ncl (100%) delete mode 100644 zotpress/contractiles/k9/README.adoc create mode 100644 zotpress/contractiles/self-validating/README.adoc rename zotpress/contractiles/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename zotpress/contractiles/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename zotpress/contractiles/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename zotpress/contractiles/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename zotpress/contractiles/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename zotpress/contractiles/{k9 => self-validating}/template-yard.k9.ncl (100%) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index dba7fc8..bda0eec 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -7,6 +7,7 @@ on: jobs: trigger-boj: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index ad8fd14..87c1e3f 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -18,6 +18,7 @@ concurrency: jobs: build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -109,6 +110,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: - name: Deploy to GitHub Pages diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index b4062e0..a044174 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -24,3 +24,4 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 + timeout-minutes: 10 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index c68b9ed..a711616 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -25,5 +25,6 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242 + timeout-minutes: 10 secrets: inherit diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 228dc43..01646a7 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 2083ca6..ee8ea02 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -12,4 +12,5 @@ permissions: jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f + timeout-minutes: 10 secrets: inherit diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index 75e2385..50d765e 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -33,6 +33,7 @@ jobs: # uses-only; `check-score` is the gating job that emits the error. scorecard: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write # For OIDC @@ -63,6 +64,7 @@ jobs: check-score: needs: scorecard runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: @@ -88,6 +90,7 @@ jobs: # Check specific high-priority items check-critical: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 097d2af..c7761fe 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -16,4 +16,5 @@ permissions: jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0 + timeout-minutes: 10 secrets: inherit diff --git a/.machine_readable/6a2/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/0-AI-MANIFEST.a2ml new file mode 100644 index 0000000..6bf1f8c --- /dev/null +++ b/.machine_readable/6a2/0-AI-MANIFEST.a2ml @@ -0,0 +1,31 @@ +# AI Manifest for 6a2 Directory + +## Purpose + +This manifest declares the AI-assistant context for the 6a2 machine-readable metadata directory. + +## Canonical Locations + +The 6 core A2ML files MUST exist in this directory: +1. AGENTIC.a2ml +2. ECOSYSTEM.a2ml +3. META.a2ml +4. NEUROSYM.a2ml +5. PLAYBOOK.a2ml +6. STATE.a2ml + +## Invariants + +- No duplicate files in root directory +- Single source of truth: this directory is authoritative +- No stale metadata + +## Protocol + +When multiple agents may write to A2ML files concurrently: +1. Read file and record git-sha-at-read in [provenance] section +2. Lock by creating .lock- +3. Write updated file with new [provenance] metadata +4. Release by removing lock file +5. On conflict: re-read and retry if git-sha-at-read does not match HEAD + diff --git a/.machine_readable/6a2/README.adoc b/.machine_readable/6a2/README.adoc new file mode 100644 index 0000000..bc033d7 --- /dev/null +++ b/.machine_readable/6a2/README.adoc @@ -0,0 +1,30 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +# A2ML 6a2 Directory + +This directory contains the 6 core A2ML machine-readable metadata files for this repository. + +## Files + +- `AGENTIC.a2ml` - AI agent operational gating, safety controls +- `ECOSYSTEM.a2ml` - Project ecosystem position, relationships, explicit boundaries +- `META.a2ml` - Architecture decisions (ADRs), development practices, design rationale +- `NEUROSYM.a2ml` - Symbolic semantics, composition algebra +- `PLAYBOOK.a2ml` - Executable plans, operational runbooks +- `STATE.a2ml` - Project state, phase, milestones, session history + +## Standards Compliance + +These files follow the A2ML Format Family specification from: +https://github.com/hyperpolymath/standards/tree/main/a2ml + +## Generation + +These files may be generated from .scm source files using transpilation tools. +Source .scm files should be removed after successful transpilation. + +## See Also + +- [A2ML Repository Template](https://github.com/hyperpolymath/standards/blob/main/A2ML-REPO-TEMPLATE.adoc) +- [6A2 Format Family](https://github.com/hyperpolymath/standards#a2ml-format-family-7-formats) + diff --git a/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml new file mode 100644 index 0000000..0dd6825 --- /dev/null +++ b/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml @@ -0,0 +1,21 @@ +# AI Manifest for Anchor Directory + +## Purpose + +This manifest declares the AI-assistant context for the anchor machine-readable metadata directory. + +## Canonical Locations + +ANCHOR.a2ml files MUST exist in this directory. + +## Multiple Versions + +Unlike other A2ML files, multiple versions of ANCHOR.a2ml with different dates MAY exist. +Each version represents a specific recalibration point. + +## Invariants + +- Multiple versions with different dates are permitted +- No other A2ML files in this directory +- Single source of truth for anchor documents + diff --git a/.machine_readable/anchors/ANCHOR.a2ml b/.machine_readable/6a2/anchor/ANCHOR.a2ml similarity index 100% rename from .machine_readable/anchors/ANCHOR.a2ml rename to .machine_readable/6a2/anchor/ANCHOR.a2ml diff --git a/.machine_readable/6a2/anchor/README.adoc b/.machine_readable/6a2/anchor/README.adoc new file mode 100644 index 0000000..bd23e35 --- /dev/null +++ b/.machine_readable/6a2/anchor/README.adoc @@ -0,0 +1,25 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +# A2ML Anchor Directory + +This directory contains ANCHOR.a2ml files for project recalibration and scope intervention. + +## Files + +- `ANCHOR.a2ml` - Project recalibration, scope intervention, canonical authority + +## Multiple Versions + +Unlike other A2ML files, multiple versions of ANCHOR.a2ml with different dates may exist. +Each version represents a specific recalibration point in the project history. + +## Standards Compliance + +These files follow the ANCHOR.a2ml specification from: +https://github.com/hyperpolymath/standards/tree/main/anchor-a2ml + +## See Also + +- [A2ML Repository Template](https://github.com/hyperpolymath/standards/blob/main/A2ML-REPO-TEMPLATE.adoc) +- [Anchor A2ML Spec](https://github.com/hyperpolymath/standards/tree/main/anchor-a2ml) + diff --git a/.machine_readable/agent_instructions/README.adoc b/.machine_readable/agent_instructions/README.adoc index 9bc2e24..e5fec01 100644 --- a/.machine_readable/agent_instructions/README.adoc +++ b/.machine_readable/agent_instructions/README.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell = Agent Instructions :toc: preamble diff --git a/CHANGELOG.md b/CHANGELOG.md index 2937657..9279cc9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,8 +1,7 @@ - # Changelog All notable changes to `zotero-tools` will be documented in this file. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 5ae1040..a66984a 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -1,3 +1,7 @@ + # Code of Conduct # Clone the repository git clone https://github.com/hyperpolymath/language-bridges.git cd language-bridges diff --git a/EXPLAINME.adoc b/EXPLAINME.adoc index 2af6210..a2293f9 100644 --- a/EXPLAINME.adoc +++ b/EXPLAINME.adoc @@ -1,5 +1,8 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = zotero-tools — Show Me The Receipts +image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[License: MPL-2.0,link="https://opensource.org/licenses/MPL-2.0"] + :toc: :icons: font @@ -22,3 +25,10 @@ ____ == Questions? Open an issue or reach out directly — happy to explain anything in more detail. + + +== License + +This project is licensed under the Mozilla Public License, v. 2.0. See the `LICENSE` file for details. + +SPDX-License-Identifier: MPL-2.0 diff --git a/LICENSE b/LICENSE index 4a7f1aa..d0a1fa1 100644 --- a/LICENSE +++ b/LICENSE @@ -1,38 +1,3 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) - ------------------------------------------------------------------------- -PREFERRED LICENCE: Palimpsest License (MPL-2.0) ------------------------------------------------------------------------- - -This work is governed by the Palimpsest License (MPL-2.0) as -its primary intended licence. MPL-2.0 extends the Mozilla -Public License 2.0 (MPL-2.0) with additional provisions for ethical use, -post-quantum cryptographic provenance, and emotional lineage protection. -The canonical PMPL text and stewardship information are maintained at: - https://github.com/hyperpolymath/palimpsest-license - ------------------------------------------------------------------------- -FALLBACK LICENCE: Mozilla Public License 2.0 (MPL-2.0) ------------------------------------------------------------------------- - -Because MPL-2.0 is not yet recognised by the Open Source -Initiative (OSI) or equivalent bodies, this work also carries MPL-2.0 -as its legally-recognised fallback licence. - -In any jurisdiction, platform, or context where MPL-2.0 is -not accepted as a valid licence, or where an OSI-approved licence is -required, this work is instead governed by the Mozilla Public License, -Version 2.0. - -MPL-2.0 was chosen as the fallback because MPL-2.0 is -explicitly based on and extends MPL-2.0; it is therefore the closest -recognised equivalent to the intended licence. - -The complete MPL-2.0 text follows below. - ------------------------------------------------------------------------- - Mozilla Public License Version 2.0 ================================== @@ -109,17 +74,17 @@ Mozilla Public License Version 2.0 means the form of the work preferred for making modifications. 1.14. "You" (or "Your") - means an individual or a legal entity exercising rights under - this License. For legal entities, "You" includes any entity that - controls, is controlled by, or is under common control with You. - For the purposes of this definition, "control" means (a) the power, - direct or indirect, to cause the direction or management of such - entity, whether by contract or otherwise, or (b) ownership of more - than fifty percent (50%) of the outstanding shares or beneficial + means an individual or a legal entity exercising rights under this + License. For legal entities, "You" includes any entity that + controls, is controlled by, or is under common control with You. For + purposes of this definition, "control" means (a) the power, direct + or indirect, to cause the direction or management of such entity, + whether by contract or otherwise, or (b) ownership of more than + fifty percent (50%) of the outstanding shares or beneficial ownership of such entity. 2. License Grants and Conditions ---------------------------------- +-------------------------------- 2.1. Grants @@ -144,11 +109,11 @@ distributes such Contribution. 2.3. Limitations on Grant Scope -The licenses granted in this Section 2 are the only rights granted -under this License. No additional rights or licenses will be implied -from the distribution or licensing of Covered Software under this -License. Notwithstanding Section 2.1(b) above, no patent license is -granted by a Contributor: +The licenses granted in this Section 2 are the only rights granted under +this License. No additional rights or licenses will be implied from the +distribution or licensing of Covered Software under this License. +Notwithstanding Section 2.1(b) above, no patent license is granted by a +Contributor: (a) for any code that a Contributor has removed from Covered Software; or @@ -158,19 +123,19 @@ granted by a Contributor: Contributions with other software (except as part of its Contributor Version); or -(c) under Patent Claims infringed by Covered Software in the absence - of its Contributions. +(c) under Patent Claims infringed by Covered Software in the absence of + its Contributions. -This License does not grant any rights in the trademarks, service -marks, or logos of any Contributor (except as may be necessary to -comply with the notice requirements in Section 3.4). +This License does not grant any rights in the trademarks, service marks, +or logos of any Contributor (except as may be necessary to comply with +the notice requirements in Section 3.4). 2.4. Subsequent Licenses No Contributor makes additional grants as a result of Your choice to distribute the Covered Software under a subsequent version of this -License (see Section 10.2) or under the terms of a Secondary License -(if permitted under the terms of Section 3.3). +License (see Section 10.2) or under the terms of a Secondary License (if +permitted under the terms of Section 3.3). 2.5. Representation @@ -186,11 +151,11 @@ equivalents. 2.7. Conditions -Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses -granted in Section 2.1. +Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted +in Section 2.1. 3. Responsibilities --------------------- +------------------- 3.1. Distribution of Source Form @@ -207,10 +172,10 @@ Form. If You distribute Covered Software in Executable Form then: (a) such Covered Software must also be made available in Source Code - Form, as described in Section 3.1, and You must inform recipients - of the Executable Form how they can obtain a copy of such Source - Code Form by reasonable means in a timely manner, at a charge no - more than the cost of distribution to the recipient; and + Form, as described in Section 3.1, and You must inform recipients of + the Executable Form how they can obtain a copy of such Source Code + Form by reasonable means in a timely manner, at a charge no more + than the cost of distribution to the recipient; and (b) You may distribute such Executable Form under the terms of this License, or sublicense it under different terms, provided that the @@ -222,8 +187,8 @@ If You distribute Covered Software in Executable Form then: You may create and distribute a Larger Work under terms of Your choice, provided that You also comply with the requirements of this License for the Covered Software. If the Larger Work is a combination of Covered -Software with a work governed by one or more Secondary Licenses, and -the Covered Software is not Incompatible With Secondary Licenses, this +Software with a work governed by one or more Secondary Licenses, and the +Covered Software is not Incompatible With Secondary Licenses, this License permits You to additionally distribute such Covered Software under the terms of such Secondary License(s), so that the recipient of the Larger Work may, at their option, further distribute the Covered @@ -241,28 +206,28 @@ the extent required to remedy known factual inaccuracies. 3.5. Application of Additional Terms You may choose to offer, and to charge a fee for, warranty, support, -indemnity or liability obligations to one or more recipients of -Covered Software. However, You may do so only on Your own behalf, and -not on behalf of any Contributor. You must make it absolutely clear -that any such warranty, support, indemnity, or liability obligation is -offered by You alone, and You hereby agree to indemnify every -Contributor for any liability incurred by such Contributor as a result -of warranty, support, indemnity or liability terms You offer. You may -include additional disclaimers of warranty and limitations of liability -specific to any jurisdiction. +indemnity or liability obligations to one or more recipients of Covered +Software. However, You may do so only on Your own behalf, and not on +behalf of any Contributor. You must make it absolutely clear that any +such warranty, support, indemnity, or liability obligation is offered by +You alone, and You hereby agree to indemnify every Contributor for any +liability incurred by such Contributor as a result of warranty, support, +indemnity or liability terms You offer. You may include additional +disclaimers of warranty and limitations of liability specific to any +jurisdiction. 4. Inability to Comply Due to Statute or Regulation ------------------------------------------------------ +--------------------------------------------------- If it is impossible for You to comply with any of the terms of this License with respect to some or all of the Covered Software due to statute, judicial order, or regulation then You must: (a) comply with the terms of this License to the maximum extent possible; and (b) -describe the limitations and the code they affect. Such description -must be placed in a text file included with all distributions of the -Covered Software under this License. Except to the extent prohibited -by statute or regulation, such description must be sufficiently -detailed for a recipient of ordinary skill to be able to understand it. +describe the limitations and the code they affect. Such description must +be placed in a text file included with all distributions of the Covered +Software under this License. Except to the extent prohibited by statute +or regulation, such description must be sufficiently detailed for a +recipient of ordinary skill to be able to understand it. 5. Termination -------------- @@ -271,27 +236,27 @@ detailed for a recipient of ordinary skill to be able to understand it. if You fail to comply with any of its terms. However, if You become compliant, then the rights granted under this License from a particular Contributor are reinstated (a) provisionally, unless and until such -Contributor explicitly and finally terminates Your grants, and (b) on -an ongoing basis, if such Contributor fails to notify You of the +Contributor explicitly and finally terminates Your grants, and (b) on an +ongoing basis, if such Contributor fails to notify You of the non-compliance by some reasonable means prior to 60 days after You have come back into compliance. Moreover, Your grants from a particular Contributor are reinstated on an ongoing basis if such Contributor -notifies You of the non-compliance by some reasonable means, this is -the first time You have received notice of non-compliance with this -License from such Contributor, and You become compliant prior to 30 -days after Your receipt of the notice. +notifies You of the non-compliance by some reasonable means, this is the +first time You have received notice of non-compliance with this License +from such Contributor, and You become compliant prior to 30 days after +Your receipt of the notice. -5.2. If You initiate litigation against any entity by asserting a -patent infringement claim (excluding declaratory judgment actions, +5.2. If You initiate litigation against any entity by asserting a patent +infringement claim (excluding declaratory judgment actions, counter-claims, and cross-claims) alleging that a Contributor Version directly or indirectly infringes any patent, then the rights granted to You by any and all Contributors for the Covered Software under Section 2.1 of this License shall terminate. 5.3. In the event of termination under Sections 5.1 or 5.2 above, all -end user license agreements (excluding distributors and resellers) -which have been validly granted by You or Your distributors under this -License prior to termination shall survive termination. +end user license agreements (excluding distributors and resellers) which +have been validly granted by You or Your distributors under this License +prior to termination shall survive termination. ************************************************************************ * * @@ -346,7 +311,7 @@ Nothing in this Section shall prevent a party's ability to bring cross-claims or counter-claims. 9. Miscellaneous ------------------ +---------------- This License represents the complete agreement concerning the subject matter hereof. If any provision of this License is held to be @@ -356,14 +321,14 @@ that the language of a contract shall be construed against the drafter shall not be used to construe this License against a Contributor. 10. Versions of the License ----------------------------- +--------------------------- 10.1. New Versions -Mozilla Foundation is the license steward. Except as provided in -Section 10.3, no one other than the license steward has the right to -modify or publish new versions of this License. Each version will be -given a distinguishing version number. +Mozilla Foundation is the license steward. Except as provided in Section +10.3, no one other than the license steward has the right to modify or +publish new versions of this License. Each version will be given a +distinguishing version number. 10.2. Effect of New Versions @@ -392,17 +357,17 @@ Exhibit A - Source Code Form License Notice This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this - file, You can obtain one at http://mozilla.org/MPL/2.0/. + file, You can obtain one at https://mozilla.org/MPL/2.0/. If it is not possible or desirable to put the notice in a particular file, then You may include the notice in a location (such as a LICENSE -file in a relevant directory) where a recipient would be likely to -look for such a notice. +file in a relevant directory) where a recipient would be likely to look +for such a notice. You may add additional accurate notices of copyright ownership. Exhibit B - "Incompatible With Secondary Licenses" Notice ----------------------------------------------------------- +--------------------------------------------------------- This Source Code Form is "Incompatible With Secondary Licenses", as defined by the Mozilla Public License, v. 2.0. diff --git a/PROOF-NEEDS.md b/PROOF-NEEDS.md index 8950320..566ed20 100644 --- a/PROOF-NEEDS.md +++ b/PROOF-NEEDS.md @@ -1,3 +1,7 @@ + # PROOF-NEEDS.md ## Template ABI Cleanup (2026-03-29) diff --git a/QUICKSTART-DEV.adoc b/QUICKSTART-DEV.adoc index 3b134f0..90a5a51 100644 --- a/QUICKSTART-DEV.adoc +++ b/QUICKSTART-DEV.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Template: QUICKSTART-DEV.adoc — clone → build → test → PR // Replace zotero-tools, {{BUILD_CMD}}, {{TEST_CMD}}, {{LANG_STACK}} with actuals = zotero-tools — Quick Start for Developers diff --git a/QUICKSTART-MAINTAINER.adoc b/QUICKSTART-MAINTAINER.adoc index 9ff8716..c698386 100644 --- a/QUICKSTART-MAINTAINER.adoc +++ b/QUICKSTART-MAINTAINER.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Template: QUICKSTART-MAINTAINER.adoc — packaging, deploying, and maintaining // Replace zotero-tools, {{PACKAGE_NAME}}, {{DEPS}} with actuals = zotero-tools — Quick Start for Platform Maintainers diff --git a/QUICKSTART-USER.adoc b/QUICKSTART-USER.adoc index bb80d40..f7d0455 100644 --- a/QUICKSTART-USER.adoc +++ b/QUICKSTART-USER.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Template: QUICKSTART-USER.adoc — 5-minute path to working software // Replace zotero-tools, Zotero Tools — See README.adoc for details., just run, Zotero Tools started successfully. with actuals = zotero-tools — Quick Start for Users diff --git a/SECURITY.md b/SECURITY.md index 7fb2778..ef33d60 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,3 +1,7 @@ + # Security Policy # TEST-NEEDS.md — zotero-tools ## CRG Grade: C — ACHIEVED 2026-04-04 diff --git a/TOPOLOGY.md b/TOPOLOGY.md index 3995d7f..c9b7c4f 100644 --- a/TOPOLOGY.md +++ b/TOPOLOGY.md @@ -1,4 +1,7 @@ - + diff --git a/docs/architecture.adoc b/docs/architecture.adoc index c11b146..dd69237 100644 --- a/docs/architecture.adoc +++ b/docs/architecture.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <6759885+hyperpolymath@users.noreply.github.com> = Architecture — zotero-tools :revdate: 2026-MM-DD diff --git a/docs/contributing.adoc b/docs/contributing.adoc index d56c1d8..96d09bb 100644 --- a/docs/contributing.adoc +++ b/docs/contributing.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <6759885+hyperpolymath@users.noreply.github.com> = Contributing — zotero-tools :revdate: 2026-MM-DD diff --git a/docs/decisions/0001-template.adoc b/docs/decisions/0001-template.adoc index 1f128dd..02ede78 100644 --- a/docs/decisions/0001-template.adoc +++ b/docs/decisions/0001-template.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <6759885+hyperpolymath@users.noreply.github.com> = ADR-0001 — Use Architecture Decision Records :revdate: 2026-MM-DD diff --git a/docs/tech-debt-2026-05-26.md b/docs/tech-debt-2026-05-26.md index db85dad..fab5dac 100644 --- a/docs/tech-debt-2026-05-26.md +++ b/docs/tech-debt-2026-05-26.md @@ -1,8 +1,7 @@ - # Tech-Debt Audit — zotero-tools — 2026-05-26 **Source:** estate-wide automated scan 2026-05-26. diff --git a/docs/troubleshooting.adoc b/docs/troubleshooting.adoc index f1c105a..4085aa8 100644 --- a/docs/troubleshooting.adoc +++ b/docs/troubleshooting.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <6759885+hyperpolymath@users.noreply.github.com> = Troubleshooting — zotero-tools :revdate: 2026-MM-DD diff --git a/docs/usage.adoc b/docs/usage.adoc index 1699eb6..b48b877 100644 --- a/docs/usage.adoc +++ b/docs/usage.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <6759885+hyperpolymath@users.noreply.github.com> = Usage — zotero-tools :revdate: 2026-MM-DD diff --git a/fogbinder/.claude/CLAUDE.md b/fogbinder/.claude/CLAUDE.md index c1e738f..78748de 100644 --- a/fogbinder/.claude/CLAUDE.md +++ b/fogbinder/.claude/CLAUDE.md @@ -1,3 +1,7 @@ + # CLAUDE.md - AI Assistant Instructions ## Language Policy (Hyperpolymath Standard) @@ -6,14 +10,14 @@ | Language/Tool | Use Case | Notes | |---------------|----------|-------| -| **ReScript** | Primary application code | Compiles to JS, type-safe | +| **AffineScript** | Primary application code | Compiles to JS, type-safe | | **Deno** | Runtime & package management | Replaces Node/npm/bun | | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools | | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI | | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like | | **Gleam** | Backend services | Runs on BEAM or compiles to JS | | **Bash/POSIX Shell** | Scripts, automation | Keep minimal | -| **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs | +| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs | | **Python** | SaltStack only | No other Python permitted | | **Nickel** | Configuration language | For complex configs | | **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm | @@ -25,13 +29,13 @@ | Banned | Replacement | |--------|-------------| -| TypeScript | ReScript | +| TypeScript | AffineScript | | Node.js | Deno | | npm | Deno | | Bun | Deno | | pnpm/yarn | Deno | | Go | Rust | -| Python (general) | ReScript/Rust | +| Python (general) | AffineScript/Rust | | Java/Kotlin | Rust/Tauri/Dioxus | | Swift | Tauri/Dioxus | | React Native | Tauri/Dioxus | @@ -41,15 +45,15 @@ **No exceptions for Kotlin/Swift** - use Rust-first approach: -1. **Tauri 2.0+** - Web UI (ReScript) + Rust backend, MIT/Apache-2.0 +1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0 2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0 Both are FOSS with independent governance (no Big Tech). ### Enforcement Rules -1. **No new TypeScript files** - Convert existing TS to ReScript -2. **No package.json for runtime deps** - Use deno.json imports +1. **No new TypeScript files** - Convert existing TS to AffineScript +2. **No package.json - use deno.json deps** - Use deno.json imports 3. **No node_modules in production** - Deno caches deps automatically 4. **No Go code** - Use Rust instead 5. **Python only for SaltStack** - All other Python must be rewritten diff --git a/fogbinder/.github/ISSUE_TEMPLATE/bug_report.md b/fogbinder/.github/ISSUE_TEMPLATE/bug_report.md index 987aab6..45a6c02 100644 --- a/fogbinder/.github/ISSUE_TEMPLATE/bug_report.md +++ b/fogbinder/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,3 +1,7 @@ + --- name: Bug report about: Create a report to help us improve diff --git a/fogbinder/.github/ISSUE_TEMPLATE/custom.md b/fogbinder/.github/ISSUE_TEMPLATE/custom.md index 48d5f81..99ebf00 100644 --- a/fogbinder/.github/ISSUE_TEMPLATE/custom.md +++ b/fogbinder/.github/ISSUE_TEMPLATE/custom.md @@ -1,3 +1,7 @@ + --- name: Custom issue template about: Describe this issue template's purpose here. diff --git a/fogbinder/.github/ISSUE_TEMPLATE/documentation.md b/fogbinder/.github/ISSUE_TEMPLATE/documentation.md index 4fcb9f9..b1d16df 100644 --- a/fogbinder/.github/ISSUE_TEMPLATE/documentation.md +++ b/fogbinder/.github/ISSUE_TEMPLATE/documentation.md @@ -1,3 +1,7 @@ + --- name: Documentation about: Report unclear, missing, or incorrect documentation diff --git a/fogbinder/.github/ISSUE_TEMPLATE/feature_request.md b/fogbinder/.github/ISSUE_TEMPLATE/feature_request.md index 3e8fa7e..a5a5693 100644 --- a/fogbinder/.github/ISSUE_TEMPLATE/feature_request.md +++ b/fogbinder/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,3 +1,7 @@ + --- name: Feature request about: Suggest an idea for this project diff --git a/fogbinder/.github/ISSUE_TEMPLATE/question.md b/fogbinder/.github/ISSUE_TEMPLATE/question.md index fd0e2a5..c2d1f57 100644 --- a/fogbinder/.github/ISSUE_TEMPLATE/question.md +++ b/fogbinder/.github/ISSUE_TEMPLATE/question.md @@ -1,3 +1,7 @@ + --- name: Question about: Ask a question about usage or behaviour diff --git a/fogbinder/.github/workflows/ci.yml b/fogbinder/.github/workflows/ci.yml index dd5f22f..88ff31f 100644 --- a/fogbinder/.github/workflows/ci.yml +++ b/fogbinder/.github/workflows/ci.yml @@ -15,6 +15,7 @@ jobs: test: name: Test runs-on: ubuntu-latest + timeout-minutes: 15 strategy: matrix: deno-version: ['1.40.x', '1.41.x'] @@ -59,6 +60,7 @@ jobs: quality: name: Code Quality runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -87,6 +89,7 @@ jobs: security: name: Security Scan runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -116,6 +119,7 @@ jobs: rsr-compliance: name: RSR Rhodium Compliance runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -144,6 +148,7 @@ jobs: accessibility: name: Accessibility Check runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -158,6 +163,7 @@ jobs: documentation: name: Documentation Check runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -203,6 +209,7 @@ jobs: philosophy: name: Philosophical Integrity runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -217,6 +224,7 @@ jobs: benchmarks: name: Performance Benchmarks runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code diff --git a/fogbinder/.github/workflows/codeql.yml b/fogbinder/.github/workflows/codeql.yml index ad4866a..542e240 100644 --- a/fogbinder/.github/workflows/codeql.yml +++ b/fogbinder/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/fogbinder/.github/workflows/governance.yml b/fogbinder/.github/workflows/governance.yml index b4062e0..a044174 100644 --- a/fogbinder/.github/workflows/governance.yml +++ b/fogbinder/.github/workflows/governance.yml @@ -24,3 +24,4 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 + timeout-minutes: 10 diff --git a/fogbinder/.github/workflows/hypatia-scan.yml b/fogbinder/.github/workflows/hypatia-scan.yml index 5b59919..49e830d 100644 --- a/fogbinder/.github/workflows/hypatia-scan.yml +++ b/fogbinder/.github/workflows/hypatia-scan.yml @@ -17,6 +17,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/fogbinder/.github/workflows/instant-sync.yml b/fogbinder/.github/workflows/instant-sync.yml index 3c78453..45e260a 100644 --- a/fogbinder/.github/workflows/instant-sync.yml +++ b/fogbinder/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 diff --git a/fogbinder/.github/workflows/jekyll-gh-pages.yml b/fogbinder/.github/workflows/jekyll-gh-pages.yml index 11a2df4..8b19021 100644 --- a/fogbinder/.github/workflows/jekyll-gh-pages.yml +++ b/fogbinder/.github/workflows/jekyll-gh-pages.yml @@ -26,6 +26,7 @@ jobs: # Build job build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 @@ -45,6 +46,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: - name: Deploy to GitHub Pages diff --git a/fogbinder/.github/workflows/mirror.yml b/fogbinder/.github/workflows/mirror.yml index e91cbd5..b13a5a0 100644 --- a/fogbinder/.github/workflows/mirror.yml +++ b/fogbinder/.github/workflows/mirror.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: mirror-gitlab: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITLAB_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -30,6 +31,7 @@ jobs: mirror-bitbucket: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.BITBUCKET_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -48,6 +50,7 @@ jobs: mirror-codeberg: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.CODEBERG_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -66,6 +69,7 @@ jobs: mirror-sourcehut: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.SOURCEHUT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -84,6 +88,7 @@ jobs: mirror-disroot: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.DISROOT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -102,6 +107,7 @@ jobs: mirror-gitea: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITEA_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -120,6 +126,7 @@ jobs: mirror-radicle: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.RADICLE_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 diff --git a/fogbinder/.github/workflows/rescript-deno-ci.yml b/fogbinder/.github/workflows/rescript-deno-ci.yml index 7af7e59..e75aec6 100644 --- a/fogbinder/.github/workflows/rescript-deno-ci.yml +++ b/fogbinder/.github/workflows/rescript-deno-ci.yml @@ -7,6 +7,7 @@ permissions: read-all jobs: build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1 @@ -34,6 +35,7 @@ jobs: security: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1 diff --git a/fogbinder/.github/workflows/scorecard-enforcer.yml b/fogbinder/.github/workflows/scorecard-enforcer.yml index 61994c0..c4ff61e 100644 --- a/fogbinder/.github/workflows/scorecard-enforcer.yml +++ b/fogbinder/.github/workflows/scorecard-enforcer.yml @@ -14,6 +14,7 @@ permissions: read-all jobs: scorecard: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write # For OIDC @@ -52,6 +53,7 @@ jobs: # Check specific high-priority items check-critical: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/fogbinder/.github/workflows/scorecard.yml b/fogbinder/.github/workflows/scorecard.yml index 255d808..9413dfe 100644 --- a/fogbinder/.github/workflows/scorecard.yml +++ b/fogbinder/.github/workflows/scorecard.yml @@ -11,6 +11,7 @@ permissions: read-all jobs: analysis: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write diff --git a/fogbinder/.github/workflows/secret-scanner.yml b/fogbinder/.github/workflows/secret-scanner.yml index d975594..c5e240f 100644 --- a/fogbinder/.github/workflows/secret-scanner.yml +++ b/fogbinder/.github/workflows/secret-scanner.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: trufflehog: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: @@ -24,6 +25,7 @@ jobs: gitleaks: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: @@ -37,6 +39,7 @@ jobs: # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/fogbinder/ABI-FFI-README.md b/fogbinder/ABI-FFI-README.md index f06f72c..af300f5 100644 --- a/fogbinder/ABI-FFI-README.md +++ b/fogbinder/ABI-FFI-README.md @@ -1,3 +1,7 @@ + {{~ Aditionally delete this line and fill out the template below ~}} # {{PROJECT}} ABI/FFI Documentation diff --git a/fogbinder/API.adoc b/fogbinder/API.adoc index 527b199..19ba0fe 100644 --- a/fogbinder/API.adoc +++ b/fogbinder/API.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell ## Fogbinder API Documentation Complete API reference for the Fogbinder epistemic analysis engine. diff --git a/fogbinder/ARCHITECTURE_RESCRIPT_WASM.adoc b/fogbinder/ARCHITECTURE_RESCRIPT_WASM.adoc index ea4fb26..0d77c34 100644 --- a/fogbinder/ARCHITECTURE_RESCRIPT_WASM.adoc +++ b/fogbinder/ARCHITECTURE_RESCRIPT_WASM.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Fogbinder Architecture: ReScript + WASM Only **Pure functional architecture with zero TypeScript/Node.js** diff --git a/fogbinder/CHANGELOG.adoc b/fogbinder/CHANGELOG.adoc index 129047d..f02629c 100644 --- a/fogbinder/CHANGELOG.adoc +++ b/fogbinder/CHANGELOG.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Changelog :toc: left :toclevels: 2 diff --git a/fogbinder/CODE_OF_CONDUCT.md b/fogbinder/CODE_OF_CONDUCT.md index 1f1548c..9020def 100644 --- a/fogbinder/CODE_OF_CONDUCT.md +++ b/fogbinder/CODE_OF_CONDUCT.md @@ -1,4 +1,7 @@ - + # Contributor Covenant Code of Conduct ## Our Pledge diff --git a/fogbinder/CONTRIBUTING.adoc b/fogbinder/CONTRIBUTING.adoc index fdda7ec..e774875 100644 --- a/fogbinder/CONTRIBUTING.adoc +++ b/fogbinder/CONTRIBUTING.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contributing to Fogbinder :toc: left :toclevels: 3 diff --git a/fogbinder/CONTRIBUTING.md b/fogbinder/CONTRIBUTING.md index e2e5073..ecc9102 100644 --- a/fogbinder/CONTRIBUTING.md +++ b/fogbinder/CONTRIBUTING.md @@ -1,3 +1,7 @@ + # Clone the repository git clone https://github.com/hyperpolymath/zotero-tools.git cd zotero-tools diff --git a/fogbinder/DEVELOPMENT.adoc b/fogbinder/DEVELOPMENT.adoc index 4c0deca..d7edb32 100644 --- a/fogbinder/DEVELOPMENT.adoc +++ b/fogbinder/DEVELOPMENT.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Fogbinder Development Guide Complete guide for developers working on Fogbinder. diff --git a/fogbinder/GITHUB_PROTECTION_RULES.adoc b/fogbinder/GITHUB_PROTECTION_RULES.adoc index 2774951..cde1786 100644 --- a/fogbinder/GITHUB_PROTECTION_RULES.adoc +++ b/fogbinder/GITHUB_PROTECTION_RULES.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = GitHub Repository Protection Rules :toc: left :toclevels: 3 diff --git a/fogbinder/LICENSE_DUAL.adoc b/fogbinder/LICENSE_DUAL.adoc index 04843a2..7098a87 100644 --- a/fogbinder/LICENSE_DUAL.adoc +++ b/fogbinder/LICENSE_DUAL.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Fogbinder Dual License **Copyright © 2024-2025 Jonathan (Hyperpolymath)** @@ -182,8 +184,6 @@ https://github.com/Hyperpolymath/fogbinder ### For MIT-licensed derivatives ```rescript -// SPDX-License-Identifier: MPL-2.0-or-later -// Copyright (c) 2024-2025 Jonathan (Hyperpolymath) // Fogbinder - Epistemic ambiguity analysis // Licensed under MIT OR AGPL-3.0 ``` @@ -191,8 +191,6 @@ https://github.com/Hyperpolymath/fogbinder ### For AGPL-licensed derivatives ```rescript -// SPDX-License-Identifier: MPL-2.0-or-later -// Copyright (c) 2024-2025 Jonathan (Hyperpolymath) // Fogbinder - Epistemic ambiguity analysis // Licensed under MIT OR AGPL-3.0 // diff --git a/fogbinder/LICENSE_TLDR.adoc b/fogbinder/LICENSE_TLDR.adoc index 021a1c2..fb89a95 100644 --- a/fogbinder/LICENSE_TLDR.adoc +++ b/fogbinder/LICENSE_TLDR.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = License TL;DR – Fogbinder :toc: left :icons: font @@ -160,7 +162,6 @@ Include in all source files: [source,rescript] ---- -// SPDX-License-Identifier: MPL-2.0-or-later // SPDX-FileCopyrightText: 2025 Jonathan ---- diff --git a/fogbinder/MAINTAINERS.adoc b/fogbinder/MAINTAINERS.adoc index dba9f48..b2928c2 100644 --- a/fogbinder/MAINTAINERS.adoc +++ b/fogbinder/MAINTAINERS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Maintainers This document lists the current maintainers of the Fogbinder project and their responsibilities. diff --git a/fogbinder/PALIMPSEST.adoc b/fogbinder/PALIMPSEST.adoc index ebaa6d0..9660f13 100644 --- a/fogbinder/PALIMPSEST.adoc +++ b/fogbinder/PALIMPSEST.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Palimpsest License :toc: :toc-placement!: diff --git a/fogbinder/PHILOSOPHY.adoc b/fogbinder/PHILOSOPHY.adoc index 909ffc9..4032403 100644 --- a/fogbinder/PHILOSOPHY.adoc +++ b/fogbinder/PHILOSOPHY.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Philosophical Foundations of Fogbinder ## Introduction diff --git a/fogbinder/README.adoc b/fogbinder/README.adoc index d030b01..b46bfc1 100644 --- a/fogbinder/README.adoc +++ b/fogbinder/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Fogbinder image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[MPL-2.0-or-later,link="https://opensource.org/licenses/MPL-2.0"] diff --git a/fogbinder/ROADMAP.adoc b/fogbinder/ROADMAP.adoc index d0e883a..1a78c02 100644 --- a/fogbinder/ROADMAP.adoc +++ b/fogbinder/ROADMAP.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Fogbinder Roadmap == Current Status diff --git a/fogbinder/RSR_ACHIEVEMENT.adoc b/fogbinder/RSR_ACHIEVEMENT.adoc index 3f3edb0..b7f2631 100644 --- a/fogbinder/RSR_ACHIEVEMENT.adoc +++ b/fogbinder/RSR_ACHIEVEMENT.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # 🏆 RSR Silver Compliance Achieved! **Date:** 2025-11-22 diff --git a/fogbinder/RSR_AUDIT.adoc b/fogbinder/RSR_AUDIT.adoc index 720abbb..ea44756 100644 --- a/fogbinder/RSR_AUDIT.adoc +++ b/fogbinder/RSR_AUDIT.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # RSR Compliance Audit - Fogbinder **Date:** 2025-11-22 diff --git a/fogbinder/RSR_COMPLIANCE_REPORT.adoc b/fogbinder/RSR_COMPLIANCE_REPORT.adoc index a9a00a9..e0f37ba 100644 --- a/fogbinder/RSR_COMPLIANCE_REPORT.adoc +++ b/fogbinder/RSR_COMPLIANCE_REPORT.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # RSR Compliance Report - Fogbinder v0.1.0 **Generated:** 2025-11-22 diff --git a/fogbinder/RSR_FINAL_STATUS.adoc b/fogbinder/RSR_FINAL_STATUS.adoc index fcf31ce..500e83c 100644 --- a/fogbinder/RSR_FINAL_STATUS.adoc +++ b/fogbinder/RSR_FINAL_STATUS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # 🏆 Fogbinder: Complete RSR Silver Compliance **Date:** 2025-11-22 diff --git a/fogbinder/RSR_OUTLINE.adoc b/fogbinder/RSR_OUTLINE.adoc index e429244..2901b24 100644 --- a/fogbinder/RSR_OUTLINE.adoc +++ b/fogbinder/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/fogbinder/RSR_PLATINUM_ACHIEVEMENT.adoc b/fogbinder/RSR_PLATINUM_ACHIEVEMENT.adoc index 2363e2f..0df9941 100644 --- a/fogbinder/RSR_PLATINUM_ACHIEVEMENT.adoc +++ b/fogbinder/RSR_PLATINUM_ACHIEVEMENT.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # RSR Platinum Tier Achievement **Fogbinder - Rhodium Standard Repository Platinum Compliance** diff --git a/fogbinder/RSR_v3.0_CANONICAL.adoc b/fogbinder/RSR_v3.0_CANONICAL.adoc index 69471e1..211d500 100644 --- a/fogbinder/RSR_v3.0_CANONICAL.adoc +++ b/fogbinder/RSR_v3.0_CANONICAL.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR: Rhodium Standard Repository v3.0 :toc: left :toclevels: 4 diff --git a/fogbinder/RSR_v3.0_STANDARD.adoc b/fogbinder/RSR_v3.0_STANDARD.adoc index d47f95b..aa086f1 100644 --- a/fogbinder/RSR_v3.0_STANDARD.adoc +++ b/fogbinder/RSR_v3.0_STANDARD.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR: Rhodium Standard Repository v3.0 :toc: left :toclevels: 4 diff --git a/fogbinder/SECURITY.md b/fogbinder/SECURITY.md index 03a1d7b..82f07d4 100644 --- a/fogbinder/SECURITY.md +++ b/fogbinder/SECURITY.md @@ -1,3 +1,7 @@ + # Security Policy ## Supported Versions diff --git a/fogbinder/SUMMARY.adoc b/fogbinder/SUMMARY.adoc index 3b75e79..29f52f4 100644 --- a/fogbinder/SUMMARY.adoc +++ b/fogbinder/SUMMARY.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Fogbinder - Autonomous Build Summary ## What Was Built diff --git a/fogbinder/TESTING-REPORT.adoc b/fogbinder/TESTING-REPORT.adoc index 9b51c34..36f6305 100644 --- a/fogbinder/TESTING-REPORT.adoc +++ b/fogbinder/TESTING-REPORT.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Fogbinder Testing Report :toc: auto :sectnums: diff --git a/fogbinder/TPCF.adoc b/fogbinder/TPCF.adoc index 2cd4a83..bb4bb47 100644 --- a/fogbinder/TPCF.adoc +++ b/fogbinder/TPCF.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Tri-Perimeter Contribution Framework (TPCF) Fogbinder uses the **Tri-Perimeter Contribution Framework (TPCF)** for graduated trust and access control. diff --git a/fogbinder/badges/README.adoc b/fogbinder/badges/README.adoc index 85a7aef..a1017a4 100644 --- a/fogbinder/badges/README.adoc +++ b/fogbinder/badges/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Badges SVG badges for displaying Rhodium Standard Repository compliance tier. diff --git a/fogbinder/benchmarks/README.adoc b/fogbinder/benchmarks/README.adoc index 9ccfc3e..01c702f 100644 --- a/fogbinder/benchmarks/README.adoc +++ b/fogbinder/benchmarks/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Fogbinder Performance Benchmarks Performance benchmarks for Fogbinder's critical operations. diff --git a/fogbinder/bootstrap.js b/fogbinder/bootstrap.js index ad89c04..9f658c5 100644 --- a/fogbinder/bootstrap.js +++ b/fogbinder/bootstrap.js @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell // // @file bootstrap.js diff --git a/fogbinder/contractiles/README.adoc b/fogbinder/contractiles/README.adoc index d19a387..70ad712 100644 --- a/fogbinder/contractiles/README.adoc +++ b/fogbinder/contractiles/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractiles Template Set :toc: :sectnums: diff --git a/fogbinder/contractiles/k9/README.adoc b/fogbinder/contractiles/self-validating/README.adoc similarity index 98% rename from fogbinder/contractiles/k9/README.adoc rename to fogbinder/contractiles/self-validating/README.adoc index 9c3099f..ce1825f 100644 --- a/fogbinder/contractiles/k9/README.adoc +++ b/fogbinder/contractiles/self-validating/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = K9 Contractiles :toc: left :icons: font diff --git a/fogbinder/contractiles/k9/examples/ci-config.k9.ncl b/fogbinder/contractiles/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from fogbinder/contractiles/k9/examples/ci-config.k9.ncl rename to fogbinder/contractiles/self-validating/examples/ci-config.k9.ncl diff --git a/fogbinder/contractiles/k9/examples/project-metadata.k9.ncl b/fogbinder/contractiles/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from fogbinder/contractiles/k9/examples/project-metadata.k9.ncl rename to fogbinder/contractiles/self-validating/examples/project-metadata.k9.ncl diff --git a/fogbinder/contractiles/k9/examples/setup-repo.k9.ncl b/fogbinder/contractiles/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from fogbinder/contractiles/k9/examples/setup-repo.k9.ncl rename to fogbinder/contractiles/self-validating/examples/setup-repo.k9.ncl diff --git a/fogbinder/contractiles/k9/template-hunt.k9.ncl b/fogbinder/contractiles/self-validating/template-hunt.k9.ncl similarity index 100% rename from fogbinder/contractiles/k9/template-hunt.k9.ncl rename to fogbinder/contractiles/self-validating/template-hunt.k9.ncl diff --git a/fogbinder/contractiles/k9/template-kennel.k9.ncl b/fogbinder/contractiles/self-validating/template-kennel.k9.ncl similarity index 100% rename from fogbinder/contractiles/k9/template-kennel.k9.ncl rename to fogbinder/contractiles/self-validating/template-kennel.k9.ncl diff --git a/fogbinder/contractiles/k9/template-yard.k9.ncl b/fogbinder/contractiles/self-validating/template-yard.k9.ncl similarity index 100% rename from fogbinder/contractiles/k9/template-yard.k9.ncl rename to fogbinder/contractiles/self-validating/template-yard.k9.ncl diff --git a/fogbinder/docs/CITATIONS.adoc b/fogbinder/docs/CITATIONS.adoc index bae6f05..1e16708 100644 --- a/fogbinder/docs/CITATIONS.adoc +++ b/fogbinder/docs/CITATIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = fogbinder - Citation Guide :toc: diff --git a/fogbinder/docs/PROPERTY_TESTING.adoc b/fogbinder/docs/PROPERTY_TESTING.adoc index fe3e6f5..d5a661f 100644 --- a/fogbinder/docs/PROPERTY_TESTING.adoc +++ b/fogbinder/docs/PROPERTY_TESTING.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Property-Based Testing in Fogbinder This document explains Fogbinder's property-based testing approach using fast-check. diff --git a/fogbinder/docs/cookbooks/BEGINNER_COOKBOOK.adoc b/fogbinder/docs/cookbooks/BEGINNER_COOKBOOK.adoc index dd4a9d9..911750a 100644 --- a/fogbinder/docs/cookbooks/BEGINNER_COOKBOOK.adoc +++ b/fogbinder/docs/cookbooks/BEGINNER_COOKBOOK.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Fogbinder Beginner's Cookbook **Getting Started with Epistemic Ambiguity Analysis** diff --git a/fogbinder/docs/cookbooks/INTERMEDIATE_COOKBOOK.adoc b/fogbinder/docs/cookbooks/INTERMEDIATE_COOKBOOK.adoc index 9caa870..950a7f4 100644 --- a/fogbinder/docs/cookbooks/INTERMEDIATE_COOKBOOK.adoc +++ b/fogbinder/docs/cookbooks/INTERMEDIATE_COOKBOOK.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Fogbinder Intermediate Cookbook **Working with Core Concepts and Integrations** diff --git a/fogbinder/docs/cookbooks/README.adoc b/fogbinder/docs/cookbooks/README.adoc index 3805887..23667c2 100644 --- a/fogbinder/docs/cookbooks/README.adoc +++ b/fogbinder/docs/cookbooks/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Fogbinder Cookbooks Practical how-to guides for using Fogbinder's epistemic ambiguity analysis features. diff --git a/fogbinder/ffi/zig/build.zig b/fogbinder/ffi/zig/build.zig index 4a2e049..c02617f 100644 --- a/fogbinder/ffi/zig/build.zig +++ b/fogbinder/ffi/zig/build.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} FFI Build Configuration // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} FFI Build Configuration const std = @import("std"); diff --git a/fogbinder/ffi/zig/src/main.zig b/fogbinder/ffi/zig/src/main.zig index 6b233bc..f1b2633 100644 --- a/fogbinder/ffi/zig/src/main.zig +++ b/fogbinder/ffi/zig/src/main.zig @@ -1,9 +1,10 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // {{PROJECT}} FFI Implementation // // This module implements the C-compatible FFI declared in src/abi/Foreign.idr // All types and layouts must match the Idris2 ABI definitions. // -// SPDX-License-Identifier: MPL-2.0 const std = @import("std"); diff --git a/fogbinder/ffi/zig/test/integration_test.zig b/fogbinder/ffi/zig/test/integration_test.zig index 0341994..e481508 100644 --- a/fogbinder/ffi/zig/test/integration_test.zig +++ b/fogbinder/ffi/zig/test/integration_test.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} Integration Tests // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} Integration Tests // // These tests verify that the Zig FFI correctly implements the Idris2 ABI diff --git a/fogbinder/formal-verification/README.adoc b/fogbinder/formal-verification/README.adoc index 12a3b56..77eeba9 100644 --- a/fogbinder/formal-verification/README.adoc +++ b/fogbinder/formal-verification/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Formal Verification for Fogbinder This directory contains formal specifications for Fogbinder's critical algorithms using TLA+ (Temporal Logic of Actions). diff --git a/fogbinder/security/AUDIT_CHECKLIST.adoc b/fogbinder/security/AUDIT_CHECKLIST.adoc index deae21b..46ff646 100644 --- a/fogbinder/security/AUDIT_CHECKLIST.adoc +++ b/fogbinder/security/AUDIT_CHECKLIST.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Security Audit Checklist Comprehensive security audit checklist for Fogbinder (RSR Platinum requirement). diff --git a/fogbinder/security/BROWSER_FUTUREPROOFING.adoc b/fogbinder/security/BROWSER_FUTUREPROOFING.adoc index 89740c5..18fd61e 100644 --- a/fogbinder/security/BROWSER_FUTUREPROOFING.adoc +++ b/fogbinder/security/BROWSER_FUTUREPROOFING.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Browser Future-Proofing Configuration **Comprehensive browser feature support for maximum dependability, security, accessibility, interoperability, functionality, and performance** diff --git a/fogbinder/security/CRYPTOGRAPHY.adoc b/fogbinder/security/CRYPTOGRAPHY.adoc index 9890428..71b7186 100644 --- a/fogbinder/security/CRYPTOGRAPHY.adoc +++ b/fogbinder/security/CRYPTOGRAPHY.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Fogbinder Cryptography Specification **Post-quantum ready, zero-knowledge friendly, maximum security** diff --git a/fogbinder/security/GIT_SSH_CONFIG.adoc b/fogbinder/security/GIT_SSH_CONFIG.adoc index 4cd0293..8bb337d 100644 --- a/fogbinder/security/GIT_SSH_CONFIG.adoc +++ b/fogbinder/security/GIT_SSH_CONFIG.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Git SSH-Only Configuration **Secure Git operations via SSH only (no HTTPS)** diff --git a/fogbinder/security/README.adoc b/fogbinder/security/README.adoc index a5b725b..8568bba 100644 --- a/fogbinder/security/README.adoc +++ b/fogbinder/security/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Security Audit Framework Comprehensive security audit preparation for Fogbinder (RSR Platinum requirement). diff --git a/fogbinder/security/TLS_SSL_CONFIG.adoc b/fogbinder/security/TLS_SSL_CONFIG.adoc index 2815bb3..087747f 100644 --- a/fogbinder/security/TLS_SSL_CONFIG.adoc +++ b/fogbinder/security/TLS_SSL_CONFIG.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # TLS/SSL Configuration & Security Headers **For deploying Fogbinder or related services with maximum security** diff --git a/fogbinder/src/Fogbinder.bs.js b/fogbinder/src/Fogbinder.bs.js index cebc69f..5662bde 100644 --- a/fogbinder/src/Fogbinder.bs.js +++ b/fogbinder/src/Fogbinder.bs.js @@ -1,5 +1,5 @@ - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import * as Js_string from "@rescript/runtime/lib/es6/Js_string.js"; import * as SpeechAct$Fogbinder from "./core/SpeechAct.bs.js"; import * as MoodScorer$Fogbinder from "./engine/MoodScorer.bs.js"; diff --git a/fogbinder/src/core/EpistemicState.bs.js b/fogbinder/src/core/EpistemicState.bs.js index 9d13c05..a6aa6d5 100644 --- a/fogbinder/src/core/EpistemicState.bs.js +++ b/fogbinder/src/core/EpistemicState.bs.js @@ -1,6 +1,5 @@ - - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell function make(certainty, context, evidence, param) { return { certainty: certainty, diff --git a/fogbinder/src/core/EpistemicState.test.bs.js b/fogbinder/src/core/EpistemicState.test.bs.js index 7f5cf71..047852a 100644 --- a/fogbinder/src/core/EpistemicState.test.bs.js +++ b/fogbinder/src/core/EpistemicState.test.bs.js @@ -1,5 +1,5 @@ - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js"; import * as EpistemicState$Fogbinder from "./EpistemicState.bs.js"; diff --git a/fogbinder/src/core/FamilyResemblance.bs.js b/fogbinder/src/core/FamilyResemblance.bs.js index f65e591..f5b94d0 100644 --- a/fogbinder/src/core/FamilyResemblance.bs.js +++ b/fogbinder/src/core/FamilyResemblance.bs.js @@ -1,6 +1,5 @@ - - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell function make(label, features, members, param) { return { label: label, diff --git a/fogbinder/src/core/FamilyResemblance.test.bs.js b/fogbinder/src/core/FamilyResemblance.test.bs.js index 7c116af..77a913a 100644 --- a/fogbinder/src/core/FamilyResemblance.test.bs.js +++ b/fogbinder/src/core/FamilyResemblance.test.bs.js @@ -1,5 +1,5 @@ - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js"; import * as FamilyResemblance$Fogbinder from "./FamilyResemblance.bs.js"; diff --git a/fogbinder/src/core/SpeechAct.bs.js b/fogbinder/src/core/SpeechAct.bs.js index 556c138..b76e6e9 100644 --- a/fogbinder/src/core/SpeechAct.bs.js +++ b/fogbinder/src/core/SpeechAct.bs.js @@ -1,6 +1,5 @@ - - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell function make(utterance, force, context, param) { let performative; switch (force.TAG) { diff --git a/fogbinder/src/core/SpeechAct.test.bs.js b/fogbinder/src/core/SpeechAct.test.bs.js index 70738d4..49f1909 100644 --- a/fogbinder/src/core/SpeechAct.test.bs.js +++ b/fogbinder/src/core/SpeechAct.test.bs.js @@ -1,5 +1,5 @@ - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js"; import * as SpeechAct$Fogbinder from "./SpeechAct.bs.js"; diff --git a/fogbinder/src/engine/ContradictionDetector.bs.js b/fogbinder/src/engine/ContradictionDetector.bs.js index ff920da..4880bb2 100644 --- a/fogbinder/src/engine/ContradictionDetector.bs.js +++ b/fogbinder/src/engine/ContradictionDetector.bs.js @@ -1,5 +1,5 @@ - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import * as SpeechAct$Fogbinder from "../core/SpeechAct.bs.js"; function detectContradiction(act1, act2) { diff --git a/fogbinder/src/engine/FogTrailVisualizer.bs.js b/fogbinder/src/engine/FogTrailVisualizer.bs.js index b51bb29..32de4b2 100644 --- a/fogbinder/src/engine/FogTrailVisualizer.bs.js +++ b/fogbinder/src/engine/FogTrailVisualizer.bs.js @@ -1,5 +1,5 @@ - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import * as ContradictionDetector$Fogbinder from "./ContradictionDetector.bs.js"; function make(title, param) { diff --git a/fogbinder/src/engine/MoodScorer.bs.js b/fogbinder/src/engine/MoodScorer.bs.js index ff5c8d6..9d6daa2 100644 --- a/fogbinder/src/engine/MoodScorer.bs.js +++ b/fogbinder/src/engine/MoodScorer.bs.js @@ -1,5 +1,5 @@ - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import * as Js_string from "@rescript/runtime/lib/es6/Js_string.js"; import * as SpeechAct$Fogbinder from "../core/SpeechAct.bs.js"; diff --git a/fogbinder/src/engine/MysteryClustering.bs.js b/fogbinder/src/engine/MysteryClustering.bs.js index d0a3c8d..52cde01 100644 --- a/fogbinder/src/engine/MysteryClustering.bs.js +++ b/fogbinder/src/engine/MysteryClustering.bs.js @@ -1,5 +1,5 @@ - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import * as Js_dict from "@rescript/runtime/lib/es6/Js_dict.js"; import * as Js_string from "@rescript/runtime/lib/es6/Js_string.js"; import * as FamilyResemblance$Fogbinder from "../core/FamilyResemblance.bs.js"; diff --git a/fogbinder/src/main.js b/fogbinder/src/main.js index 812c6ab..a4bdc34 100644 --- a/fogbinder/src/main.js +++ b/fogbinder/src/main.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * main.js - Fogbinder Entry Point * Pure JavaScript wrapper for ReScript-compiled epistemic analysis engine diff --git a/fogbinder/src/wasm/contradiction_detector/src/lib.rs b/fogbinder/src/wasm/contradiction_detector/src/lib.rs index 6342726..01a3a00 100644 --- a/fogbinder/src/wasm/contradiction_detector/src/lib.rs +++ b/fogbinder/src/wasm/contradiction_detector/src/lib.rs @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Fogbinder Contradiction Detector WASM Module // License: MPL-2.0 (with Palimpsest) // Language game conflict detection (NOT logical contradiction) diff --git a/fogbinder/src/wasm/crypto/src/lib.rs b/fogbinder/src/wasm/crypto/src/lib.rs index 7da2d1d..0149b83 100644 --- a/fogbinder/src/wasm/crypto/src/lib.rs +++ b/fogbinder/src/wasm/crypto/src/lib.rs @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Fogbinder Cryptography WASM Module // License: MPL-2.0 (with Palimpsest) // Post-quantum cryptography implementation diff --git a/fogbinder/src/wasm/graph_algorithms/src/lib.rs b/fogbinder/src/wasm/graph_algorithms/src/lib.rs index cb77642..674fb5c 100644 --- a/fogbinder/src/wasm/graph_algorithms/src/lib.rs +++ b/fogbinder/src/wasm/graph_algorithms/src/lib.rs @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Fogbinder Graph Algorithms WASM Module // License: MPL-2.0 (with Palimpsest) // FogTrail network visualization algorithms diff --git a/fogbinder/src/wasm/string_similarity/src/lib.rs b/fogbinder/src/wasm/string_similarity/src/lib.rs index 3e7dfce..d60d59e 100644 --- a/fogbinder/src/wasm/string_similarity/src/lib.rs +++ b/fogbinder/src/wasm/string_similarity/src/lib.rs @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Fogbinder String Similarity WASM Module // License: MPL-2.0 (with Palimpsest) // High-performance string similarity algorithms diff --git a/fogbinder/src/zotero/ZoteroBindings.bs.js b/fogbinder/src/zotero/ZoteroBindings.bs.js index ba7d598..6fa758f 100644 --- a/fogbinder/src/zotero/ZoteroBindings.bs.js +++ b/fogbinder/src/zotero/ZoteroBindings.bs.js @@ -1,5 +1,5 @@ - - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import * as Zotero_apiJs from "./zotero_api.js"; function getItems(prim) { diff --git a/fogbinder/src/zotero/zotero_api.js b/fogbinder/src/zotero/zotero_api.js index 10f43e3..1262dc6 100644 --- a/fogbinder/src/zotero/zotero_api.js +++ b/fogbinder/src/zotero/zotero_api.js @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell // // zotero_api.js // JavaScript shim for Zotero API — runs inside the Zotero process where diff --git a/formbd/.github/workflows/casket-pages.yml b/formbd/.github/workflows/casket-pages.yml index f6d4979..24e0c75 100644 --- a/formbd/.github/workflows/casket-pages.yml +++ b/formbd/.github/workflows/casket-pages.yml @@ -18,6 +18,7 @@ concurrency: jobs: build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -91,6 +92,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: - name: Deploy to GitHub Pages diff --git a/formbd/.github/workflows/codeql.yml b/formbd/.github/workflows/codeql.yml index 97bb6c2..85bbabc 100644 --- a/formbd/.github/workflows/codeql.yml +++ b/formbd/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/formbd/.github/workflows/governance.yml b/formbd/.github/workflows/governance.yml index b4062e0..a044174 100644 --- a/formbd/.github/workflows/governance.yml +++ b/formbd/.github/workflows/governance.yml @@ -24,3 +24,4 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 + timeout-minutes: 10 diff --git a/formbd/.github/workflows/hypatia-scan.yml b/formbd/.github/workflows/hypatia-scan.yml index 5b59919..49e830d 100644 --- a/formbd/.github/workflows/hypatia-scan.yml +++ b/formbd/.github/workflows/hypatia-scan.yml @@ -17,6 +17,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/formbd/.github/workflows/scorecard.yml b/formbd/.github/workflows/scorecard.yml index d50c271..d091a90 100644 --- a/formbd/.github/workflows/scorecard.yml +++ b/formbd/.github/workflows/scorecard.