From daca9a54960dfedbcf065683062fcbd4d6ac9b76 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 26 May 2026 12:25:57 +0100 Subject: [PATCH 01/10] chore(fixtures): delete stale SafeDOMExample.res ReScript fixture (Refs gitbot-fleet#148, #208; affinescript#229) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Removes 2 copies of the stale SafeDOMExample.res ReScript fixture from this repo. One of 1,267 byte-clustered copies across the estate (129 repos). ReScript is fully banned in new code (2026-04-30 policy refresh). Current-grammar AffineScript replacement lives at gitbot-fleet/bots/*/examples/SafeDOMExample.affine (PR gitbot-fleet#210 MERGED). The example fixtures are not load-bearing — propagated from an earlier template-instantiation script. Refs hyperpolymath/gitbot-fleet#148, #208 Refs hyperpolymath/affinescript#57, #229 Co-Authored-By: Claude Opus 4.7 (1M context) --- affinescript/examples/SafeDOMExample.res | 109 ----------------------- examples/SafeDOMExample.res | 109 ----------------------- 2 files changed, 218 deletions(-) delete mode 100644 affinescript/examples/SafeDOMExample.res delete mode 100644 examples/SafeDOMExample.res diff --git a/affinescript/examples/SafeDOMExample.res b/affinescript/examples/SafeDOMExample.res deleted file mode 100644 index e5c9046..0000000 --- a/affinescript/examples/SafeDOMExample.res +++ /dev/null @@ -1,109 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Example: Using SafeDOM for formally verified DOM mounting - -open SafeDOM - -// Example 1: Basic mounting with error handling -let mountApp = () => { - mountSafe( - "#app", - "

Hello, World!

Mounted safely with proofs.

", - ~onSuccess=el => { - Console.log("✓ App mounted successfully!") - Console.log("Element:", el) - }, - ~onError=err => { - Console.error("✗ Mount failed:", err) - } - ) -} - -// Example 2: Wait for DOM ready before mounting -let mountWhenDOMReady = () => { - mountWhenReady( - "#app", - "

App Title

", - ~onSuccess=_ => Console.log("✓ Mounted after DOM ready"), - ~onError=err => Console.error("✗ Failed:", err) - ) -} - -// Example 3: Batch mounting (atomic - all or nothing) -let mountMultiple = () => { - let specs = [ - {selector: "#header", html: "

Site Title

"}, - {selector: "#nav", html: ""}, - {selector: "#main", html: "

Content here

"}, - {selector: "#footer", html: ""} - ] - - switch mountBatch(specs) { - | Ok(elements) => { - Console.log(`✓ Successfully mounted ${Array.length(elements)} elements`) - elements->Array.forEach(el => Console.log(" -", el)) - } - | Error(err) => { - Console.error("✗ Batch mount failed:", err) - Console.error(" (None were mounted - atomic operation)") - } - } -} - -// Example 4: Explicit validation before mounting -let mountWithValidation = () => { - // Validate selector first - switch ProvenSelector.validate("#my-app") { - | Error(e) => Console.error(`Invalid selector: ${e}`) - | Ok(validSelector) => { - // Validate HTML - switch ProvenHTML.validate("
Content
") { - | Error(e) => Console.error(`Invalid HTML: ${e}`) - | Ok(validHtml) => { - // Now mount with proven safety - switch mount(validSelector, validHtml) { - | Mounted(el) => Console.log("✓ Mounted with validated inputs:", el) - | MountPointNotFound(s) => Console.error(`✗ Element not found: ${s}`) - | InvalidSelector(_) => Console.error("Impossible - already validated") - | InvalidHTML(_) => Console.error("Impossible - already validated") - } - } - } - } -} - -// Example 5: Integration with TEA -module MyApp = { - type model = {message: string} - type msg = NoOp - - let init = () => {message: "Hello from TEA"} - let update = (model, _msg) => model - let view = model => `

${model.message}

` -} - -let mountTEAApp = () => { - let model = MyApp.init() - let html = MyApp.view(model) - - mountWhenReady( - "#tea-app", - html, - ~onSuccess=el => { - Console.log("✓ TEA app mounted") - // Set up event handlers, subscriptions here - }, - ~onError=err => Console.error(`✗ TEA mount failed: ${err}`) - ) -} - -// Entry point -let main = () => { - Console.log("SafeDOM Examples") - Console.log("================\n") - - // Choose which example to run - mountWhenDOMReady() // Run on DOM ready -} - -// Auto-execute when module loads -main() diff --git a/examples/SafeDOMExample.res b/examples/SafeDOMExample.res deleted file mode 100644 index e5c9046..0000000 --- a/examples/SafeDOMExample.res +++ /dev/null @@ -1,109 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Example: Using SafeDOM for formally verified DOM mounting - -open SafeDOM - -// Example 1: Basic mounting with error handling -let mountApp = () => { - mountSafe( - "#app", - "

Hello, World!

Mounted safely with proofs.

", - ~onSuccess=el => { - Console.log("✓ App mounted successfully!") - Console.log("Element:", el) - }, - ~onError=err => { - Console.error("✗ Mount failed:", err) - } - ) -} - -// Example 2: Wait for DOM ready before mounting -let mountWhenDOMReady = () => { - mountWhenReady( - "#app", - "

App Title

", - ~onSuccess=_ => Console.log("✓ Mounted after DOM ready"), - ~onError=err => Console.error("✗ Failed:", err) - ) -} - -// Example 3: Batch mounting (atomic - all or nothing) -let mountMultiple = () => { - let specs = [ - {selector: "#header", html: "

Site Title

"}, - {selector: "#nav", html: ""}, - {selector: "#main", html: "

Content here

"}, - {selector: "#footer", html: ""} - ] - - switch mountBatch(specs) { - | Ok(elements) => { - Console.log(`✓ Successfully mounted ${Array.length(elements)} elements`) - elements->Array.forEach(el => Console.log(" -", el)) - } - | Error(err) => { - Console.error("✗ Batch mount failed:", err) - Console.error(" (None were mounted - atomic operation)") - } - } -} - -// Example 4: Explicit validation before mounting -let mountWithValidation = () => { - // Validate selector first - switch ProvenSelector.validate("#my-app") { - | Error(e) => Console.error(`Invalid selector: ${e}`) - | Ok(validSelector) => { - // Validate HTML - switch ProvenHTML.validate("
Content
") { - | Error(e) => Console.error(`Invalid HTML: ${e}`) - | Ok(validHtml) => { - // Now mount with proven safety - switch mount(validSelector, validHtml) { - | Mounted(el) => Console.log("✓ Mounted with validated inputs:", el) - | MountPointNotFound(s) => Console.error(`✗ Element not found: ${s}`) - | InvalidSelector(_) => Console.error("Impossible - already validated") - | InvalidHTML(_) => Console.error("Impossible - already validated") - } - } - } - } -} - -// Example 5: Integration with TEA -module MyApp = { - type model = {message: string} - type msg = NoOp - - let init = () => {message: "Hello from TEA"} - let update = (model, _msg) => model - let view = model => `

