From d400308c6d2323341a13d3d315f242f2640bec51 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 28 May 2026 08:58:23 +0100 Subject: [PATCH 1/8] fix(licence): align everything to MPL-2.0 (governance Licence-consistency CI green) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit LICENSE file is MPL-2.0 but 39 satellite files declared PMPL-1.0-or-later (SPDX headers, manifest licence fields, badge, docs). The standards `check-licence-consistency.sh` script compares SPDX header vs each manifest declaration and was failing on `julia-professional-registry-tests.ipkg`. This PR resolves everything in favour of MPL-2.0 per owner directive: - SPDX headers: `PMPL-1.0-or-later` → `MPL-2.0` across 36 files (workflows, .a2ml manifests, docs, ipkg, Justfile-style, scheme) - Manifest licence fields: `stapeln.toml`, `.machine_readable/6a2/META.a2ml` - Human-visible: GOVERNANCE/TOPOLOGY/CONTRIBUTING/llm-warmup docs - README badge: PMPL-1.0 (palimpsest-license) → MPL-2.0 (mozilla.org) - `guix.scm`: dropped palimpsest-license URL, points at mozilla.org MPL/2.0 - `flake.nix`: `licenses.mit` (stale comment said MIT+Palimpsest) → `mpl20` - `contractile.just` + `contractiles/trust/Trustfile.a2ml`: removed `PMPL` from the grep alternation in trust-license-content Verified locally: `bash standards/scripts/check-licence-consistency.sh` now reports `[OK] Licence consistency check passed.` Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/copilot-instructions.md | 4 ++-- .github/pull_request_template.md | 2 +- .github/workflows/boj-build.yml | 2 +- .github/workflows/casket-pages.yml | 2 +- .github/workflows/governance.yml | 2 +- .machine_readable/6a2/ECOSYSTEM.a2ml | 2 +- .machine_readable/6a2/META.a2ml | 4 ++-- .machine_readable/6a2/STATE.a2ml | 2 +- .machine_readable/CLADE.a2ml | 2 +- .machine_readable/agent_instructions/README.adoc | 2 +- .machine_readable/agent_instructions/coverage.a2ml | 2 +- .machine_readable/agent_instructions/debt.a2ml | 2 +- .machine_readable/agent_instructions/methodology.a2ml | 2 +- .machine_readable/contractiles/bust/Bustfile.a2ml | 2 +- .machine_readable/contractiles/dust/Dustfile.a2ml | 2 +- .machine_readable/contractiles/trust/Trustfile.a2ml | 2 +- .machine_readable/integrations/feedback-o-tron.a2ml | 2 +- .machine_readable/integrations/proven.a2ml | 2 +- .machine_readable/integrations/verisimdb.a2ml | 2 +- .machine_readable/integrations/vexometer.a2ml | 2 +- 0-AI-MANIFEST.a2ml | 4 ++-- CHANGELOG.md | 2 +- CONTRIBUTING.md | 2 +- EXPLAINME.adoc | 4 ++-- GOVERNANCE.adoc | 4 ++-- MAINTAINERS.adoc | 2 +- README.adoc | 4 ++-- ROADMAP.adoc | 2 +- SECURITY.md | 2 +- TOPOLOGY.md | 6 +++--- contractile.just | 4 ++-- contractiles/intend/Intentfile.a2ml | 4 ++-- contractiles/must/Mustfile.a2ml | 2 +- contractiles/trust/Trustfile.a2ml | 4 ++-- flake.nix | 2 +- guix.scm | 6 +++--- julia-professional-registry-tests.ipkg | 2 +- llm-warmup-dev.md | 2 +- llm-warmup-user.md | 2 +- stapeln.toml | 4 ++-- 40 files changed, 54 insertions(+), 54 deletions(-) diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 96a028e..658a678 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -1,4 +1,4 @@ - + # Copilot Instructions @@ -11,7 +11,7 @@ ## License -- SPDX: `PMPL-1.0-or-later` on all new files. +- SPDX: `MPL-2.0` on all new files. - Never use AGPL-3.0. - Copyright: `Jonathan D.A. Jewell (hyperpolymath) `. diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 418392b..b3da09a 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,4 +1,4 @@ - + ## Summary diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index ddeab5d..712beb3 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 name: BoJ Server Build Trigger on: push: diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 294edb5..29e7dd2 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 name: GitHub Pages on: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 5e89144..014b1eb 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # diff --git a/.machine_readable/6a2/ECOSYSTEM.a2ml b/.machine_readable/6a2/ECOSYSTEM.a2ml index e04387b..ba16916 100644 --- a/.machine_readable/6a2/ECOSYSTEM.a2ml +++ b/.machine_readable/6a2/ECOSYSTEM.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # ECOSYSTEM.a2ml — Ecosystem position # Converted from ECOSYSTEM.scm on 2026-03-15 diff --git a/.machine_readable/6a2/META.a2ml b/.machine_readable/6a2/META.a2ml index 4f1f3f3..066ee69 100644 --- a/.machine_readable/6a2/META.a2ml +++ b/.machine_readable/6a2/META.a2ml @@ -1,9 +1,9 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # META.a2ml — Project meta-information # Converted from META.scm on 2026-03-15 [metadata] project = "HyperpolymathRegistry" author = "Jonathan D.A. Jewell " -license = "PMPL-1.0-or-later" +license = "MPL-2.0" standard = "RSR 2026" diff --git a/.machine_readable/6a2/STATE.a2ml b/.machine_readable/6a2/STATE.a2ml index 1e7a107..4c6d5db 100644 --- a/.machine_readable/6a2/STATE.a2ml +++ b/.machine_readable/6a2/STATE.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # STATE.a2ml — Project state checkpoint # Converted from STATE.scm on 2026-03-15 diff --git a/.machine_readable/CLADE.a2ml b/.machine_readable/CLADE.a2ml index f306cf5..c23cb9f 100644 --- a/.machine_readable/CLADE.a2ml +++ b/.machine_readable/CLADE.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Clade declaration — part of the gv-clade-index registry # See: https://github.com/hyperpolymath/gv-clade-index diff --git a/.machine_readable/agent_instructions/README.adoc b/.machine_readable/agent_instructions/README.adoc index 0ed360b..9bc2e24 100644 --- a/.machine_readable/agent_instructions/README.adoc +++ b/.machine_readable/agent_instructions/README.adoc @@ -1,4 +1,4 @@ -// SPDX-License-Identifier: PMPL-1.0-or-later +// SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) = Agent Instructions :toc: preamble diff --git a/.machine_readable/agent_instructions/coverage.a2ml b/.machine_readable/agent_instructions/coverage.a2ml index 3d720dc..6979664 100644 --- a/.machine_readable/agent_instructions/coverage.a2ml +++ b/.machine_readable/agent_instructions/coverage.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # coverage.a2ml — Session coverage tracking diff --git a/.machine_readable/agent_instructions/debt.a2ml b/.machine_readable/agent_instructions/debt.a2ml index f46451a..c0238c5 100644 --- a/.machine_readable/agent_instructions/debt.a2ml +++ b/.machine_readable/agent_instructions/debt.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # debt.a2ml — Meander debt list diff --git a/.machine_readable/agent_instructions/methodology.a2ml b/.machine_readable/agent_instructions/methodology.a2ml index 9bf1439..754f357 100644 --- a/.machine_readable/agent_instructions/methodology.a2ml +++ b/.machine_readable/agent_instructions/methodology.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # methodology.a2ml — AI agent methodology configuration diff --git a/.machine_readable/contractiles/bust/Bustfile.a2ml b/.machine_readable/contractiles/bust/Bustfile.a2ml index e9a746c..cab2486 100644 --- a/.machine_readable/contractiles/bust/Bustfile.a2ml +++ b/.machine_readable/contractiles/bust/Bustfile.a2ml @@ -1,5 +1,5 @@ // Bustfile.a2ml — meta-repo bust contractile (breakage / rollback) -// SPDX-License-Identifier: PMPL-1.0-or-later +// SPDX-License-Identifier: MPL-2.0 Bust { name: "julia-professional-registry" diff --git a/.machine_readable/contractiles/dust/Dustfile.a2ml b/.machine_readable/contractiles/dust/Dustfile.a2ml index d7dfc19..0d619ee 100644 --- a/.machine_readable/contractiles/dust/Dustfile.a2ml +++ b/.machine_readable/contractiles/dust/Dustfile.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Dustfile — Cleanup and Hygiene Contract [dustfile] diff --git a/.machine_readable/contractiles/trust/Trustfile.a2ml b/.machine_readable/contractiles/trust/Trustfile.a2ml index 6f2c39c..0c95e15 100644 --- a/.machine_readable/contractiles/trust/Trustfile.a2ml +++ b/.machine_readable/contractiles/trust/Trustfile.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Trustfile — Integrity and Provenance Contract [trustfile] diff --git a/.machine_readable/integrations/feedback-o-tron.a2ml b/.machine_readable/integrations/feedback-o-tron.a2ml index 1c473ae..5381604 100644 --- a/.machine_readable/integrations/feedback-o-tron.a2ml +++ b/.machine_readable/integrations/feedback-o-tron.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Feedback-o-Tron Integration — Autonomous Bug Reporting [integration] diff --git a/.machine_readable/integrations/proven.a2ml b/.machine_readable/integrations/proven.a2ml index 6b3e805..9af33ff 100644 --- a/.machine_readable/integrations/proven.a2ml +++ b/.machine_readable/integrations/proven.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Proven Integration — Formally Verified Safety Library [integration] diff --git a/.machine_readable/integrations/verisimdb.a2ml b/.machine_readable/integrations/verisimdb.a2ml index 2c8f8f5..164c522 100644 --- a/.machine_readable/integrations/verisimdb.a2ml +++ b/.machine_readable/integrations/verisimdb.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # VeriSimDB Feed — Cross-Repo Analytics Data Store [integration] diff --git a/.machine_readable/integrations/vexometer.a2ml b/.machine_readable/integrations/vexometer.a2ml index bb7fc43..238b3d2 100644 --- a/.machine_readable/integrations/vexometer.a2ml +++ b/.machine_readable/integrations/vexometer.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Vexometer Integration — Irritation Surface Analysis [integration] diff --git a/0-AI-MANIFEST.a2ml b/0-AI-MANIFEST.a2ml index e9e04e5..d479b63 100644 --- a/0-AI-MANIFEST.a2ml +++ b/0-AI-MANIFEST.a2ml @@ -1,4 +1,4 @@ -;; SPDX-License-Identifier: PMPL-1.0-or-later +;; SPDX-License-Identifier: MPL-2.0 ;; 0-AI-MANIFEST.a2ml — AI Agent Entry Point ;; Repository: hyperpolymath/HyperpolymathRegistry @@ -13,7 +13,7 @@ AI manifest for HyperpolymathRegistry. Read this file first before any other wor ;; Tests: verification/tests/ or tests/ ;; === CRITICAL INVARIANTS === -;; - SPDX headers on ALL files (PMPL-1.0-or-later) +;; - SPDX headers on ALL files (MPL-2.0) ;; - No believe_me, assert_total, sorry, Admitted, unsafeCoerce, Obj.magic ;; - SCM files ONLY in .machine_readable/ (never root) ;; - Author: Jonathan D.A. Jewell diff --git a/CHANGELOG.md b/CHANGELOG.md index 480c95e..6e32fad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,5 @@ diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 3c12eeb..86b9c51 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,4 +1,4 @@ - + # Contributing Thank you for your interest in contributing! We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`. diff --git a/EXPLAINME.adoc b/EXPLAINME.adoc index b10fb42..cd8942d 100644 --- a/EXPLAINME.adoc +++ b/EXPLAINME.adoc @@ -1,4 +1,4 @@ -// SPDX-License-Identifier: PMPL-1.0-or-later +// SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell = HyperpolymathRegistry — Show Me The Receipts :toc: @@ -163,7 +163,7 @@ secret scanning and EditorConfig enforcement. | Vulnerability reporting policy. | `LICENSE` / `LICENSES/` -| PMPL-1.0-or-later full text and licence metadata. +| MPL-2.0 full text and licence metadata. |=== == Questions? diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc index 00d71e9..2b173cc 100644 --- a/GOVERNANCE.adoc +++ b/GOVERNANCE.adoc @@ -1,4 +1,4 @@ -// SPDX-License-Identifier: PMPL-1.0-or-later +// SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) = Project Governance :toc: @@ -119,4 +119,4 @@ Substantive changes (e.g., changing the governance model itself) should be discu ''' -Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath). Licensed under PMPL-1.0-or-later. +Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath). Licensed under MPL-2.0. diff --git a/MAINTAINERS.adoc b/MAINTAINERS.adoc index 4374ce9..e6f5447 100644 --- a/MAINTAINERS.adoc +++ b/MAINTAINERS.adoc @@ -1,4 +1,4 @@ -// SPDX-License-Identifier: PMPL-1.0-or-later +// SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) = Maintainers :toc: preamble diff --git a/README.adoc b/README.adoc index 594660a..2226f97 100644 --- a/README.adoc +++ b/README.adoc @@ -1,4 +1,4 @@ -// SPDX-License-Identifier: PMPL-1.0-or-later +// SPDX-License-Identifier: MPL-2.0 // SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell = julia-professional-registry @@ -6,7 +6,7 @@ Jonathan D.A. Jewell :toc: image:https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=opensourcesecurity[OpenSSF Best Practices,link="https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/julia-professional-registry"] -image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] +image:https://img.shields.io/badge/License-MPL--2.0-blue.svg[License: MPL-2.0,link="https://www.mozilla.org/en-US/MPL/2.0/"] image:https://api.thegreenwebfoundation.org/greencheckimage/github.com[Green Web,link="https://www.thegreenwebfoundation.org/green-web-check/?url=github.com"] == Overview diff --git a/ROADMAP.adoc b/ROADMAP.adoc index ddc6b73..9a597ed 100644 --- a/ROADMAP.adoc +++ b/ROADMAP.adoc @@ -1,4 +1,4 @@ -// SPDX-License-Identifier: PMPL-1.0-or-later +// SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) = julia-professional-registry: Roadmap diff --git a/SECURITY.md b/SECURITY.md index aefad4c..1a29117 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,4 +1,4 @@ - + # Security Policy ## Reporting a Vulnerability diff --git a/TOPOLOGY.md b/TOPOLOGY.md index a52fab4..7ef534b 100644 --- a/TOPOLOGY.md +++ b/TOPOLOGY.md @@ -1,4 +1,4 @@ - + # TOPOLOGY.md — HyperpolymathRegistry @@ -18,7 +18,7 @@ HyperpolymathRegistry/ │ └── ... (packages starting with B) ├── ... (alphabetical package directories) ├── README.adoc # Registry documentation -└── LICENSE # PMPL-1.0-or-later +└── LICENSE # MPL-2.0 ``` ## Data Flow @@ -30,6 +30,6 @@ HyperpolymathRegistry/ ## Key Invariants - Julia package registry format with standard Registries.toml -- All registered packages use PMPL-1.0-or-later or compatible licenses +- All registered packages use MPL-2.0 or compatible licenses - Compatible with standard Julia package manager (Pkg) - Version resolution follows semantic versioning diff --git a/contractile.just b/contractile.just index 8f99137..20a5fbb 100644 --- a/contractile.just +++ b/contractile.just @@ -2,7 +2,7 @@ # Source directory: contractiles # Re-generate with: contractile gen-just --dir contractiles # -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # === DUST (Recovery & Rollback) === # Source: Dustfile.a2ml @@ -62,7 +62,7 @@ trust-verify: trust-license-content trust-no-secrets-committed trust-container-i # LICENSE contains expected SPDX identifier trust-license-content: - grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE + grep -q 'SPDX\|License\|MIT\|Apache\|MPL' LICENSE # No .env or credential files in repo trust-no-secrets-committed: diff --git a/contractiles/intend/Intentfile.a2ml b/contractiles/intend/Intentfile.a2ml index caa9d89..662866a 100644 --- a/contractiles/intend/Intentfile.a2ml +++ b/contractiles/intend/Intentfile.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Intentfile (A2ML Canonical) # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -8,7 +8,7 @@ Declared intent and purpose for Hyperpolymathregistry. ## Purpose -Hyperpolymathregistry — // SPDX-License-Identifier: PMPL-1.0-or-later +Hyperpolymathregistry — // SPDX-License-Identifier: MPL-2.0 ## Anti-Purpose diff --git a/contractiles/must/Mustfile.a2ml b/contractiles/must/Mustfile.a2ml index 6ef16a1..c28d104 100644 --- a/contractiles/must/Mustfile.a2ml +++ b/contractiles/must/Mustfile.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Mustfile (A2ML Canonical) # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) diff --git a/contractiles/trust/Trustfile.a2ml b/contractiles/trust/Trustfile.a2ml index 8384f37..21e9f65 100644 --- a/contractiles/trust/Trustfile.a2ml +++ b/contractiles/trust/Trustfile.a2ml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Trustfile (A2ML Canonical) # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -16,7 +16,7 @@ Maximal trust by default — LLM may read, build, test, lint, format. ### license-content - description: LICENSE contains expected SPDX identifier -- run: grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE +- run: grep -q 'SPDX\|License\|MIT\|Apache\|MPL' LICENSE - severity: critical ### no-secrets-committed diff --git a/flake.nix b/flake.nix index e496bc8..dfdd12f 100644 --- a/flake.nix +++ b/flake.nix @@ -88,7 +88,7 @@ meta = with pkgs.lib; { description = "{project-description}"; homepage = "{repo-url}"; - license = with licenses; [ mit ]; # MIT + Palimpsest + license = with licenses; [ mpl20 ]; # MPL-2.0 maintainers = [ "{maintainer-name}" ]; platforms = platforms.unix; }; diff --git a/guix.scm b/guix.scm index 2a58cd5..a6109ba 100644 --- a/guix.scm +++ b/guix.scm @@ -1,4 +1,4 @@ -; SPDX-License-Identifier: PMPL-1.0-or-later +; SPDX-License-Identifier: MPL-2.0 ;; guix.scm — GNU Guix package definition for HyperpolymathRegistry ;; Usage: guix shell -f guix.scm @@ -14,5 +14,5 @@ (synopsis "HyperpolymathRegistry") (description "HyperpolymathRegistry — part of the hyperpolymath ecosystem.") (home-page "https://github.com/hyperpolymath/HyperpolymathRegistry") - (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" - "https://github.com/hyperpolymath/palimpsest-license"))) + (license ((@@ (guix licenses) license) "MPL-2.0" + "https://www.mozilla.org/en-US/MPL/2.0/"))) diff --git a/julia-professional-registry-tests.ipkg b/julia-professional-registry-tests.ipkg index 8135bf0..b220b53 100644 --- a/julia-professional-registry-tests.ipkg +++ b/julia-professional-registry-tests.ipkg @@ -1,4 +1,4 @@ --- SPDX-License-Identifier: PMPL-1.0-or-later +-- SPDX-License-Identifier: MPL-2.0 -- julia-professional-registry Idris2 test suite. Estate port 4/11. package julia-professional-registry-tests diff --git a/llm-warmup-dev.md b/llm-warmup-dev.md index 82143e7..d61f382 100644 --- a/llm-warmup-dev.md +++ b/llm-warmup-dev.md @@ -11,6 +11,6 @@ See README.adoc for overview. - `just heal` — attempt auto-repair ## Quick Context -- License: PMPL-1.0-or-later +- License: MPL-2.0 - Part of hyperpolymath ecosystem - See EXPLAINME.adoc for architecture diff --git a/llm-warmup-user.md b/llm-warmup-user.md index cc492cc..3c66889 100644 --- a/llm-warmup-user.md +++ b/llm-warmup-user.md @@ -11,6 +11,6 @@ See README.adoc for overview. - `just heal` — attempt auto-repair ## Quick Context -- License: PMPL-1.0-or-later +- License: MPL-2.0 - Part of hyperpolymath ecosystem - See EXPLAINME.adoc for architecture diff --git a/stapeln.toml b/stapeln.toml index dd90b75..6a86e08 100644 --- a/stapeln.toml +++ b/stapeln.toml @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # stapeln.toml — Layer-based container build for HyperpolymathRegistry # # stapeln builds containers as composable layers (German: "to stack"). @@ -9,7 +9,7 @@ name = "HyperpolymathRegistry" version = "0.1.0" description = "HyperpolymathRegistry" author = "Jonathan D.A. Jewell " -license = "PMPL-1.0-or-later" +license = "MPL-2.0" registry = "ghcr.io/hyperpolymath" [build] From dbd4883cc61f1d802ce9690880e72edca24ced42 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 4 Jun 2026 18:55:48 +0100 Subject: [PATCH 2/8] chore: rename agent_instructions to bot_directives for spec alignment --- .github/ISSUE_TEMPLATE/bug_report.md | 4 +++ .github/ISSUE_TEMPLATE/feature_request.md | 4 +++ .../ISSUE_TEMPLATE/package_registration.md | 4 +++ .github/copilot-instructions.md | 5 ++- .github/copilot/coding-agent.yml | 6 ++++ .github/pull_request_template.md | 5 ++- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 2 ++ .github/workflows/codeql.