From 68686b9092ea06175ac60e51e6e78d32bf598e27 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 26 Jul 2026 14:50:52 +0100
Subject: [PATCH 1/4] chore: estate-wide security compliance
---
.github/workflows/boj-build.yml | 1 +
.github/workflows/codeql.yml | 1 +
.github/workflows/dependabot-automerge.yml | 1 +
.github/workflows/dogfood-gate.yml | 1 +
.github/workflows/governance.yml | 1 +
.github/workflows/guix-nix-policy.yml | 1 +
.github/workflows/hypatia-scan.yml | 1 +
.github/workflows/instant-sync.yml | 1 +
.github/workflows/mirror.yml | 1 +
.github/workflows/npm-bun-blocker.yml | 1 +
.github/workflows/openssf-compliance.yml | 1 +
.github/workflows/pages.yml | 1 +
.github/workflows/push-email-notify.yml | 1 +
.github/workflows/quality.yml | 1 +
.github/workflows/release.yml | 1 +
.github/workflows/rhodibot.yml | 1 +
.github/workflows/rsr-antipattern.yml | 1 +
.github/workflows/rust-ci.yml | 1 +
.github/workflows/scorecard.yml | 1 +
.github/workflows/secret-scanner.yml | 1 +
.github/workflows/security-policy.yml | 1 +
.github/workflows/static-analysis-gate.yml | 1 +
.github/workflows/ts-blocker.yml | 1 +
.github/workflows/wellknown-enforcement.yml | 1 +
.github/workflows/workflow-linter.yml | 1 +
25 files changed, 25 insertions(+)
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index b203334..e56ba74 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -11,6 +11,7 @@ on:
branches: [main, master]
workflow_dispatch:
permissions:
+ actions: read
contents: read
jobs:
trigger-boj:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a7a1646..4ba7a7b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,6 +15,7 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
+ actions: read
contents: read
jobs:
analyze:
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index bce3810..e520ce0 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -39,6 +39,7 @@ on:
pull_request:
types: [opened, reopened, synchronize]
permissions:
+ actions: read
contents: write # needed to enable auto-merge
pull-requests: write # needed to approve
# NB: keep narrow — do NOT add secrets: read or id-token: write here.
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 433d048..3b6abc4 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -13,6 +13,7 @@ on:
branches: [main, master]
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 8776de0..966a16e 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -9,6 +9,7 @@ on:
workflow_dispatch:
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml
index 834bd90..7f4a7b9 100644
--- a/.github/workflows/guix-nix-policy.yml
+++ b/.github/workflows/guix-nix-policy.yml
@@ -11,6 +11,7 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
+ actions: read
contents: read
jobs:
check:
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 9dde27a..556e8e0 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -11,6 +11,7 @@ on:
workflow_dispatch:
permissions:
+ actions: read
contents: read
security-events: write
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index 0994325..37618c4 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -7,6 +7,7 @@ on:
release:
types: [published]
permissions:
+ actions: read
contents: read
jobs:
dispatch:
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 6bd847d..c3fc68a 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -5,6 +5,7 @@ on:
branches: [main]
workflow_dispatch:
permissions:
+ actions: read
contents: read
jobs:
mirror:
diff --git a/.github/workflows/npm-bun-blocker.yml b/.github/workflows/npm-bun-blocker.yml
index 7b651a2..d446d39 100644
--- a/.github/workflows/npm-bun-blocker.yml
+++ b/.github/workflows/npm-bun-blocker.yml
@@ -11,6 +11,7 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
+ actions: read
contents: read
jobs:
check:
diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml
index abb7c1e..5d7b3d3 100644
--- a/.github/workflows/openssf-compliance.yml
+++ b/.github/workflows/openssf-compliance.yml
@@ -9,6 +9,7 @@ on:
branches: [main]
workflow_dispatch:
permissions:
+ actions: read
contents: read
jobs:
openssf-compliance:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index c78489a..0273437 100755
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -5,6 +5,7 @@ on:
branches: [main, master]
workflow_dispatch:
permissions:
+ actions: read
contents: read
pages: write
id-token: write
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 4b4e754..112afd1 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -7,6 +7,7 @@ name: Push email notification
on:
push: {}
permissions:
+ actions: read
contents: read