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: analysis: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write diff --git a/formbd/ABI-FFI-README.md b/formbd/ABI-FFI-README.md index f06f72c..af300f5 100644 --- a/formbd/ABI-FFI-README.md +++ b/formbd/ABI-FFI-README.md @@ -1,3 +1,7 @@ + {{~ Aditionally delete this line and fill out the template below ~}} # {{PROJECT}} ABI/FFI Documentation diff --git a/formbd/CODE_OF_CONDUCT.md b/formbd/CODE_OF_CONDUCT.md index 7eb4a53..cd2d2fa 100644 --- a/formbd/CODE_OF_CONDUCT.md +++ b/formbd/CODE_OF_CONDUCT.md @@ -1,3 +1,7 @@ + # Code of Conduct # Clone the repository git clone https://github.com/hyperpolymath/zotero-tools.git cd zotero-tools diff --git a/formbd/MAINTAINERS.adoc b/formbd/MAINTAINERS.adoc index a1c6544..becaa3e 100644 --- a/formbd/MAINTAINERS.adoc +++ b/formbd/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/formbd/README.adoc b/formbd/README.adoc index ebe08d0..dda6add 100644 --- a/formbd/README.adoc +++ b/formbd/README.adoc @@ -1,5 +1,6 @@ -image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] // SPDX-FileCopyrightText: 2025 hyperpolymath = Zotero-FormBD :toc: diff --git a/formbd/ROADMAP.adoc b/formbd/ROADMAP.adoc index cc69a0b..4054e46 100644 --- a/formbd/ROADMAP.adoc +++ b/formbd/ROADMAP.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Formbd Roadmap == Current Status diff --git a/formbd/RSR_OUTLINE.adoc b/formbd/RSR_OUTLINE.adoc index e429244..2901b24 100644 --- a/formbd/RSR_OUTLINE.adoc +++ b/formbd/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/formbd/SECURITY.md b/formbd/SECURITY.md index 938896c..20c817b 100644 --- a/formbd/SECURITY.md +++ b/formbd/SECURITY.md @@ -1,3 +1,7 @@ + # Security Policy {{~ Aditionally delete this line and fill out the template below ~}} # {{PROJECT}} ABI/FFI Documentation diff --git a/librarian/CODE_OF_CONDUCT.md b/librarian/CODE_OF_CONDUCT.md index 7eb4a53..cd2d2fa 100644 --- a/librarian/CODE_OF_CONDUCT.md +++ b/librarian/CODE_OF_CONDUCT.md @@ -1,3 +1,7 @@ + # Code of Conduct # Clone the repository git clone https://github.com/hyperpolymath/zotero-tools.git cd zotero-tools diff --git a/librarian/MAINTAINERS.adoc b/librarian/MAINTAINERS.adoc index a1c6544..becaa3e 100644 --- a/librarian/MAINTAINERS.adoc +++ b/librarian/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/librarian/README.adoc b/librarian/README.adoc index 3a71c12..0dce998 100644 --- a/librarian/README.adoc +++ b/librarian/README.adoc @@ -1,5 +1,6 @@ -image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] // SPDX-FileCopyrightText: 2025 hyperpolymath = Zotero Librarian :toc: diff --git a/librarian/ROADMAP.adoc b/librarian/ROADMAP.adoc index 2740d77..4e1c731 100644 --- a/librarian/ROADMAP.adoc +++ b/librarian/ROADMAP.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Librarian Roadmap == Current Status diff --git a/librarian/RSR_OUTLINE.adoc b/librarian/RSR_OUTLINE.adoc index e429244..2901b24 100644 --- a/librarian/RSR_OUTLINE.adoc +++ b/librarian/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/librarian/SECURITY.md b/librarian/SECURITY.md index 938896c..20c817b 100644 --- a/librarian/SECURITY.md +++ b/librarian/SECURITY.md @@ -1,3 +1,7 @@ + # Security Policy # LLM Warmup — zotero-tools (Developer) ## What is zotero-tools? diff --git a/llm-warmup-user.md b/llm-warmup-user.md index ce2f76c..5fb95f6 100644 --- a/llm-warmup-user.md +++ b/llm-warmup-user.md @@ -1,3 +1,7 @@ + # LLM Warmup — zotero-tools (User) ## What is zotero-tools? diff --git a/nesy/.claude/CLAUDE.md b/nesy/.claude/CLAUDE.md index c878259..ce34367 100644 --- a/nesy/.claude/CLAUDE.md +++ b/nesy/.claude/CLAUDE.md @@ -1,3 +1,7 @@ + ## Machine-Readable Artefacts The following files in `.machine_readable/` contain structured project metadata: @@ -19,14 +23,14 @@ The following files in `.machine_readable/` contain structured project metadata: | Language/Tool | Use Case | Notes | |---------------|----------|-------| -| **ReScript** | Primary application code | Compiles to JS, type-safe | +| **AffineScript** | Primary application code | Compiles to JS, type-safe | | **Deno** | Runtime & package management | Replaces Node/npm/bun | | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools | | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI | | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like | | **Gleam** | Backend services | Runs on BEAM or compiles to JS | | **Bash/POSIX Shell** | Scripts, automation | Keep minimal | -| **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs | +| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs | | **Nickel** | Configuration language | For complex configs | | **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm | | **Julia** | Batch scripts, data processing | Per RSR | @@ -37,7 +41,7 @@ The following files in `.machine_readable/` contain structured project metadata: | Banned | Replacement | |--------|-------------| -| TypeScript | ReScript | +| TypeScript | AffineScript | | Node.js | Deno | | npm | Deno | | Bun | Deno | @@ -53,18 +57,18 @@ The following files in `.machine_readable/` contain structured project metadata: **No exceptions for Kotlin/Swift** - use Rust-first approach: -1. **Tauri 2.0+** - Web UI (ReScript) + Rust backend, MIT/Apache-2.0 +1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0 2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0 Both are FOSS with independent governance (no Big Tech). ### Enforcement Rules -1. **No new TypeScript files** - Convert existing TS to ReScript -2. **No package.json for runtime deps** - Use deno.json imports +1. **No new TypeScript files** - Convert existing TS to AffineScript +2. **No package.json - use deno.json deps** - Use deno.json imports 3. **No node_modules in production** - Deno caches deps automatically 4. **No Go code** - Use Rust instead -5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps +5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps 6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus ### Package Management diff --git a/nesy/.github/ISSUE_TEMPLATE/bug_report.md b/nesy/.github/ISSUE_TEMPLATE/bug_report.md index 987aab6..45a6c02 100644 --- a/nesy/.github/ISSUE_TEMPLATE/bug_report.md +++ b/nesy/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,3 +1,7 @@ + --- name: Bug report about: Create a report to help us improve diff --git a/nesy/.github/ISSUE_TEMPLATE/custom.md b/nesy/.github/ISSUE_TEMPLATE/custom.md index 48d5f81..99ebf00 100644 --- a/nesy/.github/ISSUE_TEMPLATE/custom.md +++ b/nesy/.github/ISSUE_TEMPLATE/custom.md @@ -1,3 +1,7 @@ + --- name: Custom issue template about: Describe this issue template's purpose here. diff --git a/nesy/.github/ISSUE_TEMPLATE/documentation.md b/nesy/.github/ISSUE_TEMPLATE/documentation.md index 4fcb9f9..b1d16df 100644 --- a/nesy/.github/ISSUE_TEMPLATE/documentation.md +++ b/nesy/.github/ISSUE_TEMPLATE/documentation.md @@ -1,3 +1,7 @@ + --- name: Documentation about: Report unclear, missing, or incorrect documentation diff --git a/nesy/.github/ISSUE_TEMPLATE/feature_request.md b/nesy/.github/ISSUE_TEMPLATE/feature_request.md index 3e8fa7e..a5a5693 100644 --- a/nesy/.github/ISSUE_TEMPLATE/feature_request.md +++ b/nesy/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,3 +1,7 @@ + --- name: Feature request about: Suggest an idea for this project diff --git a/nesy/.github/ISSUE_TEMPLATE/question.md b/nesy/.github/ISSUE_TEMPLATE/question.md index fd0e2a5..c2d1f57 100644 --- a/nesy/.github/ISSUE_TEMPLATE/question.md +++ b/nesy/.github/ISSUE_TEMPLATE/question.md @@ -1,3 +1,7 @@ + --- name: Question about: Ask a question about usage or behaviour diff --git a/nesy/.github/workflows/ci.yml b/nesy/.github/workflows/ci.yml index ce0c4a7..2a10f2f 100644 --- a/nesy/.github/workflows/ci.yml +++ b/nesy/.github/workflows/ci.yml @@ -12,6 +12,7 @@ jobs: test: name: Test (Node ${{ matrix.node-version }}) runs-on: ubuntu-latest + timeout-minutes: 15 strategy: matrix: @@ -44,6 +45,7 @@ jobs: typecheck: name: Type Checking runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -64,6 +66,7 @@ jobs: lint: name: Linting runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -84,6 +87,7 @@ jobs: build: name: Build runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -111,6 +115,7 @@ jobs: rsr-compliance: name: RSR Compliance Check runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -140,6 +145,7 @@ jobs: security: name: Security Audit runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -160,6 +166,7 @@ jobs: all-checks: name: All Checks Passed runs-on: ubuntu-latest + timeout-minutes: 15 needs: [test, typecheck, lint, build, rsr-compliance, security] steps: diff --git a/nesy/.github/workflows/codeql.yml b/nesy/.github/workflows/codeql.yml index f72ca6a..74c318a 100644 --- a/nesy/.github/workflows/codeql.yml +++ b/nesy/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/nesy/.github/workflows/comprehensive-quality.yml b/nesy/.github/workflows/comprehensive-quality.yml index 492f549..9552a28 100644 --- a/nesy/.github/workflows/comprehensive-quality.yml +++ b/nesy/.github/workflows/comprehensive-quality.yml @@ -11,6 +11,7 @@ jobs: # DEPENDABILITY - Stability and reliability dependability: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check test coverage @@ -30,6 +31,7 @@ jobs: # SECURITY - Multi-layer security scanning security: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Secret scanning @@ -50,6 +52,7 @@ jobs: # INTEROPERABILITY - API and format compatibility interoperability: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check API specs @@ -67,6 +70,7 @@ jobs: # VALIDATION - Input/output validation validation: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check for validation patterns @@ -77,6 +81,7 @@ jobs: # ATTESTATION - Supply chain integrity (SLSA) attestation: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: id-token: write contents: read @@ -97,6 +102,7 @@ jobs: # VERIFICATION - Formal methods where applicable verification: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check SPARK proofs @@ -113,6 +119,7 @@ jobs: # FUNCTIONALITY - Feature completeness functionality: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check TODOs and FIXMEs @@ -126,6 +133,7 @@ jobs: # PERFORMANCE - Benchmarks and profiling performance: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check for benchmarks @@ -142,6 +150,7 @@ jobs: # ACCESSIBILITY - A11y compliance accessibility: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/*.html') != '' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 @@ -157,6 +166,7 @@ jobs: # LICENSE COMPLIANCE license: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check license files @@ -175,6 +185,7 @@ jobs: # DOCUMENTATION QUALITY documentation: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check docs completeness diff --git a/nesy/.github/workflows/governance.yml b/nesy/.github/workflows/governance.yml index b4062e0..a044174 100644 --- a/nesy/.github/workflows/governance.yml +++ b/nesy/.github/workflows/governance.yml @@ -24,3 +24,4 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 + timeout-minutes: 10 diff --git a/nesy/.github/workflows/hypatia-scan.yml b/nesy/.github/workflows/hypatia-scan.yml index 5b59919..49e830d 100644 --- a/nesy/.github/workflows/hypatia-scan.yml +++ b/nesy/.github/workflows/hypatia-scan.yml @@ -17,6 +17,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/nesy/.github/workflows/instant-sync.yml b/nesy/.github/workflows/instant-sync.yml index 3c78453..45e260a 100644 --- a/nesy/.github/workflows/instant-sync.yml +++ b/nesy/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 diff --git a/nesy/.github/workflows/jekyll-gh-pages.yml b/nesy/.github/workflows/jekyll-gh-pages.yml index 11a2df4..8b19021 100644 --- a/nesy/.github/workflows/jekyll-gh-pages.yml +++ b/nesy/.github/workflows/jekyll-gh-pages.yml @@ -26,6 +26,7 @@ jobs: # Build job build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 @@ -45,6 +46,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: - name: Deploy to GitHub Pages diff --git a/nesy/.github/workflows/mirror.yml b/nesy/.github/workflows/mirror.yml index 5b67c3c..bf21b11 100644 --- a/nesy/.github/workflows/mirror.yml +++ b/nesy/.github/workflows/mirror.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: mirror-gitlab: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITLAB_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -30,6 +31,7 @@ jobs: mirror-bitbucket: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.BITBUCKET_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -48,6 +50,7 @@ jobs: mirror-codeberg: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.CODEBERG_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -66,6 +69,7 @@ jobs: mirror-sourcehut: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.SOURCEHUT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -84,6 +88,7 @@ jobs: mirror-disroot: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.DISROOT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -102,6 +107,7 @@ jobs: mirror-gitea: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITEA_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -120,6 +126,7 @@ jobs: mirror-radicle: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.RADICLE_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/nesy/.github/workflows/rescript-deno-ci.yml b/nesy/.github/workflows/rescript-deno-ci.yml index e4fcd23..94ace81 100644 --- a/nesy/.github/workflows/rescript-deno-ci.yml +++ b/nesy/.github/workflows/rescript-deno-ci.yml @@ -5,6 +5,7 @@ on: [push, pull_request] jobs: build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - uses: denoland/setup-deno@v2 @@ -32,6 +33,7 @@ jobs: security: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - uses: denoland/setup-deno@v2 diff --git a/nesy/.github/workflows/scorecard-enforcer.yml b/nesy/.github/workflows/scorecard-enforcer.yml index 9a9f4f1..d2ecfdf 100644 --- a/nesy/.github/workflows/scorecard-enforcer.yml +++ b/nesy/.github/workflows/scorecard-enforcer.yml @@ -14,6 +14,7 @@ permissions: read-all jobs: scorecard: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write # For OIDC @@ -52,6 +53,7 @@ jobs: # Check specific high-priority items check-critical: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/nesy/.github/workflows/scorecard.yml b/nesy/.github/workflows/scorecard.yml index 1961a00..69192ce 100644 --- a/nesy/.github/workflows/scorecard.yml +++ b/nesy/.github/workflows/scorecard.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: analysis: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write diff --git a/nesy/.github/workflows/secret-scanner.yml b/nesy/.github/workflows/secret-scanner.yml index cc29168..f7dbcbd 100644 --- a/nesy/.github/workflows/secret-scanner.yml +++ b/nesy/.github/workflows/secret-scanner.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: trufflehog: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: @@ -24,6 +25,7 @@ jobs: gitleaks: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: @@ -37,6 +39,7 @@ jobs: # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/nesy/ABI-FFI-README.md b/nesy/ABI-FFI-README.md index f06f72c..af300f5 100644 --- a/nesy/ABI-FFI-README.md +++ b/nesy/ABI-FFI-README.md @@ -1,3 +1,7 @@ + {{~ Aditionally delete this line and fill out the template below ~}} # {{PROJECT}} ABI/FFI Documentation diff --git a/nesy/CHANGELOG.adoc b/nesy/CHANGELOG.adoc index feaabf4..117a555 100644 --- a/nesy/CHANGELOG.adoc +++ b/nesy/CHANGELOG.adoc @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MPL-2.0-or-later +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Changelog All notable changes to this project will be documented in this file. diff --git a/nesy/CLAUDE.md b/nesy/CLAUDE.md index 31e0517..7181cfe 100644 --- a/nesy/CLAUDE.md +++ b/nesy/CLAUDE.md @@ -1,3 +1,7 @@ + # Zotero-NSAI Project ## Project Overview diff --git a/nesy/CODE_OF_CONDUCT.md b/nesy/CODE_OF_CONDUCT.md index b9e63cf..e3adc73 100644 --- a/nesy/CODE_OF_CONDUCT.md +++ b/nesy/CODE_OF_CONDUCT.md @@ -1,3 +1,7 @@ + # Code of Conduct ## Our Pledge diff --git a/nesy/CONTRIBUTING.adoc b/nesy/CONTRIBUTING.adoc index a0f2f54..2ead10c 100644 --- a/nesy/CONTRIBUTING.adoc +++ b/nesy/CONTRIBUTING.adoc @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MPL-2.0-or-later +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contributing Guide == Getting Started diff --git a/nesy/CONTRIBUTING.md b/nesy/CONTRIBUTING.md index e2e5073..ecc9102 100644 --- a/nesy/CONTRIBUTING.md +++ b/nesy/CONTRIBUTING.md @@ -1,3 +1,7 @@ + # Clone the repository git clone https://github.com/hyperpolymath/zotero-tools.git cd zotero-tools diff --git a/nesy/FOGBINDER-HANDOFF.md b/nesy/FOGBINDER-HANDOFF.md index e0d0455..3e638d6 100644 --- a/nesy/FOGBINDER-HANDOFF.md +++ b/nesy/FOGBINDER-HANDOFF.md @@ -1,3 +1,7 @@ + # NSAI → Fogbinder Handoff Documentation ## Overview diff --git a/nesy/MAINTAINERS.adoc b/nesy/MAINTAINERS.adoc index b5154a0..becaa3e 100644 --- a/nesy/MAINTAINERS.adoc +++ b/nesy/MAINTAINERS.adoc @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MPL-2.0-or-later +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/nesy/MAINTAINERS.md b/nesy/MAINTAINERS.md index 983e666..8533d64 100644 --- a/nesy/MAINTAINERS.md +++ b/nesy/MAINTAINERS.md @@ -1,3 +1,7 @@ + # Maintainers This document lists the current maintainers of the NSAI project. diff --git a/nesy/PALIMPSEST.adoc b/nesy/PALIMPSEST.adoc index ebaa6d0..9660f13 100644 --- a/nesy/PALIMPSEST.adoc +++ b/nesy/PALIMPSEST.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Palimpsest License :toc: :toc-placement!: diff --git a/nesy/PHILOSOPHY.md b/nesy/PHILOSOPHY.md index 2896da2..1bea4bf 100644 --- a/nesy/PHILOSOPHY.md +++ b/nesy/PHILOSOPHY.md @@ -1,3 +1,7 @@ + # Philosophical Foundation: NSAI and the Tractarian Approach ## The Tractatus and Research Validation diff --git a/nesy/README.adoc b/nesy/README.adoc index 681348d..53c9319 100644 --- a/nesy/README.adoc +++ b/nesy/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = NSAI - Neurosymbolic Research Validator for Zotero image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[MPL-2.0-or-later,link="https://opensource.org/licenses/MPL-2.0"] @@ -6,7 +8,6 @@ image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[MPL-2.0-or-later,lin This project must declare **MPL-2.0-or-later** for platform/tooling compatibility. Philosophy: **Palimpsest**. The Palimpsest-MPL (PMPL) text is provided in `license/PMPL-1.0.txt`, and the canonical source is the palimpsest-license repository. -// SPDX-License-Identifier: MPL-2.0-or-later // SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell *"What can be said at all can be said clearly."* — Wittgenstein, Tractatus Logico-Philosophicus diff --git a/nesy/ROADMAP.adoc b/nesy/ROADMAP.adoc index ac66259..86fde20 100644 --- a/nesy/ROADMAP.adoc +++ b/nesy/ROADMAP.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Nesy Roadmap == Current Status diff --git a/nesy/RSR-COMPLIANCE.md b/nesy/RSR-COMPLIANCE.md index 0012eef..bad3770 100644 --- a/nesy/RSR-COMPLIANCE.md +++ b/nesy/RSR-COMPLIANCE.md @@ -1,3 +1,7 @@ + # RSR (Rhodium Standard Repository) Compliance ## Compliance Level: **Silver** 🥈 diff --git a/nesy/RSR_OUTLINE.adoc b/nesy/RSR_OUTLINE.adoc index e429244..2901b24 100644 --- a/nesy/RSR_OUTLINE.adoc +++ b/nesy/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/nesy/SECURITY.md b/nesy/SECURITY.md index 09185e0..3cb230e 100644 --- a/nesy/SECURITY.md +++ b/nesy/SECURITY.md @@ -1,3 +1,7 @@ + # Security Policy ## Supported Versions diff --git a/nesy/TPCF.md b/nesy/TPCF.md index e2ce7d3..c06164e 100644 --- a/nesy/TPCF.md +++ b/nesy/TPCF.md @@ -1,3 +1,7 @@ + # Tri-Perimeter Contribution Framework (TPCF) ## Overview diff --git a/nesy/contractiles/README.adoc b/nesy/contractiles/README.adoc index d19a387..70ad712 100644 --- a/nesy/contractiles/README.adoc +++ b/nesy/contractiles/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractiles Template Set :toc: :sectnums: diff --git a/nesy/contractiles/k9/README.adoc b/nesy/contractiles/self-validating/README.adoc similarity index 98% rename from nesy/contractiles/k9/README.adoc rename to nesy/contractiles/self-validating/README.adoc index 9c3099f..ce1825f 100644 --- a/nesy/contractiles/k9/README.adoc +++ b/nesy/contractiles/self-validating/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = K9 Contractiles :toc: left :icons: font diff --git a/nesy/contractiles/k9/examples/ci-config.k9.ncl b/nesy/contractiles/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from nesy/contractiles/k9/examples/ci-config.k9.ncl rename to nesy/contractiles/self-validating/examples/ci-config.k9.ncl diff --git a/nesy/contractiles/k9/examples/project-metadata.k9.ncl b/nesy/contractiles/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from nesy/contractiles/k9/examples/project-metadata.k9.ncl rename to nesy/contractiles/self-validating/examples/project-metadata.k9.ncl diff --git a/nesy/contractiles/k9/examples/setup-repo.k9.ncl b/nesy/contractiles/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from nesy/contractiles/k9/examples/setup-repo.k9.ncl rename to nesy/contractiles/self-validating/examples/setup-repo.k9.ncl diff --git a/nesy/contractiles/k9/template-hunt.k9.ncl b/nesy/contractiles/self-validating/template-hunt.k9.ncl similarity index 100% rename from nesy/contractiles/k9/template-hunt.k9.ncl rename to nesy/contractiles/self-validating/template-hunt.k9.ncl diff --git a/nesy/contractiles/k9/template-kennel.k9.ncl b/nesy/contractiles/self-validating/template-kennel.k9.ncl similarity index 100% rename from nesy/contractiles/k9/template-kennel.k9.ncl rename to nesy/contractiles/self-validating/template-kennel.k9.ncl diff --git a/nesy/contractiles/k9/template-yard.k9.ncl b/nesy/contractiles/self-validating/template-yard.k9.ncl similarity index 100% rename from nesy/contractiles/k9/template-yard.k9.ncl rename to nesy/contractiles/self-validating/template-yard.k9.ncl diff --git a/nesy/docs/CITATIONS.adoc b/nesy/docs/CITATIONS.adoc index 48ac567..2a5af23 100644 --- a/nesy/docs/CITATIONS.adoc +++ b/nesy/docs/CITATIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = zotero-nsai - Citation Guide :toc: diff --git a/nesy/docs/wiki/00-NEUROSYMBOLIC-PLATFORM-OVERVIEW.md b/nesy/docs/wiki/00-NEUROSYMBOLIC-PLATFORM-OVERVIEW.md index 97fdebd..d75175a 100644 --- a/nesy/docs/wiki/00-NEUROSYMBOLIC-PLATFORM-OVERVIEW.md +++ b/nesy/docs/wiki/00-NEUROSYMBOLIC-PLATFORM-OVERVIEW.md @@ -1,3 +1,7 @@ + # NSAI Neurosymbolic Platform Overview ## Vision diff --git a/nesy/ffi/zig/build.zig b/nesy/ffi/zig/build.zig index 4a2e049..c02617f 100644 --- a/nesy/ffi/zig/build.zig +++ b/nesy/ffi/zig/build.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} FFI Build Configuration // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} FFI Build Configuration const std = @import("std"); diff --git a/nesy/ffi/zig/src/main.zig b/nesy/ffi/zig/src/main.zig index 6b233bc..f1b2633 100644 --- a/nesy/ffi/zig/src/main.zig +++ b/nesy/ffi/zig/src/main.zig @@ -1,9 +1,10 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // {{PROJECT}} FFI Implementation // // This module implements the C-compatible FFI declared in src/abi/Foreign.idr // All types and layouts must match the Idris2 ABI definitions. // -// SPDX-License-Identifier: MPL-2.0 const std = @import("std"); diff --git a/nesy/ffi/zig/test/integration_test.zig b/nesy/ffi/zig/test/integration_test.zig index 0341994..e481508 100644 --- a/nesy/ffi/zig/test/integration_test.zig +++ b/nesy/ffi/zig/test/integration_test.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} Integration Tests // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} Integration Tests // // These tests verify that the Zig FFI correctly implements the Idris2 ABI diff --git a/nesy/vite.config.js b/nesy/vite.config.js index 8f3eebe..2047f74 100644 --- a/nesy/vite.config.js +++ b/nesy/vite.config.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import { defineConfig } from 'vite'; import { resolve } from 'path'; diff --git a/nesy/vitest.config.js b/nesy/vitest.config.js index 91186aa..ca02732 100644 --- a/nesy/vitest.config.js +++ b/nesy/vitest.config.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import { defineConfig } from 'vitest/config'; import { resolve } from 'path'; diff --git a/rescript-templater/.claude/CLAUDE.md b/rescript-templater/.claude/CLAUDE.md index 1f18a05..ce34367 100644 --- a/rescript-templater/.claude/CLAUDE.md +++ b/rescript-templater/.claude/CLAUDE.md @@ -1,3 +1,7 @@ + ## Machine-Readable Artefacts The following files in `.machine_readable/` contain structured project metadata: @@ -19,14 +23,14 @@ The following files in `.machine_readable/` contain structured project metadata: | Language/Tool | Use Case | Notes | |---------------|----------|-------| -| **ReScript** | Primary application code | Compiles to JS, type-safe | +| **AffineScript** | Primary application code | Compiles to JS, type-safe | | **Deno** | Runtime & package management | Replaces Node/npm/bun | | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools | | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI | | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like | | **Gleam** | Backend services | Runs on BEAM or compiles to JS | | **Bash/POSIX Shell** | Scripts, automation | Keep minimal | -| **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs | +| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs | | **Nickel** | Configuration language | For complex configs | | **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm | | **Julia** | Batch scripts, data processing | Per RSR | @@ -37,13 +41,13 @@ The following files in `.machine_readable/` contain structured project metadata: | Banned | Replacement | |--------|-------------| -| TypeScript | ReScript | +| TypeScript | AffineScript | | Node.js | Deno | | npm | Deno | | Bun | Deno | | pnpm/yarn | Deno | | Go | Rust | -| Python | Julia/Rust/ReScript | +| Python | Julia/Rust/AffineScript | | Java/Kotlin | Rust/Tauri/Dioxus | | Swift | Tauri/Dioxus | | React Native | Tauri/Dioxus | @@ -53,18 +57,18 @@ The following files in `.machine_readable/` contain structured project metadata: **No exceptions for Kotlin/Swift** - use Rust-first approach: -1. **Tauri 2.0+** - Web UI (ReScript) + Rust backend, MIT/Apache-2.0 +1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0 2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0 Both are FOSS with independent governance (no Big Tech). ### Enforcement Rules -1. **No new TypeScript files** - Convert existing TS to ReScript -2. **No package.json for runtime deps** - Use deno.json imports +1. **No new TypeScript files** - Convert existing TS to AffineScript +2. **No package.json - use deno.json deps** - Use deno.json imports 3. **No node_modules in production** - Deno caches deps automatically 4. **No Go code** - Use Rust instead -5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps +5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps 6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus ### Package Management diff --git a/rescript-templater/.github/ISSUE_TEMPLATE/bug_report.md b/rescript-templater/.github/ISSUE_TEMPLATE/bug_report.md index 987aab6..45a6c02 100644 --- a/rescript-templater/.github/ISSUE_TEMPLATE/bug_report.md +++ b/rescript-templater/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,3 +1,7 @@ + --- name: Bug report about: Create a report to help us improve diff --git a/rescript-templater/.github/ISSUE_TEMPLATE/custom.md b/rescript-templater/.github/ISSUE_TEMPLATE/custom.md index 48d5f81..99ebf00 100644 --- a/rescript-templater/.github/ISSUE_TEMPLATE/custom.md +++ b/rescript-templater/.github/ISSUE_TEMPLATE/custom.md @@ -1,3 +1,7 @@ + --- name: Custom issue template about: Describe this issue template's purpose here. diff --git a/rescript-templater/.github/ISSUE_TEMPLATE/documentation.md b/rescript-templater/.github/ISSUE_TEMPLATE/documentation.md index 4fcb9f9..b1d16df 100644 --- a/rescript-templater/.github/ISSUE_TEMPLATE/documentation.md +++ b/rescript-templater/.github/ISSUE_TEMPLATE/documentation.md @@ -1,3 +1,7 @@ + --- name: Documentation about: Report unclear, missing, or incorrect documentation diff --git a/rescript-templater/.github/ISSUE_TEMPLATE/feature_request.md b/rescript-templater/.github/ISSUE_TEMPLATE/feature_request.md index 3e8fa7e..a5a5693 100644 --- a/rescript-templater/.github/ISSUE_TEMPLATE/feature_request.md +++ b/rescript-templater/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,3 +1,7 @@ + --- name: Feature request about: Suggest an idea for this project diff --git a/rescript-templater/.github/ISSUE_TEMPLATE/question.md b/rescript-templater/.github/ISSUE_TEMPLATE/question.md index fd0e2a5..c2d1f57 100644 --- a/rescript-templater/.github/ISSUE_TEMPLATE/question.md +++ b/rescript-templater/.github/ISSUE_TEMPLATE/question.md @@ -1,3 +1,7 @@ + --- name: Question about: Ask a question about usage or behaviour diff --git a/rescript-templater/.github/pull_request_template.md b/rescript-templater/.github/pull_request_template.md index d7cbedd..e043b3c 100644 --- a/rescript-templater/.github/pull_request_template.md +++ b/rescript-templater/.github/pull_request_template.md @@ -1,3 +1,7 @@ + # Pull Request ## Description diff --git a/rescript-templater/.github/workflows/ci.yml b/rescript-templater/.github/workflows/ci.yml index c84988e..92c57aa 100644 --- a/rescript-templater/.github/workflows/ci.yml +++ b/rescript-templater/.github/workflows/ci.yml @@ -12,6 +12,7 @@ jobs: test-powershell: name: Test PowerShell Scaffolder runs-on: ${{ matrix.os }} + timeout-minutes: 15 strategy: matrix: os: [windows-latest, ubuntu-latest, macos-latest] @@ -184,6 +185,7 @@ jobs: test-racket: name: Test Racket Scaffolder runs-on: ${{ matrix.os }} + timeout-minutes: 15 strategy: matrix: os: [ubuntu-latest, macos-latest, windows-latest] @@ -245,6 +247,7 @@ jobs: test-bash: name: Test Bash Scaffolder runs-on: ${{ matrix.os }} + timeout-minutes: 15 strategy: matrix: os: [ubuntu-latest, macos-latest] @@ -282,6 +285,7 @@ jobs: lint-powershell: name: Lint PowerShell runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -309,6 +313,7 @@ jobs: lint-racket: name: Lint Racket runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -328,6 +333,7 @@ jobs: test-documentation: name: Test Documentation runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -357,6 +363,7 @@ jobs: security-scan: name: Security Scan runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -379,6 +386,7 @@ jobs: test-cross-platform-compatibility: name: Cross-Platform Compatibility runs-on: ${{ matrix.os }} + timeout-minutes: 15 strategy: matrix: os: [windows-latest, ubuntu-latest, macos-latest] @@ -407,6 +415,7 @@ jobs: integration-test: name: Integration Test - Full Workflow runs-on: ubuntu-latest + timeout-minutes: 15 needs: [test-powershell, test-racket] steps: @@ -442,6 +451,7 @@ jobs: status-check: name: Status Check runs-on: ubuntu-latest + timeout-minutes: 15 needs: [test-powershell, test-racket, test-bash, lint-powershell, lint-racket, test-documentation, integration-test] if: always() diff --git a/rescript-templater/.github/workflows/codeql.yml b/rescript-templater/.github/workflows/codeql.yml index b20ebad..d5d5893 100644 --- a/rescript-templater/.github/workflows/codeql.yml +++ b/rescript-templater/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/rescript-templater/.github/workflows/comprehensive-quality.yml b/rescript-templater/.github/workflows/comprehensive-quality.yml index b0466da..d975e2b 100644 --- a/rescript-templater/.github/workflows/comprehensive-quality.yml +++ b/rescript-templater/.github/workflows/comprehensive-quality.yml @@ -11,6 +11,7 @@ jobs: # DEPENDABILITY - Stability and reliability dependability: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Check test coverage @@ -30,6 +31,7 @@ jobs: # SECURITY - Multi-layer security scanning security: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Secret scanning @@ -50,6 +52,7 @@ jobs: # INTEROPERABILITY - API and format compatibility interoperability: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Check API specs @@ -67,6 +70,7 @@ jobs: # VALIDATION - Input/output validation validation: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Check for validation patterns @@ -77,6 +81,7 @@ jobs: # ATTESTATION - Supply chain integrity (SLSA) attestation: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: id-token: write contents: read @@ -97,6 +102,7 @@ jobs: # VERIFICATION - Formal methods where applicable verification: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Check SPARK proofs @@ -113,6 +119,7 @@ jobs: # FUNCTIONALITY - Feature completeness functionality: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Check TODOs and FIXMEs @@ -126,6 +133,7 @@ jobs: # PERFORMANCE - Benchmarks and profiling performance: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Check for benchmarks @@ -142,6 +150,7 @@ jobs: # ACCESSIBILITY - A11y compliance accessibility: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/*.html') != '' steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 @@ -157,6 +166,7 @@ jobs: # LICENSE COMPLIANCE license: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Check license files @@ -175,6 +185,7 @@ jobs: # DOCUMENTATION QUALITY documentation: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Check docs completeness diff --git a/rescript-templater/.github/workflows/guix-nix-policy.yml b/rescript-templater/.github/workflows/guix-nix-policy.yml index c9da134..08f5dcd 100644 --- a/rescript-templater/.github/workflows/guix-nix-policy.yml +++ b/rescript-templater/.github/workflows/guix-nix-policy.yml @@ -7,6 +7,7 @@ permissions: read-all jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/rescript-templater/.github/workflows/hypatia-scan.yml b/rescript-templater/.github/workflows/hypatia-scan.yml index 5b59919..49e830d 100644 --- a/rescript-templater/.github/workflows/hypatia-scan.yml +++ b/rescript-templater/.github/workflows/hypatia-scan.yml @@ -17,6 +17,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/rescript-templater/.github/workflows/instant-sync.yml b/rescript-templater/.github/workflows/instant-sync.yml index 00f9d6b..62a0f3e 100644 --- a/rescript-templater/.github/workflows/instant-sync.yml +++ b/rescript-templater/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3 diff --git a/rescript-templater/.github/workflows/jekyll-gh-pages.yml b/rescript-templater/.github/workflows/jekyll-gh-pages.yml index 3e851dd..0509012 100644 --- a/rescript-templater/.github/workflows/jekyll-gh-pages.yml +++ b/rescript-templater/.github/workflows/jekyll-gh-pages.yml @@ -26,6 +26,7 @@ jobs: # Build job build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 @@ -45,6 +46,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: - name: Deploy to GitHub Pages diff --git a/rescript-templater/.github/workflows/mirror.yml b/rescript-templater/.github/workflows/mirror.yml index 90011ad..f5c9bb4 100644 --- a/rescript-templater/.github/workflows/mirror.yml +++ b/rescript-templater/.github/workflows/mirror.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: mirror-gitlab: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITLAB_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -30,6 +31,7 @@ jobs: mirror-bitbucket: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.BITBUCKET_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -48,6 +50,7 @@ jobs: mirror-codeberg: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.CODEBERG_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -66,6 +69,7 @@ jobs: mirror-sourcehut: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.SOURCEHUT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -84,6 +88,7 @@ jobs: mirror-disroot: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.DISROOT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -102,6 +107,7 @@ jobs: mirror-gitea: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITEA_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -120,6 +126,7 @@ jobs: mirror-radicle: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.RADICLE_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 diff --git a/rescript-templater/.github/workflows/npm-bun-blocker.yml b/rescript-templater/.github/workflows/npm-bun-blocker.yml index 33c4d70..c09f904 100644 --- a/rescript-templater/.github/workflows/npm-bun-blocker.yml +++ b/rescript-templater/.github/workflows/npm-bun-blocker.yml @@ -7,6 +7,7 @@ permissions: read-all jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/rescript-templater/.github/workflows/publish.yml b/rescript-templater/.github/workflows/publish.yml index c6df122..13d2e2b 100644 --- a/rescript-templater/.github/workflows/publish.yml +++ b/rescript-templater/.github/workflows/publish.yml @@ -33,6 +33,7 @@ jobs: validate: name: Pre-Publish Validation runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 @@ -97,6 +98,7 @@ jobs: name: Publish to PowerShell Gallery needs: validate runs-on: ubuntu-latest + timeout-minutes: 15 if: | github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.publish_psgallery) @@ -151,6 +153,7 @@ jobs: name: Publish Container Image needs: validate runs-on: ubuntu-latest + timeout-minutes: 15 if: | github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.publish_container) @@ -212,6 +215,7 @@ jobs: name: Trigger Zenodo Archival needs: validate runs-on: ubuntu-latest + timeout-minutes: 15 if: | github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.publish_zenodo) @@ -231,6 +235,7 @@ jobs: name: Archive to Software Heritage needs: validate runs-on: ubuntu-latest + timeout-minutes: 15 if: github.event_name == 'release' steps: - name: Request Software Heritage archival @@ -255,6 +260,7 @@ jobs: name: Notify Release needs: [publish-psgallery, publish-container, trigger-zenodo, software-heritage] runs-on: ubuntu-latest + timeout-minutes: 15 if: always() && github.event_name == 'release' steps: - name: Create release summary diff --git a/rescript-templater/.github/workflows/quality.yml b/rescript-templater/.github/workflows/quality.yml index 6c89d43..da3c617 100644 --- a/rescript-templater/.github/workflows/quality.yml +++ b/rescript-templater/.github/workflows/quality.yml @@ -8,6 +8,7 @@ permissions: read-all jobs: lint: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: @@ -40,6 +41,7 @@ jobs: docs: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/rescript-templater/.github/workflows/release.yml b/rescript-templater/.github/workflows/release.yml index e04c78b..b680f0f 100644 --- a/rescript-templater/.github/workflows/release.yml +++ b/rescript-templater/.github/workflows/release.yml @@ -15,6 +15,7 @@ jobs: create-release: name: Create Release runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: write @@ -104,6 +105,7 @@ jobs: name: Test Release Artifacts needs: create-release runs-on: ${{ matrix.os }} + timeout-minutes: 15 strategy: matrix: os: [windows-latest, ubuntu-latest, macos-latest] @@ -133,6 +135,7 @@ jobs: name: Publish to Package Registries needs: create-release runs-on: ubuntu-latest + timeout-minutes: 15 if: startsWith(github.ref, 'refs/tags/v') steps: @@ -168,6 +171,7 @@ jobs: name: Notify Release needs: [create-release, test-release-artifacts] runs-on: ubuntu-latest + timeout-minutes: 15 if: always() steps: diff --git a/rescript-templater/.github/workflows/rsr-antipattern.yml b/rescript-templater/.github/workflows/rsr-antipattern.yml index adf7ea6..c581aef 100644 --- a/rescript-templater/.github/workflows/rsr-antipattern.yml +++ b/rescript-templater/.github/workflows/rsr-antipattern.yml @@ -1,9 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 -# RSR Anti-Pattern CI Check -# SPDX-License-Identifier: MPL-2.0 -# -# Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm -# Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme +# RSR Anti-Pattern Check - Uses reusable workflow from standards name: RSR Anti-Pattern Check @@ -13,80 +9,8 @@ on: pull_request: branches: [main, master, develop] - -permissions: read-all - jobs: antipattern-check: - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - - name: Check for TypeScript - run: | - # Exclude bindings/deno/ - those are Deno FFI files using Deno.dlopen, not plain TypeScript - # Exclude .d.ts files - those are TypeScript type declarations for ReScript FFI - TS_FILES=$(find . \( -name "*.ts" -o -name "*.tsx" \) | grep -v node_modules | grep -v 'bindings/deno' | grep -v '\.d\.ts$' || true) - if [ -n "$TS_FILES" ]; then - echo "❌ TypeScript files detected - use ReScript instead" - echo "$TS_FILES" - exit 1 - fi - echo "✅ No TypeScript files (Deno FFI bindings excluded)" - - - name: Check for Go - run: | - if find . -name "*.go" | grep -q .; then - echo "❌ Go files detected - use Rust/WASM instead" - find . -name "*.go" - exit 1 - fi - echo "✅ No Go files" - - - name: Check for Python (non-SaltStack) - run: | - PY_FILES=$(find . -name "*.py" | grep -v salt | grep -v _states | grep -v _modules | grep -v pillar | grep -v venv | grep -v __pycache__ || true) - if [ -n "$PY_FILES" ]; then - echo "❌ Python files detected - only allowed for SaltStack" - echo "$PY_FILES" - exit 1 - fi - echo "✅ No non-SaltStack Python files" - - - name: Check for npm lockfiles - run: | - if [ -f "package-lock.json" ] || [ -f "yarn.lock" ]; then - echo "❌ npm/yarn lockfile detected - use Deno instead" - exit 1 - fi - echo "✅ No npm lockfiles" - - - name: Check for tsconfig - run: | - if [ -f "tsconfig.json" ]; then - echo "❌ tsconfig.json detected - use ReScript instead" - exit 1 - fi - echo "✅ No tsconfig.json" - - - name: Verify Deno presence (if package.json exists) - run: | - if [ -f "package.json" ]; then - if [ ! -f "deno.json" ] && [ ! -f "deno.jsonc" ]; then - echo "⚠️ Warning: package.json without deno.json - migration recommended" - fi - fi - echo "✅ Deno configuration check complete" + uses: hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml@main + timeout-minutes: 10 - - name: Summary - run: | - echo "╔════════════════════════════════════════════════════════════╗" - echo "║ RSR Anti-Pattern Check Passed ✅ ║" - echo "║ ║" - echo "║ Allowed: ReScript, Deno, WASM, Rust, OCaml, Haskell, ║" - echo "║ Guile/Scheme, SaltStack (Python) ║" - echo "║ ║" - echo "║ Blocked: TypeScript, Go, npm, Python (non-Salt) ║" - echo "╚════════════════════════════════════════════════════════════╝" diff --git a/rescript-templater/.github/workflows/scorecard-enforcer.yml b/rescript-templater/.github/workflows/scorecard-enforcer.yml index c0fe267..b83315a 100644 --- a/rescript-templater/.github/workflows/scorecard-enforcer.yml +++ b/rescript-templater/.github/workflows/scorecard-enforcer.yml @@ -14,6 +14,7 @@ permissions: read-all jobs: scorecard: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write # For OIDC @@ -52,6 +53,7 @@ jobs: # Check specific high-priority items check-critical: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 diff --git a/rescript-templater/.github/workflows/scorecard.yml b/rescript-templater/.github/workflows/scorecard.yml index 476ed3f..8e2ce1b 100644 --- a/rescript-templater/.github/workflows/scorecard.yml +++ b/rescript-templater/.github/workflows/scorecard.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: analysis: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write diff --git a/rescript-templater/.github/workflows/secret-scanner.yml b/rescript-templater/.github/workflows/secret-scanner.yml index b2dcc86..4df01cb 100644 --- a/rescript-templater/.github/workflows/secret-scanner.yml +++ b/rescript-templater/.github/workflows/secret-scanner.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: trufflehog: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: @@ -24,6 +25,7 @@ jobs: gitleaks: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: @@ -37,6 +39,7 @@ jobs: # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 diff --git a/rescript-templater/.github/workflows/security-policy.yml b/rescript-templater/.github/workflows/security-policy.yml index 2006161..498eaa5 100644 --- a/rescript-templater/.github/workflows/security-policy.yml +++ b/rescript-templater/.github/workflows/security-policy.yml @@ -7,6 +7,7 @@ permissions: read-all jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/rescript-templater/.github/workflows/ts-blocker.yml b/rescript-templater/.github/workflows/ts-blocker.yml index b5914ef..eabfd8e 100644 --- a/rescript-templater/.github/workflows/ts-blocker.yml +++ b/rescript-templater/.github/workflows/ts-blocker.yml @@ -7,6 +7,7 @@ permissions: read-all jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/rescript-templater/.github/workflows/wellknown-enforcement.yml b/rescript-templater/.github/workflows/wellknown-enforcement.yml index 70b893e..d009606 100644 --- a/rescript-templater/.github/workflows/wellknown-enforcement.yml +++ b/rescript-templater/.github/workflows/wellknown-enforcement.yml @@ -20,6 +20,7 @@ permissions: read-all jobs: validate: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/rescript-templater/.github/workflows/workflow-linter.yml b/rescript-templater/.github/workflows/workflow-linter.yml index baef88d..a2438e7 100644 --- a/rescript-templater/.github/workflows/workflow-linter.yml +++ b/rescript-templater/.github/workflows/workflow-linter.yml @@ -17,6 +17,7 @@ permissions: read-all jobs: lint-workflows: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read diff --git a/rescript-templater/ABI-FFI-README.md b/rescript-templater/ABI-FFI-README.md index f06f72c..af300f5 100644 --- a/rescript-templater/ABI-FFI-README.md +++ b/rescript-templater/ABI-FFI-README.md @@ -1,3 +1,7 @@ + {{~ Aditionally delete this line and fill out the template below ~}} # {{PROJECT}} ABI/FFI Documentation diff --git a/rescript-templater/ARCHIVAL.md b/rescript-templater/ARCHIVAL.md index 916334b..56b2371 100644 --- a/rescript-templater/ARCHIVAL.md +++ b/rescript-templater/ARCHIVAL.md @@ -1,3 +1,7 @@ + # Long-Term Archival Guide This document describes the project's long-term preservation strategy using Software Heritage and Zenodo. diff --git a/rescript-templater/CHANGELOG.adoc b/rescript-templater/CHANGELOG.adoc index f5656fe..93ae639 100644 --- a/rescript-templater/CHANGELOG.adoc +++ b/rescript-templater/CHANGELOG.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Changelog All notable changes to this project will be documented in this file. diff --git a/rescript-templater/CLAUDE.md b/rescript-templater/CLAUDE.md index 24421b4..de96eb3 100644 --- a/rescript-templater/CLAUDE.md +++ b/rescript-templater/CLAUDE.md @@ -1,3 +1,7 @@ + # CLAUDE.md - Zotero ReScript Templater ## Project Overview diff --git a/rescript-templater/CODE_OF_CONDUCT.md b/rescript-templater/CODE_OF_CONDUCT.md index fae88a1..fce5ff5 100644 --- a/rescript-templater/CODE_OF_CONDUCT.md +++ b/rescript-templater/CODE_OF_CONDUCT.md @@ -1,3 +1,7 @@ + # Contributor Covenant Code of Conduct ## Our Pledge diff --git a/rescript-templater/CONTRIBUTING.adoc b/rescript-templater/CONTRIBUTING.adoc index 1f34e60..2ead10c 100644 --- a/rescript-templater/CONTRIBUTING.adoc +++ b/rescript-templater/CONTRIBUTING.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contributing Guide == Getting Started diff --git a/rescript-templater/CONTRIBUTING.md b/rescript-templater/CONTRIBUTING.md index e2e5073..ecc9102 100644 --- a/rescript-templater/CONTRIBUTING.md +++ b/rescript-templater/CONTRIBUTING.md @@ -1,3 +1,7 @@ + # Clone the repository git clone https://github.com/hyperpolymath/zotero-tools.git cd zotero-tools diff --git a/rescript-templater/FORMAL_VERIFICATION.md b/rescript-templater/FORMAL_VERIFICATION.md index ebf6f57..dc84866 100644 --- a/rescript-templater/FORMAL_VERIFICATION.md +++ b/rescript-templater/FORMAL_VERIFICATION.md @@ -1,3 +1,7 @@ + # Formal Verification Guide This document describes formal verification concepts, current implementations, and future directions for the Zotero ReScript Templater project. diff --git a/rescript-templater/GPG_SIGNING.md b/rescript-templater/GPG_SIGNING.md index 0af4e92..46b7456 100644 --- a/rescript-templater/GPG_SIGNING.md +++ b/rescript-templater/GPG_SIGNING.md @@ -1,3 +1,7 @@ + # GPG Signing Guide This document explains how to sign releases, commits, and artifacts with GPG for cryptographic verification. diff --git a/rescript-templater/MAINTAINERS.adoc b/rescript-templater/MAINTAINERS.adoc index a1c6544..becaa3e 100644 --- a/rescript-templater/MAINTAINERS.adoc +++ b/rescript-templater/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/rescript-templater/MAINTAINERS.md b/rescript-templater/MAINTAINERS.md index f60109d..faf42f4 100644 --- a/rescript-templater/MAINTAINERS.md +++ b/rescript-templater/MAINTAINERS.md @@ -1,3 +1,7 @@ + # Maintainers This document lists the maintainers of the Zotero ReScript Templater project and describes the governance model. diff --git a/rescript-templater/PALIMPSEST.adoc b/rescript-templater/PALIMPSEST.adoc index ebaa6d0..9660f13 100644 --- a/rescript-templater/PALIMPSEST.adoc +++ b/rescript-templater/PALIMPSEST.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Palimpsest License :toc: :toc-placement!: diff --git a/rescript-templater/PUBLISHING.md b/rescript-templater/PUBLISHING.md index a4c5852..b9b04c9 100644 --- a/rescript-templater/PUBLISHING.md +++ b/rescript-templater/PUBLISHING.md @@ -1,3 +1,7 @@ + # Publishing Guide This document describes how to publish the Zotero ReScript Templater to various package repositories and distribution channels. diff --git a/rescript-templater/README.adoc b/rescript-templater/README.adoc index b6229b7..1d83696 100644 --- a/rescript-templater/README.adoc +++ b/rescript-templater/README.adoc @@ -1,7 +1,8 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Zotero ReScript Templater image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] -// SPDX-License-Identifier: MPL-2.0 // SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell :toc: left diff --git a/rescript-templater/ROADMAP.adoc b/rescript-templater/ROADMAP.adoc index 729376e..049e2ea 100644 --- a/rescript-templater/ROADMAP.adoc +++ b/rescript-templater/ROADMAP.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Rescript Templater Roadmap == Current Status diff --git a/rescript-templater/RSR_COMPLIANCE.md b/rescript-templater/RSR_COMPLIANCE.md index e3af0a9..28e62cc 100644 --- a/rescript-templater/RSR_COMPLIANCE.md +++ b/rescript-templater/RSR_COMPLIANCE.md @@ -1,3 +1,7 @@ + # RSR Framework Compliance Status **Project:** Zotero ReScript Templater diff --git a/rescript-templater/RSR_COMPLIANCE_ACTUAL.md b/rescript-templater/RSR_COMPLIANCE_ACTUAL.md index 2202fee..23d6579 100644 --- a/rescript-templater/RSR_COMPLIANCE_ACTUAL.md +++ b/rescript-templater/RSR_COMPLIANCE_ACTUAL.md @@ -1,3 +1,7 @@ + # Rhodium Standard Repository (RSR) Compliance Assessment **Project:** ZoteRho Templater (Zotero + Rhodium) diff --git a/rescript-templater/RSR_OUTLINE.adoc b/rescript-templater/RSR_OUTLINE.adoc index e429244..2901b24 100644 --- a/rescript-templater/RSR_OUTLINE.adoc +++ b/rescript-templater/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/rescript-templater/SECURITY.md b/rescript-templater/SECURITY.md index 14f1011..8216d18 100644 --- a/rescript-templater/SECURITY.md +++ b/rescript-templater/SECURITY.md @@ -1,3 +1,7 @@ + # Security Policy ## Supported Versions diff --git a/rescript-templater/TPCF.md b/rescript-templater/TPCF.md index 0b7de7b..fadb023 100644 --- a/rescript-templater/TPCF.md +++ b/rescript-templater/TPCF.md @@ -1,3 +1,7 @@ + # TPCF: Tri-Perimeter Contribution Framework **Project:** Zotero ReScript Templater diff --git a/rescript-templater/contractiles/README.adoc b/rescript-templater/contractiles/README.adoc index d19a387..70ad712 100644 --- a/rescript-templater/contractiles/README.adoc +++ b/rescript-templater/contractiles/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractiles Template Set :toc: :sectnums: diff --git a/rescript-templater/contractiles/k9/README.adoc b/rescript-templater/contractiles/k9/README.adoc deleted file mode 100644 index 9c3099f..0000000 --- a/rescript-templater/contractiles/k9/README.adoc +++ /dev/null @@ -1,178 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -= K9 Contractiles -:toc: left -:icons: font - -== What Are K9 Contractiles? - -K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. - -== The Three Security Levels - -K9 components declare their trust requirements using "The Leash" security model: - -[horizontal] -`'Kennel`:: Pure data, no execution (safest) -`'Yard`:: Nickel evaluation with contracts (medium trust) -`'Hunt`:: Full execution with Just recipes (requires signature) - -== Example Components - -This directory contains example K9 contractiles for common repository tasks: - -=== Kennel Level (Pure Data) - -**File:** `examples/project-metadata.k9.ncl` - -Pure configuration data with no execution. Safe to include in any repository. - -**Use cases:** -- Project metadata (name, version, description) -- Build configuration -- Tool settings -- Data schemas - -**Security:** No signature required, data-only. - -=== Yard Level (Validated Config) - -**File:** `examples/ci-config.k9.ncl` - -Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. - -**Use cases:** -- CI/CD configuration with validation -- Deployment parameters -- Database schemas with constraints -- API specifications - -**Security:** Signature recommended, Nickel evaluation only. - -=== Hunt Level (Full Execution) - -**File:** `examples/setup-repo.k9.ncl` - -Full execution with Just recipes. Can run shell commands and modify filesystem. - -**Use cases:** -- Repository setup scripts -- Deployment automation -- System configuration -- Package installation - -**Security:** **Signature required**, full system access. - -== Usage in Your Repository - -=== 1. Create K9 Components - -Choose the appropriate security level for your use case: - -[source,bash] ----- -# Kennel: Pure configuration -cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl - -# Yard: Validated configuration -cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl - -# Hunt: Full automation -cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl ----- - -=== 2. Validate Components - -[source,bash] ----- -# Validate Nickel syntax and contracts -nickel typecheck config/metadata.k9.ncl - -# Verify Hunt-level signature (if signed) -./must verify scripts/setup.k9.ncl ----- - -=== 3. Execute Components - -[source,bash] ----- -# Kennel: Export as JSON -nickel export config/metadata.k9.ncl > metadata.json - -# Yard: Evaluate with validation -nickel eval .github/ci.k9.ncl - -# Hunt: Run with Just (dry-run first!) -./must --dry-run run scripts/setup.k9.ncl -./must run scripts/setup.k9.ncl ----- - -== Integration with RSR - -K9 contractiles integrate with other RSR standards: - -**STATE.scm**:: K9 components can generate or validate STATE.scm -**ECOSYSTEM.scm**:: K9 can automate cross-repo operations -**META.scm**:: K9 can enforce architectural decisions - -== Security Best Practices - -=== For Kennel/Yard Components - -✅ **Safe to use without signatures** + -✅ **Review Nickel code before use** + -✅ **Validate contracts match expectations** - -=== For Hunt Components - -⚠️ **ALWAYS verify signatures** + -⚠️ **Review Just recipes carefully** + -⚠️ **Run dry-run mode first** + -⚠️ **Never run as root unless required** + -⚠️ **Sandbox external components** - -**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc - -== Template Files - -Use these as starting points for your own K9 components: - -- `template-kennel.k9.ncl` - Pure data template -- `template-yard.k9.ncl` - Validated config template -- `template-hunt.k9.ncl` - Full execution template - -== Dependencies - -To use K9 contractiles in your repository: - -[source,bash] ----- -# Install Nickel (configuration language) -curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel -chmod +x nickel && sudo mv nickel /usr/local/bin/ - -# Install Just (task runner, for Hunt level) -cargo install just - -# Clone K9-SVC (for must shim and tooling) -git clone https://github.com/hyperpolymath/standards.git -# Note: K9-SVC is located in standards/k9-svc ----- - -== Learn More - -- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc -- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc -- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc -- **IANA Media Type:** `application/vnd.k9+nickel` - -== Contributing - -When adding K9 contractiles to your repository: - -1. Use appropriate security level (Kennel > Yard > Hunt) -2. Document what each component does -3. Include validation contracts in Yard/Hunt components -4. Sign Hunt-level components before committing -5. Add K9 validation to CI/CD pipeline - -**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/rescript-templater/contractiles/self-validating/README.adoc b/rescript-templater/contractiles/self-validating/README.adoc new file mode 100644 index 0000000..ce1825f --- /dev/null +++ b/rescript-templater/contractiles/self-validating/README.adoc @@ -0,0 +1,179 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell += K9 Contractiles +:toc: left +:icons: font + +== What Are K9 Contractiles? + +K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. + +== The Three Security Levels + +K9 components declare their trust requirements using "The Leash" security model: + +[horizontal] +`'Kennel`:: Pure data, no execution (safest) +`'Yard`:: Nickel evaluation with contracts (medium trust) +`'Hunt`:: Full execution with Just recipes (requires signature) + +== Example Components + +This directory contains example K9 contractiles for common repository tasks: + +=== Kennel Level (Pure Data) + +**File:** `examples/project-metadata.k9.ncl` + +Pure configuration data with no execution. Safe to include in any repository. + +**Use cases:** +- Project metadata (name, version, description) +- Build configuration +- Tool settings +- Data schemas + +**Security:** No signature required, data-only. + +=== Yard Level (Validated Config) + +**File:** `examples/ci-config.k9.ncl` + +Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. + +**Use cases:** +- CI/CD configuration with validation +- Deployment parameters +- Database schemas with constraints +- API specifications + +**Security:** Signature recommended, Nickel evaluation only. + +=== Hunt Level (Full Execution) + +**File:** `examples/setup-repo.k9.ncl` + +Full execution with Just recipes. Can run shell commands and modify filesystem. + +**Use cases:** +- Repository setup scripts +- Deployment automation +- System configuration +- Package installation + +**Security:** **Signature required**, full system access. + +== Usage in Your Repository + +=== 1. Create K9 Components + +Choose the appropriate security level for your use case: + +[source,bash] +---- +# Kennel: Pure configuration +cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl + +# Yard: Validated configuration +cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl + +# Hunt: Full automation +cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl +---- + +=== 2. Validate Components + +[source,bash] +---- +# Validate Nickel syntax and contracts +nickel typecheck config/metadata.k9.ncl + +# Verify Hunt-level signature (if signed) +./must verify scripts/setup.k9.ncl +---- + +=== 3. Execute Components + +[source,bash] +---- +# Kennel: Export as JSON +nickel export config/metadata.k9.ncl > metadata.json + +# Yard: Evaluate with validation +nickel eval .github/ci.k9.ncl + +# Hunt: Run with Just (dry-run first!) +./must --dry-run run scripts/setup.k9.ncl +./must run scripts/setup.k9.ncl +---- + +== Integration with RSR + +K9 contractiles integrate with other RSR standards: + +**STATE.scm**:: K9 components can generate or validate STATE.scm +**ECOSYSTEM.scm**:: K9 can automate cross-repo operations +**META.scm**:: K9 can enforce architectural decisions + +== Security Best Practices + +=== For Kennel/Yard Components + +✅ **Safe to use without signatures** + +✅ **Review Nickel code before use** + +✅ **Validate contracts match expectations** + +=== For Hunt Components + +⚠️ **ALWAYS verify signatures** + +⚠️ **Review Just recipes carefully** + +⚠️ **Run dry-run mode first** + +⚠️ **Never run as root unless required** + +⚠️ **Sandbox external components** + +**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc + +== Template Files + +Use these as starting points for your own K9 components: + +- `template-kennel.k9.ncl` - Pure data template +- `template-yard.k9.ncl` - Validated config template +- `template-hunt.k9.ncl` - Full execution template + +== Dependencies + +To use K9 contractiles in your repository: + +[source,bash] +---- +# Install Nickel (configuration language) +curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel +chmod +x nickel && sudo mv nickel /usr/local/bin/ + +# Install Just (task runner, for Hunt level) +cargo install just + +# Clone K9-SVC (for must shim and tooling) +git clone https://github.com/hyperpolymath/standards.git +# Note: K9-SVC is located in standards/k9-svc +---- + +== Learn More + +- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc +- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc +- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc +- **IANA Media Type:** `application/vnd.k9+nickel` + +== Contributing + +When adding K9 contractiles to your repository: + +1. Use appropriate security level (Kennel > Yard > Hunt) +2. Document what each component does +3. Include validation contracts in Yard/Hunt components +4. Sign Hunt-level components before committing +5. Add K9 validation to CI/CD pipeline + +**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/rescript-templater/contractiles/k9/examples/ci-config.k9.ncl b/rescript-templater/contractiles/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from rescript-templater/contractiles/k9/examples/ci-config.k9.ncl rename to rescript-templater/contractiles/self-validating/examples/ci-config.k9.ncl diff --git a/rescript-templater/contractiles/k9/examples/project-metadata.k9.ncl b/rescript-templater/contractiles/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from rescript-templater/contractiles/k9/examples/project-metadata.k9.ncl rename to rescript-templater/contractiles/self-validating/examples/project-metadata.k9.ncl diff --git a/rescript-templater/contractiles/k9/examples/setup-repo.k9.ncl b/rescript-templater/contractiles/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from rescript-templater/contractiles/k9/examples/setup-repo.k9.ncl rename to rescript-templater/contractiles/self-validating/examples/setup-repo.k9.ncl diff --git a/rescript-templater/contractiles/k9/template-hunt.k9.ncl b/rescript-templater/contractiles/self-validating/template-hunt.k9.ncl similarity index 100% rename from rescript-templater/contractiles/k9/template-hunt.k9.ncl rename to rescript-templater/contractiles/self-validating/template-hunt.k9.ncl diff --git a/rescript-templater/contractiles/k9/template-kennel.k9.ncl b/rescript-templater/contractiles/self-validating/template-kennel.k9.ncl similarity index 100% rename from rescript-templater/contractiles/k9/template-kennel.k9.ncl rename to rescript-templater/contractiles/self-validating/template-kennel.k9.ncl diff --git a/rescript-templater/contractiles/k9/template-yard.k9.ncl b/rescript-templater/contractiles/self-validating/template-yard.k9.ncl similarity index 100% rename from rescript-templater/contractiles/k9/template-yard.k9.ncl rename to rescript-templater/contractiles/self-validating/template-yard.k9.ncl diff --git a/rescript-templater/docs/CITATIONS.adoc b/rescript-templater/docs/CITATIONS.adoc index 54ba0b8..4033ed5 100644 --- a/rescript-templater/docs/CITATIONS.adoc +++ b/rescript-templater/docs/CITATIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = zotero-rescript-templater - Citation Guide :toc: diff --git a/rescript-templater/ffi/zig/build.zig b/rescript-templater/ffi/zig/build.zig index 4a2e049..c02617f 100644 --- a/rescript-templater/ffi/zig/build.zig +++ b/rescript-templater/ffi/zig/build.