${model.message}

` -} - -let mountTEAApp = () => { - let model = MyApp.init() - let html = MyApp.view(model) - - mountWhenReady( - "#tea-app", - html, - ~onSuccess=el => { - Console.log("✓ TEA app mounted") - // Set up event handlers, subscriptions here - }, - ~onError=err => Console.error(`✗ TEA mount failed: ${err}`) - ) -} - -// Entry point -let main = () => { - Console.log("SafeDOM Examples") - Console.log("================\n") - - // Choose which example to run - mountWhenDOMReady() // Run on DOM ready -} - -// Auto-execute when module loads -main() From 5485926ca61da06e27f2e92cb1577dc28f88b7f2 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 1 Jun 2026 03:19:36 +0100 Subject: [PATCH 02/10] ci: fix CI/CD configuration (campaigns C001-C005) --- .github/copilot/coding-agent.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .github/copilot/coding-agent.yml diff --git a/.github/copilot/coding-agent.yml b/.github/copilot/coding-agent.yml new file mode 100644 index 0000000..a719a77 --- /dev/null +++ b/.github/copilot/coding-agent.yml @@ -0,0 +1,6 @@ +mcp_servers: + boj-server: + command: npx + args: ["-y", "@hyperpolymath/boj-server@latest"] + env: + BOJ_URL: http://localhost:7700 From 3be96b56e79c86f592541d2b4f3be20dc38928f3 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 1 Jun 2026 03:22:16 +0100 Subject: [PATCH 03/10] ci: fix CI/CD configuration (campaigns C001-C005) --- affinescript/.github/workflows/codeql.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/affinescript/.github/workflows/codeql.yml b/affinescript/.github/workflows/codeql.yml index ad25f9c..ac874c8 100644 --- a/affinescript/.github/workflows/codeql.yml +++ b/affinescript/.github/workflows/codeql.yml @@ -9,6 +9,7 @@ on: schedule: - cron: '0 6 * * 1' + permissions: read-all jobs: From 196929a2bb57604398bd4b0a547e6a1d580b929e Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 4 Jun 2026 17:47:47 +0100 Subject: [PATCH 04/10] chore: rename k9 directories to self-validating for clarity --- .devcontainer/README.adoc | 1 + .github/CODE_OF_CONDUCT.md | 4 + .github/CONTRIBUTING.md | 4 + .github/DIRECTORY.adoc | 2 + .github/GOVERNANCE.md | 6 +- .github/SECURITY.md | 4 + .github/copilot-instructions.md | 5 +- .github/pull_request_template.md | 5 +- .github/workflows/boj-build.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dependabot-automerge.yml | 1 + .github/workflows/dogfood-gate.yml | 6 + .github/workflows/guix-nix-policy.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 7 + .github/workflows/npm-bun-blocker.yml | 1 + .github/workflows/openssf-compliance.yml | 1 + .github/workflows/quality.yml | 2 + .github/workflows/release.yml | 3 + .github/workflows/rhodibot.yml | 1 + .github/workflows/rsr-antipattern.yml | 184 +----------------- .github/workflows/rust-ci.yml | 2 + .github/workflows/scorecard-enforcer.yml | 2 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 3 + .github/workflows/security-policy.yml | 1 + .github/workflows/static-analysis-gate.yml | 4 + .github/workflows/ts-blocker.yml | 1 + .github/workflows/wellknown-enforcement.yml | 1 + .github/workflows/workflow-linter.yml | 1 + .machine_readable/6a2/0-AI-MANIFEST.a2ml | 31 +++ .machine_readable/6a2/README.adoc | 30 +++ .../6a2/anchor/0-AI-MANIFEST.a2ml | 21 ++ .../{anchors => 6a2/anchor}/ANCHOR.a2ml | 0 .../ANCHOR_2026_05_21.a2ml} | 0 .machine_readable/6a2/anchor/README.adoc | 25 +++ .machine_readable/README.adoc | 2 + .../agent_instructions/README.adoc | 2 +- .machine_readable/ai/PLACEHOLDERS.adoc | 2 + .machine_readable/ai/README.adoc | 2 + .machine_readable/anchors/README.adoc | 2 + .machine_readable/configs/README.adoc | 2 + .machine_readable/contractiles/README.adoc | 2 + .machine_readable/policies/README.adoc | 2 + .machine_readable/scripts/forge/README.adoc | 2 + .../scripts/lifecycle/README.adoc | 2 + .../scripts/verification/README.adoc | 2 + .../svc/{k9 => self-validating}/README.adoc | 1 + .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../methodology-guard.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 AUDIT.adoc | 3 +- CHANGELOG.md | 4 + CODE_OF_CONDUCT.md | 5 +- CONTRIBUTING.md | 5 +- EXPLAINME.adoc | 1 + LICENSE | 165 +++++++--------- PROOF-NEEDS.md | 5 +- PROOF-STATUS.md | 5 +- QUICKSTART-DEV.adoc | 1 + QUICKSTART-MAINTAINER.adoc | 1 + QUICKSTART-USER.adoc | 1 + READINESS.md | 5 +- README.adoc | 7 +- ROADMAP.adoc | 1 + SECURITY.md | 5 +- TEMPLATE-STANDARDS-AUDIT.adoc | 1 + TEST-NEEDS.md | 4 + TOPOLOGY.md | 5 +- affinescript/.claude/CLAUDE.md | 18 +- affinescript/.claude/PROJECT.md | 4 + .../.github/ISSUE_TEMPLATE/bug_report.md | 4 + .../.github/ISSUE_TEMPLATE/documentation.md | 4 + .../.github/ISSUE_TEMPLATE/feature_request.md | 4 + .../.github/ISSUE_TEMPLATE/question.md | 4 + .../.github/workflows/casket-pages.yml | 2 + affinescript/.github/workflows/ci.yml | 2 + affinescript/.github/workflows/codeql.yml | 1 + .../.github/workflows/guix-nix-policy.yml | 1 + .../.github/workflows/hypatia-scan.yml | 1 + .../.github/workflows/instant-sync.yml | 1 + affinescript/.github/workflows/mirror.yml | 7 + .../.github/workflows/npm-bun-blocker.yml | 1 + affinescript/.github/workflows/quality.yml | 2 + affinescript/.github/workflows/release.yml | 1 + .../.github/workflows/rsr-antipattern.yml | 1 + .../.github/workflows/scorecard-enforcer.yml | 2 + affinescript/.github/workflows/scorecard.yml | 1 + .../.github/workflows/secret-scanner.yml | 3 + .../.github/workflows/security-policy.yml | 1 + affinescript/.github/workflows/semgrep.yml | 1 + affinescript/.github/workflows/ts-blocker.yml | 1 + .../workflows/wellknown-enforcement.yml | 1 + .../.github/workflows/workflow-linter.yml | 1 + .../agent_instructions/README.adoc | 2 +- .../contractiles/README.adoc | 2 + affinescript/ABI-FFI-README.md | 4 + affinescript/ALPHA-1-RELEASE-NOTES.md | 4 + affinescript/BACKEND-ANALYSIS.md | 4 + affinescript/BACKEND-IMPLEMENTATION.md | 4 + affinescript/CODE_OF_CONDUCT.md | 4 + affinescript/COMPILER-CAPABILITIES.md | 4 + affinescript/CONTRIBUTING.md | 4 + affinescript/CONTROLS-REFERENCE.md | 4 + affinescript/DAMAGE-SYSTEM.md | 4 + affinescript/EXPLAINME.adoc | 1 + affinescript/FIXES_2026-01-23.md | 4 + affinescript/GAME-BUNDLING-STRATEGY.md | 4 + affinescript/LICENSING-GUIDE.md | 4 + affinescript/MAINTAINERS.adoc | 1 + affinescript/MODULE-SYSTEM-PROGRESS.md | 4 + affinescript/NAVIGATION.adoc | 1 + affinescript/PHASE3-ASSESSMENT.md | 4 + affinescript/PHASE3-COMPLETE.md | 4 + affinescript/PHASE3-SESSION-SUMMARY.md | 4 + affinescript/PROOF-NEEDS.md | 4 + affinescript/README.adoc | 3 +- affinescript/REPLY-SUM-TYPES.md | 5 +- affinescript/ROADMAP.adoc | 2 + affinescript/RSR_OUTLINE.adoc | 2 + affinescript/SECURITY-SETUP.md | 4 + affinescript/SECURITY.md | 4 + affinescript/SESSION-2026-01-23.md | 4 + affinescript/SESSION-COMPLETE.md | 4 + affinescript/SPARK-experiment/README.adoc | 1 + affinescript/TRAIT_SYSTEM_STATUS.md | 4 + affinescript/conformance/README.md | 4 + .../distributions/rattlescript/README.adoc | 1 + .../distributions/rattlescript/build.rs | 1 + .../distributions/rattlescript/src/main.rs | 1 + affinescript/docs/ALIB-INTEGRATION.md | 4 + affinescript/docs/BRIDGE-DECISIONS.md | 4 + affinescript/docs/CITATIONS.adoc | 2 + affinescript/docs/DESIGN-VISION.adoc | 1 + affinescript/docs/EFFECTS-IMPLEMENTATION.md | 4 + affinescript/docs/README.adoc | 1 + .../docs/WASM-EFFECT-HANDLER-WORKAROUND.md | 4 + affinescript/docs/academic/README.md | 4 + .../axiomatic-semantics.md | 4 + .../denotational-semantics.md | 4 + .../operational-semantics.md | 4 + .../formal-verification/solo-core/Context.idr | 1 + .../solo-core/Quantity.idr | 1 + .../formal-verification/solo-core/README.adoc | 1 + .../solo-core/Soundness.idr | 1 + .../formal-verification/solo-core/Syntax.idr | 1 + .../formal-verification/solo-core/Typing.idr | 1 + .../categorical-semantics.md | 4 + .../complexity-analysis.md | 4 + .../logic-foundations.md | 4 + .../docs/academic/mechanized/agda/README.md | 4 + .../docs/academic/mechanized/coq/README.md | 4 + .../docs/academic/mechanized/lean/README.md | 4 + .../proofs/coherence-parametricity.md | 4 + .../docs/academic/proofs/dependent-types.md | 4 + .../docs/academic/proofs/effect-soundness.md | 4 + .../academic/proofs/inference-algorithm.md | 4 + .../academic/proofs/ownership-soundness.md | 4 + .../academic/proofs/quantitative-types.md | 4 + .../docs/academic/proofs/row-polymorphism.md | 4 + .../docs/academic/proofs/type-soundness.md | 4 + .../tropical-unification-2026-04-04.md | 4 + .../academic/white-papers/language-design.md | 4 + affinescript/docs/alib/README.md | 4 + .../docs/governance/CODE_OF_CONDUCT.md | 5 +- .../docs/governance/CONTRIBUTING.adoc | 1 + affinescript/docs/governance/MAINTAINERS.adoc | 1 + affinescript/docs/governance/SECURITY.md | 4 + affinescript/docs/guides/TESTING-REPORT.adoc | 2 + .../docs/guides/WHAT-MAKES-IT-BRILLIANT.md | 4 + affinescript/docs/guides/frontier-guide.adoc | 1 + .../Human_Programming_Guide.adoc | 2 + .../guides/lessons/01-hello-affinescript.md | 4 + affinescript/docs/guides/lessons/README.md | 4 + affinescript/docs/guides/warmup/README.adoc | 1 + .../TYPECHECKER-COMPLETION-2026-01-23.md | 4 + affinescript/docs/spec.md | 4 + .../docs/specs/SETTLED-DECISIONS.adoc | 1 + affinescript/docs/specs/SPEC.md | 4 + affinescript/docs/specs/faces.md | 4 + affinescript/docs/standards/DECISIONS.md | 4 + affinescript/docs/standards/PALIMPSEST.adoc | 2 + affinescript/docs/standards/RELEASE.md | 4 + affinescript/docs/standards/ROADMAP.md | 4 + .../docs/tutorial/lesson-02-functions.md | 4 + affinescript/docs/tutorial/lesson-03-data.md | 4 + .../docs/tutorial/lesson-04-patterns.md | 4 + affinescript/docs/tutorial/lesson-05-types.md | 4 + .../docs/tutorial/lesson-06-errors.md | 4 + .../docs/tutorial/lesson-07-effects.md | 4 + .../docs/tutorial/lesson-08-generics.md | 4 + .../docs/tutorial/lesson-09-modules.md | 4 + .../docs/tutorial/lesson-10-building.md | 4 + .../tree-sitter-affinescript/README.md | 4 + .../tree-sitter-affinescript/grammar.js | 3 +- affinescript/editors/vscode/README.md | 4 + affinescript/editors/vscode/src/extension.ts | 3 +- affinescript/ffi/zig/build.zig | 3 +- affinescript/ffi/zig/src/main.zig | 3 +- .../ffi/zig/test/integration_test.zig | 3 +- affinescript/js/runtime.js | 3 +- affinescript/packages/affine-js/README.adoc | 1 + affinescript/packages/affine-js/marshal.js | 2 +- affinescript/packages/affine-js/mod.js | 2 +- affinescript/packages/affine-js/runtime.js | 2 +- affinescript/packages/affine-js/types.d.ts | 2 +- affinescript/packages/affine-res/README.adoc | 1 + affinescript/packages/affine-ts/README.adoc | 1 + affinescript/packages/affine-ts/mod.js | 2 +- affinescript/packages/affine-ts/types.d.ts | 2 +- affinescript/run_wasm.js | 2 + affinescript/runtime/src/alloc.rs | 1 + affinescript/runtime/src/effects.rs | 1 + affinescript/runtime/src/ffi.rs | 1 + affinescript/runtime/src/gc.rs | 1 + affinescript/runtime/src/lib.rs | 1 + affinescript/runtime/src/panic.rs | 1 + affinescript/site/index.md | 4 + affinescript/stdlib/README.md | 4 + affinescript/tests/codegen/README.md | 4 + affinescript/tests/conformance/README.md | 4 + .../tools/affine-doc/assets/search.js | 3 +- affinescript/tools/affine-doc/src/extract.rs | 5 +- affinescript/tools/affine-doc/src/html.rs | 5 +- affinescript/tools/affine-doc/src/index.rs | 5 +- affinescript/tools/affine-doc/src/main.rs | 5 +- affinescript/tools/affine-doc/src/render.rs | 5 +- affinescript/tools/affine-pkg/src/build.rs | 5 +- affinescript/tools/affine-pkg/src/config.rs | 5 +- affinescript/tools/affine-pkg/src/lockfile.rs | 5 +- affinescript/tools/affine-pkg/src/main.rs | 4 +- affinescript/tools/affine-pkg/src/manifest.rs | 5 +- affinescript/tools/affine-pkg/src/registry.rs | 5 +- affinescript/tools/affine-pkg/src/resolve.rs | 5 +- affinescript/tools/affine-pkg/src/storage.rs | 5 +- .../tools/affine-pkg/src/workspace.rs | 5 +- .../tools/affinescript-dap/src/main.rs | 3 +- .../affinescript-lsp/src/capabilities.rs | 3 +- .../tools/affinescript-lsp/src/diagnostics.rs | 3 +- .../tools/affinescript-lsp/src/document.rs | 3 +- .../tools/affinescript-lsp/src/handlers.rs | 3 +- .../tools/affinescript-lsp/src/main.rs | 4 +- .../tools/affinescript-lsp/src/symbols.rs | 3 +- .../tools/affinescript-lsp/src/text_index.rs | 3 +- affinescript/wiki/README.md | 4 + affinescript/wiki/compiler/architecture.md | 4 + affinescript/wiki/compiler/borrow-checker.md | 4 + affinescript/wiki/compiler/codegen.md | 4 + affinescript/wiki/compiler/lexer.md | 4 + affinescript/wiki/compiler/parser.md | 4 + affinescript/wiki/compiler/type-checker.md | 4 + .../language-reference/dependent-types.md | 4 + .../wiki/language-reference/effects.md | 4 + .../wiki/language-reference/functions.md | 4 + .../wiki/language-reference/lexical.md | 4 + .../wiki/language-reference/modules.md | 4 + .../wiki/language-reference/ownership.md | 4 + .../wiki/language-reference/patterns.md | 4 + affinescript/wiki/language-reference/rows.md | 4 + .../wiki/language-reference/traits.md | 4 + affinescript/wiki/language-reference/types.md | 4 + affinescript/wiki/stdlib/overview.md | 4 + affinescript/wiki/testing/guide.md | 4 + affinescript/wiki/testing/property-based.md | 4 + affinescript/wiki/tooling/cli.md | 4 + affinescript/wiki/tooling/repl.md | 4 + affinescript/wiki/tutorials/introduction.md | 4 + affinescript/wiki/tutorials/quickstart.md | 4 + container/README.adoc | 2 +- crates/burrower-cli/src/main.rs | 2 +- crates/burrower-core/src/attempt.rs | 2 +- crates/burrower-core/src/corpus.rs | 2 +- crates/burrower-core/src/goal.rs | 2 +- crates/burrower-core/src/ledger.rs | 2 +- crates/burrower-core/src/lib.rs | 2 +- crates/burrower-core/src/oracle.rs | 2 +- crates/burrower-core/src/ranking.rs | 2 +- crates/burrower-core/src/serve.rs | 2 +- crates/burrower-core/src/specialist.rs | 2 +- crates/burrower-wasm/src/lib.rs | 2 +- docs/AGENT-DSL.adoc | 1 + docs/ECHIDNA-INTEGRATION.adoc | 1 + docs/QUICKSTART.adoc | 2 + docs/README.adoc | 2 + docs/RSR_OUTLINE.adoc | 2 + docs/STATE-VISUALIZER.adoc | 2 + docs/SWARM-DESIGN-MEANDER.adoc | 1 + docs/TYPED-WASM-VERIFICATION.adoc | 1 + docs/architecture/THREAT-MODEL.adoc | 2 + docs/attribution/CITATIONS.adoc | 2 + docs/attribution/CODEOWNERS.adoc | 2 + docs/attribution/MAINTAINERS.adoc | 1 + docs/attribution/README.adoc | 2 + docs/decisions/0000-template.adoc | 2 + docs/decisions/0001-adopt-rsr-standard.adoc | 2 + docs/decisions/README.adoc | 2 + docs/developer/ABI-FFI-README.adoc | 2 + docs/developer/README.adoc | 2 + .../REPORT.adoc | 1 + docs/governance/CRG-AUDIT-TEMPLATE.adoc | 3 +- docs/governance/CRG-CRITERIA.adoc | 2 + docs/governance/MAINTENANCE-CHECKLIST.adoc | 2 + docs/governance/README.adoc | 2 + .../SOFTWARE-DEVELOPMENT-APPROACH.adoc | 2 + docs/governance/TSDM.adoc | 2 + docs/governance/audit/README.adoc | 2 + docs/governance/audit/compliance/README.adoc | 2 + docs/governance/audit/effects/README.adoc | 2 + docs/governance/audit/systems/README.adoc | 2 + docs/governance/maintenance/README.adoc | 2 + .../maintenance/adaptive/README.adoc | 2 + .../maintenance/corrective/README.adoc | 2 + .../maintenance/perfective/README.adoc | 2 + docs/governance/planning/README.adoc | 2 + docs/governance/planning/could/README.adoc | 2 + docs/governance/planning/must/README.adoc | 2 + docs/governance/planning/should/README.adoc | 2 + docs/practice/AI-CONVENTIONS.adoc | 2 + docs/practice/README.adoc | 2 + docs/practice/STATE-VISUALIZER-GUIDE.adoc | 1 + docs/practice/ci-cost-reduction.adoc | 1 + docs/reports/README.adoc | 2 + docs/reports/audit/pillar-audit-2026-04-15.md | 4 + docs/reports/compliance/README.adoc | 2 + docs/reports/maintenance/README.adoc | 2 + docs/reports/performance/README.adoc | 2 + docs/reports/quality/README.adoc | 2 + docs/reports/security/README.adoc | 2 + docs/standards/README.adoc | 2 + docs/templates/contractiles/README.adoc | 1 + docs/theory/README.adoc | 2 + docs/theory/computing/README.adoc | 2 + docs/theory/formalisms/README.adoc | 2 + docs/theory/mathematics/README.adoc | 2 + docs/theory/ontologies/README.adoc | 2 + docs/theory/other/README.adoc | 2 + docs/theory/socio-technical/README.adoc | 2 + docs/whitepapers/README.adoc | 2 + docs/whitepapers/academic/README.adoc | 2 + docs/whitepapers/industry/README.adoc | 2 + docs/whitepapers/outreach/README.adoc | 2 + docs/wikis/README.adoc | 2 + examples/README.adoc | 2 + features/README.adoc | 2 + features/boj-server/README.adoc | 2 + features/panic-attacker/README.adoc | 2 + features/ssg/README.adoc | 2 + llm-warmup-dev.md | 4 + llm-warmup-user.md | 4 + session/README.md | 4 + src/README.adoc | 2 + src/aspects/README.adoc | 2 + src/aspects/integrity/README.adoc | 2 + src/aspects/observability/README.adoc | 2 + src/aspects/security/README.adoc | 2 + src/contracts/README.adoc | 2 + src/definitions/README.adoc | 2 + src/errors/README.adoc | 2 + src/interface/Abi/Foreign.idr | 1 + src/interface/Abi/Layout.idr | 1 + src/interface/Abi/README.adoc | 2 + src/interface/Abi/Types.idr | 1 + src/interface/README.adoc | 2 + src/interface/ffi/README.adoc | 2 + src/interface/ffi/build.zig | 2 +- src/interface/ffi/src/README.adoc | 2 + src/interface/ffi/src/main.zig | 3 +- src/interface/ffi/test/README.adoc | 2 + src/interface/ffi/test/integration_test.zig | 4 +- src/interface/generated/README.adoc | 2 + src/interface/generated/abi/README.adoc | 2 + tests/fuzz/README.adoc | 2 +- tools/invariant-path/README.adoc | 2 + verification/README.adoc | 2 + verification/benchmarks/README.adoc | 2 + verification/coverage/README.adoc | 2 + verification/fuzzing/README.adoc | 2 + verification/proofs/README.adoc | 3 +- verification/proofs/idris2/ABI/Compliance.idr | 2 +- verification/proofs/idris2/ABI/Foreign.idr | 2 +- verification/proofs/idris2/ABI/Layout.idr | 2 +- verification/proofs/idris2/ABI/Platform.idr | 2 +- verification/proofs/idris2/ABI/Pointers.idr | 2 +- verification/proofs/idris2/Types.idr | 2 +- verification/safety_case/README.adoc | 2 + verification/simulations/README.adoc | 2 + verification/tests/README.adoc | 2 + verification/traceability/README.adoc | 2 + 393 files changed, 1098 insertions(+), 403 deletions(-) create mode 100644 .machine_readable/6a2/0-AI-MANIFEST.a2ml create mode 100644 .machine_readable/6a2/README.adoc create mode 100644 .machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml rename .machine_readable/{anchors => 6a2/anchor}/ANCHOR.a2ml (100%) rename .machine_readable/6a2/{ANCHOR.a2ml => anchor/ANCHOR_2026_05_21.a2ml} (100%) create mode 100644 .machine_readable/6a2/anchor/README.adoc rename .machine_readable/svc/{k9 => self-validating}/README.adoc (98%) rename .machine_readable/svc/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename .machine_readable/svc/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename .machine_readable/svc/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename .machine_readable/svc/{k9 => self-validating}/methodology-guard.k9.ncl (100%) rename .machine_readable/svc/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename .machine_readable/svc/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename .machine_readable/svc/{k9 => self-validating}/template-yard.k9.ncl (100%) diff --git a/.devcontainer/README.adoc b/.devcontainer/README.adoc index f6e8388..b0ff99e 100644 --- a/.devcontainer/README.adoc +++ b/.devcontainer/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Dev Container Usage :author: Jonathan D.A. Jewell diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md index 4323d75..71500ab 100644 --- a/.github/CODE_OF_CONDUCT.md +++ b/.github/CODE_OF_CONDUCT.md @@ -1,3 +1,7 @@ + # Code of Conduct # Clone the repository git clone https://github.com/hyperpolymath/proof-burrower.git cd proof-burrower diff --git a/.github/DIRECTORY.adoc b/.github/DIRECTORY.adoc index a97d220..b4caddf 100644 --- a/.github/DIRECTORY.adoc +++ b/.github/DIRECTORY.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = .github Pillar diff --git a/.github/GOVERNANCE.md b/.github/GOVERNANCE.md index 6d93704..d477737 100644 --- a/.github/GOVERNANCE.md +++ b/.github/GOVERNANCE.md @@ -1,5 +1,7 @@ - - + # Project Governance This document describes the governance model for **Proof Burrower**. diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 9c2ff60..210e01e 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -1,3 +1,7 @@ + # Security Policy + diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 63eb6ad..9f5155c 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,4 +1,7 @@ - + ## Summary diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index f933154..20848c4 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -18,6 +18,7 @@ permissions: jobs: trigger-boj: runs-on: ubuntu-latest + timeout-minutes: 15 if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }} steps: - name: Checkout diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c475caf..e547933 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,6 +23,7 @@ permissions: jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 92b5254..6d98f9c 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -50,6 +50,7 @@ jobs: # Only run for PRs actually authored by Dependabot. if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Fetch Dependabot metadata diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index a9b8da5..3807e9a 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -22,6 +22,7 @@ jobs: a2ml-validate: name: Validate A2ML manifests runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -66,6 +67,7 @@ jobs: k9-validate: name: Validate K9 contracts runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -115,6 +117,7 @@ jobs: empty-lint: name: Empty-linter (invisible characters) runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -179,6 +182,7 @@ jobs: groove-check: name: Groove manifest check runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -237,6 +241,7 @@ jobs: eclexiaiser-validate: name: Validate eclexiaiser manifest runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -300,6 +305,7 @@ print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))') dogfood-summary: name: Dogfooding compliance summary runs-on: ubuntu-latest + timeout-minutes: 15 needs: [a2ml-validate, k9-validate, empty-lint, groove-check, eclexiaiser-validate] if: always() diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml index 0c4f5c5..5812c24 100644 --- a/.github/workflows/guix-nix-policy.yml +++ b/.github/workflows/guix-nix-policy.yml @@ -8,6 +8,7 @@ permissions: jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9e88ff0..2b7513d 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -24,6 +24,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index d022c3e..e1d2d9d 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index efdb7b7..f86bc9c 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -13,6 +13,7 @@ permissions: jobs: mirror-gitlab: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITLAB_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -31,6 +32,7 @@ jobs: mirror-bitbucket: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.BITBUCKET_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -49,6 +51,7 @@ jobs: mirror-codeberg: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.CODEBERG_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -67,6 +70,7 @@ jobs: mirror-sourcehut: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.SOURCEHUT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -85,6 +89,7 @@ jobs: mirror-disroot: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.DISROOT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -103,6 +108,7 @@ jobs: mirror-gitea: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITEA_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -121,6 +127,7 @@ jobs: mirror-radicle: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.RADICLE_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/npm-bun-blocker.yml b/.github/workflows/npm-bun-blocker.yml index 2fd984f..d442599 100644 --- a/.github/workflows/npm-bun-blocker.yml +++ b/.github/workflows/npm-bun-blocker.yml @@ -8,6 +8,7 @@ permissions: jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml index c2262ed..6f00e2a 100644 --- a/.github/workflows/openssf-compliance.yml +++ b/.github/workflows/openssf-compliance.yml @@ -16,6 +16,7 @@ permissions: jobs: openssf-compliance: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index c6dde0b..a3b2a7a 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -9,6 +9,7 @@ permissions: jobs: lint: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: @@ -41,6 +42,7 @@ jobs: docs: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e49a7b5..5f18a11 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,6 +18,7 @@ jobs: build: name: Build Artifacts runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: @@ -78,6 +79,7 @@ jobs: changelog: name: Generate Changelog runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read outputs: @@ -124,6 +126,7 @@ jobs: name: Create GitHub Release needs: [build, changelog] runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: write steps: diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index a82f178..471d9d4 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -27,6 +27,7 @@ permissions: jobs: rhodibot: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml index 30bd3c4..c581aef 100644 --- a/.github/workflows/rsr-antipattern.yml +++ b/.github/workflows/rsr-antipattern.yml @@ -1,9 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 -# RSR Anti-Pattern CI Check -# SPDX-License-Identifier: MPL-2.0 -# -# Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm -# Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme +# RSR Anti-Pattern Check - Uses reusable workflow from standards name: RSR Anti-Pattern Check @@ -13,182 +9,8 @@ on: pull_request: branches: [main, master, develop] - -permissions: - contents: read - jobs: antipattern-check: - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Check for TypeScript - run: | - python3 << 'PYEOF' - import re, sys, pathlib - - # Universal allowlist — bridges and conventions that need no per-repo declaration. - # Implemented as explicit string predicates rather than glob patterns so that - # top-level directories (e.g. tests/foo.ts) are matched the same as nested ones, - # which fnmatch's * cannot do reliably. - DIR_NAMES_ALLOWED = { - 'bindings', 'tests', 'test', 'scripts', - 'mcp-adapter', 'cli', 'vendor', 'examples', 'ffi', - 'node_modules', 'benchmarks', - } - - def builtin_allowed(p): - # `p` is a posix-style path with no leading ./ - # 1. Type declaration files - if p.endswith('.d.ts'): - return True - # 2. Canonical Deno entrypoint filenames - base = p.rsplit('/', 1)[-1] - if base == 'mod.ts': - return True - # 3. LSP server files (filename suffixes) - if base in ('lsp-server.ts', 'lsp_server.ts', 'lsp.ts') or base.endswith('-lsp.ts'): - return True - # 4. Benchmark files (filename suffixes) - if base.endswith('.bench.ts') or base.endswith('_bench.ts'): - return True - # 5. Any directory segment (excluding basename) matches an allowed dir - segs = p.split('/') - for s in segs[:-1]: - if s in DIR_NAMES_ALLOWED: - return True - # vscode-anything or anything-vscode - if 'vscode' in s: - return True - # deno-named subprojects - if s.startswith('deno-'): - return True - return False - - # Per-repo exemptions parsed from .claude/CLAUDE.md "TypeScript Exemptions" table. - # This is the documented single source of truth: adding one row here unblocks CI. - # Glob characters: '*' and '**' both mean "any chars including /". This loose - # interpretation matches user intent when an exemption row reads, e.g., - # `affinescript-deno-test/*.ts` (covering nested files too). - def glob_to_regex(g): - out = [] - for c in g.lstrip('./'): - if c == '*': out.append('.*') - elif c == '?': out.append('.') - elif c in '.+(){}[]|^$\\': out.append(re.escape(c)) - else: out.append(c) - return re.compile('^' + ''.join(out) + '$') - - exemption_patterns = [] - claude_md = pathlib.Path('.claude/CLAUDE.md') - if claude_md.exists(): - in_table = False - for line in claude_md.read_text(encoding='utf-8').splitlines(): - if re.search(r'TypeScript [Ee]xemptions', line): - in_table = True - continue - if in_table and line.startswith(('### ', '## ', '# ')): - break - if in_table and line.startswith('|'): - m = re.match(r'\|\s*`([^`]+)`', line) - if m: - exemption_patterns.append((m.group(1), glob_to_regex(m.group(1)))) - - def exempt(p): - for raw, regex in exemption_patterns: - if regex.match(p): - return True - # Also allow exact-path matches and prefix matches for paths - # ending in `/` - if p == raw.lstrip('./'): - return True - if raw.endswith('/') and p.startswith(raw.lstrip('./')): - return True - return False - - # Find all .ts and .tsx files (excluding common dot-dirs that find normally skips) - found = [] - for ext in ('ts', 'tsx'): - for p in pathlib.Path('.').rglob(f'*.{ext}'): - parts = p.parts - if any(part.startswith('.') and part not in ('.', '..') for part in parts): - continue - found.append(p.as_posix().lstrip('./')) - - bad = sorted(f for f in found if not (builtin_allowed(f) or exempt(f))) - if bad: - print("❌ TypeScript files detected outside the allowlist.\n") - for f in bad: - print(f" {f}") - print() - print("To resolve, choose one:") - print(" (a) migrate the file to AffineScript") - print(" (see Human_Programming_Guide.adoc 'Migrating from -script Languages')") - print(" (b) move to an allowlisted bridge path") - print(" (bindings/, tests/, test/, scripts/, benchmarks/, mcp-adapter/,") - print(" *vscode*/, cli/, deno-*/, vendor/, examples/, ffi/)") - print(" (c) add an entry to the 'TypeScript Exemptions' table in .claude/CLAUDE.md") - print(" with rationale + unblock condition") - if exemption_patterns: - print(f"\n(Currently {len(exemption_patterns)} exemption(s) parsed from .claude/CLAUDE.md.)") - sys.exit(1) - print(f"✅ No TypeScript files outside allowlist ({len(exemption_patterns)} per-repo exemption(s) parsed).") - PYEOF - - - name: Check for Go - run: | - if find . -name "*.go" | grep -q .; then - echo "❌ Go files detected - use Rust/WASM instead" - find . -name "*.go" - exit 1 - fi - echo "✅ No Go files" - - - name: Check for Python (non-SaltStack) - run: | - PY_FILES=$(find . -name "*.py" | grep -v salt | grep -v _states | grep -v _modules | grep -v pillar | grep -v venv | grep -v __pycache__ || true) - if [ -n "$PY_FILES" ]; then - echo "❌ Python files detected - only allowed for SaltStack" - echo "$PY_FILES" - exit 1 - fi - echo "✅ No non-SaltStack Python files" - - - name: Check for npm lockfiles - run: | - if [ -f "package-lock.json" ] || [ -f "yarn.lock" ]; then - echo "❌ npm/yarn lockfile detected - use Deno instead" - exit 1 - fi - echo "✅ No npm lockfiles" - - - name: Check for tsconfig - run: | - if [ -f "tsconfig.json" ]; then - echo "❌ tsconfig.json detected - use ReScript instead" - exit 1 - fi - echo "✅ No tsconfig.json" - - - name: Verify Deno presence (if package.json exists) - run: | - if [ -f "package.json" ]; then - if [ ! -f "deno.json" ] && [ ! -f "deno.jsonc" ]; then - echo "⚠️ Warning: package.json without deno.json - migration recommended" - fi - fi - echo "✅ Deno configuration check complete" + uses: hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml@main + timeout-minutes: 10 - - name: Summary - run: | - echo "╔════════════════════════════════════════════════════════════╗" - echo "║ RSR Anti-Pattern Check Passed ✅ ║" - echo "║ ║" - echo "║ Allowed: ReScript, Deno, WASM, Rust, OCaml, Haskell, ║" - echo "║ Guile/Scheme, SaltStack (Python) ║" - echo "║ ║" - echo "║ Blocked: TypeScript, Go, npm, Python (non-Salt) ║" - echo "╚════════════════════════════════════════════════════════════╝" diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 003d611..607820d 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -18,6 +18,7 @@ jobs: check: name: Cargo check + clippy + fmt runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('Cargo.toml') != '' steps: @@ -44,6 +45,7 @@ jobs: test: name: Cargo test runs-on: ubuntu-latest + timeout-minutes: 15 needs: check if: hashFiles('Cargo.toml') != '' diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index 6933b78..57535d0 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -23,6 +23,7 @@ permissions: jobs: scorecard: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write # For OIDC @@ -61,6 +62,7 @@ jobs: # Check specific high-priority items check-critical: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 620ed0a..7c792b4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -21,6 +21,7 @@ permissions: jobs: analysis: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 3ba3bac..1fcbb66 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -21,6 +21,7 @@ permissions: jobs: trufflehog: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: @@ -35,6 +36,7 @@ jobs: gitleaks: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: @@ -48,6 +50,7 @@ jobs: # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index d90ca3d..1ae27fd 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -8,6 +8,7 @@ permissions: jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index e48efaf..740ef5a 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -19,6 +19,7 @@ jobs: panic-attack-assail: name: panic-attack assail runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -123,6 +124,7 @@ jobs: hypatia-scan: name: Hypatia neurosymbolic scan runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -236,6 +238,7 @@ jobs: patch-bridge-triage: name: Patch Bridge CVE triage runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository @@ -325,6 +328,7 @@ jobs: deposit-findings: name: Deposit findings for gitbot-fleet runs-on: ubuntu-latest + timeout-minutes: 15 needs: [panic-attack-assail, hypatia-scan, patch-bridge-triage] if: always() diff --git a/.github/workflows/ts-blocker.yml b/.github/workflows/ts-blocker.yml index 432a88f..a363f48 100644 --- a/.github/workflows/ts-blocker.yml +++ b/.github/workflows/ts-blocker.yml @@ -8,6 +8,7 @@ permissions: jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml index 9a04a72..a28acdd 100644 --- a/.github/workflows/wellknown-enforcement.yml +++ b/.github/workflows/wellknown-enforcement.yml @@ -21,6 +21,7 @@ permissions: jobs: validate: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 18f0975..12e2637 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -18,6 +18,7 @@ permissions: jobs: lint-workflows: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read diff --git a/.machine_readable/6a2/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/0-AI-MANIFEST.a2ml new file mode 100644 index 0000000..6bf1f8c --- /dev/null +++ b/.machine_readable/6a2/0-AI-MANIFEST.a2ml @@ -0,0 +1,31 @@ +# AI Manifest for 6a2 Directory + +## Purpose + +This manifest declares the AI-assistant context for the 6a2 machine-readable metadata directory. + +## Canonical Locations + +The 6 core A2ML files MUST exist in this directory: +1. AGENTIC.a2ml +2. ECOSYSTEM.a2ml +3. META.a2ml +4. NEUROSYM.a2ml +5. PLAYBOOK.a2ml +6. STATE.a2ml + +## Invariants + +- No duplicate files in root directory +- Single source of truth: this directory is authoritative +- No stale metadata + +## Protocol + +When multiple agents may write to A2ML files concurrently: +1. Read file and record git-sha-at-read in [provenance] section +2. Lock by creating .lock- +3. Write updated file with new [provenance] metadata +4. Release by removing lock file +5. On conflict: re-read and retry if git-sha-at-read does not match HEAD + diff --git a/.machine_readable/6a2/README.adoc b/.machine_readable/6a2/README.adoc new file mode 100644 index 0000000..bc033d7 --- /dev/null +++ b/.machine_readable/6a2/README.adoc @@ -0,0 +1,30 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +# A2ML 6a2 Directory + +This directory contains the 6 core A2ML machine-readable metadata files for this repository. + +## Files + +- `AGENTIC.a2ml` - AI agent operational gating, safety controls +- `ECOSYSTEM.a2ml` - Project ecosystem position, relationships, explicit boundaries +- `META.a2ml` - Architecture decisions (ADRs), development practices, design rationale +- `NEUROSYM.a2ml` - Symbolic semantics, composition algebra +- `PLAYBOOK.a2ml` - Executable plans, operational runbooks +- `STATE.a2ml` - Project state, phase, milestones, session history + +## Standards Compliance + +These files follow the A2ML Format Family specification from: +https://github.com/hyperpolymath/standards/tree/main/a2ml + +## Generation + +These files may be generated from .scm source files using transpilation tools. +Source .scm files should be removed after successful transpilation. + +## See Also + +- [A2ML Repository Template](https://github.com/hyperpolymath/standards/blob/main/A2ML-REPO-TEMPLATE.adoc) +- [6A2 Format Family](https://github.com/hyperpolymath/standards#a2ml-format-family-7-formats) + diff --git a/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml new file mode 100644 index 0000000..0dd6825 --- /dev/null +++ b/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml @@ -0,0 +1,21 @@ +# AI Manifest for Anchor Directory + +## Purpose + +This manifest declares the AI-assistant context for the anchor machine-readable metadata directory. + +## Canonical Locations + +ANCHOR.a2ml files MUST exist in this directory. + +## Multiple Versions + +Unlike other A2ML files, multiple versions of ANCHOR.a2ml with different dates MAY exist. +Each version represents a specific recalibration point. + +## Invariants + +- Multiple versions with different dates are permitted +- No other A2ML files in this directory +- Single source of truth for anchor documents + diff --git a/.machine_readable/anchors/ANCHOR.a2ml b/.machine_readable/6a2/anchor/ANCHOR.a2ml similarity index 100% rename from .machine_readable/anchors/ANCHOR.a2ml rename to .machine_readable/6a2/anchor/ANCHOR.a2ml diff --git a/.machine_readable/6a2/ANCHOR.a2ml b/.machine_readable/6a2/anchor/ANCHOR_2026_05_21.a2ml similarity index 100% rename from .machine_readable/6a2/ANCHOR.a2ml rename to .machine_readable/6a2/anchor/ANCHOR_2026_05_21.a2ml diff --git a/.machine_readable/6a2/anchor/README.adoc b/.machine_readable/6a2/anchor/README.adoc new file mode 100644 index 0000000..bd23e35 --- /dev/null +++ b/.machine_readable/6a2/anchor/README.adoc @@ -0,0 +1,25 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +# A2ML Anchor Directory + +This directory contains ANCHOR.a2ml files for project recalibration and scope intervention. + +## Files + +- `ANCHOR.a2ml` - Project recalibration, scope intervention, canonical authority + +## Multiple Versions + +Unlike other A2ML files, multiple versions of ANCHOR.a2ml with different dates may exist. +Each version represents a specific recalibration point in the project history. + +## Standards Compliance + +These files follow the ANCHOR.a2ml specification from: +https://github.com/hyperpolymath/standards/tree/main/anchor-a2ml + +## See Also + +- [A2ML Repository Template](https://github.com/hyperpolymath/standards/blob/main/A2ML-REPO-TEMPLATE.adoc) +- [Anchor A2ML Spec](https://github.com/hyperpolymath/standards/tree/main/anchor-a2ml) + diff --git a/.machine_readable/README.adoc b/.machine_readable/README.adoc index 471d6c7..e72996d 100644 --- a/.machine_readable/README.adoc +++ b/.machine_readable/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = .machine_readable Pillar diff --git a/.machine_readable/agent_instructions/README.adoc b/.machine_readable/agent_instructions/README.adoc index 9bc2e24..e5fec01 100644 --- a/.machine_readable/agent_instructions/README.adoc +++ b/.machine_readable/agent_instructions/README.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell = Agent Instructions :toc: preamble diff --git a/.machine_readable/ai/PLACEHOLDERS.adoc b/.machine_readable/ai/PLACEHOLDERS.adoc index 825f873..44a12c0 100644 --- a/.machine_readable/ai/PLACEHOLDERS.adoc +++ b/.machine_readable/ai/PLACEHOLDERS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Template Placeholders # Template Placeholders diff --git a/.machine_readable/ai/README.adoc b/.machine_readable/ai/README.adoc index 121bbc8..8cf2ea7 100644 --- a/.machine_readable/ai/README.adoc +++ b/.machine_readable/ai/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = AI Guidance Directory Put AI-facing instructions in this folder. diff --git a/.machine_readable/anchors/README.adoc b/.machine_readable/anchors/README.adoc index 1b27c02..c264945 100644 --- a/.machine_readable/anchors/README.adoc +++ b/.machine_readable/anchors/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = anchors Registry diff --git a/.machine_readable/configs/README.adoc b/.machine_readable/configs/README.adoc index 616b9e7..2ab097e 100644 --- a/.machine_readable/configs/README.adoc +++ b/.machine_readable/configs/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = configs Registry diff --git a/.machine_readable/contractiles/README.adoc b/.machine_readable/contractiles/README.adoc index d40fcd1..2b8aed7 100644 --- a/.machine_readable/contractiles/README.adoc +++ b/.machine_readable/contractiles/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractiles Template Set :toc: :sectnums: diff --git a/.machine_readable/policies/README.adoc b/.machine_readable/policies/README.adoc index b7e25f5..045e5af 100644 --- a/.machine_readable/policies/README.adoc +++ b/.machine_readable/policies/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = policies Registry diff --git a/.machine_readable/scripts/forge/README.adoc b/.machine_readable/scripts/forge/README.adoc index 31adef6..a43f1d2 100644 --- a/.machine_readable/scripts/forge/README.adoc +++ b/.machine_readable/scripts/forge/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Forge Scripts diff --git a/.machine_readable/scripts/lifecycle/README.adoc b/.machine_readable/scripts/lifecycle/README.adoc index 8d262b1..481283e 100644 --- a/.machine_readable/scripts/lifecycle/README.adoc +++ b/.machine_readable/scripts/lifecycle/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Lifecycle Scripts diff --git a/.machine_readable/scripts/verification/README.adoc b/.machine_readable/scripts/verification/README.adoc index 277b4aa..19fcf01 100644 --- a/.machine_readable/scripts/verification/README.adoc +++ b/.machine_readable/scripts/verification/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Verification Scripts diff --git a/.machine_readable/svc/k9/README.adoc b/.machine_readable/svc/self-validating/README.adoc similarity index 98% rename from .machine_readable/svc/k9/README.adoc rename to .machine_readable/svc/self-validating/README.adoc index 143e746..3be2b8a 100644 --- a/.machine_readable/svc/k9/README.adoc +++ b/.machine_readable/svc/self-validating/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = K9 Contractiles :toc: left :icons: font diff --git a/.machine_readable/svc/k9/examples/ci-config.k9.ncl b/.machine_readable/svc/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/examples/ci-config.k9.ncl rename to .machine_readable/svc/self-validating/examples/ci-config.k9.ncl diff --git a/.machine_readable/svc/k9/examples/project-metadata.k9.ncl b/.machine_readable/svc/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/examples/project-metadata.k9.ncl rename to .machine_readable/svc/self-validating/examples/project-metadata.k9.ncl diff --git a/.machine_readable/svc/k9/examples/setup-repo.k9.ncl b/.machine_readable/svc/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/examples/setup-repo.k9.ncl rename to .machine_readable/svc/self-validating/examples/setup-repo.k9.ncl diff --git a/.machine_readable/svc/k9/methodology-guard.k9.ncl b/.machine_readable/svc/self-validating/methodology-guard.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/methodology-guard.k9.ncl rename to .machine_readable/svc/self-validating/methodology-guard.k9.ncl diff --git a/.machine_readable/svc/k9/template-hunt.k9.ncl b/.machine_readable/svc/self-validating/template-hunt.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/template-hunt.k9.ncl rename to .machine_readable/svc/self-validating/template-hunt.k9.ncl diff --git a/.machine_readable/svc/k9/template-kennel.k9.ncl b/.machine_readable/svc/self-validating/template-kennel.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/template-kennel.k9.ncl rename to .machine_readable/svc/self-validating/template-kennel.k9.ncl diff --git a/.machine_readable/svc/k9/template-yard.k9.ncl b/.machine_readable/svc/self-validating/template-yard.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/template-yard.k9.ncl rename to .machine_readable/svc/self-validating/template-yard.k9.ncl diff --git a/AUDIT.adoc b/AUDIT.adoc index cd5669d..0f4f5ac 100644 --- a/AUDIT.adoc +++ b/AUDIT.adoc @@ -1,6 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - +// Copyright (c) Jonathan D.A. Jewell = Audit Gate Codex v1.1, 2026-04-07 diff --git a/CHANGELOG.md b/CHANGELOG.md index 8109476..66fa7a0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,7 @@ + # Changelog All notable changes to this project will be documented in this file. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 1f1548c..9020def 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -1,4 +1,7 @@ - + # Contributor Covenant Code of Conduct ## Our Pledge diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1d8caa1..8779679 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,4 +1,7 @@ - + # Contributing 1. Fork the repository diff --git a/EXPLAINME.adoc b/EXPLAINME.adoc index cff5314..a7c01d0 100644 --- a/EXPLAINME.adoc +++ b/EXPLAINME.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repo - Explainme :toc: :icons: font diff --git a/LICENSE b/LICENSE index 4a7f1aa..d0a1fa1 100644 --- a/LICENSE +++ b/LICENSE @@ -1,38 +1,3 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) - ------------------------------------------------------------------------- -PREFERRED LICENCE: Palimpsest License (MPL-2.0) ------------------------------------------------------------------------- - -This work is governed by the Palimpsest License (MPL-2.0) as -its primary intended licence. MPL-2.0 extends the Mozilla -Public License 2.0 (MPL-2.0) with additional provisions for ethical use, -post-quantum cryptographic provenance, and emotional lineage protection. -The canonical PMPL text and stewardship information are maintained at: - https://github.com/hyperpolymath/palimpsest-license - ------------------------------------------------------------------------- -FALLBACK LICENCE: Mozilla Public License 2.0 (MPL-2.0) ------------------------------------------------------------------------- - -Because MPL-2.0 is not yet recognised by the Open Source -Initiative (OSI) or equivalent bodies, this work also carries MPL-2.0 -as its legally-recognised fallback licence. - -In any jurisdiction, platform, or context where MPL-2.0 is -not accepted as a valid licence, or where an OSI-approved licence is -required, this work is instead governed by the Mozilla Public License, -Version 2.0. - -MPL-2.0 was chosen as the fallback because MPL-2.0 is -explicitly based on and extends MPL-2.0; it is therefore the closest -recognised equivalent to the intended licence. - -The complete MPL-2.0 text follows below. - ------------------------------------------------------------------------- - Mozilla Public License Version 2.0 ================================== @@ -109,17 +74,17 @@ Mozilla Public License Version 2.0 means the form of the work preferred for making modifications. 1.14. "You" (or "Your") - means an individual or a legal entity exercising rights under - this License. For legal entities, "You" includes any entity that - controls, is controlled by, or is under common control with You. - For the purposes of this definition, "control" means (a) the power, - direct or indirect, to cause the direction or management of such - entity, whether by contract or otherwise, or (b) ownership of more - than fifty percent (50%) of the outstanding shares or beneficial + means an individual or a legal entity exercising rights under this + License. For legal entities, "You" includes any entity that + controls, is controlled by, or is under common control with You. For + purposes of this definition, "control" means (a) the power, direct + or indirect, to cause the direction or management of such entity, + whether by contract or otherwise, or (b) ownership of more than + fifty percent (50%) of the outstanding shares or beneficial ownership of such entity. 2. License Grants and Conditions ---------------------------------- +-------------------------------- 2.1. Grants @@ -144,11 +109,11 @@ distributes such Contribution. 2.3. Limitations on Grant Scope -The licenses granted in this Section 2 are the only rights granted -under this License. No additional rights or licenses will be implied -from the distribution or licensing of Covered Software under this -License. Notwithstanding Section 2.1(b) above, no patent license is -granted by a Contributor: +The licenses granted in this Section 2 are the only rights granted under +this License. No additional rights or licenses will be implied from the +distribution or licensing of Covered Software under this License. +Notwithstanding Section 2.1(b) above, no patent license is granted by a +Contributor: (a) for any code that a Contributor has removed from Covered Software; or @@ -158,19 +123,19 @@ granted by a Contributor: Contributions with other software (except as part of its Contributor Version); or -(c) under Patent Claims infringed by Covered Software in the absence - of its Contributions. +(c) under Patent Claims infringed by Covered Software in the absence of + its Contributions. -This License does not grant any rights in the trademarks, service -marks, or logos of any Contributor (except as may be necessary to -comply with the notice requirements in Section 3.4). +This License does not grant any rights in the trademarks, service marks, +or logos of any Contributor (except as may be necessary to comply with +the notice requirements in Section 3.4). 2.4. Subsequent Licenses No Contributor makes additional grants as a result of Your choice to distribute the Covered Software under a subsequent version of this -License (see Section 10.2) or under the terms of a Secondary License -(if permitted under the terms of Section 3.3). +License (see Section 10.2) or under the terms of a Secondary License (if +permitted under the terms of Section 3.3). 2.5. Representation @@ -186,11 +151,11 @@ equivalents. 2.7. Conditions -Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses -granted in Section 2.1. +Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted +in Section 2.1. 3. Responsibilities --------------------- +------------------- 3.1. Distribution of Source Form @@ -207,10 +172,10 @@ Form. If You distribute Covered Software in Executable Form then: (a) such Covered Software must also be made available in Source Code - Form, as described in Section 3.1, and You must inform recipients - of the Executable Form how they can obtain a copy of such Source - Code Form by reasonable means in a timely manner, at a charge no - more than the cost of distribution to the recipient; and + Form, as described in Section 3.1, and You must inform recipients of + the Executable Form how they can obtain a copy of such Source Code + Form by reasonable means in a timely manner, at a charge no more + than the cost of distribution to the recipient; and (b) You may distribute such Executable Form under the terms of this License, or sublicense it under different terms, provided that the @@ -222,8 +187,8 @@ If You distribute Covered Software in Executable Form then: You may create and distribute a Larger Work under terms of Your choice, provided that You also comply with the requirements of this License for the Covered Software. If the Larger Work is a combination of Covered -Software with a work governed by one or more Secondary Licenses, and -the Covered Software is not Incompatible With Secondary Licenses, this +Software with a work governed by one or more Secondary Licenses, and the +Covered Software is not Incompatible With Secondary Licenses, this License permits You to additionally distribute such Covered Software under the terms of such Secondary License(s), so that the recipient of the Larger Work may, at their option, further distribute the Covered @@ -241,28 +206,28 @@ the extent required to remedy known factual inaccuracies. 3.5. Application of Additional Terms You may choose to offer, and to charge a fee for, warranty, support, -indemnity or liability obligations to one or more recipients of -Covered Software. However, You may do so only on Your own behalf, and -not on behalf of any Contributor. You must make it absolutely clear -that any such warranty, support, indemnity, or liability obligation is -offered by You alone, and You hereby agree to indemnify every -Contributor for any liability incurred by such Contributor as a result -of warranty, support, indemnity or liability terms You offer. You may -include additional disclaimers of warranty and limitations of liability -specific to any jurisdiction. +indemnity or liability obligations to one or more recipients of Covered +Software. However, You may do so only on Your own behalf, and not on +behalf of any Contributor. You must make it absolutely clear that any +such warranty, support, indemnity, or liability obligation is offered by +You alone, and You hereby agree to indemnify every Contributor for any +liability incurred by such Contributor as a result of warranty, support, +indemnity or liability terms You offer. You may include additional +disclaimers of warranty and limitations of liability specific to any +jurisdiction. 4. Inability to Comply Due to Statute or Regulation ------------------------------------------------------ +--------------------------------------------------- If it is impossible for You to comply with any of the terms of this License with respect to some or all of the Covered Software due to statute, judicial order, or regulation then You must: (a) comply with the terms of this License to the maximum extent possible; and (b) -describe the limitations and the code they affect. Such description -must be placed in a text file included with all distributions of the -Covered Software under this License. Except to the extent prohibited -by statute or regulation, such description must be sufficiently -detailed for a recipient of ordinary skill to be able to understand it. +describe the limitations and the code they affect. Such description must +be placed in a text file included with all distributions of the Covered +Software under this License. Except to the extent prohibited by statute +or regulation, such description must be sufficiently detailed for a +recipient of ordinary skill to be able to understand it. 5. Termination -------------- @@ -271,27 +236,27 @@ detailed for a recipient of ordinary skill to be able to understand it. if You fail to comply with any of its terms. However, if You become compliant, then the rights granted under this License from a particular Contributor are reinstated (a) provisionally, unless and until such -Contributor explicitly and finally terminates Your grants, and (b) on -an ongoing basis, if such Contributor fails to notify You of the +Contributor explicitly and finally terminates Your grants, and (b) on an +ongoing basis, if such Contributor fails to notify You of the non-compliance by some reasonable means prior to 60 days after You have come back into compliance. Moreover, Your grants from a particular Contributor are reinstated on an ongoing basis if such Contributor -notifies You of the non-compliance by some reasonable means, this is -the first time You have received notice of non-compliance with this -License from such Contributor, and You become compliant prior to 30 -days after Your receipt of the notice. +notifies You of the non-compliance by some reasonable means, this is the +first time You have received notice of non-compliance with this License +from such Contributor, and You become compliant prior to 30 days after +Your receipt of the notice. -5.2. If You initiate litigation against any entity by asserting a -patent infringement claim (excluding declaratory judgment actions, +5.2. If You initiate litigation against any entity by asserting a patent +infringement claim (excluding declaratory judgment actions, counter-claims, and cross-claims) alleging that a Contributor Version directly or indirectly infringes any patent, then the rights granted to You by any and all Contributors for the Covered Software under Section 2.1 of this License shall terminate. 5.3. In the event of termination under Sections 5.1 or 5.2 above, all -end user license agreements (excluding distributors and resellers) -which have been validly granted by You or Your distributors under this -License prior to termination shall survive termination. +end user license agreements (excluding distributors and resellers) which +have been validly granted by You or Your distributors under this License +prior to termination shall survive termination. ************************************************************************ * * @@ -346,7 +311,7 @@ Nothing in this Section shall prevent a party's ability to bring cross-claims or counter-claims. 9. Miscellaneous ------------------ +---------------- This License represents the complete agreement concerning the subject matter hereof. If any provision of this License is held to be @@ -356,14 +321,14 @@ that the language of a contract shall be construed against the drafter shall not be used to construe this License against a Contributor. 10. Versions of the License ----------------------------- +--------------------------- 10.1. New Versions -Mozilla Foundation is the license steward. Except as provided in -Section 10.3, no one other than the license steward has the right to -modify or publish new versions of this License. Each version will be -given a distinguishing version number. +Mozilla Foundation is the license steward. Except as provided in Section +10.3, no one other than the license steward has the right to modify or +publish new versions of this License. Each version will be given a +distinguishing version number. 10.2. Effect of New Versions @@ -392,17 +357,17 @@ Exhibit A - Source Code Form License Notice This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this - file, You can obtain one at http://mozilla.org/MPL/2.0/. + file, You can obtain one at https://mozilla.org/MPL/2.0/. If it is not possible or desirable to put the notice in a particular file, then You may include the notice in a location (such as a LICENSE -file in a relevant directory) where a recipient would be likely to -look for such a notice. +file in a relevant directory) where a recipient would be likely to look +for such a notice. You may add additional accurate notices of copyright ownership. Exhibit B - "Incompatible With Secondary Licenses" Notice ----------------------------------------------------------- +--------------------------------------------------------- This Source Code Form is "Incompatible With Secondary Licenses", as defined by the Mozilla Public License, v. 2.0. diff --git a/PROOF-NEEDS.md b/PROOF-NEEDS.md index 5978cef..c53009d 100644 --- a/PROOF-NEEDS.md +++ b/PROOF-NEEDS.md @@ -1,5 +1,8 @@ + # Proof Requirements — Proof Burrower - diff --git a/PROOF-STATUS.md b/PROOF-STATUS.md index bdd29f2..7187ce8 100644 --- a/PROOF-STATUS.md +++ b/PROOF-STATUS.md @@ -1,5 +1,8 @@ + # Proof Status — Proof Burrower - diff --git a/QUICKSTART-DEV.adoc b/QUICKSTART-DEV.adoc index 6ac07fa..c267ae8 100644 --- a/QUICKSTART-DEV.adoc +++ b/QUICKSTART-DEV.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Template: QUICKSTART-DEV.adoc — clone → build → test → PR // Replace rsr-template-repo, cargo build, cargo test, Rust + typed-wasm with actuals = rsr-template-repo — Quick Start for Developers diff --git a/QUICKSTART-MAINTAINER.adoc b/QUICKSTART-MAINTAINER.adoc index 1d6b1d8..03ca41c 100644 --- a/QUICKSTART-MAINTAINER.adoc +++ b/QUICKSTART-MAINTAINER.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Template: QUICKSTART-MAINTAINER.adoc — packaging, deploying, and maintaining // Replace rsr-template-repo, proof-burrower, {{DEPS}} with actuals = rsr-template-repo — Quick Start for Platform Maintainers diff --git a/QUICKSTART-USER.adoc b/QUICKSTART-USER.adoc index c85eabe..4992e32 100644 --- a/QUICKSTART-USER.adoc +++ b/QUICKSTART-USER.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Template: QUICKSTART-USER.adoc — 5-minute path to working software // Replace rsr-template-repo, Rsr Template Repo — See README.adoc for details., just run, Rsr Template Repo started successfully. with actuals = rsr-template-repo — Quick Start for Users diff --git a/READINESS.md b/READINESS.md index 6aa6cc8..160367e 100644 --- a/READINESS.md +++ b/READINESS.md @@ -1,4 +1,7 @@ - + # Proof Burrower Component Readiness Assessment diff --git a/README.adoc b/README.adoc index aa13b40..de03c05 100644 --- a/README.adoc +++ b/README.adoc @@ -1,11 +1,12 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) = PseudoScript :toc: :toc-placement: preamble image:https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=opensourcesecurity[OpenSSF Best Practices,link="https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/proof-burrower"] -image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] +image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[License: MPL-2.0,link="https://opensource.org/licenses/MPL-2.0"] image:https://api.thegreenwebfoundation.org/greencheckimage/github.com[Green Web,link="https://www.thegreenwebfoundation.org/green-web-check/?url=github.com"] Pseudocode-syntax AffineScript. @@ -183,4 +184,6 @@ PseudoScript-specific contributions (branding, examples, tutorials, the == License -MPL-2.0. See link:LICENSE[LICENSE]. +This project is licensed under the Mozilla Public License, v. 2.0. See the `LICENSE` file for details. + +SPDX-License-Identifier: MPL-2.0 \ No newline at end of file diff --git a/ROADMAP.adoc b/ROADMAP.adoc index 3648ef1..128ed39 100644 --- a/ROADMAP.adoc +++ b/ROADMAP.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = YOUR Template Repo Roadmap == Current Status diff --git a/SECURITY.md b/SECURITY.md index 1a29117..88df5ba 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,4 +1,7 @@ - + # Security Policy ## Reporting a Vulnerability diff --git a/TEMPLATE-STANDARDS-AUDIT.adoc b/TEMPLATE-STANDARDS-AUDIT.adoc index 43e13ce..f79065e 100644 --- a/TEMPLATE-STANDARDS-AUDIT.adoc +++ b/TEMPLATE-STANDARDS-AUDIT.