diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index ad0a1a8..da79b54 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -30,7 +30,7 @@ permissions: contents: read jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@a521ed701f0e58cc5e7effd239b10b360908365a permissions: actions: read contents: read diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 604f838..c5eeda4 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -39,5 +39,5 @@ permissions: pull-requests: write jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@a521ed701f0e58cc5e7effd239b10b360908365a secrets: inherit diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 290c757..f299dff 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -37,4 +37,4 @@ jobs: contents: read security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@a521ed701f0e58cc5e7effd239b10b360908365a diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 042c606..aea0acb 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -19,7 +19,7 @@ permissions: contents: read jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@a521ed701f0e58cc5e7effd239b10b360908365a secrets: inherit permissions: actions: read diff --git a/CONTRIBUTING.adoc b/CONTRIBUTING.adoc new file mode 100644 index 0000000..10635e4 --- /dev/null +++ b/CONTRIBUTING.adoc @@ -0,0 +1,69 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Contributing to empty-linter +:toc: left + +Thank you for working on the negative-space diagnostics product. This +repository has an unusually strict honesty bar — please read the "Truth +conditions" section before writing a status claim anywhere. + +== Prerequisites + +* Bun at the pinned version (see `.github/workflows/dogfood-gate.yml` and README "Runtime and build"). +* optional: `just` for the task runner (`just test`, `just sync-check`, + `just audit`). +* optional: Guix — `guix shell -m manifest.scm` provides the supporting + toolchain (Bun itself is provisioned separately; see `manifest.scm`'s + note). + +== Development loop + +[source,bash] +---- +bun test # the full gate (must stay green) +bun run sync:check # downstream userscript/extension drift gate +bun run audit # self-audit at the critical threshold +bun run src/cli/Main.bun.js audit # audit arbitrary inputs +---- + +CI runs exactly these plus the estate gates (governance, hypatia, secret +scanner, SonarCloud). A PR is not ready while any of them is red. + +== Rules that are not negotiable + +. *Truth conditions* (from the originating roadmap issue): `configured`, + `wired`, `implemented`, `tested`, `proved`, and `deployed` are separate + statuses and must never be conflated in docs, commits, or PR text. No + demo, placeholder, or TODO module may be described as a capability. + Scanner errors must fail distinctly from findings (exit 2 vs 1 vs 0). + A clean result is only trusted because planted unsafe inputs are + detected. Audit mode never mutates input. +. *No literal invisible code points in source.* Plant test fixtures with + `String.fromCodePoint()` and numbers, or the checked-in generator under + `tests/fixtures/ietf-incident/` — never paste invisibles into a diff. + The self-audit gate will find them, and the estate gates will too. +. *Repair stays conservative.* Semantic-safety code points are never + offered as automatic repairs; ambiguous ones require named grants. + If you change this policy, you must change the refusal tests with it. +. *SPDX headers* on every file; docs in AsciiDoc; Bun is the sole tier-1 + JS runtime (no Node/npm/TypeScript in new code); SHA-256 or stronger + for any hashing. +. *Downstream tables are generated*, never hand-edited: userscript and + extension catalogue regions live between + `// BEGIN/END GENERATED: empty-linter-artifact-table` markers and are + regenerated with `bun run sync:downstream`. Hand edits get reverted by + the sync check. + +== Commits and PRs + +* Conventional Commits (`feat:`, `fix:`, `docs:`, `test:`, `chore:` …) — + the changelog is generated from them. +* One logical change per commit; suite must pass at every commit. +* State the evidence in the PR body (test counts, audit output), and state + what the PR does *not* do — inherited from this repository's + no-overclaim doctrine. + +== Security + +Please follow `SECURITY.adoc`; never open a public issue for a suspected +vulnerability. diff --git a/manifest.scm b/manifest.scm new file mode 100644 index 0000000..be88e67 --- /dev/null +++ b/manifest.scm @@ -0,0 +1,25 @@ +;; SPDX-License-Identifier: MPL-2.0 +;; SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell +;; +;; manifest.scm — developer environment for empty-linter. +;; +;; Estate package policy (0-canon/rsr/3-practice/LANGUAGE-POLICY.adoc, RULED +;; 2026-05-18): Guix is the primary packager, sealed container is the escape +;; hatch, Nix is not a tier. This file is the Guix artefact for this repo. +;; +;; Honest scope note: the product's tier-1 runtime is Bun, and Bun is not yet +;; packaged in GNU Guix. It is provisioned separately at a pinned version +;; (pinned in .github/workflows/dogfood-gate.yml; see README.adoc "Runtime and +;; build"). This manifest covers +;; the surrounding toolchain that Guix *does* carry, so +;; +;; guix shell -m manifest.scm +;; +;; reproduces the rest of the developer environment. When Bun lands in Guix, +;; add it here and retire the external pin. + +(specifications->manifest + '("just" ; task runner (Justfile) + "git" ; version control + diff tooling + "jq" ; inspecting the JSON surfaces (schemas, provenance, rescan) + "coreutils")) ; sha256sum et al. for provenance verification