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} FFI Build Configuration // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} FFI Build Configuration const std = @import("std"); diff --git a/rescript-templater/ffi/zig/src/main.zig b/rescript-templater/ffi/zig/src/main.zig index 6b233bc..f1b2633 100644 --- a/rescript-templater/ffi/zig/src/main.zig +++ b/rescript-templater/ffi/zig/src/main.zig @@ -1,9 +1,10 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // {{PROJECT}} FFI Implementation // // This module implements the C-compatible FFI declared in src/abi/Foreign.idr // All types and layouts must match the Idris2 ABI definitions. // -// SPDX-License-Identifier: MPL-2.0 const std = @import("std"); diff --git a/rescript-templater/ffi/zig/test/integration_test.zig b/rescript-templater/ffi/zig/test/integration_test.zig index 0341994..e481508 100644 --- a/rescript-templater/ffi/zig/test/integration_test.zig +++ b/rescript-templater/ffi/zig/test/integration_test.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} Integration Tests // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} Integration Tests // // These tests verify that the Zig FFI correctly implements the Idris2 ABI diff --git a/safe-storage/.claude/CLAUDE.md b/safe-storage/.claude/CLAUDE.md index a2076bd..30fca2e 100644 --- a/safe-storage/.claude/CLAUDE.md +++ b/safe-storage/.claude/CLAUDE.md @@ -1,3 +1,7 @@ + # CLAUDE.md - AI Assistant Instructions ## Machine-Readable Artefacts diff --git a/safe-storage/.github/ISSUE_TEMPLATE/bug_report.md b/safe-storage/.github/ISSUE_TEMPLATE/bug_report.md index dd84ea7..15a8978 100644 --- a/safe-storage/.github/ISSUE_TEMPLATE/bug_report.md +++ b/safe-storage/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,3 +1,7 @@ + --- name: Bug report about: Create a report to help us improve diff --git a/safe-storage/.github/ISSUE_TEMPLATE/custom.md b/safe-storage/.github/ISSUE_TEMPLATE/custom.md index 48d5f81..99ebf00 100644 --- a/safe-storage/.github/ISSUE_TEMPLATE/custom.md +++ b/safe-storage/.github/ISSUE_TEMPLATE/custom.md @@ -1,3 +1,7 @@ + --- name: Custom issue template about: Describe this issue template's purpose here. diff --git a/safe-storage/.github/ISSUE_TEMPLATE/feature_request.md b/safe-storage/.github/ISSUE_TEMPLATE/feature_request.md index bbcbbe7..41a5455 100644 --- a/safe-storage/.github/ISSUE_TEMPLATE/feature_request.md +++ b/safe-storage/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,3 +1,7 @@ + --- name: Feature request about: Suggest an idea for this project diff --git a/safe-storage/.github/workflows/codeql.yml b/safe-storage/.github/workflows/codeql.yml index 489b82c..b8d1fd6 100644 --- a/safe-storage/.github/workflows/codeql.yml +++ b/safe-storage/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/safe-storage/.github/workflows/governance.yml b/safe-storage/.github/workflows/governance.yml index b4062e0..a044174 100644 --- a/safe-storage/.github/workflows/governance.yml +++ b/safe-storage/.github/workflows/governance.yml @@ -24,3 +24,4 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 + timeout-minutes: 10 diff --git a/safe-storage/.github/workflows/hypatia-scan.yml b/safe-storage/.github/workflows/hypatia-scan.yml index 5b59919..49e830d 100644 --- a/safe-storage/.github/workflows/hypatia-scan.yml +++ b/safe-storage/.github/workflows/hypatia-scan.yml @@ -17,6 +17,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/safe-storage/.github/workflows/mirror.yml b/safe-storage/.github/workflows/mirror.yml index 90011ad..f5c9bb4 100644 --- a/safe-storage/.github/workflows/mirror.yml +++ b/safe-storage/.github/workflows/mirror.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: mirror-gitlab: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITLAB_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -30,6 +31,7 @@ jobs: mirror-bitbucket: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.BITBUCKET_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -48,6 +50,7 @@ jobs: mirror-codeberg: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.CODEBERG_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -66,6 +69,7 @@ jobs: mirror-sourcehut: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.SOURCEHUT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -84,6 +88,7 @@ jobs: mirror-disroot: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.DISROOT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -102,6 +107,7 @@ jobs: mirror-gitea: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITEA_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -120,6 +126,7 @@ jobs: mirror-radicle: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.RADICLE_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 diff --git a/safe-storage/.github/workflows/scorecard.yml b/safe-storage/.github/workflows/scorecard.yml index 476ed3f..8e2ce1b 100644 --- a/safe-storage/.github/workflows/scorecard.yml +++ b/safe-storage/.github/workflows/scorecard.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: analysis: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write diff --git a/safe-storage/.github/workflows/secret-scanner.yml b/safe-storage/.github/workflows/secret-scanner.yml index b2dcc86..4df01cb 100644 --- a/safe-storage/.github/workflows/secret-scanner.yml +++ b/safe-storage/.github/workflows/secret-scanner.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: trufflehog: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: @@ -24,6 +25,7 @@ jobs: gitleaks: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: @@ -37,6 +39,7 @@ jobs: # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 diff --git a/safe-storage/ABI-FFI-README.md b/safe-storage/ABI-FFI-README.md index f06f72c..af300f5 100644 --- a/safe-storage/ABI-FFI-README.md +++ b/safe-storage/ABI-FFI-README.md @@ -1,3 +1,7 @@ + {{~ Aditionally delete this line and fill out the template below ~}} # {{PROJECT}} ABI/FFI Documentation diff --git a/safe-storage/CODE_OF_CONDUCT.md b/safe-storage/CODE_OF_CONDUCT.md index 18c9147..05e6568 100644 --- a/safe-storage/CODE_OF_CONDUCT.md +++ b/safe-storage/CODE_OF_CONDUCT.md @@ -1,3 +1,7 @@ + # Contributor Covenant Code of Conduct ## Our Pledge diff --git a/safe-storage/CONTRIBUTING.md b/safe-storage/CONTRIBUTING.md index 55ff5e4..9453c11 100644 --- a/safe-storage/CONTRIBUTING.md +++ b/safe-storage/CONTRIBUTING.md @@ -1 +1,5 @@ + TPM diff --git a/safe-storage/MAINTAINERS.adoc b/safe-storage/MAINTAINERS.adoc index a1c6544..becaa3e 100644 --- a/safe-storage/MAINTAINERS.adoc +++ b/safe-storage/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/safe-storage/PALIMPSEST.adoc b/safe-storage/PALIMPSEST.adoc index ebaa6d0..9660f13 100644 --- a/safe-storage/PALIMPSEST.adoc +++ b/safe-storage/PALIMPSEST.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Palimpsest License :toc: :toc-placement!: diff --git a/safe-storage/README.adoc b/safe-storage/README.adoc index 5480070..d0967d1 100644 --- a/safe-storage/README.adoc +++ b/safe-storage/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Zotero Safe Storage image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/safe-storage/ROADMAP.adoc b/safe-storage/ROADMAP.adoc index 30241ca..e33ef0b 100644 --- a/safe-storage/ROADMAP.adoc +++ b/safe-storage/ROADMAP.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Zotero Safe Storage Roadmap :toc: macro :toc-title: Contents diff --git a/safe-storage/RSR_OUTLINE.adoc b/safe-storage/RSR_OUTLINE.adoc index e429244..2901b24 100644 --- a/safe-storage/RSR_OUTLINE.adoc +++ b/safe-storage/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/safe-storage/SECURITY.md b/safe-storage/SECURITY.md index 84937e0..a6a2a3a 100644 --- a/safe-storage/SECURITY.md +++ b/safe-storage/SECURITY.md @@ -1,3 +1,7 @@ + # Security Policy We take security seriously and appreciate your efforts to responsibly disclose vulnerabilities. This policy outlines how to report security issues, what to expect, and how we recognize contributions. diff --git a/safe-storage/contractiles/README.adoc b/safe-storage/contractiles/README.adoc index d19a387..70ad712 100644 --- a/safe-storage/contractiles/README.adoc +++ b/safe-storage/contractiles/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractiles Template Set :toc: :sectnums: diff --git a/safe-storage/contractiles/k9/README.adoc b/safe-storage/contractiles/k9/README.adoc deleted file mode 100644 index 9c3099f..0000000 --- a/safe-storage/contractiles/k9/README.adoc +++ /dev/null @@ -1,178 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -= K9 Contractiles -:toc: left -:icons: font - -== What Are K9 Contractiles? - -K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. - -== The Three Security Levels - -K9 components declare their trust requirements using "The Leash" security model: - -[horizontal] -`'Kennel`:: Pure data, no execution (safest) -`'Yard`:: Nickel evaluation with contracts (medium trust) -`'Hunt`:: Full execution with Just recipes (requires signature) - -== Example Components - -This directory contains example K9 contractiles for common repository tasks: - -=== Kennel Level (Pure Data) - -**File:** `examples/project-metadata.k9.ncl` - -Pure configuration data with no execution. Safe to include in any repository. - -**Use cases:** -- Project metadata (name, version, description) -- Build configuration -- Tool settings -- Data schemas - -**Security:** No signature required, data-only. - -=== Yard Level (Validated Config) - -**File:** `examples/ci-config.k9.ncl` - -Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. - -**Use cases:** -- CI/CD configuration with validation -- Deployment parameters -- Database schemas with constraints -- API specifications - -**Security:** Signature recommended, Nickel evaluation only. - -=== Hunt Level (Full Execution) - -**File:** `examples/setup-repo.k9.ncl` - -Full execution with Just recipes. Can run shell commands and modify filesystem. - -**Use cases:** -- Repository setup scripts -- Deployment automation -- System configuration -- Package installation - -**Security:** **Signature required**, full system access. - -== Usage in Your Repository - -=== 1. Create K9 Components - -Choose the appropriate security level for your use case: - -[source,bash] ----- -# Kennel: Pure configuration -cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl - -# Yard: Validated configuration -cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl - -# Hunt: Full automation -cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl ----- - -=== 2. Validate Components - -[source,bash] ----- -# Validate Nickel syntax and contracts -nickel typecheck config/metadata.k9.ncl - -# Verify Hunt-level signature (if signed) -./must verify scripts/setup.k9.ncl ----- - -=== 3. Execute Components - -[source,bash] ----- -# Kennel: Export as JSON -nickel export config/metadata.k9.ncl > metadata.json - -# Yard: Evaluate with validation -nickel eval .github/ci.k9.ncl - -# Hunt: Run with Just (dry-run first!) -./must --dry-run run scripts/setup.k9.ncl -./must run scripts/setup.k9.ncl ----- - -== Integration with RSR - -K9 contractiles integrate with other RSR standards: - -**STATE.scm**:: K9 components can generate or validate STATE.scm -**ECOSYSTEM.scm**:: K9 can automate cross-repo operations -**META.scm**:: K9 can enforce architectural decisions - -== Security Best Practices - -=== For Kennel/Yard Components - -✅ **Safe to use without signatures** + -✅ **Review Nickel code before use** + -✅ **Validate contracts match expectations** - -=== For Hunt Components - -⚠️ **ALWAYS verify signatures** + -⚠️ **Review Just recipes carefully** + -⚠️ **Run dry-run mode first** + -⚠️ **Never run as root unless required** + -⚠️ **Sandbox external components** - -**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc - -== Template Files - -Use these as starting points for your own K9 components: - -- `template-kennel.k9.ncl` - Pure data template -- `template-yard.k9.ncl` - Validated config template -- `template-hunt.k9.ncl` - Full execution template - -== Dependencies - -To use K9 contractiles in your repository: - -[source,bash] ----- -# Install Nickel (configuration language) -curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel -chmod +x nickel && sudo mv nickel /usr/local/bin/ - -# Install Just (task runner, for Hunt level) -cargo install just - -# Clone K9-SVC (for must shim and tooling) -git clone https://github.com/hyperpolymath/standards.git -# Note: K9-SVC is located in standards/k9-svc ----- - -== Learn More - -- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc -- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc -- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc -- **IANA Media Type:** `application/vnd.k9+nickel` - -== Contributing - -When adding K9 contractiles to your repository: - -1. Use appropriate security level (Kennel > Yard > Hunt) -2. Document what each component does -3. Include validation contracts in Yard/Hunt components -4. Sign Hunt-level components before committing -5. Add K9 validation to CI/CD pipeline - -**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/safe-storage/contractiles/self-validating/README.adoc b/safe-storage/contractiles/self-validating/README.adoc new file mode 100644 index 0000000..ce1825f --- /dev/null +++ b/safe-storage/contractiles/self-validating/README.adoc @@ -0,0 +1,179 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell += K9 Contractiles +:toc: left +:icons: font + +== What Are K9 Contractiles? + +K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. + +== The Three Security Levels + +K9 components declare their trust requirements using "The Leash" security model: + +[horizontal] +`'Kennel`:: Pure data, no execution (safest) +`'Yard`:: Nickel evaluation with contracts (medium trust) +`'Hunt`:: Full execution with Just recipes (requires signature) + +== Example Components + +This directory contains example K9 contractiles for common repository tasks: + +=== Kennel Level (Pure Data) + +**File:** `examples/project-metadata.k9.ncl` + +Pure configuration data with no execution. Safe to include in any repository. + +**Use cases:** +- Project metadata (name, version, description) +- Build configuration +- Tool settings +- Data schemas + +**Security:** No signature required, data-only. + +=== Yard Level (Validated Config) + +**File:** `examples/ci-config.k9.ncl` + +Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. + +**Use cases:** +- CI/CD configuration with validation +- Deployment parameters +- Database schemas with constraints +- API specifications + +**Security:** Signature recommended, Nickel evaluation only. + +=== Hunt Level (Full Execution) + +**File:** `examples/setup-repo.k9.ncl` + +Full execution with Just recipes. Can run shell commands and modify filesystem. + +**Use cases:** +- Repository setup scripts +- Deployment automation +- System configuration +- Package installation + +**Security:** **Signature required**, full system access. + +== Usage in Your Repository + +=== 1. Create K9 Components + +Choose the appropriate security level for your use case: + +[source,bash] +---- +# Kennel: Pure configuration +cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl + +# Yard: Validated configuration +cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl + +# Hunt: Full automation +cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl +---- + +=== 2. Validate Components + +[source,bash] +---- +# Validate Nickel syntax and contracts +nickel typecheck config/metadata.k9.ncl + +# Verify Hunt-level signature (if signed) +./must verify scripts/setup.k9.ncl +---- + +=== 3. Execute Components + +[source,bash] +---- +# Kennel: Export as JSON +nickel export config/metadata.k9.ncl > metadata.json + +# Yard: Evaluate with validation +nickel eval .github/ci.k9.ncl + +# Hunt: Run with Just (dry-run first!) +./must --dry-run run scripts/setup.k9.ncl +./must run scripts/setup.k9.ncl +---- + +== Integration with RSR + +K9 contractiles integrate with other RSR standards: + +**STATE.scm**:: K9 components can generate or validate STATE.scm +**ECOSYSTEM.scm**:: K9 can automate cross-repo operations +**META.scm**:: K9 can enforce architectural decisions + +== Security Best Practices + +=== For Kennel/Yard Components + +✅ **Safe to use without signatures** + +✅ **Review Nickel code before use** + +✅ **Validate contracts match expectations** + +=== For Hunt Components + +⚠️ **ALWAYS verify signatures** + +⚠️ **Review Just recipes carefully** + +⚠️ **Run dry-run mode first** + +⚠️ **Never run as root unless required** + +⚠️ **Sandbox external components** + +**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc + +== Template Files + +Use these as starting points for your own K9 components: + +- `template-kennel.k9.ncl` - Pure data template +- `template-yard.k9.ncl` - Validated config template +- `template-hunt.k9.ncl` - Full execution template + +== Dependencies + +To use K9 contractiles in your repository: + +[source,bash] +---- +# Install Nickel (configuration language) +curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel +chmod +x nickel && sudo mv nickel /usr/local/bin/ + +# Install Just (task runner, for Hunt level) +cargo install just + +# Clone K9-SVC (for must shim and tooling) +git clone https://github.com/hyperpolymath/standards.git +# Note: K9-SVC is located in standards/k9-svc +---- + +== Learn More + +- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc +- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc +- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc +- **IANA Media Type:** `application/vnd.k9+nickel` + +== Contributing + +When adding K9 contractiles to your repository: + +1. Use appropriate security level (Kennel > Yard > Hunt) +2. Document what each component does +3. Include validation contracts in Yard/Hunt components +4. Sign Hunt-level components before committing +5. Add K9 validation to CI/CD pipeline + +**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/safe-storage/contractiles/k9/examples/ci-config.k9.ncl b/safe-storage/contractiles/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from safe-storage/contractiles/k9/examples/ci-config.k9.ncl rename to safe-storage/contractiles/self-validating/examples/ci-config.k9.ncl diff --git a/safe-storage/contractiles/k9/examples/project-metadata.k9.ncl b/safe-storage/contractiles/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from safe-storage/contractiles/k9/examples/project-metadata.k9.ncl rename to safe-storage/contractiles/self-validating/examples/project-metadata.k9.ncl diff --git a/safe-storage/contractiles/k9/examples/setup-repo.k9.ncl b/safe-storage/contractiles/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from safe-storage/contractiles/k9/examples/setup-repo.k9.ncl rename to safe-storage/contractiles/self-validating/examples/setup-repo.k9.ncl diff --git a/safe-storage/contractiles/k9/template-hunt.k9.ncl b/safe-storage/contractiles/self-validating/template-hunt.k9.ncl similarity index 100% rename from safe-storage/contractiles/k9/template-hunt.k9.ncl rename to safe-storage/contractiles/self-validating/template-hunt.k9.ncl diff --git a/safe-storage/contractiles/k9/template-kennel.k9.ncl b/safe-storage/contractiles/self-validating/template-kennel.k9.ncl similarity index 100% rename from safe-storage/contractiles/k9/template-kennel.k9.ncl rename to safe-storage/contractiles/self-validating/template-kennel.k9.ncl diff --git a/safe-storage/contractiles/k9/template-yard.k9.ncl b/safe-storage/contractiles/self-validating/template-yard.k9.ncl similarity index 100% rename from safe-storage/contractiles/k9/template-yard.k9.ncl rename to safe-storage/contractiles/self-validating/template-yard.k9.ncl diff --git a/safe-storage/docs/CITATIONS.adoc b/safe-storage/docs/CITATIONS.adoc index 37fdb0f..52ba528 100644 --- a/safe-storage/docs/CITATIONS.adoc +++ b/safe-storage/docs/CITATIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR-template-repo - Citation Guide :toc: diff --git a/safe-storage/ffi/zig/build.zig b/safe-storage/ffi/zig/build.zig index 4a2e049..c02617f 100644 --- a/safe-storage/ffi/zig/build.zig +++ b/safe-storage/ffi/zig/build.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} FFI Build Configuration // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} FFI Build Configuration const std = @import("std"); diff --git a/safe-storage/ffi/zig/src/main.zig b/safe-storage/ffi/zig/src/main.zig index 6b233bc..f1b2633 100644 --- a/safe-storage/ffi/zig/src/main.zig +++ b/safe-storage/ffi/zig/src/main.zig @@ -1,9 +1,10 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // {{PROJECT}} FFI Implementation // // This module implements the C-compatible FFI declared in src/abi/Foreign.idr // All types and layouts must match the Idris2 ABI definitions. // -// SPDX-License-Identifier: MPL-2.0 const std = @import("std"); diff --git a/safe-storage/ffi/zig/test/integration_test.zig b/safe-storage/ffi/zig/test/integration_test.zig index 0341994..e481508 100644 --- a/safe-storage/ffi/zig/test/integration_test.zig +++ b/safe-storage/ffi/zig/test/integration_test.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} Integration Tests // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} Integration Tests // // These tests verify that the Zig FFI correctly implements the Idris2 ABI diff --git a/voyant-export/.claude/CLAUDE.md b/voyant-export/.claude/CLAUDE.md index c878259..ce34367 100644 --- a/voyant-export/.claude/CLAUDE.md +++ b/voyant-export/.claude/CLAUDE.md @@ -1,3 +1,7 @@ + ## Machine-Readable Artefacts The following files in `.machine_readable/` contain structured project metadata: @@ -19,14 +23,14 @@ The following files in `.machine_readable/` contain structured project metadata: | Language/Tool | Use Case | Notes | |---------------|----------|-------| -| **ReScript** | Primary application code | Compiles to JS, type-safe | +| **AffineScript** | Primary application code | Compiles to JS, type-safe | | **Deno** | Runtime & package management | Replaces Node/npm/bun | | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools | | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI | | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like | | **Gleam** | Backend services | Runs on BEAM or compiles to JS | | **Bash/POSIX Shell** | Scripts, automation | Keep minimal | -| **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs | +| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs | | **Nickel** | Configuration language | For complex configs | | **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm | | **Julia** | Batch scripts, data processing | Per RSR | @@ -37,7 +41,7 @@ The following files in `.machine_readable/` contain structured project metadata: | Banned | Replacement | |--------|-------------| -| TypeScript | ReScript | +| TypeScript | AffineScript | | Node.js | Deno | | npm | Deno | | Bun | Deno | @@ -53,18 +57,18 @@ The following files in `.machine_readable/` contain structured project metadata: **No exceptions for Kotlin/Swift** - use Rust-first approach: -1. **Tauri 2.0+** - Web UI (ReScript) + Rust backend, MIT/Apache-2.0 +1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0 2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0 Both are FOSS with independent governance (no Big Tech). ### Enforcement Rules -1. **No new TypeScript files** - Convert existing TS to ReScript -2. **No package.json for runtime deps** - Use deno.json imports +1. **No new TypeScript files** - Convert existing TS to AffineScript +2. **No package.json - use deno.json deps** - Use deno.json imports 3. **No node_modules in production** - Deno caches deps automatically 4. **No Go code** - Use Rust instead -5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps +5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps 6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus ### Package Management diff --git a/voyant-export/.github/ISSUE_TEMPLATE/bug_report.md b/voyant-export/.github/ISSUE_TEMPLATE/bug_report.md index 987aab6..45a6c02 100644 --- a/voyant-export/.github/ISSUE_TEMPLATE/bug_report.md +++ b/voyant-export/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,3 +1,7 @@ + --- name: Bug report about: Create a report to help us improve diff --git a/voyant-export/.github/ISSUE_TEMPLATE/custom.md b/voyant-export/.github/ISSUE_TEMPLATE/custom.md index 48d5f81..99ebf00 100644 --- a/voyant-export/.github/ISSUE_TEMPLATE/custom.md +++ b/voyant-export/.github/ISSUE_TEMPLATE/custom.md @@ -1,3 +1,7 @@ + --- name: Custom issue template about: Describe this issue template's purpose here. diff --git a/voyant-export/.github/ISSUE_TEMPLATE/documentation.md b/voyant-export/.github/ISSUE_TEMPLATE/documentation.md index 4fcb9f9..b1d16df 100644 --- a/voyant-export/.github/ISSUE_TEMPLATE/documentation.md +++ b/voyant-export/.github/ISSUE_TEMPLATE/documentation.md @@ -1,3 +1,7 @@ + --- name: Documentation about: Report unclear, missing, or incorrect documentation diff --git a/voyant-export/.github/ISSUE_TEMPLATE/feature_request.md b/voyant-export/.github/ISSUE_TEMPLATE/feature_request.md index 3e8fa7e..a5a5693 100644 --- a/voyant-export/.github/ISSUE_TEMPLATE/feature_request.md +++ b/voyant-export/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,3 +1,7 @@ + --- name: Feature request about: Suggest an idea for this project diff --git a/voyant-export/.github/ISSUE_TEMPLATE/question.md b/voyant-export/.github/ISSUE_TEMPLATE/question.md index fd0e2a5..c2d1f57 100644 --- a/voyant-export/.github/ISSUE_TEMPLATE/question.md +++ b/voyant-export/.github/ISSUE_TEMPLATE/question.md @@ -1,3 +1,7 @@ + --- name: Question about: Ask a question about usage or behaviour diff --git a/voyant-export/.github/workflows/codeql.yml b/voyant-export/.github/workflows/codeql.yml index f72ca6a..74c318a 100644 --- a/voyant-export/.github/workflows/codeql.yml +++ b/voyant-export/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/voyant-export/.github/workflows/comprehensive-quality.yml b/voyant-export/.github/workflows/comprehensive-quality.yml index 492f549..9552a28 100644 --- a/voyant-export/.github/workflows/comprehensive-quality.yml +++ b/voyant-export/.github/workflows/comprehensive-quality.yml @@ -11,6 +11,7 @@ jobs: # DEPENDABILITY - Stability and reliability dependability: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check test coverage @@ -30,6 +31,7 @@ jobs: # SECURITY - Multi-layer security scanning security: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Secret scanning @@ -50,6 +52,7 @@ jobs: # INTEROPERABILITY - API and format compatibility interoperability: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check API specs @@ -67,6 +70,7 @@ jobs: # VALIDATION - Input/output validation validation: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check for validation patterns @@ -77,6 +81,7 @@ jobs: # ATTESTATION - Supply chain integrity (SLSA) attestation: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: id-token: write contents: read @@ -97,6 +102,7 @@ jobs: # VERIFICATION - Formal methods where applicable verification: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check SPARK proofs @@ -113,6 +119,7 @@ jobs: # FUNCTIONALITY - Feature completeness functionality: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check TODOs and FIXMEs @@ -126,6 +133,7 @@ jobs: # PERFORMANCE - Benchmarks and profiling performance: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check for benchmarks @@ -142,6 +150,7 @@ jobs: # ACCESSIBILITY - A11y compliance accessibility: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/*.html') != '' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 @@ -157,6 +166,7 @@ jobs: # LICENSE COMPLIANCE license: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check license files @@ -175,6 +185,7 @@ jobs: # DOCUMENTATION QUALITY documentation: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Check docs completeness diff --git a/voyant-export/.github/workflows/governance.yml b/voyant-export/.github/workflows/governance.yml index b4062e0..a044174 100644 --- a/voyant-export/.github/workflows/governance.yml +++ b/voyant-export/.github/workflows/governance.yml @@ -24,3 +24,4 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 + timeout-minutes: 10 diff --git a/voyant-export/.github/workflows/hypatia-scan.yml b/voyant-export/.github/workflows/hypatia-scan.yml index 5b59919..49e830d 100644 --- a/voyant-export/.github/workflows/hypatia-scan.yml +++ b/voyant-export/.github/workflows/hypatia-scan.yml @@ -17,6 +17,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/voyant-export/.github/workflows/instant-sync.yml b/voyant-export/.github/workflows/instant-sync.yml index 3c78453..45e260a 100644 --- a/voyant-export/.github/workflows/instant-sync.yml +++ b/voyant-export/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 diff --git a/voyant-export/.github/workflows/jekyll-gh-pages.yml b/voyant-export/.github/workflows/jekyll-gh-pages.yml index 11a2df4..8b19021 100644 --- a/voyant-export/.github/workflows/jekyll-gh-pages.yml +++ b/voyant-export/.github/workflows/jekyll-gh-pages.yml @@ -26,6 +26,7 @@ jobs: # Build job build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 @@ -45,6 +46,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: - name: Deploy to GitHub Pages diff --git a/voyant-export/.github/workflows/mirror.yml b/voyant-export/.github/workflows/mirror.yml index 5b67c3c..bf21b11 100644 --- a/voyant-export/.github/workflows/mirror.yml +++ b/voyant-export/.github/workflows/mirror.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: mirror-gitlab: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITLAB_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -30,6 +31,7 @@ jobs: mirror-bitbucket: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.BITBUCKET_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -48,6 +50,7 @@ jobs: mirror-codeberg: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.CODEBERG_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -66,6 +69,7 @@ jobs: mirror-sourcehut: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.SOURCEHUT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -84,6 +88,7 @@ jobs: mirror-disroot: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.DISROOT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -102,6 +107,7 @@ jobs: mirror-gitea: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITEA_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -120,6 +126,7 @@ jobs: mirror-radicle: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.RADICLE_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/voyant-export/.github/workflows/scorecard-enforcer.yml b/voyant-export/.github/workflows/scorecard-enforcer.yml index 9a9f4f1..d2ecfdf 100644 --- a/voyant-export/.github/workflows/scorecard-enforcer.yml +++ b/voyant-export/.github/workflows/scorecard-enforcer.yml @@ -14,6 +14,7 @@ permissions: read-all jobs: scorecard: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write # For OIDC @@ -52,6 +53,7 @@ jobs: # Check specific high-priority items check-critical: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/voyant-export/.github/workflows/scorecard.yml b/voyant-export/.github/workflows/scorecard.yml index 1961a00..69192ce 100644 --- a/voyant-export/.github/workflows/scorecard.yml +++ b/voyant-export/.github/workflows/scorecard.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: analysis: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write diff --git a/voyant-export/.github/workflows/secret-scanner.yml b/voyant-export/.github/workflows/secret-scanner.yml index cc29168..f7dbcbd 100644 --- a/voyant-export/.github/workflows/secret-scanner.yml +++ b/voyant-export/.github/workflows/secret-scanner.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: trufflehog: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: @@ -24,6 +25,7 @@ jobs: gitleaks: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: @@ -37,6 +39,7 @@ jobs: # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/voyant-export/ABI-FFI-README.md b/voyant-export/ABI-FFI-README.md index f06f72c..af300f5 100644 --- a/voyant-export/ABI-FFI-README.md +++ b/voyant-export/ABI-FFI-README.md @@ -1,3 +1,7 @@ + {{~ Aditionally delete this line and fill out the template below ~}} # {{PROJECT}} ABI/FFI Documentation diff --git a/voyant-export/CODE_OF_CONDUCT.md b/voyant-export/CODE_OF_CONDUCT.md index 1f1548c..9020def 100644 --- a/voyant-export/CODE_OF_CONDUCT.md +++ b/voyant-export/CODE_OF_CONDUCT.md @@ -1,4 +1,7 @@ - + # Contributor Covenant Code of Conduct ## Our Pledge diff --git a/voyant-export/CONTRIBUTING.adoc b/voyant-export/CONTRIBUTING.adoc index a0f2f54..2ead10c 100644 --- a/voyant-export/CONTRIBUTING.adoc +++ b/voyant-export/CONTRIBUTING.adoc @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MPL-2.0-or-later +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contributing Guide == Getting Started diff --git a/voyant-export/CONTRIBUTING.md b/voyant-export/CONTRIBUTING.md index e2e5073..ecc9102 100644 --- a/voyant-export/CONTRIBUTING.md +++ b/voyant-export/CONTRIBUTING.md @@ -1,3 +1,7 @@ + # Clone the repository git clone https://github.com/hyperpolymath/zotero-tools.git cd zotero-tools diff --git a/voyant-export/DEVELOPMENT.adoc b/voyant-export/DEVELOPMENT.adoc index 39dc979..08c5d13 100644 --- a/voyant-export/DEVELOPMENT.adoc +++ b/voyant-export/DEVELOPMENT.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Development Guide :toc: :toclevels: 3 diff --git a/voyant-export/ECHIDNA_ARCHITECTURE_UPDATE_3LANG.md b/voyant-export/ECHIDNA_ARCHITECTURE_UPDATE_3LANG.md index 78b7cfb..9f62088 100644 --- a/voyant-export/ECHIDNA_ARCHITECTURE_UPDATE_3LANG.md +++ b/voyant-export/ECHIDNA_ARCHITECTURE_UPDATE_3LANG.md @@ -1,7 +1,9 @@ + # ECHIDNA Architecture Update: 3-Language Stack - - **Date:** 2025-12-27 **Change:** Dropped Mercury/Logtalk "logic reservoir" concept **Result:** 3 core languages (down from 4) diff --git a/voyant-export/HANDOVER_UPDATE_3LANG.md b/voyant-export/HANDOVER_UPDATE_3LANG.md index 2865621..018434c 100644 --- a/voyant-export/HANDOVER_UPDATE_3LANG.md +++ b/voyant-export/HANDOVER_UPDATE_3LANG.md @@ -1,3 +1,7 @@ + # ECHIDNA Handover Update - 3-Language Architecture ## Critical Change Made diff --git a/voyant-export/MAINTAINERS.adoc b/voyant-export/MAINTAINERS.adoc index b5154a0..becaa3e 100644 --- a/voyant-export/MAINTAINERS.adoc +++ b/voyant-export/MAINTAINERS.adoc @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MPL-2.0-or-later +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/voyant-export/MANIFEST_V3_MIGRATION.adoc b/voyant-export/MANIFEST_V3_MIGRATION.adoc index 3908118..caaa325 100644 --- a/voyant-export/MANIFEST_V3_MIGRATION.adoc +++ b/voyant-export/MANIFEST_V3_MIGRATION.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Manifest V3 Migration Guide :toc: :toclevels: 3 diff --git a/voyant-export/NEXT_STEPS.md b/voyant-export/NEXT_STEPS.md index 5979968..3a1627d 100644 --- a/voyant-export/NEXT_STEPS.md +++ b/voyant-export/NEXT_STEPS.md @@ -1,3 +1,7 @@ + # Next Steps: Your Accessibility Initiative Action Plan This document provides a clear roadmap for taking this initiative from concept to reality. diff --git a/voyant-export/PALIMPSEST.adoc b/voyant-export/PALIMPSEST.adoc index ebaa6d0..9660f13 100644 --- a/voyant-export/PALIMPSEST.adoc +++ b/voyant-export/PALIMPSEST.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Palimpsest License :toc: :toc-placement!: diff --git a/voyant-export/README.adoc b/voyant-export/README.adoc index 05119b1..e6f7f4b 100644 --- a/voyant-export/README.adoc +++ b/voyant-export/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Zotero Voyant Export image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[MPL-2.0-or-later,link="https://opensource.org/licenses/MPL-2.0"] @@ -6,7 +8,6 @@ image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[MPL-2.0-or-later,lin This project must declare **MPL-2.0-or-later** for platform/tooling compatibility. Philosophy: **Palimpsest**. The Palimpsest-MPL (PMPL) text is provided in `license/PMPL-1.0.txt`, and the canonical source is the palimpsest-license repository. -// SPDX-License-Identifier: MPL-2.0-or-later // SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell Export your Zotero collections to Voyant for text analysis. diff --git a/voyant-export/README.v3.adoc b/voyant-export/README.v3.adoc index 12c6f2c..3e920b0 100644 --- a/voyant-export/README.v3.adoc +++ b/voyant-export/README.v3.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Manifest V3 Branch This branch contains the future Manifest V3 version of the extension. diff --git a/voyant-export/ROADMAP.adoc b/voyant-export/ROADMAP.adoc index aa9210a..a99b4db 100644 --- a/voyant-export/ROADMAP.adoc +++ b/voyant-export/ROADMAP.adoc @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MPL-2.0-or-later +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Zotero Voyant Export Roadmap == Current Status diff --git a/voyant-export/RSR_OUTLINE.adoc b/voyant-export/RSR_OUTLINE.adoc index e429244..2901b24 100644 --- a/voyant-export/RSR_OUTLINE.adoc +++ b/voyant-export/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/voyant-export/SECURITY.md b/voyant-export/SECURITY.md index 60a5411..f19fd6d 100644 --- a/voyant-export/SECURITY.md +++ b/voyant-export/SECURITY.md @@ -1,4 +1,7 @@ - + # Security Policy ## Supported Versions diff --git a/voyant-export/accessibility-tools/PROPOSED_STANDARDS.md b/voyant-export/accessibility-tools/PROPOSED_STANDARDS.md index 5ed829b..4252c9e 100644 --- a/voyant-export/accessibility-tools/PROPOSED_STANDARDS.md +++ b/voyant-export/accessibility-tools/PROPOSED_STANDARDS.md @@ -1,3 +1,7 @@ + # Proposed Accessibility Standards & Protocols ## Making Accessibility as Easy as Security Headers diff --git a/voyant-export/accessibility-tools/README.md b/voyant-export/accessibility-tools/README.md index bdb951a..d40cc39 100644 --- a/voyant-export/accessibility-tools/README.md +++ b/voyant-export/accessibility-tools/README.md @@ -1,3 +1,7 @@ + # Accessibility Everywhere **Making the web accessible to everyone through technical tools, standards, and advocacy** diff --git a/voyant-export/accessibility-tools/adoption-tracker/scanner.js b/voyant-export/accessibility-tools/adoption-tracker/scanner.js index 559fdb3..841030d 100644 --- a/voyant-export/accessibility-tools/adoption-tracker/scanner.js +++ b/voyant-export/accessibility-tools/adoption-tracker/scanner.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * Accessibility Adoption Tracker * Scans top N websites to track accessibility adoption diff --git a/voyant-export/accessibility-tools/api-server/server.js b/voyant-export/accessibility-tools/api-server/server.js index deb16a9..4e093cf 100644 --- a/voyant-export/accessibility-tools/api-server/server.js +++ b/voyant-export/accessibility-tools/api-server/server.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * Accessibility Monitoring API * Like report-uri.com but for accessibility diff --git a/voyant-export/accessibility-tools/browser-extension/background.js b/voyant-export/accessibility-tools/browser-extension/background.js index 0a5df25..3002107 100644 --- a/voyant-export/accessibility-tools/browser-extension/background.js +++ b/voyant-export/accessibility-tools/browser-extension/background.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * Accessibility Everywhere - Background Service Worker * Handles API communication, caching, and badge updates diff --git a/voyant-export/accessibility-tools/browser-extension/content.js b/voyant-export/accessibility-tools/browser-extension/content.js index b133b7d..64d2a1f 100644 --- a/voyant-export/accessibility-tools/browser-extension/content.js +++ b/voyant-export/accessibility-tools/browser-extension/content.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * Accessibility Everywhere - Content Script * Runs on every page to enable scanning and reporting diff --git a/voyant-export/accessibility-tools/browser-extension/popup.js b/voyant-export/accessibility-tools/browser-extension/popup.js index e1e4349..4eae689 100644 --- a/voyant-export/accessibility-tools/browser-extension/popup.js +++ b/voyant-export/accessibility-tools/browser-extension/popup.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * Accessibility Everywhere - Popup Script * Displays accessibility score and details diff --git a/voyant-export/accessibility-tools/browser-extension/scanner.js b/voyant-export/accessibility-tools/browser-extension/scanner.js index b26452c..4d806cb 100644 --- a/voyant-export/accessibility-tools/browser-extension/scanner.js +++ b/voyant-export/accessibility-tools/browser-extension/scanner.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * Accessibility Everywhere - Scanner Module * Injected into pages to perform local accessibility testing diff --git a/voyant-export/accessibility-tools/dashboard/scanner.js b/voyant-export/accessibility-tools/dashboard/scanner.js index 02a4ce5..e1e510c 100644 --- a/voyant-export/accessibility-tools/dashboard/scanner.js +++ b/voyant-export/accessibility-tools/dashboard/scanner.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * AccessibilityHeaders.com - Client-side scanner * Like securityheaders.com but for accessibility diff --git a/voyant-export/accessibility-tools/github-action/index.js b/voyant-export/accessibility-tools/github-action/index.js index b4b9689..e64952e 100644 --- a/voyant-export/accessibility-tools/github-action/index.js +++ b/voyant-export/accessibility-tools/github-action/index.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * Accessibility Test GitHub Action * Tests websites for WCAG compliance in CI/CD diff --git a/voyant-export/bootstrap.js b/voyant-export/bootstrap.js index 7f6ffdf..aef73ff 100644 --- a/voyant-export/bootstrap.js +++ b/voyant-export/bootstrap.js @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell // // @file bootstrap.js diff --git a/voyant-export/contractiles/README.adoc b/voyant-export/contractiles/README.adoc index d19a387..70ad712 100644 --- a/voyant-export/contractiles/README.adoc +++ b/voyant-export/contractiles/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractiles Template Set :toc: :sectnums: diff --git a/voyant-export/contractiles/k9/README.adoc b/voyant-export/contractiles/k9/README.adoc deleted file mode 100644 index 9c3099f..0000000 --- a/voyant-export/contractiles/k9/README.adoc +++ /dev/null @@ -1,178 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -= K9 Contractiles -:toc: left -:icons: font - -== What Are K9 Contractiles? - -K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. - -== The Three Security Levels - -K9 components declare their trust requirements using "The Leash" security model: - -[horizontal] -`'Kennel`:: Pure data, no execution (safest) -`'Yard`:: Nickel evaluation with contracts (medium trust) -`'Hunt`:: Full execution with Just recipes (requires signature) - -== Example Components - -This directory contains example K9 contractiles for common repository tasks: - -=== Kennel Level (Pure Data) - -**File:** `examples/project-metadata.k9.ncl` - -Pure configuration data with no execution. Safe to include in any repository. - -**Use cases:** -- Project metadata (name, version, description) -- Build configuration -- Tool settings -- Data schemas - -**Security:** No signature required, data-only. - -=== Yard Level (Validated Config) - -**File:** `examples/ci-config.k9.ncl` - -Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. - -**Use cases:** -- CI/CD configuration with validation -- Deployment parameters -- Database schemas with constraints -- API specifications - -**Security:** Signature recommended, Nickel evaluation only. - -=== Hunt Level (Full Execution) - -**File:** `examples/setup-repo.k9.ncl` - -Full execution with Just recipes. Can run shell commands and modify filesystem. - -**Use cases:** -- Repository setup scripts -- Deployment automation -- System configuration -- Package installation - -**Security:** **Signature required**, full system access. - -== Usage in Your Repository - -=== 1. Create K9 Components - -Choose the appropriate security level for your use case: - -[source,bash] ----- -# Kennel: Pure configuration -cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl - -# Yard: Validated configuration -cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl - -# Hunt: Full automation -cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl ----- - -=== 2. Validate Components - -[source,bash] ----- -# Validate Nickel syntax and contracts -nickel typecheck config/metadata.k9.ncl - -# Verify Hunt-level signature (if signed) -./must verify scripts/setup.k9.ncl ----- - -=== 3. Execute Components - -[source,bash] ----- -# Kennel: Export as JSON -nickel export config/metadata.k9.ncl > metadata.json - -# Yard: Evaluate with validation -nickel eval .github/ci.k9.ncl - -# Hunt: Run with Just (dry-run first!) -./must --dry-run run scripts/setup.k9.ncl -./must run scripts/setup.k9.ncl ----- - -== Integration with RSR - -K9 contractiles integrate with other RSR standards: - -**STATE.scm**:: K9 components can generate or validate STATE.scm -**ECOSYSTEM.scm**:: K9 can automate cross-repo operations -**META.scm**:: K9 can enforce architectural decisions - -== Security Best Practices - -=== For Kennel/Yard Components - -✅ **Safe to use without signatures** + -✅ **Review Nickel code before use** + -✅ **Validate contracts match expectations** - -=== For Hunt Components - -⚠️ **ALWAYS verify signatures** + -⚠️ **Review Just recipes carefully** + -⚠️ **Run dry-run mode first** + -⚠️ **Never run as root unless required** + -⚠️ **Sandbox external components** - -**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc - -== Template Files - -Use these as starting points for your own K9 components: - -- `template-kennel.k9.ncl` - Pure data template -- `template-yard.k9.ncl` - Validated config template -- `template-hunt.k9.ncl` - Full execution template - -== Dependencies - -To use K9 contractiles in your repository: - -[source,bash] ----- -# Install Nickel (configuration language) -curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel -chmod +x nickel && sudo mv nickel /usr/local/bin/ - -# Install Just (task runner, for Hunt level) -cargo install just - -# Clone K9-SVC (for must shim and tooling) -git clone https://github.com/hyperpolymath/standards.git -# Note: K9-SVC is located in standards/k9-svc ----- - -== Learn More - -- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc -- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc -- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc -- **IANA Media Type:** `application/vnd.k9+nickel` - -== Contributing - -When adding K9 contractiles to your repository: - -1. Use appropriate security level (Kennel > Yard > Hunt) -2. Document what each component does -3. Include validation contracts in Yard/Hunt components -4. Sign Hunt-level components before committing -5. Add K9 validation to CI/CD pipeline - -**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/voyant-export/contractiles/self-validating/README.adoc b/voyant-export/contractiles/self-validating/README.adoc new file mode 100644 index 0000000..ce1825f --- /dev/null +++ b/voyant-export/contractiles/self-validating/README.adoc @@ -0,0 +1,179 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell += K9 Contractiles +:toc: left +:icons: font + +== What Are K9 Contractiles? + +K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. + +== The Three Security Levels + +K9 components declare their trust requirements using "The Leash" security model: + +[horizontal] +`'Kennel`:: Pure data, no execution (safest) +`'Yard`:: Nickel evaluation with contracts (medium trust) +`'Hunt`:: Full execution with Just recipes (requires signature) + +== Example Components + +This directory contains example K9 contractiles for common repository tasks: + +=== Kennel Level (Pure Data) + +**File:** `examples/project-metadata.k9.ncl` + +Pure configuration data with no execution. Safe to include in any repository. + +**Use cases:** +- Project metadata (name, version, description) +- Build configuration +- Tool settings +- Data schemas + +**Security:** No signature required, data-only. + +=== Yard Level (Validated Config) + +**File:** `examples/ci-config.k9.ncl` + +Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. + +**Use cases:** +- CI/CD configuration with validation +- Deployment parameters +- Database schemas with constraints +- API specifications + +**Security:** Signature recommended, Nickel evaluation only. + +=== Hunt Level (Full Execution) + +**File:** `examples/setup-repo.k9.ncl` + +Full execution with Just recipes. Can run shell commands and modify filesystem. + +**Use cases:** +- Repository setup scripts +- Deployment automation +- System configuration +- Package installation + +**Security:** **Signature required**, full system access. + +== Usage in Your Repository + +=== 1. Create K9 Components + +Choose the appropriate security level for your use case: + +[source,bash] +---- +# Kennel: Pure configuration +cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl + +# Yard: Validated configuration +cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl + +# Hunt: Full automation +cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl +---- + +=== 2. Validate Components + +[source,bash] +---- +# Validate Nickel syntax and contracts +nickel typecheck config/metadata.k9.ncl + +# Verify Hunt-level signature (if signed) +./must verify scripts/setup.k9.ncl +---- + +=== 3. Execute Components + +[source,bash] +---- +# Kennel: Export as JSON +nickel export config/metadata.k9.ncl > metadata.json + +# Yard: Evaluate with validation +nickel eval .github/ci.k9.ncl + +# Hunt: Run with Just (dry-run first!) +./must --dry-run run scripts/setup.k9.ncl +./must run scripts/setup.k9.ncl +---- + +== Integration with RSR + +K9 contractiles integrate with other RSR standards: + +**STATE.scm**:: K9 components can generate or validate STATE.scm +**ECOSYSTEM.scm**:: K9 can automate cross-repo operations +**META.scm**:: K9 can enforce architectural decisions + +== Security Best Practices + +=== For Kennel/Yard Components + +✅ **Safe to use without signatures** + +✅ **Review Nickel code before use** + +✅ **Validate contracts match expectations** + +=== For Hunt Components + +⚠️ **ALWAYS verify signatures** + +⚠️ **Review Just recipes carefully** + +⚠️ **Run dry-run mode first** + +⚠️ **Never run as root unless required** + +⚠️ **Sandbox external components** + +**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc + +== Template Files + +Use these as starting points for your own K9 components: + +- `template-kennel.k9.ncl` - Pure data template +- `template-yard.k9.ncl` - Validated config template +- `template-hunt.k9.ncl` - Full execution template + +== Dependencies + +To use K9 contractiles in your repository: + +[source,bash] +---- +# Install Nickel (configuration language) +curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel +chmod +x nickel && sudo mv nickel /usr/local/bin/ + +# Install Just (task runner, for Hunt level) +cargo install just + +# Clone K9-SVC (for must shim and tooling) +git clone https://github.com/hyperpolymath/standards.git +# Note: K9-SVC is located in standards/k9-svc +---- + +== Learn More + +- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc +- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc +- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc +- **IANA Media Type:** `application/vnd.k9+nickel` + +== Contributing + +When adding K9 contractiles to your repository: + +1. Use appropriate security level (Kennel > Yard > Hunt) +2. Document what each component does +3. Include validation contracts in Yard/Hunt components +4. Sign Hunt-level components before committing +5. Add K9 validation to CI/CD pipeline + +**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/voyant-export/contractiles/k9/examples/ci-config.k9.ncl b/voyant-export/contractiles/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from voyant-export/contractiles/k9/examples/ci-config.k9.ncl rename to voyant-export/contractiles/self-validating/examples/ci-config.k9.ncl diff --git a/voyant-export/contractiles/k9/examples/project-metadata.k9.ncl b/voyant-export/contractiles/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from voyant-export/contractiles/k9/examples/project-metadata.k9.ncl rename to voyant-export/contractiles/self-validating/examples/project-metadata.k9.ncl diff --git a/voyant-export/contractiles/k9/examples/setup-repo.k9.ncl b/voyant-export/contractiles/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from voyant-export/contractiles/k9/examples/setup-repo.k9.ncl rename to voyant-export/contractiles/self-validating/examples/setup-repo.k9.ncl diff --git a/voyant-export/contractiles/k9/template-hunt.k9.ncl b/voyant-export/contractiles/self-validating/template-hunt.k9.ncl similarity index 100% rename from voyant-export/contractiles/k9/template-hunt.k9.ncl rename to voyant-export/contractiles/self-validating/template-hunt.k9.ncl diff --git a/voyant-export/contractiles/k9/template-kennel.k9.ncl b/voyant-export/contractiles/self-validating/template-kennel.k9.ncl similarity index 100% rename from voyant-export/contractiles/k9/template-kennel.k9.ncl rename to voyant-export/contractiles/self-validating/template-kennel.k9.ncl diff --git a/voyant-export/contractiles/k9/template-yard.k9.ncl b/voyant-export/contractiles/self-validating/template-yard.k9.ncl similarity index 100% rename from voyant-export/contractiles/k9/template-yard.k9.ncl rename to voyant-export/contractiles/self-validating/template-yard.k9.ncl diff --git a/voyant-export/docs/CITATIONS.adoc b/voyant-export/docs/CITATIONS.adoc index 3c8c3e5..c7d75f1 100644 --- a/voyant-export/docs/CITATIONS.adoc +++ b/voyant-export/docs/CITATIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = zotero-voyant-export - Citation Guide :toc: diff --git a/voyant-export/ffi/zig/build.zig b/voyant-export/ffi/zig/build.zig index 4a2e049..c02617f 100644 --- a/voyant-export/ffi/zig/build.zig +++ b/voyant-export/ffi/zig/build.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} FFI Build Configuration // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} FFI Build Configuration const std = @import("std"); diff --git a/voyant-export/ffi/zig/src/main.zig b/voyant-export/ffi/zig/src/main.zig index 6b233bc..f1b2633 100644 --- a/voyant-export/ffi/zig/src/main.zig +++ b/voyant-export/ffi/zig/src/main.zig @@ -1,9 +1,10 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // {{PROJECT}} FFI Implementation // // This module implements the C-compatible FFI declared in src/abi/Foreign.idr // All types and layouts must match the Idris2 ABI definitions. // -// SPDX-License-Identifier: MPL-2.0 const std = @import("std"); diff --git a/voyant-export/ffi/zig/test/integration_test.zig b/voyant-export/ffi/zig/test/integration_test.zig index 0341994..e481508 100644 --- a/voyant-export/ffi/zig/test/integration_test.zig +++ b/voyant-export/ffi/zig/test/integration_test.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} Integration Tests // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} Integration Tests // // These tests verify that the Zig FFI correctly implements the Idris2 ABI diff --git a/voyant-export/old-src/exporter.js b/voyant-export/old-src/exporter.js index 6de77c8..d720350 100644 --- a/voyant-export/old-src/exporter.js +++ b/voyant-export/old-src/exporter.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell const { Ci, Cu diff --git a/voyant-export/old-src/format.js b/voyant-export/old-src/format.js index 8aca3e1..a76b1f8 100644 --- a/voyant-export/old-src/format.js +++ b/voyant-export/old-src/format.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell const { Cc, Ci diff --git a/voyant-export/old-src/index.js b/voyant-export/old-src/index.js index 9d54188..96a5950 100644 --- a/voyant-export/old-src/index.js +++ b/voyant-export/old-src/index.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell var self = require("sdk/self"); var utils = require("./lib/utils"); var ui = require("./lib/ui"); diff --git a/voyant-export/old-src/test/test-format.js b/voyant-export/old-src/test/test-format.js index 289b501..e36de57 100644 --- a/voyant-export/old-src/test/test-format.js +++ b/voyant-export/old-src/test/test-format.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell var format = require('../lib/format'); const { resolve diff --git a/voyant-export/old-src/ui.js b/voyant-export/old-src/ui.js index 6f50ff2..4b6d7f7 100644 --- a/voyant-export/old-src/ui.js +++ b/voyant-export/old-src/ui.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell const { Cc, Ci diff --git a/voyant-export/old-src/utils.js b/voyant-export/old-src/utils.js index a68d6f2..f09c1d7 100644 --- a/voyant-export/old-src/utils.js +++ b/voyant-export/old-src/utils.