diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d7c3b4d..8400391 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,10 +15,10 @@ jobs: node-version: [16.x, 18.x, 20.x] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@v4 with: node-version: ${{ matrix.node-version }} cache: 'npm' @@ -42,10 +42,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Use Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@v4 with: node-version: '20.x' cache: 'npm' @@ -57,7 +57,7 @@ jobs: run: npm run test:coverage - name: Upload coverage to Codecov - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@v4 with: files: ./coverage/lcov.info flags: unittests diff --git a/.well-known/security.txt b/.well-known/security.txt index dfa0c1e..0f4c751 100644 --- a/.well-known/security.txt +++ b/.well-known/security.txt @@ -3,7 +3,7 @@ Contact: mailto:security@example.com Contact: https://github.com/Hyperpolymath/preference-injector/security/advisories/new -Expires: 2025-01-15T00:00:00.000Z +Expires: 2026-12-31T23:59:59.000Z Encryption: https://example.com/.well-known/pgp-key.txt Preferred-Languages: en Canonical: https://example.com/.well-known/security.txt diff --git a/SECURITY.md b/SECURITY.md index ebd7f66..e01d7b6 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -103,14 +103,14 @@ const injector = new PreferenceInjector({ ## Known Security Limitations -### Current Limitations (v2.0) +### Current Limitations (v1.0) 1. **Cryptography Status**: Post-quantum primitives designed but not fully implemented 2. **Offline Mode**: Local-first architecture planned but not complete 3. **WASM Sandbox**: Untrusted code execution not yet sandboxed 4. **Formal Verification**: SPARK Ada proofs not implemented -### Planned Enhancements (v2.1+) +### Planned Enhancements (v1.1+) - Full post-quantum cryptography implementation - WASM sandboxing for user-provided preference scripts @@ -177,8 +177,8 @@ Permissions-Policy: geolocation=(), microphone=(), camera=() - ✅ **GDPR**: Data protection and privacy (EU) - ✅ **CCPA**: California Consumer Privacy Act (US) -- ⚠️ **SOC 2**: In progress (expected Q2 2024) -- ⚠️ **ISO 27001**: Planned for 2024 +- ⚠️ **SOC 2**: In progress (expected Q2 2026) +- ⚠️ **ISO 27001**: Planned for 2026 ### Certifications @@ -190,14 +190,14 @@ Permissions-Policy: geolocation=(), microphone=(), camera=() ### Last Audit -- **Date**: 2024-01-15 -- **Auditor**: Internal review -- **Findings**: 0 critical, 2 high, 5 medium, 12 low -- **Status**: High and medium findings remediated +- **Date**: 2025-12-17 +- **Auditor**: Internal review (Claude Code assisted) +- **Findings**: 0 critical, 0 high, 4 medium (fixed), 2 low +- **Status**: All medium findings remediated ### Next Audit -- **Scheduled**: 2024-Q2 +- **Scheduled**: 2026-Q1 - **Type**: Third-party penetration testing - **Scope**: Full application security assessment @@ -229,6 +229,6 @@ We thank the following security researchers for responsible disclosure: --- -**Last Updated**: 2024-01-15 -**Policy Version**: 2.0 -**Next Review**: 2024-07-15 +**Last Updated**: 2025-12-17 +**Policy Version**: 2.1 +**Next Review**: 2026-06-17 diff --git a/STATE.scm b/STATE.scm index 5086852..ee5b458 100644 --- a/STATE.scm +++ b/STATE.scm @@ -3,20 +3,92 @@ ;; SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell (define metadata - '((version . "0.1.0") (updated . "2025-12-15") (project . "preference-injector"))) + '((version . "1.0.0") (updated . "2025-12-17") (project . "preference-injector"))) (define current-position - '((phase . "v0.1 - Initial Setup") - (overall-completion . 25) - (components ((rsr-compliance ((status . "complete") (completion . 100))))))) + '((phase . "v1.0 - Security Hardening Complete") + (overall-completion . 35) + (components + ((rsr-compliance ((status . "complete") (completion . 100))) + (scm-metadata ((status . "complete") (completion . 100))) + (ci-security ((status . "complete") (completion . 100))) + (security-policy ((status . "complete") (completion . 100))) + (rescript-conversion ((status . "pending") (completion . 0))) + (post-quantum-crypto ((status . "planned") (completion . 5))) + (core-injector ((status . "in-progress") (completion . 60))) + (providers ((status . "in-progress") (completion . 