Skip to content

Commit f55e737

Browse files
hyperpolymathmistral-vibe
hyperpolymath
and
mistral-vibe
authored
Security/remediate critical injection (#296)
Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai>
1 parent 02f17de commit f55e737

50 files changed

Lines changed: 903 additions & 100 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ permissions:
2525

2626
jobs:
2727
hypatia:
28-
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89
28+
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242
2929
secrets: inherit
3030
# Total caller-side wall-clock cap for the reusable. Matches
3131
# Hypatia's `missing_timeout_minutes` rule expectation. The scan is

‎.machine_readable/MUST.contractile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
; remain active until the feature is fully removed.
2727
;
2828
; Enforcement:
29-
; K9 validators in contractiles/k9/ machine-check MUST constraints.
29+
; K9 validators in contractiles/self-validating/ machine-check MUST constraints.
3030
; CI runs these on every PR. Violations block merge.
3131
;
3232
; ── End Definitions ──────────────────────────────────────────────
@@ -85,7 +85,7 @@
8585
; (must "# Add project-specific invariants here")
8686

8787
(enforcement
88-
(k9-validator "contractiles/k9/must-check.k9.ncl")
88+
(k9-validator "contractiles/self-validating/must-check.k9.ncl")
8989
(ci "quality.yml runs must-check on every PR")
9090
)
9191
)

.machine_readable/agent_instructions/README.adoc renamed to .machine_readable/bot_directives/README.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ Methodology-aware configuration for AI agents. Read by any AI agent
3232
== Relationship to Other Files
3333

3434
* `AGENTIC.a2ml` says WHAT agents can do (permissions, gating)
35-
* `agent_instructions/` says HOW agents should work (methodology)
35+
* `bot_directives/` says HOW agents should work (methodology)
3636
* `bot_directives/` says what the gitbot-fleet does (fleet-specific)
3737
* `CLAUDE.md` says how Claude specifically should work (Claude-specific)
3838

.machine_readable/agent_instructions/coverage.a2ml renamed to .machine_readable/bot_directives/coverage.a2ml

File renamed without changes.

.machine_readable/agent_instructions/debt.a2ml renamed to .machine_readable/bot_directives/debt.a2ml

File renamed without changes.

.machine_readable/agent_instructions/methodology.a2ml renamed to .machine_readable/bot_directives/methodology.a2ml

File renamed without changes.

‎EXPLAINME.adoc‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -139,9 +139,12 @@ execution testing. Gates the path from draft to publishable.
139139
| `bots/finishingbot/`
140140
|===
141141

142-
Additional bots present in `bots/`: `accessibilitybot`, `cipherbot`, `panicbot`
143-
(pre-commit gate wrapping panic-attacker), `gsbot` (game-server integration),
144-
`the-hotchocolabot` (onboarding/warmth checks).
142+
Additional fleet bots present in `bots/`: `accessibilitybot`, `cipherbot`,
143+
`panicbot` (pre-commit gate wrapping panic-attacker).
144+
145+
Standalone repos that are not part of gitbot-fleet but are still maintained in
146+
the estate: `gsbot` (https://github.com/hyperpolymath/gsbot) and
147+
`hotchocolabot` (https://github.com/hyperpolymath/hotchocolabot).
145148