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell "use strict"; const { diff --git a/voyant-export/old-src/zotero.js b/voyant-export/old-src/zotero.js index dc6a363..67dee6f 100644 --- a/voyant-export/old-src/zotero.js +++ b/voyant-export/old-src/zotero.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell "use strict"; exports.getZotero = getZotero; diff --git a/zoterho-template/.claude/CLAUDE.md b/zoterho-template/.claude/CLAUDE.md index 0bca5a3..da26b04 100644 --- a/zoterho-template/.claude/CLAUDE.md +++ b/zoterho-template/.claude/CLAUDE.md @@ -1,3 +1,7 @@ + # CLAUDE.md - AI Assistant Instructions ## Language Policy (Hyperpolymath Standard) @@ -6,14 +10,14 @@ | Language/Tool | Use Case | Notes | |---------------|----------|-------| -| **ReScript** | Primary application code | Compiles to JS, type-safe | +| **AffineScript** | Primary application code | Compiles to JS, type-safe | | **Deno** | Runtime & package management | Replaces Node/npm/bun | | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools | | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI | | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like | | **Gleam** | Backend services | Runs on BEAM or compiles to JS | | **Bash/POSIX Shell** | Scripts, automation | Keep minimal | -| **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs | +| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs | | **Nickel** | Configuration language | For complex configs | | **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm | | **Julia** | Batch scripts, data processing | Per RSR | @@ -24,7 +28,7 @@ | Banned | Replacement | |--------|-------------| -| TypeScript | ReScript | +| TypeScript | AffineScript | | Node.js | Deno | | npm | Deno | | Bun | Deno | @@ -40,18 +44,18 @@ **No exceptions for Kotlin/Swift** - use Rust-first approach: -1. **Tauri 2.0+** - Web UI (ReScript) + Rust backend, MIT/Apache-2.0 +1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0 2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0 Both are FOSS with independent governance (no Big Tech). ### Enforcement Rules -1. **No new TypeScript files** - Convert existing TS to ReScript -2. **No package.json for runtime deps** - Use deno.json imports +1. **No new TypeScript files** - Convert existing TS to AffineScript +2. **No package.json - use deno.json deps** - Use deno.json imports 3. **No node_modules in production** - Deno caches deps automatically 4. **No Go code** - Use Rust instead -5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps +5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps 6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus ### Package Management diff --git a/zoterho-template/.github/ISSUE_TEMPLATE/bug_report.md b/zoterho-template/.github/ISSUE_TEMPLATE/bug_report.md index 987aab6..45a6c02 100644 --- a/zoterho-template/.github/ISSUE_TEMPLATE/bug_report.md +++ b/zoterho-template/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,3 +1,7 @@ + --- name: Bug report about: Create a report to help us improve diff --git a/zoterho-template/.github/ISSUE_TEMPLATE/custom.md b/zoterho-template/.github/ISSUE_TEMPLATE/custom.md index 48d5f81..99ebf00 100644 --- a/zoterho-template/.github/ISSUE_TEMPLATE/custom.md +++ b/zoterho-template/.github/ISSUE_TEMPLATE/custom.md @@ -1,3 +1,7 @@ + --- name: Custom issue template about: Describe this issue template's purpose here. diff --git a/zoterho-template/.github/ISSUE_TEMPLATE/documentation.md b/zoterho-template/.github/ISSUE_TEMPLATE/documentation.md index 4fcb9f9..b1d16df 100644 --- a/zoterho-template/.github/ISSUE_TEMPLATE/documentation.md +++ b/zoterho-template/.github/ISSUE_TEMPLATE/documentation.md @@ -1,3 +1,7 @@ + --- name: Documentation about: Report unclear, missing, or incorrect documentation diff --git a/zoterho-template/.github/ISSUE_TEMPLATE/feature_request.md b/zoterho-template/.github/ISSUE_TEMPLATE/feature_request.md index 3e8fa7e..a5a5693 100644 --- a/zoterho-template/.github/ISSUE_TEMPLATE/feature_request.md +++ b/zoterho-template/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,3 +1,7 @@ + --- name: Feature request about: Suggest an idea for this project diff --git a/zoterho-template/.github/ISSUE_TEMPLATE/question.md b/zoterho-template/.github/ISSUE_TEMPLATE/question.md index fd0e2a5..c2d1f57 100644 --- a/zoterho-template/.github/ISSUE_TEMPLATE/question.md +++ b/zoterho-template/.github/ISSUE_TEMPLATE/question.md @@ -1,3 +1,7 @@ + --- name: Question about: Ask a question about usage or behaviour diff --git a/zoterho-template/.github/workflows/codeql.yml b/zoterho-template/.github/workflows/codeql.yml index da2a9b6..29b1bfa 100644 --- a/zoterho-template/.github/workflows/codeql.yml +++ b/zoterho-template/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/zoterho-template/.github/workflows/governance.yml b/zoterho-template/.github/workflows/governance.yml index b4062e0..a044174 100644 --- a/zoterho-template/.github/workflows/governance.yml +++ b/zoterho-template/.github/workflows/governance.yml @@ -24,3 +24,4 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 + timeout-minutes: 10 diff --git a/zoterho-template/.github/workflows/hypatia-scan.yml b/zoterho-template/.github/workflows/hypatia-scan.yml index 5b59919..49e830d 100644 --- a/zoterho-template/.github/workflows/hypatia-scan.yml +++ b/zoterho-template/.github/workflows/hypatia-scan.yml @@ -17,6 +17,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/zoterho-template/.github/workflows/instant-sync.yml b/zoterho-template/.github/workflows/instant-sync.yml index 3c78453..45e260a 100644 --- a/zoterho-template/.github/workflows/instant-sync.yml +++ b/zoterho-template/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 diff --git a/zoterho-template/.github/workflows/mirror.yml b/zoterho-template/.github/workflows/mirror.yml index 5b67c3c..bf21b11 100644 --- a/zoterho-template/.github/workflows/mirror.yml +++ b/zoterho-template/.github/workflows/mirror.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: mirror-gitlab: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITLAB_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -30,6 +31,7 @@ jobs: mirror-bitbucket: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.BITBUCKET_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -48,6 +50,7 @@ jobs: mirror-codeberg: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.CODEBERG_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -66,6 +69,7 @@ jobs: mirror-sourcehut: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.SOURCEHUT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -84,6 +88,7 @@ jobs: mirror-disroot: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.DISROOT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -102,6 +107,7 @@ jobs: mirror-gitea: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITEA_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -120,6 +126,7 @@ jobs: mirror-radicle: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.RADICLE_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/zoterho-template/.github/workflows/rescript-deno-ci.yml b/zoterho-template/.github/workflows/rescript-deno-ci.yml index e4fcd23..94ace81 100644 --- a/zoterho-template/.github/workflows/rescript-deno-ci.yml +++ b/zoterho-template/.github/workflows/rescript-deno-ci.yml @@ -5,6 +5,7 @@ on: [push, pull_request] jobs: build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - uses: denoland/setup-deno@v2 @@ -32,6 +33,7 @@ jobs: security: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - uses: denoland/setup-deno@v2 diff --git a/zoterho-template/.github/workflows/scorecard.yml b/zoterho-template/.github/workflows/scorecard.yml index 9b5c830..9847a6d 100644 --- a/zoterho-template/.github/workflows/scorecard.yml +++ b/zoterho-template/.github/workflows/scorecard.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: analysis: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write diff --git a/zoterho-template/.github/workflows/secret-scanner.yml b/zoterho-template/.github/workflows/secret-scanner.yml index a768a58..a296203 100644 --- a/zoterho-template/.github/workflows/secret-scanner.yml +++ b/zoterho-template/.github/workflows/secret-scanner.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: trufflehog: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: @@ -24,6 +25,7 @@ jobs: gitleaks: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: @@ -37,6 +39,7 @@ jobs: # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/zoterho-template/ABI-FFI-README.md b/zoterho-template/ABI-FFI-README.md index f06f72c..af300f5 100644 --- a/zoterho-template/ABI-FFI-README.md +++ b/zoterho-template/ABI-FFI-README.md @@ -1,3 +1,7 @@ + {{~ Aditionally delete this line and fill out the template below ~}} # {{PROJECT}} ABI/FFI Documentation diff --git a/zoterho-template/CODE_OF_CONDUCT.md b/zoterho-template/CODE_OF_CONDUCT.md index 1f1548c..9020def 100644 --- a/zoterho-template/CODE_OF_CONDUCT.md +++ b/zoterho-template/CODE_OF_CONDUCT.md @@ -1,4 +1,7 @@ - + # Contributor Covenant Code of Conduct ## Our Pledge diff --git a/zoterho-template/CONTRIBUTING.adoc b/zoterho-template/CONTRIBUTING.adoc index a0f2f54..2ead10c 100644 --- a/zoterho-template/CONTRIBUTING.adoc +++ b/zoterho-template/CONTRIBUTING.adoc @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MPL-2.0-or-later +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contributing Guide == Getting Started diff --git a/zoterho-template/CONTRIBUTING.md b/zoterho-template/CONTRIBUTING.md index e2e5073..ecc9102 100644 --- a/zoterho-template/CONTRIBUTING.md +++ b/zoterho-template/CONTRIBUTING.md @@ -1,3 +1,7 @@ + # Clone the repository git clone https://github.com/hyperpolymath/zotero-tools.git cd zotero-tools diff --git a/zoterho-template/MAINTAINERS.adoc b/zoterho-template/MAINTAINERS.adoc index b5154a0..becaa3e 100644 --- a/zoterho-template/MAINTAINERS.adoc +++ b/zoterho-template/MAINTAINERS.adoc @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MPL-2.0-or-later +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/zoterho-template/README.adoc b/zoterho-template/README.adoc index c9257d8..29081a2 100644 --- a/zoterho-template/README.adoc +++ b/zoterho-template/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Make It Rhodium - ZoteRho (Rhodium-template) == License & Philosophy diff --git a/zoterho-template/ROADMAP.adoc b/zoterho-template/ROADMAP.adoc index fa82fdc..44c064a 100644 --- a/zoterho-template/ROADMAP.adoc +++ b/zoterho-template/ROADMAP.adoc @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MPL-2.0-or-later +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Zoterho Template Roadmap == Current Status diff --git a/zoterho-template/RSR_OUTLINE.adoc b/zoterho-template/RSR_OUTLINE.adoc index e429244..2901b24 100644 --- a/zoterho-template/RSR_OUTLINE.adoc +++ b/zoterho-template/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/zoterho-template/SECURITY.md b/zoterho-template/SECURITY.md index 60a5411..f19fd6d 100644 --- a/zoterho-template/SECURITY.md +++ b/zoterho-template/SECURITY.md @@ -1,4 +1,7 @@ - + # Security Policy ## Supported Versions diff --git a/zoterho-template/contractiles/README.adoc b/zoterho-template/contractiles/README.adoc index d19a387..70ad712 100644 --- a/zoterho-template/contractiles/README.adoc +++ b/zoterho-template/contractiles/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractiles Template Set :toc: :sectnums: diff --git a/zoterho-template/contractiles/k9/README.adoc b/zoterho-template/contractiles/k9/README.adoc deleted file mode 100644 index 9c3099f..0000000 --- a/zoterho-template/contractiles/k9/README.adoc +++ /dev/null @@ -1,178 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -= K9 Contractiles -:toc: left -:icons: font - -== What Are K9 Contractiles? - -K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. - -== The Three Security Levels - -K9 components declare their trust requirements using "The Leash" security model: - -[horizontal] -`'Kennel`:: Pure data, no execution (safest) -`'Yard`:: Nickel evaluation with contracts (medium trust) -`'Hunt`:: Full execution with Just recipes (requires signature) - -== Example Components - -This directory contains example K9 contractiles for common repository tasks: - -=== Kennel Level (Pure Data) - -**File:** `examples/project-metadata.k9.ncl` - -Pure configuration data with no execution. Safe to include in any repository. - -**Use cases:** -- Project metadata (name, version, description) -- Build configuration -- Tool settings -- Data schemas - -**Security:** No signature required, data-only. - -=== Yard Level (Validated Config) - -**File:** `examples/ci-config.k9.ncl` - -Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. - -**Use cases:** -- CI/CD configuration with validation -- Deployment parameters -- Database schemas with constraints -- API specifications - -**Security:** Signature recommended, Nickel evaluation only. - -=== Hunt Level (Full Execution) - -**File:** `examples/setup-repo.k9.ncl` - -Full execution with Just recipes. Can run shell commands and modify filesystem. - -**Use cases:** -- Repository setup scripts -- Deployment automation -- System configuration -- Package installation - -**Security:** **Signature required**, full system access. - -== Usage in Your Repository - -=== 1. Create K9 Components - -Choose the appropriate security level for your use case: - -[source,bash] ----- -# Kennel: Pure configuration -cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl - -# Yard: Validated configuration -cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl - -# Hunt: Full automation -cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl ----- - -=== 2. Validate Components - -[source,bash] ----- -# Validate Nickel syntax and contracts -nickel typecheck config/metadata.k9.ncl - -# Verify Hunt-level signature (if signed) -./must verify scripts/setup.k9.ncl ----- - -=== 3. Execute Components - -[source,bash] ----- -# Kennel: Export as JSON -nickel export config/metadata.k9.ncl > metadata.json - -# Yard: Evaluate with validation -nickel eval .github/ci.k9.ncl - -# Hunt: Run with Just (dry-run first!) -./must --dry-run run scripts/setup.k9.ncl -./must run scripts/setup.k9.ncl ----- - -== Integration with RSR - -K9 contractiles integrate with other RSR standards: - -**STATE.scm**:: K9 components can generate or validate STATE.scm -**ECOSYSTEM.scm**:: K9 can automate cross-repo operations -**META.scm**:: K9 can enforce architectural decisions - -== Security Best Practices - -=== For Kennel/Yard Components - -✅ **Safe to use without signatures** + -✅ **Review Nickel code before use** + -✅ **Validate contracts match expectations** - -=== For Hunt Components - -⚠️ **ALWAYS verify signatures** + -⚠️ **Review Just recipes carefully** + -⚠️ **Run dry-run mode first** + -⚠️ **Never run as root unless required** + -⚠️ **Sandbox external components** - -**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc - -== Template Files - -Use these as starting points for your own K9 components: - -- `template-kennel.k9.ncl` - Pure data template -- `template-yard.k9.ncl` - Validated config template -- `template-hunt.k9.ncl` - Full execution template - -== Dependencies - -To use K9 contractiles in your repository: - -[source,bash] ----- -# Install Nickel (configuration language) -curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel -chmod +x nickel && sudo mv nickel /usr/local/bin/ - -# Install Just (task runner, for Hunt level) -cargo install just - -# Clone K9-SVC (for must shim and tooling) -git clone https://github.com/hyperpolymath/standards.git -# Note: K9-SVC is located in standards/k9-svc ----- - -== Learn More - -- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc -- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc -- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc -- **IANA Media Type:** `application/vnd.k9+nickel` - -== Contributing - -When adding K9 contractiles to your repository: - -1. Use appropriate security level (Kennel > Yard > Hunt) -2. Document what each component does -3. Include validation contracts in Yard/Hunt components -4. Sign Hunt-level components before committing -5. Add K9 validation to CI/CD pipeline - -**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/zoterho-template/contractiles/self-validating/README.adoc b/zoterho-template/contractiles/self-validating/README.adoc new file mode 100644 index 0000000..ce1825f --- /dev/null +++ b/zoterho-template/contractiles/self-validating/README.adoc @@ -0,0 +1,179 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell += K9 Contractiles +:toc: left +:icons: font + +== What Are K9 Contractiles? + +K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. + +== The Three Security Levels + +K9 components declare their trust requirements using "The Leash" security model: + +[horizontal] +`'Kennel`:: Pure data, no execution (safest) +`'Yard`:: Nickel evaluation with contracts (medium trust) +`'Hunt`:: Full execution with Just recipes (requires signature) + +== Example Components + +This directory contains example K9 contractiles for common repository tasks: + +=== Kennel Level (Pure Data) + +**File:** `examples/project-metadata.k9.ncl` + +Pure configuration data with no execution. Safe to include in any repository. + +**Use cases:** +- Project metadata (name, version, description) +- Build configuration +- Tool settings +- Data schemas + +**Security:** No signature required, data-only. + +=== Yard Level (Validated Config) + +**File:** `examples/ci-config.k9.ncl` + +Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. + +**Use cases:** +- CI/CD configuration with validation +- Deployment parameters +- Database schemas with constraints +- API specifications + +**Security:** Signature recommended, Nickel evaluation only. + +=== Hunt Level (Full Execution) + +**File:** `examples/setup-repo.k9.ncl` + +Full execution with Just recipes. Can run shell commands and modify filesystem. + +**Use cases:** +- Repository setup scripts +- Deployment automation +- System configuration +- Package installation + +**Security:** **Signature required**, full system access. + +== Usage in Your Repository + +=== 1. Create K9 Components + +Choose the appropriate security level for your use case: + +[source,bash] +---- +# Kennel: Pure configuration +cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl + +# Yard: Validated configuration +cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl + +# Hunt: Full automation +cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl +---- + +=== 2. Validate Components + +[source,bash] +---- +# Validate Nickel syntax and contracts +nickel typecheck config/metadata.k9.ncl + +# Verify Hunt-level signature (if signed) +./must verify scripts/setup.k9.ncl +---- + +=== 3. Execute Components + +[source,bash] +---- +# Kennel: Export as JSON +nickel export config/metadata.k9.ncl > metadata.json + +# Yard: Evaluate with validation +nickel eval .github/ci.k9.ncl + +# Hunt: Run with Just (dry-run first!) +./must --dry-run run scripts/setup.k9.ncl +./must run scripts/setup.k9.ncl +---- + +== Integration with RSR + +K9 contractiles integrate with other RSR standards: + +**STATE.scm**:: K9 components can generate or validate STATE.scm +**ECOSYSTEM.scm**:: K9 can automate cross-repo operations +**META.scm**:: K9 can enforce architectural decisions + +== Security Best Practices + +=== For Kennel/Yard Components + +✅ **Safe to use without signatures** + +✅ **Review Nickel code before use** + +✅ **Validate contracts match expectations** + +=== For Hunt Components + +⚠️ **ALWAYS verify signatures** + +⚠️ **Review Just recipes carefully** + +⚠️ **Run dry-run mode first** + +⚠️ **Never run as root unless required** + +⚠️ **Sandbox external components** + +**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc + +== Template Files + +Use these as starting points for your own K9 components: + +- `template-kennel.k9.ncl` - Pure data template +- `template-yard.k9.ncl` - Validated config template +- `template-hunt.k9.ncl` - Full execution template + +== Dependencies + +To use K9 contractiles in your repository: + +[source,bash] +---- +# Install Nickel (configuration language) +curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel +chmod +x nickel && sudo mv nickel /usr/local/bin/ + +# Install Just (task runner, for Hunt level) +cargo install just + +# Clone K9-SVC (for must shim and tooling) +git clone https://github.com/hyperpolymath/standards.git +# Note: K9-SVC is located in standards/k9-svc +---- + +== Learn More + +- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc +- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc +- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc +- **IANA Media Type:** `application/vnd.k9+nickel` + +== Contributing + +When adding K9 contractiles to your repository: + +1. Use appropriate security level (Kennel > Yard > Hunt) +2. Document what each component does +3. Include validation contracts in Yard/Hunt components +4. Sign Hunt-level components before committing +5. Add K9 validation to CI/CD pipeline + +**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/zoterho-template/contractiles/k9/examples/ci-config.k9.ncl b/zoterho-template/contractiles/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from zoterho-template/contractiles/k9/examples/ci-config.k9.ncl rename to zoterho-template/contractiles/self-validating/examples/ci-config.k9.ncl diff --git a/zoterho-template/contractiles/k9/examples/project-metadata.k9.ncl b/zoterho-template/contractiles/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from zoterho-template/contractiles/k9/examples/project-metadata.k9.ncl rename to zoterho-template/contractiles/self-validating/examples/project-metadata.k9.ncl diff --git a/zoterho-template/contractiles/k9/examples/setup-repo.k9.ncl b/zoterho-template/contractiles/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from zoterho-template/contractiles/k9/examples/setup-repo.k9.ncl rename to zoterho-template/contractiles/self-validating/examples/setup-repo.k9.ncl diff --git a/zoterho-template/contractiles/k9/template-hunt.k9.ncl b/zoterho-template/contractiles/self-validating/template-hunt.k9.ncl similarity index 100% rename from zoterho-template/contractiles/k9/template-hunt.k9.ncl rename to zoterho-template/contractiles/self-validating/template-hunt.k9.ncl diff --git a/zoterho-template/contractiles/k9/template-kennel.k9.ncl b/zoterho-template/contractiles/self-validating/template-kennel.k9.ncl similarity index 100% rename from zoterho-template/contractiles/k9/template-kennel.k9.ncl rename to zoterho-template/contractiles/self-validating/template-kennel.k9.ncl diff --git a/zoterho-template/contractiles/k9/template-yard.k9.ncl b/zoterho-template/contractiles/self-validating/template-yard.k9.ncl similarity index 100% rename from zoterho-template/contractiles/k9/template-yard.k9.ncl rename to zoterho-template/contractiles/self-validating/template-yard.k9.ncl diff --git a/zoterho-template/docs/CITATIONS.adoc b/zoterho-template/docs/CITATIONS.adoc index 96736dd..89c143b 100644 --- a/zoterho-template/docs/CITATIONS.adoc +++ b/zoterho-template/docs/CITATIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = ZoteRho-template - Citation Guide :toc: diff --git a/zoterho-template/ffi/zig/build.zig b/zoterho-template/ffi/zig/build.zig index 4a2e049..c02617f 100644 --- a/zoterho-template/ffi/zig/build.zig +++ b/zoterho-template/ffi/zig/build.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} FFI Build Configuration // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} FFI Build Configuration const std = @import("std"); diff --git a/zoterho-template/ffi/zig/src/main.zig b/zoterho-template/ffi/zig/src/main.zig index 6b233bc..f1b2633 100644 --- a/zoterho-template/ffi/zig/src/main.zig +++ b/zoterho-template/ffi/zig/src/main.zig @@ -1,9 +1,10 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // {{PROJECT}} FFI Implementation // // This module implements the C-compatible FFI declared in src/abi/Foreign.idr // All types and layouts must match the Idris2 ABI definitions. // -// SPDX-License-Identifier: MPL-2.0 const std = @import("std"); diff --git a/zoterho-template/ffi/zig/test/integration_test.zig b/zoterho-template/ffi/zig/test/integration_test.zig index 0341994..e481508 100644 --- a/zoterho-template/ffi/zig/test/integration_test.zig +++ b/zoterho-template/ffi/zig/test/integration_test.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} Integration Tests // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} Integration Tests // // These tests verify that the Zig FFI correctly implements the Idris2 ABI diff --git a/zoterho/.claude/CLAUDE.md b/zoterho/.claude/CLAUDE.md index c878259..ce34367 100644 --- a/zoterho/.claude/CLAUDE.md +++ b/zoterho/.claude/CLAUDE.md @@ -1,3 +1,7 @@ + ## Machine-Readable Artefacts The following files in `.machine_readable/` contain structured project metadata: @@ -19,14 +23,14 @@ The following files in `.machine_readable/` contain structured project metadata: | Language/Tool | Use Case | Notes | |---------------|----------|-------| -| **ReScript** | Primary application code | Compiles to JS, type-safe | +| **AffineScript** | Primary application code | Compiles to JS, type-safe | | **Deno** | Runtime & package management | Replaces Node/npm/bun | | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools | | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI | | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like | | **Gleam** | Backend services | Runs on BEAM or compiles to JS | | **Bash/POSIX Shell** | Scripts, automation | Keep minimal | -| **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs | +| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs | | **Nickel** | Configuration language | For complex configs | | **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm | | **Julia** | Batch scripts, data processing | Per RSR | @@ -37,7 +41,7 @@ The following files in `.machine_readable/` contain structured project metadata: | Banned | Replacement | |--------|-------------| -| TypeScript | ReScript | +| TypeScript | AffineScript | | Node.js | Deno | | npm | Deno | | Bun | Deno | @@ -53,18 +57,18 @@ The following files in `.machine_readable/` contain structured project metadata: **No exceptions for Kotlin/Swift** - use Rust-first approach: -1. **Tauri 2.0+** - Web UI (ReScript) + Rust backend, MIT/Apache-2.0 +1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0 2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0 Both are FOSS with independent governance (no Big Tech). ### Enforcement Rules -1. **No new TypeScript files** - Convert existing TS to ReScript -2. **No package.json for runtime deps** - Use deno.json imports +1. **No new TypeScript files** - Convert existing TS to AffineScript +2. **No package.json - use deno.json deps** - Use deno.json imports 3. **No node_modules in production** - Deno caches deps automatically 4. **No Go code** - Use Rust instead -5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps +5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps 6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus ### Package Management diff --git a/zoterho/.github/workflows/codeql.yml b/zoterho/.github/workflows/codeql.yml index 489b82c..b8d1fd6 100644 --- a/zoterho/.github/workflows/codeql.yml +++ b/zoterho/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/zoterho/.github/workflows/governance.yml b/zoterho/.github/workflows/governance.yml index b4062e0..a044174 100644 --- a/zoterho/.github/workflows/governance.yml +++ b/zoterho/.github/workflows/governance.yml @@ -24,3 +24,4 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 + timeout-minutes: 10 diff --git a/zoterho/.github/workflows/hypatia-scan.yml b/zoterho/.github/workflows/hypatia-scan.yml index 74c09dd..3e8973e 100644 --- a/zoterho/.github/workflows/hypatia-scan.yml +++ b/zoterho/.github/workflows/hypatia-scan.yml @@ -17,6 +17,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/zoterho/.github/workflows/instant-sync.yml b/zoterho/.github/workflows/instant-sync.yml index 228dc43..01646a7 100644 --- a/zoterho/.github/workflows/instant-sync.yml +++ b/zoterho/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 diff --git a/zoterho/.github/workflows/mirror.yml b/zoterho/.github/workflows/mirror.yml index 90011ad..f5c9bb4 100644 --- a/zoterho/.github/workflows/mirror.yml +++ b/zoterho/.github/workflows/mirror.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: mirror-gitlab: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITLAB_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -30,6 +31,7 @@ jobs: mirror-bitbucket: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.BITBUCKET_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -48,6 +50,7 @@ jobs: mirror-codeberg: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.CODEBERG_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -66,6 +69,7 @@ jobs: mirror-sourcehut: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.SOURCEHUT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -84,6 +88,7 @@ jobs: mirror-disroot: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.DISROOT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -102,6 +107,7 @@ jobs: mirror-gitea: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITEA_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -120,6 +126,7 @@ jobs: mirror-radicle: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.RADICLE_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 diff --git a/zoterho/.github/workflows/policy-check.yml b/zoterho/.github/workflows/policy-check.yml index bc86e88..31f14f6 100644 --- a/zoterho/.github/workflows/policy-check.yml +++ b/zoterho/.github/workflows/policy-check.yml @@ -11,6 +11,7 @@ jobs: policy: name: Hyperpolymath Language Policy runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read @@ -26,6 +27,7 @@ jobs: nickel-validate: name: Validate Mustfile runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read diff --git a/zoterho/.github/workflows/scorecard.yml b/zoterho/.github/workflows/scorecard.yml index 476ed3f..8e2ce1b 100644 --- a/zoterho/.github/workflows/scorecard.yml +++ b/zoterho/.github/workflows/scorecard.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: analysis: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write diff --git a/zoterho/.github/workflows/secret-scanner.yml b/zoterho/.github/workflows/secret-scanner.yml index b2dcc86..4df01cb 100644 --- a/zoterho/.github/workflows/secret-scanner.yml +++ b/zoterho/.github/workflows/secret-scanner.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: trufflehog: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: @@ -24,6 +25,7 @@ jobs: gitleaks: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: @@ -37,6 +39,7 @@ jobs: # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 diff --git a/zoterho/.github/workflows/semgrep.yml b/zoterho/.github/workflows/semgrep.yml index ce44925..55d6455 100644 --- a/zoterho/.github/workflows/semgrep.yml +++ b/zoterho/.github/workflows/semgrep.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: semgrep: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write contents: read diff --git a/zoterho/ABI-FFI-README.md b/zoterho/ABI-FFI-README.md index f06f72c..af300f5 100644 --- a/zoterho/ABI-FFI-README.md +++ b/zoterho/ABI-FFI-README.md @@ -1,3 +1,7 @@ + {{~ Aditionally delete this line and fill out the template below ~}} # {{PROJECT}} ABI/FFI Documentation diff --git a/zoterho/CODE_OF_CONDUCT.md b/zoterho/CODE_OF_CONDUCT.md index 1f1548c..9020def 100644 --- a/zoterho/CODE_OF_CONDUCT.md +++ b/zoterho/CODE_OF_CONDUCT.md @@ -1,4 +1,7 @@ - + # Contributor Covenant Code of Conduct ## Our Pledge diff --git a/zoterho/CONTRIBUTING.adoc b/zoterho/CONTRIBUTING.adoc index 1f34e60..2ead10c 100644 --- a/zoterho/CONTRIBUTING.adoc +++ b/zoterho/CONTRIBUTING.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contributing Guide == Getting Started diff --git a/zoterho/CONTRIBUTING.md b/zoterho/CONTRIBUTING.md index e2e5073..ecc9102 100644 --- a/zoterho/CONTRIBUTING.md +++ b/zoterho/CONTRIBUTING.md @@ -1,3 +1,7 @@ + # Clone the repository git clone https://github.com/hyperpolymath/zotero-tools.git cd zotero-tools diff --git a/zoterho/MAINTAINERS.adoc b/zoterho/MAINTAINERS.adoc index a1c6544..becaa3e 100644 --- a/zoterho/MAINTAINERS.adoc +++ b/zoterho/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/zoterho/README.adoc b/zoterho/README.adoc index fe4c429..5fbbc21 100644 --- a/zoterho/README.adoc +++ b/zoterho/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Zoterho image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/zoterho/ROADMAP.adoc b/zoterho/ROADMAP.adoc index ca81227..50cd089 100644 --- a/zoterho/ROADMAP.adoc +++ b/zoterho/ROADMAP.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Zoterho Roadmap :toc: :toc-title: Phases diff --git a/zoterho/RSR_OUTLINE.adoc b/zoterho/RSR_OUTLINE.adoc index e429244..2901b24 100644 --- a/zoterho/RSR_OUTLINE.adoc +++ b/zoterho/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/zoterho/SECURITY.md b/zoterho/SECURITY.md index 60a5411..f19fd6d 100644 --- a/zoterho/SECURITY.md +++ b/zoterho/SECURITY.md @@ -1,4 +1,7 @@ - + # Security Policy ## Supported Versions diff --git a/zoterho/contractiles/README.adoc b/zoterho/contractiles/README.adoc index d19a387..70ad712 100644 --- a/zoterho/contractiles/README.adoc +++ b/zoterho/contractiles/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractiles Template Set :toc: :sectnums: diff --git a/zoterho/contractiles/k9/README.adoc b/zoterho/contractiles/k9/README.adoc deleted file mode 100644 index 9c3099f..0000000 --- a/zoterho/contractiles/k9/README.adoc +++ /dev/null @@ -1,178 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -= K9 Contractiles -:toc: left -:icons: font - -== What Are K9 Contractiles? - -K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. - -== The Three Security Levels - -K9 components declare their trust requirements using "The Leash" security model: - -[horizontal] -`'Kennel`:: Pure data, no execution (safest) -`'Yard`:: Nickel evaluation with contracts (medium trust) -`'Hunt`:: Full execution with Just recipes (requires signature) - -== Example Components - -This directory contains example K9 contractiles for common repository tasks: - -=== Kennel Level (Pure Data) - -**File:** `examples/project-metadata.k9.ncl` - -Pure configuration data with no execution. Safe to include in any repository. - -**Use cases:** -- Project metadata (name, version, description) -- Build configuration -- Tool settings -- Data schemas - -**Security:** No signature required, data-only. - -=== Yard Level (Validated Config) - -**File:** `examples/ci-config.k9.ncl` - -Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. - -**Use cases:** -- CI/CD configuration with validation -- Deployment parameters -- Database schemas with constraints -- API specifications - -**Security:** Signature recommended, Nickel evaluation only. - -=== Hunt Level (Full Execution) - -**File:** `examples/setup-repo.k9.ncl` - -Full execution with Just recipes. Can run shell commands and modify filesystem. - -**Use cases:** -- Repository setup scripts -- Deployment automation -- System configuration -- Package installation - -**Security:** **Signature required**, full system access. - -== Usage in Your Repository - -=== 1. Create K9 Components - -Choose the appropriate security level for your use case: - -[source,bash] ----- -# Kennel: Pure configuration -cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl - -# Yard: Validated configuration -cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl - -# Hunt: Full automation -cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl ----- - -=== 2. Validate Components - -[source,bash] ----- -# Validate Nickel syntax and contracts -nickel typecheck config/metadata.k9.ncl - -# Verify Hunt-level signature (if signed) -./must verify scripts/setup.k9.ncl ----- - -=== 3. Execute Components - -[source,bash] ----- -# Kennel: Export as JSON -nickel export config/metadata.k9.ncl > metadata.json - -# Yard: Evaluate with validation -nickel eval .github/ci.k9.ncl - -# Hunt: Run with Just (dry-run first!) -./must --dry-run run scripts/setup.k9.ncl -./must run scripts/setup.k9.ncl ----- - -== Integration with RSR - -K9 contractiles integrate with other RSR standards: - -**STATE.scm**:: K9 components can generate or validate STATE.scm -**ECOSYSTEM.scm**:: K9 can automate cross-repo operations -**META.scm**:: K9 can enforce architectural decisions - -== Security Best Practices - -=== For Kennel/Yard Components - -✅ **Safe to use without signatures** + -✅ **Review Nickel code before use** + -✅ **Validate contracts match expectations** - -=== For Hunt Components - -⚠️ **ALWAYS verify signatures** + -⚠️ **Review Just recipes carefully** + -⚠️ **Run dry-run mode first** + -⚠️ **Never run as root unless required** + -⚠️ **Sandbox external components** - -**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc - -== Template Files - -Use these as starting points for your own K9 components: - -- `template-kennel.k9.ncl` - Pure data template -- `template-yard.k9.ncl` - Validated config template -- `template-hunt.k9.ncl` - Full execution template - -== Dependencies - -To use K9 contractiles in your repository: - -[source,bash] ----- -# Install Nickel (configuration language) -curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel -chmod +x nickel && sudo mv nickel /usr/local/bin/ - -# Install Just (task runner, for Hunt level) -cargo install just - -# Clone K9-SVC (for must shim and tooling) -git clone https://github.com/hyperpolymath/standards.git -# Note: K9-SVC is located in standards/k9-svc ----- - -== Learn More - -- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc -- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc -- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc -- **IANA Media Type:** `application/vnd.k9+nickel` - -== Contributing - -When adding K9 contractiles to your repository: - -1. Use appropriate security level (Kennel > Yard > Hunt) -2. Document what each component does -3. Include validation contracts in Yard/Hunt components -4. Sign Hunt-level components before committing -5. Add K9 validation to CI/CD pipeline - -**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/zoterho/contractiles/self-validating/README.adoc b/zoterho/contractiles/self-validating/README.adoc new file mode 100644 index 0000000..ce1825f --- /dev/null +++ b/zoterho/contractiles/self-validating/README.adoc @@ -0,0 +1,179 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell += K9 Contractiles +:toc: left +:icons: font + +== What Are K9 Contractiles? + +K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. + +== The Three Security Levels + +K9 components declare their trust requirements using "The Leash" security model: + +[horizontal] +`'Kennel`:: Pure data, no execution (safest) +`'Yard`:: Nickel evaluation with contracts (medium trust) +`'Hunt`:: Full execution with Just recipes (requires signature) + +== Example Components + +This directory contains example K9 contractiles for common repository tasks: + +=== Kennel Level (Pure Data) + +**File:** `examples/project-metadata.k9.ncl` + +Pure configuration data with no execution. Safe to include in any repository. + +**Use cases:** +- Project metadata (name, version, description) +- Build configuration +- Tool settings +- Data schemas + +**Security:** No signature required, data-only. + +=== Yard Level (Validated Config) + +**File:** `examples/ci-config.k9.ncl` + +Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. + +**Use cases:** +- CI/CD configuration with validation +- Deployment parameters +- Database schemas with constraints +- API specifications + +**Security:** Signature recommended, Nickel evaluation only. + +=== Hunt Level (Full Execution) + +**File:** `examples/setup-repo.k9.ncl` + +Full execution with Just recipes. Can run shell commands and modify filesystem. + +**Use cases:** +- Repository setup scripts +- Deployment automation +- System configuration +- Package installation + +**Security:** **Signature required**, full system access. + +== Usage in Your Repository + +=== 1. Create K9 Components + +Choose the appropriate security level for your use case: + +[source,bash] +---- +# Kennel: Pure configuration +cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl + +# Yard: Validated configuration +cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl + +# Hunt: Full automation +cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl +---- + +=== 2. Validate Components + +[source,bash] +---- +# Validate Nickel syntax and contracts +nickel typecheck config/metadata.k9.ncl + +# Verify Hunt-level signature (if signed) +./must verify scripts/setup.k9.ncl +---- + +=== 3. Execute Components + +[source,bash] +---- +# Kennel: Export as JSON +nickel export config/metadata.k9.ncl > metadata.json + +# Yard: Evaluate with validation +nickel eval .github/ci.k9.ncl + +# Hunt: Run with Just (dry-run first!) +./must --dry-run run scripts/setup.k9.ncl +./must run scripts/setup.k9.ncl +---- + +== Integration with RSR + +K9 contractiles integrate with other RSR standards: + +**STATE.scm**:: K9 components can generate or validate STATE.scm +**ECOSYSTEM.scm**:: K9 can automate cross-repo operations +**META.scm**:: K9 can enforce architectural decisions + +== Security Best Practices + +=== For Kennel/Yard Components + +✅ **Safe to use without signatures** + +✅ **Review Nickel code before use** + +✅ **Validate contracts match expectations** + +=== For Hunt Components + +⚠️ **ALWAYS verify signatures** + +⚠️ **Review Just recipes carefully** + +⚠️ **Run dry-run mode first** + +⚠️ **Never run as root unless required** + +⚠️ **Sandbox external components** + +**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc + +== Template Files + +Use these as starting points for your own K9 components: + +- `template-kennel.k9.ncl` - Pure data template +- `template-yard.k9.ncl` - Validated config template +- `template-hunt.k9.ncl` - Full execution template + +== Dependencies + +To use K9 contractiles in your repository: + +[source,bash] +---- +# Install Nickel (configuration language) +curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel +chmod +x nickel && sudo mv nickel /usr/local/bin/ + +# Install Just (task runner, for Hunt level) +cargo install just + +# Clone K9-SVC (for must shim and tooling) +git clone https://github.com/hyperpolymath/standards.git +# Note: K9-SVC is located in standards/k9-svc +---- + +== Learn More + +- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc +- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc +- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc +- **IANA Media Type:** `application/vnd.k9+nickel` + +== Contributing + +When adding K9 contractiles to your repository: + +1. Use appropriate security level (Kennel > Yard > Hunt) +2. Document what each component does +3. Include validation contracts in Yard/Hunt components +4. Sign Hunt-level components before committing +5. Add K9 validation to CI/CD pipeline + +**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/zoterho/contractiles/k9/examples/ci-config.k9.ncl b/zoterho/contractiles/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from zoterho/contractiles/k9/examples/ci-config.k9.ncl rename to zoterho/contractiles/self-validating/examples/ci-config.k9.ncl diff --git a/zoterho/contractiles/k9/examples/project-metadata.k9.ncl b/zoterho/contractiles/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from zoterho/contractiles/k9/examples/project-metadata.k9.ncl rename to zoterho/contractiles/self-validating/examples/project-metadata.k9.ncl diff --git a/zoterho/contractiles/k9/examples/setup-repo.k9.ncl b/zoterho/contractiles/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from zoterho/contractiles/k9/examples/setup-repo.k9.ncl rename to zoterho/contractiles/self-validating/examples/setup-repo.k9.ncl diff --git a/zoterho/contractiles/k9/template-hunt.k9.ncl b/zoterho/contractiles/self-validating/template-hunt.k9.ncl similarity index 100% rename from zoterho/contractiles/k9/template-hunt.k9.ncl rename to zoterho/contractiles/self-validating/template-hunt.k9.ncl diff --git a/zoterho/contractiles/k9/template-kennel.k9.ncl b/zoterho/contractiles/self-validating/template-kennel.k9.ncl similarity index 100% rename from zoterho/contractiles/k9/template-kennel.k9.ncl rename to zoterho/contractiles/self-validating/template-kennel.k9.ncl diff --git a/zoterho/contractiles/k9/template-yard.k9.ncl b/zoterho/contractiles/self-validating/template-yard.k9.ncl similarity index 100% rename from zoterho/contractiles/k9/template-yard.k9.ncl rename to zoterho/contractiles/self-validating/template-yard.k9.ncl diff --git a/zoterho/docs/CITATIONS.adoc b/zoterho/docs/CITATIONS.adoc index 37fdb0f..52ba528 100644 --- a/zoterho/docs/CITATIONS.adoc +++ b/zoterho/docs/CITATIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR-template-repo - Citation Guide :toc: diff --git a/zoterho/ffi/zig/build.zig b/zoterho/ffi/zig/build.zig index 4a2e049..c02617f 100644 --- a/zoterho/ffi/zig/build.zig +++ b/zoterho/ffi/zig/build.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} FFI Build Configuration // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} FFI Build Configuration const std = @import("std"); diff --git a/zoterho/ffi/zig/src/main.zig b/zoterho/ffi/zig/src/main.zig index 6b233bc..f1b2633 100644 --- a/zoterho/ffi/zig/src/main.zig +++ b/zoterho/ffi/zig/src/main.zig @@ -1,9 +1,10 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // {{PROJECT}} FFI Implementation // // This module implements the C-compatible FFI declared in src/abi/Foreign.idr // All types and layouts must match the Idris2 ABI definitions. // -// SPDX-License-Identifier: MPL-2.0 const std = @import("std"); diff --git a/zoterho/ffi/zig/test/integration_test.zig b/zoterho/ffi/zig/test/integration_test.zig index 0341994..e481508 100644 --- a/zoterho/ffi/zig/test/integration_test.zig +++ b/zoterho/ffi/zig/test/integration_test.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} Integration Tests // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} Integration Tests // // These tests verify that the Zig FFI correctly implements the Idris2 ABI diff --git a/zoterho/src/abi/Foreign.idr b/zoterho/src/abi/Foreign.idr index 2965146..5b63674 100644 --- a/zoterho/src/abi/Foreign.idr +++ b/zoterho/src/abi/Foreign.idr @@ -1,3 +1,5 @@ +-- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell ||| ZOTERHO — FFI Bridge Declarations ||| ||| This module defines the formal bridge to the Zoterho bibliographic diff --git a/zoterho/src/abi/Layout.idr b/zoterho/src/abi/Layout.idr index fdda39a..dac805b 100644 --- a/zoterho/src/abi/Layout.idr +++ b/zoterho/src/abi/Layout.idr @@ -1,3 +1,5 @@ +-- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell ||| Memory Layout Proofs — ABI Foundation. ||| ||| This module provides the formal proofs required to ensure that diff --git a/zoterho/src/abi/Types.idr b/zoterho/src/abi/Types.idr index 43061c9..5cf36db 100644 --- a/zoterho/src/abi/Types.idr +++ b/zoterho/src/abi/Types.idr @@ -1,3 +1,5 @@ +-- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell ||| ZOTERHO — ABI Type Definitions ||| ||| This module defines the Application Binary Interface for the Zoterho diff --git a/zotpress/.claude/CLAUDE.md b/zotpress/.claude/CLAUDE.md index c878259..ce34367 100644 --- a/zotpress/.claude/CLAUDE.md +++ b/zotpress/.claude/CLAUDE.md @@ -1,3 +1,7 @@ + ## Machine-Readable Artefacts The following files in `.machine_readable/` contain structured project metadata: @@ -19,14 +23,14 @@ The following files in `.machine_readable/` contain structured project metadata: | Language/Tool | Use Case | Notes | |---------------|----------|-------| -| **ReScript** | Primary application code | Compiles to JS, type-safe | +| **AffineScript** | Primary application code | Compiles to JS, type-safe | | **Deno** | Runtime & package management | Replaces Node/npm/bun | | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools | | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI | | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like | | **Gleam** | Backend services | Runs on BEAM or compiles to JS | | **Bash/POSIX Shell** | Scripts, automation | Keep minimal | -| **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs | +| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs | | **Nickel** | Configuration language | For complex configs | | **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm | | **Julia** | Batch scripts, data processing | Per RSR | @@ -37,7 +41,7 @@ The following files in `.machine_readable/` contain structured project metadata: | Banned | Replacement | |--------|-------------| -| TypeScript | ReScript | +| TypeScript | AffineScript | | Node.js | Deno | | npm | Deno | | Bun | Deno | @@ -53,18 +57,18 @@ The following files in `.machine_readable/` contain structured project metadata: **No exceptions for Kotlin/Swift** - use Rust-first approach: -1. **Tauri 2.0+** - Web UI (ReScript) + Rust backend, MIT/Apache-2.0 +1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0 2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0 Both are FOSS with independent governance (no Big Tech). ### Enforcement Rules -1. **No new TypeScript files** - Convert existing TS to ReScript -2. **No package.json for runtime deps** - Use deno.json imports +1. **No new TypeScript files** - Convert existing TS to AffineScript +2. **No package.json - use deno.json deps** - Use deno.json imports 3. **No node_modules in production** - Deno caches deps automatically 4. **No Go code** - Use Rust instead -5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps +5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps 6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus ### Package Management diff --git a/zotpress/.github/ISSUE_TEMPLATE/bug_report.md b/zotpress/.github/ISSUE_TEMPLATE/bug_report.md index 987aab6..45a6c02 100644 --- a/zotpress/.github/ISSUE_TEMPLATE/bug_report.md +++ b/zotpress/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,3 +1,7 @@ + --- name: Bug report about: Create a report to help us improve diff --git a/zotpress/.github/ISSUE_TEMPLATE/custom.md b/zotpress/.github/ISSUE_TEMPLATE/custom.md index 48d5f81..99ebf00 100644 --- a/zotpress/.github/ISSUE_TEMPLATE/custom.md +++ b/zotpress/.github/ISSUE_TEMPLATE/custom.md @@ -1,3 +1,7 @@ + --- name: Custom issue template about: Describe this issue template's purpose here. diff --git a/zotpress/.github/ISSUE_TEMPLATE/documentation.md b/zotpress/.github/ISSUE_TEMPLATE/documentation.md index 4fcb9f9..b1d16df 100644 --- a/zotpress/.github/ISSUE_TEMPLATE/documentation.md +++ b/zotpress/.github/ISSUE_TEMPLATE/documentation.md @@ -1,3 +1,7 @@ + --- name: Documentation about: Report unclear, missing, or incorrect documentation diff --git a/zotpress/.github/ISSUE_TEMPLATE/feature_request.md b/zotpress/.github/ISSUE_TEMPLATE/feature_request.md index 3e8fa7e..a5a5693 100644 --- a/zotpress/.github/ISSUE_TEMPLATE/feature_request.md +++ b/zotpress/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,3 +1,7 @@ + --- name: Feature request about: Suggest an idea for this project diff --git a/zotpress/.github/ISSUE_TEMPLATE/question.md b/zotpress/.github/ISSUE_TEMPLATE/question.md index fd0e2a5..c2d1f57 100644 --- a/zotpress/.github/ISSUE_TEMPLATE/question.md +++ b/zotpress/.github/ISSUE_TEMPLATE/question.md @@ -1,3 +1,7 @@ + --- name: Question about: Ask a question about usage or behaviour diff --git a/zotpress/.github/workflows/casket-pages.yml b/zotpress/.github/workflows/casket-pages.yml index 0661cf7..800fe7e 100644 --- a/zotpress/.github/workflows/casket-pages.yml +++ b/zotpress/.github/workflows/casket-pages.yml @@ -18,6 +18,7 @@ concurrency: jobs: build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 @@ -91,6 +92,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: - name: Deploy to GitHub Pages diff --git a/zotpress/.github/workflows/codeql.yml b/zotpress/.github/workflows/codeql.yml index 02646db..bb72c7a 100644 --- a/zotpress/.github/workflows/codeql.yml +++ b/zotpress/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/zotpress/.github/workflows/governance.yml b/zotpress/.github/workflows/governance.yml index b4062e0..a044174 100644 --- a/zotpress/.github/workflows/governance.yml +++ b/zotpress/.github/workflows/governance.yml @@ -24,3 +24,4 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 + timeout-minutes: 10 diff --git a/zotpress/.github/workflows/hypatia-scan.yml b/zotpress/.github/workflows/hypatia-scan.yml index 74c09dd..3e8973e 100644 --- a/zotpress/.github/workflows/hypatia-scan.yml +++ b/zotpress/.github/workflows/hypatia-scan.yml @@ -17,6 +17,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/zotpress/.github/workflows/instant-sync.yml b/zotpress/.github/workflows/instant-sync.yml index 228dc43..01646a7 100644 --- a/zotpress/.github/workflows/instant-sync.yml +++ b/zotpress/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 diff --git a/zotpress/.github/workflows/jekyll-gh-pages.yml b/zotpress/.github/workflows/jekyll-gh-pages.yml index 0fcaf1f..c0c0a26 100644 --- a/zotpress/.github/workflows/jekyll-gh-pages.yml +++ b/zotpress/.github/workflows/jekyll-gh-pages.yml @@ -19,6 +19,7 @@ concurrency: jobs: build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -37,6 +38,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: - name: Deploy to GitHub Pages diff --git a/zotpress/.github/workflows/mirror.yml b/zotpress/.github/workflows/mirror.yml index 7af3b2f..908bf15 100644 --- a/zotpress/.github/workflows/mirror.yml +++ b/zotpress/.github/workflows/mirror.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: mirror-gitlab: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITLAB_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -30,6 +31,7 @@ jobs: mirror-bitbucket: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.BITBUCKET_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -48,6 +50,7 @@ jobs: mirror-codeberg: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.CODEBERG_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -66,6 +69,7 @@ jobs: mirror-sourcehut: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.SOURCEHUT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -84,6 +88,7 @@ jobs: mirror-disroot: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.DISROOT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -102,6 +107,7 @@ jobs: mirror-gitea: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITEA_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 @@ -120,6 +126,7 @@ jobs: mirror-radicle: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.RADICLE_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/zotpress/.github/workflows/php-standards.yml b/zotpress/.github/workflows/php-standards.yml index 4257a5d..61a15df 100644 --- a/zotpress/.github/workflows/php-standards.yml +++ b/zotpress/.github/workflows/php-standards.yml @@ -37,6 +37,7 @@ jobs: syntax: name: PHP Syntax (${{ matrix.php }}) runs-on: ubuntu-latest + timeout-minutes: 15 strategy: fail-fast: false matrix: @@ -62,6 +63,7 @@ jobs: phpcs: name: WordPress Coding Standards runs-on: ubuntu-latest + timeout-minutes: 15 needs: syntax steps: @@ -123,6 +125,7 @@ jobs: phpstan: name: PHPStan (Level ${{ matrix.level }}) runs-on: ubuntu-latest + timeout-minutes: 15 needs: syntax strategy: fail-fast: false @@ -164,6 +167,7 @@ jobs: psalm: name: Psalm Analysis runs-on: ubuntu-latest + timeout-minutes: 15 needs: syntax steps: @@ -196,6 +200,7 @@ jobs: compatibility: name: PHP Compatibility (8.1+) runs-on: ubuntu-latest + timeout-minutes: 15 needs: syntax steps: @@ -234,6 +239,7 @@ jobs: security: name: Security Audit runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout @@ -254,6 +260,7 @@ jobs: summary: name: Standards Summary runs-on: ubuntu-latest + timeout-minutes: 15 needs: [syntax, phpcs, phpstan, psalm, compatibility, security] if: always() diff --git a/zotpress/.github/workflows/scorecard-enforcer.yml b/zotpress/.github/workflows/scorecard-enforcer.yml index 5537465..1710407 100644 --- a/zotpress/.github/workflows/scorecard-enforcer.yml +++ b/zotpress/.github/workflows/scorecard-enforcer.yml @@ -14,6 +14,7 @@ permissions: read-all jobs: scorecard: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write # For OIDC @@ -52,6 +53,7 @@ jobs: # Check specific high-priority items check-critical: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/zotpress/.github/workflows/scorecard.yml b/zotpress/.github/workflows/scorecard.yml index 443d4c8..9dcfbc9 100644 --- a/zotpress/.github/workflows/scorecard.yml +++ b/zotpress/.github/workflows/scorecard.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: analysis: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write diff --git a/zotpress/.github/workflows/secret-scanner.yml b/zotpress/.github/workflows/secret-scanner.yml index 680cbcd..974dc58 100644 --- a/zotpress/.github/workflows/secret-scanner.yml +++ b/zotpress/.github/workflows/secret-scanner.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: trufflehog: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: @@ -24,6 +25,7 @@ jobs: gitleaks: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: @@ -37,6 +39,7 @@ jobs: # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 diff --git a/zotpress/.github/workflows/security-analysis.yml b/zotpress/.github/workflows/security-analysis.yml index 12694bb..753aacd 100644 --- a/zotpress/.github/workflows/security-analysis.yml +++ b/zotpress/.github/workflows/security-analysis.yml @@ -23,6 +23,7 @@ jobs: sanctify-analysis: name: Sanctify PHP Security Analysis runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write @@ -84,6 +85,7 @@ jobs: php-aegis-check: name: PHP Aegis Integration Check runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/zotpress/.github/workflows/test.yml b/zotpress/.github/workflows/test.yml index 3a9b39d..457b3b7 100644 --- a/zotpress/.github/workflows/test.yml +++ b/zotpress/.github/workflows/test.yml @@ -28,6 +28,7 @@ jobs: php-tests: name: PHP Tests (PHP ${{ matrix.php }}) runs-on: ubuntu-latest + timeout-minutes: 15 strategy: fail-fast: false matrix: @@ -80,6 +81,7 @@ jobs: php-static-analysis: name: PHP Static Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -115,6 +117,7 @@ jobs: deno-tests: name: Deno Tests runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -154,6 +157,7 @@ jobs: build: name: Build Assets runs-on: ubuntu-latest + timeout-minutes: 15 needs: [deno-tests] steps: @@ -187,6 +191,7 @@ jobs: wordpress-compat: name: WordPress Compatibility runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -216,6 +221,7 @@ jobs: all-checks: name: All Checks Passed runs-on: ubuntu-latest + timeout-minutes: 15 needs: [php-tests, php-static-analysis, deno-tests, build, wordpress-compat] if: always() diff --git a/zotpress/.meta/REQUIRED-FILES.md b/zotpress/.meta/REQUIRED-FILES.md index b06e206..0fa3da1 100644 --- a/zotpress/.meta/REQUIRED-FILES.md +++ b/zotpress/.meta/REQUIRED-FILES.md @@ -1,3 +1,7 @@ + # Required Repository Files The following files **MUST** be present and kept up-to-date in every repository: diff --git a/zotpress/ABI-FFI-README.md b/zotpress/ABI-FFI-README.md index f06f72c..af300f5 100644 --- a/zotpress/ABI-FFI-README.md +++ b/zotpress/ABI-FFI-README.md @@ -1,3 +1,7 @@ + {{~ Aditionally delete this line and fill out the template below ~}} # {{PROJECT}} ABI/FFI Documentation diff --git a/zotpress/CHANGELOG.adoc b/zotpress/CHANGELOG.adoc index 6d2d697..96e759a 100644 --- a/zotpress/CHANGELOG.adoc +++ b/zotpress/CHANGELOG.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2025 Hyperpolymath = Changelog :toc: diff --git a/zotpress/CODE_OF_CONDUCT.md b/zotpress/CODE_OF_CONDUCT.md index 7eb4a53..cd2d2fa 100644 --- a/zotpress/CODE_OF_CONDUCT.md +++ b/zotpress/CODE_OF_CONDUCT.md @@ -1,3 +1,7 @@ + # Code of Conduct # Contributing Thank you for your interest in contributing! diff --git a/zotpress/MAINTAINERS.adoc b/zotpress/MAINTAINERS.adoc index a1c6544..becaa3e 100644 --- a/zotpress/MAINTAINERS.adoc +++ b/zotpress/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/zotpress/PALIMPSEST.adoc b/zotpress/PALIMPSEST.adoc index ebaa6d0..9660f13 100644 --- a/zotpress/PALIMPSEST.adoc +++ b/zotpress/PALIMPSEST.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Palimpsest License :toc: :toc-placement!: diff --git a/zotpress/PRIORITY.adoc b/zotpress/PRIORITY.adoc index 9d06116..aa96b79 100644 --- a/zotpress/PRIORITY.adoc +++ b/zotpress/PRIORITY.