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Template Standards Audit Codex v1.0, 2026-04-07 diff --git a/TEST-NEEDS.md b/TEST-NEEDS.md index 9fc5451..1d68060 100644 --- a/TEST-NEEDS.md +++ b/TEST-NEEDS.md @@ -1,3 +1,7 @@ + # TEST-NEEDS: rsr-template-repo ## CRG Grade: C — ACHIEVED 2026-04-04 diff --git a/TOPOLOGY.md b/TOPOLOGY.md index c3107b3..98995e1 100644 --- a/TOPOLOGY.md +++ b/TOPOLOGY.md @@ -1,4 +1,7 @@ - + # Architecture Topology diff --git a/affinescript/.claude/CLAUDE.md b/affinescript/.claude/CLAUDE.md index be706cd..0f93a21 100644 --- a/affinescript/.claude/CLAUDE.md +++ b/affinescript/.claude/CLAUDE.md @@ -1,3 +1,7 @@ + ## Machine-Readable Artefacts The following files in `.machine_readable/` contain structured project metadata: @@ -19,14 +23,14 @@ The following files in `.machine_readable/` contain structured project metadata: | Language/Tool | Use Case | Notes | |---------------|----------|-------| -| **ReScript** | Primary application code | Compiles to JS, type-safe | +| **AffineScript** | Primary application code | Compiles to JS, type-safe | | **Deno** | Runtime & package management | Replaces Node/npm/bun | | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools | | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI | | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like | | **Gleam** | Backend services | Runs on BEAM or compiles to JS | | **Bash/POSIX Shell** | Scripts, automation | Keep minimal | -| **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs | +| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs | | **Python** | SaltStack only | No other Python permitted | | **Nickel** | Configuration language | For complex configs | | **A2ML** | State/meta files | .machine_readable/6a2/STATE.a2ml, .machine_readable/6a2/META.a2ml, .machine_readable/6a2/ECOSYSTEM.a2ml | @@ -38,13 +42,13 @@ The following files in `.machine_readable/` contain structured project metadata: | Banned | Replacement | |--------|-------------| -| TypeScript | ReScript | +| TypeScript | AffineScript | | Node.js | Deno | | npm | Deno | | Bun | Deno | | pnpm/yarn | Deno | | Go | Rust | -| Python (general) | ReScript/Rust | +| Python (general) | AffineScript/Rust | | Java/Kotlin | Rust/Tauri/Dioxus | | Swift | Tauri/Dioxus | | React Native | Tauri/Dioxus | @@ -54,15 +58,15 @@ The following files in `.machine_readable/` contain structured project metadata: **No exceptions for Kotlin/Swift** - use Rust-first approach: -1. **Tauri 2.0+** - Web UI (ReScript) + Rust backend, MIT/Apache-2.0 +1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0 2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0 Both are FOSS with independent governance (no Big Tech). ### Enforcement Rules -1. **No new TypeScript files** - Convert existing TS to ReScript -2. **No package.json for runtime deps** - Use deno.json imports +1. **No new TypeScript files** - Convert existing TS to AffineScript +2. **No package.json - use deno.json deps** - Use deno.json imports 3. **No node_modules in production** - Deno caches deps automatically 4. **No Go code** - Use Rust instead 5. **Python only for SaltStack** - All other Python must be rewritten diff --git a/affinescript/.claude/PROJECT.md b/affinescript/.claude/PROJECT.md index e03dfb7..090b68b 100644 --- a/affinescript/.claude/PROJECT.md +++ b/affinescript/.claude/PROJECT.md @@ -1,3 +1,7 @@ + # AffineScript - Claude Code Instructions This is the AffineScript compiler, written in OCaml. diff --git a/affinescript/.github/ISSUE_TEMPLATE/bug_report.md b/affinescript/.github/ISSUE_TEMPLATE/bug_report.md index 987aab6..45a6c02 100644 --- a/affinescript/.github/ISSUE_TEMPLATE/bug_report.md +++ b/affinescript/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,3 +1,7 @@ + --- name: Bug report about: Create a report to help us improve diff --git a/affinescript/.github/ISSUE_TEMPLATE/documentation.md b/affinescript/.github/ISSUE_TEMPLATE/documentation.md index 4fcb9f9..b1d16df 100644 --- a/affinescript/.github/ISSUE_TEMPLATE/documentation.md +++ b/affinescript/.github/ISSUE_TEMPLATE/documentation.md @@ -1,3 +1,7 @@ + --- name: Documentation about: Report unclear, missing, or incorrect documentation diff --git a/affinescript/.github/ISSUE_TEMPLATE/feature_request.md b/affinescript/.github/ISSUE_TEMPLATE/feature_request.md index 3e8fa7e..a5a5693 100644 --- a/affinescript/.github/ISSUE_TEMPLATE/feature_request.md +++ b/affinescript/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,3 +1,7 @@ + --- name: Feature request about: Suggest an idea for this project diff --git a/affinescript/.github/ISSUE_TEMPLATE/question.md b/affinescript/.github/ISSUE_TEMPLATE/question.md index fd0e2a5..c2d1f57 100644 --- a/affinescript/.github/ISSUE_TEMPLATE/question.md +++ b/affinescript/.github/ISSUE_TEMPLATE/question.md @@ -1,3 +1,7 @@ + --- name: Question about: Ask a question about usage or behaviour diff --git a/affinescript/.github/workflows/casket-pages.yml b/affinescript/.github/workflows/casket-pages.yml index 08cf7ab..9534807 100644 --- a/affinescript/.github/workflows/casket-pages.yml +++ b/affinescript/.github/workflows/casket-pages.yml @@ -18,6 +18,7 @@ concurrency: jobs: build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 @@ -91,6 +92,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: - name: Deploy to GitHub Pages diff --git a/affinescript/.github/workflows/ci.yml b/affinescript/.github/workflows/ci.yml index 1c0a6ff..ba596a4 100644 --- a/affinescript/.github/workflows/ci.yml +++ b/affinescript/.github/workflows/ci.yml @@ -13,6 +13,7 @@ permissions: jobs: build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -45,6 +46,7 @@ jobs: lint: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code diff --git a/affinescript/.github/workflows/codeql.yml b/affinescript/.github/workflows/codeql.yml index ac874c8..2978ff7 100644 --- a/affinescript/.github/workflows/codeql.yml +++ b/affinescript/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/affinescript/.github/workflows/guix-nix-policy.yml b/affinescript/.github/workflows/guix-nix-policy.yml index ec3acb3..c70b748 100644 --- a/affinescript/.github/workflows/guix-nix-policy.yml +++ b/affinescript/.github/workflows/guix-nix-policy.yml @@ -7,6 +7,7 @@ permissions: read-all jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/affinescript/.github/workflows/hypatia-scan.yml b/affinescript/.github/workflows/hypatia-scan.yml index 340b6e0..4c7bf0e 100644 --- a/affinescript/.github/workflows/hypatia-scan.yml +++ b/affinescript/.github/workflows/hypatia-scan.yml @@ -17,6 +17,7 @@ jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout repository diff --git a/affinescript/.github/workflows/instant-sync.yml b/affinescript/.github/workflows/instant-sync.yml index 228dc43..01646a7 100644 --- a/affinescript/.github/workflows/instant-sync.yml +++ b/affinescript/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 diff --git a/affinescript/.github/workflows/mirror.yml b/affinescript/.github/workflows/mirror.yml index b99205f..5a7d288 100644 --- a/affinescript/.github/workflows/mirror.yml +++ b/affinescript/.github/workflows/mirror.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: mirror-gitlab: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITLAB_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 @@ -30,6 +31,7 @@ jobs: mirror-bitbucket: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.BITBUCKET_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 @@ -48,6 +50,7 @@ jobs: mirror-codeberg: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.CODEBERG_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 @@ -66,6 +69,7 @@ jobs: mirror-sourcehut: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.SOURCEHUT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 @@ -84,6 +88,7 @@ jobs: mirror-disroot: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.DISROOT_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 @@ -102,6 +107,7 @@ jobs: mirror-gitea: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.GITEA_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 @@ -120,6 +126,7 @@ jobs: mirror-radicle: runs-on: ubuntu-latest + timeout-minutes: 15 if: vars.RADICLE_MIRROR_ENABLED == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 diff --git a/affinescript/.github/workflows/npm-bun-blocker.yml b/affinescript/.github/workflows/npm-bun-blocker.yml index 917ce45..1fe6435 100644 --- a/affinescript/.github/workflows/npm-bun-blocker.yml +++ b/affinescript/.github/workflows/npm-bun-blocker.yml @@ -7,6 +7,7 @@ permissions: read-all jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/affinescript/.github/workflows/quality.yml b/affinescript/.github/workflows/quality.yml index 48c9deb..41d6b1e 100644 --- a/affinescript/.github/workflows/quality.yml +++ b/affinescript/.github/workflows/quality.yml @@ -8,6 +8,7 @@ permissions: read-all jobs: lint: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: @@ -40,6 +41,7 @@ jobs: docs: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/affinescript/.github/workflows/release.yml b/affinescript/.github/workflows/release.yml index dda9709..2a23d02 100644 --- a/affinescript/.github/workflows/release.yml +++ b/affinescript/.github/workflows/release.yml @@ -12,6 +12,7 @@ permissions: jobs: release: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code diff --git a/affinescript/.github/workflows/rsr-antipattern.yml b/affinescript/.github/workflows/rsr-antipattern.yml index 09217b7..92d5178 100644 --- a/affinescript/.github/workflows/rsr-antipattern.yml +++ b/affinescript/.github/workflows/rsr-antipattern.yml @@ -19,6 +19,7 @@ permissions: read-all jobs: antipattern-check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/affinescript/.github/workflows/scorecard-enforcer.yml b/affinescript/.github/workflows/scorecard-enforcer.yml index e841633..df3a8c3 100644 --- a/affinescript/.github/workflows/scorecard-enforcer.yml +++ b/affinescript/.github/workflows/scorecard-enforcer.yml @@ -14,6 +14,7 @@ permissions: read-all jobs: scorecard: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write # For OIDC @@ -37,6 +38,7 @@ jobs: # Check specific high-priority items check-critical: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 diff --git a/affinescript/.github/workflows/scorecard.yml b/affinescript/.github/workflows/scorecard.yml index 4b1af26..58d6a27 100644 --- a/affinescript/.github/workflows/scorecard.yml +++ b/affinescript/.github/workflows/scorecard.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: analysis: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write diff --git a/affinescript/.github/workflows/secret-scanner.yml b/affinescript/.github/workflows/secret-scanner.yml index daace5e..3d9bb53 100644 --- a/affinescript/.github/workflows/secret-scanner.yml +++ b/affinescript/.github/workflows/secret-scanner.yml @@ -12,6 +12,7 @@ permissions: read-all jobs: trufflehog: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: @@ -24,6 +25,7 @@ jobs: gitleaks: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: @@ -37,6 +39,7 @@ jobs: # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest + timeout-minutes: 15 if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 diff --git a/affinescript/.github/workflows/security-policy.yml b/affinescript/.github/workflows/security-policy.yml index 915cd4b..ed8f3e2 100644 --- a/affinescript/.github/workflows/security-policy.yml +++ b/affinescript/.github/workflows/security-policy.yml @@ -7,6 +7,7 @@ permissions: read-all jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/affinescript/.github/workflows/semgrep.yml b/affinescript/.github/workflows/semgrep.yml index af9b720..ce1d0bb 100644 --- a/affinescript/.github/workflows/semgrep.yml +++ b/affinescript/.github/workflows/semgrep.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: semgrep: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write contents: read diff --git a/affinescript/.github/workflows/ts-blocker.yml b/affinescript/.github/workflows/ts-blocker.yml index c434f58..1d06e39 100644 --- a/affinescript/.github/workflows/ts-blocker.yml +++ b/affinescript/.github/workflows/ts-blocker.yml @@ -7,6 +7,7 @@ permissions: read-all jobs: check: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/affinescript/.github/workflows/wellknown-enforcement.yml b/affinescript/.github/workflows/wellknown-enforcement.yml index 70168af..31a8660 100644 --- a/affinescript/.github/workflows/wellknown-enforcement.yml +++ b/affinescript/.github/workflows/wellknown-enforcement.yml @@ -20,6 +20,7 @@ permissions: read-all jobs: validate: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: diff --git a/affinescript/.github/workflows/workflow-linter.yml b/affinescript/.github/workflows/workflow-linter.yml index 455b9e3..80230c5 100644 --- a/affinescript/.github/workflows/workflow-linter.yml +++ b/affinescript/.github/workflows/workflow-linter.yml @@ -17,6 +17,7 @@ permissions: read-all jobs: lint-workflows: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read diff --git a/affinescript/.machine_readable/agent_instructions/README.adoc b/affinescript/.machine_readable/agent_instructions/README.adoc index 96dd024..9660674 100644 --- a/affinescript/.machine_readable/agent_instructions/README.adoc +++ b/affinescript/.machine_readable/agent_instructions/README.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell = AffineScript Agent Instructions :toc: preamble diff --git a/affinescript/.machine_readable/contractiles/README.adoc b/affinescript/.machine_readable/contractiles/README.adoc index d19a387..70ad712 100644 --- a/affinescript/.machine_readable/contractiles/README.adoc +++ b/affinescript/.machine_readable/contractiles/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractiles Template Set :toc: :sectnums: diff --git a/affinescript/ABI-FFI-README.md b/affinescript/ABI-FFI-README.md index c985d95..a8d29b6 100644 --- a/affinescript/ABI-FFI-README.md +++ b/affinescript/ABI-FFI-README.md @@ -1,3 +1,7 @@ + {{~ Aditionally delete this line and fill out the template below ~}} # Proof Burrower ABI/FFI Documentation diff --git a/affinescript/ALPHA-1-RELEASE-NOTES.md b/affinescript/ALPHA-1-RELEASE-NOTES.md index 2106430..bbf7231 100644 --- a/affinescript/ALPHA-1-RELEASE-NOTES.md +++ b/affinescript/ALPHA-1-RELEASE-NOTES.md @@ -1,3 +1,7 @@ + # AffineScript Alpha-1 Release Notes ## 🎮 Game Developer's Edition diff --git a/affinescript/BACKEND-ANALYSIS.md b/affinescript/BACKEND-ANALYSIS.md index 52bbade..a2befd1 100644 --- a/affinescript/BACKEND-ANALYSIS.md +++ b/affinescript/BACKEND-ANALYSIS.md @@ -1,3 +1,7 @@ + # AffineScript Backend Analysis: Coprocessor Support ## Executive Summary diff --git a/affinescript/BACKEND-IMPLEMENTATION.md b/affinescript/BACKEND-IMPLEMENTATION.md index 10079fb..cf4d599 100644 --- a/affinescript/BACKEND-IMPLEMENTATION.md +++ b/affinescript/BACKEND-IMPLEMENTATION.md @@ -1,3 +1,7 @@ + # AffineScript Backend Implementation ## 🎯 Overview diff --git a/affinescript/CODE_OF_CONDUCT.md b/affinescript/CODE_OF_CONDUCT.md index 4323d75..71500ab 100644 --- a/affinescript/CODE_OF_CONDUCT.md +++ b/affinescript/CODE_OF_CONDUCT.md @@ -1,3 +1,7 @@ + # Code of Conduct # AffineScript Compiler Capabilities Analysis ## 🎯 Current Compiler Targets diff --git a/affinescript/CONTRIBUTING.md b/affinescript/CONTRIBUTING.md index 0c347b3..5ccc1c7 100644 --- a/affinescript/CONTRIBUTING.md +++ b/affinescript/CONTRIBUTING.md @@ -1,3 +1,7 @@ + # Clone the repository git clone https://github.com/hyperpolymath/proof-burrower.git cd proof-burrower diff --git a/affinescript/CONTROLS-REFERENCE.md b/affinescript/CONTROLS-REFERENCE.md index caab943..5981f6f 100644 --- a/affinescript/CONTROLS-REFERENCE.md +++ b/affinescript/CONTROLS-REFERENCE.md @@ -1,3 +1,7 @@ + # AffineScript Game Controls Reference ## 🎮 Basic Movement Controls diff --git a/affinescript/DAMAGE-SYSTEM.md b/affinescript/DAMAGE-SYSTEM.md index c38d03f..542d00f 100644 --- a/affinescript/DAMAGE-SYSTEM.md +++ b/affinescript/DAMAGE-SYSTEM.md @@ -1,3 +1,7 @@ + # AffineScript Submarine Damage System ## 🚨 Critical Damage Information diff --git a/affinescript/EXPLAINME.adoc b/affinescript/EXPLAINME.adoc index 5f1d1af..44ddb22 100644 --- a/affinescript/EXPLAINME.adoc +++ b/affinescript/EXPLAINME.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // (MPL-2.0 is the automatic legal fallback until PMPL is formally recognised) = AffineScript — Show Me The Receipts :toc: diff --git a/affinescript/FIXES_2026-01-23.md b/affinescript/FIXES_2026-01-23.md index 475a3bc..2444d8b 100644 --- a/affinescript/FIXES_2026-01-23.md +++ b/affinescript/FIXES_2026-01-23.md @@ -1,3 +1,7 @@ + # AffineScript Critical Fixes - 2026-01-23 ## Summary diff --git a/affinescript/GAME-BUNDLING-STRATEGY.md b/affinescript/GAME-BUNDLING-STRATEGY.md index 44a8e7e..2c61a93 100644 --- a/affinescript/GAME-BUNDLING-STRATEGY.md +++ b/affinescript/GAME-BUNDLING-STRATEGY.md @@ -1,3 +1,7 @@ + # AffineScript Game Bundling & Licensing Strategy ## 🎯 Executive Summary diff --git a/affinescript/LICENSING-GUIDE.md b/affinescript/LICENSING-GUIDE.md index 9c28d0a..1f464e6 100644 --- a/affinescript/LICENSING-GUIDE.md +++ b/affinescript/LICENSING-GUIDE.md @@ -1,3 +1,7 @@ + # AffineScript Licensing Guide ## 📜 Comprehensive Licensing Information diff --git a/affinescript/MAINTAINERS.adoc b/affinescript/MAINTAINERS.adoc index a1c6544..becaa3e 100644 --- a/affinescript/MAINTAINERS.adoc +++ b/affinescript/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/affinescript/MODULE-SYSTEM-PROGRESS.md b/affinescript/MODULE-SYSTEM-PROGRESS.md index 35700d7..800f941 100644 --- a/affinescript/MODULE-SYSTEM-PROGRESS.md +++ b/affinescript/MODULE-SYSTEM-PROGRESS.md @@ -1,3 +1,7 @@ + # AffineScript Compiler Implementation Progress **Session Date:** 2026-01-23 diff --git a/affinescript/NAVIGATION.adoc b/affinescript/NAVIGATION.adoc index 4380ffd..71b6a82 100644 --- a/affinescript/NAVIGATION.adoc +++ b/affinescript/NAVIGATION.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2026 Hyperpolymath Contributors = AffineScript Repository Navigation Guide diff --git a/affinescript/PHASE3-ASSESSMENT.md b/affinescript/PHASE3-ASSESSMENT.md index 31ce977..72eaffb 100644 --- a/affinescript/PHASE3-ASSESSMENT.md +++ b/affinescript/PHASE3-ASSESSMENT.md @@ -1,3 +1,7 @@ + # Phase 3: Advanced Type System - Implementation Assessment **Date:** 2026-01-23 diff --git a/affinescript/PHASE3-COMPLETE.md b/affinescript/PHASE3-COMPLETE.md index 8a6e18c..6b8a265 100644 --- a/affinescript/PHASE3-COMPLETE.md +++ b/affinescript/PHASE3-COMPLETE.md @@ -1,3 +1,7 @@ + # Phase 3: Advanced Type System - COMPLETE! 🎉 **Date:** 2026-01-23 diff --git a/affinescript/PHASE3-SESSION-SUMMARY.md b/affinescript/PHASE3-SESSION-SUMMARY.md index 133211e..c8487d0 100644 --- a/affinescript/PHASE3-SESSION-SUMMARY.md +++ b/affinescript/PHASE3-SESSION-SUMMARY.md @@ -1,3 +1,7 @@ + # Phase 3 Implementation Session - Summary **Date:** 2026-01-23 diff --git a/affinescript/PROOF-NEEDS.md b/affinescript/PROOF-NEEDS.md index 5d628db..935514c 100644 --- a/affinescript/PROOF-NEEDS.md +++ b/affinescript/PROOF-NEEDS.md @@ -1,3 +1,7 @@ + # PROOF-NEEDS.md ## Template ABI Cleanup (2026-03-29) diff --git a/affinescript/README.adoc b/affinescript/README.adoc index 2d42ae4..553dbae 100644 --- a/affinescript/README.adoc +++ b/affinescript/README.adoc @@ -1,5 +1,6 @@ -= AffineScript: The Game Developer's Secret Weapon // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell += AffineScript: The Game Developer's Secret Weapon image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:https://img.shields.io/badge/Built%20For-Games-red.svg[Built for Games] diff --git a/affinescript/REPLY-SUM-TYPES.md b/affinescript/REPLY-SUM-TYPES.md index e2d6ed2..5ea1820 100644 --- a/affinescript/REPLY-SUM-TYPES.md +++ b/affinescript/REPLY-SUM-TYPES.md @@ -1,4 +1,7 @@ - + # Reply to REPORT-SUM-TYPES.md — Sum Types Already Implemented **Date:** 2026-03-21 diff --git a/affinescript/ROADMAP.adoc b/affinescript/ROADMAP.adoc index b48e243..091df96 100644 --- a/affinescript/ROADMAP.adoc +++ b/affinescript/ROADMAP.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = AffineScript Development Roadmap :toc: macro diff --git a/affinescript/RSR_OUTLINE.adoc b/affinescript/RSR_OUTLINE.adoc index 94a49d8..3b3ca3a 100644 --- a/affinescript/RSR_OUTLINE.adoc +++ b/affinescript/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/affinescript/SECURITY-SETUP.md b/affinescript/SECURITY-SETUP.md index 5c6f4f7..14070ad 100644 --- a/affinescript/SECURITY-SETUP.md +++ b/affinescript/SECURITY-SETUP.md @@ -1,3 +1,7 @@ + # Security Configuration for affinescript.dev ## Overview diff --git a/affinescript/SECURITY.md b/affinescript/SECURITY.md index 9c2ff60..210e01e 100644 --- a/affinescript/SECURITY.md +++ b/affinescript/SECURITY.md @@ -1,3 +1,7 @@ + # Security Policy # AffineScript Development Session - 2026-01-23 ## Session Overview diff --git a/affinescript/SESSION-COMPLETE.md b/affinescript/SESSION-COMPLETE.md index 29c0782..b59feed 100644 --- a/affinescript/SESSION-COMPLETE.md +++ b/affinescript/SESSION-COMPLETE.md @@ -1,3 +1,7 @@ + # AffineScript Session Complete - 2026-01-23/24 ## 🎉 All Priorities Accomplished! diff --git a/affinescript/SPARK-experiment/README.adoc b/affinescript/SPARK-experiment/README.adoc index 78cae71..8dfbf62 100644 --- a/affinescript/SPARK-experiment/README.adoc +++ b/affinescript/SPARK-experiment/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell = AffineScript SPARK Experiment :toc: diff --git a/affinescript/TRAIT_SYSTEM_STATUS.md b/affinescript/TRAIT_SYSTEM_STATUS.md index b8afc19..bffa5ad 100644 --- a/affinescript/TRAIT_SYSTEM_STATUS.md +++ b/affinescript/TRAIT_SYSTEM_STATUS.md @@ -1,3 +1,7 @@ + # AffineScript Trait System - Implementation Status ## ✅ Completed Features diff --git a/affinescript/conformance/README.md b/affinescript/conformance/README.md index 167eb03..73e2348 100644 --- a/affinescript/conformance/README.md +++ b/affinescript/conformance/README.md @@ -1,3 +1,7 @@ + # AffineScript Conformance Test Suite This directory contains the conformance test corpus for AffineScript. diff --git a/affinescript/distributions/rattlescript/README.adoc b/affinescript/distributions/rattlescript/README.adoc index 85f038b..bf5a330 100644 --- a/affinescript/distributions/rattlescript/README.adoc +++ b/affinescript/distributions/rattlescript/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) = RattleScript :toc: diff --git a/affinescript/distributions/rattlescript/build.rs b/affinescript/distributions/rattlescript/build.rs index 5c6d395..8aa9387 100644 --- a/affinescript/distributions/rattlescript/build.rs +++ b/affinescript/distributions/rattlescript/build.rs @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) //! build.rs — detect or require the `affinescript` binary path. diff --git a/affinescript/distributions/rattlescript/src/main.rs b/affinescript/distributions/rattlescript/src/main.rs index f7ce11f..1c8fa92 100644 --- a/affinescript/distributions/rattlescript/src/main.rs +++ b/affinescript/distributions/rattlescript/src/main.rs @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) //! RattleScript CLI — thin distribution wrapper around AffineScript with diff --git a/affinescript/docs/ALIB-INTEGRATION.md b/affinescript/docs/ALIB-INTEGRATION.md index aca1b87..aa1f068 100644 --- a/affinescript/docs/ALIB-INTEGRATION.md +++ b/affinescript/docs/ALIB-INTEGRATION.md @@ -1,3 +1,7 @@ + # AffineScript ↔ aggregate-library Integration Strategy **Date:** 2026-01-23 diff --git a/affinescript/docs/BRIDGE-DECISIONS.md b/affinescript/docs/BRIDGE-DECISIONS.md index 5795aaf..9557cb3 100644 --- a/affinescript/docs/BRIDGE-DECISIONS.md +++ b/affinescript/docs/BRIDGE-DECISIONS.md @@ -1,3 +1,7 @@ + # Bridge Layer Decisions **Status as of 2026-04-12** diff --git a/affinescript/docs/CITATIONS.adoc b/affinescript/docs/CITATIONS.adoc index 564f0ae..2f516df 100644 --- a/affinescript/docs/CITATIONS.adoc +++ b/affinescript/docs/CITATIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR-template-repo - Citation Guide :toc: diff --git a/affinescript/docs/DESIGN-VISION.adoc b/affinescript/docs/DESIGN-VISION.adoc index 0d0e543..9df8139 100644 --- a/affinescript/docs/DESIGN-VISION.adoc +++ b/affinescript/docs/DESIGN-VISION.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = AffineScript: Design Vision Jonathan D.A. Jewell :toc: diff --git a/affinescript/docs/EFFECTS-IMPLEMENTATION.md b/affinescript/docs/EFFECTS-IMPLEMENTATION.md index 36cc540..8e4a7b9 100644 --- a/affinescript/docs/EFFECTS-IMPLEMENTATION.md +++ b/affinescript/docs/EFFECTS-IMPLEMENTATION.md @@ -1,3 +1,7 @@ + # Effect Handler Implementation ## Status Sync (2026-04-12) diff --git a/affinescript/docs/README.adoc b/affinescript/docs/README.adoc index e56cb0b..e5fd2b1 100644 --- a/affinescript/docs/README.adoc +++ b/affinescript/docs/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2026 Hyperpolymath Contributors = AffineScript Documentation Directory diff --git a/affinescript/docs/WASM-EFFECT-HANDLER-WORKAROUND.md b/affinescript/docs/WASM-EFFECT-HANDLER-WORKAROUND.md index 6757ec1..363be7c 100644 --- a/affinescript/docs/WASM-EFFECT-HANDLER-WORKAROUND.md +++ b/affinescript/docs/WASM-EFFECT-HANDLER-WORKAROUND.md @@ -1,3 +1,7 @@ + # WASM Effect Handler Lowering Workaround **Status as of 2026-04-12**: Effect-handler lowering in WASM targets is incomplete. This document describes the workaround implementation for the bridge layer. diff --git a/affinescript/docs/academic/README.md b/affinescript/docs/academic/README.md index 42a767e..25bcd44 100644 --- a/affinescript/docs/academic/README.md +++ b/affinescript/docs/academic/README.md @@ -1,3 +1,7 @@ + # AffineScript Academic Documentation This directory contains formal academic documentation for the AffineScript programming language, including proofs, specifications, white papers, and mechanized verification. diff --git a/affinescript/docs/academic/formal-verification/axiomatic-semantics.md b/affinescript/docs/academic/formal-verification/axiomatic-semantics.md index 2d6e4e4..6537dd2 100644 --- a/affinescript/docs/academic/formal-verification/axiomatic-semantics.md +++ b/affinescript/docs/academic/formal-verification/axiomatic-semantics.md @@ -1,3 +1,7 @@ + # Axiomatic Semantics: Program Logic for AffineScript **Document Version**: 1.0 diff --git a/affinescript/docs/academic/formal-verification/denotational-semantics.md b/affinescript/docs/academic/formal-verification/denotational-semantics.md index 441fe4e..40235c2 100644 --- a/affinescript/docs/academic/formal-verification/denotational-semantics.md +++ b/affinescript/docs/academic/formal-verification/denotational-semantics.md @@ -1,3 +1,7 @@ + # Denotational Semantics of AffineScript **Document Version**: 1.0 diff --git a/affinescript/docs/academic/formal-verification/operational-semantics.md b/affinescript/docs/academic/formal-verification/operational-semantics.md index 1563b2f..53696b1 100644 --- a/affinescript/docs/academic/formal-verification/operational-semantics.md +++ b/affinescript/docs/academic/formal-verification/operational-semantics.md @@ -1,3 +1,7 @@ + # Operational Semantics of AffineScript **Document Version**: 1.0 diff --git a/affinescript/docs/academic/formal-verification/solo-core/Context.idr b/affinescript/docs/academic/formal-verification/solo-core/Context.idr index 191637b..387d604 100644 --- a/affinescript/docs/academic/formal-verification/solo-core/Context.idr +++ b/affinescript/docs/academic/formal-verification/solo-core/Context.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell -- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -- -- QTT-style typing contexts for the Solo core. diff --git a/affinescript/docs/academic/formal-verification/solo-core/Quantity.idr b/affinescript/docs/academic/formal-verification/solo-core/Quantity.idr index c0b733c..adf6082 100644 --- a/affinescript/docs/academic/formal-verification/solo-core/Quantity.idr +++ b/affinescript/docs/academic/formal-verification/solo-core/Quantity.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell -- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -- -- Quantity semiring for the AffineScript Solo core. diff --git a/affinescript/docs/academic/formal-verification/solo-core/README.adoc b/affinescript/docs/academic/formal-verification/solo-core/README.adoc index 6d18d1f..f786352 100644 --- a/affinescript/docs/academic/formal-verification/solo-core/README.adoc +++ b/affinescript/docs/academic/formal-verification/solo-core/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell = Solo Core — Idris2 Mechanization diff --git a/affinescript/docs/academic/formal-verification/solo-core/Soundness.idr b/affinescript/docs/academic/formal-verification/solo-core/Soundness.idr index 112272a..73b9619 100644 --- a/affinescript/docs/academic/formal-verification/solo-core/Soundness.idr +++ b/affinescript/docs/academic/formal-verification/solo-core/Soundness.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell -- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -- -- Statements of the soundness theorems for the Solo core. diff --git a/affinescript/docs/academic/formal-verification/solo-core/Syntax.idr b/affinescript/docs/academic/formal-verification/solo-core/Syntax.idr index 701cefc..c8d5233 100644 --- a/affinescript/docs/academic/formal-verification/solo-core/Syntax.idr +++ b/affinescript/docs/academic/formal-verification/solo-core/Syntax.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell -- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -- -- Syntax of the Solo core of AffineScript. diff --git a/affinescript/docs/academic/formal-verification/solo-core/Typing.idr b/affinescript/docs/academic/formal-verification/solo-core/Typing.idr index 5aa9036..10b71e1 100644 --- a/affinescript/docs/academic/formal-verification/solo-core/Typing.idr +++ b/affinescript/docs/academic/formal-verification/solo-core/Typing.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell -- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -- -- QTT typing judgement for the Solo core. diff --git a/affinescript/docs/academic/mathematical-foundations/categorical-semantics.md b/affinescript/docs/academic/mathematical-foundations/categorical-semantics.md index 6fc4666..dd5792f 100644 --- a/affinescript/docs/academic/mathematical-foundations/categorical-semantics.md +++ b/affinescript/docs/academic/mathematical-foundations/categorical-semantics.md @@ -1,3 +1,7 @@ + # Categorical Semantics of AffineScript **Document Version**: 1.0 diff --git a/affinescript/docs/academic/mathematical-foundations/complexity-analysis.md b/affinescript/docs/academic/mathematical-foundations/complexity-analysis.md index 643138b..205ff7d 100644 --- a/affinescript/docs/academic/mathematical-foundations/complexity-analysis.md +++ b/affinescript/docs/academic/mathematical-foundations/complexity-analysis.md @@ -1,3 +1,7 @@ + # Complexity and Decidability Analysis **Document Version**: 1.0 diff --git a/affinescript/docs/academic/mathematical-foundations/logic-foundations.md b/affinescript/docs/academic/mathematical-foundations/logic-foundations.md index 8ee0796..4843bd9 100644 --- a/affinescript/docs/academic/mathematical-foundations/logic-foundations.md +++ b/affinescript/docs/academic/mathematical-foundations/logic-foundations.md @@ -1,3 +1,7 @@ + # Logic Foundations of AffineScript **Document Version**: 1.0 diff --git a/affinescript/docs/academic/mechanized/agda/README.md b/affinescript/docs/academic/mechanized/agda/README.md index fbd97f1..9d112be 100644 --- a/affinescript/docs/academic/mechanized/agda/README.md +++ b/affinescript/docs/academic/mechanized/agda/README.md @@ -1,3 +1,7 @@ + # AffineScript Agda Formalization **Status**: Stub / Planned diff --git a/affinescript/docs/academic/mechanized/coq/README.md b/affinescript/docs/academic/mechanized/coq/README.md index fc9f1fe..33d0dc2 100644 --- a/affinescript/docs/academic/mechanized/coq/README.md +++ b/affinescript/docs/academic/mechanized/coq/README.md @@ -1,3 +1,7 @@ + # AffineScript Coq Formalization **Status**: Stub / Planned diff --git a/affinescript/docs/academic/mechanized/lean/README.md b/affinescript/docs/academic/mechanized/lean/README.md index 19ec6b4..5dd2c77 100644 --- a/affinescript/docs/academic/mechanized/lean/README.md +++ b/affinescript/docs/academic/mechanized/lean/README.md @@ -1,3 +1,7 @@ + # AffineScript Lean 4 Formalization **Status**: Stub / Planned diff --git a/affinescript/docs/academic/proofs/coherence-parametricity.md b/affinescript/docs/academic/proofs/coherence-parametricity.md index 0ce7d46..f66f155 100644 --- a/affinescript/docs/academic/proofs/coherence-parametricity.md +++ b/affinescript/docs/academic/proofs/coherence-parametricity.md @@ -1,3 +1,7 @@ + # Coherence and Parametricity Theorems **Document Version**: 1.0 diff --git a/affinescript/docs/academic/proofs/dependent-types.md b/affinescript/docs/academic/proofs/dependent-types.md index 7939276..d069ef6 100644 --- a/affinescript/docs/academic/proofs/dependent-types.md +++ b/affinescript/docs/academic/proofs/dependent-types.md @@ -1,3 +1,7 @@ + # Dependent Types and Refinement Types: Complete Formalization **Document Version**: 1.0 diff --git a/affinescript/docs/academic/proofs/effect-soundness.md b/affinescript/docs/academic/proofs/effect-soundness.md index 356c2fc..b3c419c 100644 --- a/affinescript/docs/academic/proofs/effect-soundness.md +++ b/affinescript/docs/academic/proofs/effect-soundness.md @@ -1,3 +1,7 @@ + # Algebraic Effects: Formal Semantics and Soundness **Document Version**: 1.0 diff --git a/affinescript/docs/academic/proofs/inference-algorithm.md b/affinescript/docs/academic/proofs/inference-algorithm.md index c3025fc..b53accf 100644 --- a/affinescript/docs/academic/proofs/inference-algorithm.md +++ b/affinescript/docs/academic/proofs/inference-algorithm.md @@ -1,3 +1,7 @@ + # Type Inference Algorithm Specification **Document Version**: 1.0 diff --git a/affinescript/docs/academic/proofs/ownership-soundness.md b/affinescript/docs/academic/proofs/ownership-soundness.md index 6fface0..7818e14 100644 --- a/affinescript/docs/academic/proofs/ownership-soundness.md +++ b/affinescript/docs/academic/proofs/ownership-soundness.md @@ -1,3 +1,7 @@ + # Ownership System: Formal Verification **Document Version**: 1.0 diff --git a/affinescript/docs/academic/proofs/quantitative-types.md b/affinescript/docs/academic/proofs/quantitative-types.md index 00bcd76..cda69c9 100644 --- a/affinescript/docs/academic/proofs/quantitative-types.md +++ b/affinescript/docs/academic/proofs/quantitative-types.md @@ -1,3 +1,7 @@ + # Quantitative Type Theory in AffineScript **Document Version**: 1.0 diff --git a/affinescript/docs/academic/proofs/row-polymorphism.md b/affinescript/docs/academic/proofs/row-polymorphism.md index 4ddfc3e..5dc4538 100644 --- a/affinescript/docs/academic/proofs/row-polymorphism.md +++ b/affinescript/docs/academic/proofs/row-polymorphism.md @@ -1,3 +1,7 @@ + # Row Polymorphism: Complete Formalization **Document Version**: 1.0 diff --git a/affinescript/docs/academic/proofs/type-soundness.md b/affinescript/docs/academic/proofs/type-soundness.md index 7f44883..8f4e9eb 100644 --- a/affinescript/docs/academic/proofs/type-soundness.md +++ b/affinescript/docs/academic/proofs/type-soundness.md @@ -1,3 +1,7 @@ + # Type System Soundness **Document Version**: 1.0 diff --git a/affinescript/docs/academic/tropical-session-types/tropical-unification-2026-04-04.md b/affinescript/docs/academic/tropical-session-types/tropical-unification-2026-04-04.md index 938eb63..70c9fff 100644 --- a/affinescript/docs/academic/tropical-session-types/tropical-unification-2026-04-04.md +++ b/affinescript/docs/academic/tropical-session-types/tropical-unification-2026-04-04.md @@ -1,3 +1,7 @@ + # TROPICO: The Unified Theory of Resource-Bounded Truth **Date**: 2026-04-04 **Status**: High-Assurance Consensus (Harrison 12:00) diff --git a/affinescript/docs/academic/white-papers/language-design.md b/affinescript/docs/academic/white-papers/language-design.md index 3a0d479..5675e67 100644 --- a/affinescript/docs/academic/white-papers/language-design.md +++ b/affinescript/docs/academic/white-papers/language-design.md @@ -1,3 +1,7 @@ + # AffineScript: A Quantitative Dependently-Typed Language with Algebraic Effects **Technical Report / White Paper** diff --git a/affinescript/docs/alib/README.md b/affinescript/docs/alib/README.md index e3809b5..dcebc0d 100644 --- a/affinescript/docs/alib/README.md +++ b/affinescript/docs/alib/README.md @@ -1,3 +1,7 @@ + # AffineScript ↔ aLib Integration This directory contains documentation and tools for integrating AffineScript with the **aggregate-library (aLib)** methodology. diff --git a/affinescript/docs/governance/CODE_OF_CONDUCT.md b/affinescript/docs/governance/CODE_OF_CONDUCT.md index 1f1548c..9020def 100644 --- a/affinescript/docs/governance/CODE_OF_CONDUCT.md +++ b/affinescript/docs/governance/CODE_OF_CONDUCT.md @@ -1,4 +1,7 @@ - + # Contributor Covenant Code of Conduct ## Our Pledge diff --git a/affinescript/docs/governance/CONTRIBUTING.adoc b/affinescript/docs/governance/CONTRIBUTING.adoc index 1f34e60..2ead10c 100644 --- a/affinescript/docs/governance/CONTRIBUTING.adoc +++ b/affinescript/docs/governance/CONTRIBUTING.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contributing Guide == Getting Started diff --git a/affinescript/docs/governance/MAINTAINERS.adoc b/affinescript/docs/governance/MAINTAINERS.adoc index a1c6544..becaa3e 100644 --- a/affinescript/docs/governance/MAINTAINERS.adoc +++ b/affinescript/docs/governance/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/affinescript/docs/governance/SECURITY.md b/affinescript/docs/governance/SECURITY.md index d1cdd6c..ed71a83 100644 --- a/affinescript/docs/governance/SECURITY.md +++ b/affinescript/docs/governance/SECURITY.md @@ -1,3 +1,7 @@ + # Security Policy ## Supported Versions diff --git a/affinescript/docs/guides/TESTING-REPORT.adoc b/affinescript/docs/guides/TESTING-REPORT.adoc index 382dafd..b74bc27 100644 --- a/affinescript/docs/guides/TESTING-REPORT.adoc +++ b/affinescript/docs/guides/TESTING-REPORT.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = AffineScript Testing Report :author: Automated Testing :date: 2025-12-29 diff --git a/affinescript/docs/guides/WHAT-MAKES-IT-BRILLIANT.md b/affinescript/docs/guides/WHAT-MAKES-IT-BRILLIANT.md index 7369ec2..c2e76fb 100644 --- a/affinescript/docs/guides/WHAT-MAKES-IT-BRILLIANT.md +++ b/affinescript/docs/guides/WHAT-MAKES-IT-BRILLIANT.md @@ -1,3 +1,7 @@ + # What Makes AffineScript Brilliant **AffineScript is a programming language that makes impossible errors impossible.** diff --git a/affinescript/docs/guides/frontier-guide.adoc b/affinescript/docs/guides/frontier-guide.adoc index 45153d3..5cd670c 100644 --- a/affinescript/docs/guides/frontier-guide.adoc +++ b/affinescript/docs/guides/frontier-guide.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = AffineScript Frontier Guide: The Unveiling Jonathan D.A. Jewell 2026-04-11 diff --git a/affinescript/docs/guides/frontier-programming-practices/Human_Programming_Guide.adoc b/affinescript/docs/guides/frontier-programming-practices/Human_Programming_Guide.adoc index 0c3d117..70cf19e 100644 --- a/affinescript/docs/guides/frontier-programming-practices/Human_Programming_Guide.adoc +++ b/affinescript/docs/guides/frontier-programming-practices/Human_Programming_Guide.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = AffineScript: Frontier Programming Practices Human Edition, v2.0 :sectnums: diff --git a/affinescript/docs/guides/lessons/01-hello-affinescript.md b/affinescript/docs/guides/lessons/01-hello-affinescript.md index 3156191..ba5bf6f 100644 --- a/affinescript/docs/guides/lessons/01-hello-affinescript.md +++ b/affinescript/docs/guides/lessons/01-hello-affinescript.md @@ -1,3 +1,7 @@ + # Lesson 1: Hello AffineScript **Goal:** Write your first AffineScript program and understand basic syntax. diff --git a/affinescript/docs/guides/lessons/README.md b/affinescript/docs/guides/lessons/README.md index 513db14..49fb83c 100644 --- a/affinescript/docs/guides/lessons/README.md +++ b/affinescript/docs/guides/lessons/README.md @@ -1,3 +1,7 @@ + # AffineScript in 10 Lessons **Learn AffineScript from zero to hero in 10 progressive lessons.** diff --git a/affinescript/docs/guides/warmup/README.adoc b/affinescript/docs/guides/warmup/README.adoc index 22d9bc1..0434ba3 100644 --- a/affinescript/docs/guides/warmup/README.adoc +++ b/affinescript/docs/guides/warmup/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = AffineScript Warmup Scripts :toc: :icons: font diff --git a/affinescript/docs/history/TYPECHECKER-COMPLETION-2026-01-23.md b/affinescript/docs/history/TYPECHECKER-COMPLETION-2026-01-23.md index 6055d3d..94e8f21 100644 --- a/affinescript/docs/history/TYPECHECKER-COMPLETION-2026-01-23.md +++ b/affinescript/docs/history/TYPECHECKER-COMPLETION-2026-01-23.md @@ -1,3 +1,7 @@ + > Historical snapshot from 2026-01-23. Superseded by .machine_readable/6a2/STATE.a2ml. Retained for audit trail only. # Type Checker Completion Report diff --git a/affinescript/docs/spec.md b/affinescript/docs/spec.md index dffa5ca..909d154 100644 --- a/affinescript/docs/spec.md +++ b/affinescript/docs/spec.md @@ -1,3 +1,7 @@ + # AffineScript Complete Language Specification v2.0 > **⚠ HONEST STATUS NOTE (2026-04-10 manhattan-recovery):** diff --git a/affinescript/docs/specs/SETTLED-DECISIONS.adoc b/affinescript/docs/specs/SETTLED-DECISIONS.adoc index 78d5155..6e1f5c7 100644 --- a/affinescript/docs/specs/SETTLED-DECISIONS.adoc +++ b/affinescript/docs/specs/SETTLED-DECISIONS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = AffineScript: Settled Design Decisions Jonathan D.A. Jewell :toc: diff --git a/affinescript/docs/specs/SPEC.md b/affinescript/docs/specs/SPEC.md index 9c6f878..a17ebbf 100644 --- a/affinescript/docs/specs/SPEC.md +++ b/affinescript/docs/specs/SPEC.md @@ -1,3 +1,7 @@ + # AffineScript Language Specification v0.1 A programming language combining affine types, dependent types, row polymorphism, and extensible effects. diff --git a/affinescript/docs/specs/faces.md b/affinescript/docs/specs/faces.md index 783c285..f348396 100644 --- a/affinescript/docs/specs/faces.md +++ b/affinescript/docs/specs/faces.md @@ -1,3 +1,7 @@ + # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) diff --git a/affinescript/docs/standards/DECISIONS.md b/affinescript/docs/standards/DECISIONS.md index 6b52818..2b0535d 100644 --- a/affinescript/docs/standards/DECISIONS.md +++ b/affinescript/docs/standards/DECISIONS.md @@ -1,3 +1,7 @@ + # AffineScript Design Decisions This document records the key design decisions for AffineScript's implementation. diff --git a/affinescript/docs/standards/PALIMPSEST.adoc b/affinescript/docs/standards/PALIMPSEST.adoc index ebaa6d0..9660f13 100644 --- a/affinescript/docs/standards/PALIMPSEST.adoc +++ b/affinescript/docs/standards/PALIMPSEST.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Palimpsest License :toc: :toc-placement!: diff --git a/affinescript/docs/standards/RELEASE.md b/affinescript/docs/standards/RELEASE.md index 390aaf3..646efc3 100644 --- a/affinescript/docs/standards/RELEASE.md +++ b/affinescript/docs/standards/RELEASE.md @@ -1,3 +1,7 @@ + # AffineScript v0.1.0 - Reference Parser Release This is the first public release of AffineScript, featuring a complete specification and reference parser. diff --git a/affinescript/docs/standards/ROADMAP.md b/affinescript/docs/standards/ROADMAP.md index e936d6f..8d28bd3 100644 --- a/affinescript/docs/standards/ROADMAP.md +++ b/affinescript/docs/standards/ROADMAP.md @@ -1,3 +1,7 @@ + # AffineScript Implementation Roadmap ## Overview diff --git a/affinescript/docs/tutorial/lesson-02-functions.md b/affinescript/docs/tutorial/lesson-02-functions.md index 3f67608..11eb493 100644 --- a/affinescript/docs/tutorial/lesson-02-functions.md +++ b/affinescript/docs/tutorial/lesson-02-functions.md @@ -1,3 +1,7 @@ + # Lesson 2: Functions and Ownership Learn how AffineScript's ownership system works with functions. diff --git a/affinescript/docs/tutorial/lesson-03-data.md b/affinescript/docs/tutorial/lesson-03-data.md index 3e287a6..aebbd1e 100644 --- a/affinescript/docs/tutorial/lesson-03-data.md +++ b/affinescript/docs/tutorial/lesson-03-data.md @@ -1,3 +1,7 @@ + # Lesson 3: Data Structures ## Tuples diff --git a/affinescript/docs/tutorial/lesson-04-patterns.md b/affinescript/docs/tutorial/lesson-04-patterns.md index 2c0fc73..9ef4354 100644 --- a/affinescript/docs/tutorial/lesson-04-patterns.md +++ b/affinescript/docs/tutorial/lesson-04-patterns.md @@ -1,3 +1,7 @@ + # Lesson 4: Pattern Matching Destructure data with match expressions: diff --git a/affinescript/docs/tutorial/lesson-05-types.md b/affinescript/docs/tutorial/lesson-05-types.md index e732071..e121744 100644 --- a/affinescript/docs/tutorial/lesson-05-types.md +++ b/affinescript/docs/tutorial/lesson-05-types.md @@ -1,3 +1,7 @@ + # Lesson 5: Types and Inference ## Type Annotations diff --git a/affinescript/docs/tutorial/lesson-06-errors.md b/affinescript/docs/tutorial/lesson-06-errors.md index 33484c3..8b188f0 100644 --- a/affinescript/docs/tutorial/lesson-06-errors.md +++ b/affinescript/docs/tutorial/lesson-06-errors.md @@ -1,3 +1,7 @@ + # Lesson 6: Error Handling ## Result Types diff --git a/affinescript/docs/tutorial/lesson-07-effects.md b/affinescript/docs/tutorial/lesson-07-effects.md index 1072bea..32d24cc 100644 --- a/affinescript/docs/tutorial/lesson-07-effects.md +++ b/affinescript/docs/tutorial/lesson-07-effects.md @@ -1,3 +1,7 @@ + # Lesson 7: Algebraic Effects ## Effect Declarations diff --git a/affinescript/docs/tutorial/lesson-08-generics.md b/affinescript/docs/tutorial/lesson-08-generics.md index 4af2975..10826c0 100644 --- a/affinescript/docs/tutorial/lesson-08-generics.md +++ b/affinescript/docs/tutorial/lesson-08-generics.md @@ -1,3 +1,7 @@ + # Lesson 8: Generic Types ## Type Parameters diff --git a/affinescript/docs/tutorial/lesson-09-modules.md b/affinescript/docs/tutorial/lesson-09-modules.md index e1ca14c..90f5a72 100644 --- a/affinescript/docs/tutorial/lesson-09-modules.md +++ b/affinescript/docs/tutorial/lesson-09-modules.md @@ -1,3 +1,7 @@ + # Lesson 9: Modules and Imports ## Module Declaration diff --git a/affinescript/docs/tutorial/lesson-10-building.md b/affinescript/docs/tutorial/lesson-10-building.md index 345d86f..bca5a95 100644 --- a/affinescript/docs/tutorial/lesson-10-building.md +++ b/affinescript/docs/tutorial/lesson-10-building.md @@ -1,3 +1,7 @@ + # Lesson 10: Building Real Programs ## Project Structure diff --git a/affinescript/editors/tree-sitter-affinescript/README.md b/affinescript/editors/tree-sitter-affinescript/README.md index 6143af7..f0ce0f3 100644 --- a/affinescript/editors/tree-sitter-affinescript/README.md +++ b/affinescript/editors/tree-sitter-affinescript/README.md @@ -1,3 +1,7 @@ + # tree-sitter-affinescript Tree-sitter grammar for AffineScript - affine types, effects, and dependent types. diff --git a/affinescript/editors/tree-sitter-affinescript/grammar.js b/affinescript/editors/tree-sitter-affinescript/grammar.js index 1035295..1fce976 100644 --- a/affinescript/editors/tree-sitter-affinescript/grammar.js +++ b/affinescript/editors/tree-sitter-affinescript/grammar.js @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MIT +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Tree-sitter grammar for AffineScript module.exports = grammar({ diff --git a/affinescript/editors/vscode/README.md b/affinescript/editors/vscode/README.md index 7fd2780..65e7aad 100644 --- a/affinescript/editors/vscode/README.md +++ b/affinescript/editors/vscode/README.md @@ -1,3 +1,7 @@ + # AffineScript for Visual Studio Code Official Visual Studio Code extension for AffineScript - a language with affine types, algebraic effects, and dependent types that compiles to WebAssembly. diff --git a/affinescript/editors/vscode/src/extension.ts b/affinescript/editors/vscode/src/extension.ts index 816c2bd..4623978 100644 --- a/affinescript/editors/vscode/src/extension.ts +++ b/affinescript/editors/vscode/src/extension.ts @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MIT OR AGPL-3.0-or-later +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // AffineScript VSCode Extension import * as vscode from 'vscode'; diff --git a/affinescript/ffi/zig/build.zig b/affinescript/ffi/zig/build.zig index 9ff32de..cebe930 100644 --- a/affinescript/ffi/zig/build.zig +++ b/affinescript/ffi/zig/build.zig @@ -1,5 +1,6 @@ -// Proof Burrower FFI Build Configuration // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// Proof Burrower FFI Build Configuration const std = @import("std"); diff --git a/affinescript/ffi/zig/src/main.zig b/affinescript/ffi/zig/src/main.zig index ec07c50..65ddecb 100644 --- a/affinescript/ffi/zig/src/main.zig +++ b/affinescript/ffi/zig/src/main.zig @@ -1,9 +1,10 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Proof Burrower FFI Implementation // // This module implements the C-compatible FFI declared in src/abi/Foreign.idr // All types and layouts must match the Idris2 ABI definitions. // -// SPDX-License-Identifier: MPL-2.0 const std = @import("std"); diff --git a/affinescript/ffi/zig/test/integration_test.zig b/affinescript/ffi/zig/test/integration_test.zig index 39cba79..7bb716e 100644 --- a/affinescript/ffi/zig/test/integration_test.zig +++ b/affinescript/ffi/zig/test/integration_test.zig @@ -1,5 +1,6 @@ -// Proof Burrower Integration Tests // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +// Proof Burrower Integration Tests // // These tests verify that the Zig FFI correctly implements the Idris2 ABI diff --git a/affinescript/js/runtime.js b/affinescript/js/runtime.js index 4923b40..3985dcb 100644 --- a/affinescript/js/runtime.js +++ b/affinescript/js/runtime.js @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: MIT OR AGPL-3.0-or-later +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Playground runtime shim for js_of_ocaml. // // Provides a browser-safe stub for `caml_unix_putenv` so the js_of_ocaml diff --git a/affinescript/packages/affine-js/README.adoc b/affinescript/packages/affine-js/README.adoc index dd84a28..af69117 100644 --- a/affinescript/packages/affine-js/README.adoc +++ b/affinescript/packages/affine-js/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = affine-js :toc: :icons: font diff --git a/affinescript/packages/affine-js/marshal.js b/affinescript/packages/affine-js/marshal.js index 490da99..9b33eb4 100644 --- a/affinescript/packages/affine-js/marshal.js +++ b/affinescript/packages/affine-js/marshal.js @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell // // affine-js: Value marshaling between JavaScript and AffineScript WASM // diff --git a/affinescript/packages/affine-js/mod.js b/affinescript/packages/affine-js/mod.js index 1a10b78..f918449 100644 --- a/affinescript/packages/affine-js/mod.js +++ b/affinescript/packages/affine-js/mod.js @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell // // affine-js: JavaScript interop layer for AffineScript WASM modules // diff --git a/affinescript/packages/affine-js/runtime.js b/affinescript/packages/affine-js/runtime.js index 710274d..53d7f74 100644 --- a/affinescript/packages/affine-js/runtime.js +++ b/affinescript/packages/affine-js/runtime.js @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell // // affine-js: AffineScript WASM runtime support // diff --git a/affinescript/packages/affine-js/types.d.ts b/affinescript/packages/affine-js/types.d.ts index 7d5c3e4..2761b1a 100644 --- a/affinescript/packages/affine-js/types.d.ts +++ b/affinescript/packages/affine-js/types.d.ts @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell // // affine-js: TypeScript declarations // diff --git a/affinescript/packages/affine-res/README.adoc b/affinescript/packages/affine-res/README.adoc index cc3ba3e..d4ab7b3 100644 --- a/affinescript/packages/affine-res/README.adoc +++ b/affinescript/packages/affine-res/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = affine-res :toc: :icons: font diff --git a/affinescript/packages/affine-ts/README.adoc b/affinescript/packages/affine-ts/README.adoc index a2feba6..d4189a4 100644 --- a/affinescript/packages/affine-ts/README.adoc +++ b/affinescript/packages/affine-ts/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = affine-ts :toc: :icons: font diff --git a/affinescript/packages/affine-ts/mod.js b/affinescript/packages/affine-ts/mod.js index 8387131..ef5c937 100644 --- a/affinescript/packages/affine-ts/mod.js +++ b/affinescript/packages/affine-ts/mod.js @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell // // affine-ts: TypeScript-oriented wrapper for affine-js // diff --git a/affinescript/packages/affine-ts/types.d.ts b/affinescript/packages/affine-ts/types.d.ts index 0332ddf..29548a7 100644 --- a/affinescript/packages/affine-ts/types.d.ts +++ b/affinescript/packages/affine-ts/types.d.ts @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell // // affine-ts: Enhanced TypeScript declarations // diff --git a/affinescript/run_wasm.js b/affinescript/run_wasm.js index 91f7104..da99dde 100644 --- a/affinescript/run_wasm.js +++ b/affinescript/run_wasm.js @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Simple WASM test runner for Node.js const fs = require('fs'); const path = require('path'); diff --git a/affinescript/runtime/src/alloc.rs b/affinescript/runtime/src/alloc.rs index 52c6a7e..aa8c5b6 100644 --- a/affinescript/runtime/src/alloc.rs +++ b/affinescript/runtime/src/alloc.rs @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2025 hyperpolymath //! Memory Allocator for AffineScript Runtime diff --git a/affinescript/runtime/src/effects.rs b/affinescript/runtime/src/effects.rs index 95c6357..b176f90 100644 --- a/affinescript/runtime/src/effects.rs +++ b/affinescript/runtime/src/effects.rs @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2025 hyperpolymath //! Effect Handling Runtime for AffineScript diff --git a/affinescript/runtime/src/ffi.rs b/affinescript/runtime/src/ffi.rs index 28cae99..c537917 100644 --- a/affinescript/runtime/src/ffi.rs +++ b/affinescript/runtime/src/ffi.rs @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2025 hyperpolymath //! Foreign Function Interface for AffineScript Runtime diff --git a/affinescript/runtime/src/gc.rs b/affinescript/runtime/src/gc.rs index eccf571..43ec035 100644 --- a/affinescript/runtime/src/gc.rs +++ b/affinescript/runtime/src/gc.rs @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2025 hyperpolymath //! Optional Garbage Collector for AffineScript Runtime diff --git a/affinescript/runtime/src/lib.rs b/affinescript/runtime/src/lib.rs index f6241f4..4f7bca7 100644 --- a/affinescript/runtime/src/lib.rs +++ b/affinescript/runtime/src/lib.rs @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2025 hyperpolymath //! AffineScript Runtime Library diff --git a/affinescript/runtime/src/panic.rs b/affinescript/runtime/src/panic.rs index 1606198..a9575d1 100644 --- a/affinescript/runtime/src/panic.rs +++ b/affinescript/runtime/src/panic.rs @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2024-2025 hyperpolymath //! Panic Handling for AffineScript Runtime diff --git a/affinescript/site/index.md b/affinescript/site/index.md index c69b15a..6563bd7 100644 --- a/affinescript/site/index.md +++ b/affinescript/site/index.md @@ -1,3 +1,7 @@ + --- title: AffineScript date: 2026-03-31 diff --git a/affinescript/stdlib/README.md b/affinescript/stdlib/README.md index 1ec68a9..a973069 100644 --- a/affinescript/stdlib/README.md +++ b/affinescript/stdlib/README.md @@ -1,3 +1,7 @@ + # AffineScript Standard Library The AffineScript standard library provides essential utilities and data structures. diff --git a/affinescript/tests/codegen/README.md b/affinescript/tests/codegen/README.md index c6c24ea..c7f2038 100644 --- a/affinescript/tests/codegen/README.md +++ b/affinescript/tests/codegen/README.md @@ -1,3 +1,7 @@ + # Codegen WASM tests This directory contains AffineScript codegen tests and their compiled WASM artifacts. diff --git a/affinescript/tests/conformance/README.md b/affinescript/tests/conformance/README.md index f2d231d..a7a82d9 100644 --- a/affinescript/tests/conformance/README.md +++ b/affinescript/tests/conformance/README.md @@ -1,3 +1,7 @@ + # aLib Conformance Tests This directory contains conformance tests for the **aggregate-library (aLib)** specification. diff --git a/affinescript/tools/affine-doc/assets/search.js b/affinescript/tools/affine-doc/assets/search.js index 6c3896f..e6c4c45 100644 --- a/affinescript/tools/affine-doc/assets/search.js +++ b/affinescript/tools/affine-doc/assets/search.js @@ -1,4 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // AffineScript Documentation Search (function() { diff --git a/affinescript/tools/affine-doc/src/extract.rs b/affinescript/tools/affine-doc/src/extract.rs index 0e91293..ecdaa95 100644 --- a/affinescript/tools/affine-doc/src/extract.rs +++ b/affinescript/tools/affine-doc/src/extract.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! Documentation Extraction //! //! Extracts documentation from AffineScript source code. diff --git a/affinescript/tools/affine-doc/src/html.rs b/affinescript/tools/affine-doc/src/html.rs index b3302e3..ab44ae8 100644 --- a/affinescript/tools/affine-doc/src/html.rs +++ b/affinescript/tools/affine-doc/src/html.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! HTML Generation //! //! Generates HTML documentation pages. diff --git a/affinescript/tools/affine-doc/src/index.rs b/affinescript/tools/affine-doc/src/index.rs index 79028f9..c860d0e 100644 --- a/affinescript/tools/affine-doc/src/index.rs +++ b/affinescript/tools/affine-doc/src/index.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! Search Index //! //! Builds and queries the documentation search index. diff --git a/affinescript/tools/affine-doc/src/main.rs b/affinescript/tools/affine-doc/src/main.rs index 66e14e2..0b9f126 100644 --- a/affinescript/tools/affine-doc/src/main.rs +++ b/affinescript/tools/affine-doc/src/main.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! AffineScript Documentation Generator //! //! Generates API documentation from AffineScript source code. diff --git a/affinescript/tools/affine-doc/src/render.rs b/affinescript/tools/affine-doc/src/render.rs index f0b058c..e687510 100644 --- a/affinescript/tools/affine-doc/src/render.rs +++ b/affinescript/tools/affine-doc/src/render.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! Markdown Rendering //! //! Renders Markdown doc comments to HTML. diff --git a/affinescript/tools/affine-pkg/src/build.rs b/affinescript/tools/affine-pkg/src/build.rs index d8da1a5..6e44686 100644 --- a/affinescript/tools/affine-pkg/src/build.rs +++ b/affinescript/tools/affine-pkg/src/build.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! Build System //! //! Orchestrates compilation of AffineScript packages. diff --git a/affinescript/tools/affine-pkg/src/config.rs b/affinescript/tools/affine-pkg/src/config.rs index 95cf19c..50142b3 100644 --- a/affinescript/tools/affine-pkg/src/config.rs +++ b/affinescript/tools/affine-pkg/src/config.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! Configuration //! //! User and project configuration for the package manager. diff --git a/affinescript/tools/affine-pkg/src/lockfile.rs b/affinescript/tools/affine-pkg/src/lockfile.rs index b962993..31290fa 100644 --- a/affinescript/tools/affine-pkg/src/lockfile.rs +++ b/affinescript/tools/affine-pkg/src/lockfile.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! Lock File (affine.lock) //! //! Records the exact versions of all dependencies for reproducibility. diff --git a/affinescript/tools/affine-pkg/src/main.rs b/affinescript/tools/affine-pkg/src/main.rs index c2d87c5..7a0f3d6 100644 --- a/affinescript/tools/affine-pkg/src/main.rs +++ b/affinescript/tools/affine-pkg/src/main.rs @@ -1,6 +1,6 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell #![forbid(unsafe_code)] -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors //! AffineScript Package Manager //! diff --git a/affinescript/tools/affine-pkg/src/manifest.rs b/affinescript/tools/affine-pkg/src/manifest.rs index ee2b9c8..58f4325 100644 --- a/affinescript/tools/affine-pkg/src/manifest.rs +++ b/affinescript/tools/affine-pkg/src/manifest.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! Package Manifest (affine.toml) //! //! Defines the package metadata and dependencies. diff --git a/affinescript/tools/affine-pkg/src/registry.rs b/affinescript/tools/affine-pkg/src/registry.rs index 06462c3..4d793e2 100644 --- a/affinescript/tools/affine-pkg/src/registry.rs +++ b/affinescript/tools/affine-pkg/src/registry.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! Package Registry Client //! //! Communicates with the AffineScript package registry. diff --git a/affinescript/tools/affine-pkg/src/resolve.rs b/affinescript/tools/affine-pkg/src/resolve.rs index ed24393..268a8c1 100644 --- a/affinescript/tools/affine-pkg/src/resolve.rs +++ b/affinescript/tools/affine-pkg/src/resolve.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! Dependency Resolution //! //! Resolves version constraints to concrete versions. diff --git a/affinescript/tools/affine-pkg/src/storage.rs b/affinescript/tools/affine-pkg/src/storage.rs index a9dcea9..f441c27 100644 --- a/affinescript/tools/affine-pkg/src/storage.rs +++ b/affinescript/tools/affine-pkg/src/storage.