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 4 ++- .github/workflows/mirror.yml | 2 ++ .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 2 ++ .machine_readable/6a2/0-AI-MANIFEST.a2ml | 31 +++++++++++++++++++ .machine_readable/6a2/README.adoc | 30 ++++++++++++++++++ .../6a2/anchor/0-AI-MANIFEST.a2ml | 21 +++++++++++++ .../{anchors => 6a2/anchor}/ANCHOR.a2ml | 0 .machine_readable/6a2/anchor/README.adoc | 25 +++++++++++++++ .../README.adoc | 4 +-- .../coverage.a2ml | 0 .../debt.a2ml | 0 .../methodology.a2ml | 0 CHANGELOG.md | 3 +- CODE_OF_CONDUCT.md | 4 +++ CONTRIBUTING.md | 5 ++- EXPLAINME.adoc | 2 +- GOVERNANCE.adoc | 2 +- LICENSE | 6 ++-- MAINTAINERS.adoc | 2 +- QUICKSTART-DEV.adoc | 2 ++ QUICKSTART-MAINTAINER.adoc | 2 ++ QUICKSTART-USER.adoc | 2 ++ README.adoc | 7 +++-- ROADMAP.adoc | 3 +- SECURITY.md | 5 ++- TEST-NEEDS.md | 4 +++ TOPOLOGY.md | 5 ++- llm-warmup-dev.md | 4 +++ llm-warmup-user.md | 4 +++ tests/idris2/Main.idr | 5 ++- tests/idris2/Test/Spec.idr | 4 +-- tests/idris2/ValidateTest.idr | 4 +-- 43 files changed, 200 insertions(+), 28 deletions(-) create mode 100644 .github/copilot/coding-agent.yml create mode 100644 .machine_readable/6a2/0-AI-MANIFEST.a2ml create mode 100644 .machine_readable/6a2/README.adoc create mode 100644 .machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml rename .machine_readable/{anchors => 6a2/anchor}/ANCHOR.a2ml (100%) create mode 100644 .machine_readable/6a2/anchor/README.adoc rename .machine_readable/{agent_instructions => bot_directives}/README.adoc (88%) rename .machine_readable/{agent_instructions => bot_directives}/coverage.a2ml (100%) rename .machine_readable/{agent_instructions => bot_directives}/debt.a2ml (100%) rename .machine_readable/{agent_instructions => bot_directives}/methodology.a2ml (100%) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 4feb831..3c6ffd2 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,3 +1,7 @@ + --- name: Bug report about: Report a problem with the registry or a registered package's metadata diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index 8e402f6..65550b9 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,3 +1,7 @@ + --- name: Feature request about: Suggest an improvement to the registry's tooling, policies, or scope diff --git a/.github/ISSUE_TEMPLATE/package_registration.md b/.github/ISSUE_TEMPLATE/package_registration.md index e47dafd..90417bb 100644 --- a/.github/ISSUE_TEMPLATE/package_registration.md +++ b/.github/ISSUE_TEMPLATE/package_registration.md @@ -1,3 +1,7 @@ + --- name: Package registration request about: Propose a new package, or a new version of an existing package, for registration diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 658a678..0a7dd56 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -1,4 +1,7 @@ - + # Copilot Instructions diff --git a/.github/copilot/coding-agent.yml b/.github/copilot/coding-agent.yml new file mode 100644 index 0000000..a719a77 --- /dev/null +++ b/.github/copilot/coding-agent.yml @@ -0,0 +1,6 @@ +mcp_servers: + boj-server: + command: npx + args: ["-y", "@hyperpolymath/boj-server@latest"] + env: + BOJ_URL: http://localhost:7700 diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index b3da09a..b63e777 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,4 +1,7 @@ - + ## Summary diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 712beb3..1ae6f46 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -7,6 +7,7 @@ on: jobs: trigger-boj: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 29e7dd2..c28e687 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -18,6 +18,7 @@ concurrency: jobs: build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 @@ -35,6 +36,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: - name: Deploy to GitHub Pages diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6b2574f..7882ef6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -24,6 +24,7 @@ permissions: jobs: analyze: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read security-events: write diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 014b1eb..b55243f 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -32,3 +32,4 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260 + timeout-minutes: 10 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 1d6417e..12873b4 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -25,5 +25,7 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@97df762107501909f50bb770e9bc200b6c415600 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242 + timeout-minutes: 10 + secrets: inherit secrets: inherit diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 4880045..c3ec0f4 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -12,4 +12,6 @@ permissions: jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260 + timeout-minutes: 10 + secrets: inherit secrets: inherit diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 49310c9..faaae4a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -23,4 +23,5 @@ jobs: security-events: write id-token: write uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260 + timeout-minutes: 10 secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 9bdf984..3e0b6d6 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -16,4 +16,6 @@ permissions: jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260 + timeout-minutes: 10 + secrets: inherit secrets: inherit diff --git a/.machine_readable/6a2/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/0-AI-MANIFEST.a2ml new file mode 100644 index 0000000..6bf1f8c --- /dev/null +++ b/.machine_readable/6a2/0-AI-MANIFEST.a2ml @@ -0,0 +1,31 @@ +# AI Manifest for 6a2 Directory + +## Purpose + +This manifest declares the AI-assistant context for the 6a2 machine-readable metadata directory. + +## Canonical Locations + +The 6 core A2ML files MUST exist in this directory: +1. AGENTIC.a2ml +2. ECOSYSTEM.a2ml +3. META.a2ml +4. NEUROSYM.a2ml +5. PLAYBOOK.a2ml +6. STATE.a2ml + +## Invariants + +- No duplicate files in root directory +- Single source of truth: this directory is authoritative +- No stale metadata + +## Protocol + +When multiple agents may write to A2ML files concurrently: +1. Read file and record git-sha-at-read in [provenance] section +2. Lock by creating .lock- +3. Write updated file with new [provenance] metadata +4. Release by removing lock file +5. On conflict: re-read and retry if git-sha-at-read does not match HEAD + diff --git a/.machine_readable/6a2/README.adoc b/.machine_readable/6a2/README.adoc new file mode 100644 index 0000000..bc033d7 --- /dev/null +++ b/.machine_readable/6a2/README.adoc @@ -0,0 +1,30 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +# A2ML 6a2 Directory + +This directory contains the 6 core A2ML machine-readable metadata files for this repository. + +## Files + +- `AGENTIC.a2ml` - AI agent operational gating, safety controls +- `ECOSYSTEM.a2ml` - Project ecosystem position, relationships, explicit boundaries +- `META.a2ml` - Architecture decisions (ADRs), development practices, design rationale +- `NEUROSYM.a2ml` - Symbolic semantics, composition algebra +- `PLAYBOOK.a2ml` - Executable plans, operational runbooks +- `STATE.a2ml` - Project state, phase, milestones, session history + +## Standards Compliance + +These files follow the A2ML Format Family specification from: +https://github.com/hyperpolymath/standards/tree/main/a2ml + +## Generation + +These files may be generated from .scm source files using transpilation tools. +Source .scm files should be removed after successful transpilation. + +## See Also + +- [A2ML Repository Template](https://github.com/hyperpolymath/standards/blob/main/A2ML-REPO-TEMPLATE.adoc) +- [6A2 Format Family](https://github.com/hyperpolymath/standards#a2ml-format-family-7-formats) + diff --git a/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml new file mode 100644 index 0000000..0dd6825 --- /dev/null +++ b/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml @@ -0,0 +1,21 @@ +# AI Manifest for Anchor Directory + +## Purpose + +This manifest declares the AI-assistant context for the anchor machine-readable metadata directory. + +## Canonical Locations + +ANCHOR.a2ml files MUST exist in this directory. + +## Multiple Versions + +Unlike other A2ML files, multiple versions of ANCHOR.a2ml with different dates MAY exist. +Each version represents a specific recalibration point. + +## Invariants + +- Multiple versions with different dates are permitted +- No other A2ML files in this directory +- Single source of truth for anchor documents + diff --git a/.machine_readable/anchors/ANCHOR.a2ml b/.machine_readable/6a2/anchor/ANCHOR.a2ml similarity index 100% rename from .machine_readable/anchors/ANCHOR.a2ml rename to .machine_readable/6a2/anchor/ANCHOR.a2ml diff --git a/.machine_readable/6a2/anchor/README.adoc b/.machine_readable/6a2/anchor/README.adoc new file mode 100644 index 0000000..bd23e35 --- /dev/null +++ b/.machine_readable/6a2/anchor/README.adoc @@ -0,0 +1,25 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +# A2ML Anchor Directory + +This directory contains ANCHOR.a2ml files for project recalibration and scope intervention. + +## Files + +- `ANCHOR.a2ml` - Project recalibration, scope intervention, canonical authority + +## Multiple Versions + +Unlike other A2ML files, multiple versions of ANCHOR.a2ml with different dates may exist. +Each version represents a specific recalibration point in the project history. + +## Standards Compliance + +These files follow the ANCHOR.a2ml specification from: +https://github.com/hyperpolymath/standards/tree/main/anchor-a2ml + +## See Also + +- [A2ML Repository Template](https://github.com/hyperpolymath/standards/blob/main/A2ML-REPO-TEMPLATE.adoc) +- [Anchor A2ML Spec](https://github.com/hyperpolymath/standards/tree/main/anchor-a2ml) + diff --git a/.machine_readable/agent_instructions/README.adoc b/.machine_readable/bot_directives/README.adoc similarity index 88% rename from .machine_readable/agent_instructions/README.adoc rename to .machine_readable/bot_directives/README.adoc index 9bc2e24..a5315c7 100644 --- a/.machine_readable/agent_instructions/README.adoc +++ b/.machine_readable/bot_directives/README.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell = Agent Instructions :toc: preamble @@ -32,7 +32,7 @@ Methodology-aware configuration for AI agents. Read by any AI agent == Relationship to Other Files * `AGENTIC.a2ml` says WHAT agents can do (permissions, gating) -* `agent_instructions/` says HOW agents should work (methodology) +* `bot_directives/` says HOW agents should work (methodology) * `bot_directives/` says what the gitbot-fleet does (fleet-specific) * `CLAUDE.md` says how Claude specifically should work (Claude-specific) diff --git a/.machine_readable/agent_instructions/coverage.a2ml b/.machine_readable/bot_directives/coverage.a2ml similarity index 100% rename from .machine_readable/agent_instructions/coverage.a2ml rename to .machine_readable/bot_directives/coverage.a2ml diff --git a/.machine_readable/agent_instructions/debt.a2ml b/.machine_readable/bot_directives/debt.a2ml similarity index 100% rename from .machine_readable/agent_instructions/debt.a2ml rename to .machine_readable/bot_directives/debt.a2ml diff --git a/.machine_readable/agent_instructions/methodology.a2ml b/.machine_readable/bot_directives/methodology.a2ml similarity index 100% rename from .machine_readable/agent_instructions/methodology.a2ml rename to .machine_readable/bot_directives/methodology.a2ml diff --git a/CHANGELOG.md b/CHANGELOG.md index 6e32fad..c346f5d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,8 +1,7 @@ - # Changelog All notable changes to `julia-professional-registry` will be documented in this file. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 6cb48a9..491c54d 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -1,3 +1,7 @@ + # Code of Conduct diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 86b9c51..b7253c7 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,4 +1,7 @@ - + # Contributing Thank you for your interest in contributing! We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`. diff --git a/EXPLAINME.adoc b/EXPLAINME.adoc index cd8942d..61a0b87 100644 --- a/EXPLAINME.adoc +++ b/EXPLAINME.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell +// Copyright (c) Jonathan D.A. Jewell = HyperpolymathRegistry — Show Me The Receipts :toc: :toclevels: 3 diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc index 2b173cc..14b8358 100644 --- a/GOVERNANCE.adoc +++ b/GOVERNANCE.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell = Project Governance :toc: :toc-placement!: diff --git a/LICENSE b/LICENSE index 2a8b960..d0a1fa1 100644 --- a/LICENSE +++ b/LICENSE @@ -1,5 +1,3 @@ -SPDX-License-Identifier: MPL-2.0 - Mozilla Public License Version 2.0 ================================== @@ -37,7 +35,7 @@ Mozilla Public License Version 2.0 means any form of the work other than Source Code Form. 1.7. "Larger Work" - means a work that combines Covered Software with other material, in + means a work that combines Covered Software with other material, in a separate file or files, that is not Covered Software. 1.8. "License" @@ -359,7 +357,7 @@ Exhibit A - Source Code Form License Notice This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this - file, You can obtain one at http://mozilla.org/MPL/2.0/. + file, You can obtain one at https://mozilla.org/MPL/2.0/. If it is not possible or desirable to put the notice in a particular file, then You may include the notice in a location (such as a LICENSE diff --git a/MAINTAINERS.adoc b/MAINTAINERS.adoc index e6f5447..d296424 100644 --- a/MAINTAINERS.adoc +++ b/MAINTAINERS.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/QUICKSTART-DEV.adoc b/QUICKSTART-DEV.adoc index 3792735..c0dfc81 100644 --- a/QUICKSTART-DEV.adoc +++ b/QUICKSTART-DEV.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Hyperpolymathregistry — Developer Quickstart :toc: preamble diff --git a/QUICKSTART-MAINTAINER.adoc b/QUICKSTART-MAINTAINER.adoc index e851213..e9439a9 100644 --- a/QUICKSTART-MAINTAINER.adoc +++ b/QUICKSTART-MAINTAINER.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Hyperpolymathregistry — Maintainer Quickstart :toc: preamble diff --git a/QUICKSTART-USER.adoc b/QUICKSTART-USER.adoc index 3c6ac05..84b0412 100644 --- a/QUICKSTART-USER.adoc +++ b/QUICKSTART-USER.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Hyperpolymathregistry — User Quickstart :toc: preamble diff --git a/README.adoc b/README.adoc index 2226f97..a5e917f 100644 --- a/README.adoc +++ b/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell = julia-professional-registry @@ -6,7 +7,7 @@ Jonathan D.A. Jewell :toc: image:https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=opensourcesecurity[OpenSSF Best Practices,link="https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/julia-professional-registry"] -image:https://img.shields.io/badge/License-MPL--2.0-blue.svg[License: MPL-2.0,link="https://www.mozilla.org/en-US/MPL/2.0/"] +image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[License: MPL-2.0,link="https://opensource.org/licenses/MPL-2.0"] image:https://api.thegreenwebfoundation.org/greencheckimage/github.com[Green Web,link="https://www.thegreenwebfoundation.org/green-web-check/?url=github.com"] == Overview @@ -76,4 +77,6 @@ pkg> add SMTLib == License -MPL-2.0 +This project is licensed under the Mozilla Public License, v. 2.0. See the `LICENSE` file for details. + +SPDX-License-Identifier: MPL-2.0 \ No newline at end of file diff --git a/ROADMAP.adoc b/ROADMAP.adoc index 9a597ed..30a4c53 100644 --- a/ROADMAP.adoc +++ b/ROADMAP.adoc @@ -1,6 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - +// Copyright (c) Jonathan D.A. Jewell = julia-professional-registry: Roadmap Jonathan D.A. Jewell :toc: left diff --git a/SECURITY.md b/SECURITY.md index 1a29117..88df5ba 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,4 +1,7 @@ - + # Security Policy ## Reporting a Vulnerability diff --git a/TEST-NEEDS.md b/TEST-NEEDS.md index f70d01a..ee741c2 100644 --- a/TEST-NEEDS.md +++ b/TEST-NEEDS.md @@ -1,3 +1,7 @@ + # CRG Grade C Test Coverage ## CRG Grade: C — ACHIEVED 2026-04-04 diff --git a/TOPOLOGY.md b/TOPOLOGY.md index 7ef534b..9f0f32e 100644 --- a/TOPOLOGY.md +++ b/TOPOLOGY.md @@ -1,4 +1,7 @@ - + # TOPOLOGY.md — HyperpolymathRegistry diff --git a/llm-warmup-dev.md b/llm-warmup-dev.md index d61f382..40e82be 100644 --- a/llm-warmup-dev.md +++ b/llm-warmup-dev.md @@ -1,3 +1,7 @@ + # LLM Warmup — HyperpolymathRegistry (Developer) ## What is HyperpolymathRegistry? diff --git a/llm-warmup-user.md b/llm-warmup-user.md index 3c66889..722c289 100644 --- a/llm-warmup-user.md +++ b/llm-warmup-user.md @@ -1,3 +1,7 @@ + # LLM Warmup — HyperpolymathRegistry (User) ## What is HyperpolymathRegistry? diff --git a/tests/idris2/Main.idr b/tests/idris2/Main.idr index ca3dd8d..51fa94a 100644 --- a/tests/idris2/Main.idr +++ b/tests/idris2/Main.idr @@ -1,6 +1,5 @@ --- SPDX-License-Identifier: PMPL-1.0-or-later --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - +-- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell module Main import Test.Spec diff --git a/tests/idris2/Test/Spec.idr b/tests/idris2/Test/Spec.idr index ff6a493..0350df8 100644 --- a/tests/idris2/Test/Spec.idr +++ b/tests/idris2/Test/Spec.idr @@ -1,5 +1,5 @@ --- SPDX-License-Identifier: PMPL-1.0-or-later --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +-- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell -- ||| Minimal Idris2 test harness for the Gossamer ABI test suite. ||| diff --git a/tests/idris2/ValidateTest.idr b/tests/idris2/ValidateTest.idr index a136260..3a634f8 100644 --- a/tests/idris2/ValidateTest.idr +++ b/tests/idris2/ValidateTest.idr @@ -1,5 +1,5 @@ --- SPDX-License-Identifier: PMPL-1.0-or-later --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +-- SPDX-License-Identifier: MPL-2.0 +-- Copyright (c) Jonathan D.A. Jewell -- -- Port of tests/validate.test.ts to Idris2, estate-rollout port 4/11. -- Validates a Julia Pkg registry: Registry.toml + package directories From ec4491a4e0edc749b2b1c0ce240b18500222116c Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 7 Jun 2026 23:18:25 +0100 Subject: [PATCH 3/8] Apply estate standardization: governance docs, contractiles, CI/CD cleanup --- .machine_readable/6a2/AGENTIC.a2ml | 51 +++++++ .machine_readable/6a2/NEUROSYM.a2ml | 23 +++ .machine_readable/6a2/PLAYBOOK.a2ml | 137 ++++++++++++++++++ .machine_readable/ADJUST.contractile | 126 ---------------- .machine_readable/INTENT.contractile | 72 --------- .machine_readable/MUST.contractile | 91 ------------ .machine_readable/TRUST.contractile | 80 ---------- .../contractiles/Adjustfile.a2ml | 72 +++++++++ .../contractiles/Intentfile.a2ml | 99 +++++++++++++ .machine_readable/contractiles/Justfile | 109 ++++++++++++++ .machine_readable/contractiles/Mustfile.a2ml | 102 +++++++++++++ .machine_readable/contractiles/Trustfile.a2ml | 88 +++++++++++ .../contractiles/bust/Bustfile.a2ml | 28 ---- .machine_readable/contractiles/bust/bust.ncl | 66 --------- .../contractiles/dust/Dustfile.a2ml | 22 --- .../contractiles/trust/Trustfile.a2ml | 22 --- contractiles/intend/Intentfile.a2ml | 22 --- contractiles/must/Mustfile.a2ml | 42 ------ contractiles/trust/Trustfile.a2ml | 25 ---- flake.nix | 116 --------------- 20 files changed, 681 insertions(+), 712 deletions(-) create mode 100644 .machine_readable/6a2/AGENTIC.a2ml create mode 100644 .machine_readable/6a2/NEUROSYM.a2ml create mode 100644 .machine_readable/6a2/PLAYBOOK.a2ml delete mode 100644 .machine_readable/ADJUST.contractile delete mode 100644 .machine_readable/INTENT.contractile delete mode 100644 .machine_readable/MUST.contractile delete mode 100644 .machine_readable/TRUST.contractile create mode 100644 .machine_readable/contractiles/Adjustfile.a2ml create mode 100644 .machine_readable/contractiles/Intentfile.a2ml create mode 100644 .machine_readable/contractiles/Justfile create mode 100644 .machine_readable/contractiles/Mustfile.a2ml create mode 100644 .machine_readable/contractiles/Trustfile.a2ml delete mode 100644 .machine_readable/contractiles/bust/Bustfile.a2ml delete mode 100644 .machine_readable/contractiles/bust/bust.ncl delete mode 100644 .machine_readable/contractiles/dust/Dustfile.a2ml delete mode 100644 .machine_readable/contractiles/trust/Trustfile.a2ml delete mode 100644 contractiles/intend/Intentfile.a2ml delete mode 100644 contractiles/must/Mustfile.a2ml delete mode 100644 contractiles/trust/Trustfile.a2ml delete mode 100644 flake.nix diff --git a/.machine_readable/6a2/AGENTIC.a2ml b/.machine_readable/6a2/AGENTIC.a2ml new file mode 100644 index 0000000..b21d81b --- /dev/null +++ b/.machine_readable/6a2/AGENTIC.a2ml @@ -0,0 +1,51 @@ +# SPDX-License-Identifier: MPL-2.0 +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +# +# AGENTIC.a2ml — AI agent constraints and capabilities +# Defines what AI agents can and cannot do in this repository. + +[metadata] +version = "0.1.0" +last-updated = "2026-04-11" + +[agent-permissions] +can-edit-source = true +can-edit-tests = true +can-edit-docs = true +can-edit-config = true +can-create-files = true + +[agent-constraints] +# What AI agents must NOT do: +# - Never use banned language patterns (believe_me, unsafeCoerce, etc.) +# - Never commit secrets or credentials +# - Never use banned languages (TypeScript, Python, Go, etc.) +# - Never place state files in repository root (must be in .machine_readable/) +# - Never use AGPL license (use MPL-2.0) + +[maintenance-integrity] +fail-closed = true +require-evidence-per-step = true +allow-silent-skip = false +require-rerun-after-fix = true +release-claim-requires-hard-pass = true + +# ============================================================================ +# METHODOLOGY (ADR-002) +# ============================================================================ +# Detailed methodology configuration lives in: +# .machine_readable/bot_directives/methodology.a2ml +# .machine_readable/bot_directives/coverage.a2ml +# .machine_readable/bot_directives/debt.a2ml +# +# AGENTIC.a2ml declares WHAT agents can do (permissions, gating). +# bot_directives/ declares HOW agents should work (methodology). + +[methodology] +instructions-dir = ".machine_readable/bot_directives/" +default-mode = "hybrid" + +[automation-hooks] +# on-enter: Read 0-AI-MANIFEST.a2ml, then STATE.a2ml, then bot_directives/ +# on-exit: Update STATE.a2ml, coverage.a2ml, and debt.a2ml with session outcomes +# on-commit: Run just validate-rsr diff --git a/.machine_readable/6a2/NEUROSYM.a2ml b/.machine_readable/6a2/NEUROSYM.a2ml new file mode 100644 index 0000000..1acf7a3 --- /dev/null +++ b/.machine_readable/6a2/NEUROSYM.a2ml @@ -0,0 +1,23 @@ +# SPDX-License-Identifier: MPL-2.0 +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +# +# NEUROSYM.a2ml — Neurosymbolic integration metadata +# Configuration for Hypatia scanning and symbolic reasoning. + +[metadata] +version = "0.1.0" +last-updated = "2026-04-11" + +[hypatia-config] +scan-enabled = true +scan-depth = "standard" # quick | standard | deep +report-format = "logtalk" + +[symbolic-rules] +# Custom symbolic rules for this project +# - { name = "no-unsafe-ffi", pattern = "believe_me|unsafeCoerce", severity = "critical" } + +[neural-config] +# Neural pattern detection settings +# confidence-threshold = 0.85 +# model = "hypatia-v2" diff --git a/.machine_readable/6a2/PLAYBOOK.a2ml b/.machine_readable/6a2/PLAYBOOK.a2ml new file mode 100644 index 0000000..676ec4c --- /dev/null +++ b/.machine_readable/6a2/PLAYBOOK.a2ml @@ -0,0 +1,137 @@ +# SPDX-License-Identifier: MPL-2.0 +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) +# +# PLAYBOOK.a2ml — Operational playbook +# Runbooks, incident response, deployment procedures. + +[metadata] +version = "0.1.0" +last-updated = "2026-04-11" + +[deployment] +# method = "gitops" # gitops | manual | ci-triggered +# target = "container" # container | binary | library | wasm + +[incident-response] +# 1. Check .machine_readable/STATE.a2ml for current status +# 2. Review recent commits and CI results +# 3. Run `just validate` to check compliance +# 4. Run `just security` to audit for vulnerabilities + +[release-process] +# 1. Update version in STATE.a2ml, META.a2ml, Justfile +# 2. Run `just release-preflight` (validate + quality + security + maint-hard-pass) +# 3. Optional local permission hardening: `just perms-snapshot && just perms-lock` +# 4. Tag and push +# 5. Restore local permissions if needed: `just perms-restore` +# 6. Run `just container-push` if applicable + +[maintenance-operations] +# Baseline audit: +# just maint-audit +# Hard release gate: +# just maint-hard-pass +# Permission audit: +# just perms-audit + +[rsr-repo-skeleton] +# Canonical organisation of any RSR-derived repository. +# Used by tooling, human onboarding, and the scheduled downstream sweep agent. +# The 5-PR cleanup pattern (below) brings a non-conforming repository into +# compliance with this skeleton. +# +# This section is the single source of truth for "what does an RSR repo look +# like?". Other docs (TOPOLOGY, AUDIT, etc.) describe the repo at hand; +# this describes the canonical shape that all RSR repos share. + +skeleton-version = "1.0" +last-updated = "2026-04-30" +authority-allowlist = ".machine_readable/root-allow.txt" +enforcement-workflow = ".github/workflows/estate-rules.yml" + +# === Required at root === +# README.adoc High-level pitch (project entry point) +# AUDIT.adoc Local gate summary (release-readiness) +# EXPLAINME.adoc Developer deep-dive (architecture & invariants) +# 0-AI-MANIFEST.a2ml AI agent work-allocation policy +# LICENSE Repo license (root-bound by convention) +# CHANGELOG.md One of the recognised .md exceptions (see below) +# Justfile Task runner — thin, imports per-section files from build/just/ +# coordination.k9 Repo-local session binding + +# === Required directories === +# .github/ CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/ +# .machine_readable/ AI manifests (0.1-AI-MANIFEST.a2ml), 6a2/ checkpoints, +# contractiles/, configs/, anchors/, policies/, scripts/, svc/ +# build/ contractile.just, flake.nix, guix.scm, Containerfile, +# just/*.just (Justfile section imports) +# docs/ onboarding/, status/, architecture/, governance/ (all .adoc) +# session/ dispatch.sh, custom-checks.k9, local-hooks.sh +# src/ Project source (Idris2 ABI under abi/, Zig FFI under ffi/) +# tests/, benches/, examples/, features/, scripts/, verification/, container/ + +# === Documentation format rule === +# `.adoc` is the default for all general docs (TOPOLOGY, READINESS, ROADMAP, +# TEST-NEEDS, PROOF-NEEDS, PROOF-STATUS, llm-warmup-*, etc.). +# +# `.md` is reserved ONLY for files GitHub's community-health rules +# special-case by name: +# CONTRIBUTING.md CODE_OF_CONDUCT.md SECURITY.md CHANGELOG.md +# +# Enforcement: `scripts/check-no-md-in-docs.sh` (fails if any *.md under docs/). + +# === Banned: ziguage === +# V (vlang.io) is banned estate-wide. Replaced by `zig-unified-api-adapter` +# (16 endpoints + transaction-based firewall gating). Do not introduce +# zig code, scaffolders, or references. Note that Coq theorem files use +# the same `.v` extension and are unaffected — the rule looks at content +# patterns, not the extension. +# +# Enforcement: `scripts/check-no-vlang.sh`. + +# === Justfile structure (post-split) === +# The root Justfile is thin — it holds `set` directives, project metadata +# variables, and the `default`/`help`/`info` recipes. Each major section +# lives in its own file under build/just/ and is brought in via `import?`. +# +# Imported sections (in the canonical split): +# build/just/init.just INIT recipe (template bootstrap) +# build/just/assess.just self-assess + verify (OpenSSF compliance) +# build/just/validate.just validate-rsr/state/ai-install + aggregate +# build/just/proofs.just proof-check-{all,idris2,lean4,agda,coq}, +# proof-scan-dangerous, proof-status +# build/just/groove.just Groove protocol setup (after zig removed) +# +# Daily-use recipes (BUILD, TEST, LINT, RUN, DEPS, DOCS, CONTAINER, CI, +# SECURITY, STATE, GUIX/NIX, MATRIX, VERSION CONTROL, UTILITIES, SESSION) +# stay in the root Justfile where users expect to find them. + +# === 5-PR cleanup pattern === +# Apply these branches (in order) to bring a non-conforming downstream repo +# into compliance with this skeleton: +# +# 1. chore/root-cleanup Relocate root sprawl per root-allow.txt; add +# scripts/check-root-shape.sh; remove stub +# health files shadowed by .github/ versions. +# 2. chore/remove-zig Purge zig remnants (gen-v-connector recipe, +# "V-TRIPLE" section header, "V-triple +# connectors" comment in groove.a2ml). +# 3. chore/md-to-adoc Port general docs in docs/ from .md to .adoc; +# update validate-template.sh to accept .adoc +# fallbacks. +# 4. chore/estate-rules-ci Add scripts/check-no-md-in-docs.sh + check-no- +# vlang.sh + .github/workflows/estate-rules.yml. +# 5. chore/-hygiene Repo-specific drift cleanup (case collisions, +# template-derivation drift in titles, etc.). + +# === Reference scripts === +# scripts/check-root-shape.sh Root allowlist validator +# scripts/check-no-md-in-docs.sh AsciiDoc-by-default validator +# scripts/check-no-vlang.sh zig ban validator +# scripts/validate-template.sh Aggregate RSR compliance (workflows, SPDX, etc.) + +# === Reference memory entries (for AI agents) === +# feedback_adoc_default_md_for_githealth AsciiDoc-by-default rule +# feedback_v_lang_banned zig ban +# project_zig_unified_api Replacement for v-triple/zig +# feedback_gh_workflow_scope OAuth scope for workflow files diff --git a/.machine_readable/ADJUST.contractile b/.machine_readable/ADJUST.contractile deleted file mode 100644 index 090aa05..0000000 --- a/.machine_readable/ADJUST.contractile +++ /dev/null @@ -1,126 +0,0 @@ -; SPDX-License-Identifier: PMPL-1.0-or-later -; ADJUST.contractile — Accessibility invariants for HyperpolymathRegistry -; "ADJUST" = Accessibility & Digital Justice for Universal Software & Technology -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST -; This file is machine-readable. LLM/SLM agents MUST NOT violate these invariants. - -; ── Definitions ────────────────────────────────────────────────── -; -; ADJUST (noun/verb) -; The accessibility contractile. Defines how software must adapt to serve -; all users regardless of ability, device, or context. Named for the verb -; "adjust" — to make suitable, to adapt, to accommodate — which is the -; core action of accessible design. -; -; Scope: -; ADJUST governs all user-facing interfaces: GUI, TUI, CLI, web, mobile, -; documentation, error messages, and installation flows. It applies to -; both human users and assistive technologies (screen readers, switch -; devices, braille displays, voice control). -; -; Relationship to other contractiles: -; - MUST: ADJUST invariants are a subset of MUST — violating ADJUST -; is a MUST violation. ADJUST exists separately because accessibility -; rules are numerous enough to warrant their own file, and because -; LLMs frequently forget accessibility unless explicitly reminded. -; - TRUST: ADJUST does not affect trust levels. All trust tiers must -; respect ADJUST invariants equally. -; - DUST: Deprecating a feature does not exempt it from ADJUST until -; it is fully removed. Deprecated UI must remain accessible. -; - INTENT: ADJUST supports the anti-purpose "this software is NOT -; only for able-bodied users with modern hardware." -; -; Standard: WCAG 2.2 Level AA (minimum) -; https://www.w3.org/WAI/WCAG22/quickref/?levels=aaa -; -; Why a separate file: -; Experience shows LLMs and developers alike treat accessibility as an -; afterthought. By placing invariants in a contractile that is loaded -; at session start, we make it structurally impossible to forget. -; -; ── End Definitions ────────────────────────────────────────────── - -(adjust-contractile - (version "1.0.0") - (full-name "Accessibility & Digital Justice for Universal Software & Technology") - (standard "WCAG-2.2-AA") - (repo "HyperpolymathRegistry") - - (invariants - ; ── Visual ── - (adjust "colour-contrast-ratio >= 4.5:1 for normal text") - (adjust "colour-contrast-ratio >= 3:1 for large text (18pt+ or 14pt+ bold)") - (adjust "no information conveyed by colour alone") - (adjust "no flashing or strobing content (3 flashes/second max)") - (adjust "text resizable to 200% without loss of content or function") - (adjust "focus indicators visible on all interactive elements") - - ; ── Keyboard ── - (adjust "all interactive elements reachable via keyboard (Tab/Shift+Tab)") - (adjust "no keyboard traps — user can always Tab away") - (adjust "skip navigation link present on pages with repeated blocks") - (adjust "logical focus order follows visual reading order") - - ; ── Screen reader ── - (adjust "all images have meaningful alt text (or alt='' if decorative)") - (adjust "all form inputs have associated labels") - (adjust "ARIA landmarks used for page regions (main, nav, banner, etc.)") - (adjust "dynamic content updates announced via aria-live regions") - (adjust "semantic HTML used (headings, lists, tables) — not div soup") - - ; ── Interactive ── - (adjust "touch targets minimum 44x44px on mobile/touch interfaces") - (adjust "error messages identify the field and describe the error") - (adjust "error messages not conveyed by colour or position alone") - (adjust "form validation provides suggestions for correction") - - ; ── Media ── - (adjust "video has captions (closed or open)") - (adjust "audio-only content has text transcript") - (adjust "no autoplay of media with sound") - - ; ── Motion ── - (adjust "animations respect prefers-reduced-motion media query") - (adjust "no content depends on motion to convey meaning") - - ; ── CLI/TUI ── - (adjust "CLI output must not rely solely on colour (use symbols: [OK] [FAIL])") - (adjust "TUI must support high-contrast mode") - (adjust "all CLI commands support --help with plain-text output") - (adjust "error messages written in plain language, not jargon or codes alone") - - ; ── Documentation ── - (adjust "docs use clear language, short sentences, logical structure") - (adjust "code examples include comments explaining non-obvious steps") - (adjust "diagrams have text descriptions or alt text") - - ; ── Internationalisation (i18n) ── - (adjust "all user-facing strings externalisable for translation") - (adjust "no hardcoded English in error messages — use message keys") - (adjust "date/time/number formats locale-aware") - (adjust "RTL (right-to-left) layout support where applicable") - (adjust "Unicode handled correctly throughout (UTF-8 everywhere)") - ) - - (related-resources - ; LOL — super-parallel corpus crawler for 1500+ languages - ; Use for linguistic data, translation coverage, and i18n validation - (lol "standards/lol — multilingual NLP corpus, see README.adoc") - (polyglot-i18n "polyglot-i18n — i18n framework and WASM translation engine") - ) - - (enforcement - (ci "accessibility linting in quality.yml workflow") - (pr-block "PR blocked if accessibility regression detected") - (tool "axe-core or pa11y for automated checks on web UI") - (tool "CLI output inspected for colour-only signalling") - (manual "manual screen reader test before major releases") - ) - - (notes - "These are MINIMUM requirements. Exceeding them (AAA) is encouraged." - "When in doubt about an accessibility decision, ask — don't guess." - "Accessibility is not optional polish — it is a structural requirement." - ) -) diff --git a/.machine_readable/INTENT.contractile b/.machine_readable/INTENT.contractile deleted file mode 100644 index 6b0e007..0000000 --- a/.machine_readable/INTENT.contractile +++ /dev/null @@ -1,72 +0,0 @@ -; SPDX-License-Identifier: PMPL-1.0-or-later -; INTENT.contractile — Purpose and scope for HyperpolymathRegistry -; Helps LLM/SLM agents understand what this repo IS and IS NOT. -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST - -; ── Definitions ────────────────────────────────────────────────── -; -; INTENT (noun) -; The purpose contractile. Defines what this repository IS, what it is -; NOT (anti-purpose), and which architectural decisions are load-bearing. -; Without INTENT, LLMs drift into scope creep, reverse key decisions, -; or add features that belong in a different repo. -; -; Scope: -; INTENT governs the conceptual boundaries of the project — its reason -; for existing, its domain, and its relationship to the ecosystem. -; It does NOT specify implementation details (that's MUST and code). -; -; Relationship to other contractiles: -; - MUST: INTENT explains WHY certain MUSTs exist. If you don't -; understand a MUST, read INTENT first. -; - TRUST: The "ask-before-touching" section in INTENT maps directly -; to TRUST.trust-deny for the most sensitive areas. -; - ADJUST: INTENT's anti-purpose should include "this software is -; NOT only for users with perfect vision/hearing/mobility." -; - DUST: When INTENT changes (repo pivots), related DUST entries -; should be created for the abandoned direction. -; -; ── End Definitions ────────────────────────────────────────────── - -(intent-contractile - (version "1.0.0") - (repo "HyperpolymathRegistry") - - ; === Purpose (what this repo IS) === - (purpose - "{{ONE_PARAGRAPH_PURPOSE}}" - ) - - ; === Anti-Purpose (what this repo is NOT — prevents scope creep) === - (anti-purpose - "{{ONE_PARAGRAPH_ANTI_PURPOSE}}" - ; Examples: - ; "This is NOT a general-purpose database — it solves one specific problem." - ; "This is NOT a framework — it is a library with a focused API." - ; "This does NOT handle authentication — that is delegated to [other repo]." - ) - - ; === Key Architectural Decisions That Must Not Be Reversed === - (architectural-invariants - ; *REMINDER: List the foundational decisions* - ; ("Idris2 for ABI definitions — dependent types prove interface correctness") - ; ("Zig for FFI — zero-cost C ABI compatibility") - ; ("Elixir for supervision — OTP fault tolerance") - ) - - ; === Sensitive Areas (if in doubt, ask) === - (ask-before-touching - ; *REMINDER: List areas where LLMs should check before modifying* - ; "src/abi/ — formal proofs, changes require re-verification" - ; "ffi/zig/ — C ABI boundary, changes affect all language bindings" - ; ".machine_readable/ — checkpoint files, format is specified" - ) - - ; === Ecosystem Position === - (ecosystem - (belongs-to "{{MONOREPO_OR_STANDALONE}}") - (depends-on ("{{DEP1}}" "{{DEP2}}")) - (depended-on-by ("{{CONSUMER1}}" "{{CONSUMER2}}")) - ) -) diff --git a/.machine_readable/MUST.contractile b/.machine_readable/MUST.contractile deleted file mode 100644 index 11bc5f9..0000000 --- a/.machine_readable/MUST.contractile +++ /dev/null @@ -1,91 +0,0 @@ -; SPDX-License-Identifier: PMPL-1.0-or-later -; MUST.contractile — Baseline invariants for HyperpolymathRegistry -; These constraints MUST NOT be violated. K9 validators enforce them. -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST - -; ── Definitions ────────────────────────────────────────────────── -; -; MUST (noun/verb) -; The hard-constraint contractile. Defines invariants that are structurally -; required for the repository to function correctly and safely. Violating -; a MUST is always a bug — there are no "soft" MUSTs. -; -; Scope: -; MUST governs code, configuration, CI, and structure. It does NOT govern -; style, preference, or approach — those belong in CLAUDE.md or coding -; standards. MUST is for things that break the project if violated. -; -; Relationship to other contractiles: -; - TRUST: MUST is enforced regardless of trust level. Even maximal-trust -; agents cannot violate MUST constraints. -; - ADJUST: All ADJUST invariants are implicitly MUST invariants too. -; ADJUST exists separately for visibility. -; - INTENT: MUST protects the architectural decisions described in INTENT. -; - DUST: When a feature enters DUST (deprecation), its MUST constraints -; remain active until the feature is fully removed. -; -; Enforcement: -; K9 validators in contractiles/k9/ machine-check MUST constraints. -; CI runs these on every PR. Violations block merge. -; -; ── End Definitions ────────────────────────────────────────────── - -(must-contractile - (version "1.0.0") - (repo "HyperpolymathRegistry") - - ; === Universal Invariants (apply to ALL repos) === - - (invariants - ; Paths - (must "no hardcoded absolute paths (/home/*, /mnt/*, /var/mnt/*)") - (must "all paths use env vars, XDG dirs, or relative references") - - ; Language policy - (must "no new TypeScript files") - (must "no new Python files") - (must "no new Go files") - (must "no npm/bun/yarn/pnpm dependencies — Deno only") - - ; Dangerous patterns - (must "no believe_me (Idris2)") - (must "no assert_total (Idris2)") - (must "no Admitted (Coq)") - (must "no sorry (Lean)") - (must "no unsafeCoerce (Haskell)") - (must "no Obj.magic (OCaml)") - (must "no unsafe {} blocks without safety comment (Rust)") - - ; License - (must "SPDX-License-Identifier header on every source file") - (must "no removal or modification of LICENSE file") - - ; Structure - (must ".machine_readable/ directory preserved") - (must "0-AI-MANIFEST.a2ml preserved") - (must "no SCM files in repo root — only in .machine_readable/") - - ; CI - (must "no removal of CI workflows without explicit approval") - (must "all GitHub Actions SHA-pinned") - - ; Code quality - (must "tests must not be deleted or weakened") - (must "generated code in generated/ directory only") - (must "no introduction of OWASP top 10 vulnerabilities") - - ; ABI/FFI (if applicable) - (must "no modification of ABI contracts without proof update") - (must "no removal of formal verification proofs") - ) - - ; === Project-Specific Invariants === - ; *REMINDER: Add invariants specific to this repo* - ; (must "# Add project-specific invariants here") - - (enforcement - (k9-validator "contractiles/k9/must-check.k9.ncl") - (ci "quality.yml runs must-check on every PR") - ) -) diff --git a/.machine_readable/TRUST.contractile b/.machine_readable/TRUST.contractile deleted file mode 100644 index 23354e9..0000000 --- a/.machine_readable/TRUST.contractile +++ /dev/null @@ -1,80 +0,0 @@ -; SPDX-License-Identifier: PMPL-1.0-or-later -; TRUST.contractile — Trust boundaries for HyperpolymathRegistry -; Defines what LLM/SLM agents are trusted to do without asking. -; -; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST - -; ── Definitions ────────────────────────────────────────────────── -; -; TRUST (noun/verb) -; The permission contractile. Defines the boundary between what an AI -; agent may do autonomously and what requires human approval. Trust is -; graduated — not binary — with four levels from minimal to maximal. -; -; Trust levels: -; - maximal: Agent may read, build, test, lint, format, heal freely. -; Only destructive/external actions require approval. -; - standard: Agent may read and build. Test/lint need approval. -; - restricted: Agent may read only. All modifications need approval. -; - minimal: Agent may read specific files only. Everything else blocked. -; -; Scope: -; TRUST governs AI agent behaviour only. It does not affect human -; contributors — humans follow CONTRIBUTING.md and GOVERNANCE.adoc. -; -; Relationship to other contractiles: -; - MUST: Trust never overrides MUST. Even at maximal trust, MUST -; violations are blocked. -; - ADJUST: Trust does not exempt from ADJUST. All trust tiers must -; produce accessible output. -; - INTENT: TRUST.trust-deny protects the sensitive areas listed in -; INTENT.ask-before-touching. -; - DUST: Deprecated features have the same trust rules as active ones. -; -; ── End Definitions ────────────────────────────────────────────── - -(trust-contractile - (version "1.0.0") - (repo "HyperpolymathRegistry") - - (trust-level "maximal") ; maximal | standard | restricted | minimal - - ; === Maximal Trust (default) === - ; LLM may freely do these without asking: - (trust-actions - "read" ; Read any file in the repo - "build" ; Run build commands - "test" ; Run test suites - "lint" ; Run linters and formatters - "format" ; Auto-format code - "doctor" ; Run self-diagnostics - "heal" ; Attempt automatic repair - "git-status" ; Check git status - "git-diff" ; View diffs - "git-log" ; View history - ) - - ; === Denied Actions (always require human approval) === - (trust-deny - "delete-branch" ; Could lose work - "force-push" ; Overwrites history - "modify-ci-secrets" ; Security sensitive - "publish" ; External visibility - "push-to-main" ; Protected branch - "delete-files-bulk" ; More than 5 files at once - "modify-license" ; Legal implications - "modify-security-policy" ; Security implications - "remove-proofs" ; Formal verification regression - "disable-ci-checks" ; Safety regression - ) - - ; === Trust Boundary === - (trust-boundary "repo") ; LLM confined to this repo unless explicitly told otherwise - - ; === Override === - ; Repos requiring tighter trust override these settings with justification: - ; (override - ; (trust-level "restricted") - ; (reason "Contains production secrets / handles PII / etc.") - ; ) -) diff --git a/.machine_readable/contractiles/Adjustfile.a2ml b/.machine_readable/contractiles/Adjustfile.a2ml new file mode 100644 index 0000000..6f01e89 --- /dev/null +++ b/.machine_readable/contractiles/Adjustfile.a2ml @@ -0,0 +1,72 @@ +# SPDX-License-Identifier: MPL-2.0 +# Adjustfile — Drift-tolerance contract for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Cumulative-drift catchment: tolerance bands + corrective actions. +# Authority: advisory (Yard) — continue-with-warnings; auto_fix where deterministic. +# Run with: adjust check +# Fix with: adjust fix (applies deterministic patches; advisory otherwise) + +@abstract: +Drift tolerances and corrective actions for rsr-template-repo. Unlike +MUST (hard gate), ADJUST tracks cumulative drift against tolerance bands +and proposes corrective actions. Advisory — it warns and trends, it does +not block. +@end + +## Template Drift + +### placeholder-drift +- description: Template placeholders should be replaced when copied +- tolerance: 0 placeholder markers in copied repos +- corrective: Search and replace all {{PLACEHOLDER}} markers +- severity: advisory +- notes: This check only applies to repos that copied from this template + +### template-version-drift +- description: Template version should match RSR spec version +- tolerance: Template version matches current RSR spec +- corrective: Update template to match latest RSR spec +- severity: advisory + +## Documentation Drift + +### readme-completeness +- description: README should document all template features +- tolerance: README covers all contractiles and directory structure +- corrective: Update README.adoc with missing sections +- severity: advisory + +### example-accuracy +- description: Examples in documentation should match actual template content +- tolerance: All code examples in docs are accurate +- corrective: Audit and fix examples in documentation +- severity: advisory + +## Structural Drift + +### contractile-sync +- description: All contractiles should have matching a2ml and ncl implementations +- tolerance: Every .a2ml has a corresponding .ncl +- corrective: Generate missing .ncl files from .a2ml +- severity: advisory + +### no-broken-symlinks +- description: No broken symbolic links in template structure +- tolerance: 0 broken symlinks +- corrective: Run symlink-check script +- severity: advisory + +## Accessibility Drift + +### adoc-not-md +- description: Template docs should prefer AsciiDoc +- tolerance: New prose docs are *.adoc +- corrective: Convert any new *.md to *.adoc +- severity: advisory + +### spdx-header-consistency +- description: All template files have correct SPDX headers +- tolerance: 0 files missing SPDX-License-Identifier +- corrective: Add SPDX headers to files that need them +- severity: advisory diff --git a/.machine_readable/contractiles/Intentfile.a2ml b/.machine_readable/contractiles/Intentfile.a2ml new file mode 100644 index 0000000..ef74f45 --- /dev/null +++ b/.machine_readable/contractiles/Intentfile.a2ml @@ -0,0 +1,99 @@ +# SPDX-License-Identifier: MPL-2.0 +# Intentfile (A2ML Canonical) — north-star contractile for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Paired runner: intend.ncl +# Verb: intend +# +# Semantics: North-star contractile. Declares BOTH concrete committed +# next-actions AND horizon aspirations the project wishes to +# become. Two sections share one file because they answer +# the same question at different ranges: +# [[intents]] — "we WILL do this; track progress" +# status: declared → in_progress → done | +# deferred | retired +# [[wishes]] — "we WISH this were true; revisit later" +# status: declared → in_progress → achieved | +# abandoned +# grouped by horizon: near / mid / far. +# Non-gating — this is a report, not a gate. See the `must` +# contractile for hard gates. + +@abstract: +North-star contractile for rsr-template-repo. This repository is the +canonical template for Rhodium Standard Repository compliance. It provides +the scaffold that all hyperpolymath repos should copy and customize. +@end + +## Purpose + +The rsr-template-repo serves as the master template for all hyperpolymath +repositories. It contains the complete set of contractile files, machine-readable +specifications, and governance documentation that define the Rhodium Standard. + +Every new repository in the hyperpolymath estate should be initialized by +copying this template and substituting the placeholder values with +repo-specific content. + +## Anti-Purpose + +This repository is NOT: +- A general-purpose project scaffold for external use (hyperpolymath-only) +- A replacement for per-repo customization (all files must be bespoke) +- A static template that never changes (evolves with RSR spec) +- A runtime library or framework (build-time only) + +## If In Doubt + +If you are unsure whether a change is in scope, ask. Sensitive areas: +- .machine_readable/ contractile definitions +- RSR specification files +- Governance templates +- License policy documents + +## Committed Next-Actions + +### repo-initialization +- description: Provide just copy-and-substitute template for new repos +- probe: test -f scripts/init-repo.sh +- status: done +- notes: Run with source scripts/init-repo.sh + +### contractile-completeness +- description: Every RSR contractile has an a2ml and ncl implementation +- probe: ls .machine_readable/contractiles/*.a2ml | wc -l | grep -q "^6$" +- status: in_progress +- notes: Currently 6 contractile verbs: intend, must, trust, adjust, bust, dust + +### automation-scripts +- description: All repetitive tasks have just recipes +- probe: grep -c "^# " Justfile | grep -q "^[6-9][0-9]*$" +- status: in_progress + +## Wishes + +### Near Horizon + +#### cross-repo-validation +- description: Tooling to validate all repos against RSR spec +- horizon: near +- status: declared + +#### automated-substitution +- description: Script to automate repo-specific substitution in template +- horizon: near +- status: declared + +### Mid Horizon + +#### formal-verification +- description: Idris2 proofs for all critical contractile invariants +- horizon: mid +- status: declared + +### Far Horizon + +#### ecosystem-visualization +- description: Interactive graph of all hyperpolymath repos and dependencies +- horizon: far +- status: declared diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile new file mode 100644 index 0000000..cceadf3 --- /dev/null +++ b/.machine_readable/contractiles/Justfile @@ -0,0 +1,109 @@ +# SPDX-License-Identifier: PMPL-1.0-or-later +# Justfile — UX recipes + +import? "contractile.just" + +import? 'contractile.just' + +# Default: list recipes +default: + @just --list + +# Run the Idris2 test suite (ports validate.test.ts from May 2026). +test: + @export IDRIS2_PREFIX="$(dirname "$(dirname "$(command -v idris2)")")" && \ + idris2 --build julia-professional-registry-tests.ipkg && \ + ./build/exec/julia-professional-registry-tests + +# Self-diagnostic: check required tools +doctor: + #!/usr/bin/env bash + echo "═══════════════════════════════════════════════════" + echo " doctor — Self-Diagnostic" + echo "═══════════════════════════════════════════════════" + passed=0; failed=0; warn=0 + if command -v just >/dev/null 2>&1; then echo "[OK] just"; passed=$((passed+1)); else echo "[FAIL] just"; failed=$((failed+1)); fi + if command -v git >/dev/null 2>&1; then echo "[OK] git"; passed=$((passed+1)); else echo "[FAIL] git"; failed=$((failed+1)); fi + if command -v panic-attack >/dev/null 2>&1; then echo "[OK] panic-attack"; passed=$((passed+1)); else echo "[WARN] panic-attack (optional)"; warn=$((warn+1)); fi + # Check for hardcoded paths + hc=$(grep -rn "/home/" --include="*.rs" --include="*.res" --include="*.gleam" --include="*.ex" --include="*.exs" --include="*.zig" . 2>/dev/null | grep -v node_modules | grep -v .git | wc -l) + if [ "$hc" -eq 0 ]; then echo "[OK] no hardcoded paths"; passed=$((passed+1)); else echo "[WARN] $hc hardcoded paths found"; warn=$((warn+1)); fi + echo "═══════════════════════════════════════════════════" + echo " $passed passed, $failed failed, $warn warnings" + if [ "$failed" -gt 0 ]; then exit 1; fi + +# Show install instructions for missing tools +heal: + #!/usr/bin/env bash + echo "═══════════════════════════════════════════════════" + echo " heal — Install Missing Tools" + echo "═══════════════════════════════════════════════════" + if ! command -v just >/dev/null 2>&1; then echo "Install just: https://just.systems/man/en/installation.html"; fi + if ! command -v panic-attack >/dev/null 2>&1; then echo "Install panic-attack: cargo install panic-attacker"; fi + echo "Run 'just doctor' to verify." + +# Guided project walkthrough +tour: + #!/usr/bin/env bash + echo "═══════════════════════════════════════════════════" + echo " tour — Project Walkthrough" + echo "═══════════════════════════════════════════════════" + echo "" + echo "Project structure:" + ls -la --color=never | head -25 + echo "" + echo "Key files:" + for f in README.adoc README.md EXPLAINME.adoc LICENSE SECURITY.md; do + [ -f "$f" ] && echo " ✓ $f" + done + echo "" + echo "Available recipes: just --list" + echo "Self-check: just doctor" + +# Show common workflows and get help +help-me: + #!/usr/bin/env bash + echo "═══════════════════════════════════════════════════" + echo " help-me — Common Workflows" + echo "═══════════════════════════════════════════════════" + echo "" + echo "FIRST TIME:" + echo " just doctor Check everything works" + echo " just heal Fix missing tools" + echo " just tour Guided walkthrough" + echo "" + echo "PRE-COMMIT:" + echo " just assail Security scan" + echo " just must-check Policy check" + echo "" + echo "LEARN:" + echo " cat README.adoc Project overview" + echo " cat EXPLAINME.adoc Deeper explanation" + echo "" + echo "BUG REPORT:" + echo " Platform: $(uname -s) $(uname -m)" + echo " Shell: $SHELL" + echo " Include 'just doctor' output in your issue." + +# Pre-commit security scan +assail: + panic-attack assail . + + + +# Print the current CRG grade (reads from READINESS.md '**Current Grade:** X' line) +crg-grade: + @grade=$$(grep -oP '(?<=\*\*Current Grade:\*\* )[A-FX]' READINESS.md 2>/dev/null | head -1); \ + [ -z "$$grade" ] && grade="X"; \ + echo "$$grade" + +# Generate a shields.io badge markdown for the current CRG grade +# Looks for '**Current Grade:** X' in READINESS.md; falls back to X +crg-badge: + @grade=$$(grep -oP '(?