From ce8995534e76ff207879d9b0aa184469917e5551 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 09:58:36 +0100 Subject: [PATCH 1/3] chore: update workflow SHAs to @7fdc2705 Estate-wide SHA update per hyperpolymath/standards#426 Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/secret-scanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index ee6e8e12..80479208 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -16,5 +16,5 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit From e52419f80415d88720f2739bd8b89bebc799b033 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 11 Sep 2026 11:26:54 +0100 Subject: [PATCH 2/3] fix(ci): apply foundation CI/CD security fixes - Update CodeQL workflow to SHA-pinned actions with persist-credentials: false - Update reusable workflow pins to current standards main SHAs Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .editorconfig | 39 ++----------------- .gitattributes | 11 ++---- .github/FUNDING.yml | 7 ---- .github/dependabot.yml | 4 ++ .github/funding.yml | 20 ++++++++-- .github/workflows/codeql.yml | 8 ++-- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/rsr-antipattern.yml | 8 ++-- .github/workflows/scorecard.yml | 2 +- .gitignore | 38 +++++++++++------- .nojekyll | 0 ABI-FFI-README.md | 4 +- FUNDING | 34 ++++++++++++++++ .../h/50fdc878b8c3040575afdeacca469e44.txt | 0 .../h/9f710f6731aa94d02fcb1d79abb753c9.txt | 0 ffi/zig/.zig-cache/h/timestamp | 0 17 files changed, 99 insertions(+), 80 deletions(-) delete mode 100644 .github/FUNDING.yml delete mode 100644 .nojekyll create mode 100644 FUNDING delete mode 100644 ffi/zig/.zig-cache/h/50fdc878b8c3040575afdeacca469e44.txt delete mode 100644 ffi/zig/.zig-cache/h/9f710f6731aa94d02fcb1d79abb753c9.txt delete mode 100644 ffi/zig/.zig-cache/h/timestamp diff --git a/.editorconfig b/.editorconfig index fc6650ce..b042ff9b 100644 --- a/.editorconfig +++ b/.editorconfig @@ -2,7 +2,6 @@ # https://editorconfig.org root = true - [*] charset = utf-8 end_of_line = lf @@ -10,59 +9,27 @@ indent_size = 2 indent_style = space insert_final_newline = true trim_trailing_whitespace = true - [*.md] trim_trailing_whitespace = false - [*.adoc] -trim_trailing_whitespace = false - [*.rs] indent_size = 4 - [*.ex] -indent_size = 2 - [*.exs] -indent_size = 2 - [*.zig] -indent_size = 4 - [*.ada] indent_size = 3 - [*.adb] -indent_size = 3 - [*.ads] -indent_size = 3 - [*.hs] -indent_size = 2 - [*.res] -indent_size = 2 - [*.resi] -indent_size = 2 - [*.ncl] -indent_size = 2 - [*.rkt] -indent_size = 2 - [*.scm] -indent_size = 2 - [*.nix] -indent_size = 2 - [Justfile] -indent_style = space -indent_size = 4 - [justfile] -indent_style = space -indent_size = 4 +# SPDX-License-Identifier: MPL-2.0 +[Makefile] +indent_style = tab diff --git a/.gitattributes b/.gitattributes index e860a85c..87ba82f9 100644 --- a/.gitattributes +++ b/.gitattributes @@ -2,7 +2,6 @@ # RSR-compliant .gitattributes * text=auto eol=lf - # Source *.rs text eol=lf diff=rust *.ex text eol=lf diff=elixir @@ -18,28 +17,23 @@ *.scm text eol=lf *.ncl text eol=lf *.nix text eol=lf - # Docs *.md text eol=lf diff=markdown *.adoc text eol=lf *.txt text eol=lf - # Data *.json text eol=lf *.yaml text eol=lf *.yml text eol=lf *.toml text eol=lf - # Config .gitignore text eol=lf .gitattributes text eol=lf justfile text eol=lf Makefile text eol=lf Containerfile text eol=lf - # Scripts *.sh text eol=lf - # Binary *.png binary *.jpg binary @@ -48,7 +42,10 @@ Containerfile text eol=lf *.woff2 binary *.zip binary *.gz binary - # Lock files Cargo.lock text eol=lf -diff flake.lock text eol=lf -diff +*.a2ml text eol=lf linguist-language=TOML +*.zig text eol=lf +.editorconfig text eol=lf +.tool-versions text eol=lf diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml deleted file mode 100644 index 688a442c..00000000 --- a/.github/FUNDING.yml +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Funding platforms for hyperpolymath projects -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository - -github: hyperpolymath -ko_fi: hyperpolymath -liberapay: hyperpolymath diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 4d9ae2f7..66acc03c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,6 +13,7 @@ updates: actions: patterns: - "*" + open-pull-requests-limit: 2 # Rust/Cargo - package-ecosystem: "cargo" @@ -31,18 +32,21 @@ updates: directory: "/" schedule: interval: "weekly" + open-pull-requests-limit: 