jobs:
notify:
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 1319970..fd136dc 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -11,6 +11,7 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
+ actions: read
contents: read
jobs:
lint:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0b50929..e675c5d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,7 @@ on:
tags:
- 'v*'
permissions:
+ actions: read
contents: read
jobs:
build:
diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml
index d020405..15b299e 100644
--- a/.github/workflows/rhodibot.yml
+++ b/.github/workflows/rhodibot.yml
@@ -19,6 +19,7 @@ on:
workflows: ["Hypatia Neurosymbolic Analysis"]
types: [completed]
permissions:
+ actions: read
contents: write
pull-requests: write
jobs:
diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml
index a2a9656..e4b6c9d 100644
--- a/.github/workflows/rsr-antipattern.yml
+++ b/.github/workflows/rsr-antipattern.yml
@@ -8,6 +8,7 @@ on:
pull_request:
branches: [main, master, develop]
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 55b2c6a..e4fde20 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -9,6 +9,7 @@ on:
pull_request:
permissions:
+ actions: read
contents: read
jobs:
rust-ci:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b97e2cb..cede40a 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -9,6 +9,7 @@ on:
workflow_dispatch:
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 7af665c..a16d1bc 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -9,6 +9,7 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
+ actions: read
contents: read
jobs:
scan:
diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml
index 7387d43..708fca5 100644
--- a/.github/workflows/security-policy.yml
+++ b/.github/workflows/security-policy.yml
@@ -11,6 +11,7 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
+ actions: read
contents: read
jobs:
check:
diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml
index 485a1bb..2753b00 100644
--- a/.github/workflows/static-analysis-gate.yml
+++ b/.github/workflows/static-analysis-gate.yml
@@ -8,6 +8,7 @@ on:
push:
branches: [main, master]
permissions:
+ actions: read
contents: read
jobs:
# ---------------------------------------------------------------------------
diff --git a/.github/workflows/ts-blocker.yml b/.github/workflows/ts-blocker.yml
index fcaeede..e127439 100644
--- a/.github/workflows/ts-blocker.yml
+++ b/.github/workflows/ts-blocker.yml
@@ -11,6 +11,7 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
+ actions: read
contents: read
jobs:
check:
diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml
index 088e617..f9988c1 100644
--- a/.github/workflows/wellknown-enforcement.yml
+++ b/.github/workflows/wellknown-enforcement.yml
@@ -14,6 +14,7 @@ on:
- cron: '0 9 * * *'
workflow_dispatch:
permissions:
+ actions: read
contents: read
jobs:
validate:
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 89b95db..f19a6c0 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -13,6 +13,7 @@ on:
workflow_dispatch:
permissions:
+ actions: read
contents: read
jobs:
From de0b5ce0f2bae919b6e8920fc6b6e39baec27357 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 26 Jul 2026 15:11:02 +0100
Subject: [PATCH 2/4] chore: remove duplicate GOVERNANCE files, keep
GOVERNANCE.md
---
.github/GOVERNANCE.md | 160 -----------------------------------------
GOVERNANCE.adoc | 162 ------------------------------------------
2 files changed, 322 deletions(-)
delete mode 100644 .github/GOVERNANCE.md
delete mode 100644 GOVERNANCE.adoc
diff --git a/.github/GOVERNANCE.md b/.github/GOVERNANCE.md
deleted file mode 100644
index cea5c2e..0000000
--- a/.github/GOVERNANCE.md
+++ /dev/null
@@ -1,160 +0,0 @@
-
-# Project Governance
-
-This document describes the governance model for **Proof Burrower**.
-
----
-
-## Project Governance Model
-
-Proof Burrower follows a **Benevolent Dictator For Life (BDFL)** governance model.
-This model is well-suited for solo maintainers and small project teams where rapid,
-consistent decision-making is more valuable than formal consensus processes.
-
-The BDFL has final authority on all project decisions, including technical direction,
-release schedules, contributor access, and community standards.
-
-> **Transition clause:** When the core team exceeds three active maintainers, this
-> project should transition to a **consensus-based governance model** with documented
-> voting procedures. That transition should itself be recorded as an Architecture
-> Decision Record (ADR) in `docs/decisions/`.