50))) + (tests ((status . "pending") (completion . 20))))))) -(define blockers-and-issues '((critical ()) (high-priority ()))) +(define blockers-and-issues + '((critical ()) + (high-priority + (("TypeScript to ReScript conversion required" . "policy"))))) + +(define roadmap + '((v1.0-current + ((name . "Foundation & Security") + (status . "complete") + (items + (("RSR compliance" . "complete") + ("SCM metadata files" . "complete") + ("CI/CD security hardening" . "complete") + ("GitHub Actions updated to v4" . "complete") + ("security.txt expiry fixed" . "complete") + ("License consistency across SCM files" . "complete") + ("Version consistency across files" . "complete"))))) + + (v1.1-next + ((name . "ReScript Migration & Testing") + (status . "planned") + (items + (("Convert src/core to ReScript" . "pending") + ("Convert src/providers to ReScript" . "pending") + ("Convert src/utils to ReScript" . "pending") + ("Add ReScript-based test suite" . "pending") + ("Achieve 80% test coverage" . "pending") + ("Remove TypeScript dependencies" . "pending"))))) + + (v1.2-future + ((name . "Post-Quantum Cryptography") + (status . "planned") + (items + (("Implement Ed448 signatures" . "pending") + ("Implement Kyber1024 key exchange" . "pending") + ("Implement BLAKE3 hashing" . "pending") + ("HSM integration support" . "pending"))))) + + (v1.3-future + ((name . "Advanced Features") + (status . "planned") + (items + (("CRDT-based sync finalization" . "pending") + ("Offline-first architecture" . "pending") + ("WASM sandboxing" . "pending") + ("Formal verification with SPARK Ada" . "pending") + ("GraphQL API" . "pending"))))))) (define critical-next-actions - '((immediate (("Verify CI/CD" . high))) (this-week (("Expand tests" . medium))))) + '((immediate + (("Begin ReScript conversion of core modules" . "high") + ("Set up ReScript build pipeline" . "high"))) + (this-week + (("Convert src/types to ReScript" . "medium") + ("Add rescript.json configuration" . "medium") + ("Update bsconfig.json" . "medium"))) + (this-month + (("Complete provider conversions" . "medium") + ("Expand test coverage to 80%" . "medium"))))) (define session-history - '((snapshots ((date . "2025-12-15") (session . "initial") (notes . "SCM files added"))))) + '((snapshots + ((date . "2025-12-15") (session . "initial") (notes . "SCM files added")) + ((date . "2025-12-17") (session . "security-review") + (notes . "Security hardening: updated GitHub Actions to v4, fixed security.txt expiry, aligned versions and licenses across SCM files, updated SECURITY.md dates"))))) (define state-summary - '((project . "preference-injector") (completion . 25) (blockers . 0) (updated . "2025-12-15"))) + '((project . "preference-injector") + (completion . 35) + (blockers . 0) + (high-priority-items . 1) + (updated . "2025-12-17") + (next-milestone . "v1.1 - ReScript Migration"))) diff --git a/flake.nix b/flake.nix index 0573ccc..55f0111 100644 --- a/flake.nix +++ b/flake.nix @@ -16,7 +16,7 @@ # Project metadata pname = "preference-injector"; - version = "2.0.0"; + version = "1.0.0"; # Development dependencies nativeBuildInputs = with pkgs; [ @@ -156,7 +156,7 @@ meta = with pkgs.lib; { description = "Universal Application Automation Standard with Post-Quantum Security"; homepage = "https://github.com/Hyperpolymath/preference-injector"; - license = with licenses; [ mit ]; # Note: Also Palimpsest v0.8 + license = with licenses; [ mit agpl3Plus ]; # Dual-licensed: MIT OR AGPL-3.0-or-later maintainers = []; # Add maintainers here platforms = platforms.all; }; diff --git a/guix.scm b/guix.scm index b9466a2..f4a5f77 100644 --- a/guix.scm +++ b/guix.scm @@ -11,7 +11,7 @@ (define-public preference_injector (package (name "preference-injector") - (version "0.1.0") + (version "1.0.0") (source (local-file "." "preference-injector-checkout" #:recursive? #t #:select? (git-predicate "."))) @@ -19,7 +19,7 @@ (synopsis "ReScript application") (description "ReScript application - part of the RSR ecosystem.") (home-page "https://github.com/hyperpolymath/preference-injector") - (license license:agpl3+))) + (license (list license:expat license:agpl3+)))) ;; Return package for guix shell preference_injector