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! Content-Addressed Storage //! //! Stores packages by content hash for deduplication (like pnpm). diff --git a/affinescript/tools/affine-pkg/src/workspace.rs b/affinescript/tools/affine-pkg/src/workspace.rs index 59d9b6c..a4dbaf9 100644 --- a/affinescript/tools/affine-pkg/src/workspace.rs +++ b/affinescript/tools/affine-pkg/src/workspace.rs @@ -1,6 +1,5 @@ -// SPDX-License-Identifier: Apache-2.0 OR MIT -// Copyright 2024 AffineScript Contributors - +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! Workspace Support //! //! Manages monorepos with multiple packages. diff --git a/affinescript/tools/affinescript-dap/src/main.rs b/affinescript/tools/affinescript-dap/src/main.rs index d33981e..0769aa1 100644 --- a/affinescript/tools/affinescript-dap/src/main.rs +++ b/affinescript/tools/affinescript-dap/src/main.rs @@ -1,5 +1,6 @@ -#![forbid(unsafe_code)] // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +#![forbid(unsafe_code)] //! Debug Adapter Protocol (DAP) implementation for Affinescript //! //! This is a minimal DAP adapter for Affinescript. diff --git a/affinescript/tools/affinescript-lsp/src/capabilities.rs b/affinescript/tools/affinescript-lsp/src/capabilities.rs index e08d28e..a734447 100644 --- a/affinescript/tools/affinescript-lsp/src/capabilities.rs +++ b/affinescript/tools/affinescript-lsp/src/capabilities.rs @@ -1,6 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2024-2026 Jonathan D.A. Jewell (hyperpolymath) - +// Copyright (c) Jonathan D.A. Jewell //! Server Capabilities //! //! Defines what features the language server supports. diff --git a/affinescript/tools/affinescript-lsp/src/diagnostics.rs b/affinescript/tools/affinescript-lsp/src/diagnostics.rs index 979e61a..211235e 100644 --- a/affinescript/tools/affinescript-lsp/src/diagnostics.rs +++ b/affinescript/tools/affinescript-lsp/src/diagnostics.rs @@ -1,6 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2024-2026 Jonathan D.A. Jewell (hyperpolymath) - +// Copyright (c) Jonathan D.A. Jewell //! Diagnostics //! //! Converts AffineScript compiler diagnostics to LSP diagnostics. diff --git a/affinescript/tools/affinescript-lsp/src/document.rs b/affinescript/tools/affinescript-lsp/src/document.rs index 933a2c9..6c9c04a 100644 --- a/affinescript/tools/affinescript-lsp/src/document.rs +++ b/affinescript/tools/affinescript-lsp/src/document.rs @@ -1,6 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2024-2026 Jonathan D.A. Jewell (hyperpolymath) - +// Copyright (c) Jonathan D.A. Jewell //! Document Management //! //! Tracks open documents and their state. diff --git a/affinescript/tools/affinescript-lsp/src/handlers.rs b/affinescript/tools/affinescript-lsp/src/handlers.rs index bd51417..423ba30 100644 --- a/affinescript/tools/affinescript-lsp/src/handlers.rs +++ b/affinescript/tools/affinescript-lsp/src/handlers.rs @@ -1,6 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2024-2026 Jonathan D.A. Jewell (hyperpolymath) - +// Copyright (c) Jonathan D.A. Jewell //! Request Handlers //! //! Implementation of LSP request handlers for AffineScript. diff --git a/affinescript/tools/affinescript-lsp/src/main.rs b/affinescript/tools/affinescript-lsp/src/main.rs index 300b180..98e7e2c 100644 --- a/affinescript/tools/affinescript-lsp/src/main.rs +++ b/affinescript/tools/affinescript-lsp/src/main.rs @@ -1,6 +1,6 @@ -#![forbid(unsafe_code)] // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2024-2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell +#![forbid(unsafe_code)] //! AffineScript Language Server //! diff --git a/affinescript/tools/affinescript-lsp/src/symbols.rs b/affinescript/tools/affinescript-lsp/src/symbols.rs index eea9ac2..c2daf8d 100644 --- a/affinescript/tools/affinescript-lsp/src/symbols.rs +++ b/affinescript/tools/affinescript-lsp/src/symbols.rs @@ -1,6 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2024-2026 Jonathan D.A. Jewell (hyperpolymath) - +// Copyright (c) Jonathan D.A. Jewell //! Phase B: Symbol Table and References //! //! Parses the v2 `--json` contract's `symbols` and `references` fields. diff --git a/affinescript/tools/affinescript-lsp/src/text_index.rs b/affinescript/tools/affinescript-lsp/src/text_index.rs index bc86f77..a1f8d2e 100644 --- a/affinescript/tools/affinescript-lsp/src/text_index.rs +++ b/affinescript/tools/affinescript-lsp/src/text_index.rs @@ -1,6 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2024-2026 Jonathan D.A. Jewell (hyperpolymath) - +// Copyright (c) Jonathan D.A. Jewell //! Text-Based Symbol Index (Phase C) //! //! Provides a fallback symbol index by scanning AffineScript source text for diff --git a/affinescript/wiki/README.md b/affinescript/wiki/README.md index 7cf995f..619c42a 100644 --- a/affinescript/wiki/README.md +++ b/affinescript/wiki/README.md @@ -1,3 +1,7 @@ + # AffineScript Wiki Welcome to the AffineScript language wiki - your comprehensive guide to learning and using AffineScript. diff --git a/affinescript/wiki/compiler/architecture.md b/affinescript/wiki/compiler/architecture.md index 9cd99a8..97167b6 100644 --- a/affinescript/wiki/compiler/architecture.md +++ b/affinescript/wiki/compiler/architecture.md @@ -1,3 +1,7 @@ + # Compiler Architecture This document describes the architecture of the AffineScript compiler. diff --git a/affinescript/wiki/compiler/borrow-checker.md b/affinescript/wiki/compiler/borrow-checker.md index 55b396b..0f464c8 100644 --- a/affinescript/wiki/compiler/borrow-checker.md +++ b/affinescript/wiki/compiler/borrow-checker.md @@ -1,3 +1,7 @@ + # Borrow Checker The AffineScript borrow checker verifies ownership and borrowing rules at compile time. diff --git a/affinescript/wiki/compiler/codegen.md b/affinescript/wiki/compiler/codegen.md index 7af572d..b312c3c 100644 --- a/affinescript/wiki/compiler/codegen.md +++ b/affinescript/wiki/compiler/codegen.md @@ -1,3 +1,7 @@ + # Code Generation The AffineScript code generator emits WebAssembly from the typed and verified AST. diff --git a/affinescript/wiki/compiler/lexer.md b/affinescript/wiki/compiler/lexer.md index b389ae0..f03271e 100644 --- a/affinescript/wiki/compiler/lexer.md +++ b/affinescript/wiki/compiler/lexer.md @@ -1,3 +1,7 @@ + # Lexer Implementation The AffineScript lexer converts source text into a stream of tokens. diff --git a/affinescript/wiki/compiler/parser.md b/affinescript/wiki/compiler/parser.md index 3e6f2cc..e11bb35 100644 --- a/affinescript/wiki/compiler/parser.md +++ b/affinescript/wiki/compiler/parser.md @@ -1,3 +1,7 @@ + # Parser Implementation The AffineScript parser converts tokens into a Concrete Syntax Tree (CST). diff --git a/affinescript/wiki/compiler/type-checker.md b/affinescript/wiki/compiler/type-checker.md index 5d437cc..8c83101 100644 --- a/affinescript/wiki/compiler/type-checker.md +++ b/affinescript/wiki/compiler/type-checker.md @@ -1,3 +1,7 @@ + # Type Checker The AffineScript type checker implements bidirectional type inference with support for dependent types, row polymorphism, and effects. diff --git a/affinescript/wiki/language-reference/dependent-types.md b/affinescript/wiki/language-reference/dependent-types.md index aa19e36..21ede46 100644 --- a/affinescript/wiki/language-reference/dependent-types.md +++ b/affinescript/wiki/language-reference/dependent-types.md @@ -1,3 +1,7 @@ + # Dependent Types Dependent types allow types to depend on values, enabling compile-time verification of invariants. diff --git a/affinescript/wiki/language-reference/effects.md b/affinescript/wiki/language-reference/effects.md index 3d4c9de..ad1b508 100644 --- a/affinescript/wiki/language-reference/effects.md +++ b/affinescript/wiki/language-reference/effects.md @@ -1,3 +1,7 @@ + # Algebraic Effects AffineScript features an algebraic effect system for controlled side effects, enabling pure functional programming with practical I/O capabilities. diff --git a/affinescript/wiki/language-reference/functions.md b/affinescript/wiki/language-reference/functions.md index d8f35b8..3d6b6ca 100644 --- a/affinescript/wiki/language-reference/functions.md +++ b/affinescript/wiki/language-reference/functions.md @@ -1,3 +1,7 @@ + # Functions Functions are the primary building blocks of AffineScript programs. diff --git a/affinescript/wiki/language-reference/lexical.md b/affinescript/wiki/language-reference/lexical.md index 9db74d2..399aff4 100644 --- a/affinescript/wiki/language-reference/lexical.md +++ b/affinescript/wiki/language-reference/lexical.md @@ -1,3 +1,7 @@ + # Lexical Structure This document describes the lexical structure of AffineScript - how source code is broken into tokens. diff --git a/affinescript/wiki/language-reference/modules.md b/affinescript/wiki/language-reference/modules.md index 07e6e4f..5cae636 100644 --- a/affinescript/wiki/language-reference/modules.md +++ b/affinescript/wiki/language-reference/modules.md @@ -1,3 +1,7 @@ + # Module System AffineScript's module system organizes code into logical units with controlled visibility. diff --git a/affinescript/wiki/language-reference/ownership.md b/affinescript/wiki/language-reference/ownership.md index ee2e3e9..415367b 100644 --- a/affinescript/wiki/language-reference/ownership.md +++ b/affinescript/wiki/language-reference/ownership.md @@ -1,3 +1,7 @@ + # Ownership and Borrowing AffineScript uses an ownership system inspired by Rust and linear types from type theory. This ensures memory safety without garbage collection. diff --git a/affinescript/wiki/language-reference/patterns.md b/affinescript/wiki/language-reference/patterns.md index 4c4ec57..28e8921 100644 --- a/affinescript/wiki/language-reference/patterns.md +++ b/affinescript/wiki/language-reference/patterns.md @@ -1,3 +1,7 @@ + # Pattern Matching Pattern matching is a powerful feature for destructuring and conditionally binding values. diff --git a/affinescript/wiki/language-reference/rows.md b/affinescript/wiki/language-reference/rows.md index 985b273..ac547dc 100644 --- a/affinescript/wiki/language-reference/rows.md +++ b/affinescript/wiki/language-reference/rows.md @@ -1,3 +1,7 @@ + # Row Polymorphism Row polymorphism enables flexible, type-safe operations on extensible records and variants. diff --git a/affinescript/wiki/language-reference/traits.md b/affinescript/wiki/language-reference/traits.md index 4c2d48e..ba23e6c 100644 --- a/affinescript/wiki/language-reference/traits.md +++ b/affinescript/wiki/language-reference/traits.md @@ -1,3 +1,7 @@ + # Traits Traits define shared behavior that types can implement. They enable polymorphism and code reuse. diff --git a/affinescript/wiki/language-reference/types.md b/affinescript/wiki/language-reference/types.md index eeedc40..0590e1e 100644 --- a/affinescript/wiki/language-reference/types.md +++ b/affinescript/wiki/language-reference/types.md @@ -1,3 +1,7 @@ + # Type System AffineScript features an advanced type system combining: diff --git a/affinescript/wiki/stdlib/overview.md b/affinescript/wiki/stdlib/overview.md index 381701f..0c156ab 100644 --- a/affinescript/wiki/stdlib/overview.md +++ b/affinescript/wiki/stdlib/overview.md @@ -1,3 +1,7 @@ + # Standard Library Overview The AffineScript standard library provides essential types, traits, and functions. diff --git a/affinescript/wiki/testing/guide.md b/affinescript/wiki/testing/guide.md index cdb54b4..d857d75 100644 --- a/affinescript/wiki/testing/guide.md +++ b/affinescript/wiki/testing/guide.md @@ -1,3 +1,7 @@ + # Testing Guide Comprehensive guide to testing AffineScript programs and the compiler itself. diff --git a/affinescript/wiki/testing/property-based.md b/affinescript/wiki/testing/property-based.md index 335886e..835d291 100644 --- a/affinescript/wiki/testing/property-based.md +++ b/affinescript/wiki/testing/property-based.md @@ -1,3 +1,7 @@ + # Property-Based Testing Property-based testing generates random test cases to verify that properties hold for all inputs. diff --git a/affinescript/wiki/tooling/cli.md b/affinescript/wiki/tooling/cli.md index 0613631..0d9f28e 100644 --- a/affinescript/wiki/tooling/cli.md +++ b/affinescript/wiki/tooling/cli.md @@ -1,3 +1,7 @@ + # Command-Line Interface The AffineScript CLI provides commands for compiling, testing, and managing projects. diff --git a/affinescript/wiki/tooling/repl.md b/affinescript/wiki/tooling/repl.md index bcfeeb4..6e50c31 100644 --- a/affinescript/wiki/tooling/repl.md +++ b/affinescript/wiki/tooling/repl.md @@ -1,3 +1,7 @@ + # REPL Guide The AffineScript REPL (Read-Eval-Print Loop) provides an interactive environment for exploring the language. diff --git a/affinescript/wiki/tutorials/introduction.md b/affinescript/wiki/tutorials/introduction.md index e74a426..34f80cc 100644 --- a/affinescript/wiki/tutorials/introduction.md +++ b/affinescript/wiki/tutorials/introduction.md @@ -1,3 +1,7 @@ + # Introduction to AffineScript AffineScript is a modern systems programming language that combines safety, expressiveness, and performance. diff --git a/affinescript/wiki/tutorials/quickstart.md b/affinescript/wiki/tutorials/quickstart.md index bfa9ab2..39caeca 100644 --- a/affinescript/wiki/tutorials/quickstart.md +++ b/affinescript/wiki/tutorials/quickstart.md @@ -1,3 +1,7 @@ + # Quick Start Guide Get up and running with AffineScript in 10 minutes. diff --git a/container/README.adoc b/container/README.adoc index 1d6b4ab..70bf1ec 100644 --- a/container/README.adoc +++ b/container/README.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell = Proof Burrower Container Templates :toc: left :toclevels: 3 diff --git a/crates/burrower-cli/src/main.rs b/crates/burrower-cli/src/main.rs index b8086bf..6790953 100644 --- a/crates/burrower-cli/src/main.rs +++ b/crates/burrower-cli/src/main.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 - +// Copyright (c) Jonathan D.A. Jewell //! Proof Burrower CLI. //! //! Two subcommands: diff --git a/crates/burrower-core/src/attempt.rs b/crates/burrower-core/src/attempt.rs index 37468ca..34a0877 100644 --- a/crates/burrower-core/src/attempt.rs +++ b/crates/burrower-core/src/attempt.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 - +// Copyright (c) Jonathan D.A. Jewell //! # Proof attempts //! //! Specialists don't just route — they *attempt*. Each specialist diff --git a/crates/burrower-core/src/corpus.rs b/crates/burrower-core/src/corpus.rs index f318ea5..0b2d6da 100644 --- a/crates/burrower-core/src/corpus.rs +++ b/crates/burrower-core/src/corpus.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 - +// Copyright (c) Jonathan D.A. Jewell //! Corpus indexing. //! //! A `Corpus` is a collection of indexed lemmas extracted from one or diff --git a/crates/burrower-core/src/goal.rs b/crates/burrower-core/src/goal.rs index 5a1a76e..b202adb 100644 --- a/crates/burrower-core/src/goal.rs +++ b/crates/burrower-core/src/goal.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 - +// Copyright (c) Jonathan D.A. Jewell //! Goal parsing and normalisation. //! //! A `Goal` is the input side of Burrower: a proof obligation we want to diff --git a/crates/burrower-core/src/ledger.rs b/crates/burrower-core/src/ledger.rs index 206bcb6..c83eb2a 100644 --- a/crates/burrower-core/src/ledger.rs +++ b/crates/burrower-core/src/ledger.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 - +// Copyright (c) Jonathan D.A. Jewell //! # The Burrow Ledger //! //! Append-only log of every approach a specialist tried, with the result diff --git a/crates/burrower-core/src/lib.rs b/crates/burrower-core/src/lib.rs index 30c8062..ee4220c 100644 --- a/crates/burrower-core/src/lib.rs +++ b/crates/burrower-core/src/lib.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 - +// Copyright (c) Jonathan D.A. Jewell //! # Proof Burrower — core engine //! //! Burrower locates the *mathematical home* of a proof goal: given a goal diff --git a/crates/burrower-core/src/oracle.rs b/crates/burrower-core/src/oracle.rs index 1ed6f4b..97146cf 100644 --- a/crates/burrower-core/src/oracle.rs +++ b/crates/burrower-core/src/oracle.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 - +// Copyright (c) Jonathan D.A. Jewell //! # Pre-proof oracle (safe-learning c) //! //! When a goal can be ground-truthed numerically (today: tropical diff --git a/crates/burrower-core/src/ranking.rs b/crates/burrower-core/src/ranking.rs index 87a4c94..33b318f 100644 --- a/crates/burrower-core/src/ranking.rs +++ b/crates/burrower-core/src/ranking.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 - +// Copyright (c) Jonathan D.A. Jewell //! Goal-to-corpus ranking. //! //! Given a parsed [`Goal`] and a [`Corpus`], compute the most similar diff --git a/crates/burrower-core/src/serve.rs b/crates/burrower-core/src/serve.rs index ddd38cf..e9c4e28 100644 --- a/crates/burrower-core/src/serve.rs +++ b/crates/burrower-core/src/serve.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 - +// Copyright (c) Jonathan D.A. Jewell //! # BI-1: `burrower serve` — Unix domain socket endpoint //! //! Burrower today is a one-shot CLI; every `swarm`, `attempt`, or diff --git a/crates/burrower-core/src/specialist.rs b/crates/burrower-core/src/specialist.rs index 153b766..1c38850 100644 --- a/crates/burrower-core/src/specialist.rs +++ b/crates/burrower-core/src/specialist.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 - +// Copyright (c) Jonathan D.A. Jewell //! # Specialists — the agent swarm //! //! A `Specialist` is a domain expert: an agent that recognises a diff --git a/crates/burrower-wasm/src/lib.rs b/crates/burrower-wasm/src/lib.rs index 0d87936..c23e635 100644 --- a/crates/burrower-wasm/src/lib.rs +++ b/crates/burrower-wasm/src/lib.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 - +// Copyright (c) Jonathan D.A. Jewell //! # Burrower WASM shim //! //! Thin C-ABI wrapper around `burrower-core` so the engine ships as diff --git a/docs/AGENT-DSL.adoc b/docs/AGENT-DSL.adoc index 4b6da2c..51ea187 100644 --- a/docs/AGENT-DSL.adoc +++ b/docs/AGENT-DSL.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Agent DSL: 007 → Burrower Specialist :toc: left :sectnums: diff --git a/docs/ECHIDNA-INTEGRATION.adoc b/docs/ECHIDNA-INTEGRATION.adoc index 6297975..f56d7a6 100644 --- a/docs/ECHIDNA-INTEGRATION.adoc +++ b/docs/ECHIDNA-INTEGRATION.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = ECHIDNA + echidnabot Integration Points :toc: left :toc-title: Integration map diff --git a/docs/QUICKSTART.adoc b/docs/QUICKSTART.adoc index b20b3d0..013bf34 100644 --- a/docs/QUICKSTART.adoc +++ b/docs/QUICKSTART.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Quickstart :toc: preamble diff --git a/docs/README.adoc b/docs/README.adoc index df45be7..adf6a02 100644 --- a/docs/README.adoc +++ b/docs/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Documentation Layout Primary tracks: diff --git a/docs/RSR_OUTLINE.adoc b/docs/RSR_OUTLINE.adoc index e07a65e..43a113f 100644 --- a/docs/RSR_OUTLINE.adoc +++ b/docs/RSR_OUTLINE.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = RSR Template Repository image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] diff --git a/docs/STATE-VISUALIZER.adoc b/docs/STATE-VISUALIZER.adoc index 422fcd5..77c0248 100644 --- a/docs/STATE-VISUALIZER.adoc +++ b/docs/STATE-VISUALIZER.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Project State Visualizer [source] ---- diff --git a/docs/SWARM-DESIGN-MEANDER.adoc b/docs/SWARM-DESIGN-MEANDER.adoc index dad30e5..bda8796 100644 --- a/docs/SWARM-DESIGN-MEANDER.adoc +++ b/docs/SWARM-DESIGN-MEANDER.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Burrower Swarm: Design Meander :toc: left :toc-title: Wandering through diff --git a/docs/TYPED-WASM-VERIFICATION.adoc b/docs/TYPED-WASM-VERIFICATION.adoc index 0c2df22..47aa59a 100644 --- a/docs/TYPED-WASM-VERIFICATION.adoc +++ b/docs/TYPED-WASM-VERIFICATION.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Typed-WASM Verification Pipeline :toc: left :sectnums: diff --git a/docs/architecture/THREAT-MODEL.adoc b/docs/architecture/THREAT-MODEL.adoc index 3415289..c8c4a5c 100644 --- a/docs/architecture/THREAT-MODEL.adoc +++ b/docs/architecture/THREAT-MODEL.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Threat Model diff --git a/docs/attribution/CITATIONS.adoc b/docs/attribution/CITATIONS.adoc index 1a24abe..61040b0 100644 --- a/docs/attribution/CITATIONS.adoc +++ b/docs/attribution/CITATIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Proof Burrower - Citation Guide :toc: diff --git a/docs/attribution/CODEOWNERS.adoc b/docs/attribution/CODEOWNERS.adoc index 3714055..668df01 100644 --- a/docs/attribution/CODEOWNERS.adoc +++ b/docs/attribution/CODEOWNERS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Code Ownership :icons: font diff --git a/docs/attribution/MAINTAINERS.adoc b/docs/attribution/MAINTAINERS.adoc index a1c6544..becaa3e 100644 --- a/docs/attribution/MAINTAINERS.adoc +++ b/docs/attribution/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/docs/attribution/README.adoc b/docs/attribution/README.adoc index b095612..2e50721 100644 --- a/docs/attribution/README.adoc +++ b/docs/attribution/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = attribution Unit diff --git a/docs/decisions/0000-template.adoc b/docs/decisions/0000-template.adoc index b1a561f..825ea4a 100644 --- a/docs/decisions/0000-template.adoc +++ b/docs/decisions/0000-template.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Architecture Decision Record: 0000-template diff --git a/docs/decisions/0001-adopt-rsr-standard.adoc b/docs/decisions/0001-adopt-rsr-standard.adoc index 7e54838..b4d89d2 100644 --- a/docs/decisions/0001-adopt-rsr-standard.adoc +++ b/docs/decisions/0001-adopt-rsr-standard.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Architecture Decision Record: 0001-adopt-rsr-standard diff --git a/docs/decisions/README.adoc b/docs/decisions/README.adoc index 153a5e7..af174f5 100644 --- a/docs/decisions/README.adoc +++ b/docs/decisions/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = decisions Unit diff --git a/docs/developer/ABI-FFI-README.adoc b/docs/developer/ABI-FFI-README.adoc index d78c11d..b43220a 100644 --- a/docs/developer/ABI-FFI-README.adoc +++ b/docs/developer/ABI-FFI-README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = ABI/FFI Standards {{~ Aditionally delete this line and fill out the template below ~}} diff --git a/docs/developer/README.adoc b/docs/developer/README.adoc index 1d00529..2b328b4 100644 --- a/docs/developer/README.adoc +++ b/docs/developer/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = developer Unit diff --git a/docs/experiments/2026-04-26-tropical-comparison/REPORT.adoc b/docs/experiments/2026-04-26-tropical-comparison/REPORT.adoc index fec4876..7f3e678 100644 --- a/docs/experiments/2026-04-26-tropical-comparison/REPORT.adoc +++ b/docs/experiments/2026-04-26-tropical-comparison/REPORT.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Burrower vs. Manual Closeout — `tropical-resource-typing` (2026-04-26) :toc: diff --git a/docs/governance/CRG-AUDIT-TEMPLATE.adoc b/docs/governance/CRG-AUDIT-TEMPLATE.adoc index 8febdc3..86f0b38 100644 --- a/docs/governance/CRG-AUDIT-TEMPLATE.adoc +++ b/docs/governance/CRG-AUDIT-TEMPLATE.adoc @@ -1,6 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell - +// Copyright (c) Jonathan D.A. Jewell = Proof Burrower — CRG Audit (2026-04-26) Jonathan D.A. Jewell 2026-04-26 diff --git a/docs/governance/CRG-CRITERIA.adoc b/docs/governance/CRG-CRITERIA.adoc index f8264e6..926df5a 100644 --- a/docs/governance/CRG-CRITERIA.adoc +++ b/docs/governance/CRG-CRITERIA.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Component Readiness Grades (CRG) Criteria :toc: preamble :icons: font diff --git a/docs/governance/MAINTENANCE-CHECKLIST.adoc b/docs/governance/MAINTENANCE-CHECKLIST.adoc index 1160797..0b27a19 100644 --- a/docs/governance/MAINTENANCE-CHECKLIST.adoc +++ b/docs/governance/MAINTENANCE-CHECKLIST.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintenance Checklist # Maintenance Checklist (Cross-Repo) diff --git a/docs/governance/README.adoc b/docs/governance/README.adoc index 114ee94..48cac0d 100644 --- a/docs/governance/README.adoc +++ b/docs/governance/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Governance Pillar (TSDM) diff --git a/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc b/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc index e8805c6..2bfa0ff 100644 --- a/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc +++ b/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Software Development Approach (General) :toc: left :toclevels: 2 diff --git a/docs/governance/TSDM.adoc b/docs/governance/TSDM.adoc index cbd582c..6bf4ee8 100644 --- a/docs/governance/TSDM.adoc +++ b/docs/governance/TSDM.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Triaxial Software Development Methodology (TSDM) :toc: preamble :icons: font diff --git a/docs/governance/audit/README.adoc b/docs/governance/audit/README.adoc index fac3740..02aff13 100644 --- a/docs/governance/audit/README.adoc +++ b/docs/governance/audit/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Audit Axis diff --git a/docs/governance/audit/compliance/README.adoc b/docs/governance/audit/compliance/README.adoc index 876954f..9948dbc 100644 --- a/docs/governance/audit/compliance/README.adoc +++ b/docs/governance/audit/compliance/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Compliance Unit diff --git a/docs/governance/audit/effects/README.adoc b/docs/governance/audit/effects/README.adoc index 3634799..e5620ee 100644 --- a/docs/governance/audit/effects/README.adoc +++ b/docs/governance/audit/effects/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Effects Unit diff --git a/docs/governance/audit/systems/README.adoc b/docs/governance/audit/systems/README.adoc index 8d179b4..00a67de 100644 --- a/docs/governance/audit/systems/README.adoc +++ b/docs/governance/audit/systems/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Systems Unit diff --git a/docs/governance/maintenance/README.adoc b/docs/governance/maintenance/README.adoc index 0ed2f1b..7083a83 100644 --- a/docs/governance/maintenance/README.adoc +++ b/docs/governance/maintenance/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintenance Axis diff --git a/docs/governance/maintenance/adaptive/README.adoc b/docs/governance/maintenance/adaptive/README.adoc index 7b60992..72d0381 100644 --- a/docs/governance/maintenance/adaptive/README.adoc +++ b/docs/governance/maintenance/adaptive/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Adaptive Unit diff --git a/docs/governance/maintenance/corrective/README.adoc b/docs/governance/maintenance/corrective/README.adoc index ed904a8..9a0ed5d 100644 --- a/docs/governance/maintenance/corrective/README.adoc +++ b/docs/governance/maintenance/corrective/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Corrective Unit diff --git a/docs/governance/maintenance/perfective/README.adoc b/docs/governance/maintenance/perfective/README.adoc index 8759d74..12e3d14 100644 --- a/docs/governance/maintenance/perfective/README.adoc +++ b/docs/governance/maintenance/perfective/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Perfective Unit diff --git a/docs/governance/planning/README.adoc b/docs/governance/planning/README.adoc index 62aa375..2694fe9 100644 --- a/docs/governance/planning/README.adoc +++ b/docs/governance/planning/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Planning Axis diff --git a/docs/governance/planning/could/README.adoc b/docs/governance/planning/could/README.adoc index ad5a6b8..acc41ce 100644 --- a/docs/governance/planning/could/README.adoc +++ b/docs/governance/planning/could/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Could Unit diff --git a/docs/governance/planning/must/README.adoc b/docs/governance/planning/must/README.adoc index 47eb46d..5759550 100644 --- a/docs/governance/planning/must/README.adoc +++ b/docs/governance/planning/must/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Must Unit diff --git a/docs/governance/planning/should/README.adoc b/docs/governance/planning/should/README.adoc index 605489c..a00f585 100644 --- a/docs/governance/planning/should/README.adoc +++ b/docs/governance/planning/should/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Should Unit diff --git a/docs/practice/AI-CONVENTIONS.adoc b/docs/practice/AI-CONVENTIONS.adoc index f0ed9ea..7cad38f 100644 --- a/docs/practice/AI-CONVENTIONS.adoc +++ b/docs/practice/AI-CONVENTIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = AI Conventions diff --git a/docs/practice/README.adoc b/docs/practice/README.adoc index ae3326b..caceb5c 100644 --- a/docs/practice/README.adoc +++ b/docs/practice/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = practice Unit diff --git a/docs/practice/STATE-VISUALIZER-GUIDE.adoc b/docs/practice/STATE-VISUALIZER-GUIDE.adoc index c2490ca..6e97d92 100644 --- a/docs/practice/STATE-VISUALIZER-GUIDE.adoc +++ b/docs/practice/STATE-VISUALIZER-GUIDE.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = TOPOLOGY.md — Generation Guide Jonathan D.A. Jewell (hyperpolymath) :toc: diff --git a/docs/practice/ci-cost-reduction.adoc b/docs/practice/ci-cost-reduction.adoc index 1aa8ce2..45181aa 100644 --- a/docs/practice/ci-cost-reduction.adoc +++ b/docs/practice/ci-cost-reduction.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // (MPL-2.0 is automatic legal fallback until PMPL is formally recognised) = CI Cost Reduction — RSR Estate Spec :toc: left diff --git a/docs/reports/README.adoc b/docs/reports/README.adoc index 0c06c31..e91d79e 100644 --- a/docs/reports/README.adoc +++ b/docs/reports/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = reports Unit diff --git a/docs/reports/audit/pillar-audit-2026-04-15.md b/docs/reports/audit/pillar-audit-2026-04-15.md index d976233..1b442e6 100644 --- a/docs/reports/audit/pillar-audit-2026-04-15.md +++ b/docs/reports/audit/pillar-audit-2026-04-15.md @@ -1,3 +1,7 @@ + # Gemini Audit Report (M2: Pillar Repo Audits) Date: 2026-04-15 Repository: /var/mnt/eclipse/repos/rsr-template-repo diff --git a/docs/reports/compliance/README.adoc b/docs/reports/compliance/README.adoc index c38c66a..1f6b885 100644 --- a/docs/reports/compliance/README.adoc +++ b/docs/reports/compliance/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Compliance Reports diff --git a/docs/reports/maintenance/README.adoc b/docs/reports/maintenance/README.adoc index f13abf7..82f845e 100644 --- a/docs/reports/maintenance/README.adoc +++ b/docs/reports/maintenance/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintenance Reports diff --git a/docs/reports/performance/README.adoc b/docs/reports/performance/README.adoc index 037767d..6473ed3 100644 --- a/docs/reports/performance/README.adoc +++ b/docs/reports/performance/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Performance Reports diff --git a/docs/reports/quality/README.adoc b/docs/reports/quality/README.adoc index d1be848..dbdb3ba 100644 --- a/docs/reports/quality/README.adoc +++ b/docs/reports/quality/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Quality Reports diff --git a/docs/reports/security/README.adoc b/docs/reports/security/README.adoc index 9a78a8b..76656cc 100644 --- a/docs/reports/security/README.adoc +++ b/docs/reports/security/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Security Reports diff --git a/docs/standards/README.adoc b/docs/standards/README.adoc index 34a94c4..41f7a31 100644 --- a/docs/standards/README.adoc +++ b/docs/standards/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Standards Unit diff --git a/docs/templates/contractiles/README.adoc b/docs/templates/contractiles/README.adoc index 121da7a..c544de6 100644 --- a/docs/templates/contractiles/README.adoc +++ b/docs/templates/contractiles/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractile Templates Blank templates for projects that want to replace the hyperpolymath diff --git a/docs/theory/README.adoc b/docs/theory/README.adoc index c0ddf28..b2658b1 100644 --- a/docs/theory/README.adoc +++ b/docs/theory/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = theory Unit diff --git a/docs/theory/computing/README.adoc b/docs/theory/computing/README.adoc index 4d0db25..aec951f 100644 --- a/docs/theory/computing/README.adoc +++ b/docs/theory/computing/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Computing Theory diff --git a/docs/theory/formalisms/README.adoc b/docs/theory/formalisms/README.adoc index 5d064c3..288a410 100644 --- a/docs/theory/formalisms/README.adoc +++ b/docs/theory/formalisms/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Formalisms Theory diff --git a/docs/theory/mathematics/README.adoc b/docs/theory/mathematics/README.adoc index 356236f..c9b223d 100644 --- a/docs/theory/mathematics/README.adoc +++ b/docs/theory/mathematics/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Mathematics Theory diff --git a/docs/theory/ontologies/README.adoc b/docs/theory/ontologies/README.adoc index 6d16ecf..9267ab0 100644 --- a/docs/theory/ontologies/README.adoc +++ b/docs/theory/ontologies/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Ontologies Theory diff --git a/docs/theory/other/README.adoc b/docs/theory/other/README.adoc index 1861d6d..0ec8432 100644 --- a/docs/theory/other/README.adoc +++ b/docs/theory/other/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Other Theory diff --git a/docs/theory/socio-technical/README.adoc b/docs/theory/socio-technical/README.adoc index 9ab4ee0..5c3c819 100644 --- a/docs/theory/socio-technical/README.adoc +++ b/docs/theory/socio-technical/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Socio technical Theory diff --git a/docs/whitepapers/README.adoc b/docs/whitepapers/README.adoc index 88e83c5..1ee0309 100644 --- a/docs/whitepapers/README.adoc +++ b/docs/whitepapers/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = whitepapers Unit diff --git a/docs/whitepapers/academic/README.adoc b/docs/whitepapers/academic/README.adoc index 16c3f45..d6dc7a0 100644 --- a/docs/whitepapers/academic/README.adoc +++ b/docs/whitepapers/academic/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Academic Logic diff --git a/docs/whitepapers/industry/README.adoc b/docs/whitepapers/industry/README.adoc index 7bc7fcd..2f795b7 100644 --- a/docs/whitepapers/industry/README.adoc +++ b/docs/whitepapers/industry/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Industry Logic diff --git a/docs/whitepapers/outreach/README.adoc b/docs/whitepapers/outreach/README.adoc index 8141463..f3ea4da 100644 --- a/docs/whitepapers/outreach/README.adoc +++ b/docs/whitepapers/outreach/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Outreach & Education :toc: preamble :icons: font diff --git a/docs/wikis/README.adoc b/docs/wikis/README.adoc index 71b60d1..4d493b4 100644 --- a/docs/wikis/README.adoc +++ b/docs/wikis/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Project Wikis :toc: preamble :icons: font diff --git a/examples/README.adoc b/examples/README.adoc index b9cdb48..40bc850 100644 --- a/examples/README.adoc +++ b/examples/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = examples Pillar diff --git a/features/README.adoc b/features/README.adoc index 3899280..4922891 100644 --- a/features/README.adoc +++ b/features/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Project Features diff --git a/features/boj-server/README.adoc b/features/boj-server/README.adoc index 0039c37..0ef0376 100644 --- a/features/boj-server/README.adoc +++ b/features/boj-server/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = BoJ Server Integration :icons: font diff --git a/features/panic-attacker/README.adoc b/features/panic-attacker/README.adoc index 72d56a4..de0bd9b 100644 --- a/features/panic-attacker/README.adoc +++ b/features/panic-attacker/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Panic Attacker Feature :icons: font diff --git a/features/ssg/README.adoc b/features/ssg/README.adoc index e15687b..a6ef262 100644 --- a/features/ssg/README.adoc +++ b/features/ssg/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Ssg Feature diff --git a/llm-warmup-dev.md b/llm-warmup-dev.md index e616c99..99be7bc 100644 --- a/llm-warmup-dev.md +++ b/llm-warmup-dev.md @@ -1,3 +1,7 @@ + # LLM Warmup — rsr-template-repo (Developer) ## What is rsr-template-repo? diff --git a/llm-warmup-user.md b/llm-warmup-user.md index 18a327e..a0992be 100644 --- a/llm-warmup-user.md +++ b/llm-warmup-user.md @@ -1,3 +1,7 @@ + # LLM Warmup — rsr-template-repo (User) ## What is rsr-template-repo? diff --git a/session/README.md b/session/README.md index 70d7444..ee83d59 100644 --- a/session/README.md +++ b/session/README.md @@ -1,3 +1,7 @@ + # Session Bindings (Thin Local Layer) This directory provides local integration for central session-management standards. diff --git a/src/README.adoc b/src/README.adoc index 5529f66..d8c8116 100644 --- a/src/README.adoc +++ b/src/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = src Pillar diff --git a/src/aspects/README.adoc b/src/aspects/README.adoc index 6456f96..9b7b80f 100644 --- a/src/aspects/README.adoc +++ b/src/aspects/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Aspects Pillar diff --git a/src/aspects/integrity/README.adoc b/src/aspects/integrity/README.adoc index f15d829..17a09db 100644 --- a/src/aspects/integrity/README.adoc +++ b/src/aspects/integrity/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Integrity Aspect diff --git a/src/aspects/observability/README.adoc b/src/aspects/observability/README.adoc index 7852ee6..df2ca36 100644 --- a/src/aspects/observability/README.adoc +++ b/src/aspects/observability/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Observability Aspect diff --git a/src/aspects/security/README.adoc b/src/aspects/security/README.adoc index 3c3536e..11ad21b 100644 --- a/src/aspects/security/README.adoc +++ b/src/aspects/security/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Security Aspect diff --git a/src/contracts/README.adoc b/src/contracts/README.adoc index 9cfa209..20dd4ca 100644 --- a/src/contracts/README.adoc +++ b/src/contracts/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contracts Unit diff --git a/src/definitions/README.adoc b/src/definitions/README.adoc index 9548349..5a9912f 100644 --- a/src/definitions/README.adoc +++ b/src/definitions/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Definitions Unit diff --git a/src/errors/README.adoc b/src/errors/README.adoc index 460fc1e..eff7b29 100644 --- a/src/errors/README.adoc +++ b/src/errors/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Errors Unit diff --git a/src/interface/Abi/Foreign.idr b/src/interface/Abi/Foreign.idr index 3f16342..ca66b08 100644 --- a/src/interface/Abi/Foreign.idr +++ b/src/interface/Abi/Foreign.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell ||| Foreign Function Interface Bridge ||| ||| This module defines the raw FFI calls and their safe wrappers, diff --git a/src/interface/Abi/Layout.idr b/src/interface/Abi/Layout.idr index fec979d..e1f4275 100644 --- a/src/interface/Abi/Layout.idr +++ b/src/interface/Abi/Layout.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell ||| ABI Layout Verification ||| ||| This module provides formal proofs about memory layout, alignment, diff --git a/src/interface/Abi/README.adoc b/src/interface/Abi/README.adoc index 2330304..46743d7 100644 --- a/src/interface/Abi/README.adoc +++ b/src/interface/Abi/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = abi Logic diff --git a/src/interface/Abi/Types.idr b/src/interface/Abi/Types.idr index 6fc4d04..9d30051 100644 --- a/src/interface/Abi/Types.idr +++ b/src/interface/Abi/Types.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell ||| ABI Type Definitions Template ||| ||| This module defines the Application Binary Interface (ABI) for this library. diff --git a/src/interface/README.adoc b/src/interface/README.adoc index 8faf0aa..727b9e7 100644 --- a/src/interface/README.adoc +++ b/src/interface/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = interface Unit diff --git a/src/interface/ffi/README.adoc b/src/interface/ffi/README.adoc index 8fe57d3..b402d64 100644 --- a/src/interface/ffi/README.adoc +++ b/src/interface/ffi/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = ffi Logic diff --git a/src/interface/ffi/build.zig b/src/interface/ffi/build.zig index 69a6377..2607c11 100644 --- a/src/interface/ffi/build.zig +++ b/src/interface/ffi/build.zig @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell // // Template FFI Build Configuration (Zig 0.15.2+) // Note: This is a minimal build file that demonstrates Zig integration diff --git a/src/interface/ffi/src/README.adoc b/src/interface/ffi/src/README.adoc index a5c0c6d..4228438 100644 --- a/src/interface/ffi/src/README.adoc +++ b/src/interface/ffi/src/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Src Logic diff --git a/src/interface/ffi/src/main.zig b/src/interface/ffi/src/main.zig index ec07c50..65ddecb 100644 --- a/src/interface/ffi/src/main.zig +++ b/src/interface/ffi/src/main.zig @@ -1,9 +1,10 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // Proof Burrower FFI Implementation // // This module implements the C-compatible FFI declared in src/abi/Foreign.idr // All types and layouts must match the Idris2 ABI definitions. // -// SPDX-License-Identifier: MPL-2.0 const std = @import("std"); diff --git a/src/interface/ffi/test/README.adoc b/src/interface/ffi/test/README.adoc index f6f38bf..cdbb47d 100644 --- a/src/interface/ffi/test/README.adoc +++ b/src/interface/ffi/test/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Test Logic diff --git a/src/interface/ffi/test/integration_test.zig b/src/interface/ffi/test/integration_test.zig index 361bd05..484e156 100644 --- a/src/interface/ffi/test/integration_test.zig +++ b/src/interface/ffi/test/integration_test.zig @@ -1,6 +1,6 @@ -// RSR Template FFI Integration Tests // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell +// RSR Template FFI Integration Tests // // These tests verify that the Zig FFI correctly implements the Idris2 ABI. // This is a TEMPLATE FILE — when instantiating a new project: diff --git a/src/interface/generated/README.adoc b/src/interface/generated/README.adoc index 3691b06..93daef2 100644 --- a/src/interface/generated/README.adoc +++ b/src/interface/generated/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = generated Logic diff --git a/src/interface/generated/abi/README.adoc b/src/interface/generated/abi/README.adoc index aff61a9..0e29b69 100644 --- a/src/interface/generated/abi/README.adoc +++ b/src/interface/generated/abi/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Abi Logic diff --git a/tests/fuzz/README.adoc b/tests/fuzz/README.adoc index 55b92f3..44ae058 100644 --- a/tests/fuzz/README.adoc +++ b/tests/fuzz/README.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell = Fuzz Testing :toc: diff --git a/tools/invariant-path/README.adoc b/tools/invariant-path/README.adoc index 009d702..57c4e3d 100644 --- a/tools/invariant-path/README.adoc +++ b/tools/invariant-path/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Invariant Path Integration (RSR Template) Run Invariant Path from this repository root: diff --git a/verification/README.adoc b/verification/README.adoc index f07e7f3..efa7fb2 100644 --- a/verification/README.adoc +++ b/verification/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Verification Pillar diff --git a/verification/benchmarks/README.adoc b/verification/benchmarks/README.adoc index 5db7648..beb83cd 100644 --- a/verification/benchmarks/README.adoc +++ b/verification/benchmarks/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Benchmarks Unit diff --git a/verification/coverage/README.adoc b/verification/coverage/README.adoc index 2566956..c10a6ac 100644 --- a/verification/coverage/README.adoc +++ b/verification/coverage/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Coverage Unit diff --git a/verification/fuzzing/README.adoc b/verification/fuzzing/README.adoc index edeb179..b07ea68 100644 --- a/verification/fuzzing/README.adoc +++ b/verification/fuzzing/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Fuzzing Unit diff --git a/verification/proofs/README.adoc b/verification/proofs/README.adoc index 29cf7e8..520f5e9 100644 --- a/verification/proofs/README.adoc +++ b/verification/proofs/README.adoc @@ -1,5 +1,6 @@ -= Formal Verification Proofs // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell += Formal Verification Proofs This directory contains formal proofs organised by proof assistant. diff --git a/verification/proofs/idris2/ABI/Compliance.idr b/verification/proofs/idris2/ABI/Compliance.idr index d38c0d5..b94a5db 100644 --- a/verification/proofs/idris2/ABI/Compliance.idr +++ b/verification/proofs/idris2/ABI/Compliance.idr @@ -1,5 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +-- Copyright (c) Jonathan D.A. Jewell -- -- ABI Proof: C ABI compliance -- Proves that struct layouts are C ABI compliant. diff --git a/verification/proofs/idris2/ABI/Foreign.idr b/verification/proofs/idris2/ABI/Foreign.idr index cb98ecd..1e550dd 100644 --- a/verification/proofs/idris2/ABI/Foreign.idr +++ b/verification/proofs/idris2/ABI/Foreign.idr @@ -1,5 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +-- Copyright (c) Jonathan D.A. Jewell -- -- ABI Proof: FFI function return type proofs -- Proves that all FFI functions return expected types. diff --git a/verification/proofs/idris2/ABI/Layout.idr b/verification/proofs/idris2/ABI/Layout.idr index f38fcca..9040a5e 100644 --- a/verification/proofs/idris2/ABI/Layout.idr +++ b/verification/proofs/idris2/ABI/Layout.idr @@ -1,5 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +-- Copyright (c) Jonathan D.A. Jewell -- -- ABI Proof: Memory layout correctness -- Proves struct size, alignment, and padding properties. diff --git a/verification/proofs/idris2/ABI/Platform.idr b/verification/proofs/idris2/ABI/Platform.idr index 6b80d20..a8d6b94 100644 --- a/verification/proofs/idris2/ABI/Platform.idr +++ b/verification/proofs/idris2/ABI/Platform.idr @@ -1,5 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +-- Copyright (c) Jonathan D.A. Jewell -- -- ABI Proof: Platform-specific type size proofs -- Proves that C type sizes are correct per platform. diff --git a/verification/proofs/idris2/ABI/Pointers.idr b/verification/proofs/idris2/ABI/Pointers.idr index 49efd2f..31b6c5f 100644 --- a/verification/proofs/idris2/ABI/Pointers.idr +++ b/verification/proofs/idris2/ABI/Pointers.idr @@ -1,5 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +-- Copyright (c) Jonathan D.A. Jewell -- -- ABI Proof: Non-null pointer safety -- Template proof — customise for your project's pointer types. diff --git a/verification/proofs/idris2/Types.idr b/verification/proofs/idris2/Types.idr index 85ea9b7..cc7cce8 100644 --- a/verification/proofs/idris2/Types.idr +++ b/verification/proofs/idris2/Types.idr @@ -1,5 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +-- Copyright (c) Jonathan D.A. Jewell -- -- Typing Proof: Core data type well-formedness -- Template — replace with your project's core types. diff --git a/verification/safety_case/README.adoc b/verification/safety_case/README.adoc index 47c8e36..ffb53bd 100644 --- a/verification/safety_case/README.adoc +++ b/verification/safety_case/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Safety case Unit diff --git a/verification/simulations/README.adoc b/verification/simulations/README.adoc index 8e1b13a..42e184c 100644 --- a/verification/simulations/README.adoc +++ b/verification/simulations/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Simulations Unit diff --git a/verification/tests/README.adoc b/verification/tests/README.adoc index 344bf86..3930981 100644 --- a/verification/tests/README.adoc +++ b/verification/tests/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Tests Unit diff --git a/verification/traceability/README.adoc b/verification/traceability/README.adoc index ff23dd7..e6e54bc 100644 --- a/verification/traceability/README.adoc +++ b/verification/traceability/README.adoc @@ -1 +1,3 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Traceability Unit From 59e8004800bd82f38d927f9b633bb47ec347c61b Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 4 Jun 2026 18:05:11 +0100 Subject: [PATCH 05/10] chore: flatten self-validating directory structure --- .machine_readable/{svc => }/self-validating/README.adoc | 0 .../{svc => }/self-validating/examples/ci-config.k9.ncl | 0 .../{svc => }/self-validating/examples/project-metadata.k9.ncl | 0 .../{svc => }/self-validating/examples/setup-repo.k9.ncl | 0 .../{svc => }/self-validating/methodology-guard.k9.ncl | 0 .machine_readable/{svc => }/self-validating/template-hunt.k9.ncl | 0 .../{svc => }/self-validating/template-kennel.k9.ncl | 0 .machine_readable/{svc => }/self-validating/template-yard.k9.ncl | 0 8 files changed, 0 insertions(+), 0 deletions(-) rename .machine_readable/{svc => }/self-validating/README.adoc (100%) rename .machine_readable/{svc => }/self-validating/examples/ci-config.k9.ncl (100%) rename .machine_readable/{svc => }/self-validating/examples/project-metadata.k9.ncl (100%) rename .machine_readable/{svc => }/self-validating/examples/setup-repo.k9.ncl (100%) rename .machine_readable/{svc => }/self-validating/methodology-guard.k9.ncl (100%) rename .machine_readable/{svc => }/self-validating/template-hunt.k9.ncl (100%) rename .machine_readable/{svc => }/self-validating/template-kennel.k9.ncl (100%) rename .machine_readable/{svc => }/self-validating/template-yard.k9.ncl (100%) diff --git a/.machine_readable/svc/self-validating/README.adoc b/.machine_readable/self-validating/README.adoc similarity index 100% rename from .machine_readable/svc/self-validating/README.adoc rename to .machine_readable/self-validating/README.adoc diff --git a/.machine_readable/svc/self-validating/examples/ci-config.k9.ncl b/.machine_readable/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/examples/ci-config.k9.ncl rename to .machine_readable/self-validating/examples/ci-config.k9.ncl diff --git a/.machine_readable/svc/self-validating/examples/project-metadata.k9.ncl b/.machine_readable/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/examples/project-metadata.k9.ncl rename to .machine_readable/self-validating/examples/project-metadata.k9.ncl diff --git a/.machine_readable/svc/self-validating/examples/setup-repo.k9.ncl b/.machine_readable/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/examples/setup-repo.k9.ncl rename to .machine_readable/self-validating/examples/setup-repo.k9.ncl diff --git a/.machine_readable/svc/self-validating/methodology-guard.k9.ncl b/.machine_readable/self-validating/methodology-guard.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/methodology-guard.k9.ncl rename to .machine_readable/self-validating/methodology-guard.k9.ncl diff --git a/.machine_readable/svc/self-validating/template-hunt.k9.ncl b/.machine_readable/self-validating/template-hunt.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/template-hunt.k9.ncl rename to .machine_readable/self-validating/template-hunt.k9.ncl diff --git a/.machine_readable/svc/self-validating/template-kennel.k9.ncl b/.machine_readable/self-validating/template-kennel.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/template-kennel.k9.ncl rename to .machine_readable/self-validating/template-kennel.k9.ncl diff --git a/.machine_readable/svc/self-validating/template-yard.k9.ncl b/.machine_readable/self-validating/template-yard.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/template-yard.k9.ncl rename to .machine_readable/self-validating/template-yard.k9.ncl From 2e51b40944a56461787a323a656c0e50ce484adc Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 4 Jun 2026 18:55:54 +0100 Subject: [PATCH 06/10] chore: rename agent_instructions to bot_directives for spec alignment --- .../{agent_instructions => bot_directives}/README.adoc | 2 +- .../{agent_instructions => bot_directives}/coverage.a2ml | 0 .../{agent_instructions => bot_directives}/debt.a2ml | 0 .../methodology.a2ml | 0 .../self-validating/methodology-guard.k9.ncl | 4 ++-- Justfile | 4 ++-- affinescript/.machine_readable/6a2/STATE.a2ml | 8 ++++---- affinescript/.machine_readable/anchors/ANCHOR.a2ml | 8 ++++---- .../{agent_instructions => bot_directives}/README.adoc | 0 .../{agent_instructions => bot_directives}/coverage.a2ml | 0 .../{agent_instructions => bot_directives}/debt.a2ml | 0 .../methodology.a2ml | 0 12 files changed, 13 insertions(+), 13 deletions(-) rename .machine_readable/{agent_instructions => bot_directives}/README.adoc (94%) rename .machine_readable/{agent_instructions => bot_directives}/coverage.a2ml (100%) rename .machine_readable/{agent_instructions => bot_directives}/debt.a2ml (100%) rename .machine_readable/{agent_instructions => bot_directives}/methodology.a2ml (100%) rename affinescript/.machine_readable/{agent_instructions => bot_directives}/README.adoc (100%) rename affinescript/.machine_readable/{agent_instructions => bot_directives}/coverage.a2ml (100%) rename affinescript/.machine_readable/{agent_instructions => bot_directives}/debt.a2ml (100%) rename affinescript/.machine_readable/{agent_instructions => bot_directives}/methodology.a2ml (100%) diff --git a/.machine_readable/agent_instructions/README.adoc b/.machine_readable/bot_directives/README.adoc similarity index 94% rename from .machine_readable/agent_instructions/README.adoc rename to .machine_readable/bot_directives/README.adoc index e5fec01..a5315c7 100644 --- a/.machine_readable/agent_instructions/README.adoc +++ b/.machine_readable/bot_directives/README.adoc @@ -32,7 +32,7 @@ Methodology-aware configuration for AI agents. Read by any AI agent == Relationship to Other Files * `AGENTIC.a2ml` says WHAT agents can do (permissions, gating) -* `agent_instructions/` says HOW agents should work (methodology) +* `bot_directives/` says HOW agents should work (methodology) * `bot_directives/` says what the gitbot-fleet does (fleet-specific) * `CLAUDE.md` says how Claude specifically should work (Claude-specific) diff --git a/.machine_readable/agent_instructions/coverage.a2ml b/.machine_readable/bot_directives/coverage.a2ml similarity index 100% rename from .machine_readable/agent_instructions/coverage.a2ml rename to .machine_readable/bot_directives/coverage.a2ml diff --git a/.machine_readable/agent_instructions/debt.a2ml b/.machine_readable/bot_directives/debt.a2ml similarity index 100% rename from .machine_readable/agent_instructions/debt.a2ml rename to .machine_readable/bot_directives/debt.a2ml diff --git a/.machine_readable/agent_instructions/methodology.a2ml b/.machine_readable/bot_directives/methodology.a2ml similarity index 100% rename from .machine_readable/agent_instructions/methodology.a2ml rename to .machine_readable/bot_directives/methodology.a2ml diff --git a/.machine_readable/self-validating/methodology-guard.k9.ncl b/.machine_readable/self-validating/methodology-guard.k9.ncl index 3de35ed..9e8d062 100644 --- a/.machine_readable/self-validating/methodology-guard.k9.ncl +++ b/.machine_readable/self-validating/methodology-guard.k9.ncl @@ -3,7 +3,7 @@ # # K9 Validator: Methodology Guard # Checks that agent work respects methodology constraints declared in -# agent_instructions/methodology.a2ml. +# bot_directives/methodology.a2ml. # # Usage: k9 validate methodology-guard @@ -50,7 +50,7 @@ let methodology_guard = { coverage_updated = { description = "coverage.a2ml should be updated within 30 days", severity = "info", - file = ".machine_readable/agent_instructions/coverage.a2ml", + file = ".machine_readable/bot_directives/coverage.a2ml", staleness_days = 30, }, }, diff --git a/Justfile b/Justfile index 3011e5d..b8ec01d 100644 --- a/Justfile +++ b/Justfile @@ -499,8 +499,8 @@ self-assess: echo " ready for automated maintenance when the fleet arrives." fi - if [ -d ".machine_readable/agent_instructions" ]; then - echo " ◆ agent_instructions/ — AI agent methodology config." + if [ -d ".machine_readable/bot_directives" ]; then + echo " ◆ bot_directives/ — AI agent methodology config." echo " Guides Claude/Gemini/etc on how to work in this repo." echo " No cost to keep. Improves AI assistance quality." fi diff --git a/affinescript/.machine_readable/6a2/STATE.a2ml b/affinescript/.machine_readable/6a2/STATE.a2ml index 6e4c1b9..18f11df 100644 --- a/affinescript/.machine_readable/6a2/STATE.a2ml +++ b/affinescript/.machine_readable/6a2/STATE.a2ml @@ -202,10 +202,10 @@ added = [ ".machine_readable/contractiles/ (migrated from root via git mv — history preserved)", ".machine_readable/contractiles/adjust/Adjustfile.a2ml", ".machine_readable/contractiles/intend/Intentfile.a2ml", - ".machine_readable/agent_instructions/README.adoc", - ".machine_readable/agent_instructions/coverage.a2ml", - ".machine_readable/agent_instructions/debt.a2ml", - ".machine_readable/agent_instructions/methodology.a2ml", + ".machine_readable/bot_directives/README.adoc", + ".machine_readable/bot_directives/coverage.a2ml", + ".machine_readable/bot_directives/debt.a2ml", + ".machine_readable/bot_directives/methodology.a2ml", ".machine_readable/integrations/verisimdb.a2ml", ".machine_readable/integrations/vexometer.a2ml", ".machine_readable/ADJUST.contractile", diff --git a/affinescript/.machine_readable/anchors/ANCHOR.a2ml b/affinescript/.machine_readable/anchors/ANCHOR.a2ml index 96427e3..c45b6d6 100644 --- a/affinescript/.machine_readable/anchors/ANCHOR.a2ml +++ b/affinescript/.machine_readable/anchors/ANCHOR.a2ml @@ -5,7 +5,7 @@ # the language scope from bot-drift back to user intent. This ANCHOR is # retroactive: the project predates the ANCHOR.a2ml convention, and a full # .machine_readable/ suite upgrade (anchors/, CLADE.a2ml, contractiles/, -# agent_instructions/, integrations/, top-level .contractile files) is deferred +# bot_directives/, integrations/, top-level .contractile files) is deferred # as separate work — see STATE.a2ml [deferred-upgrade]. id: "org.hyperpolymath.affinescript" @@ -109,7 +109,7 @@ realignment-history: Brought .machine_readable/ up to the canonical standards repo shape. Migrated root contractiles/ → .machine_readable/contractiles/ (git mv, history preserved). Added: CLADE.a2ml, contractiles/adjust/Adjustfile.a2ml, - contractiles/intend/Intentfile.a2ml, agent_instructions/ (README + coverage + contractiles/intend/Intentfile.a2ml, bot_directives/ (README + coverage + debt + methodology), integrations/ (verisimdb + vexometer), ADJUST.contractile, INTENT.contractile, MUST.contractile, TRUST.contractile. STATE.a2ml [deferred-upgrade] marked done. @@ -118,7 +118,7 @@ realignment-history: - ".machine_readable/ now matches canonical standards shape" - "root contractiles/ migrated to .machine_readable/contractiles/" - "CLADE.a2ml added (clade=language)" - - "agent_instructions/ + integrations/ added" + - "bot_directives/ + integrations/ added" - "top-level .contractile instance files added" - "ANCHOR notes section updated" @@ -176,4 +176,4 @@ notes: > now matches the canonical standards repo shape. The minimum captured in the first ANCHOR (identity, thesis, authorities, relationships, manhattan-recovery) is preserved; the suite-upgrade adds the contractile instance files, - CLADE.a2ml, agent_instructions/, and integrations/. + CLADE.a2ml, bot_directives/, and integrations/. diff --git a/affinescript/.machine_readable/agent_instructions/README.adoc b/affinescript/.machine_readable/bot_directives/README.adoc similarity index 100% rename from affinescript/.machine_readable/agent_instructions/README.adoc rename to affinescript/.machine_readable/bot_directives/README.adoc diff --git a/affinescript/.machine_readable/agent_instructions/coverage.a2ml b/affinescript/.machine_readable/bot_directives/coverage.a2ml similarity index 100% rename from affinescript/.machine_readable/agent_instructions/coverage.a2ml rename to affinescript/.machine_readable/bot_directives/coverage.a2ml diff --git a/affinescript/.machine_readable/agent_instructions/debt.a2ml b/affinescript/.machine_readable/bot_directives/debt.a2ml similarity index 100% rename from affinescript/.machine_readable/agent_instructions/debt.a2ml rename to affinescript/.machine_readable/bot_directives/debt.a2ml diff --git a/affinescript/.machine_readable/agent_instructions/methodology.a2ml b/affinescript/.machine_readable/bot_directives/methodology.a2ml similarity index 100% rename from affinescript/.machine_readable/agent_instructions/methodology.a2ml rename to affinescript/.machine_readable/bot_directives/methodology.a2ml From 662c618322f909bfbd126d225d3134f0e17a514b Mon Sep 17 00:00:00 2001 From: Mistral Vibe Date: Sun, 7 Jun 2026 09:03:11 +0100 Subject: [PATCH 07/10] docs: Add CODEOWNERS, MAINTAINERS, and GOVERNANCE documents --- GOVERNANCE.adoc | 162 +++++++++++++++++++++++++++++++++++++++++++++++ MAINTAINERS.adoc | 65 +++++++++++++++++++ 2 files changed, 227 insertions(+) create mode 100644 GOVERNANCE.adoc create mode 100644 MAINTAINERS.adoc diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc new file mode 100644 index 0000000..8bbf167 --- /dev/null +++ b/GOVERNANCE.adoc @@ -0,0 +1,162 @@ +// SPDX-License-Identifier: MPL-2.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Governance Model +:toc: preamble + +This document describes the governance model for this repository. + +== Overview + +This repository follows a **Sole Maintainer Governance Model**: + +* Single maintainer (@hyperpolymath) has full authority over the project +* All contributions are welcome and reviewed by the maintainer +* Decisions are made transparently through GitHub issues and discussions +* The project adheres to the hyperpolymath estate policies where applicable + +== Core Principles + +[cols="1,2"] +|=== +| Principle | Description + +| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input + +| **Meritocracy** | Contributions are judged on technical merit, not contributor identity + +| **Transparency** | All significant decisions are documented publicly + +| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary + +| **Open Contribution** | Anyone can contribute via fork and pull request + +|=== + +== Roles and Permissions + +[cols="1,2,2"] +|=== +| Role | Permissions | Assignment + +| **Maintainer** | Write access, merge rights, admin | @hyperpolymath +| **Contributors** | Read access, fork, submit PRs | All GitHub users +| **Users** | Use the software, report issues | All GitHub users + +|=== + +== Decision Making Framework + +=== Routine Decisions + +* Bug fixes +* Documentation improvements +* Minor feature additions +* Dependency updates + +**Process**: Maintainer reviews and merges PRs that meet quality standards. + +=== Significant Changes + +* New major features +* API changes +* Architecture modifications +* Breaking changes + +**Process**: +. Open issue describing the change +. Discuss with community (minimum 72 hours) +. Maintainer makes final decision +. Document rationale in issue/PR + +=== Structural Decisions + +* Repository purpose/renaming +* License changes +* Ownership transfer +* Deprecation/archival + +**Process**: +. Extended discussion (minimum 1 week) +. Maintainer makes final decision +. Document in CHANGELOG and governance docs + +== Contribution Lifecycle + +[cols="1,2"] +|=== +| Stage | Process + +| **Ideation** | Open issue, discuss feasibility + +| **Development** | Fork, implement, test thoroughly + +| **Review** | Submit PR, maintainer reviews within 7 days + +| **Merge** | Maintainer merges or requests changes + +| **Release** | Maintainer publishes according to project conventions + +|=== + +== Conflict Resolution + +In case of disagreements: + +. Discuss in the relevant GitHub issue or PR +. Provide technical justification for positions +. Maintainer mediates and makes final decision +. Decision is documented and can be revisited later + +== Project Policies + +This repository adheres to hyperpolymath estate-wide policies: + +* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc) +* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md +* **Security**: Follows hyperpolymath SECURITY.md +* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions + +== Repository-Specific Conventions + +[cols="1,2"] +|=== +| Convention | Description + +| **Signing** | All commits must be signed (SSH or GPG) + +| **SPDX Headers** | All source files must have SPDX license identifiers + +| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root + +| **Machine Readable** | META.a2ml in .machine_readable/6a2/ + +| **CI/CD** | GitHub Actions workflows in .github/workflows/ + +|=== + +== Governance Evolution + +As the project grows, this governance model may evolve: + +* **Adding Co-Maintainers**: When contribution volume warrants it +* **Forming a Team**: For complex multi-maintainer projects +* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories) + +Changes to this document require the same process as Significant Changes above. + +== See Also + +* link:MAINTAINERS.adoc[Maintainers] +* link:CODE_OF_CONDUCT.md[Code of Conduct] +* link:CONTRIBUTING.adoc[Contributing Guide] +* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy] +* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)] + +== Changelog + +[cols="1,1,1"] +|=== +| Date | Change | By + +| 2026-06-07 | Initial governance model established | @hyperpolymath +|=== diff --git a/MAINTAINERS.adoc b/MAINTAINERS.adoc new file mode 100644 index 0000000..9910dd8 --- /dev/null +++ b/MAINTAINERS.adoc @@ -0,0 +1,65 @@ +// SPDX-License-Identifier: MPL-2.