146149
== Dogfooded Across The Account
147150

‎GOVERNANCE.adoc‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
// SPDX-License-Identifier: MPL-2.0
2+
// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
3+
= Governance Model
4+
:toc: preamble
5+
6+
This document describes the governance model for this repository.
7+
8+
== Overview
9+
10+
This repository follows a **Sole Maintainer Governance Model**:
11+
12+
* Single maintainer (@hyperpolymath) has full authority over the project
13+
* All contributions are welcome and reviewed by the maintainer
14+
* Decisions are made transparently through GitHub issues and discussions
15+
* The project adheres to the hyperpolymath estate policies where applicable
16+
17+
== Core Principles
18+
19+
[cols="1,2"]
20+
|===
21+
| Principle | Description
22+
23+
| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input
24+
25+
| **Meritocracy** | Contributions are judged on technical merit, not contributor identity
26+
27+
| **Transparency** | All significant decisions are documented publicly
28+
29+
| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary
30+
31+
| **Open Contribution** | Anyone can contribute via fork and pull request
32+
33+
|===
34+
35+
== Roles and Permissions
36+
37+
[cols="1,2,2"]
38+
|===
39+
| Role | Permissions | Assignment
40+
41+
| **Maintainer** | Write access, merge rights, admin | @hyperpolymath
42+
| **Contributors** | Read access, fork, submit PRs | All GitHub users
43+
| **Users** | Use the software, report issues | All GitHub users
44+
45+
|===
46+
47+
== Decision Making Framework
48+
49+
=== Routine Decisions
50+
51+
* Bug fixes
52+
* Documentation improvements
53+
* Minor feature additions
54+
* Dependency updates
55+
56+
**Process**: Maintainer reviews and merges PRs that meet quality standards.
57+
58+
=== Significant Changes
59+
60+
* New major features
61+
* API changes
62+
* Architecture modifications
63+
* Breaking changes
64+
65+
**Process**:
66+
. Open issue describing the change
67+
. Discuss with community (minimum 72 hours)
68+
. Maintainer makes final decision
69+
. Document rationale in issue/PR
70+
71+
=== Structural Decisions
72+
73+
* Repository purpose/renaming
74+
* License changes
75+
* Ownership transfer
76+
* Deprecation/archival
77+
78+
**Process**:
79+
. Extended discussion (minimum 1 week)
80+
. Maintainer makes final decision
81+
. Document in CHANGELOG and governance docs
82+
83+
== Contribution Lifecycle
84+
85+
[cols="1,2"]
86+
|===
87+
| Stage | Process
88+
89+
| **Ideation** | Open issue, discuss feasibility
90+
91+
| **Development** | Fork, implement, test thoroughly
92+
93+
| **Review** | Submit PR, maintainer reviews within 7 days
94+
95+
| **Merge** | Maintainer merges or requests changes
96+
97+
| **Release** | Maintainer publishes according to project conventions
98+
99+
|===
100+
101+
== Conflict Resolution
102+
103+
In case of disagreements:
104+
105+
. Discuss in the relevant GitHub issue or PR
106+
. Provide technical justification for positions
107+
. Maintainer mediates and makes final decision
108+
. Decision is documented and can be revisited later
109+
110+
== Project Policies
111+
112+
This repository adheres to hyperpolymath estate-wide policies:
113+
114+
* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc)
115+
* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md
116+
* **Security**: Follows hyperpolymath SECURITY.md
117+
* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions
118+
119+
== Repository-Specific Conventions
120+
121+
[cols="1,2"]
122+
|===
123+
| Convention | Description
124+
125+
| **Signing** | All commits must be signed (SSH or GPG)
126+
127+
| **SPDX Headers** | All source files must have SPDX license identifiers
128+
129+
| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root
130+
131+
| **Machine Readable** | META.a2ml in .machine_readable/6a2/
132+
133+
| **CI/CD** | GitHub Actions workflows in .github/workflows/
134+
135+
|===
136+
137+
== Governance Evolution
138+
139+
As the project grows, this governance model may evolve:
140+
141+
* **Adding Co-Maintainers**: When contribution volume warrants it
142+
* **Forming a Team**: For complex multi-maintainer projects
143+
* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories)
144+
145+
Changes to this document require the same process as Significant Changes above.
146+
147+
== See Also
148+
149+
* link:MAINTAINERS.adoc[Maintainers]
150+
* link:CODE_OF_CONDUCT.md[Code of Conduct]
151+
* link:CONTRIBUTING.adoc[Contributing Guide]
152+
* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy]
153+
* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)]
154+
155+
== Changelog
156+
157+
[cols="1,1,1"]
158+
|===
159+
| Date | Change | By
160+
161+
| 2026-06-07 | Initial governance model established | @hyperpolymath
162+
|===

‎README.adoc‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ toc::[]
1616

1717
== Overview
1818

19-
Gitbot Fleet coordinates 11 specialised bots through a shared-context layer. The
19+
Gitbot Fleet coordinates 9 specialised bots through a shared-context layer. The
2020
`fleet-coordinator` dispatches Hypatia scanner findings to bots based on
2121
the **safety triangle**:
2222

@@ -82,21 +82,18 @@ The historical `TOPOLOGY.md` dashboard is at the repo root.
8282
|Release readiness. Placeholder removal, license validation, claim verification, execution testing.
8383
|Complete
8484

85-
|**gsbot**
86-
|Discord bot for garment sustainability. Sustainability scores, environmental impact analysis, sustainable brand discovery.
87-
|Active
88-
8985
|**panicbot**
9086
|Panic recovery and error handling validation. Ensures graceful degradation and proper error handling patterns.
9187
|Active
92-
93-
|**the-hotchocolabot**
94-
|Educational robotics platform for teaching reverse engineering and systems thinking. Over-engineered hot chocolate dispenser.
95-
|Active
9688
|===
9789

9890
*Status legend:* `Active` = Tier 1 Verifier or Specialist bot running on every push. `Complete` = Tier 2 Finisher bot that runs after verifiers to validate final release readiness.
9991

92+
Standalone repos that are intentionally not fleet bots:
93+
94+
* `gsbot` - https://github.com/hyperpolymath/gsbot
95+
* `hotchocolabot` - https://github.com/hyperpolymath/hotchocolabot
96+
10097
The component-readiness assessment (CRG grades, evidence) lives in
10198
link:READINESS.md[READINESS.md].
10299

‎ROADMAP.adoc‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ toc::[]
1212

1313
== Current State
1414

15-
Gitbot Fleet coordinates 11 bots through a shared-context system with safety-triangle-aware
15+
Gitbot Fleet coordinates 9 bots through a shared-context system with safety-triangle-aware
1616
routing. The fleet-coordinator dispatches findings from Hypatia scans to specialised bots
1717
based on confidence thresholds (Eliminate >= 0.95, Substitute >= 0.85, Control < 0.85).
1818

@@ -29,12 +29,15 @@ based on confidence thresholds (Eliminate >= 0.95, Substitute >= 0.85, Control <
2929
| seambot | Integration seam maintenance | Yes
3030
| finishingbot | Completion of partial work | Yes
3131
| panicbot | Security scanning (panic-attack) | No (uses panic-attack roadmap)
32-
| gsbot | Git-seo, discoverability | Yes
3332
| accessibilitybot | Accessibility compliance | Yes
3433
| cipherbot | Cryptographic hygiene | Yes
35-
| the-hotchocolabot | Developer experience, warmth | Yes
3634
|===
3735

36+
Standalone repos kept out of the fleet roster:
37+
38+
* `gsbot` - separate repo: https://github.com/hyperpolymath/gsbot
39+
* `hotchocolabot` - separate repo: https://github.com/hyperpolymath/hotchocolabot
40+
3841
**Infrastructure:**
3942

4043
* fleet-coordinator.sh -- orchestration layer

0 commit comments

Comments
 (0)