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Zotpress Priority List :toc: diff --git a/zotpress/README.adoc b/zotpress/README.adoc index 287e4bc..14dc2b2 100644 --- a/zotpress/README.adoc +++ b/zotpress/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = zotpress image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/zotpress/ROADMAP.adoc b/zotpress/ROADMAP.adoc index a802a14..ee86631 100644 --- a/zotpress/ROADMAP.adoc +++ b/zotpress/ROADMAP.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Zotpress Roadmap :author: Hyperpolymath :revdate: 2025-12-26 diff --git a/zotpress/RSR_OUTLINE.adoc b/zotpress/RSR_OUTLINE.adoc index e429244..2901b24 100644 --- a/zotpress/RSR_OUTLINE.adoc +++ b/zotpress/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/zotpress/SECURITY.md b/zotpress/SECURITY.md index d670026..cb2a65a 100644 --- a/zotpress/SECURITY.md +++ b/zotpress/SECURITY.md @@ -1,3 +1,7 @@ + # Security Policy ## Supported Versions diff --git a/zotpress/contractiles/README.adoc b/zotpress/contractiles/README.adoc index d19a387..70ad712 100644 --- a/zotpress/contractiles/README.adoc +++ b/zotpress/contractiles/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractiles Template Set :toc: :sectnums: diff --git a/zotpress/contractiles/k9/README.adoc b/zotpress/contractiles/k9/README.adoc deleted file mode 100644 index 9c3099f..0000000 --- a/zotpress/contractiles/k9/README.adoc +++ /dev/null @@ -1,178 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -= K9 Contractiles -:toc: left -:icons: font - -== What Are K9 Contractiles? - -K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. - -== The Three Security Levels - -K9 components declare their trust requirements using "The Leash" security model: - -[horizontal] -`'Kennel`:: Pure data, no execution (safest) -`'Yard`:: Nickel evaluation with contracts (medium trust) -`'Hunt`:: Full execution with Just recipes (requires signature) - -== Example Components - -This directory contains example K9 contractiles for common repository tasks: - -=== Kennel Level (Pure Data) - -**File:** `examples/project-metadata.k9.ncl` - -Pure configuration data with no execution. Safe to include in any repository. - -**Use cases:** -- Project metadata (name, version, description) -- Build configuration -- Tool settings -- Data schemas - -**Security:** No signature required, data-only. - -=== Yard Level (Validated Config) - -**File:** `examples/ci-config.k9.ncl` - -Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. - -**Use cases:** -- CI/CD configuration with validation -- Deployment parameters -- Database schemas with constraints -- API specifications - -**Security:** Signature recommended, Nickel evaluation only. - -=== Hunt Level (Full Execution) - -**File:** `examples/setup-repo.k9.ncl` - -Full execution with Just recipes. Can run shell commands and modify filesystem. - -**Use cases:** -- Repository setup scripts -- Deployment automation -- System configuration -- Package installation - -**Security:** **Signature required**, full system access. - -== Usage in Your Repository - -=== 1. Create K9 Components - -Choose the appropriate security level for your use case: - -[source,bash] ----- -# Kennel: Pure configuration -cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl - -# Yard: Validated configuration -cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl - -# Hunt: Full automation -cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl ----- - -=== 2. Validate Components - -[source,bash] ----- -# Validate Nickel syntax and contracts -nickel typecheck config/metadata.k9.ncl - -# Verify Hunt-level signature (if signed) -./must verify scripts/setup.k9.ncl ----- - -=== 3. Execute Components - -[source,bash] ----- -# Kennel: Export as JSON -nickel export config/metadata.k9.ncl > metadata.json - -# Yard: Evaluate with validation -nickel eval .github/ci.k9.ncl - -# Hunt: Run with Just (dry-run first!) -./must --dry-run run scripts/setup.k9.ncl -./must run scripts/setup.k9.ncl ----- - -== Integration with RSR - -K9 contractiles integrate with other RSR standards: - -**STATE.scm**:: K9 components can generate or validate STATE.scm -**ECOSYSTEM.scm**:: K9 can automate cross-repo operations -**META.scm**:: K9 can enforce architectural decisions - -== Security Best Practices - -=== For Kennel/Yard Components - -✅ **Safe to use without signatures** + -✅ **Review Nickel code before use** + -✅ **Validate contracts match expectations** - -=== For Hunt Components - -⚠️ **ALWAYS verify signatures** + -⚠️ **Review Just recipes carefully** + -⚠️ **Run dry-run mode first** + -⚠️ **Never run as root unless required** + -⚠️ **Sandbox external components** - -**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc - -== Template Files - -Use these as starting points for your own K9 components: - -- `template-kennel.k9.ncl` - Pure data template -- `template-yard.k9.ncl` - Validated config template -- `template-hunt.k9.ncl` - Full execution template - -== Dependencies - -To use K9 contractiles in your repository: - -[source,bash] ----- -# Install Nickel (configuration language) -curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel -chmod +x nickel && sudo mv nickel /usr/local/bin/ - -# Install Just (task runner, for Hunt level) -cargo install just - -# Clone K9-SVC (for must shim and tooling) -git clone https://github.com/hyperpolymath/standards.git -# Note: K9-SVC is located in standards/k9-svc ----- - -== Learn More - -- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc -- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc -- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc -- **IANA Media Type:** `application/vnd.k9+nickel` - -== Contributing - -When adding K9 contractiles to your repository: - -1. Use appropriate security level (Kennel > Yard > Hunt) -2. Document what each component does -3. Include validation contracts in Yard/Hunt components -4. Sign Hunt-level components before committing -5. Add K9 validation to CI/CD pipeline - -**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/zotpress/contractiles/self-validating/README.adoc b/zotpress/contractiles/self-validating/README.adoc new file mode 100644 index 0000000..ce1825f --- /dev/null +++ b/zotpress/contractiles/self-validating/README.adoc @@ -0,0 +1,179 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell += K9 Contractiles +:toc: left +:icons: font + +== What Are K9 Contractiles? + +K9 contractiles are self-validating components that combine configuration, validation, and deployment logic in a single file format. They implement the RSR principle of "self-describing artifacts" by embedding contracts and orchestration directly in the component. + +== The Three Security Levels + +K9 components declare their trust requirements using "The Leash" security model: + +[horizontal] +`'Kennel`:: Pure data, no execution (safest) +`'Yard`:: Nickel evaluation with contracts (medium trust) +`'Hunt`:: Full execution with Just recipes (requires signature) + +== Example Components + +This directory contains example K9 contractiles for common repository tasks: + +=== Kennel Level (Pure Data) + +**File:** `examples/project-metadata.k9.ncl` + +Pure configuration data with no execution. Safe to include in any repository. + +**Use cases:** +- Project metadata (name, version, description) +- Build configuration +- Tool settings +- Data schemas + +**Security:** No signature required, data-only. + +=== Yard Level (Validated Config) + +**File:** `examples/ci-config.k9.ncl` + +Configuration with Nickel contracts for runtime validation. Evaluated safely without I/O. + +**Use cases:** +- CI/CD configuration with validation +- Deployment parameters +- Database schemas with constraints +- API specifications + +**Security:** Signature recommended, Nickel evaluation only. + +=== Hunt Level (Full Execution) + +**File:** `examples/setup-repo.k9.ncl` + +Full execution with Just recipes. Can run shell commands and modify filesystem. + +**Use cases:** +- Repository setup scripts +- Deployment automation +- System configuration +- Package installation + +**Security:** **Signature required**, full system access. + +== Usage in Your Repository + +=== 1. Create K9 Components + +Choose the appropriate security level for your use case: + +[source,bash] +---- +# Kennel: Pure configuration +cp contractiles/k9/examples/project-metadata.k9.ncl config/metadata.k9.ncl + +# Yard: Validated configuration +cp contractiles/k9/examples/ci-config.k9.ncl .github/ci.k9.ncl + +# Hunt: Full automation +cp contractiles/k9/examples/setup-repo.k9.ncl scripts/setup.k9.ncl +---- + +=== 2. Validate Components + +[source,bash] +---- +# Validate Nickel syntax and contracts +nickel typecheck config/metadata.k9.ncl + +# Verify Hunt-level signature (if signed) +./must verify scripts/setup.k9.ncl +---- + +=== 3. Execute Components + +[source,bash] +---- +# Kennel: Export as JSON +nickel export config/metadata.k9.ncl > metadata.json + +# Yard: Evaluate with validation +nickel eval .github/ci.k9.ncl + +# Hunt: Run with Just (dry-run first!) +./must --dry-run run scripts/setup.k9.ncl +./must run scripts/setup.k9.ncl +---- + +== Integration with RSR + +K9 contractiles integrate with other RSR standards: + +**STATE.scm**:: K9 components can generate or validate STATE.scm +**ECOSYSTEM.scm**:: K9 can automate cross-repo operations +**META.scm**:: K9 can enforce architectural decisions + +== Security Best Practices + +=== For Kennel/Yard Components + +✅ **Safe to use without signatures** + +✅ **Review Nickel code before use** + +✅ **Validate contracts match expectations** + +=== For Hunt Components + +⚠️ **ALWAYS verify signatures** + +⚠️ **Review Just recipes carefully** + +⚠️ **Run dry-run mode first** + +⚠️ **Never run as root unless required** + +⚠️ **Sandbox external components** + +**See:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-BEST-PRACTICES.adoc + +== Template Files + +Use these as starting points for your own K9 components: + +- `template-kennel.k9.ncl` - Pure data template +- `template-yard.k9.ncl` - Validated config template +- `template-hunt.k9.ncl` - Full execution template + +== Dependencies + +To use K9 contractiles in your repository: + +[source,bash] +---- +# Install Nickel (configuration language) +curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-linux-x86_64 -o nickel +chmod +x nickel && sudo mv nickel /usr/local/bin/ + +# Install Just (task runner, for Hunt level) +cargo install just + +# Clone K9-SVC (for must shim and tooling) +git clone https://github.com/hyperpolymath/standards.git +# Note: K9-SVC is located in standards/k9-svc +---- + +== Learn More + +- **K9-SVC Specification:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc +- **K9 User Guide:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/GUIDE.adoc +- **Security Documentation:** https://github.com/hyperpolymath/standards/blob/main/k9-svc/docs/SECURITY-FAQ.adoc +- **IANA Media Type:** `application/vnd.k9+nickel` + +== Contributing + +When adding K9 contractiles to your repository: + +1. Use appropriate security level (Kennel > Yard > Hunt) +2. Document what each component does +3. Include validation contracts in Yard/Hunt components +4. Sign Hunt-level components before committing +5. Add K9 validation to CI/CD pipeline + +**Questions?** Open an issue on https://github.com/hyperpolymath/standards/tree/main/k9-svc diff --git a/zotpress/contractiles/k9/examples/ci-config.k9.ncl b/zotpress/contractiles/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from zotpress/contractiles/k9/examples/ci-config.k9.ncl rename to zotpress/contractiles/self-validating/examples/ci-config.k9.ncl diff --git a/zotpress/contractiles/k9/examples/project-metadata.k9.ncl b/zotpress/contractiles/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from zotpress/contractiles/k9/examples/project-metadata.k9.ncl rename to zotpress/contractiles/self-validating/examples/project-metadata.k9.ncl diff --git a/zotpress/contractiles/k9/examples/setup-repo.k9.ncl b/zotpress/contractiles/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from zotpress/contractiles/k9/examples/setup-repo.k9.ncl rename to zotpress/contractiles/self-validating/examples/setup-repo.k9.ncl diff --git a/zotpress/contractiles/k9/template-hunt.k9.ncl b/zotpress/contractiles/self-validating/template-hunt.k9.ncl similarity index 100% rename from zotpress/contractiles/k9/template-hunt.k9.ncl rename to zotpress/contractiles/self-validating/template-hunt.k9.ncl diff --git a/zotpress/contractiles/k9/template-kennel.k9.ncl b/zotpress/contractiles/self-validating/template-kennel.k9.ncl similarity index 100% rename from zotpress/contractiles/k9/template-kennel.k9.ncl rename to zotpress/contractiles/self-validating/template-kennel.k9.ncl diff --git a/zotpress/contractiles/k9/template-yard.k9.ncl b/zotpress/contractiles/self-validating/template-yard.k9.ncl similarity index 100% rename from zotpress/contractiles/k9/template-yard.k9.ncl rename to zotpress/contractiles/self-validating/template-yard.k9.ncl diff --git a/zotpress/demo/README.md b/zotpress/demo/README.md index ad3c89c..cc8b4dc 100644 --- a/zotpress/demo/README.md +++ b/zotpress/demo/README.md @@ -1,3 +1,7 @@ + # Zotpress Demo Minimal examples showing Zotero integration with WordPress. diff --git a/zotpress/docs/CITATIONS.adoc b/zotpress/docs/CITATIONS.adoc index 940bf3b..2bb484b 100644 --- a/zotpress/docs/CITATIONS.adoc +++ b/zotpress/docs/CITATIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = zotpress - Citation Guide :toc: diff --git a/zotpress/docs/SECURITY-INTEGRATION-REPORT.md b/zotpress/docs/SECURITY-INTEGRATION-REPORT.md index acd6629..688e742 100644 --- a/zotpress/docs/SECURITY-INTEGRATION-REPORT.md +++ b/zotpress/docs/SECURITY-INTEGRATION-REPORT.md @@ -1,3 +1,7 @@ + # Security Integration Report: php-aegis & sanctify-php with Zotpress **Date:** 2025-12-27 diff --git a/zotpress/ffi/zig/build.zig b/zotpress/ffi/zig/build.zig index 4a2e049..c02617f 100644 --- a/zotpress/ffi/zig/build.zig +++ b/zotpress/ffi/zig/build.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} FFI Build Configuration // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} FFI Build Configuration const std = @import("std"); diff --git a/zotpress/ffi/zig/src/main.zig b/zotpress/ffi/zig/src/main.zig index 6b233bc..f1b2633 100644 --- a/zotpress/ffi/zig/src/main.zig +++ b/zotpress/ffi/zig/src/main.zig @@ -1,9 +1,10 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // {{PROJECT}} FFI Implementation // // This module implements the C-compatible FFI declared in src/abi/Foreign.idr // All types and layouts must match the Idris2 ABI definitions. // -// SPDX-License-Identifier: MPL-2.0 const std = @import("std"); diff --git a/zotpress/ffi/zig/test/integration_test.zig b/zotpress/ffi/zig/test/integration_test.zig index 0341994..e481508 100644 --- a/zotpress/ffi/zig/test/integration_test.zig +++ b/zotpress/ffi/zig/test/integration_test.zig @@ -1,5 +1,6 @@ -// {{PROJECT}} Integration Tests // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// {{PROJECT}} Integration Tests // // These tests verify that the Zig FFI correctly implements the Idris2 ABI diff --git a/zotpress/scripts/build-css.js b/zotpress/scripts/build-css.js index 64b8cdc..20e13ec 100644 --- a/zotpress/scripts/build-css.js +++ b/zotpress/scripts/build-css.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * CSS Build Script * diff --git a/zotpress/scripts/build-js.js b/zotpress/scripts/build-js.js index 1fd7ec3..2bc5a34 100644 --- a/zotpress/scripts/build-js.js +++ b/zotpress/scripts/build-js.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * JavaScript Build Script * diff --git a/zotpress/scripts/build.js b/zotpress/scripts/build.js index 2a3e338..7404dbb 100644 --- a/zotpress/scripts/build.js +++ b/zotpress/scripts/build.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell /** * Zotpress Build Script * From 082bbe062e7d4542989aa3b0294d1b94ff8ef4c2 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 4 Jun 2026 18:55:05 +0100 Subject: [PATCH 07/15] chore: fold lust into intend (deprecated 2026-04-18) --- fogbinder/contractiles/README.adoc | 2 +- fogbinder/contractiles/{lust => intend}/Intentfile | 0 formbd/contractiles/README.adoc | 2 +- formbd/contractiles/{lust => intend}/Intentfile | 0 librarian/contractiles/README.adoc | 2 +- librarian/contractiles/{lust => intend}/Intentfile | 0 nesy/contractiles/README.adoc | 2 +- nesy/contractiles/{lust => intend}/Intentfile | 0 rescript-templater/contractiles/README.adoc | 2 +- rescript-templater/contractiles/{lust => intend}/Intentfile | 0 safe-storage/contractiles/README.adoc | 2 +- safe-storage/contractiles/{lust => intend}/Intentfile | 0 voyant-export/contractiles/README.adoc | 2 +- voyant-export/contractiles/{lust => intend}/Intentfile | 0 zoterho-template/contractiles/README.adoc | 2 +- zoterho-template/contractiles/{lust => intend}/Intentfile | 0 zoterho/contractiles/README.adoc | 2 +- zoterho/contractiles/{lust => intend}/Intentfile | 0 zotpress/contractiles/README.adoc | 2 +- zotpress/contractiles/{lust => intend}/Intentfile | 0 20 files changed, 10 insertions(+), 10 deletions(-) rename fogbinder/contractiles/{lust => intend}/Intentfile (100%) rename formbd/contractiles/{lust => intend}/Intentfile (100%) rename librarian/contractiles/{lust => intend}/Intentfile (100%) rename nesy/contractiles/{lust => intend}/Intentfile (100%) rename rescript-templater/contractiles/{lust => intend}/Intentfile (100%) rename safe-storage/contractiles/{lust => intend}/Intentfile (100%) rename voyant-export/contractiles/{lust => intend}/Intentfile (100%) rename zoterho-template/contractiles/{lust => intend}/Intentfile (100%) rename zoterho/contractiles/{lust => intend}/Intentfile (100%) rename zotpress/contractiles/{lust => intend}/Intentfile (100%) diff --git a/fogbinder/contractiles/README.adoc b/fogbinder/contractiles/README.adoc index 70ad712..4eb4829 100644 --- a/fogbinder/contractiles/README.adoc +++ b/fogbinder/contractiles/README.adoc @@ -18,4 +18,4 @@ This directory contains the generalized contractiles templates. Copy the `contra * `must/Mustfile` - required invariants and validations. * `trust/Trustfile.hs` - cryptographic verification steps. * `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. +* `intend/Intentfile` - future intent and roadmap direction. diff --git a/fogbinder/contractiles/lust/Intentfile b/fogbinder/contractiles/intend/Intentfile similarity index 100% rename from fogbinder/contractiles/lust/Intentfile rename to fogbinder/contractiles/intend/Intentfile diff --git a/formbd/contractiles/README.adoc b/formbd/contractiles/README.adoc index 70ad712..4eb4829 100644 --- a/formbd/contractiles/README.adoc +++ b/formbd/contractiles/README.adoc @@ -18,4 +18,4 @@ This directory contains the generalized contractiles templates. Copy the `contra * `must/Mustfile` - required invariants and validations. * `trust/Trustfile.hs` - cryptographic verification steps. * `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. +* `intend/Intentfile` - future intent and roadmap direction. diff --git a/formbd/contractiles/lust/Intentfile b/formbd/contractiles/intend/Intentfile similarity index 100% rename from formbd/contractiles/lust/Intentfile rename to formbd/contractiles/intend/Intentfile diff --git a/librarian/contractiles/README.adoc b/librarian/contractiles/README.adoc index 70ad712..4eb4829 100644 --- a/librarian/contractiles/README.adoc +++ b/librarian/contractiles/README.adoc @@ -18,4 +18,4 @@ This directory contains the generalized contractiles templates. Copy the `contra * `must/Mustfile` - required invariants and validations. * `trust/Trustfile.hs` - cryptographic verification steps. * `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. +* `intend/Intentfile` - future intent and roadmap direction. diff --git a/librarian/contractiles/lust/Intentfile b/librarian/contractiles/intend/Intentfile similarity index 100% rename from librarian/contractiles/lust/Intentfile rename to librarian/contractiles/intend/Intentfile diff --git a/nesy/contractiles/README.adoc b/nesy/contractiles/README.adoc index 70ad712..4eb4829 100644 --- a/nesy/contractiles/README.adoc +++ b/nesy/contractiles/README.adoc @@ -18,4 +18,4 @@ This directory contains the generalized contractiles templates. Copy the `contra * `must/Mustfile` - required invariants and validations. * `trust/Trustfile.hs` - cryptographic verification steps. * `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. +* `intend/Intentfile` - future intent and roadmap direction. diff --git a/nesy/contractiles/lust/Intentfile b/nesy/contractiles/intend/Intentfile similarity index 100% rename from nesy/contractiles/lust/Intentfile rename to nesy/contractiles/intend/Intentfile diff --git a/rescript-templater/contractiles/README.adoc b/rescript-templater/contractiles/README.adoc index 70ad712..4eb4829 100644 --- a/rescript-templater/contractiles/README.adoc +++ b/rescript-templater/contractiles/README.adoc @@ -18,4 +18,4 @@ This directory contains the generalized contractiles templates. Copy the `contra * `must/Mustfile` - required invariants and validations. * `trust/Trustfile.hs` - cryptographic verification steps. * `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. +* `intend/Intentfile` - future intent and roadmap direction. diff --git a/rescript-templater/contractiles/lust/Intentfile b/rescript-templater/contractiles/intend/Intentfile similarity index 100% rename from rescript-templater/contractiles/lust/Intentfile rename to rescript-templater/contractiles/intend/Intentfile diff --git a/safe-storage/contractiles/README.adoc b/safe-storage/contractiles/README.adoc index 70ad712..4eb4829 100644 --- a/safe-storage/contractiles/README.adoc +++ b/safe-storage/contractiles/README.adoc @@ -18,4 +18,4 @@ This directory contains the generalized contractiles templates. Copy the `contra * `must/Mustfile` - required invariants and validations. * `trust/Trustfile.hs` - cryptographic verification steps. * `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. +* `intend/Intentfile` - future intent and roadmap direction. diff --git a/safe-storage/contractiles/lust/Intentfile b/safe-storage/contractiles/intend/Intentfile similarity index 100% rename from safe-storage/contractiles/lust/Intentfile rename to safe-storage/contractiles/intend/Intentfile diff --git a/voyant-export/contractiles/README.adoc b/voyant-export/contractiles/README.adoc index 70ad712..4eb4829 100644 --- a/voyant-export/contractiles/README.adoc +++ b/voyant-export/contractiles/README.adoc @@ -18,4 +18,4 @@ This directory contains the generalized contractiles templates. Copy the `contra * `must/Mustfile` - required invariants and validations. * `trust/Trustfile.hs` - cryptographic verification steps. * `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. +* `intend/Intentfile` - future intent and roadmap direction. diff --git a/voyant-export/contractiles/lust/Intentfile b/voyant-export/contractiles/intend/Intentfile similarity index 100% rename from voyant-export/contractiles/lust/Intentfile rename to voyant-export/contractiles/intend/Intentfile diff --git a/zoterho-template/contractiles/README.adoc b/zoterho-template/contractiles/README.adoc index 70ad712..4eb4829 100644 --- a/zoterho-template/contractiles/README.adoc +++ b/zoterho-template/contractiles/README.adoc @@ -18,4 +18,4 @@ This directory contains the generalized contractiles templates. Copy the `contra * `must/Mustfile` - required invariants and validations. * `trust/Trustfile.hs` - cryptographic verification steps. * `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. +* `intend/Intentfile` - future intent and roadmap direction. diff --git a/zoterho-template/contractiles/lust/Intentfile b/zoterho-template/contractiles/intend/Intentfile similarity index 100% rename from zoterho-template/contractiles/lust/Intentfile rename to zoterho-template/contractiles/intend/Intentfile diff --git a/zoterho/contractiles/README.adoc b/zoterho/contractiles/README.adoc index 70ad712..4eb4829 100644 --- a/zoterho/contractiles/README.adoc +++ b/zoterho/contractiles/README.adoc @@ -18,4 +18,4 @@ This directory contains the generalized contractiles templates. Copy the `contra * `must/Mustfile` - required invariants and validations. * `trust/Trustfile.hs` - cryptographic verification steps. * `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. +* `intend/Intentfile` - future intent and roadmap direction. diff --git a/zoterho/contractiles/lust/Intentfile b/zoterho/contractiles/intend/Intentfile similarity index 100% rename from zoterho/contractiles/lust/Intentfile rename to zoterho/contractiles/intend/Intentfile diff --git a/zotpress/contractiles/README.adoc b/zotpress/contractiles/README.adoc index 70ad712..4eb4829 100644 --- a/zotpress/contractiles/README.adoc +++ b/zotpress/contractiles/README.adoc @@ -18,4 +18,4 @@ This directory contains the generalized contractiles templates. Copy the `contra * `must/Mustfile` - required invariants and validations. * `trust/Trustfile.hs` - cryptographic verification steps. * `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. +* `intend/Intentfile` - future intent and roadmap direction. diff --git a/zotpress/contractiles/lust/Intentfile b/zotpress/contractiles/intend/Intentfile similarity index 100% rename from zotpress/contractiles/lust/Intentfile rename to zotpress/contractiles/intend/Intentfile From 985fdf68fb80a47c906a103fc1f210887a5699fa Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 4 Jun 2026 18:56:53 +0100 Subject: [PATCH 08/15] chore: rename agent_instructions to bot_directives for spec alignment --- .../{agent_instructions => bot_directives}/README.adoc | 2 +- .../{agent_instructions => bot_directives}/coverage.a2ml | 0 .../{agent_instructions => bot_directives}/debt.a2ml | 0 .../{agent_instructions => bot_directives}/methodology.a2ml | 0 4 files changed, 1 insertion(+), 1 deletion(-) rename .machine_readable/{agent_instructions => bot_directives}/README.adoc (94%) rename .machine_readable/{agent_instructions => bot_directives}/coverage.a2ml (100%) rename .machine_readable/{agent_instructions => bot_directives}/debt.a2ml (100%) rename .machine_readable/{agent_instructions => bot_directives}/methodology.a2ml (100%) diff --git a/.machine_readable/agent_instructions/README.adoc b/.machine_readable/bot_directives/README.adoc similarity index 94% rename from .machine_readable/agent_instructions/README.adoc rename to .machine_readable/bot_directives/README.adoc index e5fec01..a5315c7 100644 --- a/.machine_readable/agent_instructions/README.adoc +++ b/.machine_readable/bot_directives/README.adoc @@ -32,7 +32,7 @@ Methodology-aware configuration for AI agents. Read by any AI agent == Relationship to Other Files * `AGENTIC.a2ml` says WHAT agents can do (permissions, gating) -* `agent_instructions/` says HOW agents should work (methodology) +* `bot_directives/` says HOW agents should work (methodology) * `bot_directives/` says what the gitbot-fleet does (fleet-specific) * `CLAUDE.md` says how Claude specifically should work (Claude-specific) diff --git a/.machine_readable/agent_instructions/coverage.a2ml b/.machine_readable/bot_directives/coverage.a2ml similarity index 100% rename from .machine_readable/agent_instructions/coverage.a2ml rename to .machine_readable/bot_directives/coverage.a2ml diff --git a/.machine_readable/agent_instructions/debt.a2ml b/.machine_readable/bot_directives/debt.a2ml similarity index 100% rename from .machine_readable/agent_instructions/debt.a2ml rename to .machine_readable/bot_directives/debt.a2ml diff --git a/.machine_readable/agent_instructions/methodology.a2ml b/.machine_readable/bot_directives/methodology.a2ml similarity index 100% rename from .machine_readable/agent_instructions/methodology.a2ml rename to .machine_readable/bot_directives/methodology.a2ml From ea5af7e55f01f4a3814003e4fd3fba569acd21e6 Mon Sep 17 00:00:00 2001 From: Mistral Vibe Date: Sun, 7 Jun 2026 09:03:22 +0100 Subject: [PATCH 09/15] docs: Add CODEOWNERS, MAINTAINERS, and GOVERNANCE documents --- .github/CODEOWNERS | 34 ++++++++++ GOVERNANCE.adoc | 162 +++++++++++++++++++++++++++++++++++++++++++++ MAINTAINERS.adoc | 65 ++++++++++++++++++ 3 files changed, 261 insertions(+) create mode 100644 .github/CODEOWNERS create mode 100644 GOVERNANCE.adoc create mode 100644 MAINTAINERS.adoc diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..3a3b7f2 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,34 @@ +# SPDX-License-Identifier: MPL-2.0 +# CODEOWNERS - Define code review assignments for GitHub +# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners + +# Default: sole maintainer for all files +* @hyperpolymath + +# Security-sensitive files require explicit ownership +SECURITY.md @hyperpolymath +.github/workflows/ @hyperpolymath +.machine_readable/ @hyperpolymath +contractiles/ @hyperpolymath + +# License files +LICENSE @hyperpolymath +LICENSES/ @hyperpolymath + +# Configuration +.gitignore @hyperpolymath +.github/ @hyperpolymath + +# Documentation +README* @hyperpolymath +CONTRIBUTING* @hyperpolymath +CODE_OF_CONDUCT* @hyperpolymath +GOVERNANCE* @hyperpolymath +MAINTAINERS* @hyperpolymath +CHANGELOG* @hyperpolymath +ROADMAP* @hyperpolymath + +# Build and CI +Justfile @hyperpolymath +Makefile @hyperpolymath +*.sh @hyperpolymath diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc new file mode 100644 index 0000000..8bbf167 --- /dev/null +++ b/GOVERNANCE.adoc @@ -0,0 +1,162 @@ +// SPDX-License-Identifier: MPL-2.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Governance Model +:toc: preamble + +This document describes the governance model for this repository. + +== Overview + +This repository follows a **Sole Maintainer Governance Model**: + +* Single maintainer (@hyperpolymath) has full authority over the project +* All contributions are welcome and reviewed by the maintainer +* Decisions are made transparently through GitHub issues and discussions +* The project adheres to the hyperpolymath estate policies where applicable + +== Core Principles + +[cols="1,2"] +|=== +| Principle | Description + +| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input + +| **Meritocracy** | Contributions are judged on technical merit, not contributor identity + +| **Transparency** | All significant decisions are documented publicly + +| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary + +| **Open Contribution** | Anyone can contribute via fork and pull request + +|=== + +== Roles and Permissions + +[cols="1,2,2"] +|=== +| Role | Permissions | Assignment + +| **Maintainer** | Write access, merge rights, admin | @hyperpolymath +| **Contributors** | Read access, fork, submit PRs | All GitHub users +| **Users** | Use the software, report issues | All GitHub users + +|=== + +== Decision Making Framework + +=== Routine Decisions + +* Bug fixes +* Documentation improvements +* Minor feature additions +* Dependency updates + +**Process**: Maintainer reviews and merges PRs that meet quality standards. + +=== Significant Changes + +* New major features +* API changes +* Architecture modifications +* Breaking changes + +**Process**: +. Open issue describing the change +. Discuss with community (minimum 72 hours) +. Maintainer makes final decision +. Document rationale in issue/PR + +=== Structural Decisions + +* Repository purpose/renaming +* License changes +* Ownership transfer +* Deprecation/archival + +**Process**: +. Extended discussion (minimum 1 week) +. Maintainer makes final decision +. Document in CHANGELOG and governance docs + +== Contribution Lifecycle + +[cols="1,2"] +|=== +| Stage | Process + +| **Ideation** | Open issue, discuss feasibility + +| **Development** | Fork, implement, test thoroughly + +| **Review** | Submit PR, maintainer reviews within 7 days + +| **Merge** | Maintainer merges or requests changes + +| **Release** | Maintainer publishes according to project conventions + +|=== + +== Conflict Resolution + +In case of disagreements: + +. Discuss in the relevant GitHub issue or PR +. Provide technical justification for positions +. Maintainer mediates and makes final decision +. Decision is documented and can be revisited later + +== Project Policies + +This repository adheres to hyperpolymath estate-wide policies: + +* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc) +* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md +* **Security**: Follows hyperpolymath SECURITY.md +* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions + +== Repository-Specific Conventions + +[cols="1,2"] +|=== +| Convention | Description + +| **Signing** | All commits must be signed (SSH or GPG) + +| **SPDX Headers** | All source files must have SPDX license identifiers + +| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root + +| **Machine Readable** | META.a2ml in .machine_readable/6a2/ + +| **CI/CD** | GitHub Actions workflows in .github/workflows/ + +|=== + +== Governance Evolution + +As the project grows, this governance model may evolve: + +* **Adding Co-Maintainers**: When contribution volume warrants it +* **Forming a Team**: For complex multi-maintainer projects +* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories) + +Changes to this document require the same process as Significant Changes above. + +== See Also + +* link:MAINTAINERS.adoc[Maintainers] +* link:CODE_OF_CONDUCT.md[Code of Conduct] +* link:CONTRIBUTING.adoc[Contributing Guide] +* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy] +* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)] + +== Changelog + +[cols="1,1,1"] +|=== +| Date | Change | By + +| 2026-06-07 | Initial governance model established | @hyperpolymath +|=== diff --git a/MAINTAINERS.adoc b/MAINTAINERS.adoc new file mode 100644 index 0000000..9910dd8 --- /dev/null +++ b/MAINTAINERS.adoc @@ -0,0 +1,65 @@ +// SPDX-License-Identifier: MPL-2.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Maintainers +:toc: preamble + +== Current Maintainers + +[cols="2,3,2",options="header"] +|=== +| Name | Role | Contact + +| Jonathan D.A. Jewell | Sole Maintainer | https://github.com/hyperpolymath[@hyperpolymath] +|=== + +== Maintainer Responsibilities + +As the sole maintainer, all responsibilities apply to @hyperpolymath: + +* Reviewing and merging pull requests +* Triaging issues and feature requests +* Ensuring code quality and security standards +* Managing releases and versioning +* Upholding the project's Code of Conduct +* Maintaining documentation and examples +* Responding to security vulnerabilities + +== Contribution Process + +This is a sole-maintainer project. All contributions are welcome via: + +1. **Issues**: Report bugs, request features, ask questions +2. **Pull Requests**: Submit improvements for review +3. **Discussions**: Engage in community discussions + +All contributions will be reviewed by the maintainer. + +== Decision Making + +* Routine decisions (bug fixes, minor improvements): Made by maintainer +* Significant changes: Discussed in issues before implementation +* Breaking changes: Announced in advance with migration path + +== Becoming a Maintainer + +This project currently has a single maintainer. If you're interested in becoming a co-maintainer: + +1. Demonstrate consistent, high-quality contributions +2. Show understanding of project goals and standards +3. Participate constructively in discussions +4. Express interest to the current maintainer + +Co-maintainers may be added at the discretion of the current maintainer. + +== Contact + +For questions about project governance: + +* Open a GitHub issue in this repository +* Contact: https://github.com/hyperpolymath + +== See Also + +* link:GOVERNANCE.adoc[Governance Model] +* link:CODE_OF_CONDUCT.md[Code of Conduct] +* link:CONTRIBUTING.adoc[Contributing Guide] From 1fabb7074be9cda9569a2934e0802e82b5658e06 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 7 Jun 2026 23:39:33 +0100 Subject: [PATCH 10/15] Apply estate standardization: governance docs, contractiles, CI/CD cleanup --- .machine_readable/ADJUST.contractile | 126 ------------------ .machine_readable/INTENT.contractile | 72 ---------- .machine_readable/MUST.contractile | 91 ------------- .machine_readable/TRUST.contractile | 80 ----------- .../contractiles/Adjustfile.a2ml | 72 ++++++++++ .../contractiles/Intentfile.a2ml | 99 ++++++++++++++ .machine_readable/contractiles/Justfile | 72 ++++++++++ .machine_readable/contractiles/Mustfile.a2ml | 102 ++++++++++++++ .machine_readable/contractiles/Trustfile.a2ml | 88 ++++++++++++ .../contractiles/dust/Dustfile.a2ml | 22 --- .../contractiles/trust/Trustfile.a2ml | 50 ------- contractiles/intend/Intentfile.a2ml | 22 --- contractiles/must/Mustfile.a2ml | 42 ------ contractiles/trust/Trustfile.a2ml | 25 ---- flake.nix | 116 ---------------- fogbinder/manifest.scm | 24 ++++ nesy/manifest.scm | 24 ++++ rescript-templater/manifest.scm | 24 ++++ safe-storage/manifest.scm | 24 ++++ voyant-export/manifest.scm | 24 ++++ zoterho-template/manifest.scm | 24 ++++ zoterho/manifest.scm | 24 ++++ zotpress/manifest.scm | 24 ++++ 23 files changed, 625 insertions(+), 646 deletions(-) delete mode 100644 .machine_readable/ADJUST.contractile delete mode 100644 .machine_readable/INTENT.contractile delete mode 100644 .machine_readable/MUST.contractile delete mode 100644 .machine_readable/TRUST.contractile create mode 100644 .machine_readable/contractiles/Adjustfile.a2ml create mode 100644 .machine_readable/contractiles/Intentfile.a2ml create mode 100644 .machine_readable/contractiles/Justfile create mode 100644 .machine_readable/contractiles/Mustfile.a2ml create mode 100644 .machine_readable/contractiles/Trustfile.a2ml delete mode 100644 .machine_readable/contractiles/dust/Dustfile.a2ml delete mode 100644 .machine_readable/contractiles/trust/Trustfile.a2ml delete mode 100644 contractiles/intend/Intentfile.a2ml delete mode 100644 contractiles/must/Mustfile.a2ml delete mode 100644 contractiles/trust/Trustfile.a2ml delete mode 100644 flake.nix create mode 100644 fogbinder/manifest.scm create mode 100644 nesy/manifest.scm create mode 100644 rescript-templater/manifest.scm create mode 100644 safe-storage/manifest.scm create mode 100644 voyant-export/manifest.scm create mode 100644 zoterho-template/manifest.scm create mode 100644 zoterho/manifest.scm create mode 100644 zotpress/manifest.scm diff --git a/.machine_readable/ADJUST.contractile b/.machine_readable/ADJUST.contractile deleted file mode 100644 index 490dd91..0000000 --- a/.machine_readable/ADJUST.contractile +++ /dev/null @@ -1,126 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; ADJUST.contractile — Accessibility invariants for zotero-tools -; "ADJUST" = Accessibility & Digital Justice for Universal Software & Technology -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST -; This file is machine-readable. LLM/SLM agents MUST NOT violate these invariants. - -; ── Definitions ────────────────────────────────────────────────── -; -; ADJUST (noun/verb) -; The accessibility contractile. Defines how software must adapt to serve -; all users regardless of ability, device, or context. Named for the verb -; "adjust" — to make suitable, to adapt, to accommodate — which is the -; core action of accessible design. -; -; Scope: -; ADJUST governs all user-facing interfaces: GUI, TUI, CLI, web, mobile, -; documentation, error messages, and installation flows. It applies to -; both human users and assistive technologies (screen readers, switch -; devices, braille displays, voice control). -; -; Relationship to other contractiles: -; - MUST: ADJUST invariants are a subset of MUST — violating ADJUST -; is a MUST violation. ADJUST exists separately because accessibility -; rules are numerous enough to warrant their own file, and because -; LLMs frequently forget accessibility unless explicitly reminded. -; - TRUST: ADJUST does not affect trust levels. All trust tiers must -; respect ADJUST invariants equally. -; - DUST: Deprecating a feature does not exempt it from ADJUST until -; it is fully removed. Deprecated UI must remain accessible. -; - INTENT: ADJUST supports the anti-purpose "this software is NOT -; only for able-bodied users with modern hardware." -; -; Standard: WCAG 2.2 Level AA (minimum) -; https://www.w3.org/WAI/WCAG22/quickref/?levels=aaa -; -; Why a separate file: -; Experience shows LLMs and developers alike treat accessibility as an -; afterthought. By placing invariants in a contractile that is loaded -; at session start, we make it structurally impossible to forget. -; -; ── End Definitions ────────────────────────────────────────────── - -(adjust-contractile - (version "1.0.0") - (full-name "Accessibility & Digital Justice for Universal Software & Technology") - (standard "WCAG-2.2-AA") - (repo "zotero-tools") - - (invariants - ; ── Visual ── - (adjust "colour-contrast-ratio >= 4.5:1 for normal text") - (adjust "colour-contrast-ratio >= 3:1 for large text (18pt+ or 14pt+ bold)") - (adjust "no information conveyed by colour alone") - (adjust "no flashing or strobing content (3 flashes/second max)") - (adjust "text resizable to 200% without loss of content or function") - (adjust "focus indicators visible on all interactive elements") - - ; ── Keyboard ── - (adjust "all interactive elements reachable via keyboard (Tab/Shift+Tab)") - (adjust "no keyboard traps — user can always Tab away") - (adjust "skip navigation link present on pages with repeated blocks") - (adjust "logical focus order follows visual reading order") - - ; ── Screen reader ── - (adjust "all images have meaningful alt text (or alt='' if decorative)") - (adjust "all form inputs have associated labels") - (adjust "ARIA landmarks used for page regions (main, nav, banner, etc.)") - (adjust "dynamic content updates announced via aria-live regions") - (adjust "semantic HTML used (headings, lists, tables) — not div soup") - - ; ── Interactive ── - (adjust "touch targets minimum 44x44px on mobile/touch interfaces") - (adjust "error messages identify the field and describe the error") - (adjust "error messages not conveyed by colour or position alone") - (adjust "form validation provides suggestions for correction") - - ; ── Media ── - (adjust "video has captions (closed or open)") - (adjust "audio-only content has text transcript") - (adjust "no autoplay of media with sound") - - ; ── Motion ── - (adjust "animations respect prefers-reduced-motion media query") - (adjust "no content depends on motion to convey meaning") - - ; ── CLI/TUI ── - (adjust "CLI output must not rely solely on colour (use symbols: [OK] [FAIL])") - (adjust "TUI must support high-contrast mode") - (adjust "all CLI commands support --help with plain-text output") - (adjust "error messages written in plain language, not jargon or codes alone") - - ; ── Documentation ── - (adjust "docs use clear language, short sentences, logical structure") - (adjust "code examples include comments explaining non-obvious steps") - (adjust "diagrams have text descriptions or alt text") - - ; ── Internationalisation (i18n) ── - (adjust "all user-facing strings externalisable for translation") - (adjust "no hardcoded English in error messages — use message keys") - (adjust "date/time/number formats locale-aware") - (adjust "RTL (right-to-left) layout support where applicable") - (adjust "Unicode handled correctly throughout (UTF-8 everywhere)") - ) - - (related-resources - ; LOL — super-parallel corpus crawler for 1500+ languages - ; Use for linguistic data, translation coverage, and i18n validation - (lol "standards/lol — multilingual NLP corpus, see README.adoc") - (polyglot-i18n "polyglot-i18n — i18n framework and WASM translation engine") - ) - - (enforcement - (ci "accessibility linting in quality.yml workflow") - (pr-block "PR blocked if accessibility regression detected") - (tool "axe-core or pa11y for automated checks on web UI") - (tool "CLI output inspected for colour-only signalling") - (manual "manual screen reader test before major releases") - ) - - (notes - "These are MINIMUM requirements. Exceeding them (AAA) is encouraged." - "When in doubt about an accessibility decision, ask — don't guess." - "Accessibility is not optional polish — it is a structural requirement." - ) -) diff --git a/.machine_readable/INTENT.contractile b/.machine_readable/INTENT.contractile deleted file mode 100644 index 64a266d..0000000 --- a/.machine_readable/INTENT.contractile +++ /dev/null @@ -1,72 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; INTENT.contractile — Purpose and scope for zotero-tools -; Helps LLM/SLM agents understand what this repo IS and IS NOT. -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST - -; ── Definitions ────────────────────────────────────────────────── -; -; INTENT (noun) -; The purpose contractile. Defines what this repository IS, what it is -; NOT (anti-purpose), and which architectural decisions are load-bearing. -; Without INTENT, LLMs drift into scope creep, reverse key decisions, -; or add features that belong in a different repo. -; -; Scope: -; INTENT governs the conceptual boundaries of the project — its reason -; for existing, its domain, and its relationship to the ecosystem. -; It does NOT specify implementation details (that's MUST and code). -; -; Relationship to other contractiles: -; - MUST: INTENT explains WHY certain MUSTs exist. If you don't -; understand a MUST, read INTENT first. -; - TRUST: The "ask-before-touching" section in INTENT maps directly -; to TRUST.trust-deny for the most sensitive areas. -; - ADJUST: INTENT's anti-purpose should include "this software is -; NOT only for users with perfect vision/hearing/mobility." -; - DUST: When INTENT changes (repo pivots), related DUST entries -; should be created for the abandoned direction. -; -; ── End Definitions ────────────────────────────────────────────── - -(intent-contractile - (version "1.0.0") - (repo "zotero-tools") - - ; === Purpose (what this repo IS) === - (purpose - "{{ONE_PARAGRAPH_PURPOSE}}" - ) - - ; === Anti-Purpose (what this repo is NOT — prevents scope creep) === - (anti-purpose - "{{ONE_PARAGRAPH_ANTI_PURPOSE}}" - ; Examples: - ; "This is NOT a general-purpose database — it solves one specific problem." - ; "This is NOT a framework — it is a library with a focused API." - ; "This does NOT handle authentication — that is delegated to [other repo]." - ) - - ; === Key Architectural Decisions That Must Not Be Reversed === - (architectural-invariants - ; *REMINDER: List the foundational decisions* - ; ("Idris2 for ABI definitions — dependent types prove interface correctness") - ; ("Zig for FFI — zero-cost C ABI compatibility") - ; ("Elixir for supervision — OTP fault tolerance") - ) - - ; === Sensitive Areas (if in doubt, ask) === - (ask-before-touching - ; *REMINDER: List areas where LLMs should check before modifying* - ; "src/abi/ — formal proofs, changes require re-verification" - ; "ffi/zig/ — C ABI boundary, changes affect all language bindings" - ; ".machine_readable/ — checkpoint files, format is specified" - ) - - ; === Ecosystem Position === - (ecosystem - (belongs-to "{{MONOREPO_OR_STANDALONE}}") - (depends-on ("{{DEP1}}" "{{DEP2}}")) - (depended-on-by ("{{CONSUMER1}}" "{{CONSUMER2}}")) - ) -) diff --git a/.machine_readable/MUST.contractile b/.machine_readable/MUST.contractile deleted file mode 100644 index 33c0010..0000000 --- a/.machine_readable/MUST.contractile +++ /dev/null @@ -1,91 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; MUST.contractile — Baseline invariants for zotero-tools -; These constraints MUST NOT be violated. K9 validators enforce them. -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST - -; ── Definitions ────────────────────────────────────────────────── -; -; MUST (noun/verb) -; The hard-constraint contractile. Defines invariants that are structurally -; required for the repository to function correctly and safely. Violating -; a MUST is always a bug — there are no "soft" MUSTs. -; -; Scope: -; MUST governs code, configuration, CI, and structure. It does NOT govern -; style, preference, or approach — those belong in CLAUDE.md or coding -; standards. MUST is for things that break the project if violated. -; -; Relationship to other contractiles: -; - TRUST: MUST is enforced regardless of trust level. Even maximal-trust -; agents cannot violate MUST constraints. -; - ADJUST: All ADJUST invariants are implicitly MUST invariants too. -; ADJUST exists separately for visibility. -; - INTENT: MUST protects the architectural decisions described in INTENT. -; - DUST: When a feature enters DUST (deprecation), its MUST constraints -; remain active until the feature is fully removed. -; -; Enforcement: -; K9 validators in contractiles/k9/ machine-check MUST constraints. -; CI runs these on every PR. Violations block merge. -; -; ── End Definitions ────────────────────────────────────────────── - -(must-contractile - (version "1.0.0") - (repo "zotero-tools") - - ; === Universal Invariants (apply to ALL repos) === - - (invariants - ; Paths - (must "no hardcoded absolute paths (/home/*, /mnt/*, /var/mnt/*)") - (must "all paths use env vars, XDG dirs, or relative references") - - ; Language policy - (must "no new TypeScript files") - (must "no new Python files") - (must "no new Go files") - (must "no npm/bun/yarn/pnpm dependencies — Deno only") - - ; Dangerous patterns - (must "no believe_me (Idris2)") - (must "no assert_total (Idris2)") - (must "no Admitted (Coq)") - (must "no sorry (Lean)") - (must "no unsafeCoerce (Haskell)") - (must "no Obj.magic (OCaml)") - (must "no unsafe {} blocks without safety comment (Rust)") - - ; License - (must "SPDX-License-Identifier header on every source file") - (must "no removal or modification of LICENSE file") - - ; Structure - (must ".machine_readable/ directory preserved") - (must "0-AI-MANIFEST.a2ml preserved") - (must "no SCM files in repo root — only in .machine_readable/") - - ; CI - (must "no removal of CI workflows without explicit approval") - (must "all GitHub Actions SHA-pinned") - - ; Code quality - (must "tests must not be deleted or weakened") - (must "generated code in generated/ directory only") - (must "no introduction of OWASP top 10 vulnerabilities") - - ; ABI/FFI (if applicable) - (must "no modification of ABI contracts without proof update") - (must "no removal of formal verification proofs") - ) - - ; === Project-Specific Invariants === - ; *REMINDER: Add invariants specific to this repo* - ; (must "# Add project-specific invariants here") - - (enforcement - (k9-validator "contractiles/k9/must-check.k9.ncl") - (ci "quality.yml runs must-check on every PR") - ) -) diff --git a/.machine_readable/TRUST.contractile b/.machine_readable/TRUST.contractile deleted file mode 100644 index 4edfe13..0000000 --- a/.machine_readable/TRUST.contractile +++ /dev/null @@ -1,80 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; TRUST.contractile — Trust boundaries for zotero-tools -; Defines what LLM/SLM agents are trusted to do without asking. -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST - -; ── Definitions ────────────────────────────────────────────────── -; -; TRUST (noun/verb) -; The permission contractile. Defines the boundary between what an AI -; agent may do autonomously and what requires human approval. Trust is -; graduated — not binary — with four levels from minimal to maximal. -; -; Trust levels: -; - maximal: Agent may read, build, test, lint, format, heal freely. -; Only destructive/external actions require approval. -; - standard: Agent may read and build. Test/lint need approval. -; - restricted: Agent may read only. All modifications need approval. -; - minimal: Agent may read specific files only. Everything else blocked. -; -; Scope: -; TRUST governs AI agent behaviour only. It does not affect human -; contributors — humans follow CONTRIBUTING.md and GOVERNANCE.adoc. -; -; Relationship to other contractiles: -; - MUST: Trust never overrides MUST. Even at maximal trust, MUST -; violations are blocked. -; - ADJUST: Trust does not exempt from ADJUST. All trust tiers must -; produce accessible output. -; - INTENT: TRUST.trust-deny protects the sensitive areas listed in -; INTENT.ask-before-touching. -; - DUST: Deprecated features have the same trust rules as active ones. -; -; ── End Definitions ────────────────────────────────────────────── - -(trust-contractile - (version "1.0.0") - (repo "zotero-tools") - - (trust-level "maximal") ; maximal | standard | restricted | minimal - - ; === Maximal Trust (default) === - ; LLM may freely do these without asking: - (trust-actions - "read" ; Read any file in the repo - "build" ; Run build commands - "test" ; Run test suites - "lint" ; Run linters and formatters - "format" ; Auto-format code - "doctor" ; Run self-diagnostics - "heal" ; Attempt automatic repair - "git-status" ; Check git status - "git-diff" ; View diffs - "git-log" ; View history - ) - - ; === Denied Actions (always require human approval) === - (trust-deny - "delete-branch" ; Could lose work - "force-push" ; Overwrites history - "modify-ci-secrets" ; Security sensitive - "publish" ; External visibility - "push-to-main" ; Protected branch - "delete-files-bulk" ; More than 5 files at once - "modify-license" ; Legal implications - "modify-security-policy" ; Security implications - "remove-proofs" ; Formal verification regression - "disable-ci-checks" ; Safety regression - ) - - ; === Trust Boundary === - (trust-boundary "repo") ; LLM confined to this repo unless explicitly told otherwise - - ; === Override === - ; Repos requiring tighter trust override these settings with justification: - ; (override - ; (trust-level "restricted") - ; (reason "Contains production secrets / handles PII / etc.") - ; ) -) diff --git a/.machine_readable/contractiles/Adjustfile.a2ml b/.machine_readable/contractiles/Adjustfile.a2ml new file mode 100644 index 0000000..6f01e89 --- /dev/null +++ b/.machine_readable/contractiles/Adjustfile.a2ml @@ -0,0 +1,72 @@ +# SPDX-License-Identifier: MPL-2.0 +# Adjustfile — Drift-tolerance contract for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Cumulative-drift catchment: tolerance bands + corrective actions. +# Authority: advisory (Yard) — continue-with-warnings; auto_fix where deterministic. +# Run with: adjust check +# Fix with: adjust fix (applies deterministic patches; advisory otherwise) + +@abstract: +Drift tolerances and corrective actions for rsr-template-repo. Unlike +MUST (hard gate), ADJUST tracks cumulative drift against tolerance bands +and proposes corrective actions. Advisory — it warns and trends, it does +not block. +@end + +## Template Drift + +### placeholder-drift +- description: Template placeholders should be replaced when copied +- tolerance: 0 placeholder markers in copied repos +- corrective: Search and replace all {{PLACEHOLDER}} markers +- severity: advisory +- notes: This check only applies to repos that copied from this template + +### template-version-drift +- description: Template version should match RSR spec version +- tolerance: Template version matches current RSR spec +- corrective: Update template to match latest RSR spec +- severity: advisory + +## Documentation Drift + +### readme-completeness +- description: README should document all template features +- tolerance: README covers all contractiles and directory structure +- corrective: Update README.adoc with missing sections +- severity: advisory + +### example-accuracy +- description: Examples in documentation should match actual template content +- tolerance: All code examples in docs are accurate +- corrective: Audit and fix examples in documentation +- severity: advisory + +## Structural Drift + +### contractile-sync +- description: All contractiles should have matching a2ml and ncl implementations +- tolerance: Every .a2ml has a corresponding .ncl +- corrective: Generate missing .ncl files from .a2ml +- severity: advisory + +### no-broken-symlinks +- description: No broken symbolic links in template structure +- tolerance: 0 broken symlinks +- corrective: Run symlink-check script +- severity: advisory + +## Accessibility Drift + +### adoc-not-md +- description: Template docs should prefer AsciiDoc +- tolerance: New prose docs are *.adoc +- corrective: Convert any new *.md to *.adoc +- severity: advisory + +### spdx-header-consistency +- description: All template files have correct SPDX headers +- tolerance: 0 files missing SPDX-License-Identifier +- corrective: Add SPDX headers to files that need them +- severity: advisory diff --git a/.machine_readable/contractiles/Intentfile.a2ml b/.machine_readable/contractiles/Intentfile.a2ml new file mode 100644 index 0000000..ef74f45 --- /dev/null +++ b/.machine_readable/contractiles/Intentfile.a2ml @@ -0,0 +1,99 @@ +# SPDX-License-Identifier: MPL-2.0 +# Intentfile (A2ML Canonical) — north-star contractile for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Paired runner: intend.ncl +# Verb: intend +# +# Semantics: North-star contractile. Declares BOTH concrete committed +# next-actions AND horizon aspirations the project wishes to +# become. Two sections share one file because they answer +# the same question at different ranges: +# [[intents]] — "we WILL do this; track progress" +# status: declared → in_progress → done | +# deferred | retired +# [[wishes]] — "we WISH this were true; revisit later" +# status: declared → in_progress → achieved | +# abandoned +# grouped by horizon: near / mid / far. +# Non-gating — this is a report, not a gate. See the `must` +# contractile for hard gates. + +@abstract: +North-star contractile for rsr-template-repo. This repository is the +canonical template for Rhodium Standard Repository compliance. It provides +the scaffold that all hyperpolymath repos should copy and customize. +@end + +## Purpose + +The rsr-template-repo serves as the master template for all hyperpolymath +repositories. It contains the complete set of contractile files, machine-readable +specifications, and governance documentation that define the Rhodium Standard. + +Every new repository in the hyperpolymath estate should be initialized by +copying this template and substituting the placeholder values with +repo-specific content. + +## Anti-Purpose + +This repository is NOT: +- A general-purpose project scaffold for external use (hyperpolymath-only) +- A replacement for per-repo customization (all files must be bespoke) +- A static template that never changes (evolves with RSR spec) +- A runtime library or framework (build-time only) + +## If In Doubt + +If you are unsure whether a change is in scope, ask. Sensitive areas: +- .machine_readable/ contractile definitions +- RSR specification files +- Governance templates +- License policy documents + +## Committed Next-Actions + +### repo-initialization +- description: Provide just copy-and-substitute template for new repos +- probe: test -f scripts/init-repo.sh +- status: done +- notes: Run with source scripts/init-repo.sh + +### contractile-completeness +- description: Every RSR contractile has an a2ml and ncl implementation +- probe: ls .machine_readable/contractiles/*.a2ml | wc -l | grep -q "^6$" +- status: in_progress +- notes: Currently 6 contractile verbs: intend, must, trust, adjust, bust, dust + +### automation-scripts +- description: All repetitive tasks have just recipes +- probe: grep -c "^# " Justfile | grep -q "^[6-9][0-9]*$" +- status: in_progress + +## Wishes + +### Near Horizon + +#### cross-repo-validation +- description: Tooling to validate all repos against RSR spec +- horizon: near +- status: declared + +#### automated-substitution +- description: Script to automate repo-specific substitution in template +- horizon: near +- status: declared + +### Mid Horizon + +#### formal-verification +- description: Idris2 proofs for all critical contractile invariants +- horizon: mid +- status: declared + +### Far Horizon + +#### ecosystem-visualization +- description: Interactive graph of all hyperpolymath repos and dependencies +- horizon: far +- status: declared diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile new file mode 100644 index 0000000..cb26f9c --- /dev/null +++ b/.machine_readable/contractiles/Justfile @@ -0,0 +1,72 @@ +# SPDX-License-Identifier: MPL-2.0 +# Justfile for zotero-tools + +# Default recipe — list available commands +import? "contractile.just" + +default: + @just --list + +# Self-diagnostic — checks dependencies, permissions, paths +doctor: + @echo "Running diagnostics for zotero-tools..." + @echo "Checking required tools..." + @command -v just >/dev/null 2>&1 && echo " [OK] just" || echo " [FAIL] just not found" + @command -v git >/dev/null 2>&1 && echo " [OK] git" || echo " [FAIL] git not found" + @echo "Checking for hardcoded paths..." + @grep -rn '/var/mnt/eclipse' --include='*.rs' --include='*.ex' --include='*.res' --include='*.gleam' --include='*.sh' --include='*.toml' . 