Skip to content

Commit 0436227

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
authored
Review SCM files and security updates (#3)
- Fix security.txt expiry date (was placeholder {{EXPIRY_DATE}}) - Add flake.nix for Nix fallback (RSR requirement) - Update RSR_COMPLIANCE.adoc with current compliance status - Update STATE.scm roadmap and completion (25% → 35%) - Add CHANGELOG.md following Keep a Changelog format Co-authored-by: Claude <noreply@anthropic.com>
1 parent 5f24b4c commit 0436227

5 files changed

Lines changed: 167 additions & 18 deletions

File tree

‎.well-known/security.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# https://securitytxt.org/
33

44
Contact: security@hyperpolymath.org
5-
Expires: {{EXPIRY_DATE}}
5+
Expires: 2026-12-17T00:00:00.000Z
66
Encryption: https://hyperpolymath.org/gpg/security.asc
77
Preferred-Languages: en, nl
88
Canonical: https://github.com/hyperpolymath/checky-monkey/.well-known/security.txt

‎CHANGELOG.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file.
4+
5+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7+
8+
## [Unreleased]
9+
10+
### Added
11+
- `flake.nix` - Nix fallback package management (RSR requirement)
12+
- `CHANGELOG.md` - Project changelog following Keep a Changelog format
13+
14+
### Fixed
15+
- `security.txt` - RFC 9116 compliance with valid expiry date (was placeholder)
16+
- `RSR_COMPLIANCE.adoc` - Updated compliance status to reflect current state
17+
18+
### Changed
19+
- `STATE.scm` - Updated roadmap and completion status (25% → 35%)
20+
21+
## [0.1.0] - 2025-12-15
22+
23+
### Added
24+
- Initial project structure with RSR compliance
25+
- `guix.scm` - Primary package management (Guix)
26+
- `.guix-channel` - Guix channel configuration
27+
- `META.scm` - Architecture Decision Records
28+
- `ECOSYSTEM.scm` - Project relationships
29+
- `STATE.scm` - Session state persistence
30+
- GitHub Actions workflows:
31+
- `security-policy.yml` - Security checks (weak crypto, HTTP, secrets)
32+
- `quality.yml` - Code quality (TruffleHog, EditorConfig)
33+
- `workflow-linter.yml` - RSR workflow validation
34+
- `guix-nix-policy.yml` - Package manager enforcement
35+
- `npm-bun-blocker.yml` - Forbidden package manager blocking
36+
- `wellknown-enforcement.yml` - RFC 9116 validation
37+
- `scorecard.yml` - OSSF Scorecard security analysis
38+
- `mirror.yml` - Multi-platform mirroring
39+
- `codeql.yml` - Static analysis (placeholder)
40+
- `.well-known/` directory:
41+
- `security.txt` - RFC 9116 security contact
42+
- `ai.txt` - Consent-aware AI policy
43+
- `humans.txt` - Human-readable credits
44+
- `consent-required.txt` - HTTP 430 consent framework
45+
- `provenance.json` - Source provenance
46+
- Community files:
47+
- `SECURITY.md` - Security policy
48+
- `CONTRIBUTING.md` - Contribution guidelines
49+
- `CODE_OF_CONDUCT.md` - Contributor Covenant v2.1
50+
- `CITATION.cff` - Citation metadata
51+
- `codemeta.json` - CodeMeta metadata
52+
- Configuration files:
53+
- `.editorconfig` - Editor configuration
54+
- `.gitignore` - Git ignore patterns
55+
- `.gitattributes` - Git attributes
56+
- `justfile` - Task runner (TODO recipes)
57+
- `.gitlab-ci.yml` - GitLab CI/CD pipeline
58+
- `dependabot.yml` - Dependency automation
59+
60+
[Unreleased]: https://github.com/hyperpolymath/checky-monkey/compare/v0.1.0...HEAD
61+
[0.1.0]: https://github.com/hyperpolymath/checky-monkey/releases/tag/v0.1.0

‎RSR_COMPLIANCE.adoc‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ This document describes the Rhodium Standard Repository (RSR) compliance status
1313
|Attribute |Value
1414

1515
|Project |checky-monkey
16-
|Primary Language |unknown
17-
|RSR Tier |N/A
18-
|Compliance Status |Review Needed
19-
|Last Updated |2025-12-10
16+
|Primary Language |Guile Scheme
17+
|RSR Tier |Tier 2
18+
|Compliance Status |Gold Target
19+
|Last Updated |2025-12-17
2020
|===
2121

2222
== Language Tier Classification
@@ -46,14 +46,14 @@ This document describes the Rhodium Standard Repository (RSR) compliance status
4646
|===
4747
|Requirement |Status |Notes
4848

49-
|Primary language is Tier 1/2 |✓ |unknown
49+
|Primary language is Tier 1/2 |✓ |Guile Scheme (Tier 2)
5050
|No restricted languages outside exemptions |✓ |
5151
|.editorconfig present |✓ |
5252
|.well-known/ directory |✓ |
53-
|justfile present |✗ |
54-
|LICENSE.txt (AGPL + Palimpsest) |✗ |
53+
|justfile present |✓ |
54+
|LICENSE.txt (AGPL + Palimpsest) |✓ |
5555
|Containerfile present |✗ |
56-
|flake.nix present |✗ |
56+
|flake.nix present |✓ |
5757
|===
5858

