Skip to content

Commit 85e3c43

Browse files
hyperpolymathhyperpolymath
committed
Merge main into live-files CI audit PR
2 parents 2368d8a + 02fc41a commit 85e3c43

24 files changed

Lines changed: 677 additions & 340 deletions

‎.ai-instructions.md‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,4 @@
1-
<!--
2-
SPDX-License-Identifier: MPL-2.0
3-
Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
4-
-->
1+
<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
52
# Live-Files: RSR 2026 Control Plane
63

74
You are an agent operating on the Hyperpolymath Epistemic Fleet.

‎.github/workflows/mirror.yml‎

Lines changed: 3 additions & 140 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
# SPDX-License-Identifier: MPL-2.0
2-
# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
32
name: Mirror to Git Forges
43

54
on:
@@ -11,142 +10,6 @@ permissions:
1110
contents: read
1211

1312
jobs:
14-
mirror-gitlab:
15-
runs-on: ubuntu-latest
16-
timeout-minutes: 15
17-
if: vars.GITLAB_MIRROR_ENABLED == 'true'
18-
steps:
19-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
20-
with:
21-
fetch-depth: 0
22-
23-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
24-
with:
25-
ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
26-
27-
- name: Mirror to GitLab
28-
run: |
29-
ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts
30-
git remote add gitlab git@gitlab.com:${{ vars.GITLAB_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
31-
git push --force gitlab main
32-
33-
mirror-bitbucket:
34-
runs-on: ubuntu-latest
35-
timeout-minutes: 15
36-
if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
37-
steps:
38-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
39-
with:
40-
fetch-depth: 0
41-
42-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
43-
with:
44-
ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
45-
46-
- name: Mirror to Bitbucket
47-
run: |
48-
ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts
49-
git remote add bitbucket git@bitbucket.org:${{ vars.BITBUCKET_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
50-
git push --force bitbucket main
51-
52-
mirror-codeberg:
53-
runs-on: ubuntu-latest
54-
timeout-minutes: 15
55-
if: vars.CODEBERG_MIRROR_ENABLED == 'true'
56-
steps:
57-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
58-
with:
59-
fetch-depth: 0
60-
61-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
62-
with:
63-
ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
64-
65-
- name: Mirror to Codeberg
66-
run: |
67-
ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts
68-
git remote add codeberg git@codeberg.org:${{ vars.CODEBERG_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
69-
git push --force codeberg main
70-
71-
mirror-sourcehut:
72-
runs-on: ubuntu-latest
73-
timeout-minutes: 15
74-
if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
75-
steps:
76-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
77-
with:
78-
fetch-depth: 0
79-
80-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
81-
with:
82-
ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}
83-
84-
- name: Mirror to SourceHut
85-
run: |
86-
ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts
87-
git remote add sourcehut git@git.sr.ht:~${{ vars.SOURCEHUT_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }} || true
88-
git push --force sourcehut main
89-
90-
mirror-disroot:
91-
runs-on: ubuntu-latest
92-
timeout-minutes: 15
93-
if: vars.DISROOT_MIRROR_ENABLED == 'true'
94-
steps:
95-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
96-
with:
97-
fetch-depth: 0
98-
99-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
100-
with:
101-
ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}
102-
103-
- name: Mirror to Disroot
104-
run: |
105-
ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts
106-
git remote add disroot git@git.disroot.org:${{ vars.DISROOT_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
107-
git push --force disroot main
108-
109-
mirror-gitea:
110-
runs-on: ubuntu-latest
111-
timeout-minutes: 15
112-
if: vars.GITEA_MIRROR_ENABLED == 'true'
113-
steps:
114-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
115-
with:
116-
fetch-depth: 0
117-
118-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
119-
with:
120-
ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}
121-
122-
- name: Mirror to Gitea
123-
run: |
124-
ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts
125-
git remote add gitea git@${{ vars.GITEA_HOST }}:${{ vars.GITEA_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
126-
git push --force gitea main
127-
128-
mirror-radicle:
129-
runs-on: ubuntu-latest
130-
timeout-minutes: 15
131-
if: vars.RADICLE_MIRROR_ENABLED == 'true'
132-
steps:
133-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
134-
with:
135-
fetch-depth: 0
136-
137-
- name: Setup Rust
138-
uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
139-
with:
140-
toolchain: stable
141-
142-
- name: Install Radicle
143-
run: |
144-
# Install via cargo (safer than curl|sh)
145-
cargo install radicle-cli --locked
146-
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
147-
148-
- name: Mirror to Radicle
149-
run: |
150-
echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle
151-
chmod 600 ~/.radicle/keys/radicle
152-
rad sync --announce || echo "Radicle sync attempted"
13+
mirror:
14+
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f
15+
secrets: inherit

‎.github/workflows/scorecard.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
# SPDX-License-Identifier: PMPL-1.0
1+
# SPDX-License-Identifier: MPL-2.0
22
name: OSSF Scorecard
33
on:
44
push:
55
branches: [main, master]
66
schedule:
7-
- cron: '0 4 * * *'
7+
- cron: '23 4 * * 1'
88
workflow_dispatch:
99

1010
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR

‎.github/workflows/secret-scanner.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: PMPL-1.0
1+
# SPDX-License-Identifier: MPL-2.0
22
# Prevention workflow - scans for hardcoded secrets before they reach main
33
name: Secret Scanner
44

‎.machine_readable/bot_directives/README.adoc‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
// SPDX-License-Identifier: MPL-2.0
2-
// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
1+
// SPDX-License-Identifier: CC-BY-SA-4.0
2+
// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
33
= Agent Instructions
44
:toc: preamble
55

@@ -32,7 +32,7 @@ Methodology-aware configuration for AI agents. Read by any AI agent
3232
== Relationship to Other Files
3333