2>/dev/null | grep -v 'Justfile' | head -5 || echo " [OK] No hardcoded paths in source" + @echo "Diagnostics complete." + +# Guided tour of key features +tour: + @echo "=== zotero-tools Tour ===" + @echo "" + @echo "1. Project structure:" + @ls -la + @echo "" + @echo "2. Available commands: just --list" + @echo "" + @echo "3. Read README.adoc or README.md for full overview" + @echo "4. Read EXPLAINME.adoc for architecture decisions" + @echo "5. Run 'just doctor' to check your setup" + @echo "" + @echo "Tour complete! Try 'just --list' to see all available commands." + +# Open feedback channel with diagnostic context +help-me: + @echo "=== zotero-tools Help ===" + @echo "Platform: $(uname -s) $(uname -m)" + @echo "Shell: $SHELL" + @echo "" + @echo "To report an issue:" + @echo " https://github.com/hyperpolymath/zotero-tools/issues/new" + @echo "" + @echo "Include the output of 'just doctor' in your report." + +# Run panic-attacker pre-commit scan +assail: + @command -v panic-attack >/dev/null 2>&1 && panic-attack assail . || echo "WARN: panic-attack not found — install from https://github.com/hyperpolymath/panic-attacker" + +# LLM context dump +llm-context: + @echo "Project: zotero-tools" + @echo "License: MPL-2.0" + @test -f README.adoc && head -30 README.adoc || test -f README.md && head -30 README.md || echo "No README found" + + +# Print the current CRG grade (reads from READINESS.md '**Current Grade:** X' line) +crg-grade: + @grade=$$(grep -oP '(?<=\*\*Current Grade:\*\* )[A-FX]' READINESS.md 2>/dev/null | head -1); \ + [ -z "$$grade" ] && grade="X"; \ + echo "$$grade" + +# Generate a shields.io badge markdown for the current CRG grade +# Looks for '**Current Grade:** X' in READINESS.md; falls back to X +crg-badge: + @grade=$$(grep -oP '(?<=\*\*Current Grade:\*\* )[A-FX]' READINESS.md 2>/dev/null | head -1); \ + [ -z "$$grade" ] && grade="X"; \ + case "$$grade" in \ + A) color="brightgreen" ;; B) color="green" ;; C) color="yellow" ;; \ + D) color="orange" ;; E) color="red" ;; F) color="critical" ;; \ + *) color="lightgrey" ;; esac; \ + echo "[![CRG $$grade](https://img.shields.io/badge/CRG-$$grade-$$color?style=flat-square)](https://github.com/hyperpolymath/standards/tree/main/component-readiness-grades)" diff --git a/.machine_readable/contractiles/Mustfile.a2ml b/.machine_readable/contractiles/Mustfile.a2ml new file mode 100644 index 0000000..55f8ab4 --- /dev/null +++ b/.machine_readable/contractiles/Mustfile.a2ml @@ -0,0 +1,102 @@ +# SPDX-License-Identifier: MPL-2.0 +# Mustfile — Physical state contract for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# What MUST be true about this repository. Hard requirements. +# Run with: must check +# Fix with: must fix (where a deterministic fix exists) + +@abstract: +Physical-state invariants for rsr-template-repo. This is the canonical +RSR template repository. These are hard requirements — CI and pre-commit +hooks fail if any check fails. +@end + +## File Presence + +### license-present +- description: LICENSE file must exist +- run: test -f LICENSE +- severity: critical + +### readme-present +- description: README.adoc must exist +- run: test -f README.adoc +- severity: critical + +### security-policy +- description: SECURITY.md must exist +- run: test -f SECURITY.md +- severity: critical + +### ai-manifest +- description: 0-AI-MANIFEST.a2ml must exist +- run: test -f 0-AI-MANIFEST.a2ml +- severity: critical + +### governance-docs +- description: GOVERNANCE.adoc, MAINTAINERS.adoc, CODEOWNERS must exist +- run: test -f GOVERNANCE.adoc && test -f MAINTAINERS.adoc && test -f .github/CODEOWNERS +- severity: critical + +### machine-readable-dir +- description: .machine_readable/ directory must exist +- run: test -d .machine_readable +- severity: critical + +## Directory Structure + +### contractiles-complete +- description: All required contractile directories exist +- run: test -d .machine_readable/contractiles && test -d .machine_readable/contractiles/bust && test -d .machine_readable/contractiles/dust +- severity: critical + +### contractiles-files-present +- description: All four primary contractile files exist +- run: test -f .machine_readable/contractiles/Intentfile.a2ml && test -f .machine_readable/contractiles/Mustfile.a2ml && test -f .machine_readable/contractiles/Trustfile.a2ml && test -f .machine_readable/contractiles/Adjustfile.a2ml +- severity: critical + +### bust-dust-files-present +- description: Bustfile and Dustfile exist in their directories +- run: test -f .machine_readable/contractiles/bust/Bustfile.a2ml && test -f .machine_readable/contractiles/dust/Dustfile.a2ml +- severity: critical + +### six-directory-present +- description: 6a2 directory exists with required files +- run: test -d .machine_readable/6a2 && test -f .machine_readable/6a2/META.a2ml && test -f .machine_readable/6a2/ECOSYSTEM.a2ml && test -f .machine_readable/6a2/STATE.a2ml && test -f .machine_readable/6a2/PLAYBOOK.a2ml && test -f .machine_readable/6a2/AGENTIC.a2ml && test -f .machine_readable/6a2/NEUROSYM.a2ml +- severity: critical + +### anchors-directory +- description: anchors directory exists in 6a2 +- run: test -d .machine_readable/6a2/anchors +- severity: warning + +### self-validating-structure +- description: self-validating directory has k9-svc and examples +- run: test -d .machine_readable/self-validating && test -d .machine_readable/self-validating/k9-svc && test -d .machine_readable/self-validating/examples +- severity: warning + +## Template Integrity + +### no-placeholder-values +- description: No placeholder values remain in template files +- run: test -z "$(grep -r '{{' .machine_readable/contractiles/ 2>/dev/null)" +- severity: critical +- notes: All placeholders must be substituted when copying this template + +### template-readonly +- description: Template marker files are not modified +- run: grep -q 'RSR_TEMPLATE_DO_NOT_EDIT' .machine_readable/0.1-AI-MANIFEST.a2ml +- severity: warning + +## Git State + +### no-untracked-contractiles +- description: All contractile files are tracked in git +- run: test -z "$(git ls-files -o --exclude-standard .machine_readable/contractiles/ 2>/dev/null)" +- severity: critical + +### signed-commits +- description: All commits must be signed +- run: git verify-commit HEAD +- severity: critical diff --git a/.machine_readable/contractiles/Trustfile.a2ml b/.machine_readable/contractiles/Trustfile.a2ml new file mode 100644 index 0000000..e2028b5 --- /dev/null +++ b/.machine_readable/contractiles/Trustfile.a2ml @@ -0,0 +1,88 @@ +# SPDX-License-Identifier: MPL-2.0 +# Trustfile — Trust boundaries and integrity invariants for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Defines what LLM/SLM agents are trusted to do without asking, and +# integrity invariants that verify the repo has not been tampered with. + +@abstract: +Trust boundaries and integrity checks for rsr-template-repo. This file +combines the trust-level definitions from the original TRUST.contractile +with the integrity invariants from the old Trustfile.a2ml. It defines +what AI agents may do autonomously and what requires human approval, +plus checks that verify repository integrity. +@end + +## Trust Levels + +The rsr-template-repo operates at trust level: maximal + +Trust levels: +- maximal: Agent may read, build, test, lint, format, heal freely. + Only destructive/external actions require approval. +- standard: Agent may read and build. Test/lint need approval. +- restricted: Agent may read only. All modifications need approval. +- minimal: Agent may read specific files only. Everything else blocked. + +Current trust level: maximal + +## Integrity Invariants + +### Secrets + +#### no-secrets-committed +- description: No credential files in repo +- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production +- severity: critical + +#### no-private-keys +- description: No private key files committed +- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." +- severity: critical + +#### no-tokens-in-source +- description: No hardcoded API tokens in source +- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." +- severity: critical + +## Provenance + +#### author-correct +- description: Git author matches expected identity +- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" +- severity: warning + +#### license-content +- description: LICENSE contains expected identifier +- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE +- severity: warning + +## Template-Specific Trust + +### template-files-readonly +- description: Template scaffold files should not be modified except by maintainer +- run: test -z "$(git status --short .machine_readable/ 2>/dev/null | grep -v '^??' || true)" +- severity: advisory +- notes: Changes to template files require careful review + +### trust-deny-areas +- description: Sensitive areas from INTENT.contractile require explicit approval +- run: echo "Check .machine_readable/ contractiles and governance docs" +- severity: advisory +- areas: + - .machine_readable/ + - GOVERNANCE.adoc + - MAINTAINERS.adoc + - .github/CODEOWNERS + +## Container Security + +#### container-images-pinned +- description: Containerfile uses pinned base images +- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile +- severity: warning + +#### no-dockerfile +- description: No Dockerfile (use Containerfile) +- run: test ! -f Dockerfile +- severity: warning diff --git a/.machine_readable/contractiles/dust/Dustfile.a2ml b/.machine_readable/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index 0d619ee..0000000 --- a/.machine_readable/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile — Cleanup and Hygiene Contract - -[dustfile] -version = "1.0.0" -format = "a2ml" - -[cleanup] -stale-branch-policy = "delete-after-merge" -artifact-retention = "90-days" -cache-policy = "clear-on-release" - -[hygiene] -linting = "required" -formatting = "required" -dead-code-removal = "encouraged" -todo-tracking = "tracked-in-issues" - -[reversibility] -backup-before-destructive = true -rollback-mechanism = "git-revert" -data-retention-policy = "preserve-30-days" diff --git a/.machine_readable/contractiles/trust/Trustfile.a2ml b/.machine_readable/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index f2a4f95..0000000 --- a/.machine_readable/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,50 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile — Integrity and provenance verification -# Author: Jonathan D.A. Jewell - -@abstract: -Integrity invariants for this repository. These verify that the repo -has not been tampered with, secrets are not leaked, and provenance -is traceable. -@end - -## Secrets - -### no-secrets-committed -- description: No credential files in repo -- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production -- severity: critical - -### no-private-keys -- description: No private key files committed -- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-tokens-in-source -- description: No hardcoded API tokens in source -- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -## Provenance - -### author-correct -- description: Git author matches expected identity -- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" -- severity: warning - -### license-content -- description: LICENSE contains expected identifier -- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE -- severity: warning - -## Container Security - -### container-images-pinned -- description: Containerfile uses pinned base images -- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile -- severity: warning - -### no-dockerfile -- description: No Dockerfile (use Containerfile) -- run: test ! -f Dockerfile -- severity: warning diff --git a/contractiles/intend/Intentfile.a2ml b/contractiles/intend/Intentfile.a2ml deleted file mode 100644 index 151c33e..0000000 --- a/contractiles/intend/Intentfile.a2ml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Intentfile (A2ML Canonical) -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -@abstract: -Declared intent and purpose for Zotero Tools. -@end - -## Purpose - -Zotero Tools — // SPDX-License-Identifier: MPL-2.0 - -## Anti-Purpose - -This project is NOT: -- A fork or wrapper around another tool -- A monorepo (unless explicitly structured as one) - -## If In Doubt - -If you are unsure whether a change is in scope, ask. -Sensitive areas: ABI definitions, license headers, CI workflows. diff --git a/contractiles/must/Mustfile.a2ml b/contractiles/must/Mustfile.a2ml deleted file mode 100644 index 28c6fbc..0000000 --- a/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,42 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile (A2ML Canonical) -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -@abstract: -Physical State contract for Zotero Tools. Baseline UX Manifesto invariants -that MUST hold at all times. -@end - -@requires: -- section: Core-Files -- section: Banned -@end - -## Core-Files - -### license-present -- description: LICENSE file must exist -- run: test -f LICENSE -- severity: critical - -### readme-present -- description: README must exist -- run: test -f README.adoc || test -f README.md -- severity: critical - -## Banned - -### no-hardcoded-paths -- description: No hardcoded developer paths -- run: "! grep -rn '/home/hyper\|/mnt/eclipse' --include='*.rs' --include='*.res' --include='*.ex' --include='*.gleam' --include='*.zig' --include='*.sh' . 2>/dev/null | grep -v '.git/' | grep -v 'ux-rollout.jl' | head -1" -- severity: critical - -### no-dockerfiles -- description: No Dockerfiles (use Containerfile) -- run: test ! -f Dockerfile -- severity: warning - -### no-makefiles -- description: No Makefiles (use Justfile) -- run: test ! -f Makefile -- severity: warning diff --git a/contractiles/trust/Trustfile.a2ml b/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index c201f04..0000000 --- a/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,25 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile (A2ML Canonical) -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -@abstract: -Trust and provenance verification for Zotero Tools. -Maximal trust by default — LLM may read, build, test, lint, format. -@end - -@trust-level: maximal -@trust-boundary: repo -@trust-actions: [read, build, test, lint, format] -@trust-deny: [delete-branch, force-push, modify-ci-secrets, publish] - -## Integrity - -### license-content -- description: LICENSE contains expected SPDX identifier -- run: grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE -- severity: critical - -### no-secrets-committed -- description: No .env or credential files in repo -- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local -- severity: critical diff --git a/flake.nix b/flake.nix deleted file mode 100644 index b1b5845..0000000 --- a/flake.nix +++ /dev/null @@ -1,116 +0,0 @@ -{ - description = "zotero-tools - {project-description}"; - - # *REMINDER: Update inputs with actual dependencies* - inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; - flake-utils.url = "github:numtide/flake-utils"; - # Add language-specific inputs: - # rust-overlay.url = "github:oxalica/rust-overlay"; # For Rust - # fenix.url = "github:nix-community/fenix"; # Alternative Rust - }; - - outputs = { self, nixpkgs, flake-utils, ... }@inputs: - flake-utils.lib.eachDefaultSystem (system: - let - pkgs = import nixpkgs { - inherit system; - # overlays = [ (import inputs.rust-overlay) ]; # For Rust - }; - - # *REMINDER: Define build dependencies* - buildInputs = with pkgs; [ - # Language-specific dependencies: - # gnat13 # Ada - # cargo rustc # Rust - # elixir # Elixir - # For build tools: - just - podman - git - ]; - - # *REMINDER: Define development dependencies* - nativeBuildInputs = with pkgs; [ - # Development tools: - ripgrep # Code search - lychee # Link validation - # Language-specific: - # rustfmt clippy # Rust - # mix # Elixir - ]; - - in - { - # Development shell - devShells.default = pkgs.mkShell { - inherit buildInputs nativeBuildInputs; - - shellHook = '' - echo "🚀 zotero-tools development environment" - echo "Language: mixed" - echo "" - echo "Available commands:" - echo " just --list # Show all tasks" - echo " just setup # Set up environment" - echo " just build # Build project" - echo " just test # Run tests" - echo " just validate # RSR compliance" - echo "" - # *REMINDER: Add language-specific environment setup* - # export CARGO_HOME=$PWD/.cargo # Rust - # export MIX_HOME=$PWD/.mix # Elixir - ''; - }; - - # Packages - packages.default = pkgs.stdenv.mkDerivation { - pname = "zotero-tools"; - version = "0.1.0"; - src = ./.; - - inherit buildInputs nativeBuildInputs; - - buildPhase = '' - # *REMINDER: Add build commands* - # For Rust: cargo build --release - # For Elixir: mix compile - # For Ada: gprbuild -P zotero-tools.gpr -XMODE=release - ''; - - installPhase = '' - mkdir -p $out/bin - # *REMINDER: Add install commands* - # cp target/release/zotero-tools $out/bin/ # Rust - # cp bin/zotero-tools $out/bin/ # Ada - ''; - - meta = with pkgs.lib; { - description = "{project-description}"; - homepage = "{repo-url}"; - license = with licenses; [ mit ]; # MIT + Palimpsest - maintainers = [ "{maintainer-name}" ]; - platforms = platforms.unix; - }; - }; - - # Apps - apps.default = { - type = "app"; - program = "${self.packages.${system}.default}/bin/zotero-tools"; - }; - - # Checks (CI/CD integration) - checks = { - build = self.packages.${system}.default; - # *REMINDER: Add test checks* - test = pkgs.runCommand "test-zotero-tools" { - buildInputs = [ self.packages.${system}.default ]; - } '' - # Run tests here - touch $out - ''; - }; - } - ); -} diff --git a/fogbinder/manifest.scm b/fogbinder/manifest.scm new file mode 100644 index 0000000..dd942c7 --- /dev/null +++ b/fogbinder/manifest.scm @@ -0,0 +1,24 @@ +;;; SPDX-License-Identifier: MPL-2.0 +;;; manifest.scm — Generic Guix manifest for RSR-compliant projects +;;; +;;; Usage: +;;; guix shell -m manifest.scm +;;; + +(specifications->manifest + '(;; Core development tools + "git" + "just" + "nickel" + "curl" + "bash" + "coreutils" + + ;; Documentation + "asciidoctor" + "pandoc" + + ;; Common build dependencies + "openssl" + "zlib" + "pkg-config")) diff --git a/nesy/manifest.scm b/nesy/manifest.scm new file mode 100644 index 0000000..dd942c7 --- /dev/null +++ b/nesy/manifest.scm @@ -0,0 +1,24 @@ +;;; SPDX-License-Identifier: MPL-2.0 +;;; manifest.scm — Generic Guix manifest for RSR-compliant projects +;;; +;;; Usage: +;;; guix shell -m manifest.scm +;;; + +(specifications->manifest + '(;; Core development tools + "git" + "just" + "nickel" + "curl" + "bash" + "coreutils" + + ;; Documentation + "asciidoctor" + "pandoc" + + ;; Common build dependencies + "openssl" + "zlib" + "pkg-config")) diff --git a/rescript-templater/manifest.scm b/rescript-templater/manifest.scm new file mode 100644 index 0000000..dd942c7 --- /dev/null +++ b/rescript-templater/manifest.scm @@ -0,0 +1,24 @@ +;;; SPDX-License-Identifier: MPL-2.0 +;;; manifest.scm — Generic Guix manifest for RSR-compliant projects +;;; +;;; Usage: +;;; guix shell -m manifest.scm +;;; + +(specifications->manifest + '(;; Core development tools + "git" + "just" + "nickel" + "curl" + "bash" + "coreutils" + + ;; Documentation + "asciidoctor" + "pandoc" + + ;; Common build dependencies + "openssl" + "zlib" + "pkg-config")) diff --git a/safe-storage/manifest.scm b/safe-storage/manifest.scm new file mode 100644 index 0000000..dd942c7 --- /dev/null +++ b/safe-storage/manifest.scm @@ -0,0 +1,24 @@ +;;; SPDX-License-Identifier: MPL-2.0 +;;; manifest.scm — Generic Guix manifest for RSR-compliant projects +;;; +;;; Usage: +;;; guix shell -m manifest.scm +;;; + +(specifications->manifest + '(;; Core development tools + "git" + "just" + "nickel" + "curl" + "bash" + "coreutils" + + ;; Documentation + "asciidoctor" + "pandoc" + + ;; Common build dependencies + "openssl" + "zlib" + "pkg-config")) diff --git a/voyant-export/manifest.scm b/voyant-export/manifest.scm new file mode 100644 index 0000000..dd942c7 --- /dev/null +++ b/voyant-export/manifest.scm @@ -0,0 +1,24 @@ +;;; SPDX-License-Identifier: MPL-2.0 +;;; manifest.scm — Generic Guix manifest for RSR-compliant projects +;;; +;;; Usage: +;;; guix shell -m manifest.scm +;;; + +(specifications->manifest + '(;; Core development tools + "git" + "just" + "nickel" + "curl" + "bash" + "coreutils" + + ;; Documentation + "asciidoctor" + "pandoc" + + ;; Common build dependencies + "openssl" + "zlib" + "pkg-config")) diff --git a/zoterho-template/manifest.scm b/zoterho-template/manifest.scm new file mode 100644 index 0000000..dd942c7 --- /dev/null +++ b/zoterho-template/manifest.scm @@ -0,0 +1,24 @@ +;;; SPDX-License-Identifier: MPL-2.0 +;;; manifest.scm — Generic Guix manifest for RSR-compliant projects +;;; +;;; Usage: +;;; guix shell -m manifest.scm +;;; + +(specifications->manifest + '(;; Core development tools + "git" + "just" + "nickel" + "curl" + "bash" + "coreutils" + + ;; Documentation + "asciidoctor" + "pandoc" + + ;; Common build dependencies + "openssl" + "zlib" + "pkg-config")) diff --git a/zoterho/manifest.scm b/zoterho/manifest.scm new file mode 100644 index 0000000..dd942c7 --- /dev/null +++ b/zoterho/manifest.scm @@ -0,0 +1,24 @@ +;;; SPDX-License-Identifier: MPL-2.0 +;;; manifest.scm — Generic Guix manifest for RSR-compliant projects +;;; +;;; Usage: +;;; guix shell -m manifest.scm +;;; + +(specifications->manifest + '(;; Core development tools + "git" + "just" + "nickel" + "curl" + "bash" + "coreutils" + + ;; Documentation + "asciidoctor" + "pandoc" + + ;; Common build dependencies + "openssl" + "zlib" + "pkg-config")) diff --git a/zotpress/manifest.scm b/zotpress/manifest.scm new file mode 100644 index 0000000..dd942c7 --- /dev/null +++ b/zotpress/manifest.scm @@ -0,0 +1,24 @@ +;;; SPDX-License-Identifier: MPL-2.0 +;;; manifest.scm — Generic Guix manifest for RSR-compliant projects +;;; +;;; Usage: +;;; guix shell -m manifest.scm +;;; + +(specifications->manifest + '(;; Core development tools + "git" + "just" + "nickel" + "curl" + "bash" + "coreutils" + + ;; Documentation + "asciidoctor" + "pandoc" + + ;; Common build dependencies + "openssl" + "zlib" + "pkg-config")) From 14419dbb524032c2be6bd501985fe058c730011e Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 11 Jun 2026 22:16:34 +0100 Subject: [PATCH 11/15] security: standardize secret scanning on TruffleHog --- .github/workflows/casket-pages.yml | 13 - .github/workflows/governance.yml | 3 - .github/workflows/hypatia-scan.yml | 4 - .github/workflows/instant-sync.yml | 4 - .github/workflows/mirror.yml | 3 - .github/workflows/scorecard-enforcer.yml | 16 +- .github/workflows/secret-scanner.yml | 14 +- .machine_readable/contractiles/Justfile | 3 + Justfile | 3 + fogbinder/.github/workflows/ci.yml | 353 ++++++++---------- fogbinder/.github/workflows/codeql.yml | 7 - fogbinder/.github/workflows/governance.yml | 3 - fogbinder/.github/workflows/hypatia-scan.yml | 66 +--- fogbinder/.github/workflows/instant-sync.yml | 4 - .../.github/workflows/jekyll-gh-pages.yml | 6 - fogbinder/.github/workflows/mirror.yml | 23 -- .../.github/workflows/rescript-deno-ci.yml | 8 - .../.github/workflows/scorecard-enforcer.yml | 13 +- fogbinder/.github/workflows/scorecard.yml | 4 - .../.github/workflows/secret-scanner.yml | 21 +- fogbinder/Justfile | 3 + formbd/.github/workflows/casket-pages.yml | 12 - formbd/.github/workflows/codeql.yml | 7 - formbd/.github/workflows/governance.yml | 3 - formbd/.github/workflows/hypatia-scan.yml | 66 +--- formbd/.github/workflows/scorecard.yml | 4 - librarian/.github/workflows/casket-pages.yml | 12 - librarian/.github/workflows/codeql.yml | 7 - librarian/.github/workflows/governance.yml | 3 - librarian/.github/workflows/hypatia-scan.yml | 66 +--- librarian/.github/workflows/scorecard.yml | 4 - nesy/.github/workflows/ci.yml | 39 +- nesy/.github/workflows/codeql.yml | 7 - .../workflows/comprehensive-quality.yml | 11 - nesy/.github/workflows/governance.yml | 3 - nesy/.github/workflows/hypatia-scan.yml | 66 +--- nesy/.github/workflows/instant-sync.yml | 4 - nesy/.github/workflows/jekyll-gh-pages.yml | 6 - nesy/.github/workflows/mirror.yml | 24 -- nesy/.github/workflows/rescript-deno-ci.yml | 7 - nesy/.github/workflows/scorecard-enforcer.yml | 13 +- nesy/.github/workflows/scorecard.yml | 4 - nesy/.github/workflows/secret-scanner.yml | 21 +- nesy/Justfile | 3 + rescript-templater/.github/workflows/ci.yml | 61 +-- .../.github/workflows/codeql.yml | 7 - .../workflows/comprehensive-quality.yml | 11 - .../.github/workflows/guix-nix-policy.yml | 8 +- .../.github/workflows/hypatia-scan.yml | 66 +--- .../.github/workflows/instant-sync.yml | 4 - .../.github/workflows/jekyll-gh-pages.yml | 6 - .../.github/workflows/mirror.yml | 24 -- .../.github/workflows/npm-bun-blocker.yml | 2 - .../.github/workflows/publish.yml | 68 +--- .../.github/workflows/quality.yml | 11 +- .../.github/workflows/release.yml | 18 - .../.github/workflows/rsr-antipattern.yml | 3 - .../.github/workflows/scorecard-enforcer.yml | 13 +- .../.github/workflows/scorecard.yml | 4 - .../.github/workflows/secret-scanner.yml | 21 +- .../.github/workflows/security-policy.yml | 12 +- .../.github/workflows/ts-blocker.yml | 4 +- .../workflows/wellknown-enforcement.yml | 17 +- .../.github/workflows/workflow-linter.yml | 11 - rescript-templater/Justfile | 3 + safe-storage/.github/workflows/codeql.yml | 7 - safe-storage/.github/workflows/governance.yml | 3 - .../.github/workflows/hypatia-scan.yml | 66 +--- safe-storage/.github/workflows/mirror.yml | 24 -- safe-storage/.github/workflows/scorecard.yml | 4 - .../.github/workflows/secret-scanner.yml | 21 +- safe-storage/Justfile | 3 + voyant-export/.github/workflows/codeql.yml | 7 - .../workflows/comprehensive-quality.yml | 11 - .../.github/workflows/governance.yml | 3 - .../.github/workflows/hypatia-scan.yml | 66 +--- .../.github/workflows/instant-sync.yml | 4 - .../.github/workflows/jekyll-gh-pages.yml | 6 - voyant-export/.github/workflows/mirror.yml | 24 -- .../.github/workflows/scorecard-enforcer.yml | 13 +- voyant-export/.github/workflows/scorecard.yml | 4 - .../.github/workflows/secret-scanner.yml | 21 +- voyant-export/Justfile | 3 + zoterho-template/.github/workflows/codeql.yml | 7 - .../.github/workflows/governance.yml | 3 - .../.github/workflows/hypatia-scan.yml | 66 +--- .../.github/workflows/instant-sync.yml | 4 - zoterho-template/.github/workflows/mirror.yml | 24 -- .../.github/workflows/rescript-deno-ci.yml | 7 - .../.github/workflows/scorecard.yml | 4 - .../.github/workflows/secret-scanner.yml | 21 +- zoterho-template/.gitlab-ci.yml | 10 +- zoterho-template/Justfile | 3 + zoterho/.github/workflows/codeql.yml | 7 - zoterho/.github/workflows/governance.yml | 3 - zoterho/.github/workflows/hypatia-scan.yml | 66 +--- zoterho/.github/workflows/instant-sync.yml | 4 - zoterho/.github/workflows/mirror.yml | 24 -- zoterho/.github/workflows/policy-check.yml | 48 +-- zoterho/.github/workflows/scorecard.yml | 4 - zoterho/.github/workflows/secret-scanner.yml | 21 +- zoterho/.github/workflows/semgrep.yml | 5 - zoterho/Justfile | 3 + zotpress/.github/workflows/casket-pages.yml | 12 - zotpress/.github/workflows/codeql.yml | 7 - zotpress/.github/workflows/governance.yml | 3 - zotpress/.github/workflows/hypatia-scan.yml | 66 +--- zotpress/.github/workflows/instant-sync.yml | 4 - .../.github/workflows/jekyll-gh-pages.yml | 5 - zotpress/.github/workflows/mirror.yml | 24 -- zotpress/.github/workflows/php-standards.yml | 41 -- .../.github/workflows/scorecard-enforcer.yml | 13 +- zotpress/.github/workflows/scorecard.yml | 4 - zotpress/.github/workflows/secret-scanner.yml | 21 +- .../.github/workflows/security-analysis.yml | 18 +- zotpress/.github/workflows/test.yml | 42 --- zotpress/Justfile | 3 + 117 files changed, 315 insertions(+), 1912 deletions(-) diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 87c1e3f..d9a1d6d 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,20 +1,16 @@ # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages - on: push: branches: [main, master] workflow_dispatch: - permissions: contents: read pages: write id-token: write - concurrency: group: "pages" cancel-in-progress: false - jobs: build: runs-on: ubuntu-latest @@ -22,19 +18,16 @@ jobs: steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - name: Checkout casket-ssg uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - - name: Setup GHCup uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2 with: ghc-version: '9.8.2' cabal-version: '3.10' - - name: Cache Cabal uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: @@ -43,11 +36,9 @@ jobs: ~/.cabal/store .casket-ssg/dist-newstyle key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }} - - name: Build casket-ssg working-directory: .casket-ssg run: cabal build - - name: Prepare site source shell: bash run: | @@ -90,21 +81,17 @@ jobs: echo "Project-specific site content can be added later under site/." } > .site-src/index.md fi - - name: Build site run: | mkdir -p _site cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site touch ../_site/.nojekyll - - name: Setup Pages uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Upload artifact uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 with: path: '_site' - deploy: environment: name: github-pages diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index a044174..60e8e90 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -11,16 +11,13 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index a711616..0776fac 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -3,7 +3,6 @@ # See standards#191 for the reusable's purpose and design. name: Hypatia Security Scan - on: push: branches: [main, master, develop] @@ -12,17 +11,14 @@ on: schedule: - cron: '0 0 * * 0' workflow_dispatch: - # Estate guardrail: cancel superseded runs so re-pushes don't pile up. concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read security-events: write pull-requests: write - jobs: hypatia: uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242 diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 01646a7..e9df9c7 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync - on: push: branches: [main, master] release: types: [published] - permissions: contents: read - jobs: dispatch: runs-on: ubuntu-latest @@ -29,6 +26,5 @@ jobs: "sha": "${{ github.sha }}", "forges": "" } - - name: Confirm run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}" diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index ee8ea02..fcff1f2 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: contents: read - jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index 50d765e..109b1eb 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -1,14 +1,12 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores name: OpenSSF Scorecard Enforcer - on: push: branches: [main] schedule: - - cron: '0 6 * * 1' # Weekly on Monday + - cron: '0 6 * * 1' # Weekly on Monday workflow_dispatch: - # Estate guardrail: cancel superseded runs so re-pushes / rebased PR # updates do not pile up queued runs against the shared account-wide # Actions concurrency pool. Applied only to read-only check workflows @@ -16,10 +14,8 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: # The OSSF Scorecard publish endpoint enforces a hard contract: the job that # runs `ossf/scorecard-action` with `publish_results: true` must contain @@ -36,31 +32,27 @@ jobs: timeout-minutes: 15 permissions: security-events: write - id-token: write # For OIDC + id-token: write # For OIDC steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 with: results_file: results.sarif results_format: sarif publish_results: true - - name: Upload SARIF uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4 with: sarif_file: results.sarif - - name: Persist SARIF for downstream score-gate job uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 with: name: scorecard-results path: results.sarif retention-days: 1 - check-score: needs: scorecard runs-on: ubuntu-latest @@ -72,7 +64,6 @@ jobs: uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v5.0.0 with: name: scorecard-results - - name: Check minimum score run: | SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0") @@ -86,21 +77,18 @@ jobs: echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE" exit 1 fi - # Check specific high-priority items check-critical: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Check SECURITY.md exists run: | if [ ! -f "SECURITY.md" ]; then echo "::error::SECURITY.md is required" exit 1 fi - - name: Check for pinned dependencies run: | # Check workflows for unpinned actions diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index c7761fe..10729d0 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,20 +1,26 @@ # SPDX-License-Identifier: MPL-2.0 name: Secret Scanner - on: pull_request: push: branches: [main] - concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0 timeout-minutes: 10 secrets: inherit + trufflehog: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: TruffleHog Secret Scan + uses: trufflesecurity/trufflehog@main + with: + extra_args: --only-verified --fail diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile index cb26f9c..94647cc 100644 --- a/.machine_readable/contractiles/Justfile +++ b/.machine_readable/contractiles/Justfile @@ -70,3 +70,6 @@ crg-badge: D) color="orange" ;; E) color="red" ;; F) color="critical" ;; \ *) color="lightgrey" ;; esac; \ echo "[![CRG $$grade](https://img.shields.io/badge/CRG-$$grade-$$color?style=flat-square)](https://github.com/hyperpolymath/standards/tree/main/component-readiness-grades)" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/Justfile b/Justfile index cb26f9c..94647cc 100644 --- a/Justfile +++ b/Justfile @@ -70,3 +70,6 @@ crg-badge: D) color="orange" ;; E) color="red" ;; F) color="critical" ;; \ *) color="lightgrey" ;; esac; \ echo "[![CRG $$grade](https://img.shields.io/badge/CRG-$$grade-$$color?style=flat-square)](https://github.com/hyperpolymath/standards/tree/main/component-readiness-grades)" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/fogbinder/.github/workflows/ci.yml b/fogbinder/.github/workflows/ci.yml index 88ff31f..b215957 100644 --- a/fogbinder/.github/workflows/ci.yml +++ b/fogbinder/.github/workflows/ci.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0-or-later name: CI - on: push: - branches: [ main, claude/* ] + branches: [main, claude/*] pull_request: - branches: [ main ] - + branches: [main] permissions: contents: read pull-requests: read - jobs: test: name: Test @@ -19,239 +16,185 @@ jobs: strategy: matrix: deno-version: ['1.40.x', '1.41.x'] - steps: - - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - name: Setup Deno - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3 - with: - deno-version: ${{ matrix.deno-version }} - - - name: Setup just - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 - - - name: Setup Rust (for WASM) - uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master 2025-11-30 - with: - toolchain: stable - targets: wasm32-unknown-unknown - - - name: Install ReScript - run: npm install -g rescript@latest - - - name: Check tools - run: just check-tools - - - name: Build - run: just build - - - name: Run tests - run: just test - - - name: Upload test results - if: always() - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 - with: - name: test-results-deno-${{ matrix.deno-version }} - path: coverage/ - + - name: Checkout code + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - name: Setup Deno + uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3 + with: + deno-version: ${{ matrix.deno-version }} + - name: Setup just + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 + - name: Setup Rust (for WASM) + uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master 2025-11-30 + with: + toolchain: stable + targets: wasm32-unknown-unknown + - name: Install ReScript + run: npm install -g rescript@latest + - name: Check tools + run: just check-tools + - name: Build + run: just build + - name: Run tests + run: just test + - name: Upload test results + if: always() + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + with: + name: test-results-deno-${{ matrix.deno-version }} + path: coverage/ quality: name: Code Quality runs-on: ubuntu-latest timeout-minutes: 15 - steps: - - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - name: Setup Deno - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3 - with: - deno-version: '1.x' - - - name: Setup just - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 - - - name: Install ReScript - run: npm install -g rescript@latest - - - name: Lint - run: just lint - - - name: Format check - run: just fmt-check - - - name: Type check - run: just type-check - + - name: Checkout code + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - name: Setup Deno + uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3 + with: + deno-version: '1.x' + - name: Setup just + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 + - name: Install ReScript + run: npm install -g rescript@latest + - name: Lint + run: just lint + - name: Format check + run: just fmt-check + - name: Type check + run: just type-check security: name: Security Scan runs-on: ubuntu-latest timeout-minutes: 15 - steps: - - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - name: Setup Deno - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3 - with: - deno-version: '1.x' - - - name: Setup just - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 - - - name: Security audit - run: just security-audit - - - name: Check for hardcoded secrets - uses: trufflesecurity/trufflehog@ef6e76c3c4023279497fab4721ffa071a722fd05 # v3.92.4 - with: - path: ./ - base: ${{ github.event.repository.default_branch }} - head: HEAD - - - name: Verify Git SSH configuration - run: just git-ssh-verify - + - name: Checkout code + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - name: Setup Deno + uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3 + with: + deno-version: '1.x' + - name: Setup just + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 + - name: Security audit + run: just security-audit + - name: Check for hardcoded secrets + uses: trufflesecurity/trufflehog@ef6e76c3c4023279497fab4721ffa071a722fd05 # v3.92.4 + with: + path: ./ + base: ${{ github.event.repository.default_branch }} + head: HEAD + - name: Verify Git SSH configuration + run: just git-ssh-verify rsr-compliance: name: RSR Rhodium Compliance runs-on: ubuntu-latest timeout-minutes: 15 - steps: - - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - name: Setup Deno - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3 - with: - deno-version: '1.x' - - - name: Setup just - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 - - - name: Verify RSR Rhodium compliance - run: just verify-rsr - - - name: Check documentation requirements - run: just rsr-docs - - - name: Check build system requirements - run: just rsr-build - - - name: Check licensing requirements - run: just rsr-license - + - name: Checkout code + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - name: Setup Deno + uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3 + with: + deno-version: '1.x' + - name: Setup just + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 + - name: Verify RSR Rhodium compliance + run: just verify-rsr + - name: Check documentation requirements + run: just rsr-docs + - name: Check build system requirements + run: just rsr-build + - name: Check licensing requirements + run: just rsr-license accessibility: name: Accessibility Check runs-on: ubuntu-latest timeout-minutes: 15 - steps: - - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - name: Setup just - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 - - - name: Check accessibility - run: just a11y - + - name: Checkout code + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - name: Setup just + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 + - name: Check accessibility + run: just a11y documentation: name: Documentation Check runs-on: ubuntu-latest timeout-minutes: 15 - steps: - - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - name: Verify required docs exist (AsciiDoc) - run: | - test -f README.adoc || exit 1 - test -f SECURITY.md || exit 1 - test -f CONTRIBUTING.adoc || exit 1 - test -f CODE_OF_CONDUCT.adoc || exit 1 - test -f MAINTAINERS.adoc || exit 1 - test -f CHANGELOG.adoc || exit 1 - test -f TPCF.adoc || exit 1 - test -f LICENSE_DUAL.adoc || exit 1 - test -f .well-known/security.txt || exit 1 - test -f .well-known/ai.txt || exit 1 - echo "All required documentation files present" - - - name: Verify NO TypeScript exists - run: | - if find . -name "*.ts" -not -path "./node_modules/*" -type f | grep -q .; then - echo "❌ TypeScript files found (should not exist)" - exit 1 - fi - echo "✅ No TypeScript files found" - - - name: Verify NO package.json exists - run: | - if [ -f package.json ]; then - echo "❌ package.json found (should not exist)" - exit 1 - fi - echo "✅ No package.json found" - - - name: Check documentation freshness - run: | - # Ensure CHANGELOG.adoc was updated (if not initial commit) - if [ "${{ github.event_name }}" == "pull_request" ]; then - git diff --name-only origin/main | grep -q CHANGELOG.adoc || echo "Consider updating CHANGELOG.adoc" - fi - + - name: Checkout code + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - name: Verify required docs exist (AsciiDoc) + run: | + test -f README.adoc || exit 1 + test -f SECURITY.md || exit 1 + test -f CONTRIBUTING.adoc || exit 1 + test -f CODE_OF_CONDUCT.adoc || exit 1 + test -f MAINTAINERS.adoc || exit 1 + test -f CHANGELOG.adoc || exit 1 + test -f TPCF.adoc || exit 1 + test -f LICENSE_DUAL.adoc || exit 1 + test -f .well-known/security.txt || exit 1 + test -f .well-known/ai.txt || exit 1 + echo "All required documentation files present" + - name: Verify NO TypeScript exists + run: | + if find . -name "*.ts" -not -path "./node_modules/*" -type f | grep -q .; then + echo "❌ TypeScript files found (should not exist)" + exit 1 + fi + echo "✅ No TypeScript files found" + - name: Verify NO package.json exists + run: | + if [ -f package.json ]; then + echo "❌ package.json found (should not exist)" + exit 1 + fi + echo "✅ No package.json found" + - name: Check documentation freshness + run: | + # Ensure CHANGELOG.adoc was updated (if not initial commit) + if [ "${{ github.event_name }}" == "pull_request" ]; then + git diff --name-only origin/main | grep -q CHANGELOG.adoc || echo "Consider updating CHANGELOG.adoc" + fi philosophy: name: Philosophical Integrity runs-on: ubuntu-latest timeout-minutes: 15 - steps: - - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - name: Setup just - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 - - - name: Verify philosophical foundations - run: just philosophy - + - name: Checkout code + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - name: Setup just + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 + - name: Verify philosophical foundations + run: just philosophy benchmarks: name: Performance Benchmarks runs-on: ubuntu-latest timeout-minutes: 15 - steps: - - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - name: Setup Deno - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3 - with: - deno-version: '1.x' - - - name: Setup just - uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 - - - name: Setup Rust - uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master 2025-11-30 - with: - toolchain: stable - targets: wasm32-unknown-unknown - - - name: Install ReScript - run: npm install -g rescript@latest - - - name: Run benchmarks - run: just bench - - - name: Upload benchmark results - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 - with: - name: benchmark-results - path: benchmarks/results/ + - name: Checkout code + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - name: Setup Deno + uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3 + with: + deno-version: '1.x' + - name: Setup just + uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3.0.0 + - name: Setup Rust + uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # master 2025-11-30 + with: + toolchain: stable + targets: wasm32-unknown-unknown + - name: Install ReScript + run: npm install -g rescript@latest + - name: Run benchmarks + run: just bench + - name: Upload benchmark results + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + with: + name: benchmark-results + path: benchmarks/results/ diff --git a/fogbinder/.github/workflows/codeql.yml b/fogbinder/.github/workflows/codeql.yml index 542e240..b41ed41 100644 --- a/fogbinder/.github/workflows/codeql.yml +++ b/fogbinder/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0-or-later name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,10 +7,7 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - - permissions: read-all - jobs: analyze: runs-on: ubuntu-latest @@ -27,17 +23,14 @@ jobs: build-mode: none - language: rust build-mode: none - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Initialize CodeQL uses: github/codeql-action/init@1b168cd39490f61582a9beae412bb7057a6b2c4e # v3.28.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@1b168cd39490f61582a9beae412bb7057a6b2c4e # v3.28.1 with: diff --git a/fogbinder/.github/workflows/governance.yml b/fogbinder/.github/workflows/governance.yml index a044174..60e8e90 100644 --- a/fogbinder/.github/workflows/governance.yml +++ b/fogbinder/.github/workflows/governance.yml @@ -11,16 +11,13 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/fogbinder/.github/workflows/hypatia-scan.yml b/fogbinder/.github/workflows/hypatia-scan.yml index 49e830d..c3cb66b 100644 --- a/fogbinder/.github/workflows/hypatia-scan.yml +++ b/fogbinder/.github/workflows/hypatia-scan.yml @@ -1,42 +1,35 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: read-all - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) working-directory: ${{ env.HOME }}/hypatia run: | @@ -47,7 +40,6 @@ jobs: mix escript.build mv hypatia ../hypatia-v2 fi - - name: Run Hypatia scan id: scan run: | @@ -74,35 +66,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -110,7 +86,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -144,37 +119,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});\n" diff --git a/fogbinder/.github/workflows/instant-sync.yml b/fogbinder/.github/workflows/instant-sync.yml index 45e260a..33d7cd0 100644 --- a/fogbinder/.github/workflows/instant-sync.yml +++ b/fogbinder/.github/workflows/instant-sync.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync - on: push: branches: [main, master] release: types: [published] - permissions: contents: read - jobs: dispatch: runs-on: ubuntu-latest @@ -29,6 +26,5 @@ jobs: "sha": "${{ github.sha }}", "forges": "" } - - name: Confirm run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}" diff --git a/fogbinder/.github/workflows/jekyll-gh-pages.yml b/fogbinder/.github/workflows/jekyll-gh-pages.yml index 8b19021..a359a83 100644 --- a/fogbinder/.github/workflows/jekyll-gh-pages.yml +++ b/fogbinder/.github/workflows/jekyll-gh-pages.yml @@ -1,27 +1,22 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Sample workflow for building and deploying a Jekyll site to GitHub Pages name: Deploy Jekyll with GitHub Pages dependencies preinstalled - on: # Runs on pushes targeting the default branch push: branches: ["main"] - # Allows you to run this workflow manually from the Actions tab workflow_dispatch: - # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages permissions: contents: read pages: write id-token: write - # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. concurrency: group: "pages" cancel-in-progress: false - jobs: # Build job build: @@ -39,7 +34,6 @@ jobs: destination: ./_site - name: Upload artifact uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v4 - # Deployment job deploy: environment: diff --git a/fogbinder/.github/workflows/mirror.yml b/fogbinder/.github/workflows/mirror.yml index b13a5a0..65d02f3 100644 --- a/fogbinder/.github/workflows/mirror.yml +++ b/fogbinder/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0-or-later # SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: read-all - jobs: mirror-gitlab: runs-on: ubuntu-latest @@ -18,17 +15,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} - - name: Mirror to GitLab run: | ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitlab main - mirror-bitbucket: runs-on: ubuntu-latest timeout-minutes: 15 @@ -37,17 +31,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} - - name: Mirror to Bitbucket run: | ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force bitbucket main - mirror-codeberg: runs-on: ubuntu-latest timeout-minutes: 15 @@ -56,17 +47,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} - - name: Mirror to Codeberg run: | ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force codeberg main - mirror-sourcehut: runs-on: ubuntu-latest timeout-minutes: 15 @@ -75,17 +63,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} - - name: Mirror to SourceHut run: | ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true git push --force sourcehut main - mirror-disroot: runs-on: ubuntu-latest timeout-minutes: 15 @@ -94,17 +79,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} - - name: Mirror to Disroot run: | ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force disroot main - mirror-gitea: runs-on: ubuntu-latest timeout-minutes: 15 @@ -113,17 +95,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} - - name: Mirror to Gitea run: | ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitea main - mirror-radicle: runs-on: ubuntu-latest timeout-minutes: 15 @@ -132,12 +111,10 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - name: Install Radicle run: | curl -sSf https://radicle.xyz/install | sh echo "$HOME/.radicle/bin" >> $GITHUB_PATH - - name: Mirror to Radicle run: | echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle diff --git a/fogbinder/.github/workflows/rescript-deno-ci.yml b/fogbinder/.github/workflows/rescript-deno-ci.yml index e75aec6..48e9730 100644 --- a/fogbinder/.github/workflows/rescript-deno-ci.yml +++ b/fogbinder/.github/workflows/rescript-deno-ci.yml @@ -1,9 +1,7 @@ # SPDX-License-Identifier: MPL-2.0-or-later name: ReScript/Deno CI on: [push, pull_request] - permissions: read-all - jobs: build: runs-on: ubuntu-latest @@ -13,26 +11,20 @@ jobs: - uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1 with: deno-version: v1.x - - name: Deno lint run: deno lint - - name: Deno fmt check run: deno fmt --check - - name: Deno test run: deno test --allow-all --coverage=coverage - - name: ReScript build run: | if [ -f "rescript.json" ] || [ -f "bsconfig.json" ]; then npm install npx rescript fi - - name: Type check run: deno check **/*.ts || true - security: runs-on: ubuntu-latest timeout-minutes: 15 diff --git a/fogbinder/.github/workflows/scorecard-enforcer.yml b/fogbinder/.github/workflows/scorecard-enforcer.yml index c4ff61e..f9b9485 100644 --- a/fogbinder/.github/workflows/scorecard-enforcer.yml +++ b/fogbinder/.github/workflows/scorecard-enforcer.yml @@ -1,40 +1,34 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Prevention workflow - runs OpenSSF Scorecard and fails on low scores name: OpenSSF Scorecard Enforcer - on: push: branches: [main] schedule: - - cron: '0 6 * * 1' # Weekly on Monday + - cron: '0 6 * * 1' # Weekly on Monday workflow_dispatch: - permissions: read-all - jobs: scorecard: runs-on: ubuntu-latest timeout-minutes: 15 permissions: security-events: write - id-token: write # For OIDC + id-token: write # For OIDC steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 with: results_file: results.sarif results_format: sarif publish_results: true - - name: Upload SARIF uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3 with: sarif_file: results.sarif - - name: Check minimum score run: | # Parse score from results @@ -49,21 +43,18 @@ jobs: echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE" exit 1 fi - # Check specific high-priority items check-critical: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Check SECURITY.md exists run: | if [ ! -f "SECURITY.md" ]; then echo "::error::SECURITY.md is required" exit 1 fi - - name: Check for pinned dependencies run: | # Check workflows for unpinned actions diff --git a/fogbinder/.github/workflows/scorecard.yml b/fogbinder/.github/workflows/scorecard.yml index 9413dfe..13e4d04 100644 --- a/fogbinder/.github/workflows/scorecard.yml +++ b/fogbinder/.github/workflows/scorecard.yml @@ -5,9 +5,7 @@ on: branches: [main, master] schedule: - cron: '0 4 * * 0' - permissions: read-all - jobs: analysis: runs-on: ubuntu-latest @@ -19,13 +17,11 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@v4 with: diff --git a/fogbinder/.github/workflows/secret-scanner.yml b/fogbinder/.github/workflows/secret-scanner.yml index c5e240f..f971a12 100644 --- a/fogbinder/.github/workflows/secret-scanner.yml +++ b/fogbinder/.github/workflows/secret-scanner.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Prevention workflow - scans for hardcoded secrets before they reach main name: Secret Scanner - on: pull_request: push: branches: [main] - permissions: read-all - jobs: trufflehog: runs-on: ubuntu-latest @@ -16,26 +13,11 @@ jobs: steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: - fetch-depth: 0 # Full history for scanning - + fetch-depth: 0 # Full history for scanning - name: TruffleHog Secret Scan uses: trufflesecurity/trufflehog@8a8ef8526528d8a4ff3e2c90be08e25ef8efbd9b # v3 with: extra_args: --only-verified --fail - - gitleaks: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest @@ -43,7 +25,6 @@ jobs: if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Check for hardcoded secrets in Rust run: | # Patterns that suggest hardcoded secrets diff --git a/fogbinder/Justfile b/fogbinder/Justfile index f553867..e9b5075 100644 --- a/fogbinder/Justfile +++ b/fogbinder/Justfile @@ -849,3 +849,6 @@ a11y: @grep -r "outline: none" assets/ && (echo "❌ Found outline:none" && exit 1) || echo "✅ No outline:none found" @grep -r "focus.*outline.*0" assets/ && (echo "❌ Found focus outline disabled" && exit 1) || echo "✅ No focus outline disabled" @echo "✅ Accessibility check passed" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/formbd/.github/workflows/casket-pages.yml b/formbd/.github/workflows/casket-pages.yml index 24e0c75..32c256f 100644 --- a/formbd/.github/workflows/casket-pages.yml +++ b/formbd/.github/workflows/casket-pages.yml @@ -1,20 +1,16 @@ # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages - on: push: branches: [main] workflow_dispatch: - permissions: contents: read pages: write id-token: write - concurrency: group: "pages" cancel-in-progress: false - jobs: build: runs-on: ubuntu-latest @@ -22,19 +18,16 @@ jobs: steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - name: Checkout casket-ssg uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - - name: Setup GHCup uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2 with: ghc-version: '9.8.2' cabal-version: '3.10' - - name: Cache Cabal uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: @@ -43,11 +36,9 @@ jobs: ~/.cabal/store .casket-ssg/dist-newstyle key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }} - - name: Build casket-ssg working-directory: .casket-ssg run: cabal build - - name: Build site run: | mkdir -p site _site @@ -78,15 +69,12 @@ jobs: fi fi cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site - - name: Setup Pages uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Upload artifact uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 with: path: '_site' - deploy: environment: name: github-pages diff --git a/formbd/.github/workflows/codeql.yml b/formbd/.github/workflows/codeql.yml index 85bbabc..0607869 100644 --- a/formbd/.github/workflows/codeql.yml +++ b/formbd/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,10 +7,7 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - - permissions: read-all - jobs: analyze: runs-on: ubuntu-latest @@ -25,17 +21,14 @@ jobs: include: - language: javascript-typescript build-mode: none - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Initialize CodeQL uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 with: diff --git a/formbd/.github/workflows/governance.yml b/formbd/.github/workflows/governance.yml index a044174..60e8e90 100644 --- a/formbd/.github/workflows/governance.yml +++ b/formbd/.github/workflows/governance.yml @@ -11,16 +11,13 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/formbd/.github/workflows/hypatia-scan.yml b/formbd/.github/workflows/hypatia-scan.yml index 49e830d..c3cb66b 100644 --- a/formbd/.github/workflows/hypatia-scan.yml +++ b/formbd/.github/workflows/hypatia-scan.yml @@ -1,42 +1,35 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: read-all - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) working-directory: ${{ env.HOME }}/hypatia run: | @@ -47,7 +40,6 @@ jobs: mix escript.build mv hypatia ../hypatia-v2 fi - - name: Run Hypatia scan id: scan run: | @@ -74,35 +66,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -110,7 +86,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -144,37 +119,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});\n" diff --git a/formbd/.github/workflows/scorecard.yml b/formbd/.github/workflows/scorecard.yml index d091a90..4dd3b73 100644 --- a/formbd/.github/workflows/scorecard.yml +++ b/formbd/.github/workflows/scorecard.yml @@ -6,9 +6,7 @@ on: schedule: - cron: '0 4 * * *' workflow_dispatch: - permissions: read-all - jobs: analysis: runs-on: ubuntu-latest @@ -20,13 +18,11 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.31.8 with: diff --git a/librarian/.github/workflows/casket-pages.yml b/librarian/.github/workflows/casket-pages.yml index 24e0c75..32c256f 100644 --- a/librarian/.github/workflows/casket-pages.yml +++ b/librarian/.github/workflows/casket-pages.yml @@ -1,20 +1,16 @@ # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages - on: push: branches: [main] workflow_dispatch: - permissions: contents: read pages: write id-token: write - concurrency: group: "pages" cancel-in-progress: false - jobs: build: runs-on: ubuntu-latest @@ -22,19 +18,16 @@ jobs: steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - name: Checkout casket-ssg uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - - name: Setup GHCup uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2 with: ghc-version: '9.8.2' cabal-version: '3.10' - - name: Cache Cabal uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: @@ -43,11 +36,9 @@ jobs: ~/.cabal/store .casket-ssg/dist-newstyle key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }} - - name: Build casket-ssg working-directory: .casket-ssg run: cabal build - - name: Build site run: | mkdir -p site _site @@ -78,15 +69,12 @@ jobs: fi fi cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site - - name: Setup Pages uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Upload artifact uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 with: path: '_site' - deploy: environment: name: github-pages diff --git a/librarian/.github/workflows/codeql.yml b/librarian/.github/workflows/codeql.yml index 85bbabc..0607869 100644 --- a/librarian/.github/workflows/codeql.yml +++ b/librarian/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,10 +7,7 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - - permissions: read-all - jobs: analyze: runs-on: ubuntu-latest @@ -25,17 +21,14 @@ jobs: include: - language: javascript-typescript build-mode: none - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Initialize CodeQL uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 with: diff --git a/librarian/.github/workflows/governance.yml b/librarian/.github/workflows/governance.yml index a044174..60e8e90 100644 --- a/librarian/.github/workflows/governance.yml +++ b/librarian/.github/workflows/governance.yml @@ -11,16 +11,13 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/librarian/.github/workflows/hypatia-scan.yml b/librarian/.github/workflows/hypatia-scan.yml index 49e830d..c3cb66b 100644 --- a/librarian/.github/workflows/hypatia-scan.yml +++ b/librarian/.github/workflows/hypatia-scan.yml @@ -1,42 +1,35 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: read-all - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) working-directory: ${{ env.HOME }}/hypatia run: | @@ -47,7 +40,6 @@ jobs: mix escript.build mv hypatia ../hypatia-v2 fi - - name: Run Hypatia scan id: scan run: | @@ -74,35 +66,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -110,7 +86,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -144,37 +119,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});\n" diff --git a/librarian/.github/workflows/scorecard.yml b/librarian/.github/workflows/scorecard.yml index d091a90..4dd3b73 100644 --- a/librarian/.github/workflows/scorecard.yml +++ b/librarian/.github/workflows/scorecard.yml @@ -6,9 +6,7 @@ on: schedule: - cron: '0 4 * * *' workflow_dispatch: - permissions: read-all - jobs: analysis: runs-on: ubuntu-latest @@ -20,13 +18,11 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.31.8 with: diff --git a/nesy/.github/workflows/ci.yml b/nesy/.github/workflows/ci.yml index 2a10f2f..e64b319 100644 --- a/nesy/.github/workflows/ci.yml +++ b/nesy/.github/workflows/ci.yml @@ -1,39 +1,31 @@ # SPDX-License-Identifier: MPL-2.0-or-later name: CI - on: push: - branches: [ main, develop ] + branches: [main, develop] pull_request: - branches: [ main, develop ] + branches: [main, develop] workflow_dispatch: - jobs: test: name: Test (Node ${{ matrix.node-version }}) runs-on: ubuntu-latest timeout-minutes: 15 - strategy: matrix: node-version: [18.x, 20.x] - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: Setup Node.js uses: actions/setup-node@49933ea5288caeca8642195f2b846b8bbe245a93 # v4 with: node-version: ${{ matrix.node-version }} cache: 'npm' - - name: Install dependencies run: npm ci - - name: Run tests run: npm test - - name: Upload coverage if: matrix.node-version == '20.x' uses: codecov/codecov-action@v5 @@ -41,86 +33,67 @@ jobs: files: ./coverage/coverage-final.json flags: unittests name: codecov-nsai - typecheck: name: Type Checking runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: Setup Node.js uses: actions/setup-node@49933ea5288caeca8642195f2b846b8bbe245a93 # v4 with: node-version: '20.x' cache: 'npm' - - name: Install dependencies run: npm ci - - name: Type check run: npm run typecheck - lint: name: Linting runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: Setup Node.js uses: actions/setup-node@49933ea5288caeca8642195f2b846b8bbe245a93 # v4 with: node-version: '20.x' cache: 'npm' - - name: Install dependencies run: npm ci - - name: Run ESLint run: npm run lint - build: name: Build runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: Setup Node.js uses: actions/setup-node@49933ea5288caeca8642195f2b846b8bbe245a93 # v4 with: node-version: '20.x' cache: 'npm' - - name: Install dependencies run: npm ci - - name: Build project run: npm run build - - name: Upload build artifacts uses: actions/upload-artifact@v6 with: name: build-output path: build/ retention-days: 7 - rsr-compliance: name: RSR Compliance Check runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: Check required files run: | echo "Checking RSR compliance..." @@ -134,41 +107,33 @@ jobs: test -f .well-known/ai.txt || (echo "❌ ai.txt missing" && exit 1) test -f .well-known/humans.txt || (echo "❌ humans.txt missing" && exit 1) echo "✅ All RSR compliance files present" - - name: Validate security.txt run: | echo "Validating security.txt RFC 9116 compliance..." grep -q "Contact:" .well-known/security.txt || (echo "❌ Contact missing" && exit 1) grep -q "Expires:" .well-known/security.txt || (echo "❌ Expires missing" && exit 1) echo "✅ security.txt is valid" - security: name: Security Audit runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: Setup Node.js uses: actions/setup-node@49933ea5288caeca8642195f2b846b8bbe245a93 # v4 with: node-version: '20.x' cache: 'npm' - - name: Run npm audit run: npm audit --audit-level=moderate - - name: Check for vulnerable dependencies run: npm audit --production --audit-level=high - all-checks: name: All Checks Passed runs-on: ubuntu-latest timeout-minutes: 15 needs: [test, typecheck, lint, build, rsr-compliance, security] - steps: - name: All checks passed run: echo "✅ All CI checks passed!" diff --git a/nesy/.github/workflows/codeql.yml b/nesy/.github/workflows/codeql.yml index 74c318a..bc3fae4 100644 --- a/nesy/.github/workflows/codeql.yml +++ b/nesy/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0-or-later name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,10 +7,7 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - - permissions: read-all - jobs: analyze: runs-on: ubuntu-latest @@ -25,17 +21,14 @@ jobs: include: - language: javascript-typescript build-mode: none - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Initialize CodeQL uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1 with: diff --git a/nesy/.github/workflows/comprehensive-quality.yml b/nesy/.github/workflows/comprehensive-quality.yml index 9552a28..fc68e53 100644 --- a/nesy/.github/workflows/comprehensive-quality.yml +++ b/nesy/.github/workflows/comprehensive-quality.yml @@ -6,7 +6,6 @@ on: pull_request: schedule: - cron: '0 5 * * 0' - jobs: # DEPENDABILITY - Stability and reliability dependability: @@ -27,7 +26,6 @@ jobs: # Check for proper error handling patterns PANICS=$(grep -rE "panic!