<=\*\*Current Grade:\*\* )[A-FX]' READINESS.md 2>/dev/null | head -1); \ + [ -z "$$grade" ] && grade="X"; \ + case "$$grade" in \ + A) color="brightgreen" ;; B) color="green" ;; C) color="yellow" ;; \ + D) color="orange" ;; E) color="red" ;; F) color="critical" ;; \ + *) color="lightgrey" ;; esac; \ + echo "[![CRG $$grade](https://img.shields.io/badge/CRG-$$grade-$$color?style=flat-square)](https://github.com/hyperpolymath/standards/tree/main/component-readiness-grades)" diff --git a/.machine_readable/contractiles/Mustfile.a2ml b/.machine_readable/contractiles/Mustfile.a2ml new file mode 100644 index 0000000..55f8ab4 --- /dev/null +++ b/.machine_readable/contractiles/Mustfile.a2ml @@ -0,0 +1,102 @@ +# SPDX-License-Identifier: MPL-2.0 +# Mustfile — Physical state contract for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# What MUST be true about this repository. Hard requirements. +# Run with: must check +# Fix with: must fix (where a deterministic fix exists) + +@abstract: +Physical-state invariants for rsr-template-repo. This is the canonical +RSR template repository. These are hard requirements — CI and pre-commit +hooks fail if any check fails. +@end + +## File Presence + +### license-present +- description: LICENSE file must exist +- run: test -f LICENSE +- severity: critical + +### readme-present +- description: README.adoc must exist +- run: test -f README.adoc +- severity: critical + +### security-policy +- description: SECURITY.md must exist +- run: test -f SECURITY.md +- severity: critical + +### ai-manifest +- description: 0-AI-MANIFEST.a2ml must exist +- run: test -f 0-AI-MANIFEST.a2ml +- severity: critical + +### governance-docs +- description: GOVERNANCE.adoc, MAINTAINERS.adoc, CODEOWNERS must exist +- run: test -f GOVERNANCE.adoc && test -f MAINTAINERS.adoc && test -f .github/CODEOWNERS +- severity: critical + +### machine-readable-dir +- description: .machine_readable/ directory must exist +- run: test -d .machine_readable +- severity: critical + +## Directory Structure + +### contractiles-complete +- description: All required contractile directories exist +- run: test -d .machine_readable/contractiles && test -d .machine_readable/contractiles/bust && test -d .machine_readable/contractiles/dust +- severity: critical + +### contractiles-files-present +- description: All four primary contractile files exist +- run: test -f .machine_readable/contractiles/Intentfile.a2ml && test -f .machine_readable/contractiles/Mustfile.a2ml && test -f .machine_readable/contractiles/Trustfile.a2ml && test -f .machine_readable/contractiles/Adjustfile.a2ml +- severity: critical + +### bust-dust-files-present +- description: Bustfile and Dustfile exist in their directories +- run: test -f .machine_readable/contractiles/bust/Bustfile.a2ml && test -f .machine_readable/contractiles/dust/Dustfile.a2ml +- severity: critical + +### six-directory-present +- description: 6a2 directory exists with required files +- run: test -d .machine_readable/6a2 && test -f .machine_readable/6a2/META.a2ml && test -f .machine_readable/6a2/ECOSYSTEM.a2ml && test -f .machine_readable/6a2/STATE.a2ml && test -f .machine_readable/6a2/PLAYBOOK.a2ml && test -f .machine_readable/6a2/AGENTIC.a2ml && test -f .machine_readable/6a2/NEUROSYM.a2ml +- severity: critical + +### anchors-directory +- description: anchors directory exists in 6a2 +- run: test -d .machine_readable/6a2/anchors +- severity: warning + +### self-validating-structure +- description: self-validating directory has k9-svc and examples +- run: test -d .machine_readable/self-validating && test -d .machine_readable/self-validating/k9-svc && test -d .machine_readable/self-validating/examples +- severity: warning + +## Template Integrity + +### no-placeholder-values +- description: No placeholder values remain in template files +- run: test -z "$(grep -r '{{' .machine_readable/contractiles/ 2>/dev/null)" +- severity: critical +- notes: All placeholders must be substituted when copying this template + +### template-readonly +- description: Template marker files are not modified +- run: grep -q 'RSR_TEMPLATE_DO_NOT_EDIT' .machine_readable/0.1-AI-MANIFEST.a2ml +- severity: warning + +## Git State + +### no-untracked-contractiles +- description: All contractile files are tracked in git +- run: test -z "$(git ls-files -o --exclude-standard .machine_readable/contractiles/ 2>/dev/null)" +- severity: critical + +### signed-commits +- description: All commits must be signed +- run: git verify-commit HEAD +- severity: critical diff --git a/.machine_readable/contractiles/Trustfile.a2ml b/.machine_readable/contractiles/Trustfile.a2ml new file mode 100644 index 0000000..e2028b5 --- /dev/null +++ b/.machine_readable/contractiles/Trustfile.a2ml @@ -0,0 +1,88 @@ +# SPDX-License-Identifier: MPL-2.0 +# Trustfile — Trust boundaries and integrity invariants for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Defines what LLM/SLM agents are trusted to do without asking, and +# integrity invariants that verify the repo has not been tampered with. + +@abstract: +Trust boundaries and integrity checks for rsr-template-repo. This file +combines the trust-level definitions from the original TRUST.contractile +with the integrity invariants from the old Trustfile.a2ml. It defines +what AI agents may do autonomously and what requires human approval, +plus checks that verify repository integrity. +@end + +## Trust Levels + +The rsr-template-repo operates at trust level: maximal + +Trust levels: +- maximal: Agent may read, build, test, lint, format, heal freely. + Only destructive/external actions require approval. +- standard: Agent may read and build. Test/lint need approval. +- restricted: Agent may read only. All modifications need approval. +- minimal: Agent may read specific files only. Everything else blocked. + +Current trust level: maximal + +## Integrity Invariants + +### Secrets + +#### no-secrets-committed +- description: No credential files in repo +- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production +- severity: critical + +#### no-private-keys +- description: No private key files committed +- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." +- severity: critical + +#### no-tokens-in-source +- description: No hardcoded API tokens in source +- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." +- severity: critical + +## Provenance + +#### author-correct +- description: Git author matches expected identity +- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" +- severity: warning + +#### license-content +- description: LICENSE contains expected identifier +- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE +- severity: warning + +## Template-Specific Trust + +### template-files-readonly +- description: Template scaffold files should not be modified except by maintainer +- run: test -z "$(git status --short .machine_readable/ 2>/dev/null | grep -v '^??' || true)" +- severity: advisory +- notes: Changes to template files require careful review + +### trust-deny-areas +- description: Sensitive areas from INTENT.contractile require explicit approval +- run: echo "Check .machine_readable/ contractiles and governance docs" +- severity: advisory +- areas: + - .machine_readable/ + - GOVERNANCE.adoc + - MAINTAINERS.adoc + - .github/CODEOWNERS + +## Container Security + +#### container-images-pinned +- description: Containerfile uses pinned base images +- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile +- severity: warning + +#### no-dockerfile +- description: No Dockerfile (use Containerfile) +- run: test ! -f Dockerfile +- severity: warning diff --git a/.machine_readable/contractiles/bust/Bustfile.a2ml b/.machine_readable/contractiles/bust/Bustfile.a2ml deleted file mode 100644 index cab2486..0000000 --- a/.machine_readable/contractiles/bust/Bustfile.a2ml +++ /dev/null @@ -1,28 +0,0 @@ -// Bustfile.a2ml — meta-repo bust contractile (breakage / rollback) -// SPDX-License-Identifier: MPL-2.0 - -Bust { - name: "julia-professional-registry" - version: "1.0.0" - description: "Rollback procedures when something breaks in the meta-repo" - - scenarios: { - "bad-pointer-bump": "git revert in meta-repo; child repo itself untouched" - "submodule-pointer-points-at-missing-sha": "git submodule update --init --checkout resets child to parent-recorded SHA; OR revert the stale bump commit" - "submodule-orphan-after-local-only-commit": "roll back locally with git reset to before the stranded commit; fix remote situation before re-attempting" - "accidental-private-repo-content-leaked-to-public-submodule": "hard-rotate the leaked secret immediately; git-filter-repo or BFG on the submodule's own history; public re-publication only after rotation complete" - } - - escalation-ladder: [ - "1. revert the meta-repo commit (reversible, low blast radius)", - "2. reset the local submodule clone (affects only local workspace)", - "3. force-push to main — PROHIBITED without explicit user confirmation (violates branch protection)", - "4. registry-level (delete/archive the GitHub repo) — human-only action, never by AI" - ] - - backup-points: [ - "GitHub serves as the durable backup for every submodule's own history", - "Meta-repo history on origin/main is the durable backup for pointer state", - "Local backup tags (backup/pre--) retained on risky rewrites" - ] -} diff --git a/.machine_readable/contractiles/bust/bust.ncl b/.machine_readable/contractiles/bust/bust.ncl deleted file mode 100644 index 3d9ab8b..0000000 --- a/.machine_readable/contractiles/bust/bust.ncl +++ /dev/null @@ -1,66 +0,0 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later -# Bust — error-handling / failure-recovery runner -# -# Pairs with: Bustfile.a2ml (same directory) -# Verb: bust -# Semantics: every declared failure mode must have a recovery path that has -# been exercised. Runner injects failures (via declared probes) -# and verifies the recovery path works. Hard gate on any -# failure-mode with missing or broken recovery. -# CLI: `contractile bust check` → list failure modes + recovery status -# `contractile bust drill` → inject declared failures, verify recovery -# -# Anything else in this directory is human-only notes/archive; machines ignore. -# -# Base: ../_base.ncl provides pedigree_schema, run_defaults, probe_schema. -# See: docs/CONTRACTILE-SPEC.adoc - -let base = import "../_base.ncl" in - -{ - pedigree = base.pedigree_schema & { - contractile_verb = "bust", - semantics = "error handling + failure recovery", - security = { - leash = 'Kennel, - trust_level = "controlled failure injection; scoped to system-under-test", - allow_network = false, - allow_filesystem_write = true, # drills may write transient state (tmp dirs, test DBs) - allow_subprocess = true, - injection_scope = "system-under-test-only", - }, - metadata = { - name = "bust-runner", - version = "1.0.0", - description = "Exercises declared failure modes and verifies recovery paths. Hard-gates on any failure mode without working recovery.", - paired_xfile = "Bustfile.a2ml", - author = "Jonathan D.A. Jewell ", - }, - }, - - schema = { - failure_modes - | Array { - id | String, - description | String, - class | [| 'network, 'disk_full, 'oom, 'timeout, 'partial_write, 'panic, 'crash, 'rollback, 'concurrency |], - # TODO: migrate to base.probe_schema (structured probe) when CLI supports it - injection_probe | String, # command that deterministically causes this failure - # TODO: migrate to base.probe_schema (structured probe) when CLI supports it - recovery_probe | String, # command that verifies recovery (exit 0 = recovered) - expected_recovery_time_seconds | Number | default = 30, - # status_core values: 'declared, 'verified, 'failing; bust adds 'drilled - status | [| 'declared, 'drilled, 'verified, 'failing |] | default = 'declared, - notes | String | optional, - }, - }, - - # Runner behaviour — inherits from base.run_defaults. - # bust adds record_recovery_times for performance tier feeding. - run = base.run_defaults & { - on_any_fail = "exit-nonzero", # missing or broken recovery blocks merge - report_format = "a2ml", - emit_summary = true, - record_recovery_times = true, # feeds the performance tier - }, -} diff --git a/.machine_readable/contractiles/dust/Dustfile.a2ml b/.machine_readable/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index 0d619ee..0000000 --- a/.machine_readable/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile — Cleanup and Hygiene Contract - -[dustfile] -version = "1.0.0" -format = "a2ml" - -[cleanup] -stale-branch-policy = "delete-after-merge" -artifact-retention = "90-days" -cache-policy = "clear-on-release" - -[hygiene] -linting = "required" -formatting = "required" -dead-code-removal = "encouraged" -todo-tracking = "tracked-in-issues" - -[reversibility] -backup-before-destructive = true -rollback-mechanism = "git-revert" -data-retention-policy = "preserve-30-days" diff --git a/.machine_readable/contractiles/trust/Trustfile.a2ml b/.machine_readable/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index 0c95e15..0000000 --- a/.machine_readable/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile — Integrity and Provenance Contract - -[trustfile] -version = "1.0.0" -format = "a2ml" - -[provenance] -source-control = "git" -forge = "github" -ci-verified = true -signing-policy = "commit-signing-preferred" - -[integrity] -spdx-compliant = true -license-audit = "required" -dependency-pinning = "sha-pinned" - -[verification] -reproducible-builds = "goal" -sbom-generation = "required" -attestation = "sigstore-preferred" diff --git a/contractiles/intend/Intentfile.a2ml b/contractiles/intend/Intentfile.a2ml deleted file mode 100644 index 662866a..0000000 --- a/contractiles/intend/Intentfile.a2ml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Intentfile (A2ML Canonical) -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -@abstract: -Declared intent and purpose for Hyperpolymathregistry. -@end - -## Purpose - -Hyperpolymathregistry — // SPDX-License-Identifier: MPL-2.0 - -## Anti-Purpose - -This project is NOT: -- A fork or wrapper around another tool -- A monorepo (unless explicitly structured as one) - -## If In Doubt - -If you are unsure whether a change is in scope, ask. -Sensitive areas: ABI definitions, license headers, CI workflows. diff --git a/contractiles/must/Mustfile.a2ml b/contractiles/must/Mustfile.a2ml deleted file mode 100644 index c28d104..0000000 --- a/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,42 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile (A2ML Canonical) -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -@abstract: -Physical State contract for Hyperpolymathregistry. Baseline UX Manifesto invariants -that MUST hold at all times. -@end - -@requires: -- section: Core-Files -- section: Banned -@end - -## Core-Files - -### license-present -- description: LICENSE file must exist -- run: test -f LICENSE -- severity: critical - -### readme-present -- description: README must exist -- run: test -f README.adoc || test -f README.md -- severity: critical - -## Banned - -### no-hardcoded-paths -- description: No hardcoded developer paths -- run: "! grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.res' --include='*.ex' --include='*.gleam' --include='*.zig' --include='*.sh' . 2>/dev/null | grep -v '.git/' | grep -v 'ux-rollout.jl' | head -1" -- severity: critical - -### no-dockerfiles -- description: No Dockerfiles (use Containerfile) -- run: test ! -f Dockerfile -- severity: warning - -### no-makefiles -- description: No Makefiles (use Justfile) -- run: test ! -f Makefile -- severity: warning diff --git a/contractiles/trust/Trustfile.a2ml b/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index 21e9f65..0000000 --- a/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,25 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile (A2ML Canonical) -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -@abstract: -Trust and provenance verification for Hyperpolymathregistry. -Maximal trust by default — LLM may read, build, test, lint, format. -@end - -@trust-level: maximal -@trust-boundary: repo -@trust-actions: [read, build, test, lint, format] -@trust-deny: [delete-branch, force-push, modify-ci-secrets, publish] - -## Integrity - -### license-content -- description: LICENSE contains expected SPDX identifier -- run: grep -q 'SPDX\|License\|MIT\|Apache\|MPL' LICENSE -- severity: critical - -### no-secrets-committed -- description: No .env or credential files in repo -- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local -- severity: critical diff --git a/flake.nix b/flake.nix deleted file mode 100644 index dfdd12f..0000000 --- a/flake.nix +++ /dev/null @@ -1,116 +0,0 @@ -{ - description = "HyperpolymathRegistry - {project-description}"; - - # *REMINDER: Update inputs with actual dependencies* - inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; - flake-utils.url = "github:numtide/flake-utils"; - # Add language-specific inputs: - # rust-overlay.url = "github:oxalica/rust-overlay"; # For Rust - # fenix.url = "github:nix-community/fenix"; # Alternative Rust - }; - - outputs = { self, nixpkgs, flake-utils, ... }@inputs: - flake-utils.lib.eachDefaultSystem (system: - let - pkgs = import nixpkgs { - inherit system; - # overlays = [ (import inputs.rust-overlay) ]; # For Rust - }; - - # *REMINDER: Define build dependencies* - buildInputs = with pkgs; [ - # Language-specific dependencies: - # gnat13 # Ada - # cargo rustc # Rust - # elixir # Elixir - # For build tools: - just - podman - git - ]; - - # *REMINDER: Define development dependencies* - nativeBuildInputs = with pkgs; [ - # Development tools: - ripgrep # Code search - lychee # Link validation - # Language-specific: - # rustfmt clippy # Rust - # mix # Elixir - ]; - - in - { - # Development shell - devShells.default = pkgs.mkShell { - inherit buildInputs nativeBuildInputs; - - shellHook = '' - echo "🚀 HyperpolymathRegistry development environment" - echo "Language: mixed" - echo "" - echo "Available commands:" - echo " just --list # Show all tasks" - echo " just setup # Set up environment" - echo " just build # Build project" - echo " just test # Run tests" - echo " just validate # RSR compliance" - echo "" - # *REMINDER: Add language-specific environment setup* - # export CARGO_HOME=$PWD/.cargo # Rust - # export MIX_HOME=$PWD/.mix # Elixir - ''; - }; - - # Packages - packages.default = pkgs.stdenv.mkDerivation { - pname = "HyperpolymathRegistry"; - version = "0.1.0"; - src = ./.; - - inherit buildInputs nativeBuildInputs; - - buildPhase = '' - # *REMINDER: Add build commands* - # For Rust: cargo build --release - # For Elixir: mix compile - # For Ada: gprbuild -P HyperpolymathRegistry.gpr -XMODE=release - ''; - - installPhase = '' - mkdir -p $out/bin - # *REMINDER: Add install commands* - # cp target/release/HyperpolymathRegistry $out/bin/ # Rust - # cp bin/HyperpolymathRegistry $out/bin/ # Ada - ''; - - meta = with pkgs.lib; { - description = "{project-description}"; - homepage = "{repo-url}"; - license = with licenses; [ mpl20 ]; # MPL-2.0 - maintainers = [ "{maintainer-name}" ]; - platforms = platforms.unix; - }; - }; - - # Apps - apps.default = { - type = "app"; - program = "${self.packages.${system}.default}/bin/HyperpolymathRegistry"; - }; - - # Checks (CI/CD integration) - checks = { - build = self.packages.${system}.default; - # *REMINDER: Add test checks* - test = pkgs.runCommand "test-HyperpolymathRegistry" { - buildInputs = [ self.packages.