3 # Node.js/npm - package-ecosystem: "npm" directory: "/" schedule: interval: "weekly" + open-pull-requests-limit: 3 # Python/pip - package-ecosystem: "pip" directory: "/" schedule: interval: "weekly" + open-pull-requests-limit: 3 # Nix flakes - package-ecosystem: "nix" diff --git a/.github/funding.yml b/.github/funding.yml index e4f7c077..dc1b7fa0 100644 --- a/.github/funding.yml +++ b/.github/funding.yml @@ -1,4 +1,18 @@ -# Funding Configuration -# See: https://docs.github.com/en/repositories/managing-your-repositorys-custom-fields/displaying-a-sponsor-button-in-your-repository +# SPDX-License-Identifier: MPL-2.0 for code +# SPDX-License-Identifier: CC-BY-SA-4.0 for documentation +# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -github: metadatastician +# These are supported funding model platforms + +buy_me_a_coffee: jonathan.jewell +community_bridge: jonathan-jewell +github: hyperpolymath +indieweb: +issuehunt: hyperpolymath +ko_fi: hyperpolymath +lfx_crowdfunding: hyperpolymath +liberapay: hyperpolymath +open_collective: jonathan-jewell +patreon: cc_studio +polar: hyperpolymath +thanks_dev: hyperpolymath diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9019e927..1efe38c7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,16 +26,18 @@ jobs: build-mode: none steps: - name: Checkout - uses: actions/checkout@v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@v4.31.10 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.31.10 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 87b2dfcf..35f0b843 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -14,4 +14,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f31a5a4ba591d544b65f91f6d78b136e07756f0 \ No newline at end of file diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 37ea9f6d..580ecc9f 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -17,4 +17,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@cc58c0cb23f73fc2019ce85a56a468e5248a93b3 \ No newline at end of file diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml index e97147b2..522ad34e 100644 --- a/.github/workflows/rsr-antipattern.yml +++ b/.github/workflows/rsr-antipattern.yml @@ -4,7 +4,7 @@ # SPDX-License-Identifier: MPL-2.0 # # Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm -# Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme +# Allows: AffineScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme name: RSR Anti-Pattern Check @@ -30,7 +30,7 @@ jobs: # Exclude .d.ts files - those are TypeScript type declarations for ReScript FFI TS_FILES=$(find . \( -name "*.ts" -o -name "*.tsx" \) | grep -v node_modules | grep -v 'bindings/deno' | grep -v '\.d\.ts$' || true) if [ -n "$TS_FILES" ]; then - echo "❌ TypeScript files detected - use ReScript instead" + echo "❌ TypeScript files detected - use AffineScript instead" echo "$TS_FILES" exit 1 fi @@ -66,7 +66,7 @@ jobs: - name: Check for tsconfig run: | if [ -f "tsconfig.json" ]; then - echo "❌ tsconfig.json detected - use ReScript instead" + echo "❌ tsconfig.json detected - use AffineScript instead" exit 1 fi echo "✅ No tsconfig.json" @@ -85,7 +85,7 @@ jobs: echo "╔════════════════════════════════════════════════════════════╗" echo "║ RSR Anti-Pattern Check Passed ✅ ║" echo "║ ║" - echo "║ Allowed: ReScript, Deno, WASM, Rust, OCaml, Haskell, ║" + echo "║ Allowed: AffineScript, Deno, WASM, Rust, OCaml, Haskell, ║" echo "║ Guile/Scheme, SaltStack (Python) ║" echo "║ ║" echo "║ Blocked: TypeScript, Go, npm, Python (non-Salt) ║" diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 098c2a93..cfaf484a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -12,7 +12,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8750b94ac1bbe8c51ad13fe106669b13478f0b62 permissions: contents: read security-events: write diff --git a/.gitignore b/.gitignore index 73f3573f..e9d7f367 100644 --- a/.gitignore +++ b/.gitignore @@ -9,75 +9,60 @@ Thumbs.db *~ .idea/ .vscode/ - # Build /target/ /_build/ /build/ /dist/ /out/ - # Dependencies /node_modules/ /vendor/ /deps/ /.elixir_ls/ - # Rust # Cargo.lock # Keep for binaries - # Elixir /cover/ /doc/ *.ez erl_crash.dump - # Julia *.jl.cov *.jl.mem /Manifest.toml - # ReScript /lib/bs/ /.bsb.lock - # Python (SaltStack only) __pycache__/ *.py[cod] .venv/ - # Ada/SPARK *.ali /obj/ /bin/ - # Haskell /.stack-work/ /dist-newstyle/ - # Chapel *.chpl.tmp.* - # Secrets .env .env.