|unwrap\(\)|expect\(" --include="*.rs" . 2>/dev/null | wc -l || echo "0") echo "Rust panics/unwraps: $PANICS" - # SECURITY - Multi-layer security scanning security: runs-on: ubuntu-latest @@ -48,7 +46,6 @@ jobs: - name: SAST scan uses: returntocorp/semgrep-action@v1 continue-on-error: true - # INTEROPERABILITY - API and format compatibility interoperability: runs-on: ubuntu-latest @@ -66,7 +63,6 @@ jobs: - name: Validate JSON/YAML schemas run: | find . -name "*.json" -exec python3 -m json.tool {} \; 2>/dev/null | head -5 || true - # VALIDATION - Input/output validation validation: runs-on: ubuntu-latest @@ -77,7 +73,6 @@ jobs: run: | VALIDATION=$(grep -rE "validate|sanitize|Schema|Validator" --include="*.rs" --include="*.res" --include="*.ex" . 2>/dev/null | wc -l || echo "0") echo "Validation patterns found: $VALIDATION" - # ATTESTATION - Supply chain integrity (SLSA) attestation: runs-on: ubuntu-latest @@ -98,7 +93,6 @@ jobs: if [ -f "CHECKSUMS.txt" ] || [ -f "SHA256SUMS" ]; then echo "✅ Checksums file present" fi - # VERIFICATION - Formal methods where applicable verification: runs-on: ubuntu-latest @@ -115,7 +109,6 @@ jobs: if [ -f "rescript.json" ]; then echo "ReScript provides 100% type coverage" fi - # FUNCTIONALITY - Feature completeness functionality: runs-on: ubuntu-latest @@ -129,7 +122,6 @@ jobs: - name: Check deprecated usage run: | grep -rn "deprecated\|DEPRECATED" . 2>/dev/null | head -10 || echo "No deprecations" - # PERFORMANCE - Benchmarks and profiling performance: runs-on: ubuntu-latest @@ -146,7 +138,6 @@ jobs: cargo build --release 2>/dev/null || true find target/release -maxdepth 1 -type f -executable -exec ls -lh {} \; 2>/dev/null || true fi - # ACCESSIBILITY - A11y compliance accessibility: runs-on: ubuntu-latest @@ -162,7 +153,6 @@ jobs: - name: Lighthouse (if web project) run: | echo "Lighthouse would run on deployed URL" - # LICENSE COMPLIANCE license: runs-on: ubuntu-latest @@ -181,7 +171,6 @@ jobs: run: | SPDX=$(grep -rE "SPDX-License-Identifier" . 2>/dev/null | wc -l || echo "0") echo "Files with SPDX headers: $SPDX" - # DOCUMENTATION QUALITY documentation: runs-on: ubuntu-latest diff --git a/nesy/.github/workflows/governance.yml b/nesy/.github/workflows/governance.yml index a044174..60e8e90 100644 --- a/nesy/.github/workflows/governance.yml +++ b/nesy/.github/workflows/governance.yml @@ -11,16 +11,13 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/nesy/.github/workflows/hypatia-scan.yml b/nesy/.github/workflows/hypatia-scan.yml index 49e830d..c3cb66b 100644 --- a/nesy/.github/workflows/hypatia-scan.yml +++ b/nesy/.github/workflows/hypatia-scan.yml @@ -1,42 +1,35 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: read-all - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) working-directory: ${{ env.HOME }}/hypatia run: | @@ -47,7 +40,6 @@ jobs: mix escript.build mv hypatia ../hypatia-v2 fi - - name: Run Hypatia scan id: scan run: | @@ -74,35 +66,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -110,7 +86,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -144,37 +119,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});\n" diff --git a/nesy/.github/workflows/instant-sync.yml b/nesy/.github/workflows/instant-sync.yml index 45e260a..33d7cd0 100644 --- a/nesy/.github/workflows/instant-sync.yml +++ b/nesy/.github/workflows/instant-sync.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync - on: push: branches: [main, master] release: types: [published] - permissions: contents: read - jobs: dispatch: runs-on: ubuntu-latest @@ -29,6 +26,5 @@ jobs: "sha": "${{ github.sha }}", "forges": "" } - - name: Confirm run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}" diff --git a/nesy/.github/workflows/jekyll-gh-pages.yml b/nesy/.github/workflows/jekyll-gh-pages.yml index 8b19021..a359a83 100644 --- a/nesy/.github/workflows/jekyll-gh-pages.yml +++ b/nesy/.github/workflows/jekyll-gh-pages.yml @@ -1,27 +1,22 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Sample workflow for building and deploying a Jekyll site to GitHub Pages name: Deploy Jekyll with GitHub Pages dependencies preinstalled - on: # Runs on pushes targeting the default branch push: branches: ["main"] - # Allows you to run this workflow manually from the Actions tab workflow_dispatch: - # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages permissions: contents: read pages: write id-token: write - # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. concurrency: group: "pages" cancel-in-progress: false - jobs: # Build job build: @@ -39,7 +34,6 @@ jobs: destination: ./_site - name: Upload artifact uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v4 - # Deployment job deploy: environment: diff --git a/nesy/.github/workflows/mirror.yml b/nesy/.github/workflows/mirror.yml index bf21b11..a10a916 100644 --- a/nesy/.github/workflows/mirror.yml +++ b/nesy/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0-or-later # SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: read-all - jobs: mirror-gitlab: runs-on: ubuntu-latest @@ -18,17 +15,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} - - name: Mirror to GitLab run: | ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitlab main - mirror-bitbucket: runs-on: ubuntu-latest timeout-minutes: 15 @@ -37,17 +31,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} - - name: Mirror to Bitbucket run: | ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force bitbucket main - mirror-codeberg: runs-on: ubuntu-latest timeout-minutes: 15 @@ -56,17 +47,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} - - name: Mirror to Codeberg run: | ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force codeberg main - mirror-sourcehut: runs-on: ubuntu-latest timeout-minutes: 15 @@ -75,17 +63,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} - - name: Mirror to SourceHut run: | ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true git push --force sourcehut main - mirror-disroot: runs-on: ubuntu-latest timeout-minutes: 15 @@ -94,17 +79,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} - - name: Mirror to Disroot run: | ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force disroot main - mirror-gitea: runs-on: ubuntu-latest timeout-minutes: 15 @@ -113,17 +95,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} - - name: Mirror to Gitea run: | ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitea main - mirror-radicle: runs-on: ubuntu-latest timeout-minutes: 15 @@ -132,18 +111,15 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - name: Setup Rust uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # stable with: toolchain: stable - - name: Install Radicle run: | # Install via cargo (safer than curl|sh) cargo install radicle-cli --locked echo "$HOME/.cargo/bin" >> $GITHUB_PATH - - name: Mirror to Radicle run: | echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle diff --git a/nesy/.github/workflows/rescript-deno-ci.yml b/nesy/.github/workflows/rescript-deno-ci.yml index 94ace81..f1ad681 100644 --- a/nesy/.github/workflows/rescript-deno-ci.yml +++ b/nesy/.github/workflows/rescript-deno-ci.yml @@ -1,7 +1,6 @@ # SPDX-License-Identifier: MPL-2.0-or-later name: ReScript/Deno CI on: [push, pull_request] - jobs: build: runs-on: ubuntu-latest @@ -11,26 +10,20 @@ jobs: - uses: denoland/setup-deno@v2 with: deno-version: v1.x - - name: Deno lint run: deno lint - - name: Deno fmt check run: deno fmt --check - - name: Deno test run: deno test --allow-all --coverage=coverage - - name: ReScript build run: | if [ -f "rescript.json" ] || [ -f "bsconfig.json" ]; then npm install npx rescript fi - - name: Type check run: deno check **/*.ts || true - security: runs-on: ubuntu-latest timeout-minutes: 15 diff --git a/nesy/.github/workflows/scorecard-enforcer.yml b/nesy/.github/workflows/scorecard-enforcer.yml index d2ecfdf..d3ef9bb 100644 --- a/nesy/.github/workflows/scorecard-enforcer.yml +++ b/nesy/.github/workflows/scorecard-enforcer.yml @@ -1,40 +1,34 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Prevention workflow - runs OpenSSF Scorecard and fails on low scores name: OpenSSF Scorecard Enforcer - on: push: branches: [main] schedule: - - cron: '0 6 * * 1' # Weekly on Monday + - cron: '0 6 * * 1' # Weekly on Monday workflow_dispatch: - permissions: read-all - jobs: scorecard: runs-on: ubuntu-latest timeout-minutes: 15 permissions: security-events: write - id-token: write # For OIDC + id-token: write # For OIDC steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 with: results_file: results.sarif results_format: sarif publish_results: true - - name: Upload SARIF uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3 with: sarif_file: results.sarif - - name: Check minimum score run: | # Parse score from results @@ -49,21 +43,18 @@ jobs: echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE" exit 1 fi - # Check specific high-priority items check-critical: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Check SECURITY.md exists run: | if [ ! -f "SECURITY.md" ]; then echo "::error::SECURITY.md is required" exit 1 fi - - name: Check for pinned dependencies run: | # Check workflows for unpinned actions diff --git a/nesy/.github/workflows/scorecard.yml b/nesy/.github/workflows/scorecard.yml index 69192ce..b2cde06 100644 --- a/nesy/.github/workflows/scorecard.yml +++ b/nesy/.github/workflows/scorecard.yml @@ -6,9 +6,7 @@ on: schedule: - cron: '0 4 * * *' workflow_dispatch: - permissions: read-all - jobs: analysis: runs-on: ubuntu-latest @@ -20,13 +18,11 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.31.8 with: diff --git a/nesy/.github/workflows/secret-scanner.yml b/nesy/.github/workflows/secret-scanner.yml index f7dbcbd..3f4de94 100644 --- a/nesy/.github/workflows/secret-scanner.yml +++ b/nesy/.github/workflows/secret-scanner.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Prevention workflow - scans for hardcoded secrets before they reach main name: Secret Scanner - on: pull_request: push: branches: [main] - permissions: read-all - jobs: trufflehog: runs-on: ubuntu-latest @@ -16,26 +13,11 @@ jobs: steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: - fetch-depth: 0 # Full history for scanning - + fetch-depth: 0 # Full history for scanning - name: TruffleHog Secret Scan uses: trufflesecurity/trufflehog@ef6e76c3c4023279497fab4721ffa071a722fd05 # v3 with: extra_args: --only-verified --fail - - gitleaks: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest @@ -43,7 +25,6 @@ jobs: if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Check for hardcoded secrets in Rust run: | # Patterns that suggest hardcoded secrets diff --git a/nesy/Justfile b/nesy/Justfile index 5c22217..7c04d3d 100644 --- a/nesy/Justfile +++ b/nesy/Justfile @@ -177,3 +177,6 @@ philosophy: @echo "" @echo "7 \"Whereof one cannot speak, thereof one must be silent.\"" @echo " → What NSAI cannot validate, Fogbinder explores" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/rescript-templater/.github/workflows/ci.yml b/rescript-templater/.github/workflows/ci.yml index 92c57aa..dceda9d 100644 --- a/rescript-templater/.github/workflows/ci.yml +++ b/rescript-templater/.github/workflows/ci.yml @@ -1,13 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 name: CI - on: push: - branches: [ main, develop ] + branches: [main, develop] pull_request: - branches: [ main, develop ] + branches: [main, develop] workflow_dispatch: - jobs: test-powershell: name: Test PowerShell Scaffolder @@ -17,16 +15,13 @@ jobs: matrix: os: [windows-latest, ubuntu-latest, macos-latest] fail-fast: false - steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Setup PowerShell shell: pwsh run: | $PSVersionTable - - name: Test scaffolding (practitioner template) shell: pwsh run: | @@ -34,7 +29,6 @@ jobs: -ProjectName "TestPractitioner" ` -AuthorName "CI Test" ` -TemplateType practitioner - - name: Verify generated files (practitioner) shell: pwsh run: | @@ -54,14 +48,12 @@ jobs: } Write-Host "✓ Found: $file" } - - name: Test integrity verification (practitioner) shell: pwsh run: | ./init-zotero-rscript-plugin.ps1 ` -ProjectName "TestPractitioner" ` -VerifyIntegrity - - name: Test scaffolding (researcher template) shell: pwsh run: | @@ -69,7 +61,6 @@ jobs: -ProjectName "TestResearcher" ` -AuthorName "CI Test" ` -TemplateType researcher - - name: Verify generated files (researcher) shell: pwsh run: | @@ -86,7 +77,6 @@ jobs: } Write-Host "✓ Found: $file" } - - name: Test scaffolding (student template) shell: pwsh run: | @@ -94,7 +84,6 @@ jobs: -ProjectName "TestStudent" ` -AuthorName "CI Test" ` -TemplateType student - - name: Verify generated files (student) shell: pwsh run: | @@ -113,7 +102,6 @@ jobs: } Write-Host "✓ Found: $file" } - - name: Test GitInit functionality shell: pwsh run: | @@ -133,7 +121,6 @@ jobs: } Write-Host "✓ Found: $file" } - - name: Test variable substitution shell: pwsh run: | @@ -148,7 +135,6 @@ jobs: throw "AuthorName not substituted correctly" } Write-Host "✓ Variable substitution successful" - - name: Test integrity tamper detection shell: pwsh run: | @@ -169,7 +155,6 @@ jobs: throw "Integrity verification should have detected tampering" } Write-Host "✓ Tamper detection successful" - - name: Upload test artifacts if: always() uses: actions/upload-artifact@ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb # v4 @@ -181,7 +166,6 @@ jobs: TestStudent/ TestGitInit/ retention-days: 7 - test-racket: name: Test Racket Scaffolder runs-on: ${{ matrix.os }} @@ -191,24 +175,19 @@ jobs: os: [ubuntu-latest, macos-latest, windows-latest] racket-version: ['8.11', '8.12'] fail-fast: false - steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Setup Racket uses: Bogdanp/setup-racket@v1.10 with: version: ${{ matrix.racket-version }} distribution: 'full' - - name: Verify Racket installation run: racket --version - - name: Test Racket scaffolding (basic) run: | racket init-raczotbuild.rkt -n TestRacketPlugin -a "CI Test" - - name: Verify Racket generated files run: | test -f TestRacketPlugin/README.md || exit 1 @@ -217,23 +196,19 @@ jobs: test -d TestRacketPlugin/raczotbuild || exit 1 test -d TestRacketPlugin/templates || exit 1 echo "✓ All required files present" - - name: Test Racket scaffolding with git init run: | racket init-raczotbuild.rkt -n TestRacketGit -a "CI Test" -g - - name: Verify git initialization run: | test -d TestRacketGit/.git || exit 1 cd TestRacketGit git log --oneline | head -n 1 echo "✓ Git initialized successfully" - - name: Verify Racket code syntax run: | racket -e '(require "TestRacketPlugin/raczotbuild/main.rkt")' echo "✓ Generated Racket code is syntactically valid" - - name: Upload Racket test artifacts if: always() uses: actions/upload-artifact@ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb # v4 @@ -243,7 +218,6 @@ jobs: TestRacketPlugin/ TestRacketGit/ retention-days: 7 - test-bash: name: Test Bash Scaffolder runs-on: ${{ matrix.os }} @@ -252,28 +226,23 @@ jobs: matrix: os: [ubuntu-latest, macos-latest] fail-fast: false - steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Run Bash tests run: | chmod +x tests/bash-tests.sh bash tests/bash-tests.sh - - name: Test Bash scaffolding manually run: | chmod +x init-zotero-plugin.sh ./init-zotero-plugin.sh -n BashTestProject -a "CI Test" -t student - - name: Verify Bash generated files run: | test -f BashTestProject/README.md || exit 1 test -f BashTestProject/bootstrap.js || exit 1 test -f BashTestProject/audit-index.json || exit 1 echo "✓ Bash scaffolder generated files correctly" - - name: Upload Bash test artifacts if: always() uses: actions/upload-artifact@ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb # v4 @@ -281,21 +250,17 @@ jobs: name: test-bash-projects-${{ matrix.os }} path: BashTestProject/ retention-days: 7 - lint-powershell: name: Lint PowerShell runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Install PSScriptAnalyzer shell: pwsh run: | Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser - - name: Run PSScriptAnalyzer shell: pwsh run: | @@ -309,43 +274,35 @@ jobs: throw "PSScriptAnalyzer found $($results.Count) issue(s)" } Write-Host "✓ No PSScriptAnalyzer issues found" - lint-racket: name: Lint Racket runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Setup Racket uses: Bogdanp/setup-racket@v1.10 with: version: '8.12' distribution: 'full' - - name: Check Racket syntax run: | raco check init-raczotbuild.rkt echo "✓ Racket syntax check passed" - test-documentation: name: Test Documentation runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Check for broken links in README uses: gaurav-nelson/github-action-markdown-link-check@v1 with: use-quiet-mode: 'yes' config-file: '.github/workflows/markdown-link-check-config.json' continue-on-error: true - - name: Verify all required documentation exists run: | test -f README.md || exit 1 @@ -353,22 +310,18 @@ jobs: test -f CONTRIBUTING.md || exit 1 test -f LICENSE || exit 1 echo "✓ All required documentation files present" - - name: Check documentation formatting run: | # Check for consistent heading levels grep -E '^#{1,6} ' README.md > /dev/null || exit 1 echo "✓ README has proper heading structure" - security-scan: name: Security Scan runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Run Trivy security scanner uses: aquasecurity/trivy-action@master with: @@ -376,13 +329,11 @@ jobs: scan-ref: '.' format: 'sarif' output: 'trivy-results.sarif' - - name: Upload Trivy results to GitHub Security uses: github/codeql-action/upload-sarif@6624720a57d4c312633c7b953db2f2da5bcb4c3a # v3 if: always() with: sarif_file: 'trivy-results.sarif' - test-cross-platform-compatibility: name: Cross-Platform Compatibility runs-on: ${{ matrix.os }} @@ -390,11 +341,9 @@ jobs: strategy: matrix: os: [windows-latest, ubuntu-latest, macos-latest] - steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Test file path handling shell: pwsh run: | @@ -411,22 +360,18 @@ jobs: throw "No files generated" } echo "✓ Cross-platform file generation successful" - integration-test: name: Integration Test - Full Workflow runs-on: ubuntu-latest timeout-minutes: 15 needs: [test-powershell, test-racket] - steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Setup Node.js uses: actions/setup-node@49933ea5288caeca8642195f2b846b8bbe245a93 # v4 with: node-version: '20' - - name: Full workflow test (PowerShell) shell: pwsh run: | @@ -447,14 +392,12 @@ jobs: npm install npm run build echo "✓ Full workflow test passed" - status-check: name: Status Check runs-on: ubuntu-latest timeout-minutes: 15 needs: [test-powershell, test-racket, test-bash, lint-powershell, lint-racket, test-documentation, integration-test] if: always() - steps: - name: Check all jobs status run: | diff --git a/rescript-templater/.github/workflows/codeql.yml b/rescript-templater/.github/workflows/codeql.yml index d5d5893..7bc55f1 100644 --- a/rescript-templater/.github/workflows/codeql.yml +++ b/rescript-templater/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,10 +7,7 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - - permissions: read-all - jobs: analyze: runs-on: ubuntu-latest @@ -29,17 +25,14 @@ jobs: build-mode: none - language: ruby build-mode: none - steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - - name: Initialize CodeQL uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1 with: diff --git a/rescript-templater/.github/workflows/comprehensive-quality.yml b/rescript-templater/.github/workflows/comprehensive-quality.yml index d975e2b..b4d4792 100644 --- a/rescript-templater/.github/workflows/comprehensive-quality.yml +++ b/rescript-templater/.github/workflows/comprehensive-quality.yml @@ -6,7 +6,6 @@ on: pull_request: schedule: - cron: '0 5 * * 0' - jobs: # DEPENDABILITY - Stability and reliability dependability: @@ -27,7 +26,6 @@ jobs: # Check for proper error handling patterns PANICS=$(grep -rE "panic!|unwrap\(\)|expect\(" --include="*.rs" . 2>/dev/null | wc -l || echo "0") echo "Rust panics/unwraps: $PANICS" - # SECURITY - Multi-layer security scanning security: runs-on: ubuntu-latest @@ -48,7 +46,6 @@ jobs: - name: SAST scan uses: returntocorp/semgrep-action@v1 continue-on-error: true - # INTEROPERABILITY - API and format compatibility interoperability: runs-on: ubuntu-latest @@ -66,7 +63,6 @@ jobs: - name: Validate JSON/YAML schemas run: | find . -name "*.json" -exec python3 -m json.tool {} \; 2>/dev/null | head -5 || true - # VALIDATION - Input/output validation validation: runs-on: ubuntu-latest @@ -77,7 +73,6 @@ jobs: run: | VALIDATION=$(grep -rE "validate|sanitize|Schema|Validator" --include="*.rs" --include="*.res" --include="*.ex" . 2>/dev/null | wc -l || echo "0") echo "Validation patterns found: $VALIDATION" - # ATTESTATION - Supply chain integrity (SLSA) attestation: runs-on: ubuntu-latest @@ -98,7 +93,6 @@ jobs: if [ -f "CHECKSUMS.txt" ] || [ -f "SHA256SUMS" ]; then echo "✅ Checksums file present" fi - # VERIFICATION - Formal methods where applicable verification: runs-on: ubuntu-latest @@ -115,7 +109,6 @@ jobs: if [ -f "rescript.json" ]; then echo "ReScript provides 100% type coverage" fi - # FUNCTIONALITY - Feature completeness functionality: runs-on: ubuntu-latest @@ -129,7 +122,6 @@ jobs: - name: Check deprecated usage run: | grep -rn "deprecated\|DEPRECATED" . 2>/dev/null | head -10 || echo "No deprecations" - # PERFORMANCE - Benchmarks and profiling performance: runs-on: ubuntu-latest @@ -146,7 +138,6 @@ jobs: cargo build --release 2>/dev/null || true find target/release -maxdepth 1 -type f -executable -exec ls -lh {} \; 2>/dev/null || true fi - # ACCESSIBILITY - A11y compliance accessibility: runs-on: ubuntu-latest @@ -162,7 +153,6 @@ jobs: - name: Lighthouse (if web project) run: | echo "Lighthouse would run on deployed URL" - # LICENSE COMPLIANCE license: runs-on: ubuntu-latest @@ -181,7 +171,6 @@ jobs: run: | SPDX=$(grep -rE "SPDX-License-Identifier" . 2>/dev/null | wc -l || echo "0") echo "Files with SPDX headers: $SPDX" - # DOCUMENTATION QUALITY documentation: runs-on: ubuntu-latest diff --git a/rescript-templater/.github/workflows/guix-nix-policy.yml b/rescript-templater/.github/workflows/guix-nix-policy.yml index 08f5dcd..6b9d80b 100644 --- a/rescript-templater/.github/workflows/guix-nix-policy.yml +++ b/rescript-templater/.github/workflows/guix-nix-policy.yml @@ -1,9 +1,7 @@ # SPDX-License-Identifier: MPL-2.0 name: Guix/Nix Package Policy on: [push, pull_request] - permissions: read-all - jobs: check: runs-on: ubuntu-latest @@ -17,13 +15,13 @@ jobs: # Check for package manager files HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null | head -1) HAS_NIX=$(find . -name "*.nix" 2>/dev/null | head -1) - + # Block new package-lock.json, yarn.lock, Gemfile.lock, etc. NEW_LOCKS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E 'package-lock\.json|yarn\.lock|Gemfile\.lock|Pipfile\.lock|poetry\.lock|cargo\.lock' || true) if [ -n "$NEW_LOCKS" ]; then echo "⚠️ Lock files detected. Prefer Guix manifests for reproducibility." fi - + # Prefer Guix, fallback to Nix if [ -n "$HAS_GUIX" ]; then echo "✅ Guix package management detected (primary)" @@ -32,5 +30,5 @@ jobs: else echo "ℹ️ Consider adding guix.scm or flake.nix for reproducible builds" fi - + echo "✅ Package policy check passed" diff --git a/rescript-templater/.github/workflows/hypatia-scan.yml b/rescript-templater/.github/workflows/hypatia-scan.yml index 49e830d..c3cb66b 100644 --- a/rescript-templater/.github/workflows/hypatia-scan.yml +++ b/rescript-templater/.github/workflows/hypatia-scan.yml @@ -1,42 +1,35 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: read-all - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) working-directory: ${{ env.HOME }}/hypatia run: | @@ -47,7 +40,6 @@ jobs: mix escript.build mv hypatia ../hypatia-v2 fi - - name: Run Hypatia scan id: scan run: | @@ -74,35 +66,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -110,7 +86,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -144,37 +119,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});\n" diff --git a/rescript-templater/.github/workflows/instant-sync.yml b/rescript-templater/.github/workflows/instant-sync.yml index 62a0f3e..42ffeaf 100644 --- a/rescript-templater/.github/workflows/instant-sync.yml +++ b/rescript-templater/.github/workflows/instant-sync.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync - on: push: branches: [main, master] release: types: [published] - permissions: contents: read - jobs: dispatch: runs-on: ubuntu-latest @@ -29,6 +26,5 @@ jobs: "sha": "${{ github.sha }}", "forges": "" } - - name: Confirm run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}" diff --git a/rescript-templater/.github/workflows/jekyll-gh-pages.yml b/rescript-templater/.github/workflows/jekyll-gh-pages.yml index 0509012..9dcb09a 100644 --- a/rescript-templater/.github/workflows/jekyll-gh-pages.yml +++ b/rescript-templater/.github/workflows/jekyll-gh-pages.yml @@ -1,27 +1,22 @@ # SPDX-License-Identifier: MPL-2.0 # Sample workflow for building and deploying a Jekyll site to GitHub Pages name: Deploy Jekyll with GitHub Pages dependencies preinstalled - on: # Runs on pushes targeting the default branch push: branches: ["main"] - # Allows you to run this workflow manually from the Actions tab workflow_dispatch: - # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages permissions: contents: read pages: write id-token: write - # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. concurrency: group: "pages" cancel-in-progress: false - jobs: # Build job build: @@ -39,7 +34,6 @@ jobs: destination: ./_site - name: Upload artifact uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 - # Deployment job deploy: environment: diff --git a/rescript-templater/.github/workflows/mirror.yml b/rescript-templater/.github/workflows/mirror.yml index f5c9bb4..cbb4944 100644 --- a/rescript-templater/.github/workflows/mirror.yml +++ b/rescript-templater/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: read-all - jobs: mirror-gitlab: runs-on: ubuntu-latest @@ -18,17 +15,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} - - name: Mirror to GitLab run: | ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitlab main - mirror-bitbucket: runs-on: ubuntu-latest timeout-minutes: 15 @@ -37,17 +31,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} - - name: Mirror to Bitbucket run: | ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force bitbucket main - mirror-codeberg: runs-on: ubuntu-latest timeout-minutes: 15 @@ -56,17 +47,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} - - name: Mirror to Codeberg run: | ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force codeberg main - mirror-sourcehut: runs-on: ubuntu-latest timeout-minutes: 15 @@ -75,17 +63,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} - - name: Mirror to SourceHut run: | ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true git push --force sourcehut main - mirror-disroot: runs-on: ubuntu-latest timeout-minutes: 15 @@ -94,17 +79,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} - - name: Mirror to Disroot run: | ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force disroot main - mirror-gitea: runs-on: ubuntu-latest timeout-minutes: 15 @@ -113,17 +95,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} - - name: Mirror to Gitea run: | ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitea main - mirror-radicle: runs-on: ubuntu-latest timeout-minutes: 15 @@ -132,18 +111,15 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - name: Setup Rust uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # stable with: toolchain: stable - - name: Install Radicle run: | # Install via cargo (safer than curl|sh) cargo install radicle-cli --locked echo "$HOME/.cargo/bin" >> $GITHUB_PATH - - name: Mirror to Radicle run: | echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle diff --git a/rescript-templater/.github/workflows/npm-bun-blocker.yml b/rescript-templater/.github/workflows/npm-bun-blocker.yml index c09f904..929c37f 100644 --- a/rescript-templater/.github/workflows/npm-bun-blocker.yml +++ b/rescript-templater/.github/workflows/npm-bun-blocker.yml @@ -1,9 +1,7 @@ # SPDX-License-Identifier: MPL-2.0 name: NPM/Bun Blocker on: [push, pull_request] - permissions: read-all - jobs: check: runs-on: ubuntu-latest diff --git a/rescript-templater/.github/workflows/publish.yml b/rescript-templater/.github/workflows/publish.yml index 13d2e2b..05da8fd 100644 --- a/rescript-templater/.github/workflows/publish.yml +++ b/rescript-templater/.github/workflows/publish.yml @@ -1,9 +1,7 @@ # SPDX-License-Identifier: MPL-2.0 name: Publish Packages - # Workflow for publishing to package repositories # Triggered manually or on release creation - on: release: types: [published] @@ -24,11 +22,9 @@ on: description: 'Trigger Zenodo archival' type: boolean default: false - permissions: contents: read - packages: write # For GitHub Container Registry - + packages: write # For GitHub Container Registry jobs: validate: name: Pre-Publish Validation @@ -37,22 +33,18 @@ jobs: steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Setup PowerShell uses: actions/setup-dotnet@v4 with: dotnet-version: '8.0.x' - - name: Install PowerShell run: | dotnet tool install --global PowerShell - - name: Install Pester shell: pwsh run: | Install-Module -Name Pester -Force -Scope CurrentUser -AcceptLicense Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser - - name: Setup Racket uses: Bogdanp/setup-racket@v1.11 with: @@ -61,7 +53,6 @@ jobs: dest: '/opt/racket' local_catalogs: '' architecture: 'x64' - - name: Run full validation shell: pwsh run: | @@ -71,7 +62,6 @@ jobs: # Run linters Invoke-ScriptAnalyzer -Path ./init-zotero-rscript-plugin.ps1 -Settings PSGallery -Severity Warning,Error - - name: Validate manifests shell: pwsh run: | @@ -93,7 +83,6 @@ jobs: exit 1 } } - publish-psgallery: name: Publish to PowerShell Gallery needs: validate @@ -105,16 +94,13 @@ jobs: steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Setup PowerShell uses: actions/setup-dotnet@v4 with: dotnet-version: '8.0.x' - - name: Install PowerShell run: | dotnet tool install --global PowerShell - - name: Publish to PowerShell Gallery shell: pwsh env: @@ -133,7 +119,6 @@ jobs: Publish-Module -Path . -NuGetApiKey $env:PSGALLERY_API_KEY -Verbose Write-Host "✅ Successfully published to PowerShell Gallery" - - name: Verify publication shell: pwsh run: | @@ -148,7 +133,6 @@ jobs: } else { Write-Warning "Package not yet indexed (may take a few minutes)" } - publish-container: name: Publish Container Image needs: validate @@ -160,20 +144,16 @@ jobs: steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Set up QEMU uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - - name: Log in to GitHub Container Registry uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - name: Extract metadata id: meta uses: docker/metadata-action@v5 @@ -185,7 +165,6 @@ jobs: type=semver,pattern={{major}} type=raw,value=latest,enable={{is_default_branch}} type=sha,prefix={{branch}}- - - name: Build and push container image uses: docker/build-push-action@v5 with: @@ -197,20 +176,17 @@ jobs: labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max - - name: Generate SBOM uses: anchore/sbom-action@v0 with: image: ghcr.io/${{ github.repository }}:latest format: spdx-json output-file: sbom.spdx.json - - name: Upload SBOM uses: actions/upload-artifact@ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb # v4 with: name: container-sbom path: sbom.spdx.json - trigger-zenodo: name: Trigger Zenodo Archival needs: validate @@ -230,7 +206,6 @@ jobs: echo "" echo "Once enabled, this release will be automatically archived with a DOI." echo "DOI will be available at: https://doi.org/10.5281/zenodo.XXXXXX" - software-heritage: name: Archive to Software Heritage needs: validate @@ -255,7 +230,6 @@ jobs: echo "" echo "View archive at:" echo "https://archive.softwareheritage.org/browse/origin/?origin_url=${{ github.server_url }}/${{ github.repository }}" - notify: name: Notify Release needs: [publish-psgallery, publish-container, trigger-zenodo, software-heritage] @@ -264,45 +238,7 @@ jobs: if: always() && github.event_name == 'release' steps: - name: Create release summary - run: | - echo "## 📦 Package Publication Summary" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "**Release**: ${{ github.event.release.tag_name }}" >> $GITHUB_STEP_SUMMARY - echo "**Date**: $(date -u +'%Y-%m-%d %H:%M:%S UTC')" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - - echo "### Distribution Channels" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "- ✅ **GitHub Releases**: https://github.com/${{ github.repository }}/releases/tag/${{ github.event.release.tag_name }}" >> $GITHUB_STEP_SUMMARY - echo "- ✅ **Container Registry**: ghcr.io/${{ github.repository }}" >> $GITHUB_STEP_SUMMARY - echo "- 🔄 **PowerShell Gallery**: https://www.powershellgallery.com/packages/ZoteroReScriptTemplater" >> $GITHUB_STEP_SUMMARY - echo "- 🔄 **Racket Packages**: https://pkgs.racket-lang.org/package/zotero-rescript-templater" >> $GITHUB_STEP_SUMMARY - echo "- 🔄 **Software Heritage**: https://archive.softwareheritage.org/" >> $GITHUB_STEP_SUMMARY - echo "- 🔄 **Zenodo**: https://zenodo.org/ (if configured)" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - - echo "### Installation Methods" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "**PowerShell**:" >> $GITHUB_STEP_SUMMARY - echo '```powershell' >> $GITHUB_STEP_SUMMARY - echo "Install-Module -Name ZoteroReScriptTemplater" >> $GITHUB_STEP_SUMMARY - echo '```' >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "**Racket**:" >> $GITHUB_STEP_SUMMARY - echo '```bash' >> $GITHUB_STEP_SUMMARY - echo "raco pkg install zotero-rescript-templater" >> $GITHUB_STEP_SUMMARY - echo '```' >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "**Container**:" >> $GITHUB_STEP_SUMMARY - echo '```bash' >> $GITHUB_STEP_SUMMARY - echo "podman pull ghcr.io/${{ github.repository }}:${{ github.event.release.tag_name }}" >> $GITHUB_STEP_SUMMARY - echo '```' >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "**Nix**:" >> $GITHUB_STEP_SUMMARY - echo '```bash' >> $GITHUB_STEP_SUMMARY - echo "nix run github:${{ github.repository }}" >> $GITHUB_STEP_SUMMARY - echo '```' >> $GITHUB_STEP_SUMMARY - + run: "echo \"## \U0001F4E6 Package Publication Summary\" >> $GITHUB_STEP_SUMMARY\necho \"\" >> $GITHUB_STEP_SUMMARY\necho \"**Release**: ${{ github.event.release.tag_name }}\" >> $GITHUB_STEP_SUMMARY\necho \"**Date**: $(date -u +'%Y-%m-%d %H:%M:%S UTC')\" >> $GITHUB_STEP_SUMMARY\necho \"\" >> $GITHUB_STEP_SUMMARY\n\necho \"### Distribution Channels\" >> $GITHUB_STEP_SUMMARY\necho \"\" >> $GITHUB_STEP_SUMMARY\necho \"- ✅ **GitHub Releases**: https://github.com/${{ github.repository }}/releases/tag/${{ github.event.release.tag_name }}\" >> $GITHUB_STEP_SUMMARY\necho \"- ✅ **Container Registry**: ghcr.io/${{ github.repository }}\" >> $GITHUB_STEP_SUMMARY\necho \"- \U0001F504 **PowerShell Gallery**: https://www.powershellgallery.com/packages/ZoteroReScriptTemplater\" >> $GITHUB_STEP_SUMMARY\necho \"- \U0001F504 **Racket Packages**: https://pkgs.racket-lang.org/package/zotero-rescript-templater\" >> $GITHUB_STEP_SUMMARY\necho \"- \U0001F504 **Software Heritage**: https://archive.softwareheritage.org/\" >> $GITHUB_STEP_SUMMARY\necho \"- \U0001F504 **Zenodo**: https://zenodo.org/ (if configured)\" >> $GITHUB_STEP_SUMMARY\necho \"\" >> $GITHUB_STEP_SUMMARY\n\necho \"### Installation Methods\" >> $GITHUB_STEP_SUMMARY\necho \"\" >> $GITHUB_STEP_SUMMARY\necho \"**PowerShell**:\" >> $GITHUB_STEP_SUMMARY\necho '```powershell' >> $GITHUB_STEP_SUMMARY\necho \"Install-Module -Name ZoteroReScriptTemplater\" >> $GITHUB_STEP_SUMMARY\necho '```' >> $GITHUB_STEP_SUMMARY\necho \"\" >> $GITHUB_STEP_SUMMARY\necho \"**Racket**:\" >> $GITHUB_STEP_SUMMARY\necho '```bash' >> $GITHUB_STEP_SUMMARY\necho \"raco pkg install zotero-rescript-templater\" >> $GITHUB_STEP_SUMMARY\necho '```' >> $GITHUB_STEP_SUMMARY\necho \"\" >> $GITHUB_STEP_SUMMARY\necho \"**Container**:\" >> $GITHUB_STEP_SUMMARY\necho '```bash' >> $GITHUB_STEP_SUMMARY\necho \"podman pull ghcr.io/${{ github.repository }}:${{ github.event.release.tag_name }}\" >> $GITHUB_STEP_SUMMARY\necho '```' >> $GITHUB_STEP_SUMMARY\necho \"\" >> $GITHUB_STEP_SUMMARY\necho \"**Nix**:\" >> $GITHUB_STEP_SUMMARY\necho '```bash' >> $GITHUB_STEP_SUMMARY\necho \"nix run github:${{ github.repository }}\" >> $GITHUB_STEP_SUMMARY\necho '```' >> $GITHUB_STEP_SUMMARY\n" # Documentation for secrets required: # # PSGALLERY_API_KEY: diff --git a/rescript-templater/.github/workflows/quality.yml b/rescript-templater/.github/workflows/quality.yml index da3c617..6ed3c13 100644 --- a/rescript-templater/.github/workflows/quality.yml +++ b/rescript-templater/.github/workflows/quality.yml @@ -1,10 +1,7 @@ # SPDX-License-Identifier: MPL-2.0 name: Code Quality on: [push, pull_request] - - permissions: read-all - jobs: lint: runs-on: ubuntu-latest @@ -13,11 +10,9 @@ jobs: contents: read steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - name: Check file permissions run: | find . -type f -perm /111 -name "*.sh" | head -10 || true - - name: Check for secrets uses: trufflesecurity/trufflehog@05cccb53bc9e13bc6d17997db5a6bcc3df44bf2f # v3.92.3 with: @@ -25,20 +20,16 @@ jobs: base: ${{ github.event.pull_request.base.sha || github.event.before }} head: ${{ github.sha }} continue-on-error: true - - name: Check TODO/FIXME run: | echo "=== TODOs ===" grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.res" --include="*.py" --include="*.ex" . | head -20 || echo "None found" - - name: Check for large files run: | find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files" - - name: EditorConfig check uses: editorconfig-checker/action-editorconfig-checker@4b6cd6190d435e7e084fb35e36a096e98506f7b9 # v2.1.0 continue-on-error: true - docs: runs-on: ubuntu-latest timeout-minutes: 15 @@ -52,7 +43,7 @@ jobs: [ ! -f "README.md" ] && [ ! -f "README.adoc" ] && MISSING="$MISSING README" [ ! -f "LICENSE" ] && [ ! -f "LICENSE.txt" ] && [ ! -f "LICENSE.md" ] && MISSING="$MISSING LICENSE" [ ! -f "CONTRIBUTING.md" ] && [ ! -f "CONTRIBUTING.adoc" ] && MISSING="$MISSING CONTRIBUTING" - + if [ -n "$MISSING" ]; then echo "::warning::Missing docs:$MISSING" else diff --git a/rescript-templater/.github/workflows/release.yml b/rescript-templater/.github/workflows/release.yml index b680f0f..bd780d9 100644 --- a/rescript-templater/.github/workflows/release.yml +++ b/rescript-templater/.github/workflows/release.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: Release - on: push: tags: @@ -10,7 +9,6 @@ on: version: description: 'Version to release (e.g., v1.0.0)' required: true - jobs: create-release: name: Create Release @@ -18,13 +16,11 @@ jobs: timeout-minutes: 15 permissions: contents: write - steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 with: fetch-depth: 0 - - name: Extract version id: version run: | @@ -35,7 +31,6 @@ jobs: fi echo "version=$VERSION" >> $GITHUB_OUTPUT echo "Version: $VERSION" - - name: Generate changelog id: changelog run: | @@ -53,7 +48,6 @@ jobs: echo "Generated release notes:" cat release_notes.txt - - name: Create package archives run: | mkdir -p dist @@ -86,7 +80,6 @@ jobs: cd dist sha256sum * > SHA256SUMS.txt cat SHA256SUMS.txt - - name: Create GitHub Release uses: softprops/action-gh-release@v1 with: @@ -100,7 +93,6 @@ jobs: dist/SHA256SUMS.txt env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - test-release-artifacts: name: Test Release Artifacts needs: create-release @@ -109,7 +101,6 @@ jobs: strategy: matrix: os: [windows-latest, ubuntu-latest, macos-latest] - steps: - name: Download PowerShell artifact run: | @@ -117,7 +108,6 @@ jobs: curl -L -o package.zip \ "https://github.com/${{ github.repository }}/releases/download/$VERSION/zotero-rescript-templater-powershell-$VERSION.zip" unzip package.zip - - name: Test PowerShell package shell: pwsh run: | @@ -130,30 +120,25 @@ jobs: throw "Release artifact test failed" } Write-Host "✓ Release artifact works correctly" - publish-to-registry: name: Publish to Package Registries needs: create-release runs-on: ubuntu-latest timeout-minutes: 15 if: startsWith(github.ref, 'refs/tags/v') - steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Setup Racket uses: Bogdanp/setup-racket@v1.10 with: version: '8.12' - - name: Publish to Racket Package Catalog run: | # This would publish to https://pkgs.racket-lang.org/ # Requires setup and authentication echo "Racket package publication would happen here" # raco pkg install --link $(pwd) - - name: Publish to PowerShell Gallery shell: pwsh env: @@ -166,20 +151,17 @@ jobs: } Publish-Module -Path . -NuGetApiKey $env:PSGALLERY_API_KEY -Verbose Write-Host "✅ Published to PowerShell Gallery" - notify: name: Notify Release needs: [create-release, test-release-artifacts] runs-on: ubuntu-latest timeout-minutes: 15 if: always() - steps: - name: Notify success if: needs.test-release-artifacts.result == 'success' run: | echo "✅ Release ${{ needs.create-release.outputs.version }} completed successfully" - - name: Notify failure if: needs.test-release-artifacts.result == 'failure' run: | diff --git a/rescript-templater/.github/workflows/rsr-antipattern.yml b/rescript-templater/.github/workflows/rsr-antipattern.yml index c581aef..2df4715 100644 --- a/rescript-templater/.github/workflows/rsr-antipattern.yml +++ b/rescript-templater/.github/workflows/rsr-antipattern.yml @@ -2,15 +2,12 @@ # RSR Anti-Pattern Check - Uses reusable workflow from standards name: RSR Anti-Pattern Check - on: push: branches: [main, master, develop] pull_request: branches: [main, master, develop] - jobs: antipattern-check: uses: hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml@main timeout-minutes: 10 - diff --git a/rescript-templater/.github/workflows/scorecard-enforcer.yml b/rescript-templater/.github/workflows/scorecard-enforcer.yml index b83315a..d4eb19d 100644 --- a/rescript-templater/.github/workflows/scorecard-enforcer.yml +++ b/rescript-templater/.github/workflows/scorecard-enforcer.yml @@ -1,40 +1,34 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores name: OpenSSF Scorecard Enforcer - on: push: branches: [main] schedule: - - cron: '0 6 * * 1' # Weekly on Monday + - cron: '0 6 * * 1' # Weekly on Monday workflow_dispatch: - permissions: read-all - jobs: scorecard: runs-on: ubuntu-latest timeout-minutes: 15 permissions: security-events: write - id-token: write # For OIDC + id-token: write # For OIDC steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 with: results_file: results.sarif results_format: sarif publish_results: true - - name: Upload SARIF uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3 with: sarif_file: results.sarif - - name: Check minimum score run: | # Parse score from results @@ -49,21 +43,18 @@ jobs: echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE" exit 1 fi - # Check specific high-priority items check-critical: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - name: Check SECURITY.md exists run: | if [ ! -f "SECURITY.md" ]; then echo "::error::SECURITY.md is required" exit 1 fi - - name: Check for pinned dependencies run: | # Check workflows for unpinned actions diff --git a/rescript-templater/.github/workflows/scorecard.yml b/rescript-templater/.github/workflows/scorecard.yml index 8e2ce1b..f5f8980 100644 --- a/rescript-templater/.github/workflows/scorecard.yml +++ b/rescript-templater/.github/workflows/scorecard.yml @@ -6,9 +6,7 @@ on: schedule: - cron: '0 4 * * *' workflow_dispatch: - permissions: read-all - jobs: analysis: runs-on: ubuntu-latest @@ -20,13 +18,11 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.3.1 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.31.8 with: diff --git a/rescript-templater/.github/workflows/secret-scanner.yml b/rescript-templater/.github/workflows/secret-scanner.yml index 4df01cb..3afb768 100644 --- a/rescript-templater/.github/workflows/secret-scanner.yml +++ b/rescript-templater/.github/workflows/secret-scanner.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - scans for hardcoded secrets before they reach main name: Secret Scanner - on: pull_request: push: branches: [main] - permissions: read-all - jobs: trufflehog: runs-on: ubuntu-latest @@ -16,26 +13,11 @@ jobs: steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for scanning - + fetch-depth: 0 # Full history for scanning - name: TruffleHog Secret Scan uses: trufflesecurity/trufflehog@8a8ef8526528d8a4ff3e2c90be08e25ef8efbd9b # v3 with: extra_args: --only-verified --fail - - gitleaks: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest @@ -43,7 +25,6 @@ jobs: if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - name: Check for hardcoded secrets in Rust run: | # Patterns that suggest hardcoded secrets diff --git a/rescript-templater/.github/workflows/security-policy.yml b/rescript-templater/.github/workflows/security-policy.yml index 498eaa5..ae3ecb1 100644 --- a/rescript-templater/.github/workflows/security-policy.yml +++ b/rescript-templater/.github/workflows/security-policy.yml @@ -1,9 +1,7 @@ # SPDX-License-Identifier: MPL-2.0 name: Security Policy on: [push, pull_request] - permissions: read-all - jobs: check: runs-on: ubuntu-latest @@ -15,30 +13,30 @@ jobs: - name: Security checks run: | FAILED=false - + # Block MD5/SHA1 for security (allow for checksums/caching) WEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true) if [ -n "$WEAK_CRYPTO" ]; then echo "⚠️ Weak crypto (MD5/SHA1) detected. Use SHA256+ for security:" echo "$WEAK_CRYPTO" fi - + # Block HTTP URLs (except localhost) HTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true) if [ -n "$HTTP_URLS" ]; then echo "⚠️ HTTP URLs found. Use HTTPS:" echo "$HTTP_URLS" fi - + # Block hardcoded secrets patterns SECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true) if [ -n "$SECRETS" ]; then echo "❌ Potential hardcoded secrets detected!" FAILED=true fi - + if [ "$FAILED" = true ]; then exit 1 fi - + echo "✅ Security policy check passed" diff --git a/rescript-templater/.github/workflows/ts-blocker.yml b/rescript-templater/.github/workflows/ts-blocker.yml index eabfd8e..40a469c 100644 --- a/rescript-templater/.github/workflows/ts-blocker.yml +++ b/rescript-templater/.github/workflows/ts-blocker.yml @@ -1,9 +1,7 @@ # SPDX-License-Identifier: MPL-2.0 name: TypeScript/JavaScript Blocker on: [push, pull_request] - permissions: read-all - jobs: check: runs-on: ubuntu-latest @@ -16,7 +14,7 @@ jobs: run: | NEW_TS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(ts|tsx)$' | grep -v '\.gen\.' || true) NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true) - + if [ -n "$NEW_TS" ] || [ -n "$NEW_JS" ]; then echo "❌ New TS/JS files detected. Use ReScript instead." [ -n "$NEW_TS" ] && echo "$NEW_TS" diff --git a/rescript-templater/.github/workflows/wellknown-enforcement.yml b/rescript-templater/.github/workflows/wellknown-enforcement.yml index d009606..f68e86d 100644 --- a/rescript-templater/.github/workflows/wellknown-enforcement.yml +++ b/rescript-templater/.github/workflows/wellknown-enforcement.yml @@ -13,10 +13,7 @@ on: # Weekly expiry check - cron: '0 9 * * *' workflow_dispatch: - - permissions: read-all - jobs: validate: runs-on: ubuntu-latest @@ -25,27 +22,26 @@ jobs: contents: read steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - name: RFC 9116 security.txt validation run: | SECTXT="" [ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt" [ -f "security.txt" ] && SECTXT="security.txt" - + if [ -z "$SECTXT" ]; then echo "::warning::No security.txt found. See https://github.com/hyperpolymath/well-known-ecosystem" exit 0 fi - + # Required: Contact grep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; } - + # Required: Expires if ! grep -q "^Expires:" "$SECTXT"; then echo "::error::Missing Expires field" exit 1 fi - + # Check expiry EXPIRES=$(grep "^Expires:" "$SECTXT" | cut -d: -f2- | tr -d ' ' | head -1) if date -d "$EXPIRES" > /dev/null 2>&1; then @@ -59,21 +55,19 @@ jobs: echo "✅ security.txt valid ($DAYS days)" fi fi - - name: RSR well-known compliance run: | MISSING="" [ ! -f ".well-known/security.txt" ] && [ ! -f "security.txt" ] && MISSING="$MISSING security.txt" [ ! -f ".well-known/ai.txt" ] && MISSING="$MISSING ai.txt" [ ! -f ".well-known/humans.txt" ] && MISSING="$MISSING humans.txt" - + if [ -n "$MISSING" ]; then echo "::warning::Missing RSR recommended files:$MISSING" echo "Reference: https://github.com/hyperpolymath/well-known-ecosystem/.well-known/" else echo "✅ RSR well-known compliant" fi - - name: Mixed content check run: | MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com' | head -5 || true) @@ -83,7 +77,6 @@ jobs: exit 1 fi echo "✅ No mixed content" - - name: DNS security records check if: hashFiles('CNAME') != '' run: | diff --git a/rescript-templater/.github/workflows/workflow-linter.yml b/rescript-templater/.github/workflows/workflow-linter.yml index a2438e7..2d6df35 100644 --- a/rescript-templater/.github/workflows/workflow-linter.yml +++ b/rescript-templater/.github/workflows/workflow-linter.yml @@ -2,7 +2,6 @@ # workflow-linter.yml - Validates GitHub workflows against RSR security standards # This workflow can be copied to other repos for consistent enforcement name: Workflow Security Linter - on: push: paths: @@ -11,20 +10,16 @@ on: paths: - '.github/workflows/**' workflow_dispatch: - permissions: read-all - jobs: lint-workflows: runs-on: ubuntu-latest timeout-minutes: 15 permissions: contents: read - steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - - name: Check SPDX Headers run: | echo "=== Checking SPDX License Headers ===" @@ -41,7 +36,6 @@ jobs: exit 1 fi echo "All workflows have SPDX headers" - - name: Check Permissions Declaration run: | echo "=== Checking Permissions ===" @@ -58,7 +52,6 @@ jobs: exit 1 fi echo "All workflows have permissions declared" - - name: Check SHA-Pinned Actions run: | echo "=== Checking Action Pinning ===" @@ -77,7 +70,6 @@ jobs: exit 1 fi echo "All actions are SHA-pinned" - - name: Check for Duplicate Workflows run: | echo "=== Checking for Duplicates ===" @@ -92,7 +84,6 @@ jobs: echo "Consider consolidating rust.yml and rust-ci.yml" fi echo "No critical duplicates found" - - name: Check CodeQL Language Matrix run: | echo "=== Checking CodeQL Configuration ===" @@ -132,7 +123,6 @@ jobs: fi echo "CodeQL check complete" - - name: Check Secrets Guards run: | echo "=== Checking Secrets Usage ===" @@ -146,7 +136,6 @@ jobs: fi fi echo "Secrets check complete" - - name: Summary run: | echo "" diff --git a/rescript-templater/Justfile b/rescript-templater/Justfile index 5fb4de2..8ead80b 100644 --- a/rescript-templater/Justfile +++ b/rescript-templater/Justfile @@ -322,3 +322,6 @@ help-extended: @echo " README.md # Project overview" @echo " CONTRIBUTING.md # Contribution guide" @echo " RSR_COMPLIANCE.md # RSR framework compliance" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/safe-storage/.github/workflows/codeql.yml b/safe-storage/.github/workflows/codeql.yml index b8d1fd6..21f2cc9 100644 --- a/safe-storage/.github/workflows/codeql.yml +++ b/safe-storage/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,10 +7,7 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - - permissions: read-all - jobs: analyze: runs-on: ubuntu-latest @@ -25,17 +21,14 @@ jobs: include: - language: javascript-typescript build-mode: none - steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - - name: Initialize CodeQL uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1 with: diff --git a/safe-storage/.github/workflows/governance.yml b/safe-storage/.github/workflows/governance.yml index a044174..60e8e90 100644 --- a/safe-storage/.github/workflows/governance.yml +++ b/safe-storage/.github/workflows/governance.yml @@ -11,16 +11,13 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/safe-storage/.github/workflows/hypatia-scan.yml b/safe-storage/.github/workflows/hypatia-scan.yml index 49e830d..c3cb66b 100644 --- a/safe-storage/.github/workflows/hypatia-scan.yml +++ b/safe-storage/.github/workflows/hypatia-scan.yml @@ -1,42 +1,35 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: read-all - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) working-directory: ${{ env.HOME }}/hypatia run: | @@ -47,7 +40,6 @@ jobs: mix escript.build mv hypatia ../hypatia-v2 fi - - name: Run Hypatia scan id: scan run: | @@ -74,35 +66,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -110,7 +86,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -144,37 +119,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});\n" diff --git a/safe-storage/.github/workflows/mirror.yml b/safe-storage/.github/workflows/mirror.yml index f5c9bb4..cbb4944 100644 --- a/safe-storage/.github/workflows/mirror.yml +++ b/safe-storage/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: read-all - jobs: mirror-gitlab: runs-on: ubuntu-latest @@ -18,17 +15,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} - - name: Mirror to GitLab run: | ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitlab main - mirror-bitbucket: runs-on: ubuntu-latest timeout-minutes: 15 @@ -37,17 +31,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} - - name: Mirror to Bitbucket run: | ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force bitbucket main - mirror-codeberg: runs-on: ubuntu-latest timeout-minutes: 15 @@ -56,17 +47,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} - - name: Mirror to Codeberg run: | ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force codeberg main - mirror-sourcehut: runs-on: ubuntu-latest timeout-minutes: 15 @@ -75,17 +63,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} - - name: Mirror to SourceHut run: | ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true git push --force sourcehut main - mirror-disroot: runs-on: ubuntu-latest timeout-minutes: 15 @@ -94,17 +79,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} - - name: Mirror to Disroot run: | ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force disroot main - mirror-gitea: runs-on: ubuntu-latest timeout-minutes: 15 @@ -113,17 +95,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} - - name: Mirror to Gitea run: | ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitea main - mirror-radicle: runs-on: ubuntu-latest timeout-minutes: 15 @@ -132,18 +111,15 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - name: Setup Rust uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # stable with: toolchain: stable - - name: Install Radicle run: | # Install via cargo (safer than curl|sh) cargo install radicle-cli --locked echo "$HOME/.cargo/bin" >> $GITHUB_PATH - - name: Mirror to Radicle run: | echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle diff --git a/safe-storage/.github/workflows/scorecard.yml b/safe-storage/.github/workflows/scorecard.yml index 8e2ce1b..f5f8980 100644 --- a/safe-storage/.github/workflows/scorecard.yml +++ b/safe-storage/.github/workflows/scorecard.yml @@ -6,9 +6,7 @@ on: schedule: - cron: '0 4 * * *' workflow_dispatch: - permissions: read-all - jobs: analysis: runs-on: ubuntu-latest @@ -20,13 +18,11 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.3.1 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.31.8 with: diff --git a/safe-storage/.github/workflows/secret-scanner.yml b/safe-storage/.github/workflows/secret-scanner.yml index 4df01cb..3afb768 100644 --- a/safe-storage/.github/workflows/secret-scanner.yml +++ b/safe-storage/.github/workflows/secret-scanner.