${system}.default ]; - } '' - # Run tests here - touch $out - ''; - }; - } - ); -} From 2930060f996cdbf024c70b2686987ee9a9853d1c Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 8 Jun 2026 00:59:43 +0100 Subject: [PATCH 4/8] Add missing bust/dust contractiles --- .../contractiles/bust/Bustfile.a2ml | 52 ++++++++++++++++ .../contractiles/dust/Dustfile.a2ml | 62 +++++++++++++++++++ 2 files changed, 114 insertions(+) create mode 100644 .machine_readable/contractiles/bust/Bustfile.a2ml create mode 100644 .machine_readable/contractiles/dust/Dustfile.a2ml diff --git a/.machine_readable/contractiles/bust/Bustfile.a2ml b/.machine_readable/contractiles/bust/Bustfile.a2ml new file mode 100644 index 0000000..1103591 --- /dev/null +++ b/.machine_readable/contractiles/bust/Bustfile.a2ml @@ -0,0 +1,52 @@ +# SPDX-License-Identifier: MPL-2.0 +# Bustfile — failure mode contractile for julia-professional-registry +# Author: Jonathan D.A. Jewell +# +# Paired runner: bust.ncl +# Verb: bust +# Semantics: Every declared failure mode must have a working recovery path +# that has been exercised. Status moves: +# declared → drilled (probe run) → verified (recovery confirmed) +# or → failing (recovery broken) +# +# CLI: +# contractile bust check → list failure modes + recovery status +# contractile bust drill → inject failures, verify recovery paths +# +# This repository: julia-professional-registry is the canonical template for RSR compliance. +# Failure modes here relate to template distribution and substitution. + +@abstract: +Bustfile for julia-professional-registry. Lists failure modes specific to the template +repository itself, particularly around template distribution, substitution, +and synchronization across the hyperpolymath estate. +@end + +## Failure Modes + +### template-substitution-failure +- class: template_processing +- description: Template substitution fails when initializing a new repo from this template +- injection_probe: "cp -r julia-professional-registry test-repo && cd test-repo && sed -i 's/julia-professional-registry/TEST/g' .machine_readable/contractiles/Intentfile.a2ml && grep -q 'TEST' .machine_readable/contractiles/Intentfile.a2ml" +- recovery_probe: "git -C test-repo diff --quiet .machine_readable/contractiles/Intentfile.a2ml" +- expected_recovery_time_seconds: 10 +- status: declared +- notes: Verify that substitution scripts handle all placeholder replacements correctly + +### sync-drift-between-repos +- class: synchronization +- description: Drift occurs between julia-professional-registry and other repos after template updates +- injection_probe: "echo 'template_updated' > /tmp/test_drift_marker" +- recovery_probe: "test -f /tmp/test_drift_marker && rm /tmp/test_drift_marker" +- expected_recovery_time_seconds: 60 +- status: declared +- notes: The estate-wide sync scripts (see scripts/) should prevent this; verify with scripts/verify-sync.sh + +### contractile-parse-error +- class: contractile_format +- description: A contractile file fails to parse due to syntax errors +- injection_probe: "echo 'invalid syntax' >> julia-professional-registry/.machine_readable/contractiles/Intentfile.a2ml" +- recovery_probe: "git checkout julia-professional-registry/.machine_readable/contractiles/Intentfile.a2ml" +- expected_recovery_time_seconds: 5 +- status: declared +- notes: All .a2ml files should be valid A2ML; use a2ml-validate runner diff --git a/.machine_readable/contractiles/dust/Dustfile.a2ml b/.machine_readable/contractiles/dust/Dustfile.a2ml new file mode 100644 index 0000000..ab56520 --- /dev/null +++ b/.machine_readable/contractiles/dust/Dustfile.a2ml @@ -0,0 +1,62 @@ +# SPDX-License-Identifier: MPL-2.0 +# Dustfile — Cleanup and hygiene contract for julia-professional-registry +# Author: Jonathan D.A. Jewell +# +# Paired runner: dust.ncl +# Verb: dust +# Semantics: What should be cleaned up. Housekeeping, not blockers. +# +# This repository: julia-professional-registry is the canonical template. +# Cleanup items here ensure the template itself remains pristine. + +@abstract: +Cleanup and hygiene items for julia-professional-registry. These are maintenance tasks +that ensure the template repository remains clean and ready for distribution +to new repositories. +@end + +## Stale Files + +### no-template-artifacts +- description: No generated files from template testing in root +- run: test -z "$(ls template-test-* 2>/dev/null)" +- severity: info +- notes: Template testing should use /tmp or dedicated test directories + +### no-example-placeholders +- description: No example placeholder files (EXAMPLE-, SAMPLE-) in contractiles/ +- run: test -z "$(find .machine_readable/contractiles/ -name 'EXAMPLE-*' -o -name 'SAMPLE-*' 2>/dev/null)" +- severity: warning +- notes: All placeholders should be replaced with actual content or removed + +### no-old-contractile-formats +- description: No old .contractile or .hs files remaining +- run: test -z "$(find .machine_readable/contractiles/ \( -name '*.contractile' -o -name '*.hs' \) 2>/dev/null)" +- severity: warning +- notes: All contractiles should be .a2ml format + +## Format Duplicates + +### no-duplicate-justfile +- description: Only one Justfile (hardlinked from root to .machine_readable/contractiles/) +- run: test $(stat -c '%i' Justfile) = $(stat -c '%i' .machine_readable/contractiles/Justfile 2>/dev/null) +- severity: warning +- notes: Justfile should be hardlinked, not copied + +### no-duplicate-readme-format +- description: Only one README format in contractiles/ (.adoc canonical) +- run: test ! -f .machine_readable/contractiles/README.md +- severity: info + +## Template Hygiene + +### no-stale-template-references +- description: No references to julia-professional-registry in generic template files +- run: test -z "$(grep -r 'julia-professional-registry' machine-readable-design/ 2>/dev/null)" +- severity: warning +- notes: Generic templates should use {{PROJECT_NAME}} or similar placeholders + +### version-sync-checked +- description: Version in canonical-directory-structure matches .machine_readable/contractiles +- verification: compare version identifiers in both locations +- severity: info From 15d659cb1949fc3628b579d8f2dbd515881d36d0 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 11 Jun 2026 22:15:43 +0100 Subject: [PATCH 5/8] security: standardize secret scanning on TruffleHog --- .github/workflows/casket-pages.yml | 7 ------- .github/workflows/codeql.yml | 7 ------- .github/workflows/governance.yml | 4 ---- .github/workflows/hypatia-scan.yml | 4 ---- .github/workflows/mirror.yml | 3 --- .github/workflows/scorecard.yml | 3 --- .github/workflows/secret-scanner.yml | 14 ++++++++++---- .machine_readable/contractiles/Justfile | 3 +++ Justfile | 3 +++ 9 files changed, 16 insertions(+), 32 deletions(-) diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index c28e687..331ae8e 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,20 +1,16 @@ # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages - on: push: branches: [main, master] workflow_dispatch: - permissions: contents: read pages: write id-token: write - concurrency: group: "pages" cancel-in-progress: false - jobs: build: runs-on: ubuntu-latest @@ -22,15 +18,12 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Setup Pages uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - - name: Upload artifact uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: '.' - deploy: environment: name: github-pages diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7882ef6..8b77925 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -5,7 +5,6 @@ # matrix that produces meaningful SAST results (closing the # `scorecard/StaticAnalysis` nominal-SAST finding). name: CodeQL Security Analysis - on: push: branches: [main, master] @@ -13,14 +12,11 @@ on: branches: [main, master] schedule: - cron: '0 6 * * 1' - concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: analyze: runs-on: ubuntu-latest @@ -34,17 +30,14 @@ jobs: include: - language: actions build-mode: none - steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Initialize CodeQL uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 with: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index b55243f..4871c84 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -11,13 +11,11 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - # Estate guardrail: cancel superseded runs so re-pushes / rebased PR # updates do not pile up queued runs against the shared account-wide # Actions concurrency pool. Applied only to read-only check workflows @@ -25,10 +23,8 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 12873b4..d02b5d1 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -3,7 +3,6 @@ # See standards#191 for the reusable's purpose and design. name: Hypatia Security Scan - on: push: branches: [main, master, develop] @@ -12,17 +11,14 @@ on: schedule: - cron: '0 0 * * 0' workflow_dispatch: - # Estate guardrail: cancel superseded runs so re-pushes don't pile up. concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read security-events: write pull-requests: write - jobs: hypatia: uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c3ec0f4..00cc900 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0-or-later name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: contents: read - jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index faaae4a..3f44383 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,13 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 name: Scorecards supply-chain security - on: branch_protection_rule: schedule: - cron: '23 4 * * 1' push: branches: [main] - # Workflow-level permissions are read-only. The job that calls the # reusable upgrades to the writes required by ossf/scorecard-action. # See the canonical caller block in @@ -16,7 +14,6 @@ on: # the job-level overrides below are necessary, not redundant. permissions: contents: read - jobs: analysis: permissions: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 3e0b6d6..b4c30a0 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,21 +1,27 @@ # SPDX-License-Identifier: MPL-2.0-or-later name: Secret Scanner - on: pull_request: push: branches: [main] - concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260 timeout-minutes: 10 secrets: inherit secrets: inherit + trufflehog: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: TruffleHog Secret Scan + uses: trufflesecurity/trufflehog@main + with: + extra_args: --only-verified --fail diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile index cceadf3..be63905 100644 --- a/.machine_readable/contractiles/Justfile +++ b/.machine_readable/contractiles/Justfile @@ -107,3 +107,6 @@ crg-badge: D) color="orange" ;; E) color="red" ;; F) color="critical" ;; \ *) color="lightgrey" ;; esac; \ echo "[![CRG $$grade](https://img.shields.io/badge/CRG-$$grade-$$color?style=flat-square)](https://github.com/hyperpolymath/standards/tree/main/component-readiness-grades)" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/Justfile b/Justfile index cceadf3..be63905 100644 --- a/Justfile +++ b/Justfile @@ -107,3 +107,6 @@ crg-badge: D) color="orange" ;; E) color="red" ;; F) color="critical" ;; \ *) color="lightgrey" ;; esac; \ echo "[![CRG $$grade](https://img.shields.io/badge/CRG-$$grade-$$color?style=flat-square)](https://github.com/hyperpolymath/standards/tree/main/component-readiness-grades)" + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true From f68ad78a481ba3082f8604cf74a71aaf5ed1d7a1 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 12 Jun 2026 00:26:37 +0100 Subject: [PATCH 6/8] chore: resolve structure conflicts --- .gitattributes | 2 +- .github/CODEOWNERS | 2 +- .github/copilot-instructions.md | 5 +- .github/pull_request_template.md | 5 +- .github/workflows/boj-build.yml | 3 +- .github/workflows/casket-pages.yml | 4 +- .github/workflows/codeql.yml | 8 +- .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 5 +- .github/workflows/mirror.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 3 +- .gitignore | 2 +- .machine_readable/ADJUST.contractile | 126 ++++++++++++++++++ .machine_readable/INTENT.contractile | 72 ++++++++++ .machine_readable/MUST.contractile | 91 +++++++++++++ .machine_readable/TRUST.contractile | 80 +++++++++++ .machine_readable/bot_directives/README.adoc | 2 +- .../contractiles/bust/Bustfile.a2ml | 19 +-- .machine_readable/contractiles/bust/bust.ncl | 66 +++++++++ .../contractiles/dust/Dustfile.a2ml | 10 +- .../contractiles/trust/Trustfile.a2ml | 22 +++ .well-known/ai.txt | 2 +- .well-known/humans.txt | 2 +- .well-known/security.txt | 2 +- CHANGELOG.md | 12 +- CONTRIBUTING.md | 6 +- EXPLAINME.adoc | 2 +- GOVERNANCE.adoc | 2 +- Justfile | 3 +- MAINTAINERS.adoc | 2 +- README.adoc | 6 +- ROADMAP.adoc | 3 +- SECURITY.md | 6 +- TOPOLOGY.md | 5 +- contractiles/intend/Intentfile.a2ml | 22 +++ contractiles/must/Mustfile.a2ml | 42 ++++++ contractiles/trust/Trustfile.a2ml | 25 ++++ flake.nix | 116 ++++++++++++++++ setup.sh | 2 +- tests/idris2/Main.idr | 3 +- tests/idris2/Test/Spec.idr | 2 +- tests/idris2/ValidateTest.idr | 2 +- 43 files changed, 719 insertions(+), 78 deletions(-) create mode 100644 .machine_readable/ADJUST.contractile create mode 100644 .machine_readable/INTENT.contractile create mode 100644 .machine_readable/MUST.contractile create mode 100644 .machine_readable/TRUST.contractile create mode 100644 .machine_readable/contractiles/bust/bust.ncl create mode 100644 .machine_readable/contractiles/trust/Trustfile.a2ml create mode 100644 contractiles/intend/Intentfile.a2ml create mode 100644 contractiles/must/Mustfile.a2ml create mode 100644 contractiles/trust/Trustfile.a2ml create mode 100644 flake.nix diff --git a/.gitattributes b/.gitattributes index 3ac1078..6d99ca0 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # RSR-compliant .gitattributes * text=auto eol=lf diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index c5d861c..a4324ed 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # # CODEOWNERS — julia-professional-registry diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 0a7dd56..658a678 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -1,7 +1,4 @@ - + # Copilot Instructions diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index b63e777..b3da09a 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,7 +1,4 @@ - + ## Summary diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 1ae6f46..7a830a0 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: BoJ Server Build Trigger on: @@ -10,7 +11,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Trigger BoJ Server (Casket/ssg-mcp) run: | # Send a secure trigger to boj-server to build this repository diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 331ae8e..70d5492 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages on: @@ -17,7 +18,8 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4 + - name: Setup Pages uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload artifact diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 8b77925..063e408 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Analyses the GitHub Actions workflows in this repo. This is a Julia # package registry: source content is TOML and the only executable @@ -32,13 +33,14 @@ jobs: build-mode: none steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - name: Initialize CodeQL - uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 4871c84..5e2ea70 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index d02b5d1..1238f35 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml. # See standards#191 for the reusable's purpose and design. @@ -21,7 +22,5 @@ permissions: pull-requests: write jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242 - timeout-minutes: 10 - secrets: inherit + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89 secrets: inherit diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 00cc900..f2ba3cd 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0-or-later name: Mirror to Git Forges on: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 3f44383..24db3a4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Scorecards supply-chain security on: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index b4c30a0..039d109 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0-or-later name: Secret Scanner on: @@ -18,7 +19,7 @@ jobs: trufflehog: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: fetch-depth: 0 - name: TruffleHog Secret Scan diff --git a/.gitignore b/.gitignore index 7150e06..36a0887 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # RSR-compliant .gitignore # OS & Editor diff --git a/.machine_readable/ADJUST.contractile b/.machine_readable/ADJUST.contractile new file mode 100644 index 0000000..56d3cb9 --- /dev/null +++ b/.machine_readable/ADJUST.contractile @@ -0,0 +1,126 @@ +; SPDX-License-Identifier: MPL-2.0 +; ADJUST.contractile — Accessibility invariants for HyperpolymathRegistry +; "ADJUST" = Accessibility & Digital Justice for Universal Software & Technology +; +; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST +; This file is machine-readable. LLM/SLM agents MUST NOT violate these invariants. + +; ── Definitions ────────────────────────────────────────────────── +; +; ADJUST (noun/verb) +; The accessibility contractile. Defines how software must adapt to serve +; all users regardless of ability, device, or context. Named for the verb +; "adjust" — to make suitable, to adapt, to accommodate — which is the +; core action of accessible design. +; +; Scope: +; ADJUST governs all user-facing interfaces: GUI, TUI, CLI, web, mobile, +; documentation, error messages, and installation flows. It applies to +; both human users and assistive technologies (screen readers, switch +; devices, braille displays, voice control). +; +; Relationship to other contractiles: +; - MUST: ADJUST invariants are a subset of MUST — violating ADJUST +; is a MUST violation. ADJUST exists separately because accessibility +; rules are numerous enough to warrant their own file, and because +; LLMs frequently forget accessibility unless explicitly reminded. +; - TRUST: ADJUST does not affect trust levels. All trust tiers must +; respect ADJUST invariants equally. +; - DUST: Deprecating a feature does not exempt it from ADJUST until +; it is fully removed. Deprecated UI must remain accessible. +; - INTENT: ADJUST supports the anti-purpose "this software is NOT +; only for able-bodied users with modern hardware." +; +; Standard: WCAG 2.2 Level AA (minimum) +; https://www.w3.org/WAI/WCAG22/quickref/?levels=aaa +; +; Why a separate file: +; Experience shows LLMs and developers alike treat accessibility as an +; afterthought. By placing invariants in a contractile that is loaded +; at session start, we make it structurally impossible to forget. +; +; ── End Definitions ────────────────────────────────────────────── + +(adjust-contractile + (version "1.0.0") + (full-name "Accessibility & Digital Justice for Universal Software & Technology") + (standard "WCAG-2.2-AA") + (repo "HyperpolymathRegistry") + + (invariants + ; ── Visual ── + (adjust "colour-contrast-ratio >= 4.5:1 for normal text") + (adjust "colour-contrast-ratio >= 3:1 for large text (18pt+ or 14pt+ bold)") + (adjust "no information conveyed by colour alone") + (adjust "no flashing or strobing content (3 flashes/second max)") + (adjust "text resizable to 200% without loss of content or function") + (adjust "focus indicators visible on all interactive elements") + + ; ── Keyboard ── + (adjust "all interactive elements reachable via keyboard (Tab/Shift+Tab)") + (adjust "no keyboard traps — user can always Tab away") + (adjust "skip navigation link present on pages with repeated blocks") + (adjust "logical focus order follows visual reading order") + + ; ── Screen reader ── + (adjust "all images have meaningful alt text (or alt='' if decorative)") + (adjust "all form inputs have associated labels") + (adjust "ARIA landmarks used for page regions (main, nav, banner, etc.)") + (adjust "dynamic content updates announced via aria-live regions") + (adjust "semantic HTML used (headings, lists, tables) — not div soup") + + ; ── Interactive ── + (adjust "touch targets minimum 44x44px on mobile/touch interfaces") + (adjust "error messages identify the field and describe the error") + (adjust "error messages not conveyed by colour or position alone") + (adjust "form validation provides suggestions for correction") + + ; ── Media ── + (adjust "video has captions (closed or open)") + (adjust "audio-only content has text transcript") + (adjust "no autoplay of media with sound") + + ; ── Motion ── + (adjust "animations respect prefers-reduced-motion media query") + (adjust "no content depends on motion to convey meaning") + + ; ── CLI/TUI ── + (adjust "CLI output must not rely solely on colour (use symbols: [OK] [FAIL])") + (adjust "TUI must support high-contrast mode") + (adjust "all CLI commands support --help with plain-text output") + (adjust "error messages written in plain language, not jargon or codes alone") + + ; ── Documentation ── + (adjust "docs use clear language, short sentences, logical structure") + (adjust "code examples include comments explaining non-obvious steps") + (adjust "diagrams have text descriptions or alt text") + + ; ── Internationalisation (i18n) ── + (adjust "all user-facing strings externalisable for translation") + (adjust "no hardcoded English in error messages — use message keys") + (adjust "date/time/number formats locale-aware") + (adjust "RTL (right-to-left) layout support where applicable") + (adjust "Unicode handled correctly throughout (UTF-8 everywhere)") + ) + + (related-resources + ; LOL — super-parallel corpus crawler for 1500+ languages + ; Use for linguistic data, translation coverage, and i18n validation + (lol "standards/lol — multilingual NLP corpus, see README.adoc") + (polyglot-i18n "polyglot-i18n — i18n framework and WASM translation engine") + ) + + (enforcement + (ci "accessibility linting in quality.yml workflow") + (pr-block "PR blocked if accessibility regression detected") + (tool "axe-core or pa11y for automated checks on web UI") + (tool "CLI output inspected for colour-only signalling") + (manual "manual screen reader test before major releases") + ) + + (notes + "These are MINIMUM requirements. Exceeding them (AAA) is encouraged." + "When in doubt about an accessibility decision, ask — don't guess." + "Accessibility is not optional polish — it is a structural requirement." + ) +) diff --git a/.machine_readable/INTENT.contractile b/.machine_readable/INTENT.contractile new file mode 100644 index 0000000..1a39136 --- /dev/null +++ b/.machine_readable/INTENT.contractile @@ -0,0 +1,72 @@ +; SPDX-License-Identifier: MPL-2.0 +; INTENT.contractile — Purpose and scope for HyperpolymathRegistry +; Helps LLM/SLM agents understand what this repo IS and IS NOT. +; +; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST + +; ── Definitions ────────────────────────────────────────────────── +; +; INTENT (noun) +; The purpose contractile. Defines what this repository IS, what it is +; NOT (anti-purpose), and which architectural decisions are load-bearing. +; Without INTENT, LLMs drift into scope creep, reverse key decisions, +; or add features that belong in a different repo. +; +; Scope: +; INTENT governs the conceptual boundaries of the project — its reason +; for existing, its domain, and its relationship to the ecosystem. +; It does NOT specify implementation details (that's MUST and code). +; +; Relationship to other contractiles: +; - MUST: INTENT explains WHY certain MUSTs exist. If you don't +; understand a MUST, read INTENT first. +; - TRUST: The "ask-before-touching" section in INTENT maps directly +; to TRUST.trust-deny for the most sensitive areas. +; - ADJUST: INTENT's anti-purpose should include "this software is +; NOT only for users with perfect vision/hearing/mobility." +; - DUST: When INTENT changes (repo pivots), related DUST entries +; should be created for the abandoned direction. +; +; ── End Definitions ────────────────────────────────────────────── + +(intent-contractile + (version "1.0.0") + (repo "HyperpolymathRegistry") + + ; === Purpose (what this repo IS) === + (purpose + "{{ONE_PARAGRAPH_PURPOSE}}" + ) + + ; === Anti-Purpose (what this repo is NOT — prevents scope creep) === + (anti-purpose + "{{ONE_PARAGRAPH_ANTI_PURPOSE}}" + ; Examples: + ; "This is NOT a general-purpose database — it solves one specific problem." + ; "This is NOT a framework — it is a library with a focused API." + ; "This does NOT handle authentication — that is delegated to [other repo]." + ) + + ; === Key Architectural Decisions That Must Not Be Reversed === + (architectural-invariants + ; *REMINDER: List the foundational decisions* + ; ("Idris2 for ABI definitions — dependent types prove interface correctness") + ; ("Zig for FFI — zero-cost C ABI compatibility") + ; ("Elixir for supervision — OTP fault tolerance") + ) + + ; === Sensitive Areas (if in doubt, ask) === + (ask-before-touching + ; *REMINDER: List areas where LLMs should check before modifying* + ; "src/abi/ — formal proofs, changes require re-verification" + ; "ffi/zig/ — C ABI boundary, changes affect all language bindings" + ; ".machine_readable/ — checkpoint files, format is specified" + ) + + ; === Ecosystem Position === + (ecosystem + (belongs-to "{{MONOREPO_OR_STANDALONE}}") + (depends-on ("{{DEP1}}" "{{DEP2}}")) + (depended-on-by ("{{CONSUMER1}}" "{{CONSUMER2}}")) + ) +) diff --git a/.machine_readable/MUST.contractile b/.machine_readable/MUST.contractile new file mode 100644 index 0000000..0a6ecd0 --- /dev/null +++ b/.machine_readable/MUST.contractile @@ -0,0 +1,91 @@ +; SPDX-License-Identifier: MPL-2.0 +; MUST.contractile — Baseline invariants for HyperpolymathRegistry +; These constraints MUST NOT be violated. K9 validators enforce them. +; +; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST + +; ── Definitions ────────────────────────────────────────────────── +; +; MUST (noun/verb) +; The hard-constraint contractile. Defines invariants that are structurally +; required for the repository to function correctly and safely. Violating +; a MUST is always a bug — there are no "soft" MUSTs. +; +; Scope: +; MUST governs code, configuration, CI, and structure. It does NOT govern +; style, preference, or approach — those belong in CLAUDE.md or coding +; standards. MUST is for things that break the project if violated. +; +; Relationship to other contractiles: +; - TRUST: MUST is enforced regardless of trust level. Even maximal-trust +; agents cannot violate MUST constraints. +; - ADJUST: All ADJUST invariants are implicitly MUST invariants too. +; ADJUST exists separately for visibility. +; - INTENT: MUST protects the architectural decisions described in INTENT. +; - DUST: When a feature enters DUST (deprecation), its MUST constraints +; remain active until the feature is fully removed. +; +; Enforcement: +; K9 validators in contractiles/k9/ machine-check MUST constraints. +; CI runs these on every PR. Violations block merge. +; +; ── End Definitions ────────────────────────────────────────────── + +(must-contractile + (version "1.0.0") + (repo "HyperpolymathRegistry") + + ; === Universal Invariants (apply to ALL repos) === + + (invariants + ; Paths + (must "no hardcoded absolute paths (/home/*, /mnt/*, /var/mnt/*)") + (must "all paths use env vars, XDG dirs, or relative references") + + ; Language policy + (must "no new TypeScript files") + (must "no new Python files") + (must "no new Go files") + (must "no npm/bun/yarn/pnpm dependencies — Deno only") + + ; Dangerous patterns + (must "no believe_me (Idris2)") + (must "no assert_total (Idris2)") + (must "no Admitted (Coq)") + (must "no sorry (Lean)") + (must "no unsafeCoerce (Haskell)") + (must "no Obj.magic (OCaml)") + (must "no unsafe {} blocks without safety comment (Rust)") + + ; License + (must "SPDX-License-Identifier header on every source file") + (must "no removal or modification of LICENSE file") + + ; Structure + (must ".machine_readable/ directory preserved") + (must "0-AI-MANIFEST.a2ml preserved") + (must "no SCM files in repo root — only in .machine_readable/") + + ; CI + (must "no removal of CI workflows without explicit approval") + (must "all GitHub Actions SHA-pinned") + + ; Code quality + (must "tests must not be deleted or weakened") + (must "generated code in generated/ directory only") + (must "no introduction of OWASP top 10 vulnerabilities") + + ; ABI/FFI (if applicable) + (must "no modification of ABI contracts without proof update") + (must "no removal of formal verification proofs") + ) + + ; === Project-Specific Invariants === + ; *REMINDER: Add invariants specific to this repo* + ; (must "# Add project-specific invariants here") + + (enforcement + (k9-validator "contractiles/k9/must-check.k9.ncl") + (ci "quality.yml runs must-check on every PR") + ) +) diff --git a/.machine_readable/TRUST.contractile b/.machine_readable/TRUST.contractile new file mode 100644 index 0000000..c694353 --- /dev/null +++ b/.machine_readable/TRUST.contractile @@ -0,0 +1,80 @@ +; SPDX-License-Identifier: MPL-2.0 +; TRUST.contractile — Trust boundaries for HyperpolymathRegistry +; Defines what LLM/SLM agents are trusted to do without asking. +; +; Part of the contractile family: MUST, TRUST, DUST, INTENT, ADJUST + +; ── Definitions ────────────────────────────────────────────────── +; +; TRUST (noun/verb) +; The permission contractile. Defines the boundary between what an AI +; agent may do autonomously and what requires human approval. Trust is +; graduated — not binary — with four levels from minimal to maximal. +; +; Trust levels: +; - maximal: Agent may read, build, test, lint, format, heal freely. +; Only destructive/external actions require approval. +; - standard: Agent may read and build. Test/lint need approval. +; - restricted: Agent may read only. All modifications need approval. +; - minimal: Agent may read specific files only. Everything else blocked. +; +; Scope: +; TRUST governs AI agent behaviour only. It does not affect human +; contributors — humans follow CONTRIBUTING.md and GOVERNANCE.adoc. +; +; Relationship to other contractiles: +; - MUST: Trust never overrides MUST. Even at maximal trust, MUST +; violations are blocked. +; - ADJUST: Trust does not exempt from ADJUST. All trust tiers must +; produce accessible output. +; - INTENT: TRUST.trust-deny protects the sensitive areas listed in +; INTENT.ask-before-touching. +; - DUST: Deprecated features have the same trust rules as active ones. +; +; ── End Definitions ────────────────────────────────────────────── + +(trust-contractile + (version "1.0.0") + (repo "HyperpolymathRegistry") + + (trust-level "maximal") ; maximal | standard | restricted | minimal + + ; === Maximal Trust (default) === + ; LLM may freely do these without asking: + (trust-actions + "read" ; Read any file in the repo + "build" ; Run build commands + "test" ; Run test suites + "lint" ; Run linters and formatters + "format" ; Auto-format code + "doctor" ; Run self-diagnostics + "heal" ; Attempt automatic repair + "git-status" ; Check git status + "git-diff" ; View diffs + "git-log" ; View history + ) + + ; === Denied Actions (always require human approval) === + (trust-deny + "delete-branch" ; Could lose work + "force-push" ; Overwrites history + "modify-ci-secrets" ; Security sensitive + "publish" ; External visibility + "push-to-main" ; Protected branch + "delete-files-bulk" ; More than 5 files at once + "modify-license" ; Legal implications + "modify-security-policy" ; Security implications + "remove-proofs" ; Formal verification regression + "disable-ci-checks" ; Safety regression + ) + + ; === Trust Boundary === + (trust-boundary "repo") ; LLM confined to this repo unless explicitly told otherwise + + ; === Override === + ; Repos requiring tighter trust override these settings with justification: + ; (override + ; (trust-level "restricted") + ; (reason "Contains production secrets / handles PII / etc.") + ; ) +) diff --git a/.machine_readable/bot_directives/README.adoc b/.machine_readable/bot_directives/README.adoc index a5315c7..4e989c7 100644 --- a/.machine_readable/bot_directives/README.adoc +++ b/.machine_readable/bot_directives/README.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) Jonathan D.A. Jewell +// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) = Agent Instructions :toc: preamble diff --git a/.machine_readable/contractiles/bust/Bustfile.a2ml b/.machine_readable/contractiles/bust/Bustfile.a2ml index 1103591..f55a467 100644 --- a/.machine_readable/contractiles/bust/Bustfile.a2ml +++ b/.machine_readable/contractiles/bust/Bustfile.a2ml @@ -1,20 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 -# Bustfile — failure mode contractile for julia-professional-registry -# Author: Jonathan D.A. Jewell -# -# Paired runner: bust.ncl -# Verb: bust -# Semantics: Every declared failure mode must have a working recovery path -# that has been exercised. Status moves: -# declared → drilled (probe run) → verified (recovery confirmed) -# or → failing (recovery broken) -# -# CLI: -# contractile bust check → list failure modes + recovery status -# contractile bust drill → inject failures, verify recovery paths -# -# This repository: julia-professional-registry is the canonical template for RSR compliance. -# Failure modes here relate to template distribution and substitution. +// Bustfile.a2ml — meta-repo bust contractile (breakage / rollback) +// SPDX-License-Identifier: MPL-2.0 @abstract: Bustfile for julia-professional-registry. Lists failure modes specific to the template diff --git a/.machine_readable/contractiles/bust/bust.ncl b/.machine_readable/contractiles/bust/bust.ncl new file mode 100644 index 0000000..fc8cb8c --- /dev/null +++ b/.machine_readable/contractiles/bust/bust.ncl @@ -0,0 +1,66 @@ +# SPDX-License-Identifier: MPL-2.0 +# Bust — error-handling / failure-recovery runner +# +# Pairs with: Bustfile.a2ml (same directory) +# Verb: bust +# Semantics: every declared failure mode must have a recovery path that has +# been exercised. Runner injects failures (via declared probes) +# and verifies the recovery path works. Hard gate on any +# failure-mode with missing or broken recovery. +# CLI: `contractile bust check` → list failure modes + recovery status +# `contractile bust drill` → inject declared failures, verify recovery +# +# Anything else in this directory is human-only notes/archive; machines ignore. +# +# Base: ../_base.ncl provides pedigree_schema, run_defaults, probe_schema. +# See: docs/CONTRACTILE-SPEC.adoc + +let base = import "../_base.ncl" in + +{ + pedigree = base.pedigree_schema & { + contractile_verb = "bust", + semantics = "error handling + failure recovery", + security = { + leash = 'Kennel, + trust_level = "controlled failure injection; scoped to system-under-test", + allow_network = false, + allow_filesystem_write = true, # drills may write transient state (tmp dirs, test DBs) + allow_subprocess = true, + injection_scope = "system-under-test-only", + }, + metadata = { + name = "bust-runner", + version = "1.0.0", + description = "Exercises declared failure modes and verifies recovery paths. Hard-gates on any failure mode without working recovery.", + paired_xfile = "Bustfile.a2ml", + author = "Jonathan D.A. Jewell ", + }, + }, + + schema = { + failure_modes + | Array { + id | String, + description | String, + class | [| 'network, 'disk_full, 'oom, 'timeout, 'partial_write, 'panic, 'crash, 'rollback, 'concurrency |], + # TODO: migrate to base.probe_schema (structured probe) when CLI supports it + injection_probe | String, # command that deterministically causes this failure + # TODO: migrate to base.probe_schema (structured probe) when CLI supports it + recovery_probe | String, # command that verifies recovery (exit 0 = recovered) + expected_recovery_time_seconds | Number | default = 30, + # status_core values: 'declared, 'verified, 'failing; bust adds 'drilled + status | [| 'declared, 'drilled, 'verified, 'failing |] | default = 'declared, + notes | String | optional, + }, + }, + + # Runner behaviour — inherits from base.run_defaults. + # bust adds record_recovery_times for performance tier feeding. + run = base.run_defaults & { + on_any_fail = "exit-nonzero", # missing or broken recovery blocks merge + report_format = "a2ml", + emit_summary = true, + record_recovery_times = true, # feeds the performance tier + }, +} diff --git a/.machine_readable/contractiles/dust/Dustfile.a2ml b/.machine_readable/contractiles/dust/Dustfile.a2ml index ab56520..78bc1dc 100644 --- a/.machine_readable/contractiles/dust/Dustfile.a2ml +++ b/.machine_readable/contractiles/dust/Dustfile.a2ml @@ -1,13 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 -# Dustfile — Cleanup and hygiene contract for julia-professional-registry -# Author: Jonathan D.A. Jewell -# -# Paired runner: dust.ncl -# Verb: dust -# Semantics: What should be cleaned up. Housekeeping, not blockers. -# -# This repository: julia-professional-registry is the canonical template. -# Cleanup items here ensure the template itself remains pristine. +# Dustfile — Cleanup and Hygiene Contract @abstract: Cleanup and hygiene items for julia-professional-registry. These are maintenance tasks diff --git a/.machine_readable/contractiles/trust/Trustfile.a2ml b/.machine_readable/contractiles/trust/Trustfile.a2ml new file mode 100644 index 0000000..0c95e15 --- /dev/null +++ b/.machine_readable/contractiles/trust/Trustfile.a2ml @@ -0,0 +1,22 @@ +# SPDX-License-Identifier: MPL-2.0 +# Trustfile — Integrity and Provenance Contract + +[trustfile] +version = "1.0.0" +format = "a2ml" + +[provenance] +source-control = "git" +forge = "github" +ci-verified = true +signing-policy = "commit-signing-preferred" + +[integrity] +spdx-compliant = true +license-audit = "required" +dependency-pinning = "sha-pinned" + +[verification] +reproducible-builds = "goal" +sbom-generation = "required" +attestation = "sigstore-preferred" diff --git a/.well-known/ai.txt b/.well-known/ai.txt index 6668d66..cc7cbc3 100644 --- a/.well-known/ai.txt +++ b/.well-known/ai.txt @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # ai.txt - AI interaction policy # See: https://site.spawning.ai/spawning-ai-txt diff --git a/.well-known/humans.txt b/.well-known/humans.txt index a558f15..5423d9e 100644 --- a/.well-known/humans.txt +++ b/.well-known/humans.txt @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # humanstxt.org /* TEAM */ diff --git a/.well-known/security.txt b/.well-known/security.txt index b581cae..7987773 100644 --- a/.well-known/security.txt +++ b/.well-known/security.txt @@ -1,4 +1,4 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # RFC 9116 - security.txt # https://securitytxt.org/ diff --git a/CHANGELOG.md b/CHANGELOG.md index c346f5d..a32c9de 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog @@ -19,15 +19,17 @@ this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Added -- `CHANGELOG.md`, `ROADMAP.adoc`, `MAINTAINERS.adoc`, `GOVERNANCE.adoc` — bring repo to estate documentation convention. -- `.github/ISSUE_TEMPLATE/{bug_report,feature_request,custom}.md`, `.github/pull_request_template.md`, `.github/CODEOWNERS`, `.github/FUNDING.yml`, `.github/copilot-instructions.md` — estate-standard contributor onboarding fleet. +- Registry: `EchoTypes v0.1.0` (PR #16) and `v0.2.0` (PR #20); `KRLAdapter v0.1.0` (PR #16); `ViperPkg v0.1.0` (PR #18) — total 37 registered packages. +- `CHANGELOG.md`, `ROADMAP.adoc`, `MAINTAINERS.adoc`, `GOVERNANCE.adoc` — bring repo to estate documentation convention (PR #19). +- `.github/ISSUE_TEMPLATE/{bug_report,feature_request,package_registration}.md`, `.github/pull_request_template.md`, `.github/CODEOWNERS`, `.github/FUNDING.yml`, `.github/copilot-instructions.md` — estate-standard contributor onboarding fleet (PR #19). - `.github/workflows/{scorecard,mirror,secret-scanner,codeql}.yml` — wire the four missing standards reusables (PR #17). -- Wiki: structured pages mirroring repo documentation (Home, Registry-Usage, Packages, Architecture, Testing, Governance, Roadmap). +- Wiki: 9 structured pages mirroring repo documentation (Home, Registry-Usage, Packages, Registering-a-Package, Architecture, Testing, Governance, Roadmap, Security) + `_Sidebar` (PR #19). ### Changed - `.github/workflows/governance.yml` — SHA-pin the standards governance reusable (was floating `@main`) (PR #17). -- Consolidate `CONTRIBUTING.md` and `CONTRIBUTING.adoc` into a single canonical Markdown file. +- `.github/workflows/scorecard.yml` — job-level `security-events: write` + `id-token: write` permissions to match the reusable's canonical caller block; fixes `startup_failure` regression introduced in PR #17 (PR #19). +- Consolidate `CONTRIBUTING.md` and `CONTRIBUTING.adoc` into a single canonical Markdown file (PR #19). ### Removed diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index b7253c7..03bf633 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,7 +1,5 @@ - + + # Contributing Thank you for your interest in contributing! We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`. diff --git a/EXPLAINME.adoc b/EXPLAINME.adoc index 61a0b87..cd8942d 100644 --- a/EXPLAINME.adoc +++ b/EXPLAINME.