* *.pem *.key secrets/ - # Test/Coverage /coverage/ htmlcov/ - # Logs *.log /logs/ - # Temp /tmp/ *.tmp *.bak - # Crash recovery artifacts ai-cli-crash-capture/ target/ @@ -88,3 +73,26 @@ deps/ .cache/ build/ dist/ +# Build (unanchored to match nested monorepo paths) +zig-out/ +zig-cache/ +.zig-cache/ +# Machine-readable locks +.machine_readable/.locks/ +# ReScript/OCaml compiler artifacts +*.cmt +*.cmti +*.cmi +# asdf version manager +.tool-versions +# Rust build artefacts (innervation tools) +inline-annotations/extractor/target/ +k9-coordination-protocol/tools/k9-init/target/ +hooks/playbook-to-recipe/target/ +inline-annotations/extractor/Cargo.lock +k9-coordination-protocol/tools/k9-init/Cargo.lock +hooks/playbook-to-recipe/Cargo.lock +.verisimdb/ecosystem-ingest/target/ +.verisimdb/ecosystem-ingest/Cargo.lock +# Backup/scratch files (never commit) +*.backup diff --git a/.nojekyll b/.nojekyll deleted file mode 100644 index e69de29b..00000000 diff --git a/ABI-FFI-README.md b/ABI-FFI-README.md index f06f72cb..34d6b2cf 100644 --- a/ABI-FFI-README.md +++ b/ABI-FFI-README.md @@ -339,8 +339,8 @@ zig build test-integration -- Runtime checks main : IO () main = do - verifyLayoutsCorrect - verifyAlignmentsCorrect + verifyLayouorrect + verifyAlignmenorrect putStrLn "ABI verification passed" ``` diff --git a/FUNDING b/FUNDING new file mode 100644 index 00000000..7e58d67e --- /dev/null +++ b/FUNDING @@ -0,0 +1,34 @@ +// SPDX-License-Identifier: MPL-2.0 for code +// SPDX-License-Identifier: CC-BY-SA-4.0 for documentation +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell + += Funding +:toc: macro +:toclevels: 2 + +This document lists the supported funding platforms for the hyperpolymath and metadatastician estates. + +== Supported Funding Platforms + +[cols="1,1",options="header"] +|=== +| Platform | Username +| Buy Me a Coffee | jonathan.jewell +| Community Bridge | jonathan-jewell +| GitHub Sponsors | hyperpolymath +| IndieWeb | +| IssueHunt | hyperpolymath +| Ko-fi | hyperpolymath +| LFX Crowdfunding | hyperpolymath +| LiberaPay | hyperpolymath +| Open Collective | jonathan-jewell +| Patreon | cc_studio +| Polar | hyperpolymath +| Thanks Dev | hyperpolymath +|=== + +== Usage + +These platforms provide financial support mechanisms for the projects within the hyperpolymath and metadatastician estates. Contributions through any of these platforms help sustain development, maintenance, and governance of the open source projects. + +For more information about contributing or sponsoring specific projects, please refer to the project's README file or contact the maintainers directly. diff --git a/ffi/zig/.zig-cache/h/50fdc878b8c3040575afdeacca469e44.txt b/ffi/zig/.zig-cache/h/50fdc878b8c3040575afdeacca469e44.txt deleted file mode 100644 index e69de29b..00000000 diff --git a/ffi/zig/.zig-cache/h/9f710f6731aa94d02fcb1d79abb753c9.txt b/ffi/zig/.zig-cache/h/9f710f6731aa94d02fcb1d79abb753c9.txt deleted file mode 100644 index e69de29b..00000000 diff --git a/ffi/zig/.zig-cache/h/timestamp b/ffi/zig/.zig-cache/h/timestamp deleted file mode 100644 index e69de29b..00000000 From f169ad2a3270dcacf136fd8c67015e69cc5beb43 Mon Sep 17 00:00:00 2001 From: Mistral Vibe Date: Fri, 11 Sep 2026 14:16:07 +0100 Subject: [PATCH 3/3] Fix TokenPermissionsID: apply least-privilege permissions Apply principle of least privilege for GITHUB_TOKEN: - Change top-level permissions to read-only - Jobs inherit read permissions, can escalate as needed This resolves Scorecard TokenPermissionsID alerts. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/dependabot-automerge.yml | 2 +- .github/workflows/ingest.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 394f1b3e..e902b83c 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -42,7 +42,7 @@ on: types: [opened, reopened, synchronize] permissions: - contents: write # needed to enable auto-merge + contents: read # needed to enable auto-merge pull-requests: write # needed to approve # NB: keep narrow — do NOT add secrets: read or id-token: write here. diff --git a/.github/workflows/ingest.yml b/.github/workflows/ingest.yml index d926e856..db18da17 100644 --- a/.github/workflows/ingest.yml +++ b/.github/workflows/ingest.yml @@ -16,7 +16,7 @@ on: required: true permissions: - contents: write + contents: read # Serialize ingests: concurrent repository_dispatch deliveries race on # the commit+push and one writer loses. Queue them instead.