-
----
-
-## Decision Making
-
-### Day-to-day decisions
-
-- The BDFL makes final decisions on all matters.
-- Routine decisions (bug fixes, dependency updates, minor improvements) may be made
- by any maintainer with commit access.
-- Maintainers are expected to use good judgement and seek input on non-trivial changes.
-
-### Proposing changes
-
-- Contributors can propose changes by opening issues or pull requests.
-- Significant changes (new features, breaking changes, architectural shifts) should
- be discussed in an issue before implementation begins.
-- The BDFL will provide a clear accept/reject decision with reasoning.
-
-### Architecture Decision Records (ADRs)
-
-- Significant technical decisions are documented as ADRs in `docs/decisions/`.
-- ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`.
-- ADRs provide a historical record of why decisions were made and what alternatives
- were considered.
-- See `.machine_readable/META.a2ml` for the machine-readable ADR index.
-
----
-
-## Roles
-
-### BDFL (Benevolent Dictator For Life)
-
-- The project creator and ultimate decision-maker.
-- Sets the project's technical direction and long-term vision.
-- Has final say on all matters, including maintainer appointments and removals.
-- Responsible for ensuring the project adheres to RSR standards.
-
-### Maintainer
-
-- Has commit access to the repository.
-- Reviews and merges pull requests.
-- Triages issues and manages releases.
-- Upholds code quality, security standards, and the Code of Conduct.
-- Listed in [MAINTAINERS.md](MAINTAINERS.md).
-
-### Contributor
-
-- Anyone who submits pull requests, opens issues, or participates in discussions.
-- Does not have direct commit access.
-- Contributions are reviewed by maintainers before merging.
-- All contributors must follow the [Code of Conduct](CODE_OF_CONDUCT.md).
-
-### Bot
-
-- Automated agents managed via your bot orchestration system.
-- Perform automated code review, security scanning, dependency updates, and
- standards enforcement.
-- Bot actions are subject to the same quality and review standards as human
- contributions.
-- Configure your bots in `.machine_readable/bot_directives/`.
-
----
-
-## Becoming a Maintainer
-
-A contributor may be nominated to become a maintainer when they demonstrate:
-
-1. **Sustained quality contributions** -- a track record of well-crafted pull requests
- that follow project conventions and require minimal revision.
-2. **Understanding of RSR standards** -- familiarity with the Repository Structure
- Requirements, security policies, and CI/CD workflows used across the project.
-3. **Constructive participation** -- helpful issue triage, thoughtful code review
- comments, and mentoring of other contributors.
-4. **Reliability** -- consistent engagement over a meaningful period (typically 3+
- months of active contribution).
-
-### Process
-
-1. An existing maintainer nominates the candidate by opening a private discussion
- with the BDFL.
-2. The BDFL reviews the candidate's contribution history and community interactions.
-3. The BDFL approves or declines the nomination, with reasoning provided to the
- nominator.
-4. If approved, the new maintainer is added to [MAINTAINERS.md](MAINTAINERS.md) and
- granted appropriate repository access.
-
----
-
-## Removing a Maintainer
-
-A maintainer may be removed under the following circumstances:
-
-- **Inactivity**: No meaningful contributions or reviews for 12 or more consecutive
- months. The maintainer will be contacted before removal and offered the option to
- move to emeritus status voluntarily.
-- **Code of Conduct violation**: Behaviour that violates the
- [Code of Conduct](CODE_OF_CONDUCT.md), as determined through the enforcement
- process described therein.
-- **BDFL discretion**: The BDFL may remove a maintainer for other reasons (e.g.,
- repeated disregard for project standards, loss of trust). Reasoning will be
- documented privately.
-
-Removed maintainers are moved to the Emeritus section of
-[MAINTAINERS.md](MAINTAINERS.md) unless removal was due to a serious Code of Conduct
-violation.
-
----
-
-## Code of Conduct
-
-All participants in this project are expected to follow the
-[Code of Conduct](CODE_OF_CONDUCT.md). The Code of Conduct applies to all project
-spaces, including issues, pull requests, discussions, and any forum where the project
-is represented.
-
-Enforcement of the Code of Conduct is described in that document. The BDFL serves as
-the final arbiter in conduct disputes.