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Maintainers +:toc: preamble + +== Current Maintainers + +[cols="2,3,2",options="header"] +|=== +| Name | Role | Contact + +| Jonathan D.A. Jewell | Sole Maintainer | https://github.com/hyperpolymath[@hyperpolymath] +|=== + +== Maintainer Responsibilities + +As the sole maintainer, all responsibilities apply to @hyperpolymath: + +* Reviewing and merging pull requests +* Triaging issues and feature requests +* Ensuring code quality and security standards +* Managing releases and versioning +* Upholding the project's Code of Conduct +* Maintaining documentation and examples +* Responding to security vulnerabilities + +== Contribution Process + +This is a sole-maintainer project. All contributions are welcome via: + +1. **Issues**: Report bugs, request features, ask questions +2. **Pull Requests**: Submit improvements for review +3. **Discussions**: Engage in community discussions + +All contributions will be reviewed by the maintainer. + +== Decision Making + +* Routine decisions (bug fixes, minor improvements): Made by maintainer +* Significant changes: Discussed in issues before implementation +* Breaking changes: Announced in advance with migration path + +== Becoming a Maintainer + +This project currently has a single maintainer. If you're interested in becoming a co-maintainer: + +1. Demonstrate consistent, high-quality contributions +2. Show understanding of project goals and standards +3. Participate constructively in discussions +4. Express interest to the current maintainer + +Co-maintainers may be added at the discretion of the current maintainer. + +== Contact + +For questions about project governance: + +* Open a GitHub issue in this repository +* Contact: https://github.com/hyperpolymath + +== See Also + +* link:GOVERNANCE.adoc[Governance Model] +* link:CODE_OF_CONDUCT.md[Code of Conduct] +* link:CONTRIBUTING.adoc[Contributing Guide] From 7003ee14d5c3b1c932f4bddad8572126dd1072cb Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 7 Jun 2026 23:31:19 +0100 Subject: [PATCH 08/10] Apply estate standardization: governance docs, contractiles, CI/CD cleanup --- .machine_readable/ADJUST.contractile | 126 -- .machine_readable/INTENT.contractile | 72 - .machine_readable/MUST.contractile | 91 - .machine_readable/TRUST.contractile | 80 - .../contractiles/Adjustfile.a2ml | 72 + .../contractiles/Intentfile.a2ml | 99 + .machine_readable/contractiles/Justfile | 1587 +++++++++++++++++ .machine_readable/contractiles/Mustfile.a2ml | 102 ++ .machine_readable/contractiles/Trustfile.a2ml | 88 + .../contractiles/adjust/Adjustfile.a2ml | 211 --- .../contractiles/adjust/adjust.k9.ncl | 166 -- .../contractiles/adjust/adjust.manifest.a2ml | 47 - .../contractiles/adjust/adjust.ncl | 62 - .../contractiles/bust/Bustfile.a2ml | 28 - .machine_readable/contractiles/bust/bust.ncl | 66 - .../contractiles/dust/Dustfile.a2ml | 44 - .machine_readable/contractiles/dust/dust.ncl | 66 - .../contractiles/intend/Intentfile.a2ml | 123 -- .../contractiles/intend/intend.k9.ncl | 250 --- .../contractiles/intend/intend.manifest.a2ml | 73 - .../contractiles/intend/intend.ncl | 81 - .../contractiles/must/Mustfile.a2ml | 69 - .machine_readable/contractiles/must/must.ncl | 64 - .../contractiles/trust/Trustfile.a2ml | 74 - .../contractiles/trust/trust.ncl | 88 - .../.machine_readable/ADJUST.contractile | 38 - .../.machine_readable/INTENT.contractile | 40 - .../.machine_readable/MUST.contractile | 52 - .../.machine_readable/TRUST.contractile | 38 - .../contractiles/Adjustfile.a2ml | 15 + .../contractiles/Intentfile.a2ml | 19 + .../contractiles/Mustfile.a2ml | 14 + .../contractiles/Trustfile.a2ml | 14 + .../contractiles/trust/Trustfile.hs | 105 -- .../distributions/rattlescript/manifest.scm | 24 + affinescript/manifest.scm | 24 + flake.lock | 61 - flake.nix | 170 -- 38 files changed, 2058 insertions(+), 2385 deletions(-) delete mode 100644 .machine_readable/ADJUST.contractile delete mode 100644 .machine_readable/INTENT.contractile delete mode 100644 .machine_readable/MUST.contractile delete mode 100644 .machine_readable/TRUST.contractile create mode 100644 .machine_readable/contractiles/Adjustfile.a2ml create mode 100644 .machine_readable/contractiles/Intentfile.a2ml create mode 100644 .machine_readable/contractiles/Justfile create mode 100644 .machine_readable/contractiles/Mustfile.a2ml create mode 100644 .machine_readable/contractiles/Trustfile.a2ml delete mode 100644 .machine_readable/contractiles/adjust/Adjustfile.a2ml delete mode 100644 .machine_readable/contractiles/adjust/adjust.k9.ncl delete mode 100644 .machine_readable/contractiles/adjust/adjust.manifest.a2ml delete mode 100644 .machine_readable/contractiles/adjust/adjust.ncl delete mode 100644 .machine_readable/contractiles/bust/Bustfile.a2ml delete mode 100644 .machine_readable/contractiles/bust/bust.ncl delete mode 100644 .machine_readable/contractiles/dust/Dustfile.a2ml delete mode 100644 .machine_readable/contractiles/dust/dust.ncl delete mode 100644 .machine_readable/contractiles/intend/Intentfile.a2ml delete mode 100644 .machine_readable/contractiles/intend/intend.k9.ncl delete mode 100644 .machine_readable/contractiles/intend/intend.manifest.a2ml delete mode 100644 .machine_readable/contractiles/intend/intend.ncl delete mode 100644 .machine_readable/contractiles/must/Mustfile.a2ml delete mode 100644 .machine_readable/contractiles/must/must.ncl delete mode 100644 .machine_readable/contractiles/trust/Trustfile.a2ml delete mode 100644 .machine_readable/contractiles/trust/trust.ncl delete mode 100644 affinescript/.machine_readable/ADJUST.contractile delete mode 100644 affinescript/.machine_readable/INTENT.contractile delete mode 100644 affinescript/.machine_readable/MUST.contractile delete mode 100644 affinescript/.machine_readable/TRUST.contractile create mode 100644 affinescript/.machine_readable/contractiles/Adjustfile.a2ml create mode 100644 affinescript/.machine_readable/contractiles/Intentfile.a2ml create mode 100644 affinescript/.machine_readable/contractiles/Mustfile.a2ml create mode 100644 affinescript/.machine_readable/contractiles/Trustfile.a2ml delete mode 100644 affinescript/.machine_readable/contractiles/trust/Trustfile.hs create mode 100644 affinescript/distributions/rattlescript/manifest.scm create mode 100644 affinescript/manifest.scm delete mode 100644 flake.lock delete mode 100644 flake.nix diff --git a/.machine_readable/ADJUST.contractile b/.machine_readable/ADJUST.contractile deleted file mode 100644 index d9c798f..0000000 --- a/.machine_readable/ADJUST.contractile +++ /dev/null @@ -1,126 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; ADJUST.contractile — Accessibility invariants for rsr-template-repo -; "ADJUST" = Accessibility & Digital Justice for Universal Software & Technology -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST -; This file is machine-readable. LLM/SLM agents MUST NOT violate these invariants. - -; ── Definitions ────────────────────────────────────────────────── -; -; ADJUST (noun/verb) -; The accessibility contractile. Defines how software must adapt to serve -; all users regardless of ability, device, or context. Named for the verb -; "adjust" — to make suitable, to adapt, to accommodate — which is the -; core action of accessible design. -; -; Scope: -; ADJUST governs all user-facing interfaces: GUI, TUI, CLI, web, mobile, -; documentation, error messages, and installation flows. It applies to -; both human users and assistive technologies (screen readers, switch -; devices, braille displays, voice control). -; -; Relationship to other contractiles: -; - MUST: ADJUST invariants are a subset of MUST — violating ADJUST -; is a MUST violation. ADJUST exists separately because accessibility -; rules are numerous enough to warrant their own file, and because -; LLMs frequently forget accessibility unless explicitly reminded. -; - TRUST: ADJUST does not affect trust levels. All trust tiers must -; respect ADJUST invariants equally. -; - DUST: Deprecating a feature does not exempt it from ADJUST until -; it is fully removed. Deprecated UI must remain accessible. -; - INTENT: ADJUST supports the anti-purpose "this software is NOT -; only for able-bodied users with modern hardware." -; -; Standard: WCAG 2.2 Level AA (minimum) -; https://www.w3.org/WAI/WCAG22/quickref/?levels=aaa -; -; Why a separate file: -; Experience shows LLMs and developers alike treat accessibility as an -; afterthought. By placing invariants in a contractile that is loaded -; at session start, we make it structurally impossible to forget. -; -; ── End Definitions ────────────────────────────────────────────── - -(adjust-contractile - (version "1.0.0") - (full-name "Accessibility & Digital Justice for Universal Software & Technology") - (standard "WCAG-2.2-AA") - (repo "rsr-template-repo") - - (invariants - ; ── Visual ── - (adjust "colour-contrast-ratio >= 4.5:1 for normal text") - (adjust "colour-contrast-ratio >= 3:1 for large text (18pt+ or 14pt+ bold)") - (adjust "no information conveyed by colour alone") - (adjust "no flashing or strobing content (3 flashes/second max)") - (adjust "text resizable to 200% without loss of content or function") - (adjust "focus indicators visible on all interactive elements") - - ; ── Keyboard ── - (adjust "all interactive elements reachable via keyboard (Tab/Shift+Tab)") - (adjust "no keyboard traps — user can always Tab away") - (adjust "skip navigation link present on pages with repeated blocks") - (adjust "logical focus order follows visual reading order") - - ; ── Screen reader ── - (adjust "all images have meaningful alt text (or alt='' if decorative)") - (adjust "all form inputs have associated labels") - (adjust "ARIA landmarks used for page regions (main, nav, banner, etc.)") - (adjust "dynamic content updates announced via aria-live regions") - (adjust "semantic HTML used (headings, lists, tables) — not div soup") - - ; ── Interactive ── - (adjust "touch targets minimum 44x44px on mobile/touch interfaces") - (adjust "error messages identify the field and describe the error") - (adjust "error messages not conveyed by colour or position alone") - (adjust "form validation provides suggestions for correction") - - ; ── Media ── - (adjust "video has captions (closed or open)") - (adjust "audio-only content has text transcript") - (adjust "no autoplay of media with sound") - - ; ── Motion ── - (adjust "animations respect prefers-reduced-motion media query") - (adjust "no content depends on motion to convey meaning") - - ; ── CLI/TUI ── - (adjust "CLI output must not rely solely on colour (use symbols: [OK] [FAIL])") - (adjust "TUI must support high-contrast mode") - (adjust "all CLI commands support --help with plain-text output") - (adjust "error messages written in plain language, not jargon or codes alone") - - ; ── Documentation ── - (adjust "docs use clear language, short sentences, logical structure") - (adjust "code examples include comments explaining non-obvious steps") - (adjust "diagrams have text descriptions or alt text") - - ; ── Internationalisation (i18n) ── - (adjust "all user-facing strings externalisable for translation") - (adjust "no hardcoded English in error messages — use message keys") - (adjust "date/time/number formats locale-aware") - (adjust "RTL (right-to-left) layout support where applicable") - (adjust "Unicode handled correctly throughout (UTF-8 everywhere)") - ) - - (related-resources - ; LOL — super-parallel corpus crawler for 1500+ languages - ; Use for linguistic data, translation coverage, and i18n validation - (lol "standards/lol — multilingual NLP corpus, see README.adoc") - (polyglot-i18n "polyglot-i18n — i18n framework and WASM translation engine") - ) - - (enforcement - (ci "accessibility linting in quality.yml workflow") - (pr-block "PR blocked if accessibility regression detected") - (tool "axe-core or pa11y for automated checks on web UI") - (tool "CLI output inspected for colour-only signalling") - (manual "manual screen reader test before major releases") - ) - - (notes - "These are MINIMUM requirements. Exceeding them (AAA) is encouraged." - "When in doubt about an accessibility decision, ask — don't guess." - "Accessibility is not optional polish — it is a structural requirement." - ) -) diff --git a/.machine_readable/INTENT.contractile b/.machine_readable/INTENT.contractile deleted file mode 100644 index eb0a18e..0000000 --- a/.machine_readable/INTENT.contractile +++ /dev/null @@ -1,72 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; INTENT.contractile — Purpose and scope for rsr-template-repo -; Helps LLM/SLM agents understand what this repo IS and IS NOT. -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST - -; ── Definitions ────────────────────────────────────────────────── -; -; INTENT (noun) -; The purpose contractile. Defines what this repository IS, what it is -; NOT (anti-purpose), and which architectural decisions are load-bearing. -; Without INTENT, LLMs drift into scope creep, reverse key decisions, -; or add features that belong in a different repo. -; -; Scope: -; INTENT governs the conceptual boundaries of the project — its reason -; for existing, its domain, and its relationship to the ecosystem. -; It does NOT specify implementation details (that's MUST and code). -; -; Relationship to other contractiles: -; - MUST: INTENT explains WHY certain MUSTs exist. If you don't -; understand a MUST, read INTENT first. -; - TRUST: The "ask-before-touching" section in INTENT maps directly -; to TRUST.trust-deny for the most sensitive areas. -; - ADJUST: INTENT's anti-purpose should include "this software is -; NOT only for users with perfect vision/hearing/mobility." -; - DUST: When INTENT changes (repo pivots), related DUST entries -; should be created for the abandoned direction. -; -; ── End Definitions ────────────────────────────────────────────── - -(intent-contractile - (version "1.0.0") - (repo "rsr-template-repo") - - ; === Purpose (what this repo IS) === - (purpose - "Proof Burrower locates the mathematical home of a proof goal by searching across formal-mathematics libraries. Given a goal, it returns ranked candidate neighbourhoods of existing lemmas, suggested lemma names, and the minimum premise set. Burrower complements ECHIDNA: ECHIDNA dispatches finished proofs; Burrower finds where the goal belongs before any proof search." - ) - - ; === Anti-Purpose (what this repo is NOT — prevents scope creep) === - (anti-purpose - "Burrower is not a theorem prover. It does not attempt to close goals — it locates them. It is not a tactic suggester (that is ECHIDNA). It is not a generic code-search engine — it operates on parsed proof goals and structured library indices." - ; Examples: - ; "This is NOT a general-purpose database — it solves one specific problem." - ; "This is NOT a framework — it is a library with a focused API." - ; "This does NOT handle authentication — that is delegated to [other repo]." - ) - - ; === Key Architectural Decisions That Must Not Be Reversed === - (architectural-invariants - ; *REMINDER: List the foundational decisions* - ; ("Idris2 for ABI definitions — dependent types prove interface correctness") - ; ("Zig for FFI — zero-cost C ABI compatibility") - ; ("Elixir for supervision — OTP fault tolerance") - ) - - ; === Sensitive Areas (if in doubt, ask) === - (ask-before-touching - ; *REMINDER: List areas where LLMs should check before modifying* - ; "src/abi/ — formal proofs, changes require re-verification" - ; "ffi/zig/ — C ABI boundary, changes affect all language bindings" - ; ".machine_readable/ — checkpoint files, format is specified" - ) - - ; === Ecosystem Position === - (ecosystem - (belongs-to "standalone") - (depends-on ("{{DEP1}}" "{{DEP2}}")) - (depended-on-by ("{{CONSUMER1}}" "{{CONSUMER2}}")) - ) -) diff --git a/.machine_readable/MUST.contractile b/.machine_readable/MUST.contractile deleted file mode 100644 index 1160f0a..0000000 --- a/.machine_readable/MUST.contractile +++ /dev/null @@ -1,91 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; MUST.contractile — Baseline invariants for rsr-template-repo -; These constraints MUST NOT be violated. K9 validators enforce them. -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST - -; ── Definitions ────────────────────────────────────────────────── -; -; MUST (noun/verb) -; The hard-constraint contractile. Defines invariants that are structurally -; required for the repository to function correctly and safely. Violating -; a MUST is always a bug — there are no "soft" MUSTs. -; -; Scope: -; MUST governs code, configuration, CI, and structure. It does NOT govern -; style, preference, or approach — those belong in CLAUDE.md or coding -; standards. MUST is for things that break the project if violated. -; -; Relationship to other contractiles: -; - TRUST: MUST is enforced regardless of trust level. Even maximal-trust -; agents cannot violate MUST constraints. -; - ADJUST: All ADJUST invariants are implicitly MUST invariants too. -; ADJUST exists separately for visibility. -; - INTENT: MUST protects the architectural decisions described in INTENT. -; - DUST: When a feature enters DUST (deprecation), its MUST constraints -; remain active until the feature is fully removed. -; -; Enforcement: -; K9 validators in contractiles/k9/ machine-check MUST constraints. -; CI runs these on every PR. Violations block merge. -; -; ── End Definitions ────────────────────────────────────────────── - -(must-contractile - (version "1.0.0") - (repo "rsr-template-repo") - - ; === Universal Invariants (apply to ALL repos) === - - (invariants - ; Paths - (must "no hardcoded absolute paths (/home/*, /mnt/*, /var/mnt/*)") - (must "all paths use env vars, XDG dirs, or relative references") - - ; Language policy - (must "no new TypeScript files") - (must "no new Python files") - (must "no new Go files") - (must "no npm/bun/yarn/pnpm dependencies — Deno only") - - ; Dangerous patterns - (must "no believe_me (Idris2)") - (must "no assert_total (Idris2)") - (must "no Admitted (Coq)") - (must "no sorry (Lean)") - (must "no unsafeCoerce (Haskell)") - (must "no Obj.magic (OCaml)") - (must "no unsafe {} blocks without safety comment (Rust)") - - ; License - (must "SPDX-License-Identifier header on every source file") - (must "no removal or modification of LICENSE file") - - ; Structure - (must ".machine_readable/ directory preserved") - (must "0-AI-MANIFEST.a2ml preserved") - (must "no SCM files in repo root — only in .machine_readable/") - - ; CI - (must "no removal of CI workflows without explicit approval") - (must "all GitHub Actions SHA-pinned") - - ; Code quality - (must "tests must not be deleted or weakened") - (must "generated code in generated/ directory only") - (must "no introduction of OWASP top 10 vulnerabilities") - - ; ABI/FFI (if applicable) - (must "no modification of ABI contracts without proof update") - (must "no removal of formal verification proofs") - ) - - ; === Project-Specific Invariants === - ; *REMINDER: Add invariants specific to this repo* - ; (must "# Add project-specific invariants here") - - (enforcement - (k9-validator "contractiles/k9/must-check.k9.ncl") - (ci "quality.yml runs must-check on every PR") - ) -) diff --git a/.machine_readable/TRUST.contractile b/.machine_readable/TRUST.contractile deleted file mode 100644 index 52fd1f0..0000000 --- a/.machine_readable/TRUST.contractile +++ /dev/null @@ -1,80 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; TRUST.contractile — Trust boundaries for rsr-template-repo -; Defines what LLM/SLM agents are trusted to do without asking. -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST - -; ── Definitions ────────────────────────────────────────────────── -; -; TRUST (noun/verb) -; The permission contractile. Defines the boundary between what an AI -; agent may do autonomously and what requires human approval. Trust is -; graduated — not binary — with four levels from minimal to maximal. -; -; Trust levels: -; - maximal: Agent may read, build, test, lint, format, heal freely. -; Only destructive/external actions require approval. -; - standard: Agent may read and build. Test/lint need approval. -; - restricted: Agent may read only. All modifications need approval. -; - minimal: Agent may read specific files only. Everything else blocked. -; -; Scope: -; TRUST governs AI agent behaviour only. It does not affect human -; contributors — humans follow CONTRIBUTING.md and GOVERNANCE.adoc. -; -; Relationship to other contractiles: -; - MUST: Trust never overrides MUST. Even at maximal trust, MUST -; violations are blocked. -; - ADJUST: Trust does not exempt from ADJUST. All trust tiers must -; produce accessible output. -; - INTENT: TRUST.trust-deny protects the sensitive areas listed in -; INTENT.ask-before-touching. -; - DUST: Deprecated features have the same trust rules as active ones. -; -; ── End Definitions ────────────────────────────────────────────── - -(trust-contractile - (version "1.0.0") - (repo "rsr-template-repo") - - (trust-level "maximal") ; maximal | standard | restricted | minimal - - ; === Maximal Trust (default) === - ; LLM may freely do these without asking: - (trust-actions - "read" ; Read any file in the repo - "build" ; Run build commands - "test" ; Run test suites - "lint" ; Run linters and formatters - "format" ; Auto-format code - "doctor" ; Run self-diagnostics - "heal" ; Attempt automatic repair - "git-status" ; Check git status - "git-diff" ; View diffs - "git-log" ; View history - ) - - ; === Denied Actions (always require human approval) === - (trust-deny - "delete-branch" ; Could lose work - "force-push" ; Overwrites history - "modify-ci-secrets" ; Security sensitive - "publish" ; External visibility - "push-to-main" ; Protected branch - "delete-files-bulk" ; More than 5 files at once - "modify-license" ; Legal implications - "modify-security-policy" ; Security implications - "remove-proofs" ; Formal verification regression - "disable-ci-checks" ; Safety regression - ) - - ; === Trust Boundary === - (trust-boundary "repo") ; LLM confined to this repo unless explicitly told otherwise - - ; === Override === - ; Repos requiring tighter trust override these settings with justification: - ; (override - ; (trust-level "restricted") - ; (reason "Contains production secrets / handles PII / etc.") - ; ) -) diff --git a/.machine_readable/contractiles/Adjustfile.a2ml b/.machine_readable/contractiles/Adjustfile.a2ml new file mode 100644 index 0000000..6f01e89 --- /dev/null +++ b/.machine_readable/contractiles/Adjustfile.a2ml @@ -0,0 +1,72 @@ +# SPDX-License-Identifier: MPL-2.0 +# Adjustfile — Drift-tolerance contract for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Cumulative-drift catchment: tolerance bands + corrective actions. +# Authority: advisory (Yard) — continue-with-warnings; auto_fix where deterministic. +# Run with: adjust check +# Fix with: adjust fix (applies deterministic patches; advisory otherwise) + +@abstract: +Drift tolerances and corrective actions for rsr-template-repo. Unlike +MUST (hard gate), ADJUST tracks cumulative drift against tolerance bands +and proposes corrective actions. Advisory — it warns and trends, it does +not block. +@end + +## Template Drift + +### placeholder-drift +- description: Template placeholders should be replaced when copied +- tolerance: 0 placeholder markers in copied repos +- corrective: Search and replace all {{PLACEHOLDER}} markers +- severity: advisory +- notes: This check only applies to repos that copied from this template + +### template-version-drift +- description: Template version should match RSR spec version +- tolerance: Template version matches current RSR spec +- corrective: Update template to match latest RSR spec +- severity: advisory + +## Documentation Drift + +### readme-completeness +- description: README should document all template features +- tolerance: README covers all contractiles and directory structure +- corrective: Update README.adoc with missing sections +- severity: advisory + +### example-accuracy +- description: Examples in documentation should match actual template content +- tolerance: All code examples in docs are accurate +- corrective: Audit and fix examples in documentation +- severity: advisory + +## Structural Drift + +### contractile-sync +- description: All contractiles should have matching a2ml and ncl implementations +- tolerance: Every .a2ml has a corresponding .ncl +- corrective: Generate missing .ncl files from .a2ml +- severity: advisory + +### no-broken-symlinks +- description: No broken symbolic links in template structure +- tolerance: 0 broken symlinks +- corrective: Run symlink-check script +- severity: advisory + +## Accessibility Drift + +### adoc-not-md +- description: Template docs should prefer AsciiDoc +- tolerance: New prose docs are *.adoc +- corrective: Convert any new *.md to *.adoc +- severity: advisory + +### spdx-header-consistency +- description: All template files have correct SPDX headers +- tolerance: 0 files missing SPDX-License-Identifier +- corrective: Add SPDX headers to files that need them +- severity: advisory diff --git a/.machine_readable/contractiles/Intentfile.a2ml b/.machine_readable/contractiles/Intentfile.a2ml new file mode 100644 index 0000000..ef74f45 --- /dev/null +++ b/.machine_readable/contractiles/Intentfile.a2ml @@ -0,0 +1,99 @@ +# SPDX-License-Identifier: MPL-2.0 +# Intentfile (A2ML Canonical) — north-star contractile for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Paired runner: intend.ncl +# Verb: intend +# +# Semantics: North-star contractile. Declares BOTH concrete committed +# next-actions AND horizon aspirations the project wishes to +# become. Two sections share one file because they answer +# the same question at different ranges: +# [[intents]] — "we WILL do this; track progress" +# status: declared → in_progress → done | +# deferred | retired +# [[wishes]] — "we WISH this were true; revisit later" +# status: declared → in_progress → achieved | +# abandoned +# grouped by horizon: near / mid / far. +# Non-gating — this is a report, not a gate. See the `must` +# contractile for hard gates. + +@abstract: +North-star contractile for rsr-template-repo. This repository is the +canonical template for Rhodium Standard Repository compliance. It provides +the scaffold that all hyperpolymath repos should copy and customize. +@end + +## Purpose + +The rsr-template-repo serves as the master template for all hyperpolymath +repositories. It contains the complete set of contractile files, machine-readable +specifications, and governance documentation that define the Rhodium Standard. + +Every new repository in the hyperpolymath estate should be initialized by +copying this template and substituting the placeholder values with +repo-specific content. + +## Anti-Purpose + +This repository is NOT: +- A general-purpose project scaffold for external use (hyperpolymath-only) +- A replacement for per-repo customization (all files must be bespoke) +- A static template that never changes (evolves with RSR spec) +- A runtime library or framework (build-time only) + +## If In Doubt + +If you are unsure whether a change is in scope, ask. Sensitive areas: +- .machine_readable/ contractile definitions +- RSR specification files +- Governance templates +- License policy documents + +## Committed Next-Actions + +### repo-initialization +- description: Provide just copy-and-substitute template for new repos +- probe: test -f scripts/init-repo.sh +- status: done +- notes: Run with source scripts/init-repo.sh + +### contractile-completeness +- description: Every RSR contractile has an a2ml and ncl implementation +- probe: ls .machine_readable/contractiles/*.a2ml | wc -l | grep -q "^6$" +- status: in_progress +- notes: Currently 6 contractile verbs: intend, must, trust, adjust, bust, dust + +### automation-scripts +- description: All repetitive tasks have just recipes +- probe: grep -c "^# " Justfile | grep -q "^[6-9][0-9]*$" +- status: in_progress + +## Wishes + +### Near Horizon + +#### cross-repo-validation +- description: Tooling to validate all repos against RSR spec +- horizon: near +- status: declared + +#### automated-substitution +- description: Script to automate repo-specific substitution in template +- horizon: near +- status: declared + +### Mid Horizon + +#### formal-verification +- description: Idris2 proofs for all critical contractile invariants +- horizon: mid +- status: declared + +### Far Horizon + +#### ecosystem-visualization +- description: Interactive graph of all hyperpolymath repos and dependencies +- horizon: far +- status: declared diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile new file mode 100644 index 0000000..b8ec01d --- /dev/null +++ b/.machine_readable/contractiles/Justfile @@ -0,0 +1,1587 @@ +# SPDX-License-Identifier: MPL-2.0 +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +# +# RSR Standard Justfile Template +# https://just.systems/man/en/ +# +# Copy this file to new projects and customize the placeholder values. +# +# Run `just` to see all available recipes +# Run `just cookbook` to generate docs/just-cookbook.adoc +# Run `just combinations` to see matrix recipe options + +set shell := ["bash", "-uc"] +set dotenv-load := true +set positional-arguments := true + +# Import auto-generated contractile recipes (must-check, trust-verify, etc.) +# Re-generate with: contractile gen-just +import? "contractile.just" + +# Project metadata — customize these +project := "rsr-template-repo" +OWNER := "hyperpolymath" +REPO := "rsr-template-repo" +version := "0.1.0" +tier := "infrastructure" # 1 | 2 | infrastructure + +# ═══════════════════════════════════════════════════════════════════════════════ +# DEFAULT & HELP +# ═══════════════════════════════════════════════════════════════════════════════ + +# Show all available recipes with descriptions +default: + @just --list --unsorted + +# Show detailed help for a specific recipe +help recipe="": + #!/usr/bin/env bash + if [ -z "{{recipe}}" ]; then + just --list --unsorted + echo "" + echo "Usage: just help " + echo " just cookbook # Generate full documentation" + echo " just combinations # Show matrix recipes" + else + just --show "{{recipe}}" 2>/dev/null || echo "Recipe '{{recipe}}' not found" + fi + +# Show this project's info +info: + @echo "Project: {{project}}" + @echo "Version: {{version}}" + @echo "RSR Tier: {{tier}}" + @echo "Recipes: $(just --summary | wc -w)" + @[ -f ".machine_readable/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true + +# Run Invariant Path overlay tools for this repository +invariant-path *ARGS: + ./scripts/invariant-path.sh {{ARGS}} + +# ═══════════════════════════════════════════════════════════════════════════════ +# INIT — Bootstrap a new project from this template +# ═══════════════════════════════════════════════════════════════════════════════ + +# Interactive project bootstrap — replaces all {{PLACEHOLDER}} tokens +init: + #!/usr/bin/env bash + set -euo pipefail + + echo "═══════════════════════════════════════════════════" + echo " RSR Project Bootstrap" + echo "═══════════════════════════════════════════════════" + echo "" + + # --- Load defaults from config (if exists) --- + # Create yours: ~/.config/rsr/defaults + # Format: OWNER=myorg AUTHOR="My Name" AUTHOR_EMAIL=me@example.org ... + DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" + if [ -f "$DEFAULTS" ]; then + echo "Loading defaults from $DEFAULTS" + # shellcheck source=/dev/null + source "$DEFAULTS" + echo "" + fi + + # --- Required values (pre-filled from defaults if available) --- + read -rp "Project name (human-readable, e.g. My Project): " PROJECT_NAME + [ -z "$PROJECT_NAME" ] && echo "Error: project name required" && exit 1 + + read -rp "Repository slug (e.g. my-project): " REPO + [ -z "$REPO" ] && echo "Error: repo slug required" && exit 1 + + read -rp "Owner [${OWNER:-}]: " _OWNER + OWNER="${_OWNER:-${OWNER:-}}" + [ -z "$OWNER" ] && echo "Error: owner required" && exit 1 + + read -rp "Author full name [${AUTHOR:-}]: " _AUTHOR + AUTHOR="${_AUTHOR:-${AUTHOR:-}}" + [ -z "$AUTHOR" ] && echo "Error: author name required" && exit 1 + + read -rp "Author email [${AUTHOR_EMAIL:-}]: " _AUTHOR_EMAIL + AUTHOR_EMAIL="${_AUTHOR_EMAIL:-${AUTHOR_EMAIL:-}}" + [ -z "$AUTHOR_EMAIL" ] && echo "Error: email required" && exit 1 + + # --- Optional values (pre-filled from defaults if available) --- + read -rp "Author organization [${AUTHOR_ORG:-none}]: " _AUTHOR_ORG + AUTHOR_ORG="${_AUTHOR_ORG:-${AUTHOR_ORG:-}}" + + read -rp "Previous/alt email [${AUTHOR_EMAIL_ALT:-none}]: " _AUTHOR_EMAIL_ALT + AUTHOR_EMAIL_ALT="${_AUTHOR_EMAIL_ALT:-${AUTHOR_EMAIL_ALT:-}}" + + read -rp "Project description []: " PROJECT_DESCRIPTION + + read -rp "Forge domain [${FORGE:-github.com}]: " _FORGE + FORGE="${_FORGE:-${FORGE:-github.com}}" + + read -rp "Security contact email [${SECURITY_EMAIL:-$AUTHOR_EMAIL}]: " _SECURITY_EMAIL + SECURITY_EMAIL="${_SECURITY_EMAIL:-${SECURITY_EMAIL:-$AUTHOR_EMAIL}}" + + read -rp "Conduct contact email [${CONDUCT_EMAIL:-$AUTHOR_EMAIL}]: " _CONDUCT_EMAIL + CONDUCT_EMAIL="${_CONDUCT_EMAIL:-${CONDUCT_EMAIL:-$AUTHOR_EMAIL}}" + + read -rp "Project type (library|binary|monorepo|service|website) [library]: " PROJECT_TYPE + PROJECT_TYPE="${PROJECT_TYPE:-library}" + + read -rp "Website URL [https://${FORGE}/${OWNER}/${REPO}]: " WEBSITE + WEBSITE="${WEBSITE:-https://${FORGE}/${OWNER}/${REPO}}" + + # --- Container values (optional — only relevant if container/ exists) --- + if [ -d "container" ]; then + echo "" + echo "── Container configuration (optional) ─────────" + read -rp "Service name [${REPO}]: " _SERVICE_NAME + SERVICE_NAME="${_SERVICE_NAME:-${REPO}}" + read -rp "Primary port [8080]: " _PORT + PORT="${_PORT:-8080}" + read -rp "Container registry [ghcr.io/${OWNER}]: " _REGISTRY + REGISTRY="${_REGISTRY:-ghcr.io/${OWNER}}" + else + SERVICE_NAME="${REPO}" + PORT="8080" + REGISTRY="ghcr.io/${OWNER}" + fi + + # --- Derived values --- + PROJECT_UPPER=$(echo "$REPO" | tr '[:lower:]-' '[:upper:]_') + PROJECT_LOWER=$(echo "$REPO" | tr '[:upper:]-' '[:lower:]_') + CURRENT_YEAR=$(date +%Y) + CURRENT_DATE=$(date +%Y-%m-%d) + VERSION="0.1.0" + + # Derive citation name parts (best-effort split on last space) + AUTHOR_LAST="${AUTHOR##* }" + AUTHOR_FIRST="${AUTHOR% *}" + FIRST_INITIAL="${AUTHOR_FIRST:0:1}." + if [ "$AUTHOR_LAST" = "$AUTHOR_FIRST" ]; then + AUTHOR_FIRST="$AUTHOR" + AUTHOR_LAST="" + FIRST_INITIAL="" + fi + + echo "" + echo "── Summary ──────────────────────────────────────" + echo " Project: $PROJECT_NAME" + echo " Repo: $REPO" + echo " Owner: $OWNER" + echo " Author: $AUTHOR <$AUTHOR_EMAIL>" + [ -n "$AUTHOR_ORG" ] && echo " Organization: $AUTHOR_ORG" + echo " Forge: $FORGE" + echo " Year: $CURRENT_YEAR" + echo "────────────────────────────────────────────────" + echo "" + read -rp "Proceed? [Y/n] " CONFIRM + [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 + + echo "" + echo "Replacing placeholders..." + + # Brace tokens as variables (hex avoids just interpolation) + LB=$(printf '\x7b\x7b') + RB=$(printf '\x7d\x7d') + + # Build the sed expression list + # Note: using | as delimiter since URLs contain / + SED_ARGS=( + -e "s|${LB}PROJECT_NAME${RB}|${PROJECT_NAME}|g" + -e "s|${LB}PROJECT_DESCRIPTION${RB}|${PROJECT_DESCRIPTION}|g" + -e "s|${LB}PROJECT${RB}|${PROJECT_UPPER}|g" + -e "s|${LB}project${RB}|${PROJECT_LOWER}|g" + -e "s|${LB}REPO${RB}|${REPO}|g" + -e "s|${LB}OWNER${RB}|${OWNER}|g" + -e "s|${LB}AUTHOR${RB}|${AUTHOR}|g" + -e "s|${LB}AUTHOR_EMAIL${RB}|${AUTHOR_EMAIL}|g" + -e "s|${LB}AUTHOR_ORG${RB}|${AUTHOR_ORG}|g" + -e "s|${LB}AUTHOR_LAST${RB}|${AUTHOR_LAST}|g" + -e "s|${LB}AUTHOR_FIRST${RB}|${AUTHOR_FIRST}|g" + -e "s|${LB}AUTHOR_INITIALS${RB}|${FIRST_INITIAL}|g" + -e "s|${LB}FORGE${RB}|${FORGE}|g" + -e "s|${LB}CURRENT_YEAR${RB}|${CURRENT_YEAR}|g" + -e "s|${LB}CURRENT_DATE${RB}|${CURRENT_DATE}|g" + -e "s|${LB}DATE${RB}|${CURRENT_DATE}|g" + -e "s|${LB}SECURITY_EMAIL${RB}|${SECURITY_EMAIL}|g" + -e "s|${LB}CONDUCT_EMAIL${RB}|${CONDUCT_EMAIL}|g" + -e "s|${LB}LICENSE${RB}|MPL-2.0|g" + -e "s|${LB}CONDUCT_TEAM${RB}|Code of Conduct Committee|g" + -e "s|${LB}RESPONSE_TIME${RB}|48 hours|g" + -e "s|${LB}MAIN_BRANCH${RB}|main|g" + -e "s|${LB}PROJECT_PURPOSE${RB}|${PROJECT_DESCRIPTION}|g" + -e "s|${LB}PROJECT_ROLE${RB}|${PROJECT_TYPE}|g" + -e "s|${LB}PROJECT_TYPE${RB}|${PROJECT_TYPE}|g" + -e "s|${LB}WEBSITE${RB}|${WEBSITE}|g" + -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" + -e "s|${LB}PORT${RB}|${PORT}|g" + -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" + -e "s|${LB}IMAGE${RB}|${REGISTRY}/${SERVICE_NAME}|g" + -e "s|${LB}VERSION${RB}|${VERSION}|g" + -e "s|${LB}EMAIL${RB}|${AUTHOR_EMAIL}|g" + ) + [ -n "$AUTHOR_EMAIL_ALT" ] && SED_ARGS+=(-e "s|${LB}AUTHOR_EMAIL_ALT${RB}|${AUTHOR_EMAIL_ALT}|g") + + # Replace in all text files (skip .git, LICENSE text, and binaries) + find . -type f \ + -not -path './.git/*' \ + -not -name 'MPL-2.0.txt' \ + -not -name '*.png' -not -name '*.jpg' -not -name '*.gif' \ + -not -name '*.woff' -not -name '*.woff2' \ + | while read -r file; do + if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then + sed -i "${SED_ARGS[@]}" "$file" + fi + done + + # Also replace [YOUR-REPO-NAME] and [YOUR-NAME/ORG] in AI manifest + sed -i "s|\[YOUR-REPO-NAME\]|${PROJECT_NAME}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true + sed -i "s|\[YOUR-NAME/ORG\]|${OWNER}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true + + echo "" + echo "── Validation ───────────────────────────────────" + + # Check for remaining placeholders + PATTERN="${LB}[A-Z_]*${RB}" + REMAINING=$(grep -rl "$PATTERN" . --include='*.md' --include='*.adoc' --include='*.yml' --include='*.yaml' --include='*.a2ml' --include='*.toml' --include='*.scm' --include='*.ncl' --include='*.nix' --include='*.json' --include='*.sh' 2>/dev/null | grep -v '.git/' | grep -v '.machine_readable/ai/PLACEHOLDERS.adoc' || true) + if [ -n "$REMAINING" ]; then + echo "WARNING: Remaining placeholders in:" + echo "$REMAINING" | sed 's/^/ /' + echo "" + echo "Run: grep -rn '$LB' . --include='*.md' to inspect" + else + echo "All placeholders replaced successfully!" + fi + + # K9-SVC validation (if available) + if command -v k9-svc >/dev/null 2>&1; then + echo "" + echo "Running k9-svc validation..." + k9-svc validate . 2>/dev/null || true + fi + + echo "" + echo "Running OpenSSF compliance verification..." + just verify + + echo "" + echo "Done! Next steps:" + echo " 1. Review changes: git diff" + echo " 2. Remove template cruft: rm .machine_readable/ai/PLACEHOLDERS.adoc" + echo " 3. Customize README.adoc for your project" + echo " 4. Commit: git add -A && git commit -m 'feat: initialize from RSR template'" + echo " 5. Push: git remote add origin git@${FORGE}:${OWNER}/${REPO}.git && git push -u origin main" + +# ═══════════════════════════════════════════════════════════════════════════════ +# GROOVE & V-TRIPLE SETUP +# ═══════════════════════════════════════════════════════════════════════════════ + +# Configure Groove protocol manifest (port assignment, API surfaces) +groove-setup: + #!/usr/bin/env bash + set -euo pipefail + MANIFEST=".machine_readable/integrations/groove.a2ml" + if [ ! -f "$MANIFEST" ]; then + echo "Error: $MANIFEST not found. Run 'just init' first." + exit 1 + fi + + echo "═══════════════════════════════════════════════════" + echo " Groove Protocol Setup" + echo "═══════════════════════════════════════════════════" + echo "" + echo "Check PORT-REGISTRY.md before assigning a port:" + echo " https://github.com/hyperpolymath/standards/blob/main/PORT-REGISTRY.md" + echo "" + + read -rp "Primary port for this service: " PORT + [ -z "$PORT" ] && echo "Error: port required" && exit 1 + + echo "" + echo "Which API surfaces does this project expose?" + read -rp " REST API? [Y/n]: " REST + read -rp " gRPC? [y/N]: " GRPC + read -rp " GraphQL? [y/N]: " GRAPHQL + read -rp " WebSocket? [y/N]: " WS + read -rp " SSE (Server-Sent Events)? [y/N]: " SSE + + # Update port in manifest + sed -i "s/(port 0)/(port ${PORT})/" "$MANIFEST" + + # Update API surface flags + [[ "${GRPC,,}" == "y" ]] && sed -i 's/(grpc.*enabled false)/(grpc (enabled true)/' "$MANIFEST" + [[ "${GRAPHQL,,}" == "y" ]] && sed -i 's/(graphql.*enabled false)/(graphql (enabled true)/' "$MANIFEST" + [[ "${WS,,}" == "y" ]] && sed -i 's/(websocket.*enabled false)/(websocket (enabled true)/' "$MANIFEST" + [[ "${SSE,,}" == "y" ]] && sed -i 's/(sse.*enabled false)/(sse (enabled true)/' "$MANIFEST" + + echo "" + echo "Groove manifest updated: $MANIFEST" + echo "Port ${PORT} assigned. Add to PORT-REGISTRY.md if not already there." + +# Check for template placeholders that haven't been replaced +verify-template: + #!/usr/bin/env bash + set -euo pipefail + echo "Checking for unreplaced template placeholders..." + FOUND=0 + + # Check for double-brace placeholder patterns + HITS=$(grep -rn '{{'{{'}}[A-Z_]*{{'}}'}}' --include="*.adoc" --include="*.md" --include="*.a2ml" \ + --include="*.scm" --include="*.toml" --include="*.yml" --include="*.yaml" \ + . 2>/dev/null | grep -v 'node_modules\|\.git/' | grep -v 'PLACEHOLDERS.adoc' || true) + if [ -n "$HITS" ]; then + echo "" + echo "⚠ Unreplaced placeholders found:" + echo "$HITS" | head -20 + FOUND=1 + fi + + # Check for template defaults still present + if grep -q 'rsr-template-repo' Justfile 2>/dev/null; then + echo "⚠ Justfile still references 'rsr-template-repo' — update project name" + FOUND=1 + fi + + # Check for port 0 in Groove manifest + if grep -q '(port 0)' .machine_readable/integrations/groove.a2ml 2>/dev/null; then + echo "⚠ Groove manifest has port 0 — run 'just groove-setup' to assign a port" + FOUND=1 + fi + + # Check for empty SCM files + for f in .machine_readable/6a2/STATE.a2ml .machine_readable/6a2/META.a2ml .machine_readable/6a2/ECOSYSTEM.a2ml; do + if [ -f "$f" ] && grep -q '{{'{{'}}' "$f" 2>/dev/null; then + echo "⚠ $f still has template placeholders" + FOUND=1 + fi + done + + if [ $FOUND -eq 0 ]; then + echo "✓ No template placeholders found — project is properly customised." + else + echo "" + echo "Run 'just init' to replace placeholders, or edit files manually." + exit 1 + fi + +# Analyse this project and advise what to keep, remove, or leave for later. +# Does NOT modify any files — only prints recommendations. +self-assess: + #!/usr/bin/env bash + set -euo pipefail + + echo "═══════════════════════════════════════════════════" + echo " RSR Project Self-Assessment" + echo "═══════════════════════════════════════════════════" + echo "" + echo "Scanning project structure to identify what's" + echo "relevant, removable, or worth keeping for later..." + echo "" + + # Detect project characteristics + HAS_RUST=false; [ -f "Cargo.toml" ] && HAS_RUST=true + HAS_ELIXIR=false; [ -f "mix.exs" ] && HAS_ELIXIR=true + HAS_RESCRIPT=false; [ -f "rescript.json" ] || [ -f "bsconfig.json" ] && HAS_RESCRIPT=true + HAS_IDRIS=false; ls *.ipkg >/dev/null 2>&1 && HAS_IDRIS=true + HAS_ZIG=false; [ -f "build.zig" ] || [ -d "ffi/zig" ] && HAS_ZIG=true + HAS_GLEAM=false; [ -f "gleam.toml" ] && HAS_GLEAM=true + HAS_CONTAINER=false; [ -f "Containerfile" ] || [ -f "container/Containerfile" ] && HAS_CONTAINER=true + HAS_TESTS=false; [ -d "test" ] || [ -d "tests" ] || [ -d "__tests__" ] && HAS_TESTS=true + HAS_API=false; grep -rq 'port\|listen\|endpoint' --include="*.exs" --include="*.rs" --include="*.toml" . 2>/dev/null && HAS_API=true + IS_LIBRARY=false; [ -f "Cargo.toml" ] && grep -q '\[lib\]' Cargo.toml 2>/dev/null && IS_LIBRARY=true + + echo "Detected: Rust=$HAS_RUST Elixir=$HAS_ELIXIR ReScript=$HAS_RESCRIPT" + echo " Idris=$HAS_IDRIS Zig=$HAS_ZIG Gleam=$HAS_GLEAM" + echo " Container=$HAS_CONTAINER Tests=$HAS_TESTS API=$HAS_API" + echo "" + + # ── ESSENTIAL (removing these breaks RSR compliance) ────────── + echo "── ESSENTIAL (removing breaks Rhodium Standard) ──────────" + echo "" + + for f in LICENSE SECURITY.md CODE_OF_CONDUCT.md CONTRIBUTING.md .editorconfig .gitignore; do + if [ -f "$f" ]; then + echo " ✓ $f — KEEP (RSR required)" + else + echo " ✗ $f — MISSING (RSR violation!)" + fi + done + + if [ -d ".machine_readable/6a2" ]; then + echo " ✓ .machine_readable/6a2/ — KEEP (SCM checkpoint files)" + else + echo " ✗ .machine_readable/6a2/ — MISSING (RSR violation!)" + fi + + if [ -d ".github/workflows" ]; then + WF_COUNT=$(ls .github/workflows/*.yml 2>/dev/null | wc -l) + echo " ✓ .github/workflows/ — KEEP ($WF_COUNT workflows, RSR CI/CD)" + fi + echo "" + + # ── RELEVANT (useful for your project type) ─────────────────── + echo "── RELEVANT (matches your project) ───────────────────────" + echo "" + + if $HAS_IDRIS && { [ -d "src/interface/Abi" ] || [ -d "src/interface/abi" ]; }; then + echo " ✓ src/interface/Abi|abi/ — KEEP (Idris2 ABI definitions)" + elif ! $HAS_IDRIS && { [ -d "src/interface/Abi" ] || [ -d "src/interface/abi" ]; }; then + echo " ? src/interface/Abi|abi/ — No Idris2 detected." + echo " → KEEP if you plan to add formal verification later." + echo " → SAFE TO REMOVE if this project will never use Idris2." + echo " ⚠ Consequence: no formally verified interface definitions." + fi + + if $HAS_ZIG && [ -d "src/interface/ffi" ]; then + echo " ✓ src/interface/ffi/ — KEEP (Zig FFI bridge)" + elif ! $HAS_ZIG && [ -d "src/interface/ffi" ]; then + echo " ? src/interface/ffi/ — No Zig detected." + echo " → KEEP if you plan C ABI interop later." + echo " → SAFE TO REMOVE if this is a pure web/scripting project." + echo " ⚠ Consequence: no C-compatible FFI bridge." + fi + + if $HAS_API && [ -f ".machine_readable/integrations/groove.a2ml" ]; then + PORT=$(grep '(port ' .machine_readable/integrations/groove.a2ml 2>/dev/null | sed 's/.*(port \([0-9]*\)).*/\1/') + if [ "$PORT" = "0" ]; then + echo " ⚠ groove.a2ml — Port not assigned. Run 'just groove-setup'." + else + echo " ✓ groove.a2ml — KEEP (Groove discovery on port $PORT)" + fi + elif $HAS_API; then + echo " ✗ groove.a2ml — MISSING. Your project has an API but no Groove manifest." + echo " → Run 'just groove-setup' to enable snap-on/snap-off discovery." + fi + + if $HAS_CONTAINER && [ -d "container" ]; then + echo " ✓ container/ — KEEP (Containerfile + compose)" + elif ! $HAS_CONTAINER && [ -d "container" ]; then + echo " ? container/ — No Containerfile detected in use." + echo " → KEEP if you plan to containerise later." + echo " → SAFE TO REMOVE for libraries and CLI tools." + fi + + echo "" + + # ── SAFE TO REMOVE (not relevant, no consequences) ──────────── + echo "── SAFE TO REMOVE (no RSR consequences) ──────────────────" + echo "" + + if ! $HAS_RESCRIPT && [ -d "examples" ] && ls examples/*.res >/dev/null 2>&1; then + echo " ○ examples/*.res — Template ReScript examples. Not your code." + fi + + if [ -f ".machine_readable/ai/PLACEHOLDERS.adoc" ]; then + echo " ○ .machine_readable/ai/PLACEHOLDERS.adoc — Template doc. Remove after init." + fi + + if [ -f "flake.nix" ] && ! command -v nix >/dev/null 2>&1; then + echo " ○ flake.nix — Nix flake. Safe to remove if you don't use Nix." + echo " → KEEP if others might build with Nix." + fi + + if [ -f "guix.scm" ] && ! command -v guix >/dev/null 2>&1; then + echo " ○ guix.scm — Guix package. Safe to remove if you don't use Guix." + echo " → KEEP if others might build with Guix." + fi + + echo "" + + # ── FUTURE VALUE (not needed now, worth keeping) ────────────── + echo "── KEEP FOR FUTURE (not active, but valuable later) ──────" + echo "" + + if [ -d ".machine_readable/contractiles" ]; then + echo " ◆ contractiles/ — Must/Trust/Dust/Lust contracts." + echo " Not enforced until you configure them, but ready when you need" + echo " automated compliance checking. Zero cost to keep." + fi + + if [ -d ".machine_readable/bot_directives" ]; then + echo " ◆ bot_directives/ — Gitbot fleet configuration." + echo " Not active until gitbot-fleet is connected. Keeps your repo" + echo " ready for automated maintenance when the fleet arrives." + fi + + if [ -d ".machine_readable/bot_directives" ]; then + echo " ◆ bot_directives/ — AI agent methodology config." + echo " Guides Claude/Gemini/etc on how to work in this repo." + echo " No cost to keep. Improves AI assistance quality." + fi + + if [ -d "docs/governance" ]; then + echo " ◆ docs/governance/ — TSDM, CRG, maintenance checklists." + echo " Not needed for solo projects. Essential when you add contributors." + fi + + if [ -d "verification" ]; then + echo " ◆ verification/ — Proofs, benchmarks, fuzzing, safety case." + echo " Empty scaffolds until you add formal verification." + echo " Worth keeping for any project that claims safety properties." + fi + + echo "" + echo "═══════════════════════════════════════════════════" + echo " Assessment complete. No files were modified." + echo "═══════════════════════════════════════════════════" + +# ═══════════════════════════════════════════════════════════════════════════════ +# OPENSSF COMPLIANCE VERIFICATION +# ═══════════════════════════════════════════════════════════════════════════════ + +# Verify OpenSSF Best Practices prerequisites — fails if any required file is missing +verify: + #!/usr/bin/env bash + set -euo pipefail + + echo "=== OpenSSF Best Practices Verification ===" + ERRORS=0 + + check_file() { + if [ ! -f "$1" ]; then + echo " FAIL: $1 missing" + ERRORS=$((ERRORS + 1)) + else + echo " OK: $1" + fi + } + + # Accept either .md or .adoc for documentation files + check_either() { + if [ ! -f "$1" ] && [ ! -f "$2" ]; then + echo " FAIL: $1 (or $2) missing" + ERRORS=$((ERRORS + 1)) + else + local found="$1" + [ -f "$2" ] && found="$2" + [ -f "$1" ] && found="$1" + echo " OK: $found" + fi + } + + check_either "SECURITY.md" "SECURITY.adoc" + check_file "LICENSE" + check_either "CONTRIBUTING.md" "CONTRIBUTING.adoc" + check_either "README.adoc" "README.md" + check_file ".machine_readable/STATE.a2ml" + check_file ".machine_readable/META.a2ml" + check_file ".machine_readable/ECOSYSTEM.a2ml" + check_either "CHANGELOG.md" "CHANGELOG.adoc" + + # Check at least 1 workflow exists + WORKFLOW_COUNT=$(find .github/workflows -name '*.yml' -o -name '*.yaml' 2>/dev/null | wc -l) + if [ "$WORKFLOW_COUNT" -eq 0 ]; then + echo " FAIL: No workflows in .github/workflows/" + ERRORS=$((ERRORS + 1)) + else + echo " OK: .github/workflows/ ($WORKFLOW_COUNT workflows)" + fi + + echo "" + if [ "$ERRORS" -gt 0 ]; then + echo "FAIL: $ERRORS OpenSSF prerequisites missing — repo cannot ship." + exit 1 + fi + echo "PASS: All OpenSSF Best Practices prerequisites satisfied." + +# ═══════════════════════════════════════════════════════════════════════════════ +# BUILD & COMPILE +# ═══════════════════════════════════════════════════════════════════════════════ + +# Build the project (debug mode) +build *args: + @echo "Building {{project}} (debug)..." + # TODO: Replace with your build command + # Examples: + # cargo build {{args}} # Rust + # mix compile {{args}} # Elixir + # zig build {{args}} # Zig + # deno task build {{args}} # Deno/ReScript + @echo "Build complete" + +# Build in release mode with optimizations +build-release *args: + @echo "Building {{project}} (release)..." + # TODO: Replace with your release build command + # Examples: + # cargo build --release {{args}} + # MIX_ENV=prod mix compile {{args}} + # zig build -Doptimize=ReleaseFast {{args}} + @echo "Release build complete" + +# Build and watch for changes (requires entr or similar) +build-watch: + @echo "Watching for changes..." + # TODO: Customize file patterns for your language + # Examples: + # find src -name '*.rs' | entr -c just build + # mix compile --force --warnings-as-errors + # deno task dev + +# Clean build artifacts [reversible: rebuild with `just build`] +clean: + @echo "Cleaning..." + # TODO: Customize for your build system + rm -rf target/ _build/ build/ dist/ out/ obj/ bin/ + +# Deep clean including caches [reversible: rebuild] +clean-all: clean + rm -rf .cache .tmp + +# ═══════════════════════════════════════════════════════════════════════════════ +# TEST & QUALITY +# ═══════════════════════════════════════════════════════════════════════════════ + +# Run all tests +test *args: + @echo "Running tests..." + # TODO: Replace with your test command + # Examples: + # cargo test {{args}} + # mix test {{args}} + # zig build test {{args}} + # deno test {{args}} + @echo "Tests passed!" + +# Run tests with verbose output +test-verbose: + @echo "Running tests (verbose)..." + # TODO: Replace with verbose test command + +# Smoke test +test-smoke: + @echo "Smoke test..." + # TODO: Add basic sanity checks + +# Run end-to-end tests (full pipeline: build → run → verify) +e2e: + @echo "Running E2E tests..." + # TODO: Replace with your E2E test command. Examples: + # bash tests/e2e.sh # Shell-based E2E + # npx playwright test # Browser E2E + # mix test test/integration/e2e_test.exs # Elixir E2E + # cargo test --test end_to_end # Rust E2E + @echo "E2E tests passed!" + +# Run aspect tests (cross-cutting concern validation) +aspect: + @echo "Running aspect tests..." + # TODO: Replace with your aspect test command. Examples: + # bash tests/aspect_tests.sh # Shell-based aspect tests + # cargo test --test aspects # Rust aspect tests + # Aspect tests validate architectural invariants: + # - Thread safety (mutex in FFI modules) + # - ABI/FFI contract (declarations match exports) + # - SPDX compliance (all files have license headers) + # - No dangerous patterns (believe_me, assert_total, etc.) + @echo "Aspect tests passed!" + +# Run benchmarks (performance regression detection) +bench: + @echo "Running benchmarks..." + # TODO: Replace with your benchmark command. Examples: + # cargo bench # Rust criterion + # zig build bench # Zig benchmarks + # mix run bench/benchmarks.exs # Elixir benchee + # deno bench # Deno bench + @echo "Benchmarks complete!" + +# Run readiness tests (Component Readiness Grade: D/C/B) +readiness: + @echo "Running readiness tests..." + # TODO: Replace with your readiness test command. Examples: + # cargo test --test readiness -- --nocapture + @echo "Readiness tests complete!" + +# Print the current CRG grade (reads from READINESS.md '**Current Grade:** X' line) +crg-grade: + @grade=$$(grep -oP '(?<=\*\*Current Grade:\*\* )[A-FX]' READINESS.md 2>/dev/null | head -1); \ + [ -z "$$grade" ] && grade="X"; \ + echo "$$grade" + +# Print a shields.io CRG badge for embedding in README files +# Looks for '**Current Grade:** X' in READINESS.md; falls back to X +crg-badge: + @grade=$$(grep -oP '(?<=\*\*Current Grade:\*\* )[A-FX]' READINESS.md 2>/dev/null | head -1); \ + [ -z "$$grade" ] && grade="X"; \ + case "$$grade" in \ + A) color="brightgreen" ;; \ + B) color="green" ;; \ + C) color="yellow" ;; \ + D) color="orange" ;; \ + E) color="red" ;; \ + F) color="critical" ;; \ + *) color="lightgrey" ;; \ + esac; \ + echo "[![CRG $$grade](https://img.shields.io/badge/CRG-$$grade-$$color?style=flat-square)](https://github.com/hyperpolymath/standards/tree/main/component-readiness-grades)" + +# Run the full merge-requirement test suite (ALL categories) +# Per STANDING rule: P2P + E2E + aspect + execution + lifecycle + bench +test-all: test e2e aspect bench readiness + @echo "All test categories passed — safe to merge!" + +# Run all quality checks +quality: fmt-check lint test + @echo "All quality checks passed!" + +# Fix all auto-fixable issues [reversible: git checkout] +fix: fmt + @echo "Fixed all auto-fixable issues" + +# ═══════════════════════════════════════════════════════════════════════════════ +# LINT & FORMAT +# ═══════════════════════════════════════════════════════════════════════════════ + +# Format all source files [reversible: git checkout] +fmt: + @echo "Formatting source files..." + # TODO: Replace with your formatter + # Examples: + # cargo fmt + # mix format + # gleam format + # deno fmt + +# Check formatting without changes +fmt-check: + @echo "Checking formatting..." + # TODO: Replace with your format check + # Examples: + # cargo fmt --check + # mix format --check-formatted + # gleam format --check + +# Run linter +lint: + @echo "Linting source files..." + # TODO: Replace with your linter + # Examples: + # cargo clippy -- -D warnings + # mix credo --strict + # gleam check + +# ═══════════════════════════════════════════════════════════════════════════════ +# RUN & EXECUTE +# ═══════════════════════════════════════════════════════════════════════════════ + +# Run the application +run *args: build + # TODO: Replace with your run command + echo "Run not configured yet" + +# Run with verbose output +run-verbose *args: build + # TODO: Replace with verbose run command + echo "Run not configured yet" + +# Install to user path +install: build-release + @echo "Installing {{project}}..." + # TODO: Replace with your install command + +# ═══════════════════════════════════════════════════════════════════════════════ +# DEPENDENCIES +# ═══════════════════════════════════════════════════════════════════════════════ + +# Install/check all dependencies +deps: + @echo "Checking dependencies..." + # TODO: Replace with your dependency check + # Examples: + # cargo check + # mix deps.get + # gleam deps download + @echo "All dependencies satisfied" + +# Audit dependencies for vulnerabilities +deps-audit: + @echo "Auditing for vulnerabilities..." + # TODO: Replace with your audit command + # Examples: + # cargo audit + # mix audit + @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || true + @command -v gitleaks >/dev/null && gitleaks detect --source . --no-git --quiet || true + @echo "Audit complete" + +# ═══════════════════════════════════════════════════════════════════════════════ +# DOCUMENTATION +# ═══════════════════════════════════════════════════════════════════════════════ + +# Generate all documentation +docs: + @mkdir -p docs/generated docs/man + just cookbook + just man + @echo "Documentation generated in docs/" + +# Generate justfile cookbook documentation +cookbook: + #!/usr/bin/env bash + mkdir -p docs + OUTPUT="docs/just-cookbook.adoc" + echo "= {{project}} Justfile Cookbook" > "$OUTPUT" + echo ":toc: left" >> "$OUTPUT" + echo ":toclevels: 3" >> "$OUTPUT" + echo "" >> "$OUTPUT" + echo "Generated: $(date -Iseconds)" >> "$OUTPUT" + echo "" >> "$OUTPUT" + echo "== Recipes" >> "$OUTPUT" + echo "" >> "$OUTPUT" + just --list --unsorted | while read -r line; do + if [[ "$line" =~ ^[[:space:]]+([a-z_-]+) ]]; then + recipe="${BASH_REMATCH[1]}" + echo "=== $recipe" >> "$OUTPUT" + echo "" >> "$OUTPUT" + echo "[source,bash]" >> "$OUTPUT" + echo "----" >> "$OUTPUT" + echo "just $recipe" >> "$OUTPUT" + echo "----" >> "$OUTPUT" + echo "" >> "$OUTPUT" + fi + done + echo "Generated: $OUTPUT" + +# Generate man page +man: + #!/usr/bin/env bash + mkdir -p docs/man + cat > docs/man/{{project}}.1 << EOF + .TH {{project}} 1 "$(date +%Y-%m-%d)" "{{version}}" "{{project}} Manual" + .SH NAME + {{project}} \- RSR-compliant project + .SH SYNOPSIS + .B just + [recipe] [args...] + .SH DESCRIPTION + RSR (Rhodium Standard Repository) project managed with just. + .SH AUTHOR + $(git config user.name 2>/dev/null || echo "Author") <$(git config user.email 2>/dev/null || echo "email")> + EOF + echo "Generated: docs/man/{{project}}.1" + +# ═══════════════════════════════════════════════════════════════════════════════ +# CONTAINERS (stapeln ecosystem — Podman + Chainguard Wolfi) +# ═══════════════════════════════════════════════════════════════════════════════ + +# Initialise container templates — substitute placeholders with project values +container-init: + #!/usr/bin/env bash + set -euo pipefail + + if [ ! -d "container" ]; then + echo "Error: container/ directory not found." + echo "This repo may not have been created from rsr-template-repo." + exit 1 + fi + + echo "=== Container Template Initialisation ===" + echo "" + + # Load RSR defaults if available + DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" + if [ -f "$DEFAULTS" ]; then + echo "Loading defaults from $DEFAULTS" + # shellcheck source=/dev/null + source "$DEFAULTS" + echo "" + fi + + # Prompt for container-specific values + read -rp "Service name (e.g. my-api) [{{project}}]: " _SERVICE_NAME + SERVICE_NAME="${_SERVICE_NAME:-{{project}}}" + + read -rp "Primary port [8080]: " _PORT + PORT="${_PORT:-8080}" + + read -rp "Container registry [ghcr.io/${OWNER:-hyperpolymath}]: " _REGISTRY + REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-hyperpolymath}}" + + echo "" + echo " Service: $SERVICE_NAME" + echo " Port: $PORT" + echo " Registry: $REGISTRY" + echo "" + read -rp "Proceed? [Y/n] " CONFIRM + [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 + + echo "" + echo "Replacing container placeholders..." + + # Brace tokens as variables (hex escapes avoid just interpolation) + LB=$(printf '\x7b\x7b') + RB=$(printf '\x7d\x7d') + + SED_ARGS=( + -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" + -e "s|${LB}PORT${RB}|${PORT}|g" + -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" + ) + + find container/ -type f | while read -r file; do + if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then + sed -i "${SED_ARGS[@]}" "$file" + fi + done + + echo "Container templates initialised." + echo "" + echo "Next steps:" + echo " 1. Edit container/Containerfile — add your build commands" + echo " 2. Edit container/entrypoint.sh — set your application binary" + echo " 3. Review container/compose.toml — adjust services and volumes" + echo " 4. Build: just container-build" + +# Build container image via cerro-torre pipeline +container-build *args: + #!/usr/bin/env bash + if [ -f "container/ct-build.sh" ]; then + cd container && ./ct-build.sh {{args}} + elif [ -f "container/Containerfile" ]; then + podman build -t {{project}}:latest -f container/Containerfile . + elif [ -f "Containerfile" ]; then + podman build -t {{project}}:latest -f Containerfile . + else + echo "No Containerfile found in container/ or project root" + exit 1 + fi + +# Verify compose configuration +container-verify: + #!/usr/bin/env bash + if [ ! -f "container/compose.toml" ]; then + echo "No container/compose.toml found" + exit 1 + fi + cd container + if command -v selur-compose &>/dev/null; then + selur-compose verify + else + echo "selur-compose not found, falling back to podman compose" + podman compose --file compose.toml config + fi + +# Start container stack +container-up *args: + #!/usr/bin/env bash + if [ ! -f "container/compose.toml" ]; then + echo "No container/compose.toml found" + exit 1 + fi + cd container + if command -v selur-compose &>/dev/null; then + selur-compose up {{args}} + else + podman compose --file compose.toml up {{args}} + fi + +# Stop container stack +container-down: + #!