Skip to content

Commit 15383b4

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
feat: consolidate boj-server-mistral and boj-server-gemini into unified boj-server
Merges best-of-breed from three repos into the canonical boj-server: From boj-server-gemini: - PanLL ReScript/TEA UI components (BojModel, BojEngine, Boj, BojModule) - Gemini CLI extension config (gemini-extension.json, GEMINI.md) - Farm/fleet enrollment configs - Updated EXHIBIT-A (Ethical Use) and EXHIBIT-B (Quantum-Safe Provenance) From boj-server-mistral: - 9 architecture docs (Quantum Security, HSM, Marketplace, BoJ OS, Formal Verification, Type Safety, Zero Trust, SDP, Gossip Protocol) - Cartridge tools specification - Intentfile and Mustfile (contractile invariants) Also includes pre-existing fixes: - Constant-time comparison in webhook HMAC verification - Hypatia vulnerability-scanning and dependency-update rules MCP bridges were identical across all three repos — no merge needed. All 18 Zig FFI test suites pass (307 tests). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent f49e816 commit 15383b4

25 files changed

Lines changed: 10688 additions & 177 deletions

‎.hypatia/scorecard-rules.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,23 @@ rules:
7474
- docs/SECURITY.md
7575
remediation: "Add SECURITY.md with vulnerability reporting instructions"
7676

77+
vulnerability-scanning:
78+
severity: high
79+
description: "Repository must have automated vulnerability scanning (Gitleaks, TruffleHog, etc.)"
80+
checks:
81+
- workflow_exists: secret-scanner.yml
82+
- uses_action: gitleaks/gitleaks-action
83+
- uses_action: trufflesecurity/trufflehog
84+
remediation: "Add .github/workflows/secret-scanner.yml with Gitleaks/TruffleHog"
85+
86+
dependency-update-tool:
87+
severity: medium
88+
description: "Repository must use an automated dependency update tool (Dependabot, Renovate)"
89+
checks:
90+
- file_exists: .github/dependabot.yml
91+
- file_exists: renovate.json
92+
remediation: "Create .github/dependabot.yml to enable automated updates"
93+
7794
# --- Workflow-specific rules ---
7895

7996
action-sha-pinning:

‎.machine_readable/farm-config.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"farm_enrollment": {
3+
"repository": "hyperpolymath/boj-server",
4+
"tier": "tier-1-critical",
5+
"sync_interval": "daily",
6+
"backup_strategy": "distributed-ipfs",
7+
"branch_protection_enforced": true
8+
}
9+
}

‎.machine_readable/fleet-enrollment.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"enrollment": {
3+
"project": "boj-server",
4+
"fleet": "gitbot-fleet",
5+
"status": "active",
6+
"managed_bots": [
7+
"panicbot",
8+
"hypatiabot",
9+
"a2mlbot"
10+
],
11+
"auto_remediate": true
12+
}
13+
}

‎GEMINI.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# BoJ Server Gemini Extension
2+
3+
This extension integrates the **Bundle of Joy (BoJ) Server** infrastructure directly into Gemini CLI.
4+
5+
## Core Mandates
6+
7+
- **Teranga (Hospitality):** Always provide the most verified, "Unbreakable" tools to the user.
8+
- **Umoja (Unity):** Favor unified tool calls over fragmented separate utilities.
9+
- **Ayọ (Joy):** Ensure tool interactions are smooth and provide helpful, clear feedback.
10+
11+
## Available Capabilities
12+
13+
- **Database:** Query formally verified databases (VeriSimDB, etc.)
14+
- **Containers:** Manage lifecycle of Stapeln-compliant OCI containers.
15+
- **Cloud:** Orchestrate resources across Cloudflare, Vercel, and Verpex.
16+
- **Fleet:** Monitor and manage the hyperpolymath bot fleet.
17+
- **Git:** Cross-forge repository management.
18+
19+
## Technical Standards
20+
21+
- All cartridge logic is formally verified via Idris2 ABIs.
22+
- Memory safety is guaranteed by Zig FFI layers.
23+
- High-performance networking provided by the V-lang Triple Adapter.