5959
== Exemptions
@@ -62,9 +62,7 @@ None
6262

6363
== Action Items
6464

65-
* Add justfile
6665
* Add Containerfile
67-
* Add flake.nix
6866

6967
== References
7068

‎STATE.scm‎

Lines changed: 30 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
'((version . "0.1.0")
1616
(schema-version . "1.0")
1717
(created . "2025-12-15")
18-
(updated . "2025-12-15")
18+
(updated . "2025-12-18")
1919
(project . "checky-monkey")
2020
(repo . "github.com/hyperpolymath/checky-monkey")))
2121

@@ -41,18 +41,28 @@
4141

4242
(define current-position
4343
'((phase . "v0.1 - Initial Setup and RSR Compliance")
44-
(overall-completion . 25)
44+
(overall-completion . 35)
4545

4646
(components
4747
((rsr-compliance
4848
((status . "complete")
4949
(completion . 100)
5050
(notes . "SHA-pinned actions, SPDX headers, multi-platform CI")))
5151

52+
(security
53+
((status . "complete")
54+
(completion . 100)
55+
(notes . "RFC 9116 security.txt, wellknown-enforcement, no weak crypto")))
56+
57+
(package-management
58+
((status . "complete")
59+
(completion . 100)
60+
(notes . "guix.scm (primary), flake.nix (fallback), npm/bun blocked")))
61+
5262
(documentation
5363
((status . "foundation")
54-
(completion . 30)
55-
(notes . "README exists, META/ECOSYSTEM/STATE.scm added")))
64+
(completion . 40)
65+
(notes . "README, META/ECOSYSTEM/STATE.scm, RSR_COMPLIANCE updated")))
5666

5767
(testing
5868
((status . "minimal")
@@ -68,7 +78,11 @@
6878
("RSR-compliant CI/CD pipeline"
6979
"Multi-platform mirroring (GitHub, GitLab, Bitbucket)"
7080
"SPDX license headers on all files"
71-
"SHA-pinned GitHub Actions"))))
81+
"SHA-pinned GitHub Actions"
82+
"RFC 9116 security.txt with valid expiry"
83+
"Guix primary + Nix fallback package management"
84+
"npm/bun blocker workflow"
85+
"Workflow security linter"))))
7286

7387
;;;============================================================================
7488
;;; ROUTE TO MVP
@@ -151,6 +165,15 @@
151165

152166
(define session-history
153167
'((snapshots
168+
((date . "2025-12-18")
169+
(session . "security-review-and-scm-fixes")
170+
(accomplishments
171+
("Fixed security.txt expiry date (RFC 9116 compliance)"
172+
"Created flake.nix (Nix fallback for RSR)"
173+
"Updated RSR_COMPLIANCE.adoc status"
174+
"Updated STATE.scm with current roadmap"
175+
"Verified all CI/CD workflows"))
176+
(notes . "Security audit and SCM file review"))
154177
((date . "2025-12-15")
155178
(session . "initial-state-creation")
156179
(accomplishments
@@ -185,10 +208,10 @@
185208
(define state-summary
186209
'((project . "checky-monkey")
187210
(version . "0.1.0")
188-
(overall-completion . 25)
211+
(overall-completion . 35)
189212
(next-milestone . "v0.2 - Core Functionality")
190213
(critical-blockers . 0)
191214
(high-priority-issues . 0)
192-
(updated . "2025-12-15")))
215+
(updated . "2025-12-18")))
193216

194217
;;; End of STATE.scm

‎flake.nix‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
3+
#
4+
# flake.nix - Nix Flake (fallback package management)
5+
# Primary: guix.scm | Fallback: flake.nix
6+
# Run: nix develop
7+
{
8+
description = "checky-monkey - RSR-compliant infrastructure project";
9+
10+
inputs = {
11+
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
12+
flake-utils.url = "github:numtide/flake-utils";
13+
};
14+
15+
outputs = { self, nixpkgs, flake-utils }:
16+
flake-utils.lib.eachDefaultSystem (system:
17+
let
18+
pkgs = nixpkgs.legacyPackages.${system};
19+
in
20+
{
21+
packages.default = pkgs.stdenv.mkDerivation {
22+
pname = "checky-monkey";
23+
version = "0.1.0";
24+
src = ./.;
25+
26+
meta = with pkgs.lib; {
27+
description = "RSR-compliant infrastructure project";
28+
homepage = "https://github.com/hyperpolymath/checky-monkey";
29+
license = licenses.agpl3Plus;
30+
maintainers = [ ];
31+
platforms = platforms.all;
32+
};
33+
};
34+
35+
devShells.default = pkgs.mkShell {
36+
buildInputs = with pkgs; [
37+
# Core tools
38+
git
39+
gnumake
40+
just
41+
42+
# Guile Scheme (for SCM files)
43+
guile
44+
45+
# Security tools
46+
trufflehog
47+
trivy
48+
49+
# Linters
50+
shellcheck
51+
yamllint
52+
editorconfig-checker
53+
];
54+
55+
shellHook = ''
56+
echo "checky-monkey development environment"
57+
echo "Primary SCM: guix.scm"
58+
echo "Fallback SCM: flake.nix (this file)"
59+
echo ""
60+
echo "Available commands:"
61+
echo " just --list # Show available tasks"
62+
echo " guile META.scm # Evaluate architecture decisions"
63+
'';
64+
};
65+
}
66+
);
67+
}

0 commit comments

Comments
 (0)