/usr/bin/env bash + cd container 2>/dev/null || { echo "No container/ directory"; exit 1; } + if command -v selur-compose &>/dev/null; then + selur-compose down + else + podman compose --file compose.toml down + fi + +# Sign and verify container bundle (build + pack + sign + verify) +container-sign: + #!/usr/bin/env bash + if [ -f "container/ct-build.sh" ]; then + cd container && ./ct-build.sh + else + echo "No container/ct-build.sh found" + exit 1 + fi + +# Push signed bundle to registry +container-push: + #!/usr/bin/env bash + if [ -f "container/ct-build.sh" ]; then + cd container && ./ct-build.sh --push + else + echo "No container/ct-build.sh found — falling back to podman push" + podman push {{project}}:latest + fi + +# Run container interactively (for debugging) +container-run *args: + podman run --rm -it {{project}}:latest {{args}} + +# ═══════════════════════════════════════════════════════════════════════════════ +# CI & AUTOMATION +# ═══════════════════════════════════════════════════════════════════════════════ + +# Run full CI pipeline locally +ci: deps quality + @echo "CI pipeline complete!" + +# Install git hooks +install-hooks: + @mkdir -p .git/hooks + @cat > .git/hooks/pre-commit << 'HOOKEOF' + #!/bin/bash + just fmt-check || exit 1 + just lint || exit 1 + just assail || exit 1 + HOOKEOF + @chmod +x .git/hooks/pre-commit + @echo "Git hooks installed" + +# ═══════════════════════════════════════════════════════════════════════════════ +# SECURITY +# ═══════════════════════════════════════════════════════════════════════════════ + +# Run security audit +security: deps-audit + @echo "=== Security Audit ===" + @command -v gitleaks >/dev/null && gitleaks detect --source . --verbose || true + @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL . || true + @echo "Security audit complete" + +# Generate SBOM +sbom: + @mkdir -p docs/security + @command -v syft >/dev/null && syft . -o spdx-json > docs/security/sbom.spdx.json || echo "syft not found" + +# ═══════════════════════════════════════════════════════════════════════════════ +# VALIDATION & COMPLIANCE +# ═══════════════════════════════════════════════════════════════════════════════ + +# Validate RSR compliance +validate-rsr: + #!/usr/bin/env bash + echo "=== RSR Compliance Check ===" + MISSING="" + for f in .editorconfig .gitignore Justfile README.adoc LICENSE 0-AI-MANIFEST.a2ml; do + [ -f "$f" ] || MISSING="$MISSING $f" + done + for f in .machine_readable/STATE.a2ml .machine_readable/META.a2ml .machine_readable/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do + [ -f "$f" ] || MISSING="$MISSING $f" + done + for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/MPL-2.0.txt; do + [ -f "$f" ] || MISSING="$MISSING $f" + done + if [ ! -d "src/interface/Abi" ] && [ ! -d "src/interface/abi" ]; then + MISSING="$MISSING src/interface/Abi" + fi + for f in src/interface/ffi src/interface/generated; do + [ -d "$f" ] || MISSING="$MISSING $f" + done + for f in docs/governance/MAINTENANCE-CHECKLIST.adoc docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc; do + [ -f "$f" ] || MISSING="$MISSING $f" + done + if [ -f ".machine_readable/META.a2ml" ]; then + grep -q 'axis-1 = "must > intend > like"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-1" + grep -q 'axis-2 = "corrective > adaptive > perfective"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-2" + grep -q 'axis-3 = "systems > compliance > effects"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-3" + grep -q 'scoping-first = true' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:scoping-first" + grep -q 'idris-unsound-scan = "believe_me/assert_total"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:idris-unsound-scan" + grep -q 'audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:audit-focus" + grep -q 'compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:compliance-focus" + grep -q 'effects-evidence = "benchmark execution/results and maintainer status dialogue/review"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:effects-evidence" + grep -q 'compliance-tooling = "panic-attack"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:compliance-tooling" + grep -q 'effects-tooling = "ecological checking with sustainabot guidance"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:effects-tooling" + grep -q 'source-human = "docs/governance/MAINTENANCE-CHECKLIST.adoc"' .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml || MISSING="$MISSING MAINTENANCE-CHECKLIST.a2ml:source-human" + grep -q 'source-human = "docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc"' .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml || MISSING="$MISSING SOFTWARE-DEVELOPMENT-APPROACH.a2ml:source-human" + fi + if [ -n "$MISSING" ]; then + echo "MISSING:$MISSING" + exit 1 + fi + echo "RSR compliance: PASS" + +# Validate STATE.a2ml syntax +validate-state: + @if [ -f ".machine_readable/STATE.a2ml" ]; then \ + grep -q '^\[metadata\]' .machine_readable/STATE.a2ml && \ + grep -q 'project\s*=' .machine_readable/STATE.a2ml && \ + echo "STATE.a2ml: valid" || echo "STATE.a2ml: INVALID (missing required sections)"; \ + else \ + echo "No .machine_readable/STATE.a2ml found"; \ + fi + +# Validate AI installation guide completeness (finishbot pre-release check) +validate-ai-install: + #!/usr/bin/env bash + echo "=== AI Installation Guide Check ===" + GUIDE="docs/AI_INSTALLATION_GUIDE.adoc" + README="README.adoc" + ERRORS=0 + + # Check guide exists + if [ ! -f "$GUIDE" ]; then + echo "MISSING: $GUIDE (create from template: docs/AI_INSTALLATION_GUIDE.adoc)" + ERRORS=$((ERRORS + 1)) + else + # Check for unfilled TODO markers + TODOS=$(grep -c '\[TODO-AI-INSTALL' "$GUIDE" 2>/dev/null || true) + if [ "$TODOS" -gt 0 ]; then + echo "INCOMPLETE: $GUIDE has $TODOS unfilled [TODO-AI-INSTALL] markers:" + grep -n '\[TODO-AI-INSTALL' "$GUIDE" | head -10 + ERRORS=$((ERRORS + 1)) + else + echo "$GUIDE: complete (no TODO markers)" + fi + + # Check AI implementation section exists + if ! grep -q 'ai-implementation' "$GUIDE" 2>/dev/null; then + echo "MISSING: [[ai-implementation]] anchor in $GUIDE" + ERRORS=$((ERRORS + 1)) + fi + + # Check privacy notice exists + if ! grep -qi 'privacy' "$GUIDE" 2>/dev/null; then + echo "MISSING: Privacy notice in $GUIDE" + ERRORS=$((ERRORS + 1)) + fi + + # Check install commands exist (not just placeholders) + if ! grep -q 'git clone' "$GUIDE" 2>/dev/null; then + echo "WARNING: No git clone command found in $GUIDE -- install commands may be incomplete" + fi + fi + + # Check README has AI install section + if [ -f "$README" ]; then + if ! grep -qi 'AI-Assisted Installation' "$README" 2>/dev/null; then + echo "MISSING: AI-Assisted Installation section in $README" + echo " Copy from docs/AI-INSTALL-README-SECTION.adoc" + ERRORS=$((ERRORS + 1)) + fi + + # Check README for unfilled TODO markers + README_TODOS=$(grep -c '\[TODO-AI-INSTALL' "$README" 2>/dev/null || true) + if [ "$README_TODOS" -gt 0 ]; then + echo "INCOMPLETE: $README has $README_TODOS unfilled [TODO-AI-INSTALL] markers" + ERRORS=$((ERRORS + 1)) + fi + fi + + if [ "$ERRORS" -gt 0 ]; then + echo "" + echo "AI install guide: FAIL ($ERRORS issues)" + exit 1 + fi + echo "AI install guide: PASS" + +# Full validation suite +validate: validate-rsr validate-state validate-ai-install + @echo "All validations passed!" + +# ═══════════════════════════════════════════════════════════════════════════════ +# STATE MANAGEMENT +# ═══════════════════════════════════════════════════════════════════════════════ + +# Update STATE.a2ml timestamp +state-touch: + @if [ -f ".machine_readable/STATE.a2ml" ]; then \ + sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/STATE.a2ml && \ + echo "STATE.a2ml timestamp updated"; \ + fi + +# Show current phase from STATE.a2ml +state-phase: + @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml 2>/dev/null | head -1 || echo "unknown" + +# ═══════════════════════════════════════════════════════════════════════════════ +# GUIX & NIX +# ═══════════════════════════════════════════════════════════════════════════════ + +# Enter Guix development shell (primary) +guix-shell: + guix shell -D -f guix.scm + +# Build with Guix +guix-build: + guix build -f guix.scm + +# Enter Nix development shell (fallback) +nix-shell: + @if [ -f "flake.nix" ]; then nix develop; else echo "No flake.nix"; fi + +# ═══════════════════════════════════════════════════════════════════════════════ +# HYBRID AUTOMATION +# ═══════════════════════════════════════════════════════════════════════════════ + +# Run local automation tasks +automate task="all": + #!/usr/bin/env bash + case "{{task}}" in + all) just fmt && just lint && just test && just docs && just state-touch ;; + cleanup) just clean && find . -name "*.orig" -delete && find . -name "*~" -delete ;; + update) just deps && just validate ;; + *) echo "Unknown: {{task}}. Use: all, cleanup, update" && exit 1 ;; + esac + +# ═══════════════════════════════════════════════════════════════════════════════ +# COMBINATORIC MATRIX RECIPES +# ═══════════════════════════════════════════════════════════════════════════════ + +# Build matrix: [debug|release] x [target] x [features] +build-matrix mode="debug" target="" features="": + @echo "Build matrix: mode={{mode}} target={{target}} features={{features}}" + +# Test matrix: [unit|integration|e2e|all] x [verbosity] x [parallel] +test-matrix suite="unit" verbosity="normal" parallel="true": + @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}" + +# Container matrix: [build|run|push|shell|scan] x [registry] x [tag] +container-matrix action="build" registry="ghcr.io/hyperpolymath" tag="latest": + @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}" + +# CI matrix: [lint|test|build|security|all] x [quick|full] +ci-matrix stage="all" depth="quick": + @echo "CI matrix: stage={{stage}} depth={{depth}}" + +# Show all matrix combinations +combinations: + @echo "=== Combinatoric Matrix Recipes ===" + @echo "" + @echo "Build Matrix: just build-matrix [debug|release] [target] [features]" + @echo "Test Matrix: just test-matrix [unit|integration|e2e|all] [verbosity] [parallel]" + @echo "Container: just container-matrix [build|run|push|shell|scan] [registry] [tag]" + @echo "CI Matrix: just ci-matrix [lint|test|build|security|all] [quick|full]" + +# ═══════════════════════════════════════════════════════════════════════════════ +# VERSION CONTROL +# ═══════════════════════════════════════════════════════════════════════════════ + +# Show git status +status: + @git status --short + +# Show recent commits +log count="20": + @git log --oneline -{{count}} + +# Generate CHANGELOG.md with git-cliff +changelog: + @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } + git cliff --config .machine_readable/configs/git-cliff/cliff.toml --output CHANGELOG.md + @echo "Generated CHANGELOG.md" + +# Preview changelog for unreleased commits (does not write) +changelog-preview: + @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } + git cliff --config .machine_readable/configs/git-cliff/cliff.toml --unreleased --strip header + +# Tag a new release (usage: just release-tag 1.2.3) +release-tag version: + #!/usr/bin/env bash + TAG="v{{version}}" + if git rev-parse "$TAG" >/dev/null 2>&1; then + echo "Tag $TAG already exists" + exit 1 + fi + just changelog + git add CHANGELOG.md + git commit -m "chore(release): prepare $TAG" + git tag -a "$TAG" -m "Release $TAG" + echo "Created tag $TAG — push with: git push origin main --tags" + +# ═══════════════════════════════════════════════════════════════════════════════ +# UTILITIES +# ═══════════════════════════════════════════════════════════════════════════════ + +# Count lines of code +loc: + @find . \( -name "*.rs" -o -name "*.ex" -o -name "*.exs" -o -name "*.res" -o -name "*.gleam" -o -name "*.zig" -o -name "*.idr" -o -name "*.hs" -o -name "*.ncl" -o -name "*.scm" -o -name "*.adb" -o -name "*.ads" \) -not -path './target/*' -not -path './_build/*' 2>/dev/null | xargs wc -l 2>/dev/null | tail -1 || echo "0" + +# Show TODO comments +todos: + @grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.ex" --include="*.res" --include="*.gleam" --include="*.zig" --include="*.idr" --include="*.hs" . 2>/dev/null || echo "No TODOs" + +# Open in editor +edit: + ${EDITOR:-code} . + +# Run high-rigor security assault using panic-attacker +maint-assault: + @./.machine_readable/scripts/maintenance/maint-assault.sh + +# Run panic-attacker pre-commit scan (foundational floor-raise requirement) +assail: + @command -v panic-attack >/dev/null 2>&1 && panic-attack assail . || echo "WARN: panic-attack not found — install from https://github.com/hyperpolymath/panic-attacker" + + +# Self-diagnostic — checks dependencies, permissions, paths +doctor: + @echo "Running diagnostics for rsr-template-repo..." + @echo "Checking required tools..." + @command -v just >/dev/null 2>&1 && echo " [OK] just" || echo " [FAIL] just not found" + @command -v git >/dev/null 2>&1 && echo " [OK] git" || echo " [FAIL] git not found" + @echo "Checking for hardcoded paths..." + @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.res' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo " [OK] No hardcoded paths" + @echo "Diagnostics complete." + +# Guided tour of key features +tour: + @echo "=== rsr-template-repo Tour ===" + @echo "" + @echo "1. Project structure:" + @ls -la + @echo "" + @echo "2. Available commands: just --list" + @echo "" + @echo "3. Read README.adoc for full overview" + @echo "4. Read EXPLAINME.adoc for architecture decisions" + @echo "5. Run 'just doctor' to check your setup" + @echo "" + @echo "Tour complete! Try 'just --list' to see all available commands." + +# Open feedback channel with diagnostic context +help-me: + @echo "=== rsr-template-repo Help ===" + @echo "Platform: $(uname -s) $(uname -m)" + @echo "Shell: $SHELL" + @echo "" + @echo "To report an issue:" + @echo " https://github.com/hyperpolymath/rsr-template-repo/issues/new" + @echo "" + @echo "Include the output of 'just doctor' in your report." + +# ═══════════════════════════════════════════════════════════════════════════════ +# FORMAL VERIFICATION (PROOFS) +# ═══════════════════════════════════════════════════════════════════════════════ + +# Check all formal proofs (Idris2 + Lean4 + Agda + Coq) +proof-check-all: proof-check-idris2 proof-check-lean4 proof-check-agda proof-check-coq proof-scan-dangerous + @echo "=== All proof checks complete ===" + +# Check Idris2 proofs (ABI, types, dependent type proofs) +proof-check-idris2: + #!/usr/bin/env bash + set -euo pipefail + echo "=== Checking Idris2 proofs ===" + if ! command -v idris2 &>/dev/null; then + echo "SKIP: idris2 not installed" + exit 0 + fi + ERRORS=0 + for f in $(find verification/proofs/idris2 -name '*.idr' 2>/dev/null); do + echo -n " Checking $f ... " + if idris2 --check "$f" 2>/dev/null; then + echo "OK" + else + echo "FAIL" + ERRORS=$((ERRORS + 1)) + fi + done + if [ "$ERRORS" -gt 0 ]; then + echo "FAIL: $ERRORS Idris2 proof(s) failed" + exit 1 + fi + echo "PASS: All Idris2 proofs verified" + +# Check Lean4 proofs +proof-check-lean4: + #!/usr/bin/env bash + set -euo pipefail + echo "=== Checking Lean4 proofs ===" + if ! command -v lean &>/dev/null; then + echo "SKIP: lean not installed" + exit 0 + fi + ERRORS=0 + for f in $(find verification/proofs/lean4 -name '*.lean' 2>/dev/null); do + echo -n " Checking $f ... " + if lean "$f" 2>/dev/null; then + echo "OK" + else + echo "FAIL" + ERRORS=$((ERRORS + 1)) + fi + done + if [ "$ERRORS" -gt 0 ]; then + echo "FAIL: $ERRORS Lean4 proof(s) failed" + exit 1 + fi + echo "PASS: All Lean4 proofs verified" + +# Check Agda proofs +proof-check-agda: + #!/usr/bin/env bash + set -euo pipefail + echo "=== Checking Agda proofs ===" + if ! command -v agda &>/dev/null; then + echo "SKIP: agda not installed" + exit 0 + fi + ERRORS=0 + for f in $(find verification/proofs/agda -name '*.agda' 2>/dev/null); do + echo -n " Checking $f ... " + if agda --safe "$f" 2>/dev/null; then + echo "OK" + else + echo "FAIL" + ERRORS=$((ERRORS + 1)) + fi + done + if [ "$ERRORS" -gt 0 ]; then + echo "FAIL: $ERRORS Agda proof(s) failed" + exit 1 + fi + echo "PASS: All Agda proofs verified" + +# Check Coq proofs +proof-check-coq: + #!/usr/bin/env bash + set -euo pipefail + echo "=== Checking Coq proofs ===" + if ! command -v coqc &>/dev/null; then + echo "SKIP: coqc not installed" + exit 0 + fi + ERRORS=0 + for f in $(find verification/proofs/coq -name '*.v' 2>/dev/null); do + echo -n " Checking $f ... " + if coqc "$f" 2>/dev/null; then + echo "OK" + else + echo "FAIL" + ERRORS=$((ERRORS + 1)) + fi + done + if [ "$ERRORS" -gt 0 ]; then + echo "FAIL: $ERRORS Coq proof(s) failed" + exit 1 + fi + echo "PASS: All Coq proofs verified" + +# Scan for dangerous patterns in proof files (believe_me, sorry, Admitted, etc.) +proof-scan-dangerous: + #!/usr/bin/env bash + set -euo pipefail + echo "=== Scanning for dangerous patterns in proofs ===" + DANGEROUS=0 + PATTERNS="believe_me|assert_total|postulate|sorry|Admitted|unsafeCoerce|Obj\.magic" + for f in $(find verification/proofs -name '*.idr' -o -name '*.lean' -o -name '*.agda' -o -name '*.v' 2>/dev/null); do + MATCHES=$(grep -nE "$PATTERNS" "$f" 2>/dev/null || true) + if [ -n "$MATCHES" ]; then + echo " DANGEROUS: $f" + echo "$MATCHES" | sed 's/^/ /' + DANGEROUS=$((DANGEROUS + 1)) + fi + done + if [ "$DANGEROUS" -gt 0 ]; then + echo "FAIL: $DANGEROUS file(s) contain dangerous patterns" + exit 1 + fi + echo "PASS: No dangerous patterns found in proofs" + +# Show proof status summary +proof-status: + #!/usr/bin/env bash + echo "=== Proof Status ===" + echo "" + echo "Idris2: $(find verification/proofs/idris2 -name '*.idr' 2>/dev/null | wc -l) files" + echo "Lean4: $(find verification/proofs/lean4 -name '*.lean' 2>/dev/null | wc -l) files" + echo "Agda: $(find verification/proofs/agda -name '*.agda' 2>/dev/null | wc -l) files" + echo "Coq: $(find verification/proofs/coq -name '*.v' 2>/dev/null | wc -l) files" + echo "TLA+: $(find verification/proofs/tlaplus -name '*.tla' 2>/dev/null | wc -l) files" + echo "" + if [ -f PROOF-STATUS.md ]; then + grep -E "^\| \*\*Total\*\*" PROOF-STATUS.md 2>/dev/null || echo "(No summary row in PROOF-STATUS.md)" + else + echo "(No PROOF-STATUS.md found)" + fi + +# ═══════════════════════════════════════════════════════════════════════════════ +# SESSION MANAGEMENT (THIN BINDINGS TO CENTRAL STANDARDS) +# ═══════════════════════════════════════════════════════════════════════════════ + +# Show canonical session-management command model +session-help: + @echo "Canonical command model:" + @echo " intake repo " + @echo " checkpoint change " + @echo " verify maintenance " + @echo " verify substantial " + @echo " verify release " + @echo " close planned " + @echo " close urgent " + @echo " recover repo " + @echo " handover full " + @echo " handover split " + @echo " handover model " + @echo " handover human " + @echo "" + @echo "Use Just aliases below (thin wrappers around ./session/dispatch.sh)." + +# Canonical aliases (friendly recipe names that map to canonical commands) +intake-repo path=".": + @./session/dispatch.sh intake repo "{{path}}" + +checkpoint-change path=".": + @./session/dispatch.sh checkpoint change "{{path}}" + +verify-maintenance path=".": + @./session/dispatch.sh verify maintenance "{{path}}" + +verify-substantial path=".": + @./session/dispatch.sh verify substantial "{{path}}" + +verify-release path=".": + @./session/dispatch.sh verify release "{{path}}" + +close-planned path=".": + @./session/dispatch.sh close planned "{{path}}" + +close-urgent path=".": + @./session/dispatch.sh close urgent "{{path}}" + +recover-repo path=".": + @./session/dispatch.sh recover repo "{{path}}" + +handover-full path=".": + @./session/dispatch.sh handover full "{{path}}" + +handover-split path=".": + @./session/dispatch.sh handover split "{{path}}" + +handover-model path=".": + @./session/dispatch.sh handover model "{{path}}" + +handover-human path=".": + @./session/dispatch.sh handover human "{{path}}" + +# ==================================================================== +# Burrower-specific recipes (proof-burrower) +# ==================================================================== + +# Path to rustup's stable toolchain. The Fedora system rustc lacks +# the wasm32-unknown-unknown stdlib; rustup ships it. +rustup_stable := "/home/hyper/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/bin" + +# Build the Burrower CLI (debug). +build-burrower: + PATH="{{rustup_stable}}:$PATH" cargo build + +# Run the burrower test suite. +test-burrower: + PATH="{{rustup_stable}}:$PATH" cargo test --workspace + +# Build the typed-wasm artifact. +wasm: + PATH="{{rustup_stable}}:$PATH" cargo build --release --target wasm32-unknown-unknown -p burrower-wasm + @ls -lh target/wasm32-unknown-unknown/release/burrower_wasm.wasm + +# Index a corpus directory into a JSON index file. +# Usage: just index /path/to/corpus /tmp/idx.json +index root output: + PATH="{{rustup_stable}}:$PATH" cargo run --release -p burrower -- index "{{root}}" --output "{{output}}" + +# Run the swarm against a goal, optionally appending to a ledger. +# Usage: just swarm "lemma foo: ..." /tmp/idx.json /tmp/burrow.jsonl +swarm goal index ledger="": + @if [ -n "{{ledger}}" ]; then \ + PATH="{{rustup_stable}}:$PATH" cargo run --release -p burrower -- swarm "{{goal}}" --index "{{index}}" --ledger "{{ledger}}"; \ + else \ + PATH="{{rustup_stable}}:$PATH" cargo run --release -p burrower -- swarm "{{goal}}" --index "{{index}}"; \ + fi + +# Show the most-recent ledger records. +ledger-recent path limit="10": + PATH="{{rustup_stable}}:$PATH" cargo run --release -p burrower -- ledger recent --path "{{path}}" --limit "{{limit}}" + +# Aggregate digest of the ledger. +ledger-digest path: + PATH="{{rustup_stable}}:$PATH" cargo run --release -p burrower -- ledger digest --path "{{path}}" diff --git a/.machine_readable/contractiles/Mustfile.a2ml b/.machine_readable/contractiles/Mustfile.a2ml new file mode 100644 index 0000000..55f8ab4 --- /dev/null +++ b/.machine_readable/contractiles/Mustfile.a2ml @@ -0,0 +1,102 @@ +# SPDX-License-Identifier: MPL-2.0 +# Mustfile — Physical state contract for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# What MUST be true about this repository. Hard requirements. +# Run with: must check +# Fix with: must fix (where a deterministic fix exists) + +@abstract: +Physical-state invariants for rsr-template-repo. This is the canonical +RSR template repository. These are hard requirements — CI and pre-commit +hooks fail if any check fails. +@end + +## File Presence + +### license-present +- description: LICENSE file must exist +- run: test -f LICENSE +- severity: critical + +### readme-present +- description: README.adoc must exist +- run: test -f README.adoc +- severity: critical + +### security-policy +- description: SECURITY.md must exist +- run: test -f SECURITY.md +- severity: critical + +### ai-manifest +- description: 0-AI-MANIFEST.a2ml must exist +- run: test -f 0-AI-MANIFEST.a2ml +- severity: critical + +### governance-docs +- description: GOVERNANCE.adoc, MAINTAINERS.adoc, CODEOWNERS must exist +- run: test -f GOVERNANCE.adoc && test -f MAINTAINERS.adoc && test -f .github/CODEOWNERS +- severity: critical + +### machine-readable-dir +- description: .machine_readable/ directory must exist +- run: test -d .machine_readable +- severity: critical + +## Directory Structure + +### contractiles-complete +- description: All required contractile directories exist +- run: test -d .machine_readable/contractiles && test -d .machine_readable/contractiles/bust && test -d .machine_readable/contractiles/dust +- severity: critical + +### contractiles-files-present +- description: All four primary contractile files exist +- run: test -f .machine_readable/contractiles/Intentfile.a2ml && test -f .machine_readable/contractiles/Mustfile.a2ml && test -f .machine_readable/contractiles/Trustfile.a2ml && test -f .machine_readable/contractiles/Adjustfile.a2ml +- severity: critical + +### bust-dust-files-present +- description: Bustfile and Dustfile exist in their directories +- run: test -f .machine_readable/contractiles/bust/Bustfile.a2ml && test -f .machine_readable/contractiles/dust/Dustfile.a2ml +- severity: critical + +### six-directory-present +- description: 6a2 directory exists with required files +- run: test -d .machine_readable/6a2 && test -f .machine_readable/6a2/META.a2ml && test -f .machine_readable/6a2/ECOSYSTEM.a2ml && test -f .machine_readable/6a2/STATE.a2ml && test -f .machine_readable/6a2/PLAYBOOK.a2ml && test -f .machine_readable/6a2/AGENTIC.a2ml && test -f .machine_readable/6a2/NEUROSYM.a2ml +- severity: critical + +### anchors-directory +- description: anchors directory exists in 6a2 +- run: test -d .machine_readable/6a2/anchors +- severity: warning + +### self-validating-structure +- description: self-validating directory has k9-svc and examples +- run: test -d .machine_readable/self-validating && test -d .machine_readable/self-validating/k9-svc && test -d .machine_readable/self-validating/examples +- severity: warning + +## Template Integrity + +### no-placeholder-values +- description: No placeholder values remain in template files +- run: test -z "$(grep -r '{{' .machine_readable/contractiles/ 2>/dev/null)" +- severity: critical +- notes: All placeholders must be substituted when copying this template + +### template-readonly +- description: Template marker files are not modified +- run: grep -q 'RSR_TEMPLATE_DO_NOT_EDIT' .machine_readable/0.1-AI-MANIFEST.a2ml +- severity: warning + +## Git State + +### no-untracked-contractiles +- description: All contractile files are tracked in git +- run: test -z "$(git ls-files -o --exclude-standard .machine_readable/contractiles/ 2>/dev/null)" +- severity: critical + +### signed-commits +- description: All commits must be signed +- run: git verify-commit HEAD +- severity: critical diff --git a/.machine_readable/contractiles/Trustfile.a2ml b/.machine_readable/contractiles/Trustfile.a2ml new file mode 100644 index 0000000..e2028b5 --- /dev/null +++ b/.machine_readable/contractiles/Trustfile.a2ml @@ -0,0 +1,88 @@ +# SPDX-License-Identifier: MPL-2.0 +# Trustfile — Trust boundaries and integrity invariants for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Defines what LLM/SLM agents are trusted to do without asking, and +# integrity invariants that verify the repo has not been tampered with. + +@abstract: +Trust boundaries and integrity checks for rsr-template-repo. This file +combines the trust-level definitions from the original TRUST.contractile +with the integrity invariants from the old Trustfile.a2ml. It defines +what AI agents may do autonomously and what requires human approval, +plus checks that verify repository integrity. +@end + +## Trust Levels + +The rsr-template-repo operates at trust level: maximal + +Trust levels: +- maximal: Agent may read, build, test, lint, format, heal freely. + Only destructive/external actions require approval. +- standard: Agent may read and build. Test/lint need approval. +- restricted: Agent may read only. All modifications need approval. +- minimal: Agent may read specific files only. Everything else blocked. + +Current trust level: maximal + +## Integrity Invariants + +### Secrets + +#### no-secrets-committed +- description: No credential files in repo +- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production +- severity: critical + +#### no-private-keys +- description: No private key files committed +- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." +- severity: critical + +#### no-tokens-in-source +- description: No hardcoded API tokens in source +- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." +- severity: critical + +## Provenance + +#### author-correct +- description: Git author matches expected identity +- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" +- severity: warning + +#### license-content +- description: LICENSE contains expected identifier +- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE +- severity: warning + +## Template-Specific Trust + +### template-files-readonly +- description: Template scaffold files should not be modified except by maintainer +- run: test -z "$(git status --short .machine_readable/ 2>/dev/null | grep -v '^??' || true)" +- severity: advisory +- notes: Changes to template files require careful review + +### trust-deny-areas +- description: Sensitive areas from INTENT.contractile require explicit approval +- run: echo "Check .machine_readable/ contractiles and governance docs" +- severity: advisory +- areas: + - .machine_readable/ + - GOVERNANCE.adoc + - MAINTAINERS.adoc + - .github/CODEOWNERS + +## Container Security + +#### container-images-pinned +- description: Containerfile uses pinned base images +- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile +- severity: warning + +#### no-dockerfile +- description: No Dockerfile (use Containerfile) +- run: test ! -f Dockerfile +- severity: warning diff --git a/.machine_readable/contractiles/adjust/Adjustfile.a2ml b/.machine_readable/contractiles/adjust/Adjustfile.a2ml deleted file mode 100644 index 24f400f..0000000 --- a/.machine_readable/contractiles/adjust/Adjustfile.a2ml +++ /dev/null @@ -1,211 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Adjustfile — Accessibility Contract for Burble -# Author: Jonathan D.A. Jewell -# -# Accessibility requirements and compliance for Burble. -# Voice-first design must be inclusive for all users. -# -# Run with: adjust check -# Fix with: adjust fix (where deterministic fix exists) - -@abstract: -Accessibility requirements and compliance for the Burble voice-first communications platform. -These requirements ensure Burble is usable by everyone, regardless of ability. -@end - -## Keyboard Accessibility - -### keyboard-navigation -- description: All features accessible via keyboard -- status: partial -- probe: test -f server/lib/burble/accessibility/keyboard.ex -- compliance: WCAG 2.1 AA -- notes: Basic navigation implemented. Full keyboard-only flow needed. -- fix: Port PanLL's comprehensive keyboard navigation system - -### custom-keybindings -- description: User-configurable keybindings -- status: implemented -- probe: test -f server/lib/burble/accessibility/keyboard.ex -- compliance: WCAG 2.1 AAA -- notes: Users can remap PTT, mute, deafen, volume, and room navigation keys - -### keyboard-shortcuts-discoverable -- description: Keyboard shortcuts are documented and discoverable -- status: missing -- compliance: WCAG 2.1 A -- fix: Add keyboard shortcuts help modal in web client - -## Visual Accessibility - -### high-contrast-mode -- description: High contrast UI theme -- status: missing -- compliance: WCAG 2.1 AA -- fix: Port PanLL's high-contrast theme system -- target: CSS variables for contrast ratios >= 4.5:1 - -### colorblind-support -- description: Colorblind-friendly color schemes -- status: missing -- compliance: WCAG 2.1 AA -- fix: Implement deuteranopia, protanopia, and tritanopia palettes -- reference: PanLL's palette system - -### font-size-adjustment -- description: Resizable UI fonts (4 levels: 14-20px) -- status: missing -- compliance: WCAG 2.1 AA -- fix: Port PanLL's font size adjustment system -- target: User preference persists across sessions - -### theme-switching -- description: Dark/Light/System theme support -- status: missing -- compliance: WCAG 2.1 AA -- fix: Port PanLL's theme system -- target: Respects OS preference, user override - -## Auditory Accessibility - -### screen-reader-support -- description: Full screen reader compatibility -- status: partial -- probe: test -f server/lib/burble/accessibility/screen_reader.ex -- compliance: WCAG 2.1 AA -- notes: Basic announcements implemented. Needs ARIA attributes and live regions. -- fix: Complete ARIA implementation in web client - -### closed-captions -- description: Real-time captioning for voice chat -- status: missing -- compliance: WCAG 2.1 AA -- notes: Requires Web Speech API or external STT integration -- target: 90%+ accuracy for English, configurable display - -### visual-notifications -- description: Visual indicators for audio events -- status: missing -- compliance: WCAG 2.1 A -- notes: Speaking indicators, mute status, connection status -- fix: Add visual cues that duplicate audio information - -### volume-normalization -- description: Consistent volume levels across users -- status: missing -- compliance: WCAG 2.1 AA -- notes: Prevents sudden loud sounds for sensitive users -- target: -23 LUFS normalization per EBU R128 - -## Motor Accessibility - -### voice-commands -- description: Voice-controlled interface -- status: missing -- compliance: WCAG 2.1 AAA -- notes: "Mute", "Deafen", "Join room X", "Volume up/down" -- target: Web Speech API with fallback to keyboard - -### reduced-motion -- description: Reduced animation options -- status: missing -- compliance: WCAG 2.1 AA -- fix: Port PanLL's animation control (on/reduced/off) -- target: Respects prefers-reduced-motion media query - -### hover-alternatives -- description: All hover interactions have click alternatives -- status: partial -- compliance: WCAG 2.1 AA -- notes: Some hover tooltips need click-to-show option -- fix: Audit and add click alternatives - -## Cognitive Accessibility - -### clear-language -- description: Simple, consistent terminology -- status: partial -- compliance: WCAG 2.1 AAA -- notes: Technical terms need plain language explanations -- fix: Add tooltips/glossary for jargon - -### predictable-navigation -- description: Consistent navigation patterns -- status: partial -- compliance: WCAG 2.1 AA -- notes: Navigation structure varies between pages -- fix: Standardize navigation layout - -### error-prevention -- description: Confirmation for destructive actions -- status: partial -- compliance: WCAG 2.1 AA -- notes: Room deletion has confirmation, others may not -- fix: Audit all destructive actions - -### help-availability -- description: Context-sensitive help always available -- status: missing -- compliance: WCAG 2.1 AAA -- notes: No persistent help system -- fix: Add help button with contextual guidance - -## Compliance Targets - -### wcag-2.1-aa -- description: WCAG 2.1 AA compliance -- status: partial -- target: Full compliance by Q4 2026 -- tracking: https://github.com/hyperpolymath/burble/issues/XXX - -### section-508 -- description: U.S. Section 508 compliance -- status: partial -- target: Full compliance by Q4 2026 -- notes: Aligns with WCAG 2.1 AA for most requirements - -### en-301-549 -- description: EU EN 301 549 compliance -- status: partial -- target: Full compliance by Q4 2026 -- notes: EU public sector procurement requirement - -## Integration Requirements - -### panll-accessibility-port -- description: Port PanLL's accessibility engine to Burble -- status: planned -- reference: /var/mnt/eclipse/repos/panll/tests/accessibility_engine_test.js -- target: Q2 2026 - -### k9-accessibility-validator -- description: Integrate K9 accessibility validator -- status: planned -- reference: /var/mnt/eclipse/repos/panll/contractiles/k9/validators/accessibility-baseline.k9.ncl -- target: Q2 2026 - -### accessibility-testing -- description: Add accessibility tests to CI/CD -- status: planned -- target: pa11y or axe-core integration -- compliance: Automated WCAG testing - -## Documentation Requirements - -### accessibility-guide -- description: User-facing accessibility guide -- status: missing -- target: docs/accessibility/USER-GUIDE.adoc -- notes: Keyboard shortcuts, screen reader setup, theme switching - -### developer-accessibility -- description: Developer accessibility guidelines -- status: missing -- target: docs/accessibility/DEVELOPER.adoc -- notes: Coding standards, testing requirements, compliance checklist - -### compliance-report -- description: Accessibility compliance report -- status: missing -- target: docs/compliance/ACCESSIBILITY.adoc -- notes: VPAT (Voluntary Product Accessibility Template) diff --git a/.machine_readable/contractiles/adjust/adjust.k9.ncl b/.machine_readable/contractiles/adjust/adjust.k9.ncl deleted file mode 100644 index 9ff26c9..0000000 --- a/.machine_readable/contractiles/adjust/adjust.k9.ncl +++ /dev/null @@ -1,166 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# adjust.k9.ncl — K9 trust-tier component of the adjust trident -# Author: Jonathan D.A. Jewell -# -# Pairs with: Adjustfile.a2ml (declaration) + adjust.ncl (runner). -# -# Verb: adjust (drift tolerances + corrective actions) -# Tier: Yard (validation with subprocess for measurement; -# no mutation beyond auto-fix where declared) -# Authority: advisory (continue-with-warnings; not blocking) -# -# adjust is the tolerance-band verb. Where must says "this MUST hold" -# and trust says "this MUST verify clean" (both binary), adjust says -# "drift ≤ X is acceptable; drift > X triggers action Y". Between them, -# adjust handles the subtle-drift territory that binary verbs can't. -# -# Cardinality: ONE adjust trident per repo. -# -# Failure-mode focus: adjust catches cumulative-small-drift patterns -# (E2 cosmetic churn accumulating into real regression, F2 context -# erosion causing gradual parameter drift). Where must flags "broken -# now", adjust flags "drifting toward broken". - -let base_k9 = import "../k9/template-hunt.k9.ncl" in -let base = import "../_base.ncl" in - -{ - pedigree = base_k9.pedigree_schema & { - contractile_verb = "adjust", - paired_xfile = "../adjust/Adjustfile.a2ml", - paired_runner = "../adjust/adjust.ncl", - - tier = 'Yard, - authority = 'advisory, - - metadata = { - name = "adjust-k9", - version = "1.0.0", - description = "Drift-tolerance + corrective-action runner. Fifth trident instance. First (Yard, advisory) authority pattern.", - paired_xfile = "Adjustfile.a2ml", - paired_runner = "adjust.ncl", - author = "Jonathan D.A. Jewell ", - }, - - security = { - leash = 'Yard, - trust_level = "tolerance measurement + declared auto-fix", - allow_network = false, - allow_filesystem_write_conditional = true, # auto_fix_when_available may edit - allow_subprocess = true, - probe_scope = 'measurement_plus_declared_fix, - }, - }, - - variance_schema = { - entry_id | String, - reason | String, - approved_by | String, - scope | String, - expires | String, - review_notes | String | optional, - # adjust-specific: which tolerance band the variance widens - tolerance_band_widened | String, - widened_to_value | String, - }, - - execution = { - triggers = [ 'session_close, 'on_demand, 'pre_push ], - - per_tolerance = { - measure_drift = true, - record_outcome = true, - respect_variance = true, - # adjust-specific authority: tolerance exceeded → warn, try - # auto-fix if declared, then continue. Never blocks. - on_exceeded = 'warn_and_attempt_fix, - on_auto_fix_applied = 'record_and_continue, - on_auto_fix_unavailable = 'record_as_advisory_drift, - # Cumulative-drift detection (adjust's specialty) - track_drift_trend_over_sessions = true, - flag_accelerating_drift = true, - }, - - evidence_sinks = [ - { kind = 'verisimdb, table = "contractile_executions", - schema = "contractile_execution_v1", - aux_tables = [ "adjust_drift_history" ] }, - { kind = 'drift_log, path = ".machine_readable/6a2/DRIFT.a2ml", - append_only = true }, - ], - - on_close = { - re_measure_all_tolerances = true, - diff_against_last_ratification = true, - emit_drift_entries_for_tolerance_exceeded = true, - surface_expired_variances = true, - surface_accelerating_drift = true, - # adjust is advisory — does NOT block session close. - block_session_close_on_any_drift = false, - }, - - on_open = { - render_summary = 'plain_language, - include_drift_log_from_last_close = true, - include_active_variances = true, - include_recent_anchors = true, - anchor_lookback_weeks = 8, - include_tolerance_trend_summary = true, - - negotiation = { - required = true, - ai_required_inputs = [ - 'timeline_realism, - 'industry_standards, - 'audience_feasibility, - 'resulting_invariants, - 'ecosystem_dependencies, - ], - user_engagement_required = true, - user_engagement_mode = 'per_input_response, - specification_translation = { - ai_produces_spec_form = true, - user_reviews_in_domain_language = true, - schema_authoring_is_ai_responsibility = true, - translation_faithfulness_auditable = true, - }, - }, - - accountability_pledge = { - required = true, - parties = [ - { - role = 'user, - pledge = "I have reviewed the tolerance bands and corrective actions. I accept accountability for reviewing drift warnings rather than muting them, and for re-tuning tolerances via amendment when the intended operating envelope changes.", - signature_required = true, - }, - { - role = 'ai_agent, - pledge = "I will surface tolerance breaches and accelerating-drift patterns at session close; I will propose corrective actions rather than widening tolerances silently; I will require amendment for legitimate tolerance re-tuning, not quiet band-widening.", - signature_required = true, - }, - ], - signed_record_destination = ".machine_readable/6a2/ratification-.a2ml", - must_precede_work = true, - }, - - ratification_record_shape = { - includes_negotiation_transcript = true, - includes_both_pledges = true, - includes_tolerance_bands_snapshot = true, - signed = true, - dated = true, - session_id = 'required, - contract_hash = 'required, - }, - }, - }, - - failure_mode_defenses = [ - 'A1_enthusiasm_capture, - 'C3_helpfulness_inflation, # helpful additions surfaced if they widen tolerances silently - 'C4_modernization_drift, - 'E2_cosmetic_churn, # adjust tracks cumulative churn - 'F2_context_window_erosion, # parameter drift across sessions detected - ], -} diff --git a/.machine_readable/contractiles/adjust/adjust.manifest.a2ml b/.machine_readable/contractiles/adjust/adjust.manifest.a2ml deleted file mode 100644 index f28f94d..0000000 --- a/.machine_readable/contractiles/adjust/adjust.manifest.a2ml +++ /dev/null @@ -1,47 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# adjust.manifest.a2ml — Trident coherence manifest for the adjust verb. -# Author: Jonathan D.A. Jewell -# -# Fifth trident instance. First (Yard, advisory) authority pattern — -# complements the (Hunt, blocking) triple (must + trust + bust) and -# the (Hunt, reporting) north-star (intend). - ---- -trident_version = "1.0.0" -verb = "adjust" -semantics = "drift tolerances + corrective actions" -cardinality = "one per repo" -authority = "advisory (continue-with-warnings)" - -[[files]] -role = "declaration" -path = "Adjustfile.a2ml" -sha256 = "pending-first-verify" -size_bytes = "pending-first-verify" - -[[files]] -role = "runner" -path = "adjust.ncl" -sha256 = "pending-first-verify" -size_bytes = "pending-first-verify" - -[[files]] -role = "k9_component" -path = "adjust.k9.ncl" -sha256 = "pending-first-verify" -size_bytes = "pending-first-verify" - -[cross_refs] -runner_paired_xfile = "Adjustfile.a2ml" -k9_paired_xfile = "../adjust/Adjustfile.a2ml" -k9_paired_runner = "../adjust/adjust.ncl" - -[signed_by] -user = "Jonathan D.A. Jewell" -date = "2026-04-18" -context = "adjust trident — fifth Trident instance. First (Yard, advisory) authority pattern. Specialises in cumulative-drift catchment — tolerance bands + trend tracking + auto-fix-where-declared." - -[[history]] -date = "2026-04-18" -event = "trident-born" -note = "Adjustfile.a2ml and adjust.ncl pre-existed. This manifest + adjust.k9.ncl complete the trident. Exercises the Yard tier + advisory authority for the first time; on_exceeded = 'warn_and_attempt_fix rather than 'fail. adjust-specific track_drift_trend_over_sessions + flag_accelerating_drift." diff --git a/.machine_readable/contractiles/adjust/adjust.ncl b/.machine_readable/contractiles/adjust/adjust.ncl deleted file mode 100644 index d6c24f0..0000000 --- a/.machine_readable/contractiles/adjust/adjust.ncl +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Adjust — accessibility runner -# -# Pairs with: Adjustfile.a2ml (same directory) -# Verb: adjust -# Semantics: accessibility compliance (WCAG 2.1 AA baseline). Gating where -# a deterministic fix exists; advisory where human review needed. -# CLI: `contractile adjust check` → run all probes, list violations -# `contractile adjust fix` → apply deterministic fixes where defined -# -# Anything else in this directory is human-only notes/archive; machines ignore. -# -# Base: ../_base.ncl provides pedigree_schema, run_defaults, probe_schema. -# See: docs/CONTRACTILE-SPEC.adoc - -let base = import "../_base.ncl" in - -{ - pedigree = base.pedigree_schema & { - contractile_verb = "adjust", - semantics = "accessibility compliance", - security = { - leash = 'Kennel, - trust_level = "fixes allowed where deterministic", - allow_network = false, - allow_filesystem_write = true, # `adjust fix` may write (deterministic patches only) - allow_subprocess = true, - }, - metadata = { - name = "adjust-runner", - version = "1.0.0", - description = "Evaluates accessibility requirements from Adjustfile.a2ml. Fixes deterministic items; flags the rest for human review.", - paired_xfile = "Adjustfile.a2ml", - author = "Jonathan D.A. Jewell ", - }, - }, - - schema = { - requirements - | Array { - id | String, - description | String, - # TODO: migrate to base.probe_schema (structured probe) when CLI supports it - probe | String, - # status_core values: 'declared, 'verified, 'failing; adjust adds 'partial - status | [| 'declared, 'partial, 'verified, 'failing |] | default = 'declared, - compliance | String | optional, # e.g. "WCAG 2.1 AA" - notes | String | optional, - fix | String | optional, # deterministic fix command (optional) - }, - }, - - # Runner behaviour — inherits from base.run_defaults. - # adjust is advisory (continue-with-warnings) not a hard gate. - # auto_fix_when_available is adjust-specific. - run = base.run_defaults & { - on_any_fail = "continue-with-warnings", # accessibility is progress-tracked, not a hard gate by default - report_format = "a2ml", - emit_summary = true, - auto_fix_when_available = true, - }, -} diff --git a/.machine_readable/contractiles/bust/Bustfile.a2ml b/.machine_readable/contractiles/bust/Bustfile.a2ml deleted file mode 100644 index 86e271f..0000000 --- a/.machine_readable/contractiles/bust/Bustfile.a2ml +++ /dev/null @@ -1,28 +0,0 @@ -// Bustfile.a2ml — meta-repo bust contractile (breakage / rollback) -// SPDX-License-Identifier: MPL-2.0 - -Bust { - name: "rsr-template-repo" - version: "1.0.0" - description: "Rollback procedures when something breaks in the meta-repo" - - scenarios: { - "bad-pointer-bump": "git revert in meta-repo; child repo itself untouched" - "submodule-pointer-points-at-missing-sha": "git submodule update --init --checkout resets child to parent-recorded SHA; OR revert the stale bump commit" - "submodule-orphan-after-local-only-commit": "roll back locally with git reset to before the stranded commit; fix remote situation before re-attempting" - "accidental-private-repo-content-leaked-to-public-submodule": "hard-rotate the leaked secret immediately; git-filter-repo or BFG on the submodule's own history; public re-publication only after rotation complete" - } - - escalation-ladder: [ - "1. revert the meta-repo commit (reversible, low blast radius)", - "2. reset the local submodule clone (affects only local workspace)", - "3. force-push to main — PROHIBITED without explicit user confirmation (violates branch protection)", - "4. registry-level (delete/archive the GitHub repo) — human-only action, never by AI" - ] - - backup-points: [ - "GitHub serves as the durable backup for every submodule's own history", - "Meta-repo history on origin/main is the durable backup for pointer state", - "Local backup tags (backup/pre--) retained on risky rewrites" - ] -} diff --git a/.machine_readable/contractiles/bust/bust.ncl b/.machine_readable/contractiles/bust/bust.ncl deleted file mode 100644 index fc8cb8c..0000000 --- a/.machine_readable/contractiles/bust/bust.ncl +++ /dev/null @@ -1,66 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Bust — error-handling / failure-recovery runner -# -# Pairs with: Bustfile.a2ml (same directory) -# Verb: bust -# Semantics: every declared failure mode must have a recovery path that has -# been exercised. Runner injects failures (via declared probes) -# and verifies the recovery path works. Hard gate on any -# failure-mode with missing or broken recovery. -# CLI: `contractile bust check` → list failure modes + recovery status -# `contractile bust drill` → inject declared failures, verify recovery -# -# Anything else in this directory is human-only notes/archive; machines ignore. -# -# Base: ../_base.ncl provides pedigree_schema, run_defaults, probe_schema. -# See: docs/CONTRACTILE-SPEC.adoc - -let base = import "../_base.ncl" in - -{ - pedigree = base.pedigree_schema & { - contractile_verb = "bust", - semantics = "error handling + failure recovery", - security = { - leash = 'Kennel, - trust_level = "controlled failure injection; scoped to system-under-test", - allow_network = false, - allow_filesystem_write = true, # drills may write transient state (tmp dirs, test DBs) - allow_subprocess = true, - injection_scope = "system-under-test-only", - }, - metadata = { - name = "bust-runner", - version = "1.0.0", - description = "Exercises declared failure modes and verifies recovery paths. Hard-gates on any failure mode without working recovery.", - paired_xfile = "Bustfile.a2ml", - author = "Jonathan D.A. Jewell ", - }, - }, - - schema = { - failure_modes - | Array { - id | String, - description | String, - class | [| 'network, 'disk_full, 'oom, 'timeout, 'partial_write, 'panic, 'crash, 'rollback, 'concurrency |], - # TODO: migrate to base.probe_schema (structured probe) when CLI supports it - injection_probe | String, # command that deterministically causes this failure - # TODO: migrate to base.probe_schema (structured probe) when CLI supports it - recovery_probe | String, # command that verifies recovery (exit 0 = recovered) - expected_recovery_time_seconds | Number | default = 30, - # status_core values: 'declared, 'verified, 'failing; bust adds 'drilled - status | [| 'declared, 'drilled, 'verified, 'failing |] | default = 'declared, - notes | String | optional, - }, - }, - - # Runner behaviour — inherits from base.run_defaults. - # bust adds record_recovery_times for performance tier feeding. - run = base.run_defaults & { - on_any_fail = "exit-nonzero", # missing or broken recovery blocks merge - report_format = "a2ml", - emit_summary = true, - record_recovery_times = true, # feeds the performance tier - }, -} diff --git a/.machine_readable/contractiles/dust/Dustfile.a2ml b/.machine_readable/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index be38a8c..0000000 --- a/.machine_readable/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,44 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile — Cleanup and hygiene contract -# Author: Jonathan D.A. Jewell - -@abstract: -What should be cleaned up or removed from this repository. -These are housekeeping items, not blockers. -@end - -## Stale Files - -### no-stale-snapshots -- description: No dated status/completion files in root -- run: "! ls *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md 2>/dev/null | head -1 | grep -q ." -- severity: info - -### no-ai-djot -- description: AI.djot is superseded by 0-AI-MANIFEST.a2ml -- run: test ! -f AI.djot -- severity: warning - -### no-next-steps -- description: NEXT_STEPS.md superseded by ROADMAP -- run: test ! -f NEXT_STEPS.md -- severity: info - -## Build Artifacts - -### no-tracked-artifacts -- description: No build artifacts tracked in git -- run: "! git ls-files lib/bs/ lib/ocaml/ target/release/ _build/ 2>/dev/null | head -1 | grep -q ." -- severity: warning - -## Format Duplicates - -### no-duplicate-contributing -- description: Only one CONTRIBUTING format (keep .md) -- run: "! (test -f CONTRIBUTING.md && test -f CONTRIBUTING.adoc)" -- severity: warning - -### no-duplicate-readme -- description: Only one README format -- run: "! (test -f README.md && test -f README.adoc && [ $(wc -l < README.md) -gt 5 ])" -- severity: warning diff --git a/.machine_readable/contractiles/dust/dust.ncl b/.machine_readable/contractiles/dust/dust.ncl deleted file mode 100644 index 36aa89b..0000000 --- a/.machine_readable/contractiles/dust/dust.ncl +++ /dev/null @@ -1,66 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dust — exnovation / code-removal runner -# -# Pairs with: Dustfile.a2ml (same directory) -# Verb: dust -# Semantics: exnovation. Identifies code, docs, files, dependencies that are -# candidates for REMOVAL. Advisory by default; can be flipped to -# active delete via `contractile dust sweep --apply`. -# CLI: `contractile dust find` → list removal candidates -# `contractile dust sweep` → dry-run removals -# `contractile dust sweep --apply` → actually delete (gated) -# -# Anything else in this directory is human-only notes/archive; machines ignore. -# -# Base: ../_base.ncl provides pedigree_schema, run_defaults, probe_schema. -# See: docs/CONTRACTILE-SPEC.adoc - -let base = import "../_base.ncl" in - -{ - pedigree = base.pedigree_schema & { - contractile_verb = "dust", - semantics = "exnovation / removal", - security = { - leash = 'Kennel, - trust_level = "proposes deletion; --apply required to execute", - allow_network = false, - allow_filesystem_write = true, # --apply mode writes (deletes) - allow_subprocess = true, - destructive_mode_requires_flag = "--apply", - }, - metadata = { - name = "dust-runner", - version = "1.0.0", - description = "Identifies and optionally removes exnovation targets listed in Dustfile.a2ml. Destructive mode gated behind --apply.", - paired_xfile = "Dustfile.a2ml", - author = "Jonathan D.A. Jewell ", - }, - }, - - schema = { - removal_candidates - | Array { - id | String, - description | String, - target | String, # file / path / symbol / dep name - reason | String, # why it's a removal candidate - # TODO: migrate to base.probe_schema (structured probe) when CLI supports it - probe | String | optional, # command that confirms it's still removable - # dust has a non-standard status progression (no 'verified): - # 'declared → 'proposed → 'approved → 'removed - status | [| 'declared, 'proposed, 'approved, 'removed |] | default = 'declared, - approver | String | optional, # who signed off (for 'approved / 'removed) - notes | String | optional, - }, - }, - - # Runner behaviour — inherits from base.run_defaults. - # dust is advisory; apply_requires_approval is dust-specific. - run = base.run_defaults & { - on_any_fail = "continue-with-warnings", - report_format = "a2ml", - emit_summary = true, - apply_requires_approval = true, # only 'approved items get swept, even with --apply - }, -} diff --git a/.machine_readable/contractiles/intend/Intentfile.a2ml b/.machine_readable/contractiles/intend/Intentfile.a2ml deleted file mode 100644 index 088cb23..0000000 --- a/.machine_readable/contractiles/intend/Intentfile.a2ml +++ /dev/null @@ -1,123 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Intentfile (A2ML Canonical) — north-star contractile -# Author: Jonathan D.A. Jewell -# -# Paired runner: intend.ncl -# Verb: intend -# Semantics: North-star contractile. Declares BOTH concrete committed -# next-actions AND horizon aspirations the project wishes to -# become. Two sections share one file because they answer -# the same question at different ranges: -# [[intents]] — "we WILL do this; track progress" -# status: declared → in_progress → done | -# deferred | retired -# [[wishes]] — "we WISH this were true; revisit later" -# status: declared → in_progress → achieved | -# abandoned -# grouped by horizon: near / mid / far. -# Non-gating — this is a report, not a gate. See the `must` -# contractile for hard gates. -# -# History: The `lust/` sibling contractile was deprecated 2026-04-18; -# its `[[wishes]]` semantics were absorbed here so the -# project's aspirational horizon and its committed -# next-actions live together in one north-star view. -# -# CLI: -# contractile intend run → print status table (both sections) -# contractile intend progress → diff declared-vs-observed for intents -# contractile intend horizon → group wishes by near/mid/far -# -# ADOPTER INSTRUCTIONS: Replace the example intents and wishes below with -# project-specific content. Each intent should have a probe command that -# returns exit 0 when the intent is done. Wishes are report-only and never -# run a probe. Omit either section if not applicable; don't delete the file. - -@abstract: -Seed Intentfile for the standards contractile template set. Demonstrates -both sections: concrete intents with probes and horizon-grouped wishes. -Adopters should replace these with real project commitments and aspirations. -@end - -## Purpose - -The standards contractile template set commits to the intents declared -below and points at the wishes on the horizon. The primary goal is to -keep the contractile system complete, documented, and machine-verifiable -so repos copying this template inherit a working operational framework. - -## Anti-Purpose - -This Intentfile is NOT: -- A feature roadmap (that belongs in the project ROADMAP.adoc) -- A hard gate (intend never blocks; see the `must` contractile for gates) - -## If In Doubt - -If you are unsure whether a change is in scope, ask. Sensitive areas: -ABI definitions, license headers, CI workflows. - -## Committed Next-Actions - -[[intents]] -id = "contractile-spec-written" -description = "CONTRACTILE-SPEC.adoc normative spec exists and is up-to-date" -probe = "test -f docs/CONTRACTILE-SPEC.adoc" -status = "done" -notes = "Spec written and committed 2026-04-17" - -[[intents]] -id = "base-ncl-extracted" -description = "_base.ncl shared contractile base extracted and all 6 active verb runners import it" -probe = "grep -l 'import.