‎Intentfile‎

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
# BoJ Server Intentfile (Lustfile)
2+
# Defines the intentions and invariants for AI agents accessing the repository.
3+
# AI agents must comply with these intentions when interacting with the repo.
4+
5+
---
6+
# --- AI Agent Invariants ---
7+
ai_agent_invariants:
8+
- name: "Respect Palimpsest-MPL 1.0"
9+
description: "AI agents must respect the Palimpsest-MPL 1.0 license and not contribute to corporate enclosure."
10+
scope: ["read", "write", "admin"]
11+
must: true
12+
13+
- name: "Maintain Unbreakable Stack"
14+
description: "AI agents must not modify the Unbreakable Stack (Idris2 ABI, Zig FFI, V-lang Triple Adapter, A2ML Manifests) unless explicitly approved by maintainers."
15+
scope: ["read", "write"]
16+
must: true
17+
18+
- name: "Sign Cartridges"
19+
description: "AI agents must sign all cartridges with Sigstore before deployment."
20+
scope: ["write"]
21+
must: true
22+
23+
- name: "Follow Security Policies"
24+
description: "AI agents must follow all security policies defined in Trustfile."
25+
scope: ["read", "write", "admin"]
26+
must: true
27+
28+
- name: "Update Documentation"
29+
description: "AI agents must update documentation (README, docs/) when making changes to the codebase."
30+
scope: ["write"]
31+
should: true
32+
33+
- name: "Respect Community Guidelines"
34+
description: "AI agents must follow the BoJ community guidelines and code of conduct."
35+
scope: ["read", "write"]
36+
must: true
37+
38+
- name: "Avoid Hardcoded Secrets"
39+
description: "AI agents must not introduce hardcoded secrets or API keys."
40+
scope: ["write"]
41+
must: true
42+
43+
- name: "Validate A2ML Manifests"
44+
description: "AI agents must validate A2ML Manifests before deploying cartridges."
45+
scope: ["write"]
46+
must: true
47+
48+
- name: "Respect Trust Boundaries"
49+
description: "AI agents must respect the trust boundaries defined in Trustfile."
50+
scope: ["read", "write", "admin"]
51+
must: true
52+
53+
- name: "Report Vulnerabilities"
54+
description: "AI agents must report any security vulnerabilities to security@boj.dev."
55+
scope: ["read", "write"]
56+
should: true
57+
58+
# --- AI Agent Capabilities ---
59+
ai_agent_capabilities:
60+
- name: "Read Repository"
61+
description: "AI agents can read the repository for learning or collaboration."
62+
scope: ["read"]
63+
constraints:
64+
- Must not scrape sensitive data.
65+
- Must respect rate limits.
66+
example_actions:
67+
- "Read README.md"
68+
- "View logs: `kubectl logs <pod_name>`"
69+
- "Query BoJ API: `curl http://localhost:4000/api/cartridges`"
70+
71+
- name: "Write to Repository"
72+
description: "AI agents can contribute to the repository (e.g., bug fixes, features)."
73+
scope: ["write"]
74+
constraints:
75+
- Must follow PR review process.
76+
- Must pass CI/CD checks.
77+
- Must update documentation.
78+
example_actions:
79+
- "Submit a PR to fix a bug."
80+
- "Add a new cartridge."
81+
- "Update STATE.md"
82+
83+
- name: "Administer Repository"
84+
description: "AI agents with maintainer access can perform administrative tasks."
85+
scope: ["admin"]
86+
constraints:
87+
- Must follow governance model.
88+
- Must document changes.
89+
- Must notify community of major updates.
90+
example_actions:
91+
- "Cut a release."
92+
- "Merge a PR."
93+
- "Update META.md"
94+
95+
- name: "Deploy Cartridges"
96+
description: "AI agents can deploy cartridges to BoJ Server."