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - scans for hardcoded secrets before they reach main name: Secret Scanner - on: pull_request: push: branches: [main] - permissions: read-all - jobs: trufflehog: runs-on: ubuntu-latest @@ -16,26 +13,11 @@ jobs: steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for scanning - + fetch-depth: 0 # Full history for scanning - name: TruffleHog Secret Scan uses: trufflesecurity/trufflehog@8a8ef8526528d8a4ff3e2c90be08e25ef8efbd9b # v3 with: extra_args: --only-verified --fail - - gitleaks: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest @@ -43,7 +25,6 @@ jobs: if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - name: Check for hardcoded secrets in Rust run: | # Patterns that suggest hardcoded secrets diff --git a/safe-storage/Justfile b/safe-storage/Justfile index f975710..33692b6 100644 --- a/safe-storage/Justfile +++ b/safe-storage/Justfile @@ -25,3 +25,6 @@ lint: # Clean build artifacts clean: @echo "Clean not configured yet" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/voyant-export/.github/workflows/codeql.yml b/voyant-export/.github/workflows/codeql.yml index 74c318a..bc3fae4 100644 --- a/voyant-export/.github/workflows/codeql.yml +++ b/voyant-export/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0-or-later name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,10 +7,7 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - - permissions: read-all - jobs: analyze: runs-on: ubuntu-latest @@ -25,17 +21,14 @@ jobs: include: - language: javascript-typescript build-mode: none - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Initialize CodeQL uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1 with: diff --git a/voyant-export/.github/workflows/comprehensive-quality.yml b/voyant-export/.github/workflows/comprehensive-quality.yml index 9552a28..fc68e53 100644 --- a/voyant-export/.github/workflows/comprehensive-quality.yml +++ b/voyant-export/.github/workflows/comprehensive-quality.yml @@ -6,7 +6,6 @@ on: pull_request: schedule: - cron: '0 5 * * 0' - jobs: # DEPENDABILITY - Stability and reliability dependability: @@ -27,7 +26,6 @@ jobs: # Check for proper error handling patterns PANICS=$(grep -rE "panic!|unwrap\(\)|expect\(" --include="*.rs" . 2>/dev/null | wc -l || echo "0") echo "Rust panics/unwraps: $PANICS" - # SECURITY - Multi-layer security scanning security: runs-on: ubuntu-latest @@ -48,7 +46,6 @@ jobs: - name: SAST scan uses: returntocorp/semgrep-action@v1 continue-on-error: true - # INTEROPERABILITY - API and format compatibility interoperability: runs-on: ubuntu-latest @@ -66,7 +63,6 @@ jobs: - name: Validate JSON/YAML schemas run: | find . -name "*.json" -exec python3 -m json.tool {} \; 2>/dev/null | head -5 || true - # VALIDATION - Input/output validation validation: runs-on: ubuntu-latest @@ -77,7 +73,6 @@ jobs: run: | VALIDATION=$(grep -rE "validate|sanitize|Schema|Validator" --include="*.rs" --include="*.res" --include="*.ex" . 2>/dev/null | wc -l || echo "0") echo "Validation patterns found: $VALIDATION" - # ATTESTATION - Supply chain integrity (SLSA) attestation: runs-on: ubuntu-latest @@ -98,7 +93,6 @@ jobs: if [ -f "CHECKSUMS.txt" ] || [ -f "SHA256SUMS" ]; then echo "✅ Checksums file present" fi - # VERIFICATION - Formal methods where applicable verification: runs-on: ubuntu-latest @@ -115,7 +109,6 @@ jobs: if [ -f "rescript.json" ]; then echo "ReScript provides 100% type coverage" fi - # FUNCTIONALITY - Feature completeness functionality: runs-on: ubuntu-latest @@ -129,7 +122,6 @@ jobs: - name: Check deprecated usage run: | grep -rn "deprecated\|DEPRECATED" . 2>/dev/null | head -10 || echo "No deprecations" - # PERFORMANCE - Benchmarks and profiling performance: runs-on: ubuntu-latest @@ -146,7 +138,6 @@ jobs: cargo build --release 2>/dev/null || true find target/release -maxdepth 1 -type f -executable -exec ls -lh {} \; 2>/dev/null || true fi - # ACCESSIBILITY - A11y compliance accessibility: runs-on: ubuntu-latest @@ -162,7 +153,6 @@ jobs: - name: Lighthouse (if web project) run: | echo "Lighthouse would run on deployed URL" - # LICENSE COMPLIANCE license: runs-on: ubuntu-latest @@ -181,7 +171,6 @@ jobs: run: | SPDX=$(grep -rE "SPDX-License-Identifier" . 2>/dev/null | wc -l || echo "0") echo "Files with SPDX headers: $SPDX" - # DOCUMENTATION QUALITY documentation: runs-on: ubuntu-latest diff --git a/voyant-export/.github/workflows/governance.yml b/voyant-export/.github/workflows/governance.yml index a044174..60e8e90 100644 --- a/voyant-export/.github/workflows/governance.yml +++ b/voyant-export/.github/workflows/governance.yml @@ -11,16 +11,13 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/voyant-export/.github/workflows/hypatia-scan.yml b/voyant-export/.github/workflows/hypatia-scan.yml index 49e830d..c3cb66b 100644 --- a/voyant-export/.github/workflows/hypatia-scan.yml +++ b/voyant-export/.github/workflows/hypatia-scan.yml @@ -1,42 +1,35 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: read-all - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) working-directory: ${{ env.HOME }}/hypatia run: | @@ -47,7 +40,6 @@ jobs: mix escript.build mv hypatia ../hypatia-v2 fi - - name: Run Hypatia scan id: scan run: | @@ -74,35 +66,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -110,7 +86,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -144,37 +119,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});\n" diff --git a/voyant-export/.github/workflows/instant-sync.yml b/voyant-export/.github/workflows/instant-sync.yml index 45e260a..33d7cd0 100644 --- a/voyant-export/.github/workflows/instant-sync.yml +++ b/voyant-export/.github/workflows/instant-sync.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync - on: push: branches: [main, master] release: types: [published] - permissions: contents: read - jobs: dispatch: runs-on: ubuntu-latest @@ -29,6 +26,5 @@ jobs: "sha": "${{ github.sha }}", "forges": "" } - - name: Confirm run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}" diff --git a/voyant-export/.github/workflows/jekyll-gh-pages.yml b/voyant-export/.github/workflows/jekyll-gh-pages.yml index 8b19021..a359a83 100644 --- a/voyant-export/.github/workflows/jekyll-gh-pages.yml +++ b/voyant-export/.github/workflows/jekyll-gh-pages.yml @@ -1,27 +1,22 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Sample workflow for building and deploying a Jekyll site to GitHub Pages name: Deploy Jekyll with GitHub Pages dependencies preinstalled - on: # Runs on pushes targeting the default branch push: branches: ["main"] - # Allows you to run this workflow manually from the Actions tab workflow_dispatch: - # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages permissions: contents: read pages: write id-token: write - # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. concurrency: group: "pages" cancel-in-progress: false - jobs: # Build job build: @@ -39,7 +34,6 @@ jobs: destination: ./_site - name: Upload artifact uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v4 - # Deployment job deploy: environment: diff --git a/voyant-export/.github/workflows/mirror.yml b/voyant-export/.github/workflows/mirror.yml index bf21b11..a10a916 100644 --- a/voyant-export/.github/workflows/mirror.yml +++ b/voyant-export/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0-or-later # SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: read-all - jobs: mirror-gitlab: runs-on: ubuntu-latest @@ -18,17 +15,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} - - name: Mirror to GitLab run: | ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitlab main - mirror-bitbucket: runs-on: ubuntu-latest timeout-minutes: 15 @@ -37,17 +31,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} - - name: Mirror to Bitbucket run: | ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force bitbucket main - mirror-codeberg: runs-on: ubuntu-latest timeout-minutes: 15 @@ -56,17 +47,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} - - name: Mirror to Codeberg run: | ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force codeberg main - mirror-sourcehut: runs-on: ubuntu-latest timeout-minutes: 15 @@ -75,17 +63,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} - - name: Mirror to SourceHut run: | ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true git push --force sourcehut main - mirror-disroot: runs-on: ubuntu-latest timeout-minutes: 15 @@ -94,17 +79,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} - - name: Mirror to Disroot run: | ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force disroot main - mirror-gitea: runs-on: ubuntu-latest timeout-minutes: 15 @@ -113,17 +95,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} - - name: Mirror to Gitea run: | ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitea main - mirror-radicle: runs-on: ubuntu-latest timeout-minutes: 15 @@ -132,18 +111,15 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - name: Setup Rust uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # stable with: toolchain: stable - - name: Install Radicle run: | # Install via cargo (safer than curl|sh) cargo install radicle-cli --locked echo "$HOME/.cargo/bin" >> $GITHUB_PATH - - name: Mirror to Radicle run: | echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle diff --git a/voyant-export/.github/workflows/scorecard-enforcer.yml b/voyant-export/.github/workflows/scorecard-enforcer.yml index d2ecfdf..d3ef9bb 100644 --- a/voyant-export/.github/workflows/scorecard-enforcer.yml +++ b/voyant-export/.github/workflows/scorecard-enforcer.yml @@ -1,40 +1,34 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Prevention workflow - runs OpenSSF Scorecard and fails on low scores name: OpenSSF Scorecard Enforcer - on: push: branches: [main] schedule: - - cron: '0 6 * * 1' # Weekly on Monday + - cron: '0 6 * * 1' # Weekly on Monday workflow_dispatch: - permissions: read-all - jobs: scorecard: runs-on: ubuntu-latest timeout-minutes: 15 permissions: security-events: write - id-token: write # For OIDC + id-token: write # For OIDC steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 with: results_file: results.sarif results_format: sarif publish_results: true - - name: Upload SARIF uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3 with: sarif_file: results.sarif - - name: Check minimum score run: | # Parse score from results @@ -49,21 +43,18 @@ jobs: echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE" exit 1 fi - # Check specific high-priority items check-critical: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Check SECURITY.md exists run: | if [ ! -f "SECURITY.md" ]; then echo "::error::SECURITY.md is required" exit 1 fi - - name: Check for pinned dependencies run: | # Check workflows for unpinned actions diff --git a/voyant-export/.github/workflows/scorecard.yml b/voyant-export/.github/workflows/scorecard.yml index 69192ce..b2cde06 100644 --- a/voyant-export/.github/workflows/scorecard.yml +++ b/voyant-export/.github/workflows/scorecard.yml @@ -6,9 +6,7 @@ on: schedule: - cron: '0 4 * * *' workflow_dispatch: - permissions: read-all - jobs: analysis: runs-on: ubuntu-latest @@ -20,13 +18,11 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.31.8 with: diff --git a/voyant-export/.github/workflows/secret-scanner.yml b/voyant-export/.github/workflows/secret-scanner.yml index f7dbcbd..3f4de94 100644 --- a/voyant-export/.github/workflows/secret-scanner.yml +++ b/voyant-export/.github/workflows/secret-scanner.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Prevention workflow - scans for hardcoded secrets before they reach main name: Secret Scanner - on: pull_request: push: branches: [main] - permissions: read-all - jobs: trufflehog: runs-on: ubuntu-latest @@ -16,26 +13,11 @@ jobs: steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: - fetch-depth: 0 # Full history for scanning - + fetch-depth: 0 # Full history for scanning - name: TruffleHog Secret Scan uses: trufflesecurity/trufflehog@ef6e76c3c4023279497fab4721ffa071a722fd05 # v3 with: extra_args: --only-verified --fail - - gitleaks: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest @@ -43,7 +25,6 @@ jobs: if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Check for hardcoded secrets in Rust run: | # Patterns that suggest hardcoded secrets diff --git a/voyant-export/Justfile b/voyant-export/Justfile index ea53862..d9b71dd 100644 --- a/voyant-export/Justfile +++ b/voyant-export/Justfile @@ -73,3 +73,6 @@ install-hooks: @echo "Installing git hooks..." @echo "Note: Install lefthook separately: https://github.com/evilmartians/lefthook" @echo "Then run: lefthook install" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/zoterho-template/.github/workflows/codeql.yml b/zoterho-template/.github/workflows/codeql.yml index 29b1bfa..c9b0575 100644 --- a/zoterho-template/.github/workflows/codeql.yml +++ b/zoterho-template/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0-or-later name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,10 +7,7 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - - permissions: read-all - jobs: analyze: runs-on: ubuntu-latest @@ -25,17 +21,14 @@ jobs: include: - language: javascript-typescript build-mode: none - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Initialize CodeQL uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 with: diff --git a/zoterho-template/.github/workflows/governance.yml b/zoterho-template/.github/workflows/governance.yml index a044174..60e8e90 100644 --- a/zoterho-template/.github/workflows/governance.yml +++ b/zoterho-template/.github/workflows/governance.yml @@ -11,16 +11,13 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/zoterho-template/.github/workflows/hypatia-scan.yml b/zoterho-template/.github/workflows/hypatia-scan.yml index 49e830d..c3cb66b 100644 --- a/zoterho-template/.github/workflows/hypatia-scan.yml +++ b/zoterho-template/.github/workflows/hypatia-scan.yml @@ -1,42 +1,35 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: read-all - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) working-directory: ${{ env.HOME }}/hypatia run: | @@ -47,7 +40,6 @@ jobs: mix escript.build mv hypatia ../hypatia-v2 fi - - name: Run Hypatia scan id: scan run: | @@ -74,35 +66,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -110,7 +86,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -144,37 +119,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});\n" diff --git a/zoterho-template/.github/workflows/instant-sync.yml b/zoterho-template/.github/workflows/instant-sync.yml index 45e260a..33d7cd0 100644 --- a/zoterho-template/.github/workflows/instant-sync.yml +++ b/zoterho-template/.github/workflows/instant-sync.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync - on: push: branches: [main, master] release: types: [published] - permissions: contents: read - jobs: dispatch: runs-on: ubuntu-latest @@ -29,6 +26,5 @@ jobs: "sha": "${{ github.sha }}", "forges": "" } - - name: Confirm run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}" diff --git a/zoterho-template/.github/workflows/mirror.yml b/zoterho-template/.github/workflows/mirror.yml index bf21b11..a10a916 100644 --- a/zoterho-template/.github/workflows/mirror.yml +++ b/zoterho-template/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0-or-later # SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: read-all - jobs: mirror-gitlab: runs-on: ubuntu-latest @@ -18,17 +15,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} - - name: Mirror to GitLab run: | ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitlab main - mirror-bitbucket: runs-on: ubuntu-latest timeout-minutes: 15 @@ -37,17 +31,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} - - name: Mirror to Bitbucket run: | ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force bitbucket main - mirror-codeberg: runs-on: ubuntu-latest timeout-minutes: 15 @@ -56,17 +47,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} - - name: Mirror to Codeberg run: | ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force codeberg main - mirror-sourcehut: runs-on: ubuntu-latest timeout-minutes: 15 @@ -75,17 +63,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} - - name: Mirror to SourceHut run: | ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true git push --force sourcehut main - mirror-disroot: runs-on: ubuntu-latest timeout-minutes: 15 @@ -94,17 +79,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} - - name: Mirror to Disroot run: | ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force disroot main - mirror-gitea: runs-on: ubuntu-latest timeout-minutes: 15 @@ -113,17 +95,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} - - name: Mirror to Gitea run: | ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitea main - mirror-radicle: runs-on: ubuntu-latest timeout-minutes: 15 @@ -132,18 +111,15 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - name: Setup Rust uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # stable with: toolchain: stable - - name: Install Radicle run: | # Install via cargo (safer than curl|sh) cargo install radicle-cli --locked echo "$HOME/.cargo/bin" >> $GITHUB_PATH - - name: Mirror to Radicle run: | echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle diff --git a/zoterho-template/.github/workflows/rescript-deno-ci.yml b/zoterho-template/.github/workflows/rescript-deno-ci.yml index 94ace81..f1ad681 100644 --- a/zoterho-template/.github/workflows/rescript-deno-ci.yml +++ b/zoterho-template/.github/workflows/rescript-deno-ci.yml @@ -1,7 +1,6 @@ # SPDX-License-Identifier: MPL-2.0-or-later name: ReScript/Deno CI on: [push, pull_request] - jobs: build: runs-on: ubuntu-latest @@ -11,26 +10,20 @@ jobs: - uses: denoland/setup-deno@v2 with: deno-version: v1.x - - name: Deno lint run: deno lint - - name: Deno fmt check run: deno fmt --check - - name: Deno test run: deno test --allow-all --coverage=coverage - - name: ReScript build run: | if [ -f "rescript.json" ] || [ -f "bsconfig.json" ]; then npm install npx rescript fi - - name: Type check run: deno check **/*.ts || true - security: runs-on: ubuntu-latest timeout-minutes: 15 diff --git a/zoterho-template/.github/workflows/scorecard.yml b/zoterho-template/.github/workflows/scorecard.yml index 9847a6d..1ec6ebb 100644 --- a/zoterho-template/.github/workflows/scorecard.yml +++ b/zoterho-template/.github/workflows/scorecard.yml @@ -6,9 +6,7 @@ on: schedule: - cron: '0 4 * * *' workflow_dispatch: - permissions: read-all - jobs: analysis: runs-on: ubuntu-latest @@ -20,13 +18,11 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.31.8 with: diff --git a/zoterho-template/.github/workflows/secret-scanner.yml b/zoterho-template/.github/workflows/secret-scanner.yml index a296203..1e9a951 100644 --- a/zoterho-template/.github/workflows/secret-scanner.yml +++ b/zoterho-template/.github/workflows/secret-scanner.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0-or-later # Prevention workflow - scans for hardcoded secrets before they reach main name: Secret Scanner - on: pull_request: push: branches: [main] - permissions: read-all - jobs: trufflehog: runs-on: ubuntu-latest @@ -16,26 +13,11 @@ jobs: steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: - fetch-depth: 0 # Full history for scanning - + fetch-depth: 0 # Full history for scanning - name: TruffleHog Secret Scan uses: trufflesecurity/trufflehog@116e7171542d2f1dad8810f00dcfacbe0b809183 # v3 with: extra_args: --only-verified --fail - - gitleaks: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest @@ -43,7 +25,6 @@ jobs: if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Check for hardcoded secrets in Rust run: | # Patterns that suggest hardcoded secrets diff --git a/zoterho-template/.gitlab-ci.yml b/zoterho-template/.gitlab-ci.yml index 1168160..98f5e46 100644 --- a/zoterho-template/.gitlab-ci.yml +++ b/zoterho-template/.gitlab-ci.yml @@ -2,14 +2,11 @@ stages: - build - test - deploy - variables: CACHE_DIR: ".cache" - cache: paths: - ${CACHE_DIR} - build: stage: build script: @@ -18,12 +15,10 @@ build: artifacts: paths: - ${CACHE_DIR} - test: stage: test script: - echo "Running tests..." - deploy: stage: deploy script: @@ -31,3 +26,8 @@ deploy: only: - main - master +trufflehog: + stage: security + image: trufflesecurity/trufflehog:latest + script: + - trufflehog git file://. --only-verified --fail diff --git a/zoterho-template/Justfile b/zoterho-template/Justfile index f369298..0b17abc 100644 --- a/zoterho-template/Justfile +++ b/zoterho-template/Justfile @@ -355,3 +355,6 @@ install-zotero-manual: elif command -v open >/dev/null 2>&1; then \ open build/ 2>/dev/null || true; \ fi + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/zoterho/.github/workflows/codeql.yml b/zoterho/.github/workflows/codeql.yml index b8d1fd6..21f2cc9 100644 --- a/zoterho/.github/workflows/codeql.yml +++ b/zoterho/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,10 +7,7 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - - permissions: read-all - jobs: analyze: runs-on: ubuntu-latest @@ -25,17 +21,14 @@ jobs: include: - language: javascript-typescript build-mode: none - steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - - name: Initialize CodeQL uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1 with: diff --git a/zoterho/.github/workflows/governance.yml b/zoterho/.github/workflows/governance.yml index a044174..60e8e90 100644 --- a/zoterho/.github/workflows/governance.yml +++ b/zoterho/.github/workflows/governance.yml @@ -11,16 +11,13 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/zoterho/.github/workflows/hypatia-scan.yml b/zoterho/.github/workflows/hypatia-scan.yml index 3e8973e..5609aa8 100644 --- a/zoterho/.github/workflows/hypatia-scan.yml +++ b/zoterho/.github/workflows/hypatia-scan.yml @@ -1,42 +1,35 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: read-all - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) working-directory: ${{ env.HOME }}/hypatia run: | @@ -46,7 +39,6 @@ jobs: mix escript.build mv hypatia ../hypatia-v2 fi - - name: Run Hypatia scan id: scan run: | @@ -73,35 +65,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -109,7 +85,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -143,37 +118,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); \ No newline at end of file + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});" diff --git a/zoterho/.github/workflows/instant-sync.yml b/zoterho/.github/workflows/instant-sync.yml index 01646a7..e9df9c7 100644 --- a/zoterho/.github/workflows/instant-sync.yml +++ b/zoterho/.github/workflows/instant-sync.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync - on: push: branches: [main, master] release: types: [published] - permissions: contents: read - jobs: dispatch: runs-on: ubuntu-latest @@ -29,6 +26,5 @@ jobs: "sha": "${{ github.sha }}", "forges": "" } - - name: Confirm run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}" diff --git a/zoterho/.github/workflows/mirror.yml b/zoterho/.github/workflows/mirror.yml index f5c9bb4..cbb4944 100644 --- a/zoterho/.github/workflows/mirror.yml +++ b/zoterho/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: read-all - jobs: mirror-gitlab: runs-on: ubuntu-latest @@ -18,17 +15,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} - - name: Mirror to GitLab run: | ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitlab main - mirror-bitbucket: runs-on: ubuntu-latest timeout-minutes: 15 @@ -37,17 +31,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} - - name: Mirror to Bitbucket run: | ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force bitbucket main - mirror-codeberg: runs-on: ubuntu-latest timeout-minutes: 15 @@ -56,17 +47,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} - - name: Mirror to Codeberg run: | ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force codeberg main - mirror-sourcehut: runs-on: ubuntu-latest timeout-minutes: 15 @@ -75,17 +63,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} - - name: Mirror to SourceHut run: | ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true git push --force sourcehut main - mirror-disroot: runs-on: ubuntu-latest timeout-minutes: 15 @@ -94,17 +79,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} - - name: Mirror to Disroot run: | ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force disroot main - mirror-gitea: runs-on: ubuntu-latest timeout-minutes: 15 @@ -113,17 +95,14 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0 with: ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} - - name: Mirror to Gitea run: | ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitea main - mirror-radicle: runs-on: ubuntu-latest timeout-minutes: 15 @@ -132,18 +111,15 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - name: Setup Rust uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # stable with: toolchain: stable - - name: Install Radicle run: | # Install via cargo (safer than curl|sh) cargo install radicle-cli --locked echo "$HOME/.cargo/bin" >> $GITHUB_PATH - - name: Mirror to Radicle run: | echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle diff --git a/zoterho/.github/workflows/policy-check.yml b/zoterho/.github/workflows/policy-check.yml index 31f14f6..cf045ee 100644 --- a/zoterho/.github/workflows/policy-check.yml +++ b/zoterho/.github/workflows/policy-check.yml @@ -1,12 +1,10 @@ # SPDX-License-Identifier: MPL-2.0 name: "Policy Check" - on: push: - branches: [ "main", "master" ] + branches: ["main", "master"] pull_request: - branches: [ "main", "master" ] - + branches: ["main", "master"] jobs: policy: name: Hyperpolymath Language Policy @@ -14,35 +12,29 @@ jobs: timeout-minutes: 15 permissions: contents: read - steps: - - name: Checkout repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - name: Run policy check - run: | - chmod +x scripts/check-policy.sh - ./scripts/check-policy.sh - + - name: Checkout repository + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - name: Run policy check + run: | + chmod +x scripts/check-policy.sh + ./scripts/check-policy.sh nickel-validate: name: Validate Mustfile runs-on: ubuntu-latest timeout-minutes: 15 permissions: contents: read - steps: - - name: Checkout repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - name: Install Nickel - run: | - curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-x86_64-unknown-linux-musl -o nickel - chmod +x nickel - sudo mv nickel /usr/local/bin/ - - - name: Validate Mustfile.ncl - run: | - nickel typecheck Mustfile.ncl - nickel export Mustfile.ncl > /dev/null - echo "✓ Mustfile.ncl is valid" + - name: Checkout repository + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - name: Install Nickel + run: | + curl -L https://github.com/tweag/nickel/releases/latest/download/nickel-x86_64-unknown-linux-musl -o nickel + chmod +x nickel + sudo mv nickel /usr/local/bin/ + - name: Validate Mustfile.ncl + run: | + nickel typecheck Mustfile.ncl + nickel export Mustfile.ncl > /dev/null + echo "✓ Mustfile.ncl is valid" diff --git a/zoterho/.github/workflows/scorecard.yml b/zoterho/.github/workflows/scorecard.yml index 8e2ce1b..f5f8980 100644 --- a/zoterho/.github/workflows/scorecard.yml +++ b/zoterho/.github/workflows/scorecard.yml @@ -6,9 +6,7 @@ on: schedule: - cron: '0 4 * * *' workflow_dispatch: - permissions: read-all - jobs: analysis: runs-on: ubuntu-latest @@ -20,13 +18,11 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.3.1 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.31.8 with: diff --git a/zoterho/.github/workflows/secret-scanner.yml b/zoterho/.github/workflows/secret-scanner.yml index 4df01cb..3afb768 100644 --- a/zoterho/.github/workflows/secret-scanner.yml +++ b/zoterho/.github/workflows/secret-scanner.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - scans for hardcoded secrets before they reach main name: Secret Scanner - on: pull_request: push: branches: [main] - permissions: read-all - jobs: trufflehog: runs-on: ubuntu-latest @@ -16,26 +13,11 @@ jobs: steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for scanning - + fetch-depth: 0 # Full history for scanning - name: TruffleHog Secret Scan uses: trufflesecurity/trufflehog@8a8ef8526528d8a4ff3e2c90be08e25ef8efbd9b # v3 with: extra_args: --only-verified --fail - - gitleaks: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest @@ -43,7 +25,6 @@ jobs: if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - name: Check for hardcoded secrets in Rust run: | # Patterns that suggest hardcoded secrets diff --git a/zoterho/.github/workflows/semgrep.yml b/zoterho/.github/workflows/semgrep.yml index 55d6455..5e8ff5a 100644 --- a/zoterho/.github/workflows/semgrep.yml +++ b/zoterho/.github/workflows/semgrep.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: Semgrep SAST - on: push: branches: [main, master] @@ -9,9 +8,7 @@ on: schedule: - cron: '0 5 * * 1' workflow_dispatch: - permissions: read-all - jobs: semgrep: runs-on: ubuntu-latest @@ -23,12 +20,10 @@ jobs: image: semgrep/semgrep steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Run Semgrep run: semgrep scan --sarif --output=semgrep.sarif --config=auto . env: SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} - - name: Upload SARIF uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9 with: diff --git a/zoterho/Justfile b/zoterho/Justfile index a1f9bd8..d156c03 100644 --- a/zoterho/Justfile +++ b/zoterho/Justfile @@ -244,3 +244,6 @@ setup: @just install-hooks @just submodules-init @echo "✓ Setup complete" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/zotpress/.github/workflows/casket-pages.yml b/zotpress/.github/workflows/casket-pages.yml index 800fe7e..2846c69 100644 --- a/zotpress/.github/workflows/casket-pages.yml +++ b/zotpress/.github/workflows/casket-pages.yml @@ -1,20 +1,16 @@ # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages - on: push: branches: [main] workflow_dispatch: - permissions: contents: read pages: write id-token: write - concurrency: group: "pages" cancel-in-progress: false - jobs: build: runs-on: ubuntu-latest @@ -22,19 +18,16 @@ jobs: steps: - name: Checkout uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - name: Checkout casket-ssg uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - - name: Setup GHCup uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2 with: ghc-version: '9.8.2' cabal-version: '3.10' - - name: Cache Cabal uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4 with: @@ -43,11 +36,9 @@ jobs: ~/.cabal/store .casket-ssg/dist-newstyle key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }} - - name: Build casket-ssg working-directory: .casket-ssg run: cabal build - - name: Build site run: | mkdir -p site _site @@ -78,15 +69,12 @@ jobs: fi fi cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site - - name: Setup Pages uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Upload artifact uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 with: path: '_site' - deploy: environment: name: github-pages diff --git a/zotpress/.github/workflows/codeql.yml b/zotpress/.github/workflows/codeql.yml index bb72c7a..7741ec7 100644 --- a/zotpress/.github/workflows/codeql.yml +++ b/zotpress/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,10 +7,7 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - - permissions: read-all - jobs: analyze: runs-on: ubuntu-latest @@ -29,17 +25,14 @@ jobs: build-mode: none - language: ruby build-mode: none - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Initialize CodeQL uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1 with: diff --git a/zotpress/.github/workflows/governance.yml b/zotpress/.github/workflows/governance.yml index a044174..60e8e90 100644 --- a/zotpress/.github/workflows/governance.yml +++ b/zotpress/.github/workflows/governance.yml @@ -11,16 +11,13 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/zotpress/.github/workflows/hypatia-scan.yml b/zotpress/.github/workflows/hypatia-scan.yml index 3e8973e..5609aa8 100644 --- a/zotpress/.github/workflows/hypatia-scan.yml +++ b/zotpress/.github/workflows/hypatia-scan.yml @@ -1,42 +1,35 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: read-all - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) working-directory: ${{ env.HOME }}/hypatia run: | @@ -46,7 +39,6 @@ jobs: mix escript.build mv hypatia ../hypatia-v2 fi - - name: Run Hypatia scan id: scan run: | @@ -73,35 +65,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -109,7 +85,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -143,37 +118,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); \ No newline at end of file + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});" diff --git a/zotpress/.github/workflows/instant-sync.yml b/zotpress/.github/workflows/instant-sync.yml index 01646a7..e9df9c7 100644 --- a/zotpress/.github/workflows/instant-sync.yml +++ b/zotpress/.github/workflows/instant-sync.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync - on: push: branches: [main, master] release: types: [published] - permissions: contents: read - jobs: dispatch: runs-on: ubuntu-latest @@ -29,6 +26,5 @@ jobs: "sha": "${{ github.sha }}", "forges": "" } - - name: Confirm run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}" diff --git a/zotpress/.github/workflows/jekyll-gh-pages.yml b/zotpress/.github/workflows/jekyll-gh-pages.yml index c0c0a26..530b89e 100644 --- a/zotpress/.github/workflows/jekyll-gh-pages.yml +++ b/zotpress/.github/workflows/jekyll-gh-pages.yml @@ -1,21 +1,17 @@ # SPDX-License-Identifier: MPL-2.0 # Deploy Jekyll site to GitHub Pages name: Deploy Jekyll with GitHub Pages dependencies preinstalled - on: push: branches: ["main"] workflow_dispatch: - permissions: contents: read pages: write id-token: write - concurrency: group: "pages" cancel-in-progress: false - jobs: build: runs-on: ubuntu-latest @@ -32,7 +28,6 @@ jobs: destination: ./_site - name: Upload artifact uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v3 - deploy: environment: name: github-pages diff --git a/zotpress/.github/workflows/mirror.yml b/zotpress/.github/workflows/mirror.yml index 908bf15..922db39 100644 --- a/zotpress/.github/workflows/mirror.yml +++ b/zotpress/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: read-all - jobs: mirror-gitlab: runs-on: ubuntu-latest @@ -18,17 +15,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} - - name: Mirror to GitLab run: | ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitlab main - mirror-bitbucket: runs-on: ubuntu-latest timeout-minutes: 15 @@ -37,17 +31,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} - - name: Mirror to Bitbucket run: | ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force bitbucket main - mirror-codeberg: runs-on: ubuntu-latest timeout-minutes: 15 @@ -56,17 +47,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} - - name: Mirror to Codeberg run: | ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force codeberg main - mirror-sourcehut: runs-on: ubuntu-latest timeout-minutes: 15 @@ -75,17 +63,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} - - name: Mirror to SourceHut run: | ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true git push --force sourcehut main - mirror-disroot: runs-on: ubuntu-latest timeout-minutes: 15 @@ -94,17 +79,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} - - name: Mirror to Disroot run: | ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force disroot main - mirror-gitea: runs-on: ubuntu-latest timeout-minutes: 15 @@ -113,17 +95,14 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} - - name: Mirror to Gitea run: | ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitea main - mirror-radicle: runs-on: ubuntu-latest timeout-minutes: 15 @@ -132,18 +111,15 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: fetch-depth: 0 - - name: Setup Rust uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # stable with: toolchain: stable - - name: Install Radicle run: | # Install via cargo (safer than curl|sh) cargo install radicle-cli --locked echo "$HOME/.cargo/bin" >> $GITHUB_PATH - - name: Mirror to Radicle run: | echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle diff --git a/zotpress/.github/workflows/php-standards.yml b/zotpress/.github/workflows/php-standards.yml index 61a15df..6ef9384 100644 --- a/zotpress/.github/workflows/php-standards.yml +++ b/zotpress/.github/workflows/php-standards.yml @@ -3,7 +3,6 @@ # Enforces WordPress coding standards and runs comprehensive static analysis name: PHP Standards - on: push: branches: [main, develop, 'claude/*'] @@ -23,13 +22,10 @@ on: - 'phpstan.neon' - 'phpcs.xml' workflow_dispatch: - permissions: read-all - concurrency: group: php-standards-${{ github.ref }} cancel-in-progress: true - jobs: # ───────────────────────────────────────────────────────────────────────────── # PHP Syntax Check @@ -42,21 +38,17 @@ jobs: fail-fast: false matrix: php: ['8.1', '8.2', '8.3', '8.4'] - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Setup PHP ${{ matrix.php }} uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0 with: php-version: ${{ matrix.php }} extensions: mbstring, xml, curl, json, dom tools: parallel-lint - - name: Check syntax run: parallel-lint --colors lib/ src/ zotpress.php - # ───────────────────────────────────────────────────────────────────────────── # WordPress Coding Standards (PHPCS) # ───────────────────────────────────────────────────────────────────────────── @@ -65,32 +57,26 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 needs: syntax - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Setup PHP uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0 with: php-version: '8.2' extensions: mbstring, xml, curl, json, dom tools: composer:v2, cs2pr - - name: Get Composer cache directory id: composer-cache run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT - - name: Cache Composer dependencies uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1 with: path: ${{ steps.composer-cache.outputs.dir }} key: php-8.2-composer-${{ hashFiles('**/composer.lock') }} restore-keys: php-8.2-composer- - - name: Install dependencies run: composer install --prefer-dist --no-progress - - name: Run PHPCS (WordPress standards) run: | vendor/bin/phpcs \ @@ -100,7 +86,6 @@ jobs: --report=checkstyle \ --report-file=phpcs-report.xml \ lib/ src/ zotpress.php || true - - name: Show PHPCS results run: | if [ -f phpcs-report.xml ]; then @@ -110,7 +95,6 @@ jobs: --ignore=vendor/,node_modules/,dist/ \ lib/ src/ zotpress.php || true fi - - name: Upload PHPCS report uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 if: always() @@ -118,7 +102,6 @@ jobs: name: phpcs-report path: phpcs-report.xml retention-days: 30 - # ───────────────────────────────────────────────────────────────────────────── # PHPStan Static Analysis # ───────────────────────────────────────────────────────────────────────────── @@ -131,28 +114,23 @@ jobs: fail-fast: false matrix: level: [5, 6] - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Setup PHP uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0 with: php-version: '8.2' extensions: mbstring, xml, curl, json, dom tools: composer:v2 - - name: Cache Composer dependencies uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1 with: path: ~/.composer/cache key: php-composer-${{ hashFiles('**/composer.lock') }} restore-keys: php-composer- - - name: Install dependencies run: composer install --prefer-dist --no-progress - - name: Run PHPStan (Level ${{ matrix.level }}) run: | vendor/bin/phpstan analyse \ @@ -160,7 +138,6 @@ jobs: --memory-limit=512M \ --error-format=github \ lib/ src/ zotpress.php || true - # ───────────────────────────────────────────────────────────────────────────── # Psalm Static Analysis # ───────────────────────────────────────────────────────────────────────────── @@ -169,31 +146,25 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 needs: syntax - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Setup PHP uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0 with: php-version: '8.2' extensions: mbstring, xml, curl, json, dom tools: composer:v2 - - name: Cache Composer dependencies uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1 with: path: ~/.composer/cache key: php-composer-${{ hashFiles('**/composer.lock') }} restore-keys: php-composer- - - name: Install dependencies run: composer install --prefer-dist --no-progress - - name: Run Psalm run: vendor/bin/psalm --no-cache --output-format=github || true - # ───────────────────────────────────────────────────────────────────────────── # PHP Compatibility Check # ───────────────────────────────────────────────────────────────────────────── @@ -202,28 +173,23 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 needs: syntax - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Setup PHP uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0 with: php-version: '8.2' extensions: mbstring, xml, curl, json, dom tools: composer:v2 - - name: Cache Composer dependencies uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1 with: path: ~/.composer/cache key: php-composer-${{ hashFiles('**/composer.lock') }} restore-keys: php-composer- - - name: Install dependencies run: composer install --prefer-dist --no-progress - - name: Check PHP 8.1+ compatibility run: | vendor/bin/phpcs \ @@ -232,7 +198,6 @@ jobs: --extensions=php \ --ignore=vendor/,node_modules/,dist/ \ lib/ src/ zotpress.php || true - # ───────────────────────────────────────────────────────────────────────────── # Security Check # ───────────────────────────────────────────────────────────────────────────── @@ -240,20 +205,16 @@ jobs: name: Security Audit runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Setup PHP uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0 with: php-version: '8.2' tools: composer:v2 - - name: Check for vulnerable dependencies run: composer audit - # ───────────────────────────────────────────────────────────────────────────── # Summary # ───────────────────────────────────────────────────────────────────────────── @@ -263,7 +224,6 @@ jobs: timeout-minutes: 15 needs: [syntax, phpcs, phpstan, psalm, compatibility, security] if: always() - steps: - name: Check results run: | @@ -277,7 +237,6 @@ jobs: echo "| Psalm | ${{ needs.psalm.result == 'success' && '✅ Pass' || '⚠️ Issues' }} |" >> $GITHUB_STEP_SUMMARY echo "| Compatibility | ${{ needs.compatibility.result == 'success' && '✅ Pass' || '⚠️ Issues' }} |" >> $GITHUB_STEP_SUMMARY echo "| Security | ${{ needs.security.result == 'success' && '✅ Pass' || '❌ Vulnerabilities' }} |" >> $GITHUB_STEP_SUMMARY - - name: Fail if syntax check failed if: needs.syntax.result == 'failure' run: exit 1 diff --git a/zotpress/.github/workflows/scorecard-enforcer.yml b/zotpress/.github/workflows/scorecard-enforcer.yml index 1710407..1aa0c99 100644 --- a/zotpress/.github/workflows/scorecard-enforcer.yml +++ b/zotpress/.github/workflows/scorecard-enforcer.yml @@ -1,40 +1,34 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores name: OpenSSF Scorecard Enforcer - on: push: branches: [main] schedule: - - cron: '0 6 * * 1' # Weekly on Monday + - cron: '0 6 * * 1' # Weekly on Monday workflow_dispatch: - permissions: read-all - jobs: scorecard: runs-on: ubuntu-latest timeout-minutes: 15 permissions: security-events: write - id-token: write # For OIDC + id-token: write # For OIDC steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 with: results_file: results.sarif results_format: sarif publish_results: true - - name: Upload SARIF uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3 with: sarif_file: results.sarif - - name: Check minimum score run: | # Parse score from results @@ -49,21 +43,18 @@ jobs: echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE" exit 1 fi - # Check specific high-priority items check-critical: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Check SECURITY.md exists run: | if [ ! -f "SECURITY.md" ]; then echo "::error::SECURITY.md is required" exit 1 fi - - name: Check for pinned dependencies run: | # Check workflows for unpinned actions diff --git a/zotpress/.github/workflows/scorecard.yml b/zotpress/.github/workflows/scorecard.yml index 9dcfbc9..a2b1d43 100644 --- a/zotpress/.github/workflows/scorecard.yml +++ b/zotpress/.github/workflows/scorecard.yml @@ -6,9 +6,7 @@ on: schedule: - cron: '0 4 * * *' workflow_dispatch: - permissions: read-all - jobs: analysis: runs-on: ubuntu-latest @@ -20,13 +18,11 @@ jobs: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.31.8 with: diff --git a/zotpress/.github/workflows/secret-scanner.yml b/zotpress/.github/workflows/secret-scanner.yml index 974dc58..bf9a58a 100644 --- a/zotpress/.github/workflows/secret-scanner.yml +++ b/zotpress/.github/workflows/secret-scanner.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - scans for hardcoded secrets before they reach main name: Secret Scanner - on: pull_request: push: branches: [main] - permissions: read-all - jobs: trufflehog: runs-on: ubuntu-latest @@ -16,26 +13,11 @@ jobs: steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 with: - fetch-depth: 0 # Full history for scanning - + fetch-depth: 0 # Full history for scanning - name: TruffleHog Secret Scan uses: trufflesecurity/trufflehog@ef6e76c3c4023279497fab4721ffa071a722fd05 # v3 with: extra_args: --only-verified --fail - - gitleaks: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest @@ -43,7 +25,6 @@ jobs: if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Check for hardcoded secrets in Rust run: | # Patterns that suggest hardcoded secrets diff --git a/zotpress/.github/workflows/security-analysis.yml b/zotpress/.github/workflows/security-analysis.yml index 753aacd..7886ed1 100644 --- a/zotpress/.github/workflows/security-analysis.yml +++ b/zotpress/.github/workflows/security-analysis.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: Security Analysis (sanctify-php) - on: push: branches: [main] @@ -15,10 +14,8 @@ on: - 'composer.json' - 'composer.lock' schedule: - - cron: '0 6 * * 1' # Weekly on Monday at 6am - + - cron: '0 6 * * 1' # Weekly on Monday at 6am permissions: read-all - jobs: sanctify-analysis: name: Sanctify PHP Security Analysis @@ -27,17 +24,14 @@ jobs: permissions: contents: read security-events: write - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - - name: Setup Haskell uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2.7.5 with: ghc-version: '9.6' cabal-version: '3.10' - - name: Cache Cabal packages uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 with: @@ -48,17 +42,14 @@ jobs: key: ${{ runner.os }}-cabal-${{ hashFiles('**/*.cabal') }} restore-keys: | ${{ runner.os }}-cabal- - - name: Clone sanctify-php run: | git clone --depth 1 https://github.com/hyperpolymath/sanctify-php.git /tmp/sanctify-php - - name: Build sanctify-php working-directory: /tmp/sanctify-php run: | cabal update cabal build - - name: Run sanctify-php analysis run: | /tmp/sanctify-php/dist-newstyle/build/*/ghc-*/sanctify-php-*/x/sanctify-php/build/sanctify-php/sanctify-php \ @@ -66,14 +57,12 @@ jobs: --output security-report.sarif \ --severity high \ lib/ src/ || true - - name: Upload SARIF results uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0 if: always() with: sarif_file: security-report.sarif continue-on-error: true - - name: Run sanctify-php (text output) run: | echo "## Security Analysis Report" >> $GITHUB_STEP_SUMMARY @@ -81,26 +70,21 @@ jobs: --format text \ --severity medium \ lib/ src/ 2>&1 | tee -a $GITHUB_STEP_SUMMARY || true - php-aegis-check: name: PHP Aegis Integration Check runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - - name: Setup PHP uses: shivammathur/setup-php@c541c155eee45413f5b09a52248675b1a2575231 # v2.31.1 with: php-version: '8.2' extensions: mbstring, intl, sodium coverage: none - - name: Install dependencies run: composer install --no-progress --prefer-dist - - name: Check php-aegis usage run: | echo "## PHP Aegis Integration Check" >> $GITHUB_STEP_SUMMARY diff --git a/zotpress/.github/workflows/test.yml b/zotpress/.github/workflows/test.yml index 457b3b7..d5172fb 100644 --- a/zotpress/.github/workflows/test.yml +++ b/zotpress/.github/workflows/test.yml @@ -3,24 +3,19 @@ # Runs PHP and TypeScript/JavaScript tests with full CI checks name: Test & Quality - on: push: branches: [main, develop, 'claude/*'] pull_request: branches: [main, develop] workflow_dispatch: - permissions: read-all - concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - env: DENO_VERSION: '2.x' PHP_VERSION: '8.2' - jobs: # ───────────────────────────────────────────────────────────────────────────── # PHP Tests @@ -33,11 +28,9 @@ jobs: fail-fast: false matrix: php: ['8.1', '8.2', '8.3', '8.4'] - steps: - name: Checkout code uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Setup PHP ${{ matrix.php }} uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2 with: @@ -45,11 +38,9 @@ jobs: extensions: mbstring, xml, curl, json, dom coverage: xdebug tools: composer:v2 - - name: Get Composer cache directory id: composer-cache run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT - - name: Cache Composer dependencies uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v4 with: @@ -57,16 +48,12 @@ jobs: key: php-${{ matrix.php }}-composer-${{ hashFiles('**/composer.lock') }} restore-keys: | php-${{ matrix.php }}-composer- - - name: Install dependencies run: composer install --prefer-dist --no-progress - - name: Run PHP syntax check run: composer lint - - name: Run PHPUnit tests run: composer test - - name: Upload coverage to Codecov if: matrix.php == '8.2' uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5 @@ -74,7 +61,6 @@ jobs: files: ./coverage/clover.xml flags: php fail_ci_if_error: false - # ───────────────────────────────────────────────────────────────────────────── # PHP Static Analysis # ───────────────────────────────────────────────────────────────────────────── @@ -82,35 +68,28 @@ jobs: name: PHP Static Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Setup PHP uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2 with: php-version: ${{ env.PHP_VERSION }} extensions: mbstring, xml, curl, json, dom - - name: Cache Composer dependencies uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v4 with: path: ~/.composer/cache key: php-composer-${{ hashFiles('**/composer.lock') }} restore-keys: php-composer- - - name: Install dependencies run: composer install --prefer-dist --no-progress - - name: Run PHPStan run: composer phpstan continue-on-error: true - - name: Run PHPCS (WordPress standards) run: composer phpcs continue-on-error: true - # ───────────────────────────────────────────────────────────────────────────── # Deno Tests (TypeScript/JavaScript) # ───────────────────────────────────────────────────────────────────────────── @@ -118,16 +97,13 @@ jobs: name: Deno Tests runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Setup Deno uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2 with: deno-version: ${{ env.DENO_VERSION }} - - name: Cache Deno dependencies uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v4 with: @@ -136,21 +112,16 @@ jobs: ~/.deno key: deno-${{ hashFiles('deno.json', 'deno.lock') }} restore-keys: deno- - - name: Verify formatting run: deno fmt --check - - name: Run linter run: deno lint - - name: Type check run: deno check src/**/*.ts scripts/**/*.ts continue-on-error: true - - name: Run tests run: deno test --allow-read --allow-write continue-on-error: true - # ───────────────────────────────────────────────────────────────────────────── # Build Check # ───────────────────────────────────────────────────────────────────────────── @@ -159,24 +130,19 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 needs: [deno-tests] - steps: - name: Checkout code uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Setup Deno uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2 with: deno-version: ${{ env.DENO_VERSION }} - - name: Build CSS run: deno task build:css continue-on-error: true - - name: Build JavaScript run: deno task build:js continue-on-error: true - - name: Upload build artifacts uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v4 with: @@ -184,7 +150,6 @@ jobs: path: dist/ retention-days: 7 if: always() - # ───────────────────────────────────────────────────────────────────────────── # WordPress Compatibility # ───────────────────────────────────────────────────────────────────────────── @@ -192,29 +157,23 @@ jobs: name: WordPress Compatibility runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4 - - name: Setup PHP uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2 with: php-version: ${{ env.PHP_VERSION }} extensions: mbstring, xml, curl, json, dom - - name: Install dependencies run: composer install --prefer-dist --no-progress - - name: Check PHP compatibility run: | vendor/bin/phpcs --standard=PHPCompatibilityWP --runtime-set testVersion 8.1- lib/ src/ || true - - name: Check WordPress minimum version run: | echo "Checking for WordPress 6.0+ compatibility markers..." # Add specific checks here if needed - # ───────────────────────────────────────────────────────────────────────────── # All Checks Passed # ───────────────────────────────────────────────────────────────────────────── @@ -224,7 +183,6 @@ jobs: timeout-minutes: 15 needs: [php-tests, php-static-analysis, deno-tests, build, wordpress-compat] if: always() - steps: - name: Check all jobs run: | diff --git a/zotpress/Justfile b/zotpress/Justfile index f2876e2..d2d784a 100644 --- a/zotpress/Justfile +++ b/zotpress/Justfile @@ -212,3 +212,6 @@ check-tools: @which composer || echo "❌ Composer not found" @which just || echo "❌ Just not found" @echo "✓ Tool check complete" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true From e3f90363f885bf127e86a6283fb481aa702d709c Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 21 Jun 2026 00:56:35 +0100 Subject: [PATCH 12/15] ci: adopt standards reusable workflows for Scorecard, Hypatia, and Governance --- .github/workflows/governance.yml | 20 ++--- .github/workflows/hypatia-scan.yml | 21 ++--- .github/workflows/scorecard-enforcer.yml | 99 ------------------------ 3 files changed, 13 insertions(+), 127 deletions(-) delete mode 100644 .github/workflows/scorecard-enforcer.yml diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 60e8e90..2674263 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,24 +1,16 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - +# SPDX-License-Identifier: PMPL-1.0-or-later name: Governance + on: push: branches: [main, master] pull_request: + branches: [main, master] workflow_dispatch: + permissions: contents: read + jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 - timeout-minutes: 10 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@b89b2ef1e98928fce53a85e83c37f23a1d99f6d3 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 0776fac..736b63f 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,8 +1,6 @@ -# SPDX-License-Identifier: MPL-2.0 -# Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml. -# See standards#191 for the reusable's purpose and design. - +# SPDX-License-Identifier: PMPL-1.0-or-later name: Hypatia Security Scan + on: push: branches: [main, master, develop] @@ -11,16 +9,11 @@ on: schedule: - cron: '0 0 * * 0' workflow_dispatch: -# Estate guardrail: cancel superseded runs so re-pushes don't pile up. -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true + permissions: contents: read - security-events: write - pull-requests: write + security-events: read + jobs: - hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242 - timeout-minutes: 10 - secrets: inherit + scan: + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@b89b2ef1e98928fce53a85e83c37f23a1d99f6d3 diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml deleted file mode 100644 index 109b1eb..0000000 --- a/.github/workflows/scorecard-enforcer.yml +++ /dev/null @@ -1,99 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Prevention workflow - runs OpenSSF Scorecard and fails on low scores -name: OpenSSF Scorecard Enforcer -on: - push: - branches: [main] - schedule: - - cron: '0 6 * * 1' # Weekly on Monday - workflow_dispatch: -# Estate guardrail: cancel superseded runs so re-pushes / rebased PR -# updates do not pile up queued runs against the shared account-wide -# Actions concurrency pool. Applied only to read-only check workflows -# (no publish/mutation), so cancelling a superseded run is always safe. -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true -permissions: - contents: read -jobs: - # The OSSF Scorecard publish endpoint enforces a hard contract: the job that - # runs `ossf/scorecard-action` with `publish_results: true` must contain - # ONLY steps with `uses:` (no `run:` steps in the same job). If a `run:` - # step is present, the publish step fails with: - # "webapp: scorecard job must only have steps with uses" - # (49 estate repos hit this; see ROADMAP audit 2026-05-30.) - # - # Fix: split the threshold check into a downstream job that depends on - # `scorecard` and consumes the SARIF artifact. The `scorecard` job stays - # uses-only; `check-score` is the gating job that emits the error. - scorecard: - runs-on: ubuntu-latest - timeout-minutes: 15 - permissions: - security-events: write - id-token: write # For OIDC - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - name: Run Scorecard - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 - with: - results_file: results.sarif - results_format: sarif - publish_results: true - - name: Upload SARIF - uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4 - with: - sarif_file: results.sarif - - name: Persist SARIF for downstream score-gate job - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 - with: - name: scorecard-results - path: results.sarif - retention-days: 1 - check-score: - needs: scorecard - runs-on: ubuntu-latest - timeout-minutes: 15 - permissions: - contents: read - steps: - - name: Download SARIF from scorecard job - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v5.0.0 - with: - name: scorecard-results - - name: Check minimum score - run: | - SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0") - - echo "OpenSSF Scorecard Score: $SCORE" - - # Minimum acceptable score (0-10 scale) - MIN_SCORE=5 - - if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then - echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE" - exit 1 - fi - # Check specific high-priority items - check-critical: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Check SECURITY.md exists - run: | - if [ ! -f "SECURITY.md" ]; then - echo "::error::SECURITY.md is required" - exit 1 - fi - - name: Check for pinned dependencies - run: | - # Check workflows for unpinned actions - unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true) - if [ -n "$unpinned" ]; then - echo "::warning::Found unpinned actions:" - echo "$unpinned" - fi From d55df0acd7f3b5b048dbdd484d62049e5fb3cd55 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 21 Jun 2026 01:15:42 +0100 Subject: [PATCH 13/15] ci: adopt standards reusable workflows for Scorecard, Hypatia, and Governance --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 2674263..31d497f 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -13,4 +13,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@b89b2ef1e98928fce53a85e83c37f23a1d99f6d3 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 736b63f..ce9ce4c 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -16,4 +16,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@b89b2ef1e98928fce53a85e83c37f23a1d99f6d3 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995 From 07efeb4a332bb947cdde53f8339c334c653e3b13 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 21 Jun 2026 01:20:29 +0100 Subject: [PATCH 14/15] ci: adopt standards reusable workflows for Scorecard, Hypatia, and Governance --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 31d497f..8161ec2 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -13,4 +13,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index ce9ce4c..e715848 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -16,4 +16,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910 From 9b9c25798802712e933fe07b19fd9a350c69a8c1 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 7 Jul 2026 16:11:15 +0100 Subject: [PATCH 15/15] fix(ci): estate-wide structural CI fixes - grant secret-scanner reusable its requested job permissions - drop invalid timeout-minutes on reusable-call jobs - drop hashFiles() from job-level if: expressions --- .github/workflows/mirror.yml | 1 - .github/workflows/secret-scanner.yml | 5 ++++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index fcff1f2..8ba570d 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -9,5 +9,4 @@ permissions: jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f - timeout-minutes: 10 secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 10729d0..3211a30 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,8 +11,11 @@ permissions: contents: read jobs: scan: + permissions: + contents: read + pull-requests: write + actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0 - timeout-minutes: 10 secrets: inherit trufflehog: runs-on: ubuntu-latest