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) Jonathan D.A. Jewell +// Copyright (c) 2026 Jonathan D.A. Jewell = HyperpolymathRegistry — Show Me The Receipts :toc: :toclevels: 3 diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc index 14b8358..2b173cc 100644 --- a/GOVERNANCE.adoc +++ b/GOVERNANCE.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) Jonathan D.A. Jewell +// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) = Project Governance :toc: :toc-placement!: diff --git a/Justfile b/Justfile index be63905..f3d5afd 100644 --- a/Justfile +++ b/Justfile @@ -1,4 +1,5 @@ -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # Justfile — UX recipes import? "contractile.just" diff --git a/MAINTAINERS.adoc b/MAINTAINERS.adoc index d296424..e6f5447 100644 --- a/MAINTAINERS.adoc +++ b/MAINTAINERS.adoc @@ -1,5 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) Jonathan D.A. Jewell +// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) = Maintainers :toc: preamble diff --git a/README.adoc b/README.adoc index a5e917f..77c9f76 100644 --- a/README.adoc +++ b/README.adoc @@ -1,5 +1,4 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell = julia-professional-registry @@ -7,7 +6,7 @@ Jonathan D.A. Jewell :toc: image:https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=opensourcesecurity[OpenSSF Best Practices,link="https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/julia-professional-registry"] -image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[License: MPL-2.0,link="https://opensource.org/licenses/MPL-2.0"] +image:https://img.shields.io/badge/License-MPL--2.0-blue.svg[License: MPL-2.0,link="https://www.mozilla.org/en-US/MPL/2.0/"] image:https://api.thegreenwebfoundation.org/greencheckimage/github.com[Green Web,link="https://www.thegreenwebfoundation.org/green-web-check/?url=github.com"] == Overview @@ -47,6 +46,7 @@ pkg> add SMTLib | Cladistics | 0.1.0 | Phylogenetic cladistic analysis | Cliodynamics | 0.1.0 | Mathematical modelling of historical dynamics | Cliometrics | 0.1.0 | Quantitative historical economics +| EchoTypes | 0.2.0 | Echo-types runtime — companion to the nextgen-languages Echo type system | Exnovation | 0.1.0 | Technology phase-out analysis | FirmwareAudit | 0.1.0 | Firmware integrity auditing | HackenbushGames | 0.1.0 | Combinatorial game theory (Hackenbush) @@ -56,6 +56,7 @@ pkg> add SMTLib | JuliaForChildren | 0.1.0 | Educational Julia for young learners | JuliaPackageSpitter | 0.1.0 | Julia package quality auditing | KnotTheory | 0.1.0 | Knot theory and invariants +| KRLAdapter | 0.1.0 | Knowledge Representation Layer adapter | Lithoglyph | 0.1.0 | Lithographic data processing | LowLevel | 0.1.0 | Low-level systems programming utilities | MacroPower | 0.1.0 | Advanced Julia metaprogramming @@ -72,6 +73,7 @@ pkg> add SMTLib | SoftwareSovereign | 0.1.0 | Software sovereignty analysis | TradeUnionist | 0.1.0 | Labour rights data analysis | ViableSystems | 0.1.0 | Viable Systems Model (VSM) implementation +| ViperPkg | 0.1.0 | Julia bindings for the `julia-the-viper` Viper language | ZeroProb | 0.1.0 | Zero-probability event analysis |=== diff --git a/ROADMAP.adoc b/ROADMAP.adoc index 30a4c53..9a597ed 100644 --- a/ROADMAP.adoc +++ b/ROADMAP.adoc @@ -1,5 +1,6 @@ // SPDX-License-Identifier: MPL-2.0 -// Copyright (c) Jonathan D.A. Jewell +// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) + = julia-professional-registry: Roadmap Jonathan D.A. Jewell :toc: left diff --git a/SECURITY.md b/SECURITY.md index 88df5ba..685e4f9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,7 +1,5 @@ - + + # Security Policy ## Reporting a Vulnerability diff --git a/TOPOLOGY.md b/TOPOLOGY.md index 9f0f32e..7ef534b 100644 --- a/TOPOLOGY.md +++ b/TOPOLOGY.md @@ -1,7 +1,4 @@ - + # TOPOLOGY.md — HyperpolymathRegistry diff --git a/contractiles/intend/Intentfile.a2ml b/contractiles/intend/Intentfile.a2ml new file mode 100644 index 0000000..662866a --- /dev/null +++ b/contractiles/intend/Intentfile.a2ml @@ -0,0 +1,22 @@ +# SPDX-License-Identifier: MPL-2.0 +# Intentfile (A2ML Canonical) +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) + +@abstract: +Declared intent and purpose for Hyperpolymathregistry. +@end + +## Purpose + +Hyperpolymathregistry — // SPDX-License-Identifier: MPL-2.0 + +## Anti-Purpose + +This project is NOT: +- A fork or wrapper around another tool +- A monorepo (unless explicitly structured as one) + +## If In Doubt + +If you are unsure whether a change is in scope, ask. +Sensitive areas: ABI definitions, license headers, CI workflows. diff --git a/contractiles/must/Mustfile.a2ml b/contractiles/must/Mustfile.a2ml new file mode 100644 index 0000000..c28d104 --- /dev/null +++ b/contractiles/must/Mustfile.a2ml @@ -0,0 +1,42 @@ +# SPDX-License-Identifier: MPL-2.0 +# Mustfile (A2ML Canonical) +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) + +@abstract: +Physical State contract for Hyperpolymathregistry. Baseline UX Manifesto invariants +that MUST hold at all times. +@end + +@requires: +- section: Core-Files +- section: Banned +@end + +## Core-Files + +### license-present +- description: LICENSE file must exist +- run: test -f LICENSE +- severity: critical + +### readme-present +- description: README must exist +- run: test -f README.adoc || test -f README.md +- severity: critical + +## Banned + +### no-hardcoded-paths +- description: No hardcoded developer paths +- run: "! grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.res' --include='*.ex' --include='*.gleam' --include='*.zig' --include='*.sh' . 2>/dev/null | grep -v '.git/' | grep -v 'ux-rollout.jl' | head -1" +- severity: critical + +### no-dockerfiles +- description: No Dockerfiles (use Containerfile) +- run: test ! -f Dockerfile +- severity: warning + +### no-makefiles +- description: No Makefiles (use Justfile) +- run: test ! -f Makefile +- severity: warning diff --git a/contractiles/trust/Trustfile.a2ml b/contractiles/trust/Trustfile.a2ml new file mode 100644 index 0000000..21e9f65 --- /dev/null +++ b/contractiles/trust/Trustfile.a2ml @@ -0,0 +1,25 @@ +# SPDX-License-Identifier: MPL-2.0 +# Trustfile (A2ML Canonical) +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) + +@abstract: +Trust and provenance verification for Hyperpolymathregistry. +Maximal trust by default — LLM may read, build, test, lint, format. +@end + +@trust-level: maximal +@trust-boundary: repo +@trust-actions: [read, build, test, lint, format] +@trust-deny: [delete-branch, force-push, modify-ci-secrets, publish] + +## Integrity + +### license-content +- description: LICENSE contains expected SPDX identifier +- run: grep -q 'SPDX\|License\|MIT\|Apache\|MPL' LICENSE +- severity: critical + +### no-secrets-committed +- description: No .env or credential files in repo +- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local +- severity: critical diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..dfdd12f --- /dev/null +++ b/flake.nix @@ -0,0 +1,116 @@ +{ + description = "HyperpolymathRegistry - {project-description}"; + + # *REMINDER: Update inputs with actual dependencies* + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + flake-utils.url = "github:numtide/flake-utils"; + # Add language-specific inputs: + # rust-overlay.url = "github:oxalica/rust-overlay"; # For Rust + # fenix.url = "github:nix-community/fenix"; # Alternative Rust + }; + + outputs = { self, nixpkgs, flake-utils, ... }@inputs: + flake-utils.lib.eachDefaultSystem (system: + let + pkgs = import nixpkgs { + inherit system; + # overlays = [ (import inputs.rust-overlay) ]; # For Rust + }; + + # *REMINDER: Define build dependencies* + buildInputs = with pkgs; [ + # Language-specific dependencies: + # gnat13 # Ada + # cargo rustc # Rust + # elixir # Elixir + # For build tools: + just + podman + git + ]; + + # *REMINDER: Define development dependencies* + nativeBuildInputs = with pkgs; [ + # Development tools: + ripgrep # Code search + lychee # Link validation + # Language-specific: + # rustfmt clippy # Rust + # mix # Elixir + ]; + + in + { + # Development shell + devShells.default = pkgs.mkShell { + inherit buildInputs nativeBuildInputs; + + shellHook = '' + echo "🚀 HyperpolymathRegistry development environment" + echo "Language: mixed" + echo "" + echo "Available commands:" + echo " just --list # Show all tasks" + echo " just setup # Set up environment" + echo " just build # Build project" + echo " just test # Run tests" + echo " just validate # RSR compliance" + echo "" + # *REMINDER: Add language-specific environment setup* + # export CARGO_HOME=$PWD/.cargo # Rust + # export MIX_HOME=$PWD/.mix # Elixir + ''; + }; + + # Packages + packages.default = pkgs.stdenv.mkDerivation { + pname = "HyperpolymathRegistry"; + version = "0.1.0"; + src = ./.; + + inherit buildInputs nativeBuildInputs; + + buildPhase = '' + # *REMINDER: Add build commands* + # For Rust: cargo build --release + # For Elixir: mix compile + # For Ada: gprbuild -P HyperpolymathRegistry.gpr -XMODE=release + ''; + + installPhase = '' + mkdir -p $out/bin + # *REMINDER: Add install commands* + # cp target/release/HyperpolymathRegistry $out/bin/ # Rust + # cp bin/HyperpolymathRegistry $out/bin/ # Ada + ''; + + meta = with pkgs.lib; { + description = "{project-description}"; + homepage = "{repo-url}"; + license = with licenses; [ mpl20 ]; # MPL-2.0 + maintainers = [ "{maintainer-name}" ]; + platforms = platforms.unix; + }; + }; + + # Apps + apps.default = { + type = "app"; + program = "${self.packages.${system}.default}/bin/HyperpolymathRegistry"; + }; + + # Checks (CI/CD integration) + checks = { + build = self.packages.${system}.default; + # *REMINDER: Add test checks* + test = pkgs.runCommand "test-HyperpolymathRegistry" { + buildInputs = [ self.packages.${system}.default ]; + } '' + # Run tests here + touch $out + ''; + }; + } + ); +} diff --git a/setup.sh b/setup.sh index 0c2cf3f..fa3ac32 100755 --- a/setup.sh +++ b/setup.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# SPDX-License-Identifier: PMPL-1.0-or-later +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Hyperpolymathregistry — Universal Setup Script diff --git a/tests/idris2/Main.idr b/tests/idris2/Main.idr index 51fa94a..5842804 100644 --- a/tests/idris2/Main.idr +++ b/tests/idris2/Main.idr @@ -1,5 +1,6 @@ -- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) Jonathan D.A. Jewell +-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) + module Main import Test.Spec diff --git a/tests/idris2/Test/Spec.idr b/tests/idris2/Test/Spec.idr index 0350df8..c7fe418 100644 --- a/tests/idris2/Test/Spec.idr +++ b/tests/idris2/Test/Spec.idr @@ -1,5 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) Jonathan D.A. Jewell +-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -- ||| Minimal Idris2 test harness for the Gossamer ABI test suite. ||| diff --git a/tests/idris2/ValidateTest.idr b/tests/idris2/ValidateTest.idr index 3a634f8..3899597 100644 --- a/tests/idris2/ValidateTest.idr +++ b/tests/idris2/ValidateTest.idr @@ -1,5 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) Jonathan D.A. Jewell +-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -- -- Port of tests/validate.test.ts to Idris2, estate-rollout port 4/11. -- Validates a Julia Pkg registry: Registry.toml + package directories From 3ae57e74c3f7886d2f9a98e78598004bd2b9a2bd Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 12 Jun 2026 00:26:37 +0100 Subject: [PATCH 7/8] fix(security/compliance): standardized TruffleHog and RSR metadata --- CHANGELOG.md | 1 + GOVERNANCE.adoc | 1 + MAINTAINERS.adoc | 1 + TOPOLOGY.md | 1 + tests/idris2/Main.idr | 1 + tests/idris2/Test/Spec.idr | 1 + tests/idris2/ValidateTest.idr | 1 + 7 files changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a32c9de..e7321a2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,5 @@ SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) --> diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc index 2b173cc..76de7ad 100644 --- a/GOVERNANCE.adoc +++ b/GOVERNANCE.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) = Project Governance :toc: diff --git a/MAINTAINERS.adoc b/MAINTAINERS.adoc index e6f5447..354b47d 100644 --- a/MAINTAINERS.adoc +++ b/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) = Maintainers :toc: preamble diff --git a/TOPOLOGY.md b/TOPOLOGY.md index 7ef534b..a053504 100644 --- a/TOPOLOGY.md +++ b/TOPOLOGY.md @@ -1,4 +1,5 @@ + # TOPOLOGY.md — HyperpolymathRegistry diff --git a/tests/idris2/Main.idr b/tests/idris2/Main.idr index 5842804..b851b8a 100644 --- a/tests/idris2/Main.idr +++ b/tests/idris2/Main.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell -- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) module Main diff --git a/tests/idris2/Test/Spec.idr b/tests/idris2/Test/Spec.idr index c7fe418..8c48bdf 100644 --- a/tests/idris2/Test/Spec.idr +++ b/tests/idris2/Test/Spec.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell -- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -- ||| Minimal Idris2 test harness for the Gossamer ABI test suite. diff --git a/tests/idris2/ValidateTest.idr b/tests/idris2/ValidateTest.idr index 3899597..87c16c3 100644 --- a/tests/idris2/ValidateTest.idr +++ b/tests/idris2/ValidateTest.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell -- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -- -- Port of tests/validate.test.ts to Idris2, estate-rollout port 4/11. From 5b8b109b9f9c642f16d9b1e59875ca13e24a39c6 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 12 Jun 2026 00:27:54 +0100 Subject: [PATCH 8/8] fix(security/compliance): standardized TruffleHog and RSR metadata --- CHANGELOG.md | 1 + CONTRIBUTING.md | 1 + GOVERNANCE.adoc | 1 + Justfile | 1 + MAINTAINERS.adoc | 1 + SECURITY.md | 1 + TOPOLOGY.md | 1 + tests/idris2/Main.idr | 1 + tests/idris2/Test/Spec.idr | 1 + tests/idris2/ValidateTest.idr | 1 + 10 files changed, 10 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a32c9de..e7321a2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,5 @@ SPDX-License-Identifier: MPL-2.0 SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) --> diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 86b9c51..d7d8f51 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,4 +1,5 @@ + # Contributing Thank you for your interest in contributing! We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`. diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc index 2b173cc..76de7ad 100644 --- a/GOVERNANCE.adoc +++ b/GOVERNANCE.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) = Project Governance :toc: diff --git a/Justfile b/Justfile index ee9b61d..ba1f134 100644 --- a/Justfile +++ b/Justfile @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell # Justfile — UX recipes import? "contractile.just" diff --git a/MAINTAINERS.adoc b/MAINTAINERS.adoc index e6f5447..354b47d 100644 --- a/MAINTAINERS.adoc +++ b/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) = Maintainers :toc: preamble diff --git a/SECURITY.md b/SECURITY.md index 1a29117..10d7f51 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,4 +1,5 @@ + # Security Policy ## Reporting a Vulnerability diff --git a/TOPOLOGY.md b/TOPOLOGY.md index 7ef534b..a053504 100644 --- a/TOPOLOGY.md +++ b/TOPOLOGY.md @@ -1,4 +1,5 @@ + # TOPOLOGY.md — HyperpolymathRegistry diff --git a/tests/idris2/Main.idr b/tests/idris2/Main.idr index 5842804..b851b8a 100644 --- a/tests/idris2/Main.idr +++ b/tests/idris2/Main.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell -- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) module Main diff --git a/tests/idris2/Test/Spec.idr b/tests/idris2/Test/Spec.idr index c7fe418..8c48bdf 100644 --- a/tests/idris2/Test/Spec.idr +++ b/tests/idris2/Test/Spec.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell -- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -- ||| Minimal Idris2 test harness for the Gossamer ABI test suite. diff --git a/tests/idris2/ValidateTest.idr b/tests/idris2/ValidateTest.idr index 3899597..87c16c3 100644 --- a/tests/idris2/ValidateTest.idr +++ b/tests/idris2/ValidateTest.idr @@ -1,4 +1,5 @@ -- SPDX-License-Identifier: MPL-2.0 +// Owner: Jonathan D.A. Jewell -- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -- -- Port of tests/validate.test.ts to Idris2, estate-rollout port 4/11.