*_base.ncl' .machine_readable/contractiles/must/must.ncl .machine_readable/contractiles/trust/trust.ncl .machine_readable/contractiles/bust/bust.ncl .machine_readable/contractiles/adjust/adjust.ncl .machine_readable/contractiles/dust/dust.ncl .machine_readable/contractiles/intend/intend.ncl | wc -l | xargs test 6 -eq" -status = "done" -notes = "Base extracted and all runners refactored 2026-04-17; lust/ deprecated 2026-04-18, count reduced 7→6." - -[[intents]] -id = "index-registry-present" -description = "INDEX.a2ml registry listing all active verbs exists in the contractiles directory" -probe = "test -f .machine_readable/contractiles/INDEX.a2ml" -status = "done" -notes = "Registry created 2026-04-17" - -[[intents]] -id = "lust-dir-retired" -description = "Deprecated lust/ dir removed; wishes semantics absorbed into Intentfile" -probe = "! test -d .machine_readable/contractiles/lust" -status = "done" -notes = "Retired 2026-04-18 per user direction — name had negative associations; north-star meaning always belonged here." - -[[intents]] -id = "probe-schema-migration" -description = "All verb runner files migrate probe fields from String to structured probe_schema" -probe = "! grep -r 'probe | String' .machine_readable/contractiles/ --include='*.ncl'" -status = "declared" -notes = "DEFERRED — breaking change requiring CLI support. Legacy String probes kept with TODO comments. See CONTRACTILE-SPEC.adoc Migration Notes." -target_date = "2026-Q3" - -## Horizon Aspirations (wishes) - -# Wishes are non-probeable project horizons. They exist to make the -# aspiration axis visible without polluting the commitment queue. - -[[wishes]] -id = "example-near-wish" -description = "Describe one aspirational feature/property the project intends toward in the near term" -horizon = "near" -why = "Why this would matter; the value of it being true" -status = "declared" -notes = "Optional human notes; leave empty or delete" - -[[wishes]] -id = "example-mid-wish" -description = "Aspirational item on the one-to-two release horizon" -horizon = "mid" -why = "The impact of reaching it" -status = "declared" - -[[wishes]] -id = "example-far-wish" -description = "Multi-year horizon state" -horizon = "far" -why = "Why we still bother pointing at it" -status = "declared" diff --git a/.machine_readable/contractiles/intend/intend.k9.ncl b/.machine_readable/contractiles/intend/intend.k9.ncl deleted file mode 100644 index 5b0c295..0000000 --- a/.machine_readable/contractiles/intend/intend.k9.ncl +++ /dev/null @@ -1,250 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# intend.k9.ncl — K9 trust-tier component of the intend trident -# Author: Jonathan D.A. Jewell -# -# Pairs with: Intentfile.a2ml (declaration) + intend.ncl (runner). -# Trident completeness is a hard precondition — a repo shipping -# Intentfile without this file AND its runner is an invalid trident; -# the contractile CLI's verify gate refuses partial publication. -# -# Verb: intend (north star — commitments + aspirations) -# Tier: Hunt (capability: subprocess probes may shell out) -# Authority: reporting (never blocks; drift-log only) -# -# Cardinality: ONE intend trident per repo (see feedback_contractile_ -# layout_rules.md). ANCHOR.a2ml is the sole multi-instance exception — -# it is NOT a verb contractile. -# -# Design commitments baked in (see memory trail 2026-04-18 for full -# context; key files referenced by name in annotations below): -# * α two-axis (tier × authority) — structurally separate capability -# from authority so "Hunt tier = can override" is impossible. -# * Variance schema first-class, not comment markers -# (feedback_audit_tool_suppression_design.md — structural > markers). -# * Sessional drift detection hooks (on_close, on_open). -# * Ratification at session open; drift log at session close. -# * Evidence sinks: VeriSimDB (queryable) + 6a2/DRIFT.a2ml (repo-local). -# * Failure-mode defenses cross-referenced to the AI failure catalog. - -let base_k9 = import "../k9/template-hunt.k9.ncl" in -let base = import "../_base.ncl" in - -{ - pedigree = base_k9.pedigree_schema & { - contractile_verb = "intend", - paired_xfile = "../intend/Intentfile.a2ml", - paired_runner = "../intend/intend.ncl", - - # α two-axis declaration — capability × authority. - # intend is Hunt-capable (probes shell out) but reporting-authority - # (never blocks). must/trust/bust will declare (Hunt, blocking); - # adjust/dust will declare (Yard, advisory). Splitting the axes - # means "I'm Hunt-tier so I can override everything" is structurally - # impossible — authority is a separate field. - tier = 'Hunt, - authority = 'reporting, - - metadata = { - name = "intend-k9", - version = "2.0.0", # 1.0.0 (2026-04-18 AM): initial trident. - # 2.0.0 (2026-04-18 PM): negotiation + - # accountability + plain-language-translation - # schema baked into on_open — prerequisite for - # the adversarial Gemini+Copilot drift pilot. - description = "Executes Intentfile probes + emits drift log. Non-gating; reporting authority only. on_open hook implements negotiation-ratification-accountability protocol.", - paired_xfile = "Intentfile.a2ml", - paired_runner = "intend.ncl", - author = "Jonathan D.A. Jewell ", - }, - - security = { - leash = 'Hunt, - trust_level = "subprocess + filesystem-read", - allow_network = false, - allow_filesystem_write = false, # evidence sinks are indirected - allow_subprocess = true, - }, - }, - - # ------------------------------------------------------------------- - # Variance schema — P-shape scoped exceptions per entry. - # A variance suppresses a specific intent's or wish's obligation for a - # reason, with approver + expiry. Expired variance = effective - # re-imposition of the obligation. Unmet intent without a variance = - # drift, logged to the drift log. - # Per user 2026-04-18: variances are structural, not magic-comment - # markers — markers are gameable. - # ------------------------------------------------------------------- - variance_schema = { - entry_id | String, # which intent/wish id the variance applies to - reason | String, - approved_by | String, - scope | String, # path glob | session-id | "until-" - expires | String, # absolute date or condition - review_notes | String | optional, - }, - - # ------------------------------------------------------------------- - # Execution policy - # ------------------------------------------------------------------- - execution = { - # When the component runs. - # session_close is mandatory (the "picked up sessionally" check). - triggers = [ 'session_close, 'on_demand, 'pre_push ], - - # Per-intent execution. - per_intent = { - run_probe = true, - record_outcome = true, - respect_variance = true, # active variance suppresses failure - on_unmet = 'log_drift, # never 'fail — authority = reporting - }, - - # Per-wish execution (wishes are non-probeable; horizon-group only). - per_wish = { - run_probe = false, - emit_horizon_summary = true, - # Vertical alignment soft-check per user_6a2_is_contractile_ought.md: - # highest-level alignment is meta ↔ north-star (soft), not hard gate. - check_alignment_with_META = true, - }, - - # Evidence sinks — BOTH written, every execution. - # VeriSimDB = queryable machine record (feedback_verisimdb_policy.md). - # 6a2/DRIFT.a2ml = repo-local append-only drift log (feedback_sessional_ - # drift_detection.md + user_6a2_is_contractile_ought.md descriptive role). - evidence_sinks = [ - { - kind = 'verisimdb, - table = "contractile_executions", - schema = "contractile_execution_v1", - }, - { - kind = 'drift_log, - path = ".machine_readable/6a2/DRIFT.a2ml", - append_only = true, - }, - ], - - # Session-close hook — the "picked up sessionally" requirement. - # Re-execute, diff against the last ratification, surface expired - # variances, emit drift entries for new failures. - on_close = { - re_execute_all_intents = true, - diff_against_last_ratification = true, - emit_drift_entries_for_new_failures = true, - surface_expired_variances = true, - }, - - # ----------------------------------------------------------------- - # Session-open hook — NEGOTIATION + RATIFICATION + ACCOUNTABILITY - # (user_contract_negotiation_and_accountability_pledge.md) - # (user_contractiles_agreed_at_session_start.md) - # - # Ratification is not passive acknowledgement; it is negotiation - # ending in an explicit accountability pledge from BOTH parties. - # Work cannot proceed before both pledges are on file. - # ----------------------------------------------------------------- - on_open = { - # --- Context presentation (pre-negotiation) --- - render_summary = 'plain_language, # metaphor-capture defense - include_drift_log_from_last_close = true, - include_active_variances = true, - include_recent_anchors = true, - anchor_lookback_weeks = 8, - - # --- Negotiation phase (five mandatory inputs) --- - # AI must surface all five before the user is asked to ratify. - # "Yes, and …" — not "yes". Missing any of the five = the - # negotiation is incomplete and work cannot proceed. - negotiation = { - required = true, # blank-cheque ratification refused - - # The five inputs the AI must contribute to the negotiation. - # Each is a structured field the agent is required to populate, - # not optional prose. See user_contract_negotiation_and_ - # accountability_pledge.md for the domain-language-rendering rule. - ai_required_inputs = [ - 'timeline_realism, # "this will take X; not Y" - 'industry_standards, # WCAG, ISO, OWASP, GDPR, licensing … - 'audience_feasibility, # real addressable user set - 'resulting_invariants, # what must/trust/adjust entries follow - 'ecosystem_dependencies, # libs, licences, threat-model implications - ], - - # User must actually engage with each input — not - # auto-approve. If user tries to skip ("just do it, I trust you") - # the system re-renders the obligations and requires the pledge. - user_engagement_required = true, - user_engagement_mode = 'per_input_response, - - # The AI does the specification-form work. The user reviews the - # rendering in domain language and accepts / amends / pushes back. - # User never has to author Nickel schemas or decide on type - # specificity — that is the AI's translation responsibility, - # with auditable faithfulness. - specification_translation = { - ai_produces_spec_form = true, - user_reviews_in_domain_language = true, - schema_authoring_is_ai_responsibility = true, - translation_faithfulness_auditable = true, - # Failure mode this closes: user is forced to learn spec-theory - # (type refinement, Nickel contract grammar) to ratify a contract - # — which drives users away from ratification entirely. - }, - }, - - # --- Accountability pledge (both parties, explicit) --- - # Not "I read it" — "I am answerable for this obligation". - # Both pledges are required before work proceeds; both are recorded. - accountability_pledge = { - required = true, - parties = [ - { - role = 'user, - pledge = "I have reviewed the obligations as negotiated; I accept accountability for meeting the declared invariants and for the audience/timeline/standards consequences surfaced in negotiation.", - signature_required = true, - }, - { - role = 'ai_agent, - pledge = "I will hold the user to the obligations as negotiated, including by surfacing drift at session close and refusing off-contract actions, even when the user is enthusiastic about them. If the user wishes to depart from the contract, I will require a variance or amendment, not silent acceptance.", - signature_required = true, - # Per user_contractile_is_contract_do_not_break.md — - # the AI is the holder of the line against enthusiasm drift. - }, - ], - signed_record_destination = ".machine_readable/6a2/ratification-.a2ml", - must_precede_work = true, - }, - - # --- Policy: ratification output --- - # The ratification record IS the negotiation transcript + the - # accountability pledge combined. One document; future-session - # ground-truth for "what was agreed, who is accountable". - ratification_record_shape = { - includes_negotiation_transcript = true, - includes_both_pledges = true, - signed = true, - dated = true, - session_id = 'required, - contract_hash = 'required, # pins what was actually signed - }, - }, - }, - - # ------------------------------------------------------------------- - # Failure-mode defenses — explicit cross-reference to the catalog - # (feedback_ai_failure_mode_catalog.md). New catalog entries that - # shift this verb's defenses must update this list, not narrative. - # ------------------------------------------------------------------- - failure_mode_defenses = [ - 'A1_enthusiasm_capture, # scope breach → drift log - 'A2_metaphor_capture, # render_summary = 'plain_language - 'A3_allegory_drift, # intents cite concrete obligations - 'C1_scope_creep, # feature-adjacent change needs intent_id - 'C3_helpfulness_inflation, # changes without intent_id flagged - 'C4_modernization_drift, # upgrade cannot cite intent → drift - 'D5_sycophancy, # ratification compares user framing vs contract - 'F1_across_session_forgetting, # on_open reads last-ratification record - ], -} diff --git a/.machine_readable/contractiles/intend/intend.manifest.a2ml b/.machine_readable/contractiles/intend/intend.manifest.a2ml deleted file mode 100644 index 5d932a6..0000000 --- a/.machine_readable/contractiles/intend/intend.manifest.a2ml +++ /dev/null @@ -1,73 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# intend.manifest.a2ml — Trident coherence manifest for the intend verb. -# Author: Jonathan D.A. Jewell -# -# Asserts: exactly three files constitute the intend trident; their -# content-hashes are pinned here; cross-references round-trip; no -# partial publication is permitted. -# -# The contractile CLI's `verify ` subcommand MUST: -# 1. Confirm all three listed files exist at the declared paths. -# 2. Compute each file's sha256 and match against the pinned value. -# 3. Follow each cross-reference and confirm the target file's -# reciprocal field points back. -# 4. Refuse the dir (exit non-zero) if any of 1–3 fails. -# -# This forecloses the failure mode where an agent publishes an A2ML -# declaration with no paired runner or K9 component — the trident is -# atomically complete or it is invalid. - ---- -trident_version = "1.0.0" -verb = "intend" -semantics = "north-star (commitments + aspirations)" -cardinality = "one per repo" - -## Files (three; exactly) - -[[files]] -role = "declaration" -path = "Intentfile.a2ml" -sha256 = "pending-first-verify" # populated on first `contractile verify intend` -size_bytes = "pending-first-verify" - -[[files]] -role = "runner" -path = "intend.ncl" -sha256 = "pending-first-verify" -size_bytes = "pending-first-verify" - -[[files]] -role = "k9_component" -path = "intend.k9.ncl" -sha256 = "pending-first-verify" -size_bytes = "pending-first-verify" - -## Cross-references (must round-trip) - -[cross_refs] -# Each runner/K9 component names its paired files; the CLI follows the -# links and asserts reciprocity. Any dangling or mismatched reference -# fails the verify gate. -runner_paired_xfile = "Intentfile.a2ml" -k9_paired_xfile = "../intend/Intentfile.a2ml" -k9_paired_runner = "../intend/intend.ncl" - -## Trident signing - -[signed_by] -user = "Jonathan D.A. Jewell" -date = "2026-04-18" -context = "intend trident pilot — first Trident instance in the estate; template for the remaining 5 verbs (must/trust/bust/adjust/dust) and for the 14 template-copy dirs." - -## Change log - -[[history]] -date = "2026-04-18" -event = "trident-born" -note = "intend/Intentfile.a2ml pre-existed (f380b62, lust absorption). This manifest + intend.k9.ncl complete the trident for the first time." - -[[history]] -date = "2026-04-18" -event = "negotiation-accountability-schema-landed" -note = "intend.k9.ncl on_open hook extended: five negotiation inputs (timeline/standards/audience/invariants/dependencies), both-parties accountability pledge, plain-language-translation policy (AI authors spec form, user reviews in domain language). K9 metadata version bumped 1.0.0 → 2.0.0. Prerequisite for the adversarial Gemini+Copilot drift pilot; intend is the hardest verb (abstract north-star) so baking the full protocol here first means simpler verbs (trust, must) can inherit the template." diff --git a/.machine_readable/contractiles/intend/intend.ncl b/.machine_readable/contractiles/intend/intend.ncl deleted file mode 100644 index 091b7f6..0000000 --- a/.machine_readable/contractiles/intend/intend.ncl +++ /dev/null @@ -1,81 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Intend — north-star runner (verb is `intend`, file is `Intentfile.a2ml`) -# -# Pairs with: Intentfile.a2ml (same directory) -# Verb: intend -# Semantics: Declares BOTH concrete committed next-actions ([[intents]]) and -# horizon aspirations ([[wishes]]). Not a gate — reports progress -# toward declared intents and lists wishes by horizon. -# Status progressions: -# intents: 'declared → 'in_progress → 'done | 'deferred | 'retired -# wishes: 'declared → 'in_progress → 'achieved | 'abandoned -# CLI: `contractile intend run` → print status table (both sections) -# `contractile intend progress` → diff declared-vs-observed (intents) -# `contractile intend horizon` → group wishes by near/mid/far -# -# History: Absorbed the deprecated `lust` contractile's [[wishes]] schema -# 2026-04-18. `lust/` dir removed estate-wide. -# -# Anything else in this directory is human-only notes/archive; machines ignore. -# -# Base: ../_base.ncl provides pedigree_schema, run_defaults, probe_schema. -# See: docs/CONTRACTILE-SPEC.adoc - -let base = import "../_base.ncl" in - -{ - pedigree = base.pedigree_schema & { - contractile_verb = "intend", - semantics = "north-star (commitments + aspirations)", - security = { - leash = 'Kennel, - trust_level = "read-only reporting", - allow_network = false, - allow_filesystem_write = false, - allow_subprocess = true, # probe commands may shell out (intents only; wishes never probe) - }, - metadata = { - name = "intend-runner", - version = "2.0.0", - description = "Reports progress toward committed next-actions and lists horizon aspirations. Non-gating. Absorbed `lust` semantics 2026-04-18.", - paired_xfile = "Intentfile.a2ml", - author = "Jonathan D.A. Jewell ", - }, - }, - - schema = { - intents - | Array { - id | String, - description | String, - # TODO: migrate to base.probe_schema (structured probe) when CLI supports it - probe | String | optional, # shell command that indicates done-ness - status | [| 'declared, 'in_progress, 'done, 'deferred, 'retired |] | default = 'declared, - notes | String | optional, - target_date | String | optional, - }, - wishes - | Array { - id | String, - description | String, - horizon | [| 'near, 'mid, 'far |] | default = 'mid, - why | String | optional, - status | [| 'declared, 'in_progress, 'achieved, 'abandoned |] | default = 'declared, - notes | String | optional, - } - | optional, - }, - - # Runner behaviour — inherits from base.run_defaults. - # intend never blocks; it is a report only. - # emit_diff is intent-specific (declared vs observed probes). - # emit_grouped_by_horizon renders wishes grouped by near/mid/far. - run = base.run_defaults & { - on_pass = "continue", - on_any_fail = "continue", # never blocks; it's a report - report_format = "a2ml", - emit_summary = true, - emit_diff = true, # declared vs observed (intents) - emit_grouped_by_horizon = true, # wishes grouped by horizon (absorbed from lust) - }, -} diff --git a/.machine_readable/contractiles/must/Mustfile.a2ml b/.machine_readable/contractiles/must/Mustfile.a2ml deleted file mode 100644 index 215c510..0000000 --- a/.machine_readable/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,69 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile — Physical state contract -# Author: Jonathan D.A. Jewell - -@abstract: -What MUST be true about this repository's files and configuration. -These are hard requirements — CI fails if any check fails. -@end - -## File Presence - -### license-present -- description: LICENSE file must exist -- run: test -f LICENSE -- severity: critical - -### readme-present -- description: README.adoc or README.md must exist -- run: test -f README.adoc || test -f README.md -- severity: critical - -### security-policy -- description: SECURITY.md must exist -- run: test -f SECURITY.md -- severity: critical - -### ai-manifest -- description: 0-AI-MANIFEST.a2ml must exist -- run: test -f 0-AI-MANIFEST.a2ml -- severity: critical - -### contributing -- description: CONTRIBUTING.md must exist (GitHub community health) -- run: test -f CONTRIBUTING.md -- severity: warning - -### editorconfig -- description: .editorconfig must exist -- run: test -f .editorconfig -- severity: warning - -## SPDX Compliance - -### spdx-headers -- description: All source files must have SPDX-License-Identifier -- run: "! find src/ -name '*.rs' -o -name '*.res' -o -name '*.idr' -o -name '*.zig' 2>/dev/null | head -20 | xargs grep -L 'SPDX-License-Identifier' 2>/dev/null | head -1 | grep -q ." -- severity: warning - -### no-agpl -- description: No AGPL-3.0 references in dotfiles -- run: "! grep -r 'AGPL-3.0' .gitignore .gitattributes .editorconfig 2>/dev/null | head -1 | grep -q ." -- severity: critical - -## Dangerous Patterns - -### no-believe-me -- description: No believe_me in Idris2 code -- run: "! grep -r 'believe_me' --include='*.idr' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-sorry -- description: No sorry in Lean code -- run: "! grep -r 'sorry' --include='*.lean' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-admitted -- description: No Admitted in Coq code -- run: "! grep -r 'Admitted' --include='*.v' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical diff --git a/.machine_readable/contractiles/must/must.ncl b/.machine_readable/contractiles/must/must.ncl deleted file mode 100644 index 47509d3..0000000 --- a/.machine_readable/contractiles/must/must.ncl +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Must — invariants runner -# -# Pairs with: Mustfile.a2ml (same directory) -# Verb: must (invariant assertion) -# Semantics: every check is a hard gate. A single failure blocks merge. -# CLI: `contractile must run` → reads Mustfile.a2ml, evaluates each check, -# emits pass/fail verdict per item, exits non-zero if any failed. -# -# This file is the *schema + runner* that the `contractile` CLI (at -# /var/mnt/eclipse/repos/reposystem/contractiles/cli/) loads alongside -# Mustfile.a2ml. Anything else in this directory is human-only notes/archive -# and MUST be ignored by machines. -# -# Base: ../_base.ncl provides pedigree_schema, run_defaults, probe_schema. -# See: docs/CONTRACTILE-SPEC.adoc - -let base = import "../_base.ncl" in - -{ - pedigree = base.pedigree_schema & { - contractile_verb = "must", - semantics = "invariant", - security = { - leash = 'Kennel, - trust_level = "read-only verification", - allow_network = false, - allow_filesystem_write = false, - allow_subprocess = true, # verification probes may shell out (e.g. grep, test -f) - }, - metadata = { - name = "must-runner", - version = "1.0.0", - description = "Evaluates every invariant in the adjacent Mustfile.a2ml as a hard gate.", - paired_xfile = "Mustfile.a2ml", - author = "Jonathan D.A. Jewell ", - }, - }, - - # Contract schema — the shape every Mustfile.a2ml must satisfy. - # Used by `contractile must typecheck Mustfile.a2ml`. - schema = { - invariants - | Array { - id | String, - description | String, - # TODO: migrate to base.probe_schema (structured probe) when CLI supports it - probe | String, # shell command; exit 0 = pass - # status_core values: 'declared, 'verified, 'failing - status | [| 'declared, 'verified, 'failing |] | default = 'declared, - severity | [| 'critical, 'high, 'medium |] | default = 'critical, - notes | String | optional, - fix | String | optional, - }, - }, - - # Runner behaviour — consumed by the contractile CLI dispatcher. - # Inherits from base.run_defaults; on_any_fail is the hard-gate default. - run = base.run_defaults & { - on_any_fail = "exit-nonzero", # hard gate - report_format = "a2ml", # emit a2ml report, not json - emit_summary = true, - }, -} diff --git a/.machine_readable/contractiles/trust/Trustfile.a2ml b/.machine_readable/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index 2e583a3..0000000 --- a/.machine_readable/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,74 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile — Integrity and provenance verification -# Author: Jonathan D.A. Jewell - -@abstract: -Integrity invariants for this repository. These verify that the repo -has not been tampered with, secrets are not leaked, and provenance -is traceable. -@end - -## Secrets - -### no-secrets-committed -- description: No credential files in repo -- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production -- severity: critical - -### no-private-keys -- description: No private key files committed -- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-tokens-in-source -- description: No hardcoded API tokens in source -- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -## Provenance - -### author-correct -- description: Git author matches expected identity -- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" -- severity: warning - -### license-content -- description: LICENSE contains expected identifier -- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE -- severity: warning - -## Container Security - -### container-images-pinned -- description: Containerfile uses pinned base images -- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile -- severity: warning - -### no-dockerfile -- description: No Dockerfile (use Containerfile) -- run: test ! -f Dockerfile -- severity: warning - -## Dangerous Patterns - -### no-believe-me -- description: No believe_me, assert_total, Admitted, sorry, unsafeCoerce, Obj.magic -- run: "! grep -rE 'believe_me|assert_total|Admitted|sorry|unsafeCoerce|Obj\\.magic' --include='*.idr' --include='*.lean' --include='*.v' --include='*.ml' --include='*.hs' . 2>/dev/null | head -1 | grep -q ." -- severity: critical - -### no-unsafe-without-comment -- description: All unsafe blocks in Rust must have SAFETY comments -- run: "! grep -B1 'unsafe {' --include='*.rs' -r . 2>/dev/null | grep -v SAFETY | grep 'unsafe {' | head -1 | grep -q ." -- severity: warning - -## Service Security (if applicable) - -### localhost-only-bindings -- description: Backend services bind to 127.0.0.1 only -- run: "! grep -rE 'bind\\(\"0\\.0\\.0\\.0' --include='*.rs' --include='*.ex' --include='*.ts' . 2>/dev/null | head -1 | grep -q ." -- severity: critical - -### coordination-file-permissions -- description: Coordination/session files are owner-only (0600) -- run: test ! -d ~/.claude/coordination || find ~/.claude/coordination -type f ! -perm 600 2>/dev/null | wc -l | grep -q '^0$' -- severity: warning diff --git a/.machine_readable/contractiles/trust/trust.ncl b/.machine_readable/contractiles/trust/trust.ncl deleted file mode 100644 index 21b335c..0000000 --- a/.machine_readable/contractiles/trust/trust.ncl +++ /dev/null @@ -1,88 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trust — security + safe-hacking runner -# -# Pairs with: Trustfile.a2ml (same directory) -# Verb: trust -# Semantics: integrity / provenance / security verification PLUS a declared -# "safe hacking + testing" section — authorised offensive probes -# (pen-test harness runs, chaos-engineering probes) scoped to the -# repo under test, NEVER touching external systems. -# CLI: `contractile trust verify` → run all verifications (read-only) -# `contractile trust probe` → run declared safe-hacking probes -# -# Anything else in this directory is human-only notes/archive; machines ignore. -# -# Base: ../_base.ncl provides pedigree_schema, run_defaults, probe_schema. -# See: docs/CONTRACTILE-SPEC.adoc - -let base = import "../_base.ncl" in - -{ - pedigree = base.pedigree_schema & { - contractile_verb = "trust", - semantics = "security + provenance + safe-hacking", - security = { - leash = 'Kennel, - trust_level = "verification + authorised-probe", - allow_network = false, # verifications are offline by default - allow_filesystem_write = false, # trust writes NOTHING - allow_subprocess = true, - authorised_probes_only = true, # probe section must explicitly list allowed targets - }, - metadata = { - name = "trust-runner", - version = "1.0.0", - description = "Security + provenance verifications plus authorised safe-hacking probes. All probes are scoped to the repo under test; never hits external systems.", - paired_xfile = "Trustfile.a2ml", - author = "Jonathan D.A. Jewell ", - }, - }, - - schema = { - verifications - | Array { - id | String, - description | String, - # TODO: migrate to base.probe_schema (structured probe) when CLI supports it - probe | String, # read-only; exit 0 = pass - # status_core values: 'declared, 'verified, 'failing - status | [| 'declared, 'verified, 'failing |] | default = 'declared, - # trust uses all four severity levels (from base.severity_core) - severity | [| 'critical, 'high, 'medium, 'low |] | default = 'high, - notes | String | optional, - }, - - # Safe-hacking + testing section (added 2026-04-17 per user direction). - # Each probe here is an ACTIVELY EXECUTED test — fuzz runs, chaos probes, - # auth-bypass attempts, injection tests. All scoped to the current repo. - safe_hacking - | { - scope | String, # e.g. "this-repo-only" / "localhost" - allowed_probe_classes - | Array [| 'fuzz, 'property_test, 'chaos, 'auth_bypass, 'injection, 'timing |] - | default = [], - probes - | Array { - id | String, - class | [| 'fuzz, 'property_test, 'chaos, 'auth_bypass, 'injection, 'timing |], - description | String, - # TODO: migrate to base.probe_schema (structured probe) when CLI supports it - probe | String, # command to run the probe - expected_outcome | [| 'probe_blocks_attempt, 'probe_finds_no_issue |], - timeout_seconds | Number | default = 300, - notes | String | optional, - } - | default = [], - } - | default = { scope = "this-repo-only", allowed_probe_classes = [], probes = [] }, - }, - - # Runner behaviour — inherits from base.run_defaults. - # trust has an extra field for unexpected safe-hacking outcomes. - run = base.run_defaults & { - on_any_fail = "exit-nonzero", # hard gate on verifications - safe_hacking_on_unexpected_outcome = "exit-nonzero", # probe found what it shouldn't = block - report_format = "a2ml", - emit_summary = true, - }, -} diff --git a/affinescript/.machine_readable/ADJUST.contractile b/affinescript/.machine_readable/ADJUST.contractile deleted file mode 100644 index d191304..0000000 --- a/affinescript/.machine_readable/ADJUST.contractile +++ /dev/null @@ -1,38 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; ADJUST.contractile — Accessibility instance for AffineScript -; Compiler/LSP accessibility — subset of WCAG 2.2 AA applicable to developer tools. - -(adjust-contractile - (version "1.0.0") - (repo "nextgen-languages/affinescript") - (standard "CLI-accessible (WCAG 2.2 AA where applicable to developer tools)") - - (invariants - ; ── CLI output ── - (adjust "all error messages include file:line:col — not just a message") - (adjust "error messages use plain language — not jargon codes alone") - (adjust "no information conveyed by ANSI colour alone (symbol + colour)") - (adjust "output safe in non-TTY (piped to file or CI log)") - (adjust "all subcommands support --help with plain-text output") - (adjust "exit codes documented in QUICKSTART-USER.adoc") - - ; ── Affine type errors ── - (adjust "affine/linear violation messages name the variable and say why it is consumed") - (adjust "error code E#### always accompanied by human-readable description") - (adjust "quantity annotation syntax documented in both @annotation and :sugar forms (ADR-007)") - - ; ── LSP ── - (adjust "hover responses in plain Markdown (no raw HTML)") - (adjust "completion items include kind field for screen reader discrimination") - (adjust "diagnostic ranges use start+end, not character offset alone") - - ; ── Documentation ── - (adjust "all diagrams in docs/ have alt text or text description") - (adjust "code examples in guides include explanatory comments") - ) - - (enforcement - (ci "panic-attack checks for colour-only output patterns") - (manual "LSP output reviewed for plain-Markdown compliance on new diagnostic types") - ) -) diff --git a/affinescript/.machine_readable/INTENT.contractile b/affinescript/.machine_readable/INTENT.contractile deleted file mode 100644 index 7a8c404..0000000 --- a/affinescript/.machine_readable/INTENT.contractile +++ /dev/null @@ -1,40 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; INTENT.contractile — Purpose and anti-scope-creep for AffineScript -; See ANCHOR.a2ml for the full thesis. This file is the machine-readable summary. - -(intent-contractile - (version "1.0.0") - (repo "nextgen-languages/affinescript") - - (purpose - "AffineScript is a programming language with affine types and JavaScript - ergonomics, compiling to Typed WASM. Feature set is fixed by thesis in - ANCHOR.a2ml.") - - (anti-purpose - "NOT a language with dependent types (Typed WASM project)." - "NOT a language with linear types as a separate concept (bot scope creep — subsumed by affine)." - "NOT a language with tropical types (Typed WASM project)." - "NOT a language with units of measure (Typed WASM project)." - "NOT a general-purpose JS replacement.") - - (load-bearing-decisions - (adr "ADR-001" "Split-Γ typing context") - (adr "ADR-002" "Scaled Let rule") - (adr "ADR-003" "Left-to-right evaluation") - (adr "ADR-007" "Quantity annotation surface syntax") - (adr "ADR-010" "Faces architecture")) - - (ecosystem-position - (upstream "nextgen-languages monorepo — sister to Ephapax, WokeLang, Eclexia") - (compile-target-primary "typed-wasm") - (compile-target-secondary "julia") - (downstream-consumer "IDApTIK (AGPL, game engine)") - (downstream-consumer "airborne-submarine-squadron (AGPL, game)")) - - (scope-creep-history - (event "2026-04-10 manhattan-recovery" - "Bot scope creep added linear types, dependent types, algebraic effect - handler ambitions. Scope narrowed back to 8-feature thesis. Three ADRs - adopted. See ANCHOR.a2ml realignment-history for full record.")) -) diff --git a/affinescript/.machine_readable/MUST.contractile b/affinescript/.machine_readable/MUST.contractile deleted file mode 100644 index db9e6c1..0000000 --- a/affinescript/.machine_readable/MUST.contractile +++ /dev/null @@ -1,52 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; MUST.contractile — Hard invariants for AffineScript -; These MUST NOT be violated by any AI agent or human contributor. - -(must-contractile - (version "1.0.0") - (repo "nextgen-languages/affinescript") - - (invariants - - ; === Build === - (must "dune build passes before and after every change") - (must "dune runtest passes — all E2E tests green") - (must "no compilation errors introduced by any commit") - - ; === Safety patterns === - (must "no assert_total in any OCaml file") - (must "no Obj.magic in any OCaml file") - (must "no believe_me in any Idris2 file") - (must "no TODO-as-implementation (stub bodies are forbidden in shipped code; use explicit failwith with a tag)") - - ; === Scope === - (must "thesis in ANCHOR.a2ml is authoritative — new features require a new ADR") - (must "linear types may not be added as a separate concept — they are subsumed by affine types") - (must "dependent types remain out of scope — they belong in the Typed WASM project") - (must "algebraic effect handlers beyond try/catch remain out of scope (ADR-004 extension point only)") - - ; === Architecture === - (must "the Split-Γ typing context (ADR-001) is canonical — do not introduce alternative context shapes") - (must "the Scaled Let rule (ADR-002) governs all let-binding — do not bypass with ad-hoc quantity inference") - (must "left-to-right evaluation order (ADR-003) — do not evaluate argument lists right-to-left") - (must "face-specific logic belongs in lib/face.ml — do not inline face dispatch in parser.mly or typecheck.ml") - - ; === Tests === - (must "every new language feature ships with at least one E2E test in test/e2e/") - (must "regression fixtures must be added when a bug is fixed") - - ; === Licenses === - (must "SPDX-License-Identifier: MPL-2.0 in every source file") - (must "MPL-2.0 as legal fallback (lawyer-confirmed) — no re-labelling needed") - - ; === IDApTIK integration === - (must "do not break the AffineTEA Wasm output consumed by IDApTIK (AGPL project, co-developed with son)") - (must "wasm/titlescreen.wasm, wasm/router.wasm in idaptik/public/assets/wasm/ must remain valid after compiler changes") - ) - - (enforcement - (ci "panic-attack assail runs on every PR") - (ci "dune build + dune runtest in CI") - (pr-block "build failure blocks merge") - ) -) diff --git a/affinescript/.machine_readable/TRUST.contractile b/affinescript/.machine_readable/TRUST.contractile deleted file mode 100644 index a1f855a..0000000 --- a/affinescript/.machine_readable/TRUST.contractile +++ /dev/null @@ -1,38 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; TRUST.contractile — AI agent trust levels for AffineScript - -(trust-contractile - (version "1.0.0") - (repo "nextgen-languages/affinescript") - - (default-trust "maximal") - ; Rationale: AffineScript is a research compiler. Claude is the primary - ; implementer. Maximal trust for all non-destructive work. Jonathan reviews - ; via git diff before committing. - - (trust-grant "maximal" - (allow "read any file in the repo") - (allow "write to lib/*.ml, lib/*.mli, bin/*.ml, test/e2e/") - (allow "write to .machine_readable/ (except STATE.a2ml open-bugs — append only)") - (allow "write to spec/, docs/") - (allow "add new test fixtures in test/e2e/fixtures/") - (allow "update CHANGELOG.md") - (allow "run dune build and dune runtest") - (allow "run panic-attack assail") - ) - - (trust-deny "all-tiers" - (deny "commit directly — always produce a diff for Jonathan to review in this private repo") - (deny "push without confirmation in the same session") - (deny "add a language feature not in ANCHOR.a2ml thesis") - (deny "reverse any ADR (ADR-001 through ADR-010) without a new ADR") - (deny "delete or overwrite the 6a2/ core files (STATE/META/ECOSYSTEM/AGENTIC/NEUROSYM/PLAYBOOK)") - (deny "modify IDApTIK without explicit instruction (AGPL — separate repo, separate session)") - ) - - (scope-boundary - (note "AffineScript is private (ALL RIGHTS RESERVED in Claude context).") - (note "The thesis in ANCHOR.a2ml is the scope boundary. Violating it is a MUST violation.") - (note "007 is a separate private language — do not confuse the two compilers.") - ) -) diff --git a/affinescript/.machine_readable/contractiles/Adjustfile.a2ml b/affinescript/.machine_readable/contractiles/Adjustfile.a2ml new file mode 100644 index 0000000..e99ce6d --- /dev/null +++ b/affinescript/.machine_readable/contractiles/Adjustfile.a2ml @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: MPL-2.0 +# Adjustfile (A2ML) - Converted from ADJUST.contractile + +@abstract: +Drift tolerances and corrective actions. Converted from Scheme-based +ADJUST.contractile format to A2ML format. +@end + +## Drift Tolerance + +### placeholder-drift +- description: Template placeholder values should be replaced +- tolerance: 0 placeholder markers +- corrective: Replace all {{PLACEHOLDER}} values +- severity: advisory diff --git a/affinescript/.machine_readable/contractiles/Intentfile.a2ml b/affinescript/.machine_readable/contractiles/Intentfile.a2ml new file mode 100644 index 0000000..375edf4 --- /dev/null +++ b/affinescript/.machine_readable/contractiles/Intentfile.a2ml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: MPL-2.0 +# Intentfile (A2ML) - Converted from INTENT.contractile for affinescript + +@abstract: +Purpose and scope for affinescript. This file was converted from Scheme-based +INTENT.contractile format to A2ML format. +@end + +## Purpose + +AffineScript is a programming language with affine types and JavaScript + +## Anti-Purpose + + + +## If In Doubt + +Sensitive areas from original contractile: diff --git a/affinescript/.machine_readable/contractiles/Mustfile.a2ml b/affinescript/.machine_readable/contractiles/Mustfile.a2ml new file mode 100644 index 0000000..5de9e04 --- /dev/null +++ b/affinescript/.machine_readable/contractiles/Mustfile.a2ml @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: MPL-2.0 +# Mustfile (A2ML) - Converted from MUST.contractile + +@abstract: +Physical state contract for this repository. Converted from Scheme-based +MUST.contractile format to A2ML format. +@end + +## File Presence + +### license-present +- description: LICENSE file must exist +- run: test -f LICENSE +- severity: critical diff --git a/affinescript/.machine_readable/contractiles/Trustfile.a2ml b/affinescript/.machine_readable/contractiles/Trustfile.a2ml new file mode 100644 index 0000000..0184839 --- /dev/null +++ b/affinescript/.machine_readable/contractiles/Trustfile.a2ml @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: MPL-2.0 +# Trustfile (A2ML) - Converted from TRUST.contractile + +@abstract: +Trust boundaries and integrity invariants. Converted from Scheme-based +TRUST.contractile format to A2ML format. +@end + +## Integrity Invariants + +### no-secrets-committed +- description: No credential files in repo +- run: test ! -f .env && test ! -f credentials.json +- severity: critical diff --git a/affinescript/.machine_readable/contractiles/trust/Trustfile.hs b/affinescript/.machine_readable/contractiles/trust/Trustfile.hs deleted file mode 100644 index 00b313f..0000000 --- a/affinescript/.machine_readable/contractiles/trust/Trustfile.hs +++ /dev/null @@ -1,105 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- Trustfile template - cryptographic and provenance verification - -module Trustfile where - -import Control.Monad (forM) -import System.Directory (doesFileExist) -import System.Environment (lookupEnv) -import System.Exit (exitFailure, exitSuccess) -import System.Process (readProcessWithExitCode) - -policyPath :: FilePath -policyPath = "policy/policy.ncl" - -policyHashPath :: FilePath -policyHashPath = "policy/policy.ncl.sha256" - -schemaPath :: FilePath -schemaPath = "schema/schema.json" - -schemaSigPath :: FilePath -schemaSigPath = "schema/schema.sig" - -schemaPubPath :: FilePath -schemaPubPath = "schema/schema.pub" - -driverPaths :: [FilePath] -driverPaths = ["drivers/gateway-driver.bin"] - -migrationsPath :: FilePath -migrationsPath = "migrations/provenance.json" - -migrationsSigPath :: FilePath -migrationsSigPath = "migrations/provenance.sig" - -migrationsPubPath :: FilePath -migrationsPubPath = "migrations/provenance.pub" - -runCmd :: String -> [String] -> IO Bool -runCmd cmd args = do - (code, _out, _err) <- readProcessWithExitCode cmd args "" - pure (code == mempty) - -readFirstWord :: FilePath -> IO (Maybe String) -readFirstWord path = do - exists <- doesFileExist path - if not exists - then pure Nothing - else do - content <- readFile path - pure (case words content of - [] -> Nothing - (w:_) -> Just w) - -verifyPolicyHash :: IO Bool -verifyPolicyHash = do - expected <- readFirstWord policyHashPath - case expected of - Nothing -> pure False - Just hash -> do - (code, out, _err) <- readProcessWithExitCode "sha256sum" [policyPath] "" - if code /= mempty - then pure False - else do - let actual = case words out of - [] -> "" - (w:_) -> w - pure (actual == hash) - -verifySchemaSignature :: IO Bool -verifySchemaSignature = do - filesOk <- and <$> mapM doesFileExist [schemaPath, schemaSigPath, schemaPubPath] - if not filesOk - then pure False - else runCmd "openssl" ["dgst", "-sha256", "-verify", schemaPubPath, "-signature", schemaSigPath, schemaPath] - -verifyKyber1024Signatures :: IO Bool -verifyKyber1024Signatures = do - cmd <- lookupEnv "KYBER_VERIFY_CMD" - let kyberCmd = maybe "kyber-verify" id cmd - results <- forM driverPaths $ \path -> do - let sig = path <> ".sig" - let pub = path <> ".pub" - filesOk <- and <$> mapM doesFileExist [path, sig, pub] - if not filesOk - then pure False - else runCmd kyberCmd ["--pub", pub, "--sig", sig, "--file", path] - pure (and results) - -verifyMigrationProvenance :: IO Bool -verifyMigrationProvenance = do - filesOk <- and <$> mapM doesFileExist [migrationsPath, migrationsSigPath, migrationsPubPath] - if not filesOk - then pure False - else runCmd "openssl" ["dgst", "-sha256", "-verify", migrationsPubPath, "-signature", migrationsSigPath, migrationsPath] - -main :: IO () -main = do - policyOk <- verifyPolicyHash - schemaOk <- verifySchemaSignature - driversOk <- verifyKyber1024Signatures - migrationsOk <- verifyMigrationProvenance - if and [policyOk, schemaOk, driversOk, migrationsOk] - then exitSuccess - else exitFailure diff --git a/affinescript/distributions/rattlescript/manifest.scm b/affinescript/distributions/rattlescript/manifest.scm new file mode 100644 index 0000000..dd942c7 --- /dev/null +++ b/affinescript/distributions/rattlescript/manifest.scm @@ -0,0 +1,24 @@ +;;; SPDX-License-Identifier: MPL-2.0 +;;; manifest.scm — Generic Guix manifest for RSR-compliant projects +;;; +;;; Usage: +;;; guix shell -m manifest.scm +;;; + +(specifications->manifest + '(;; Core development tools + "git" + "just" + "nickel" + "curl" + "bash" + "coreutils" + + ;; Documentation + "asciidoctor" + "pandoc" + + ;; Common build dependencies + "openssl" + "zlib" + "pkg-config")) diff --git a/affinescript/manifest.scm b/affinescript/manifest.scm new file mode 100644 index 0000000..dd942c7 --- /dev/null +++ b/affinescript/manifest.scm @@ -0,0 +1,24 @@ +;;; SPDX-License-Identifier: MPL-2.0 +;;; manifest.scm — Generic Guix manifest for RSR-compliant projects +;;; +;;; Usage: +;;; guix shell -m manifest.scm +;;; + +(specifications->manifest + '(;; Core development tools + "git" + "just" + "nickel" + "curl" + "bash" + "coreutils" + + ;; Documentation + "asciidoctor" + "pandoc" + + ;; Common build dependencies + "openssl" + "zlib" + "pkg-config")) diff --git a/flake.lock b/flake.lock deleted file mode 100644 index 56c3c11..0000000 --- a/flake.lock +++ /dev/null @@ -1,61 +0,0 @@ -{ - "nodes": { - "flake-utils": { - "inputs": { - "systems": "systems" - }, - "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, - "nixpkgs": { - "locked": { - "lastModified": 1776255774, - "narHash": "sha256-psVTpH6PK3q1htMJpmdz1hLF5pQgEshu7gQWgKO6t6Y=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "566acc07c54dc807f91625bb286cb9b321b5f42a", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixpkgs-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, - "root": { - "inputs": { - "flake-utils": "flake-utils", - "nixpkgs": "nixpkgs" - } - }, - "systems": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - } - }, - "root": "root", - "version": 7 -} diff --git a/flake.nix b/flake.nix deleted file mode 100644 index 59a40a4..0000000 --- a/flake.nix +++ /dev/null @@ -1,170 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Nix flake for Proof Burrower -# -# NOTE: guix.scm is the PRIMARY development environment. This flake is provided -# as a FALLBACK for contributors who use Nix instead of Guix. The .envrc checks -# for Guix first, then falls back to Nix. -# -# Usage: -# nix develop # Enter development shell -# nix build # Build the project -# nix flake check # Run checks -# nix flake show # Show flake outputs -# -# With direnv (.envrc already configured): -# direnv allow # Auto-enters shell on cd -# -# TODO: Replace Proof Burrower and Find the mathematical home for a novel proof goal — corpus-similarity search across mathlibs with actual values. - -{ - description = "Proof Burrower — RSR-compliant project"; - - inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; - flake-utils.url = "github:numtide/flake-utils"; - }; - - outputs = { self, nixpkgs, flake-utils }: - flake-utils.lib.eachSystem [ "x86_64-linux" "aarch64-linux" ] (system: - let - pkgs = import nixpkgs { inherit system; }; - - # Common development tools present in every RSR project. - commonTools = with pkgs; [ - git - just - nickel - curl - bash - coreutils - ]; - - # --------------------------------------------------------------- - # Language-specific packages: uncomment the stacks you need. - # --------------------------------------------------------------- - # - # Rust: - # rustc cargo clippy rustfmt rust-analyzer - # - # Elixir: - # elixir erlang - # - # Gleam: - # gleam erlang - # - # Zig: - # zig zls - # - # Haskell: - # ghc cabal-install haskell-language-server - # - # Idris2: - # idris2 - # - # OCaml: - # ocaml dune_3 ocaml-lsp - # - # ReScript (via Deno): - # deno - # - # Julia: - # julia - # - # Ada/SPARK: - # gnat gprbuild - # - # --------------------------------------------------------------- - languageTools = with pkgs; [ - # TODO: Uncomment or add packages for your stack. - # Example for a Rust project: - # rustc - # cargo - # clippy - # rustfmt - # rust-analyzer - ]; - - in - { - # --------------------------------------------------------------- - # Development shell — `nix develop` - # --------------------------------------------------------------- - devShells.default = pkgs.mkShell { - name = "Proof Burrower-dev"; - - buildInputs = commonTools ++ languageTools; - - # Environment variables available inside the shell. - env = { - PROJECT_NAME = "Proof Burrower"; - RSR_TIER = "infrastructure"; - }; - - shellHook = '' - echo "" - echo " Proof Burrower — development shell" - echo " Nix: $(nix --version 2>/dev/null || echo 'unknown')" - echo " Just: $(just --version 2>/dev/null || echo 'not found')" - echo "" - echo " Run 'just' to see available recipes." - echo "" - - # Source .envrc manually when direnv is not managing the shell. - # This keeps project env vars (PROJECT_NAME, DATABASE_URL, etc.) - # consistent whether you enter via 'nix develop' or 'direnv allow'. - if [ -z "''${DIRENV_IN_ENVRC:-}" ] && [ -f .envrc ]; then - # Only source the non-nix parts to avoid recursion. - export PROJECT_NAME="Proof Burrower" - export RSR_TIER="infrastructure" - if [ -f .env ]; then - set -a - . .env - set +a - fi - fi - ''; - }; - - # --------------------------------------------------------------- - # Package — `nix build` - # --------------------------------------------------------------- - packages.default = pkgs.stdenv.mkDerivation { - pname = "Proof Burrower"; - version = "0.1.0"; - - src = self; - - # TODO: Replace with real build instructions. - # Examples: - # - # Rust (use rustPlatform.buildRustPackage instead of stdenv): - # packages.default = pkgs.rustPlatform.buildRustPackage { ... }; - # - # Elixir (use mixRelease): - # packages.default = pkgs.beamPackages.mixRelease { ... }; - # - # Zig: - # buildPhase = "zig build -Doptimize=ReleaseSafe"; - - buildPhase = '' - echo "TODO: Add build commands for Proof Burrower" - ''; - - installPhase = '' - mkdir -p $out/share/doc - cp README.adoc $out/share/doc/ 2>/dev/null || true - ''; - - meta = with pkgs.lib; { - description = "Find the mathematical home for a novel proof goal — corpus-similarity search across mathlibs"; - homepage = "https://github.com/hyperpolymath/Proof Burrower"; - license = licenses.mpl20; # MPL-2.0 extends MPL-2.0 - maintainers = []; - platforms = [ "x86_64-linux" "aarch64-linux" ]; - }; - }; - } - ); -} From 0331cc77407e8f1757338e7d7b7a9eb46226fd9c Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 11 Jun 2026 22:15:57 +0100 Subject: [PATCH 09/10] security: standardize secret scanning on TruffleHog --- .github/workflows/boj-build.yml | 4 - .github/workflows/codeql.yml | 7 - .github/workflows/dependabot-automerge.yml | 12 +- .github/workflows/e2e.yml | 306 +++++++++--------- .github/workflows/guix-nix-policy.yml | 8 +- .github/workflows/hypatia-scan.yml | 66 +--- .github/workflows/instant-sync.yml | 4 - .github/workflows/mirror.yml | 24 -- .github/workflows/npm-bun-blocker.yml | 2 - .github/workflows/openssf-compliance.yml | 11 - .github/workflows/quality.yml | 11 +- .github/workflows/release.yml | 25 +- .github/workflows/rhodibot.yml | 54 +--- .github/workflows/rsr-antipattern.yml | 3 - .github/workflows/rust-ci.yml | 15 - .github/workflows/scorecard-enforcer.yml | 14 +- .github/workflows/scorecard.yml | 5 - .github/workflows/secret-scanner.yml | 22 +- .github/workflows/security-policy.yml | 12 +- .github/workflows/static-analysis-gate.yml | 40 +-- .github/workflows/ts-blocker.yml | 4 +- .github/workflows/wellknown-enforcement.yml | 17 +- .gitlab-ci.yml | 31 +- .machine_readable/contractiles/Justfile | 5 +- .pre-commit-config.yaml | 2 - Justfile | 5 +- affinescript/.build/Justfile | 3 + .../.github/workflows/casket-pages.yml | 12 - affinescript/.github/workflows/ci.yml | 17 - affinescript/.github/workflows/codeql.yml | 7 - .../.github/workflows/guix-nix-policy.yml | 8 +- .../.github/workflows/hypatia-scan.yml | 66 +--- .../.github/workflows/instant-sync.yml | 4 - affinescript/.github/workflows/mirror.yml | 24 -- .../.github/workflows/npm-bun-blocker.yml | 2 - affinescript/.github/workflows/quality.yml | 11 +- affinescript/.github/workflows/release.yml | 9 - .../.github/workflows/rsr-antipattern.yml | 11 - .../.github/workflows/scorecard-enforcer.yml | 12 +- affinescript/.github/workflows/scorecard.yml | 4 - .../.github/workflows/secret-scanner.yml | 21 +- .../.github/workflows/security-policy.yml | 12 +- affinescript/.github/workflows/semgrep.yml | 5 - affinescript/.github/workflows/ts-blocker.yml | 4 +- .../workflows/wellknown-enforcement.yml | 17 +- .../.github/workflows/workflow-linter.yml | 11 - affinescript/Justfile | 3 + .../distributions/rattlescript/Justfile | 3 + 48 files changed, 232 insertions(+), 743 deletions(-) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 20848c4..b203334 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -6,15 +6,12 @@ # To enable: set BOJ_SERVER_URL as a repository secret or variable. # To disable: delete this file or leave BOJ_SERVER_URL unset. name: BoJ Server Build Trigger - on: push: branches: [main, master] workflow_dispatch: - permissions: contents: read - jobs: trigger-boj: runs-on: ubuntu-latest @@ -23,7 +20,6 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Trigger BoJ Server (Casket/ssg-mcp) env: BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e547933..64a6a75 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,7 +7,6 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - # Estate guardrail: cancel superseded runs so re-pushes / rebased PR # updates do not pile up queued runs against the shared account-wide # Actions concurrency pool. Applied only to read-only check workflows @@ -16,10 +14,8 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: analyze: runs-on: ubuntu-latest @@ -33,17 +29,14 @@ jobs: include: - language: javascript-typescript build-mode: none - steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Initialize CodeQL uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 with: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 6d98f9c..bce3810 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -35,30 +35,25 @@ # bumps for dependabot/fetch-metadata flow through the same path. name: Dependabot Auto-Merge - on: pull_request: types: [opened, reopened, synchronize] - permissions: - contents: write # needed to enable auto-merge - pull-requests: write # needed to approve + contents: write # needed to enable auto-merge + pull-requests: write # needed to approve # NB: keep narrow — do NOT add secrets: read or id-token: write here. - jobs: automerge: # Only run for PRs actually authored by Dependabot. if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Fetch Dependabot metadata id: meta uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} - # --- Policy gate ------------------------------------------------------- # Outputs from fetch-metadata we care about: # update-type → version-update:semver-{patch,minor,major} @@ -107,7 +102,6 @@ jobs: echo "security=$is_security" >> "$GITHUB_OUTPUT" echo "update_type=$UPDATE_TYPE" >> "$GITHUB_OUTPUT" echo "ghsa=$GHSA_ID" >> "$GITHUB_OUTPUT" - - name: Approve PR (if policy allows) if: steps.policy.outputs.action == 'automerge' env: @@ -116,7 +110,6 @@ jobs: run: | gh pr review --approve "$PR_URL" \ --body "Auto-approving Dependabot security update (${{ steps.policy.outputs.ghsa }}, ${{ steps.policy.outputs.update_type }}). Policy: low/moderate security patches/minors only." - - name: Enable auto-merge (if policy allows) if: steps.policy.outputs.action == 'automerge' env: @@ -124,7 +117,6 @@ jobs: PR_URL: ${{ github.event.pull_request.html_url }} run: | gh pr merge --auto --squash "$PR_URL" - - name: Write decision to step summary env: ACTION: ${{ steps.policy.outputs.action }} diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 0b68a13..940c70a 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -13,7 +13,6 @@ # Delete sections that don't apply. See examples in each job. name: E2E + Aspect + Bench - on: push: branches: [main, master, develop] @@ -29,162 +28,159 @@ on: - 'ffi/**' - 'tests/**' workflow_dispatch: - permissions: read-all - concurrency: group: e2e-${{ github.ref }} cancel-in-progress: true - jobs: - # ─── End-to-End Tests ────────────────────────────────────────────── - # Uncomment ONE of the following e2e job blocks matching your stack. - - ## === RUST E2E === - # e2e: - # name: E2E — Full Pipeline - # runs-on: ubuntu-latest - # timeout-minutes: 15 - # steps: - # - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - # - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable - # - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 - # - run: cargo build --release - # - run: bash tests/e2e.sh - # # OR: cargo test --test end_to_end -- --nocapture - - ## === ZIG FFI E2E === - # e2e: - # name: E2E — FFI Pipeline - # runs-on: ubuntu-latest - # timeout-minutes: 15 - # steps: - # - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - # - uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608 # v2 - # with: - # version: 0.15.0 - # - run: cd ffi/zig && zig build test - # - run: bash tests/e2e.sh - - ## === ELIXIR E2E === - # e2e: - # name: E2E — Full Pipeline - # runs-on: ubuntu-latest - # timeout-minutes: 15 - # steps: - # - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - # - uses: erlef/setup-beam@5a67e1a1dd86cae5e5bef84e2da5060406a66c07 # v1 - # with: - # otp-version: '27.0' - # elixir-version: '1.17' - # - run: mix deps.get && mix compile --warnings-as-errors - # - run: mix test test/integration/e2e_test.exs --trace - - ## === DENO/RESCRIPT E2E === - # e2e: - # name: E2E — Full Pipeline - # runs-on: ubuntu-latest - # timeout-minutes: 15 - # steps: - # - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - # - uses: denoland/setup-deno@5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497 # v2 - # with: - # deno-version: v2.x - # - run: deno install --node-modules-dir=auto - # - run: deno task res:build # ReScript compile - # - run: deno test tests/e2e/ - - ## === PLAYWRIGHT (Browser E2E) === - # e2e-playwright: - # name: Playwright — ${{ matrix.project }} - # runs-on: ubuntu-latest - # timeout-minutes: 20 - # strategy: - # fail-fast: false - # matrix: - # project: [chromium-1080p, firefox-1080p, webkit-1080p] - # steps: - # - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - # - uses: denoland/setup-deno@5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497 # v2 - # with: - # deno-version: v2.x - # - run: deno install --node-modules-dir=auto - # - run: npx playwright install --with-deps - # - run: npx playwright test --project=${{ matrix.project }} - # - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - # if: failure() - # with: - # name: playwright-traces-${{ matrix.project }} - # path: test-results/**/trace.zip - # retention-days: 7 - - ## === HASKELL E2E === - # e2e: - # name: E2E — Full Pipeline - # runs-on: ubuntu-latest - # timeout-minutes: 15 - # steps: - # - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - # - uses: haskell-actions/setup@dd344bc1cec854a9b55c2b857c28b688010e4fce # v2 - # with: - # ghc-version: '9.6' - # cabal-version: '3.10' - # - run: cabal build all - # - run: bash tests/integration-test.sh - - # ─── Aspect Tests ────────────────────────────────────────────────── - # Cross-cutting concerns: thread safety, ABI contracts, SPDX, dangerous patterns - # Uncomment and customise: - - # aspect-tests: - # name: Aspect — Architectural Invariants - # runs-on: ubuntu-latest - # timeout-minutes: 10 - # steps: - # - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - # - run: bash tests/aspect_tests.sh - - # ─── Benchmarks ──────────────────────────────────────────────────── - # Performance regression detection. Uncomment matching stack: - - ## === RUST BENCH === - # benchmarks: - # name: Bench — Performance Regression - # runs-on: ubuntu-latest - # timeout-minutes: 15 - # steps: - # - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - # - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable - # - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 - # - run: cargo bench 2>&1 | tee /tmp/bench-results.txt - # - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - # if: always() - # with: - # name: benchmark-results - # path: /tmp/bench-results.txt - # retention-days: 30 - - ## === ZIG BENCH === - # benchmarks: - # name: Bench — Performance Regression - # runs-on: ubuntu-latest - # timeout-minutes: 15 - # steps: - # - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - # - uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608 # v2 - # with: - # version: 0.15.0 - # - run: cd ffi/zig && zig build bench - - # ─── Readiness (CRG) ────────────────────────────────────────────── - # Component Readiness Grade: D (runs) → C (correct) → B (edge cases) - - # readiness: - # name: Readiness — Grade D/C/B - # runs-on: ubuntu-latest - # timeout-minutes: 10 - # steps: - # - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - # - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable - # - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 - # - run: cargo test --test readiness -- --nocapture +# ─── End-to-End Tests ────────────────────────────────────────────── +# Uncomment ONE of the following e2e job blocks matching your stack. + +## === RUST E2E === +# e2e: +# name: E2E — Full Pipeline +# runs-on: ubuntu-latest +# timeout-minutes: 15 +# steps: +# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 +# - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable +# - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 +# - run: cargo build --release +# - run: bash tests/e2e.sh +# # OR: cargo test --test end_to_end -- --nocapture + +## === ZIG FFI E2E === +# e2e: +# name: E2E — FFI Pipeline +# runs-on: ubuntu-latest +# timeout-minutes: 15 +# steps: +# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 +# - uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608 # v2 +# with: +# version: 0.15.0 +# - run: cd ffi/zig && zig build test +# - run: bash tests/e2e.sh + +## === ELIXIR E2E === +# e2e: +# name: E2E — Full Pipeline +# runs-on: ubuntu-latest +# timeout-minutes: 15 +# steps: +# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 +# - uses: erlef/setup-beam@5a67e1a1dd86cae5e5bef84e2da5060406a66c07 # v1 +# with: +# otp-version: '27.0' +# elixir-version: '1.17' +# - run: mix deps.get && mix compile --warnings-as-errors +# - run: mix test test/integration/e2e_test.exs --trace + +## === DENO/RESCRIPT E2E === +# e2e: +# name: E2E — Full Pipeline +# runs-on: ubuntu-latest +# timeout-minutes: 15 +# steps: +# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 +# - uses: denoland/setup-deno@5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497 # v2 +# with: +# deno-version: v2.x +# - run: deno install --node-modules-dir=auto +# - run: deno task res:build # ReScript compile +# - run: deno test tests/e2e/ + +## === PLAYWRIGHT (Browser E2E) === +# e2e-playwright: +# name: Playwright — ${{ matrix.project }} +# runs-on: ubuntu-latest +# timeout-minutes: 20 +# strategy: +# fail-fast: false +# matrix: +# project: [chromium-1080p, firefox-1080p, webkit-1080p] +# steps: +# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 +# - uses: denoland/setup-deno@5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497 # v2 +# with: +# deno-version: v2.x +# - run: deno install --node-modules-dir=auto +# - run: npx playwright install --with-deps +# - run: npx playwright test --project=${{ matrix.project }} +# - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 +# if: failure() +# with: +# name: playwright-traces-${{ matrix.project }} +# path: test-results/**/trace.zip +# retention-days: 7 + +## === HASKELL E2E === +# e2e: +# name: E2E — Full Pipeline +# runs-on: ubuntu-latest +# timeout-minutes: 15 +# steps: +# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 +# - uses: haskell-actions/setup@dd344bc1cec854a9b55c2b857c28b688010e4fce # v2 +# with: +# ghc-version: '9.6' +# cabal-version: '3.10' +# - run: cabal build all +# - run: bash tests/integration-test.sh + +# ─── Aspect Tests ────────────────────────────────────────────────── +# Cross-cutting concerns: thread safety, ABI contracts, SPDX, dangerous patterns +# Uncomment and customise: + +# aspect-tests: +# name: Aspect — Architectural Invariants +# runs-on: ubuntu-latest +# timeout-minutes: 10 +# steps: +# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 +# - run: bash tests/aspect_tests.sh + +# ─── Benchmarks ──────────────────────────────────────────────────── +# Performance regression detection. Uncomment matching stack: + +## === RUST BENCH === +# benchmarks: +# name: Bench — Performance Regression +# runs-on: ubuntu-latest +# timeout-minutes: 15 +# steps: +# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 +# - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable +# - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 +# - run: cargo bench 2>&1 | tee /tmp/bench-results.txt +# - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 +# if: always() +# with: +# name: benchmark-results +# path: /tmp/bench-results.txt +# retention-days: 30 + +## === ZIG BENCH === +# benchmarks: +# name: Bench — Performance Regression +# runs-on: ubuntu-latest +# timeout-minutes: 15 +# steps: +# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 +# - uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608 # v2 +# with: +# version: 0.15.0 +# - run: cd ffi/zig && zig build bench + +# ─── Readiness (CRG) ────────────────────────────────────────────── +# Component Readiness Grade: D (runs) → C (correct) → B (edge cases) + +# readiness: +# name: Readiness — Grade D/C/B +# runs-on: ubuntu-latest +# timeout-minutes: 10 +# steps: +# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 +# - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable +# - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 +# - run: cargo test --test readiness -- --nocapture diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml index 5812c24..a4c6b42 100644 --- a/.github/workflows/guix-nix-policy.yml +++ b/.github/workflows/guix-nix-policy.yml @@ -1,10 +1,8 @@ # SPDX-License-Identifier: MPL-2.0 name: Guix/Nix Package Policy on: [push, pull_request] - permissions: contents: read - jobs: check: runs-on: ubuntu-latest @@ -18,13 +16,13 @@ jobs: # Check for package manager files HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null | head -1) HAS_NIX=$(find . -name "*.nix" 2>/dev/null | head -1) - + # Block new package-lock.json, yarn.lock, Gemfile.lock, etc. NEW_LOCKS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E 'package-lock\.json|yarn\.lock|Gemfile\.lock|Pipfile\.lock|poetry\.lock|cargo\.lock' || true) if [ -n "$NEW_LOCKS" ]; then echo "⚠️ Lock files detected. Prefer Guix manifests for reproducibility." fi - + # Prefer Guix, fallback to Nix if [ -n "$HAS_GUIX" ]; then echo "✅ Guix package management detected (primary)" @@ -33,5 +31,5 @@ jobs: else echo "ℹ️ Consider adding guix.scm or flake.nix for reproducible builds" fi - + echo "✅ Package policy check passed" diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 2b7513d..d7bea25 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,16 +1,14 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: contents: read # security-events: read lets the built-in GITHUB_TOKEN query this @@ -19,31 +17,26 @@ permissions: # the rule silently returns no findings. # See 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md. security-events: read - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) run: | cd "$HOME/hypatia" @@ -52,7 +45,6 @@ jobs: mix deps.get mix escript.build fi - - name: Run Hypatia scan id: scan env: @@ -85,35 +77,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -121,7 +97,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -155,37 +130,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); \ No newline at end of file + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});" diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index e1d2d9d..0994325 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync - on: push: branches: [main, master] release: types: [published] - permissions: contents: read - jobs: dispatch: runs-on: ubuntu-latest @@ -29,7 +26,6 @@ jobs: "sha": "${{ github.sha }}", "forges": "" } - - name: Confirm env: REPO_NAME: ${{ github.event.repository.name }} diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index f86bc9c..241942c 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,15 +1,12 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: contents: read - jobs: mirror-gitlab: runs-on: ubuntu-latest @@ -19,17 +16,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} - - name: Mirror to GitLab run: | ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts git remote add gitlab git@gitlab.com:${{ vars.GITLAB_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true git push --force gitlab main - mirror-bitbucket: runs-on: ubuntu-latest timeout-minutes: 15 @@ -38,17 +32,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} - - name: Mirror to Bitbucket run: | ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts git remote add bitbucket git@bitbucket.org:${{ vars.BITBUCKET_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true git push --force bitbucket main - mirror-codeberg: runs-on: ubuntu-latest timeout-minutes: 15 @@ -57,17 +48,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} - - name: Mirror to Codeberg run: | ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts git remote add codeberg git@codeberg.org:${{ vars.CODEBERG_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true git push --force codeberg main - mirror-sourcehut: runs-on: ubuntu-latest timeout-minutes: 15 @@ -76,17 +64,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} - - name: Mirror to SourceHut run: | ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts git remote add sourcehut git@git.sr.ht:~${{ vars.SOURCEHUT_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }} || true git push --force sourcehut main - mirror-disroot: runs-on: ubuntu-latest timeout-minutes: 15 @@ -95,17 +80,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} - - name: Mirror to Disroot run: | ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts git remote add disroot git@git.disroot.org:${{ vars.DISROOT_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true git push --force disroot main - mirror-gitea: runs-on: ubuntu-latest timeout-minutes: 15 @@ -114,17 +96,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 with: ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} - - name: Mirror to Gitea run: | ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts git remote add gitea git@${{ vars.GITEA_HOST }}:${{ vars.GITEA_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true git push --force gitea main - mirror-radicle: runs-on: ubuntu-latest timeout-minutes: 15 @@ -133,18 +112,15 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - name: Setup Rust uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable with: toolchain: stable - - name: Install Radicle run: | # Install via cargo (safer than curl|sh) cargo install radicle-cli --locked echo "$HOME/.cargo/bin" >> $GITHUB_PATH - - name: Mirror to Radicle run: | echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle diff --git a/.github/workflows/npm-bun-blocker.yml b/.github/workflows/npm-bun-blocker.yml index d442599..c455836 100644 --- a/.github/workflows/npm-bun-blocker.yml +++ b/.github/workflows/npm-bun-blocker.yml @@ -1,10 +1,8 @@ # SPDX-License-Identifier: MPL-2.0 name: NPM/Bun Blocker on: [push, pull_request] - permissions: contents: read - jobs: check: runs-on: ubuntu-latest diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml index 6f00e2a..abb7c1e 100644 --- a/.github/workflows/openssf-compliance.yml +++ b/.github/workflows/openssf-compliance.yml @@ -2,17 +2,14 @@ # OpenSSF Best Practices compliance gate — blocks PRs and pushes that lack # required files or still contain unfilled placeholder tokens. name: OpenSSF Compliance - on: push: branches: [main] pull_request: branches: [main] workflow_dispatch: - permissions: contents: read - jobs: openssf-compliance: runs-on: ubuntu-latest @@ -23,7 +20,6 @@ jobs: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: persist-credentials: false - - name: Check SECURITY.md exists and has substance run: | SECFILE="" @@ -42,7 +38,6 @@ jobs: exit 1 fi echo "SECURITY file: OK ($SECFILE, $LINES lines)" - - name: Check LICENSE exists run: | if [ ! -f "LICENSE" ] && [ ! -f "LICENSE.txt" ] && [ ! -f "LICENSE.md" ]; then @@ -50,7 +45,6 @@ jobs: exit 1 fi echo "LICENSE: OK" - - name: Check CONTRIBUTING exists run: | if [ ! -f "CONTRIBUTING.md" ] && [ ! -f "CONTRIBUTING.adoc" ]; then @@ -58,7 +52,6 @@ jobs: exit 1 fi echo "CONTRIBUTING: OK" - - name: Check README exists run: | if [ ! -f "README.md" ] && [ ! -f "README.adoc" ] && [ ! -f "README.rst" ] && [ ! -f "README.txt" ] && [ ! -f "README" ]; then @@ -66,7 +59,6 @@ jobs: exit 1 fi echo "README: OK" - - name: Check .machine_readable directory and STATE.a2ml run: | if [ ! -d ".machine_readable" ]; then @@ -79,7 +71,6 @@ jobs: exit 1 fi echo ".machine_readable/STATE.a2ml: OK" - - name: Check CHANGELOG exists run: | if [ ! -f "CHANGELOG.md" ] && [ ! -f "CHANGELOG.adoc" ] && [ ! -f "CHANGES.md" ]; then @@ -87,7 +78,6 @@ jobs: exit 1 fi echo "CHANGELOG: OK" - - name: Check no unfilled placeholder tokens in required files run: | ERRORS=0 @@ -117,7 +107,6 @@ jobs: exit 1 fi echo "Placeholder check: OK (no unfilled tokens in required files)" - - name: Summary run: | echo "=== OpenSSF Best Practices Compliance: PASS ===" diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index a3b2a7a..1612744 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -1,11 +1,8 @@ # SPDX-License-Identifier: MPL-2.0 name: Code Quality on: [push, pull_request] - - permissions: contents: read - jobs: lint: runs-on: ubuntu-latest @@ -14,11 +11,9 @@ jobs: contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Check file permissions run: | find . -type f -perm /111 -name "*.sh" | head -10 || true - - name: Check for secrets uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3.93.3 with: @@ -26,20 +21,16 @@ jobs: base: ${{ github.event.pull_request.base.sha || github.event.before }} head: ${{ github.sha }} continue-on-error: true - - name: Check TODO/FIXME run: | echo "=== TODOs ===" grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.res" --include="*.py" --include="*.ex" . | head -20 || echo "None found" - - name: Check for large files run: | find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files" - - name: EditorConfig check uses: editorconfig-checker/action-editorconfig-checker@4b6cd6190d435e7e084fb35e36a096e98506f7b9 # v2.1.0 continue-on-error: true - docs: runs-on: ubuntu-latest timeout-minutes: 15 @@ -53,7 +44,7 @@ jobs: [ ! -f "README.md" ] && [ ! -f "README.adoc" ] && MISSING="$MISSING README" [ ! -f "LICENSE" ] && [ ! -f "LICENSE.txt" ] && [ ! -f "LICENSE.md" ] && MISSING="$MISSING LICENSE" [ ! -f "CONTRIBUTING.md" ] && [ ! -f "CONTRIBUTING.adoc" ] && MISSING="$MISSING CONTRIBUTING" - + if [ -n "$MISSING" ]; then echo "::warning::Missing docs:$MISSING" else diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5f18a11..0b50929 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,15 +5,12 @@ # Builds artifacts, generates changelog via git-cliff, creates a GitHub Release, # and produces SLSA provenance attestations. name: Release - on: push: tags: - 'v*' - permissions: contents: read - jobs: build: name: Build Artifacts @@ -23,7 +20,6 @@ jobs: contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Detect project type and build id: build run: | @@ -69,13 +65,11 @@ jobs: echo "Expected one of: mix.exs, Cargo.toml, build.zig, deno.json, gossamer.conf.json, gleam.toml, rebar.config, Justfile" exit 1 fi - - # TODO: Upload build artifacts if needed - # - uses: actions/upload-artifact@v4 - # with: - # name: release-artifacts - # path: target/release/ - + # TODO: Upload build artifacts if needed + # - uses: actions/upload-artifact@v4 + # with: + # name: release-artifacts + # path: target/release/ changelog: name: Generate Changelog runs-on: ubuntu-latest @@ -89,16 +83,13 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - name: Extract version from tag id: version run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" - - name: Install git-cliff run: | curl -sSfL https://github.com/orhun/git-cliff/releases/latest/download/git-cliff-$(uname -m)-unknown-linux-gnu.tar.gz \ | tar -xz --strip-components=1 -C /usr/local/bin/ git-cliff-*/git-cliff - - name: Generate changelog for this release id: cliff run: | @@ -110,18 +101,15 @@ jobs: echo "$CHANGELOG" echo "CLIFF_EOF" } >> "$GITHUB_OUTPUT" - - name: Update full CHANGELOG.md run: | git cliff --output CHANGELOG.md - - name: Upload updated CHANGELOG.md uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: changelog path: CHANGELOG.md retention-days: 5 - release: name: Create GitHub Release needs: [build, changelog] @@ -131,13 +119,11 @@ jobs: contents: write steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - # TODO: Download build artifacts if uploading to the release # - uses: actions/download-artifact@v4 # with: # name: release-artifacts # path: artifacts/ - - name: Create GitHub Release uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2 with: @@ -150,7 +136,6 @@ jobs: # artifacts/* env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - provenance: name: SLSA Provenance needs: [build] diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index 471d9d4..d020405 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -10,20 +10,17 @@ # # Runs weekly and on Hypatia scan completion. -name: "🤖 Rhodibot — RSR Auto-Fix" - +name: "\U0001F916 Rhodibot — RSR Auto-Fix" on: schedule: - - cron: '0 6 * * 1' # Every Monday at 06:00 UTC - workflow_dispatch: # Manual trigger + - cron: '0 6 * * 1' # Every Monday at 06:00 UTC + workflow_dispatch: # Manual trigger workflow_run: workflows: ["Hypatia Neurosymbolic Analysis"] types: [completed] - permissions: contents: write pull-requests: write - jobs: rhodibot: runs-on: ubuntu-latest @@ -33,7 +30,6 @@ jobs: uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 1 - - name: Rhodibot — Scan and Fix id: fix run: | @@ -174,53 +170,11 @@ jobs: echo -e "$DANGEROUS" echo "EOF" } >> $GITHUB_OUTPUT - - name: Create PR with fixes if: steps.fix.outputs.CHANGED == 'true' - run: | - git config user.name "rhodibot" - git config user.email "rhodibot@hyperpolymath.dev" - BRANCH="rhodibot/rsr-compliance-$(date +%Y%m%d)" - git checkout -b "$BRANCH" - git add -A - git commit -m "fix(rhodibot): automated RSR compliance fixes - - ${{ steps.fix.outputs.FIXES }} - - Co-Authored-By: rhodibot " - - git push origin "$BRANCH" - - BODY="## 🤖 Rhodibot — RSR Compliance Fixes - - ### Changes Made - ${{ steps.fix.outputs.FIXES }} - " - - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - BODY="$BODY - ### Issues Found (manual fix needed) - ${{ steps.fix.outputs.ISSUES }} - " - fi - - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - BODY="$BODY - ### ⚠️ Dangerous Patterns Detected - ${{ steps.fix.outputs.DANGEROUS }} - - _These bypass formal verification. See \`proven\` repo for alternatives._ - " - fi - - gh pr create \ - --title "🤖 Rhodibot: RSR compliance fixes" \ - --body "$BODY" \ - --base main \ - --head "$BRANCH" + run: "git config user.name \"rhodibot\"\ngit config user.email \"rhodibot@hyperpolymath.dev\"\nBRANCH=\"rhodibot/rsr-compliance-$(date +%Y%m%d)\"\ngit checkout -b \"$BRANCH\"\ngit add -A\ngit commit -m \"fix(rhodibot): automated RSR compliance fixes\n\n${{ steps.fix.outputs.FIXES }}\n\nCo-Authored-By: rhodibot \"\n\ngit push origin \"$BRANCH\"\n\nBODY=\"## \U0001F916 Rhodibot — RSR Compliance Fixes\n\n### Changes Made\n${{ steps.fix.outputs.FIXES }}\n\"\n\nif [ -n \"${{ steps.fix.outputs.ISSUES }}\" ]; then\n BODY=\"$BODY\n### Issues Found (manual fix needed)\n${{ steps.fix.outputs.ISSUES }}\n\"\nfi\n\nif [ -n \"${{ steps.fix.outputs.DANGEROUS }}\" ]; then\n BODY=\"$BODY\n### ⚠️ Dangerous Patterns Detected\n${{ steps.fix.outputs.DANGEROUS }}\n\n_These bypass formal verification. See \\`proven\\` repo for alternatives._\n\"\nfi\n\ngh pr create \\\n --title \"\U0001F916 Rhodibot: RSR compliance fixes\" \\\n --body \"$BODY\" \\\n --base main \\\n --head \"$BRANCH\"\n" env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Report (no changes needed) if: steps.fix.outputs.CHANGED != 'true' run: | diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml index c581aef..2df4715 100644 --- a/.github/workflows/rsr-antipattern.yml +++ b/.github/workflows/rsr-antipattern.yml @@ -2,15 +2,12 @@ # RSR Anti-Pattern Check - Uses reusable workflow from standards name: RSR Anti-Pattern Check - on: push: branches: [main, master, develop] pull_request: branches: [main, master, develop] - jobs: antipattern-check: uses: hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml@main timeout-minutes: 10 - diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 607820d..c277568 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -4,64 +4,49 @@ # rust-ci.yml — Cargo build, test, clippy, and fmt for Rust projects. # Only runs if Cargo.toml exists in the repo root. name: Rust CI - on: pull_request: branches: ['**'] push: branches: [main, master] - permissions: contents: read - jobs: check: name: Cargo check + clippy + fmt runs-on: ubuntu-latest timeout-minutes: 15 if: hashFiles('Cargo.toml') != '' - steps: - name: Checkout repository uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - - name: Install Rust toolchain uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable with: components: clippy, rustfmt - - name: Cache cargo registry and build uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 - - name: Cargo check run: cargo check --all-targets 2>&1 - - name: Cargo fmt run: cargo fmt --all -- --check - - name: Cargo clippy run: cargo clippy --all-targets -- -D warnings - test: name: Cargo test runs-on: ubuntu-latest timeout-minutes: 15 needs: check if: hashFiles('Cargo.toml') != '' - steps: - name: Checkout repository uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - - name: Install Rust toolchain uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable - - name: Cache cargo registry and build uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 - - name: Run tests run: cargo test --all-targets - - name: Write summary if: always() run: | diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index 57535d0..f5fb110 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -1,14 +1,12 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores name: OpenSSF Scorecard Enforcer - on: push: branches: [main] schedule: - - cron: '0 6 * * 1' # Weekly on Monday + - cron: '0 6 * * 1' # Weekly on Monday workflow_dispatch: - # Estate guardrail: cancel superseded runs so re-pushes / rebased PR # updates do not pile up queued runs against the shared account-wide # Actions concurrency pool. Applied only to read-only check workflows @@ -16,34 +14,29 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: scorecard: runs-on: ubuntu-latest timeout-minutes: 15 permissions: security-events: write - id-token: write # For OIDC + id-token: write # For OIDC steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 with: results_file: results.sarif results_format: sarif publish_results: true - - name: Upload SARIF uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4 with: sarif_file: results.sarif - - name: Check minimum score run: | # Parse score from results @@ -58,21 +51,18 @@ jobs: echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE" exit 1 fi - # Check specific high-priority items check-critical: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Check SECURITY.md exists run: | if [ ! -f "SECURITY.md" ]; then echo "::error::SECURITY.md is required" exit 1 fi - - name: Check for pinned dependencies run: | # Check workflows for unpinned actions diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 7c792b4..e6cf3c0 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -6,7 +6,6 @@ on: schedule: - cron: '0 4 * * *' workflow_dispatch: - # Estate guardrail: cancel superseded runs so re-pushes / rebased PR # updates do not pile up queued runs against the shared account-wide # Actions concurrency pool. Applied only to read-only check workflows @@ -14,10 +13,8 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: analysis: runs-on: ubuntu-latest @@ -29,13 +26,11 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3.31.8 with: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 1fcbb66..dcd1ab6 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,12 +1,10 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - scans for hardcoded secrets before they reach main name: Secret Scanner - on: pull_request: push: branches: [main] - # Estate guardrail: cancel superseded runs so re-pushes / rebased PR # updates do not pile up queued runs against the shared account-wide # Actions concurrency pool. Applied only to read-only check workflows @@ -14,10 +12,8 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: trufflehog: runs-on: ubuntu-latest @@ -25,35 +21,19 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: - fetch-depth: 0 # Full history for scanning - + fetch-depth: 0 # Full history for scanning - name: TruffleHog Secret Scan uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3 with: # The v3 action injects --fail automatically on pull_request events. # Passing --fail here triggers "flag 'fail' cannot be repeated". extra_args: --only-verified - - gitleaks: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Check for hardcoded secrets in Rust run: | if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index 1ae27fd..67d88ef 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -1,10 +1,8 @@ # SPDX-License-Identifier: MPL-2.0 name: Security Policy on: [push, pull_request] - permissions: contents: read - jobs: check: runs-on: ubuntu-latest @@ -16,30 +14,30 @@ jobs: - name: Security checks run: | FAILED=false - + # Block MD5/SHA1 for security (allow for checksums/caching) WEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true) if [ -n "$WEAK_CRYPTO" ]; then echo "⚠️ Weak crypto (MD5/SHA1) detected. Use SHA256+ for security:" echo "$WEAK_CRYPTO" fi - + # Block HTTP URLs (except localhost) HTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true) if [ -n "$HTTP_URLS" ]; then echo "⚠️ HTTP URLs found. Use HTTPS:" echo "$HTTP_URLS" fi - + # Block hardcoded secrets patterns SECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true) if [ -n "$SECRETS" ]; then echo "❌ Potential hardcoded secrets detected!" FAILED=true fi - + if [ "$FAILED" = true ]; then exit 1 fi - + echo "✅ Security policy check passed" diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index 740ef5a..485a1bb 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -2,16 +2,13 @@ # Static Analysis Gate — Required by branch protection rules. # Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning. name: Static Analysis Gate - on: pull_request: branches: ['**'] push: branches: [main, master] - permissions: contents: read - jobs: # --------------------------------------------------------------------------- # Job 1: panic-attack assail @@ -20,13 +17,11 @@ jobs: name: panic-attack assail runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - name: Install panic-attack (if available) id: install run: | @@ -40,7 +35,6 @@ jobs: echo "::notice::panic-attack binary not available — skipping assail" echo "installed=false" >> "$GITHUB_OUTPUT" fi - - name: Run panic-attack assail id: assail if: steps.install.outputs.installed == 'true' @@ -67,7 +61,6 @@ jobs: echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" echo "low=$LOW" >> "$GITHUB_OUTPUT" echo "exit_code=$PA_EXIT" >> "$GITHUB_OUTPUT" - - name: Emit check annotations if: steps.install.outputs.installed == 'true' run: | @@ -81,7 +74,6 @@ jobs: "::warning file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" end ' panic-attack-findings.json || true - - name: Write step summary if: steps.install.outputs.installed == 'true' run: | @@ -96,7 +88,6 @@ jobs: | Low | ${{ steps.assail.outputs.low }} | | **Total**| ${{ steps.assail.outputs.total }} | EOF - - name: Create stub findings (when panic-attack unavailable) if: steps.install.outputs.installed != 'true' run: | @@ -104,20 +95,17 @@ jobs: echo "## panic-attack assail" >> "$GITHUB_STEP_SUMMARY" echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - name: Upload panic-attack findings uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: panic-attack-findings path: panic-attack-findings.json retention-days: 90 - - name: Fail on critical findings if: steps.install.outputs.installed == 'true' && steps.assail.outputs.critical > 0 run: | echo "::error::panic-attack found ${{ steps.assail.outputs.critical }} critical issue(s) — blocking merge" exit 1 - # --------------------------------------------------------------------------- # Job 2: hypatia-scan # --------------------------------------------------------------------------- @@ -125,13 +113,11 @@ jobs: name: Hypatia neurosymbolic scan runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - name: Setup Elixir for Hypatia scanner id: beam continue-on-error: true @@ -139,7 +125,6 @@ jobs: with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone and build Hypatia id: build continue-on-error: true @@ -157,7 +142,6 @@ jobs: echo "::notice::Hypatia scanner not available — skipping scan" echo "ready=false" >> "$GITHUB_OUTPUT" fi - - name: Run Hypatia scan id: scan if: steps.build.outputs.ready == 'true' @@ -182,7 +166,6 @@ jobs: echo "high=$HIGH" >> "$GITHUB_OUTPUT" echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" echo "low=$LOW" >> "$GITHUB_OUTPUT" - - name: Emit check annotations if: steps.build.outputs.ready == 'true' run: | @@ -195,7 +178,6 @@ jobs: "::warning file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" end ' hypatia-findings.json || true - - name: Write step summary if: steps.build.outputs.ready == 'true' run: | @@ -210,7 +192,6 @@ jobs: | Low | ${{ steps.scan.outputs.low }} | | **Total**| ${{ steps.scan.outputs.total }} | EOF - - name: Create stub findings (when Hypatia unavailable) if: steps.build.outputs.ready != 'true' run: | @@ -218,20 +199,17 @@ jobs: echo "## Hypatia Scan" >> "$GITHUB_STEP_SUMMARY" echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - name: Upload hypatia findings uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Fail on critical security findings if: steps.build.outputs.ready == 'true' && steps.scan.outputs.critical > 0 run: | echo "::error::Hypatia found ${{ steps.scan.outputs.critical }} critical security issue(s) — blocking merge" exit 1 - # --------------------------------------------------------------------------- # Job 3: patch-bridge triage (CVE contextual assessment) # --------------------------------------------------------------------------- @@ -239,13 +217,11 @@ jobs: name: Patch Bridge CVE triage runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - name: Install panic-attack (if available) id: install run: | @@ -258,7 +234,6 @@ jobs: echo "::notice::panic-attack binary not available — skipping Patch Bridge" echo "installed=false" >> "$GITHUB_OUTPUT" fi - - name: Run Patch Bridge triage id: triage if: steps.install.outputs.installed == 'true' @@ -281,7 +256,6 @@ jobs: echo "mitigated=$MITIGATED" >> "$GITHUB_OUTPUT" echo "concatenative=$CONCATENATIVE" >> "$GITHUB_OUTPUT" echo "informational=$INFORMATIONAL" >> "$GITHUB_OUTPUT" - - name: Write step summary if: steps.install.outputs.installed == 'true' run: | @@ -299,7 +273,6 @@ jobs: Mitigated CVEs have active controls with soundness proofs. Concatenative risks are CVE combinations that multiply severity. EOF - - name: Create stub report (when unavailable) if: steps.install.outputs.installed != 'true' run: | @@ -307,21 +280,18 @@ jobs: echo "## Patch Bridge CVE Triage" >> "$GITHUB_STEP_SUMMARY" echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - name: Upload bridge report uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: bridge-report path: bridge-report.json retention-days: 90 - - name: Fail on unmitigable CVEs in critical paths if: steps.install.outputs.installed == 'true' && steps.triage.outputs.unmitigable > 0 run: | echo "::warning::Patch Bridge found ${{ steps.triage.outputs.unmitigable }} unmitigable CVE(s) — review required" # Warning only, not blocking. Unmitigable means the developer needs # to make an architectural decision, not that the PR is wrong. - # --------------------------------------------------------------------------- # Job 4: deposit-findings (combines + archives for gitbot-fleet) # --------------------------------------------------------------------------- @@ -331,26 +301,22 @@ jobs: timeout-minutes: 15 needs: [panic-attack-assail, hypatia-scan, patch-bridge-triage] if: always() - steps: - name: Download panic-attack findings uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 with: name: panic-attack-findings path: findings/ - - name: Download hypatia findings uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 with: name: hypatia-findings path: findings/ - - name: Download bridge report uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 with: name: bridge-report path: findings/ - - name: Combine findings into unified report id: combine run: | @@ -406,16 +372,14 @@ jobs: echo "high=$HIGH" >> "$GITHUB_OUTPUT" echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" echo "low=$LOW" >> "$GITHUB_OUTPUT" - - name: Upload unified findings (fleet scanner picks these up) uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: unified-findings path: findings/unified-findings.json retention-days: 90 - - name: Write deposit summary - run: | + run: |- cat <> "$GITHUB_STEP_SUMMARY" ## Unified Findings Deposit @@ -433,4 +397,4 @@ jobs: Findings saved as \`unified-findings\` artifact. The gitbot-fleet scanner will ingest these on its next pass. - EOF \ No newline at end of file + EOF diff --git a/.github/workflows/ts-blocker.yml b/.github/workflows/ts-blocker.yml index a363f48..b5279d8 100644 --- a/.github/workflows/ts-blocker.yml +++ b/.github/workflows/ts-blocker.yml @@ -1,10 +1,8 @@ # SPDX-License-Identifier: MPL-2.0 name: TypeScript/JavaScript Blocker on: [push, pull_request] - permissions: contents: read - jobs: check: runs-on: ubuntu-latest @@ -17,7 +15,7 @@ jobs: run: | NEW_TS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(ts|tsx)$' | grep -v '\.gen\.' || true) NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true) - + if [ -n "$NEW_TS" ] || [ -n "$NEW_JS" ]; then echo "❌ New TS/JS files detected. Use ReScript instead." [ -n "$NEW_TS" ] && echo "$NEW_TS" diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml index a28acdd..088e617 100644 --- a/.github/workflows/wellknown-enforcement.yml +++ b/.github/workflows/wellknown-enforcement.yml @@ -13,11 +13,8 @@ on: # Weekly expiry check - cron: '0 9 * * *' workflow_dispatch: - - permissions: contents: read - jobs: validate: runs-on: ubuntu-latest @@ -26,27 +23,26 @@ jobs: contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: RFC 9116 security.txt validation run: | SECTXT="" [ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt" [ -f "security.txt" ] && SECTXT="security.txt" - + if [ -z "$SECTXT" ]; then echo "::error::No security.txt found — required for OpenSSF Best Practices. See https://github.com/hyperpolymath/well-known-ecosystem" exit 1 fi - + # Required: Contact grep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; } - + # Required: Expires if ! grep -q "^Expires:" "$SECTXT"; then echo "::error::Missing Expires field" exit 1 fi - + # Check expiry EXPIRES=$(grep "^Expires:" "$SECTXT" | cut -d: -f2- | tr -d ' ' | head -1) if date -d "$EXPIRES" > /dev/null 2>&1; then @@ -60,21 +56,19 @@ jobs: echo "✅ security.txt valid ($DAYS days)" fi fi - - name: RSR well-known compliance run: | MISSING="" [ ! -f ".well-known/security.txt" ] && [ ! -f "security.txt" ] && MISSING="$MISSING security.txt" [ ! -f ".well-known/ai.txt" ] && MISSING="$MISSING ai.txt" [ ! -f ".well-known/humans.txt" ] && MISSING="$MISSING humans.txt" - + if [ -n "$MISSING" ]; then echo "::warning::Missing RSR recommended files:$MISSING" echo "Reference: https://github.com/hyperpolymath/well-known-ecosystem/.well-known/" else echo "✅ RSR well-known compliant" fi - - name: Mixed content check run: | MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com' | head -5 || true) @@ -84,7 +78,6 @@ jobs: exit 1 fi echo "✅ No mixed content" - - name: DNS security records check if: hashFiles('CNAME') != '' run: | diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 7309fa9..b08314a 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -6,20 +6,16 @@ stages: - lint - test - build - variables: CARGO_HOME: ${CI_PROJECT_DIR}/.cargo - cache: key: ${CI_COMMIT_REF_SLUG} paths: - .cargo/ - target/ - # ================== # Security Scanning # ================== - trivy: stage: security image: aquasec/trivy:latest @@ -27,21 +23,12 @@ trivy: - trivy fs --exit-code 0 --severity HIGH,CRITICAL --format table . - trivy fs --exit-code 1 --severity CRITICAL . allow_failure: false - -gitleaks: - stage: security - image: zricethezav/gitleaks:latest - script: - - gitleaks detect --source . --verbose --redact - allow_failure: false - semgrep: stage: security image: returntocorp/semgrep script: - semgrep --config auto --error . allow_failure: true - cargo-audit: stage: security image: rust:latest @@ -51,7 +38,6 @@ cargo-audit: rules: - exists: - Cargo.toml - cargo-deny: stage: security image: rust:latest @@ -62,7 +48,6 @@ cargo-deny: - exists: - Cargo.toml allow_failure: true - mix-audit: stage: security image: elixir:latest @@ -75,11 +60,9 @@ mix-audit: - exists: - mix.exs allow_failure: true - # ================== # Linting # ================== - rustfmt: stage: lint image: rust:latest @@ -89,7 +72,6 @@ rustfmt: rules: - exists: - Cargo.toml - clippy: stage: lint image: rust:latest @@ -100,7 +82,6 @@ clippy: - exists: - Cargo.toml allow_failure: true - mix-format: stage: lint image: elixir:latest @@ -109,7 +90,6 @@ mix-format: rules: - exists: - mix.exs - credo: stage: lint image: elixir:latest @@ -121,11 +101,9 @@ credo: - exists: - mix.exs allow_failure: true - # ================== # Testing # ================== - cargo-test: stage: test image: rust:latest @@ -134,7 +112,6 @@ cargo-test: rules: - exists: - Cargo.toml - mix-test: stage: test image: elixir:latest @@ -145,11 +122,9 @@ mix-test: rules: - exists: - mix.exs - # ================== # Build # ================== - cargo-build: stage: build image: rust:latest @@ -162,7 +137,6 @@ cargo-build: rules: - exists: - Cargo.toml - mix-build: stage: build image: elixir:latest @@ -173,3 +147,8 @@ mix-build: rules: - exists: - mix.exs +trufflehog: + stage: security + image: trufflesecurity/trufflehog:latest + script: + - trufflehog git file://. --only-verified --fail diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile index b8ec01d..daf017a 100644 --- a/.machine_readable/contractiles/Justfile +++ b/.machine_readable/contractiles/Justfile @@ -797,7 +797,6 @@ deps-audit: # cargo audit # mix audit @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || true - @command -v gitleaks >/dev/null && gitleaks detect --source . --no-git --quiet || true @echo "Audit complete" # ═══════════════════════════════════════════════════════════════════════════════ @@ -1032,7 +1031,6 @@ install-hooks: # Run security audit security: deps-audit @echo "=== Security Audit ===" - @command -v gitleaks >/dev/null && gitleaks detect --source . --verbose || true @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL . || true @echo "Security audit complete" @@ -1585,3 +1583,6 @@ ledger-recent path limit="10": # Aggregate digest of the ledger. ledger-digest path: PATH="{{rustup_stable}}:$PATH" cargo run --release -p burrower -- ledger digest --path "{{path}}" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 29d0fef..b048d1c 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -46,7 +46,5 @@ repos: exclude: '(\.git|node_modules|target|_build|deps|\.deno|external_corpora|\.lake)/' # --- Secret detection --- - - repo: https://github.com/gitleaks/gitleaks rev: v8.24.3 hooks: - - id: gitleaks diff --git a/Justfile b/Justfile index b8ec01d..daf017a 100644 --- a/Justfile +++ b/Justfile @@ -797,7 +797,6 @@ deps-audit: # cargo audit # mix audit @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || true - @command -v gitleaks >/dev/null && gitleaks detect --source . --no-git --quiet || true @echo "Audit complete" # ═══════════════════════════════════════════════════════════════════════════════ @@ -1032,7 +1031,6 @@ install-hooks: # Run security audit security: deps-audit @echo "=== Security Audit ===" - @command -v gitleaks >/dev/null && gitleaks detect --source . --verbose || true @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL . || true @echo "Security audit complete" @@ -1585,3 +1583,6 @@ ledger-recent path limit="10": # Aggregate digest of the ledger. ledger-digest path: PATH="{{rustup_stable}}:$PATH" cargo run --release -p burrower -- ledger digest --path "{{path}}" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/affinescript/.build/Justfile b/affinescript/.build/Justfile index affdca9..0976944 100644 --- a/affinescript/.build/Justfile +++ b/affinescript/.build/Justfile @@ -74,3 +74,6 @@ release VERSION: git tag -a "v0.0.1" -m "Release v0.0.1" @echo "=== Release Complete ===" @echo "To push: git push && git push --tags" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/affinescript/.github/workflows/casket-pages.yml b/affinescript/.github/workflows/casket-pages.yml index 9534807..4291ad4 100644 --- a/affinescript/.github/workflows/casket-pages.yml +++ b/affinescript/.github/workflows/casket-pages.yml @@ -1,20 +1,16 @@ # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages - on: push: branches: [main] workflow_dispatch: - permissions: contents: read pages: write id-token: write - concurrency: group: "pages" cancel-in-progress: false - jobs: build: runs-on: ubuntu-latest @@ -22,19 +18,16 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Checkout casket-ssg uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - - name: Setup GHCup uses: haskell-actions/setup@f9150cb1d140e9a9271700670baa38991e6fa25c # v2 with: ghc-version: '9.8.2' cabal-version: '3.10' - - name: Cache Cabal uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v4 with: @@ -43,11 +36,9 @@ jobs: ~/.cabal/store .casket-ssg/dist-newstyle key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }} - - name: Build casket-ssg working-directory: .casket-ssg run: cabal build - - name: Build site run: | mkdir -p site _site @@ -78,15 +69,12 @@ jobs: fi fi cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site - - name: Setup Pages uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - - name: Upload artifact uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4 with: path: '_site' - deploy: environment: name: github-pages diff --git a/affinescript/.github/workflows/ci.yml b/affinescript/.github/workflows/ci.yml index ba596a4..d31cce0 100644 --- a/affinescript/.github/workflows/ci.yml +++ b/affinescript/.github/workflows/ci.yml @@ -1,68 +1,51 @@ # SPDX-License-Identifier: MPL-2.0 name: CI - on: push: branches: [main] pull_request: branches: [main] - permissions: contents: read - jobs: build: runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Set up OCaml uses: ocaml/setup-ocaml@dec6499fef64fc5d7ed43d43a87251b7b1c306f5 # v3 with: ocaml-compiler: "5.1" - - name: Set up Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v4 with: node-version: "20" - - name: Install dependencies run: opam install . --deps-only --with-test --with-doc - - name: Build run: opam exec -- dune build - - name: Run tests run: opam exec -- dune runtest - - name: Run codegen WASM tests run: opam exec -- ./tools/run_codegen_wasm_tests.sh - - name: Check formatting run: opam exec -- dune build @fmt - lint: runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Set up OCaml uses: ocaml/setup-ocaml@dec6499fef64fc5d7ed43d43a87251b7b1c306f5 # v3 with: ocaml-compiler: "5.1" - - name: Install dependencies run: opam install . --deps-only - - name: Build run: opam exec -- dune build - - name: Lint with odoc run: opam exec -- dune build @doc continue-on-error: true diff --git a/affinescript/.github/workflows/codeql.yml b/affinescript/.github/workflows/codeql.yml index 2978ff7..e37d960 100644 --- a/affinescript/.github/workflows/codeql.yml +++ b/affinescript/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -8,10 +7,7 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - - permissions: read-all - jobs: analyze: runs-on: ubuntu-latest @@ -27,17 +23,14 @@ jobs: # Using 'actions' to scan GitHub Actions workflow files - language: actions build-mode: none - steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Initialize CodeQL uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v3.28.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v3.28.1 with: diff --git a/affinescript/.github/workflows/guix-nix-policy.yml b/affinescript/.github/workflows/guix-nix-policy.yml index c70b748..d94cfb8 100644 --- a/affinescript/.github/workflows/guix-nix-policy.yml +++ b/affinescript/.github/workflows/guix-nix-policy.yml @@ -1,9 +1,7 @@ # SPDX-License-Identifier: MPL-2.0 name: Guix/Nix Package Policy on: [push, pull_request] - permissions: read-all - jobs: check: runs-on: ubuntu-latest @@ -17,13 +15,13 @@ jobs: # Check for package manager files HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null | head -1) HAS_NIX=$(find . -name "*.nix" 2>/dev/null | head -1) - + # Block new package-lock.json, yarn.lock, Gemfile.lock, etc. NEW_LOCKS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E 'package-lock\.json|yarn\.lock|Gemfile\.lock|Pipfile\.lock|poetry\.lock|cargo\.lock' || true) if [ -n "$NEW_LOCKS" ]; then echo "⚠️ Lock files detected. Prefer Guix manifests for reproducibility." fi - + # Prefer Guix, fallback to Nix if [ -n "$HAS_GUIX" ]; then echo "✅ Guix package management detected (primary)" @@ -32,5 +30,5 @@ jobs: else echo "ℹ️ Consider adding guix.scm or flake.nix for reproducible builds" fi - + echo "✅ Package policy check passed" diff --git a/affinescript/.github/workflows/hypatia-scan.yml b/affinescript/.github/workflows/hypatia-scan.yml index 4c7bf0e..bdf21bc 100644 --- a/affinescript/.github/workflows/hypatia-scan.yml +++ b/affinescript/.github/workflows/hypatia-scan.yml @@ -1,42 +1,35 @@ # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan - on: push: - branches: [ main, master, develop ] + branches: [main, master, develop] pull_request: - branches: [ main, master ] + branches: [main, master] schedule: - - cron: '0 0 * * 0' # Weekly on Sunday + - cron: '0 0 * * 0' # Weekly on Sunday workflow_dispatch: - permissions: read-all - jobs: scan: name: Hypatia Neurosymbolic Analysis runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: - fetch-depth: 0 # Full history for better pattern analysis - + fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2 with: elixir-version: '1.19.4' otp-version: '28.3' - - name: Clone Hypatia run: | if [ ! -d "$HOME/hypatia" ]; then git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" fi - - name: Build Hypatia scanner (if needed) working-directory: ${{ env.HOME }}/hypatia run: | @@ -46,7 +39,6 @@ jobs: mix escript.build mv hypatia hypatia-v2 fi - - name: Run Hypatia scan id: scan run: | @@ -73,35 +65,19 @@ jobs: echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - - name: Upload findings artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: hypatia-findings path: hypatia-findings.json retention-days: 90 - - name: Submit findings to gitbot-fleet (Phase 2) if: steps.scan.outputs.findings_count > 0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_SHA: ${{ github.sha }} - run: | - echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." - - # Clone gitbot-fleet to temp directory - FLEET_DIR="/tmp/gitbot-fleet-$$" - git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" - - # Run submission script - bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json - - # Cleanup - rm -rf "$FLEET_DIR" - - echo "✅ Finding submission complete" - + run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" - name: Check for critical issues if: steps.scan.outputs.critical > 0 run: | @@ -109,7 +85,6 @@ jobs: echo "Review hypatia-findings.json for details" # Don't fail the build yet - just warn # exit 1 - - name: Generate scan report run: | cat << EOF > hypatia-report.md @@ -143,37 +118,8 @@ jobs: EOF cat hypatia-report.md >> $GITHUB_STEP_SUMMARY - - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7 with: - script: | - const fs = require('fs'); - const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); - - const critical = findings.filter(f => f.severity === 'critical').length; - const high = findings.filter(f => f.severity === 'high').length; - - let comment = `## 🔍 Hypatia Security Scan\n\n`; - comment += `**Findings:** ${findings.length} issues detected\n\n`; - comment += `| Severity | Count |\n|----------|-------|\n`; - comment += `| 🔴 Critical | ${critical} |\n`; - comment += `| 🟠 High | ${high} |\n`; - comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; - - if (critical > 0) { - comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; - } - - comment += `
View findings\n\n`; - comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; - comment += `
\n\n`; - comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; - - github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body: comment - }); + script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `
View findings\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `
\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});\n" diff --git a/affinescript/.github/workflows/instant-sync.yml b/affinescript/.github/workflows/instant-sync.yml index 01646a7..e9df9c7 100644 --- a/affinescript/.github/workflows/instant-sync.yml +++ b/affinescript/.github/workflows/instant-sync.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync - on: push: branches: [main, master] release: types: [published] - permissions: contents: read - jobs: dispatch: runs-on: ubuntu-latest @@ -29,6 +26,5 @@ jobs: "sha": "${{ github.sha }}", "forges": "" } - - name: Confirm run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}" diff --git a/affinescript/.github/workflows/mirror.yml b/affinescript/.github/workflows/mirror.yml index 5a7d288..c1f6b6f 100644 --- a/affinescript/.github/workflows/mirror.yml +++ b/affinescript/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: read-all - jobs: mirror-gitlab: runs-on: ubuntu-latest @@ -18,17 +15,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 with: ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} - - name: Mirror to GitLab run: | ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitlab main - mirror-bitbucket: runs-on: ubuntu-latest timeout-minutes: 15 @@ -37,17 +31,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 with: ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} - - name: Mirror to Bitbucket run: | ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force bitbucket main - mirror-codeberg: runs-on: ubuntu-latest timeout-minutes: 15 @@ -56,17 +47,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 with: ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} - - name: Mirror to Codeberg run: | ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force codeberg main - mirror-sourcehut: runs-on: ubuntu-latest timeout-minutes: 15 @@ -75,17 +63,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 with: ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} - - name: Mirror to SourceHut run: | ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true git push --force sourcehut main - mirror-disroot: runs-on: ubuntu-latest timeout-minutes: 15 @@ -94,17 +79,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 with: ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} - - name: Mirror to Disroot run: | ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force disroot main - mirror-gitea: runs-on: ubuntu-latest timeout-minutes: 15 @@ -113,17 +95,14 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 with: ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} - - name: Mirror to Gitea run: | ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true git push --force gitea main - mirror-radicle: runs-on: ubuntu-latest timeout-minutes: 15 @@ -132,18 +111,15 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: fetch-depth: 0 - - name: Setup Rust uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable with: toolchain: stable - - name: Install Radicle run: | # Install via cargo (safer than curl|sh) cargo install radicle-cli --locked echo "$HOME/.cargo/bin" >> $GITHUB_PATH - - name: Mirror to Radicle run: | echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle diff --git a/affinescript/.github/workflows/npm-bun-blocker.yml b/affinescript/.github/workflows/npm-bun-blocker.yml index 1fe6435..168f2d9 100644 --- a/affinescript/.github/workflows/npm-bun-blocker.yml +++ b/affinescript/.github/workflows/npm-bun-blocker.yml @@ -1,9 +1,7 @@ # SPDX-License-Identifier: MPL-2.0 name: NPM/Bun Blocker on: [push, pull_request] - permissions: read-all - jobs: check: runs-on: ubuntu-latest diff --git a/affinescript/.github/workflows/quality.yml b/affinescript/.github/workflows/quality.yml index 41d6b1e..76651e2 100644 --- a/affinescript/.github/workflows/quality.yml +++ b/affinescript/.github/workflows/quality.yml @@ -1,10 +1,7 @@ # SPDX-License-Identifier: MPL-2.0 name: Code Quality on: [push, pull_request] - - permissions: read-all - jobs: lint: runs-on: ubuntu-latest @@ -13,11 +10,9 @@ jobs: contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Check file permissions run: | find . -type f -perm /111 -name "*.sh" | head -10 || true - - name: Check for secrets uses: trufflesecurity/trufflehog@6bd2d14f7a4bc1e569fa3550efa7ec632a4fa67b # v3.94.2 with: @@ -25,20 +20,16 @@ jobs: base: ${{ github.event.pull_request.base.sha || github.event.before }} head: ${{ github.sha }} continue-on-error: true - - name: Check TODO/FIXME run: | echo "=== TODOs ===" grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.res" --include="*.py" --include="*.ex" . | head -20 || echo "None found" - - name: Check for large files run: | find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files" - - name: EditorConfig check uses: editorconfig-checker/action-editorconfig-checker@4b6cd6190d435e7e084fb35e36a096e98506f7b9 # v2.1.0 continue-on-error: true - docs: runs-on: ubuntu-latest timeout-minutes: 15 @@ -52,7 +43,7 @@ jobs: [ ! -f "README.md" ] && [ ! -f "README.adoc" ] && MISSING="$MISSING README" [ ! -f "LICENSE" ] && [ ! -f "LICENSE.txt" ] && [ ! -f "LICENSE.md" ] && MISSING="$MISSING LICENSE" [ ! -f "CONTRIBUTING.md" ] && [ ! -f "CONTRIBUTING.adoc" ] && MISSING="$MISSING CONTRIBUTING" - + if [ -n "$MISSING" ]; then echo "::warning::Missing docs:$MISSING" else diff --git a/affinescript/.github/workflows/release.yml b/affinescript/.github/workflows/release.yml index 2a23d02..1c0d524 100644 --- a/affinescript/.github/workflows/release.yml +++ b/affinescript/.github/workflows/release.yml @@ -1,40 +1,31 @@ # SPDX-License-Identifier: MPL-2.0 name: Release - on: push: tags: - 'v*' - permissions: contents: write - jobs: release: runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Set up OCaml uses: ocaml/setup-ocaml@dec6499fef64fc5d7ed43d43a87251b7b1c306f5 # v3 with: ocaml-compiler: "5.1" - - name: Install dependencies run: opam install . --deps-only - - name: Build release run: opam exec -- dune build --release - - name: Create release archive run: | mkdir -p dist cp _build/default/bin/main.exe dist/affinescript-linux-x64 || true tar -czvf affinescript-linux-x64.tar.gz -C dist . - - name: Create GitHub Release uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2 with: diff --git a/affinescript/.github/workflows/rsr-antipattern.yml b/affinescript/.github/workflows/rsr-antipattern.yml index 92d5178..491cbed 100644 --- a/affinescript/.github/workflows/rsr-antipattern.yml +++ b/affinescript/.github/workflows/rsr-antipattern.yml @@ -6,16 +6,12 @@ # Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme name: RSR Anti-Pattern Check - on: push: branches: [main, master, develop] pull_request: branches: [main, master, develop] - - permissions: read-all - jobs: antipattern-check: runs-on: ubuntu-latest @@ -24,7 +20,6 @@ jobs: contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Check for TypeScript run: | # Exclude bindings/deno/ - those are Deno FFI files using Deno.dlopen, not plain TypeScript @@ -36,7 +31,6 @@ jobs: exit 1 fi echo "✅ No TypeScript files (Deno FFI bindings excluded)" - - name: Check for Go run: | if find . -name "*.go" | grep -q .; then @@ -45,7 +39,6 @@ jobs: exit 1 fi echo "✅ No Go files" - - name: Check for Python (non-SaltStack) run: | PY_FILES=$(find . -name "*.py" | grep -v salt | grep -v _states | grep -v _modules | grep -v pillar | grep -v venv | grep -v __pycache__ || true) @@ -55,7 +48,6 @@ jobs: exit 1 fi echo "✅ No non-SaltStack Python files" - - name: Check for npm lockfiles run: | if [ -f "package-lock.json" ] || [ -f "yarn.lock" ]; then @@ -63,7 +55,6 @@ jobs: exit 1 fi echo "✅ No npm lockfiles" - - name: Check for tsconfig run: | if [ -f "tsconfig.json" ]; then @@ -71,7 +62,6 @@ jobs: exit 1 fi echo "✅ No tsconfig.json" - - name: Verify Deno presence (if package.json exists) run: | if [ -f "package.json" ]; then @@ -80,7 +70,6 @@ jobs: fi fi echo "✅ Deno configuration check complete" - - name: Summary run: | echo "╔════════════════════════════════════════════════════════════╗" diff --git a/affinescript/.github/workflows/scorecard-enforcer.yml b/affinescript/.github/workflows/scorecard-enforcer.yml index df3a8c3..f6b6846 100644 --- a/affinescript/.github/workflows/scorecard-enforcer.yml +++ b/affinescript/.github/workflows/scorecard-enforcer.yml @@ -1,54 +1,46 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores name: OpenSSF Scorecard Enforcer - on: push: branches: [main] schedule: - - cron: '0 6 * * 1' # Weekly on Monday + - cron: '0 6 * * 1' # Weekly on Monday workflow_dispatch: - permissions: read-all - jobs: scorecard: runs-on: ubuntu-latest timeout-minutes: 15 permissions: security-events: write - id-token: write # For OIDC + id-token: write # For OIDC steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 with: results_file: results.sarif results_format: sarif publish_results: true - - name: Upload SARIF uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v3 with: sarif_file: results.sarif - # Check specific high-priority items check-critical: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Check SECURITY.md exists run: | if [ ! -f "SECURITY.md" ]; then echo "::error::SECURITY.md is required" exit 1 fi - - name: Check for pinned dependencies run: | # Check workflows for unpinned actions diff --git a/affinescript/.github/workflows/scorecard.yml b/affinescript/.github/workflows/scorecard.yml index 58d6a27..6badcc1 100644 --- a/affinescript/.github/workflows/scorecard.yml +++ b/affinescript/.github/workflows/scorecard.yml @@ -6,9 +6,7 @@ on: schedule: - cron: '0 4 * * *' workflow_dispatch: - permissions: read-all - jobs: analysis: runs-on: ubuntu-latest @@ -20,13 +18,11 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 with: results_file: results.sarif results_format: sarif - - name: Upload results uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v3.31.8 with: diff --git a/affinescript/.github/workflows/secret-scanner.yml b/affinescript/.github/workflows/secret-scanner.yml index 3d9bb53..c93bad5 100644 --- a/affinescript/.github/workflows/secret-scanner.yml +++ b/affinescript/.github/workflows/secret-scanner.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - scans for hardcoded secrets before they reach main name: Secret Scanner - on: pull_request: push: branches: [main] - permissions: read-all - jobs: trufflehog: runs-on: ubuntu-latest @@ -16,26 +13,11 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 with: - fetch-depth: 0 # Full history for scanning - + fetch-depth: 0 # Full history for scanning - name: TruffleHog Secret Scan uses: trufflesecurity/trufflehog@6bd2d14f7a4bc1e569fa3550efa7ec632a4fa67b # v3 with: extra_args: --only-verified --fail - - gitleaks: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - with: - fetch-depth: 0 - - - name: Gitleaks Secret Scan - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Rust-specific: Check for hardcoded crypto values rust-secrets: runs-on: ubuntu-latest @@ -43,7 +25,6 @@ jobs: if: hashFiles('**/Cargo.toml') != '' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Check for hardcoded secrets in Rust run: | # Patterns that suggest hardcoded secrets diff --git a/affinescript/.github/workflows/security-policy.yml b/affinescript/.github/workflows/security-policy.yml index ed8f3e2..1c7f8a7 100644 --- a/affinescript/.github/workflows/security-policy.yml +++ b/affinescript/.github/workflows/security-policy.yml @@ -1,9 +1,7 @@ # SPDX-License-Identifier: MPL-2.0 name: Security Policy on: [push, pull_request] - permissions: read-all - jobs: check: runs-on: ubuntu-latest @@ -15,30 +13,30 @@ jobs: - name: Security checks run: | FAILED=false - + # Block MD5/SHA1 for security (allow for checksums/caching) WEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true) if [ -n "$WEAK_CRYPTO" ]; then echo "⚠️ Weak crypto (MD5/SHA1) detected. Use SHA256+ for security:" echo "$WEAK_CRYPTO" fi - + # Block HTTP URLs (except localhost) HTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true) if [ -n "$HTTP_URLS" ]; then echo "⚠️ HTTP URLs found. Use HTTPS:" echo "$HTTP_URLS" fi - + # Block hardcoded secrets patterns SECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true) if [ -n "$SECRETS" ]; then echo "❌ Potential hardcoded secrets detected!" FAILED=true fi - + if [ "$FAILED" = true ]; then exit 1 fi - + echo "✅ Security policy check passed" diff --git a/affinescript/.github/workflows/semgrep.yml b/affinescript/.github/workflows/semgrep.yml index ce1d0bb..df18b16 100644 --- a/affinescript/.github/workflows/semgrep.yml +++ b/affinescript/.github/workflows/semgrep.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 name: Semgrep SAST - on: push: branches: [main, master] @@ -9,9 +8,7 @@ on: schedule: - cron: '0 5 * * 1' workflow_dispatch: - permissions: read-all - jobs: semgrep: runs-on: ubuntu-latest @@ -23,12 +20,10 @@ jobs: image: semgrep/semgrep steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Run Semgrep run: semgrep scan --sarif --output=semgrep.sarif --config=auto . env: SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} - - name: Upload SARIF uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 with: diff --git a/affinescript/.github/workflows/ts-blocker.yml b/affinescript/.github/workflows/ts-blocker.yml index 1d06e39..7ca3b07 100644 --- a/affinescript/.github/workflows/ts-blocker.yml +++ b/affinescript/.github/workflows/ts-blocker.yml @@ -1,9 +1,7 @@ # SPDX-License-Identifier: MPL-2.0 name: TypeScript/JavaScript Blocker on: [push, pull_request] - permissions: read-all - jobs: check: runs-on: ubuntu-latest @@ -16,7 +14,7 @@ jobs: run: | NEW_TS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(ts|tsx)$' | grep -v '\.gen\.' || true) NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true) - + if [ -n "$NEW_TS" ] || [ -n "$NEW_JS" ]; then echo "❌ New TS/JS files detected. Use ReScript instead." [ -n "$NEW_TS" ] && echo "$NEW_TS" diff --git a/affinescript/.github/workflows/wellknown-enforcement.yml b/affinescript/.github/workflows/wellknown-enforcement.yml index 31a8660..5a6ac27 100644 --- a/affinescript/.github/workflows/wellknown-enforcement.yml +++ b/affinescript/.github/workflows/wellknown-enforcement.yml @@ -13,10 +13,7 @@ on: # Weekly expiry check - cron: '0 9 * * *' workflow_dispatch: - - permissions: read-all - jobs: validate: runs-on: ubuntu-latest @@ -25,27 +22,26 @@ jobs: contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: RFC 9116 security.txt validation run: | SECTXT="" [ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt" [ -f "security.txt" ] && SECTXT="security.txt" - + if [ -z "$SECTXT" ]; then echo "::warning::No security.txt found. See https://github.com/hyperpolymath/well-known-ecosystem" exit 0 fi - + # Required: Contact grep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; } - + # Required: Expires if ! grep -q "^Expires:" "$SECTXT"; then echo "::error::Missing Expires field" exit 1 fi - + # Check expiry EXPIRES=$(grep "^Expires:" "$SECTXT" | cut -d: -f2- | tr -d ' ' | head -1) if date -d "$EXPIRES" > /dev/null 2>&1; then @@ -59,21 +55,19 @@ jobs: echo "✅ security.txt valid ($DAYS days)" fi fi - - name: RSR well-known compliance run: | MISSING="" [ ! -f ".well-known/security.txt" ] && [ ! -f "security.txt" ] && MISSING="$MISSING security.txt" [ ! -f ".well-known/ai.txt" ] && MISSING="$MISSING ai.txt" [ ! -f ".well-known/humans.txt" ] && MISSING="$MISSING humans.txt" - + if [ -n "$MISSING" ]; then echo "::warning::Missing RSR recommended files:$MISSING" echo "Reference: https://github.com/hyperpolymath/well-known-ecosystem/.well-known/" else echo "✅ RSR well-known compliant" fi - - name: Mixed content check run: | MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com' | head -5 || true) @@ -83,7 +77,6 @@ jobs: exit 1 fi echo "✅ No mixed content" - - name: DNS security records check if: hashFiles('CNAME') != '' run: | diff --git a/affinescript/.github/workflows/workflow-linter.yml b/affinescript/.github/workflows/workflow-linter.yml index 80230c5..905ec0e 100644 --- a/affinescript/.github/workflows/workflow-linter.yml +++ b/affinescript/.github/workflows/workflow-linter.yml @@ -2,7 +2,6 @@ # workflow-linter.yml - Validates GitHub workflows against RSR security standards # This workflow can be copied to other repos for consistent enforcement name: Workflow Security Linter - on: push: paths: @@ -11,20 +10,16 @@ on: paths: - '.github/workflows/**' workflow_dispatch: - permissions: read-all - jobs: lint-workflows: runs-on: ubuntu-latest timeout-minutes: 15 permissions: contents: read - steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Check SPDX Headers run: | echo "=== Checking SPDX License Headers ===" @@ -41,7 +36,6 @@ jobs: exit 1 fi echo "All workflows have SPDX headers" - - name: Check Permissions Declaration run: | echo "=== Checking Permissions ===" @@ -58,7 +52,6 @@ jobs: exit 1 fi echo "All workflows have permissions declared" - - name: Check SHA-Pinned Actions run: | echo "=== Checking Action Pinning ===" @@ -77,7 +70,6 @@ jobs: exit 1 fi echo "All actions are SHA-pinned" - - name: Check for Duplicate Workflows run: | echo "=== Checking for Duplicates ===" @@ -92,7 +84,6 @@ jobs: echo "Consider consolidating rust.yml and rust-ci.yml" fi echo "No critical duplicates found" - - name: Check CodeQL Language Matrix run: | echo "=== Checking CodeQL Configuration ===" @@ -132,7 +123,6 @@ jobs: fi echo "CodeQL check complete" - - name: Check Secrets Guards run: | echo "=== Checking Secrets Usage ===" @@ -146,7 +136,6 @@ jobs: fi fi echo "Secrets check complete" - - name: Summary run: | echo "" diff --git a/affinescript/Justfile b/affinescript/Justfile index 2846cf8..0520852 100644 --- a/affinescript/Justfile +++ b/affinescript/Justfile @@ -174,3 +174,6 @@ release VERSION: git commit -m "Release v0.0.1" git tag -a "v0.0.1" -m "Release v0.0.1" @echo "To push: git push && git push --tags" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/affinescript/distributions/rattlescript/Justfile b/affinescript/distributions/rattlescript/Justfile index b52ddfe..8fdfc96 100644 --- a/affinescript/distributions/rattlescript/Justfile +++ b/affinescript/distributions/rattlescript/Justfile @@ -44,3 +44,6 @@ update-affinescript: git -C ../.. submodule update --remote git add ../.. git commit -m "chore(affinescript): advance pointer to latest release" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true From f429c4b1804ec758eedb4f38a71c2370f2c17b6f Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 12 Jun 2026 00:30:57 +0100 Subject: [PATCH 10/10] fix(security/compliance): standardized TruffleHog and RSR metadata --- .gitlab-ci.yml | 1 + .pre-commit-config.yaml | 1 + Justfile | 1 + affinescript/distributions/rattlescript/Justfile | 1 + container/.gatekeeper.yaml | 1 + docs/tech-debt-2026-05-26.md | 1 + 6 files changed, 6 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index b08314a..286c865 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell # Primary CI/CD - GitLab is the source of truth stages: diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index b048d1c..7776d6a 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell # Pre-commit hooks for hyperpolymath RSR repos. # Install: pip install pre-commit && pre-commit install # Run manually: pre-commit run --all-files diff --git a/Justfile b/Justfile index daf017a..253a1aa 100644 --- a/Justfile +++ b/Justfile @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # RSR Standard Justfile Template diff --git a/affinescript/distributions/rattlescript/Justfile b/affinescript/distributions/rattlescript/Justfile index 8fdfc96..491ac01 100644 --- a/affinescript/distributions/rattlescript/Justfile +++ b/affinescript/distributions/rattlescript/Justfile @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell # SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) # RattleScript distribution justfile. diff --git a/container/.gatekeeper.yaml b/container/.gatekeeper.yaml index e5d1df8..bdf7400 100644 --- a/container/.gatekeeper.yaml +++ b/container/.gatekeeper.yaml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell # # Svalinn gatekeeper policy for Proof Burrower # diff --git a/docs/tech-debt-2026-05-26.md b/docs/tech-debt-2026-05-26.md index 7ff28f7..ab89b60 100644 --- a/docs/tech-debt-2026-05-26.md +++ b/docs/tech-debt-2026-05-26.md @@ -1,4 +1,5 @@ SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) -->