diff --git a/.machine_readable/arrival-pack/claude-md.k9.ncl b/.machine_readable/arrival-pack/claude-md.k9.ncl index 67c861e..d3fbb1c 100644 --- a/.machine_readable/arrival-pack/claude-md.k9.ncl +++ b/.machine_readable/arrival-pack/claude-md.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # diff --git a/.machine_readable/coaptation/coapt.k9.ncl b/.machine_readable/coaptation/coapt.k9.ncl index 25fa568..2c065bf 100644 --- a/.machine_readable/coaptation/coapt.k9.ncl +++ b/.machine_readable/coaptation/coapt.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # diff --git a/.machine_readable/contractiles/adjust/adjust.k9.ncl b/.machine_readable/contractiles/adjust/adjust.k9.ncl index 0f1561e..4974ba7 100644 --- a/.machine_readable/contractiles/adjust/adjust.k9.ncl +++ b/.machine_readable/contractiles/adjust/adjust.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # adjust.k9.ncl — K9 trust-tier component of the adjust trident # Author: Jonathan D.A. Jewell diff --git a/.machine_readable/contractiles/bust/bust.k9.ncl b/.machine_readable/contractiles/bust/bust.k9.ncl index 3d28c22..cc8032e 100644 --- a/.machine_readable/contractiles/bust/bust.k9.ncl +++ b/.machine_readable/contractiles/bust/bust.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # bust.k9.ncl — K9 trust-tier component of the bust trident # Author: Jonathan D.A. Jewell @@ -50,6 +51,7 @@ let base = import "../_base.ncl" in allow_filesystem_write = false, allow_subprocess = true, probe_scope = 'read_only, + signature_required = true, }, }, diff --git a/.machine_readable/contractiles/dust/dust.k9.ncl b/.machine_readable/contractiles/dust/dust.k9.ncl index 183fc07..6c51e54 100644 --- a/.machine_readable/contractiles/dust/dust.k9.ncl +++ b/.machine_readable/contractiles/dust/dust.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # dust.k9.ncl — K9 trust-tier component of the dust trident # Author: Jonathan D.A. Jewell diff --git a/.machine_readable/contractiles/intend/intend.k9.ncl b/.machine_readable/contractiles/intend/intend.k9.ncl index 723d9bc..d8d83b7 100644 --- a/.machine_readable/contractiles/intend/intend.k9.ncl +++ b/.machine_readable/contractiles/intend/intend.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # intend.k9.ncl — K9 trust-tier component of the intend trident # Author: Jonathan D.A. Jewell @@ -63,6 +64,7 @@ let base = import "../_base.ncl" in allow_network = false, allow_filesystem_write = false, # evidence sinks are indirected allow_subprocess = true, + signature_required = true, }, }, diff --git a/.machine_readable/contractiles/must/must.k9.ncl b/.machine_readable/contractiles/must/must.k9.ncl index f139ef3..e6327ed 100644 --- a/.machine_readable/contractiles/must/must.k9.ncl +++ b/.machine_readable/contractiles/must/must.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # must.k9.ncl — K9 trust-tier component of the must trident # Author: Jonathan D.A. Jewell @@ -72,6 +73,7 @@ let base = import "../_base.ncl" in 'external_api, 'exploit_attempt, # that's trust's safe_hacking territory ], + signature_required = true, }, }, diff --git a/.machine_readable/contractiles/trust/trust.k9.ncl b/.machine_readable/contractiles/trust/trust.k9.ncl index 72ca271..32b48ed 100644 --- a/.machine_readable/contractiles/trust/trust.k9.ncl +++ b/.machine_readable/contractiles/trust/trust.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # trust.k9.ncl — K9 trust-tier component of the trust trident # Author: Jonathan D.A. Jewell @@ -77,6 +78,7 @@ let base = import "../_base.ncl" in allow_subprocess = true, authorised_probes_only = true, # probe section explicitly lists allowed targets + probe classes probe_scope_enforcement = 'this_repo_only, # probes NEVER hit external systems + signature_required = true, }, }, diff --git a/.machine_readable/self-validating/methodology-guard.k9.ncl b/.machine_readable/self-validating/methodology-guard.k9.ncl index 7a424d7..796b0eb 100644 --- a/.machine_readable/self-validating/methodology-guard.k9.ncl +++ b/.machine_readable/self-validating/methodology-guard.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> # diff --git a/container/stapeln/deploy.k9.ncl b/container/stapeln/deploy.k9.ncl index 02b7df4..8182fe8 100644 --- a/container/stapeln/deploy.k9.ncl +++ b/container/stapeln/deploy.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level) # diff --git a/crates/squabble-core/src/gate.rs b/crates/squabble-core/src/gate.rs index a28d2df..1e424da 100644 --- a/crates/squabble-core/src/gate.rs +++ b/crates/squabble-core/src/gate.rs @@ -26,7 +26,6 @@ pub enum CheckRun { Passed, } - /// Why a required context shows [`CheckRun::Missing`]. /// /// `Missing` is the gate's most common stuck state and its least actionable one: @@ -234,9 +233,15 @@ mod tests { #[test] fn missing_cause_is_optional_and_does_not_alter_gate_state() { // A diagnosis explains a stuck gate; it must never move it. - let undiagnosed = Gate::new(vec![RequiredCheck::new("scan / gitleaks", CheckRun::Missing)]); - let diagnosed = Gate::new(vec![RequiredCheck::new("scan / gitleaks", CheckRun::Missing) - .with_cause(MissingCause::DeadActionPin)]); + let undiagnosed = Gate::new(vec![RequiredCheck::new( + "scan / gitleaks", + CheckRun::Missing, + )]); + let diagnosed = Gate::new(vec![RequiredCheck::new( + "scan / gitleaks", + CheckRun::Missing, + ) + .with_cause(MissingCause::DeadActionPin)]); assert_eq!(undiagnosed.evaluate(), GateState::Blocked); assert_eq!(diagnosed.evaluate(), GateState::Blocked); assert_eq!(diagnosed.evaluate(), undiagnosed.evaluate()); @@ -244,7 +249,9 @@ mod tests { #[test] fn remedy_is_offered_only_for_diagnosed_missing_checks() { - assert!(RequiredCheck::new("x", CheckRun::Missing).remedy().is_none()); + assert!(RequiredCheck::new("x", CheckRun::Missing) + .remedy() + .is_none()); assert!(RequiredCheck::new("x", CheckRun::Passed) .with_cause(MissingCause::NoSuchJob) .remedy() @@ -270,7 +277,11 @@ mod tests { RequiredCheck::new("a", CheckRun::Passed), RequiredCheck::new("b", CheckRun::Missing).with_cause(cause), ]); - assert_ne!(g.evaluate(), GateState::Green, "{cause:?} must not reach Green"); + assert_ne!( + g.evaluate(), + GateState::Green, + "{cause:?} must not reach Green" + ); } } }