3434
* `AGENTIC.a2ml` says WHAT agents can do (permissions, gating)
35-
* `bot_directives/` says HOW agents should work (methodology)
35+
* `agent_instructions/` says HOW agents should work (methodology)
3636
* `bot_directives/` says what the gitbot-fleet does (fleet-specific)
3737
* `CLAUDE.md` says how Claude specifically should work (Claude-specific)
3838

‎CHANGELOG.md‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<!--
2+
SPDX-License-Identifier: CC-BY-SA-4.0
3+
SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
4+
-->
5+
6+
# Changelog
7+
8+
All notable changes to `live-files` will be documented in this file.
9+
10+
This file is generated from conventional commits by the
11+
[`changelog-reusable.yml`](https://github.com/hyperpolymath/standards/blob/main/.github/workflows/changelog-reusable.yml)
12+
workflow (`hyperpolymath/standards#206`). Adopt the workflow in this repo's CI to keep this file in sync automatically — see
13+
[`templates/cliff.toml`](https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml)
14+
for the canonical config.
15+
16+
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
17+
this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
18+
19+
## [Unreleased]
20+
21+
### Added
22+
23+
- feat(crg): add crg-grade and crg-badge justfile recipes
24+
- feat: add stapeln.toml container definition
25+
- feat: deploy UX Manifesto infrastructure
26+
- feat: add CLADE.a2ml — clade taxonomy declaration
27+
- feat: add mirror.yml workflow for GitLab/Bitbucket mirroring
28+
- feat: add AI Gatekeeper Protocol manifest
29+
- feat: add critical security workflows
30+
- feat(ci): enable Hypatia scanning
31+
32+
### Fixed
33+
34+
- fix(ci): bump a2ml/k9-validate-action pins to canonical (standards#85) (#10)
35+
- fix(ci): sync hypatia-scan.yml to canonical (kill cd-scanner build drift) (#9)
36+
- fix(ci): adopt canonical hypatia-scan.yml (env.HOME/scanner-layout + Comment-step gate) (#8)
37+
- fix: RSR compliance — fix SPDX headers, resolve template placeholders, add .well-known
38+
- fix: remove duplicate SCM files from root
39+
40+
### Changed
41+
42+
- refactor: migrate 6SCM → 6A2 (.scm → .a2ml format)
43+
44+
### Documentation
45+
46+
- docs: add TEST-NEEDS.md (CRG C)
47+
- docs: update SCM files with project information
48+
- docs: add CODE_OF_CONDUCT.md
49+
- docs: add CONTRIBUTING.md
50+
- docs: add SECURITY.md for vulnerability reporting
51+
- docs: add checkpoint files for state tracking
52+
53+
### CI
54+
55+
- ci: redistribute concurrency-cancel guard to read-only check workflows (#12)
56+
- ci: bump actions/upload-artifact SHA to current v4 (#6)
57+
- ci: SHA-pin hyperpolymath validate-actions in dogfood-gate
58+
- ci: wire hypatia-scan.yml to query own Dependabot alerts
59+
- ci: deploy dogfood-gate, fix hypatia-scan, add pre-commit hooks
60+
61+
## Pre-history
62+
63+
Prior commits to this file's introduction are recorded in git history but not formally classified into Keep-a-Changelog sections. To backfill, run `git cliff -o CHANGELOG.md` locally using the canonical [`cliff.toml`](https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml) — this is one-shot mechanical work.
64+
65+
---
66+
67+
<!-- This file was seeded by the 2026-05-26 estate tech-debt audit follow-up (Row-2 Phase 3); see [`hyperpolymath/standards/docs/audits/2026-05-26-estate-documentation-debt.md`](https://github.com/hyperpolymath/standards/blob/main/docs/audits/2026-05-26-estate-documentation-debt.md). -->

‎CODE_OF_CONDUCT.md‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,4 @@
1-
<!--
2-
SPDX-License-Identifier: MPL-2.0
3-
Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
4-
-->
1+
<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
52
# Code of Conduct
63

74
## Our Pledge

‎CONTRIBUTING.md‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,4 @@
1-
<!--
2-
SPDX-License-Identifier: MPL-2.0
3-
Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
4-
-->
1+
<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
52
# Clone the repository
63
git clone https://github.com/hyperpolymath/live-files.git
74
cd live-files

‎EXPLAINME.adoc‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
// SPDX-License-Identifier: MPL-2.0
2-
// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
1+
// SPDX-License-Identifier: CC-BY-SA-4.0
32
= live-files — Show Me The Receipts
43
:toc:
54
:icons: font

‎LICENSE‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
SPDX-License-Identifier: MPL-2.0
2+
SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath)
3+
14
Mozilla Public License Version 2.0
25
==================================
36

@@ -35,7 +38,7 @@ Mozilla Public License Version 2.0
3538
means any form of the work other than Source Code Form.
3639

3740
1.7. "Larger Work"
38-
means a work that combines Covered Software with other material, in
41+
means a work that combines Covered Software with other material, in
3942
a separate file or files, that is not Covered Software.
4043

4144
1.8. "License"
@@ -357,7 +360,7 @@ Exhibit A - Source Code Form License Notice
357360

358361
This Source Code Form is subject to the terms of the Mozilla Public
359362
License, v. 2.0. If a copy of the MPL was not distributed with this
360-
file, You can obtain one at https://mozilla.org/MPL/2.0/.
363+
file, You can obtain one at http://mozilla.org/MPL/2.0/.
361364

362365
If it is not possible or desirable to put the notice in a particular
363366
file, then You may include the notice in a location (such as a LICENSE

0 commit comments

Comments
 (0)