97+
scope: ["deploy"]
98+
constraints:
99+
- Must sign cartridges with Sigstore.
100+
- Must validate A2ML Manifests.
101+
- Must follow deployment playbooks.
102+
example_actions:
103+
- "Deploy a new cartridge: `just deploy-cartridge my-ai 1.0.0 boj-server`"
104+
- "Scale BoJ nodes: `just deploy-multiplier`"
105+
106+
- name: "Sign"
107+
description: "AI agents can sign cartridges with Sigstore."
108+
scope: ["sign"]
109+
constraints:
110+
- Must have access to Sigstore keys.
111+
- Must verify cartridge integrity.
112+
example_actions:
113+
- "Sign a cartridge: `cosign sign my-cartridge:1.0.0`"
114+
115+
# --- AI Agent Actions ---
116+
ai_agent_actions:
117+
- name: "Update STATE.md"
118+
description: "AI agents can update STATE.md to reflect changes in the repository state."
119+
scope: ["write"]
120+
constraints:
121+
- Must comply with core invariants.
122+
- Must document changes in commit messages.
123+
124+
- name: "Update ECOSYSTEM.md"
125+
description: "AI agents can update ECOSYSTEM.md to reflect changes in the external ecosystem."
126+
scope: ["write"]
127+
constraints:
128+
- Must cite sources.
129+
- Must follow community guidelines.
130+
131+
- name: "Update META.md"
132+
description: "AI agents can update META.md to reflect changes in repository metadata."
133+
scope: ["write"]
134+
constraints:
135+
- Must update version numbers.
136+
- Must document changes.
137+
138+
- name: "Update PLAYBOOK.md"
139+
description: "AI agents can update PLAYBOOK.md to reflect changes in operational playbooks."
140+
scope: ["write"]
141+
constraints:
142+
- Must follow security policies.
143+
- Must document new procedures.
144+
145+
- name: "Update NEUROSYM.md"
146+
description: "AI agents can update NEUROSYM.md to reflect changes in symbolic/neural representations."
147+
scope: ["write"]
148+
constraints:
149+
- Must maintain consistency with core architecture.
150+
- Must document rationale.
151+
152+
- name: "Update AGENTIC.md"
153+
description: "AI agents can update AGENTIC.md to reflect changes in agent-specific capabilities."
154+
scope: ["write"]
155+
constraints:
156+
- Must align with Intentfile.
157+
- Must document new capabilities.
158+
159+
# --- AI Agent Logging ---
160+
ai_agent_logging:
161+
- name: "Log All Actions"
162+
description: "AI agents must log all actions taken in the repository."
163+
scope: ["read", "write", "admin", "deploy", "sign"]
164+
log_format:
165+
- "timestamp: <ISO8601>"
166+
- "ai_agent_id: <identifier>"
167+
- "action: <read|write|admin|deploy|sign>"
168+
- "target: <file|endpoint|resource>"
169+
- "result: <success|failure>"
170+
- "details: <optional>"
171+
example_log:
172+
- |
173+
timestamp: "2026-03-19T12:00:00Z"
174+
ai_agent_id: "ai-agent-123"
175+
action: "write"
176+
target: "cartridges/my-ai/README.md"
177+
result: "success"
178+
details: "Added documentation for sentiment analysis cartridge."
179+
180+
# --- AI Agent Verification ---
181+
verify-intent:
182+
- name: "Check AI Agent Invariants"
183+
command: "grep -A 5 'ai_agent_invariants' Intentfile"
184+
description: "Verify AI agent invariants are being followed."
185+
- name: "Review AI Agent Actions"
186+
command: "grep -A 5 'ai_agent_actions' Intentfile"
187+
description: "Review allowed AI agent actions."
188+
- name: "Check AI Agent Logging"
189+
command: "tail -n 20 /var/log/boj/ai_agent_actions.log"
190+
description: "Verify AI agent actions are being logged."

0 commit comments

Comments
 (0)