-
----
-
-## Amendments
-
-This governance document may be amended by the BDFL at any time. All amendments will
-be:
-
-1. Documented as an ADR in `docs/decisions/` explaining the rationale for the change.
-2. Committed to the repository with a clear commit message.
-3. Communicated to existing maintainers and contributors via the project's usual
- channels.
-
-Substantive changes (e.g., changing the governance model itself) should be discussed
-with the community before adoption, even though the BDFL retains final authority.
-
----
-
-Copyright (c) 2026 hyperpolymath. Licensed under MPL-2.0.
diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc
deleted file mode 100644
index e41020d..0000000
--- a/GOVERNANCE.adoc
+++ /dev/null
@@ -1,162 +0,0 @@
-// SPDX-License-Identifier: CC-BY-SA-4.0
-// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
-= Governance Model
-:toc: preamble
-
-This document describes the governance model for this repository.
-
-== Overview
-
-This repository follows a **Sole Maintainer Governance Model**:
-
-* Single maintainer (@hyperpolymath) has full authority over the project
-* All contributions are welcome and reviewed by the maintainer
-* Decisions are made transparently through GitHub issues and discussions
-* The project adheres to the hyperpolymath estate policies where applicable
-
-== Core Principles
-
-[cols="1,2"]
-|===
-| Principle | Description
-
-| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input
-
-| **Meritocracy** | Contributions are judged on technical merit, not contributor identity
-
-| **Transparency** | All significant decisions are documented publicly
-
-| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary
-
-| **Open Contribution** | Anyone can contribute via fork and pull request
-
-|===
-
-== Roles and Permissions
-
-[cols="1,2,2"]
-|===
-| Role | Permissions | Assignment
-
-| **Maintainer** | Write access, merge rights, admin | @hyperpolymath
-| **Contributors** | Read access, fork, submit PRs | All GitHub users
-| **Users** | Use the software, report issues | All GitHub users
-
-|===
-
-== Decision Making Framework
-
-=== Routine Decisions
-
-* Bug fixes
-* Documentation improvements
-* Minor feature additions
-* Dependency updates
-
-**Process**: Maintainer reviews and merges PRs that meet quality standards.
-
-=== Significant Changes
-
-* New major features
-* API changes
-* Architecture modifications
-* Breaking changes
-
-**Process**:
-. Open issue describing the change
-. Discuss with community (minimum 72 hours)
-. Maintainer makes final decision
-. Document rationale in issue/PR
-
-=== Structural Decisions
-
-* Repository purpose/renaming
-* License changes
-* Ownership transfer
-* Deprecation/archival
-
-**Process**:
-. Extended discussion (minimum 1 week)
-. Maintainer makes final decision
-. Document in CHANGELOG and governance docs
-
-== Contribution Lifecycle
-
-[cols="1,2"]
-|===
-| Stage | Process
-
-| **Ideation** | Open issue, discuss feasibility
-
-| **Development** | Fork, implement, test thoroughly
-
-| **Review** | Submit PR, maintainer reviews within 7 days
-
-| **Merge** | Maintainer merges or requests changes
-
-| **Release** | Maintainer publishes according to project conventions
-
-|===
-
-== Conflict Resolution
-
-In case of disagreements:
-
-. Discuss in the relevant GitHub issue or PR
-. Provide technical justification for positions
-. Maintainer mediates and makes final decision
-. Decision is documented and can be revisited later
-
-== Project Policies
-
-This repository adheres to hyperpolymath estate-wide policies:
-
-* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc)
-* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md
-* **Security**: Follows hyperpolymath SECURITY.md
-* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions
-
-== Repository-Specific Conventions
-
-[cols="1,2"]
-|===
-| Convention | Description
-
-| **Signing** | All commits must be signed (SSH or GPG)
-
-| **SPDX Headers** | All source files must have SPDX license identifiers
-
-| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root
-
-| **Machine Readable** | META.a2ml in .machine_readable/6a2/
-
-| **CI/CD** | GitHub Actions workflows in .github/workflows/
-
-|===
-
-== Governance Evolution
-
-As the project grows, this governance model may evolve:
-
-* **Adding Co-Maintainers**: When contribution volume warrants it
-* **Forming a Team**: For complex multi-maintainer projects
-* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories)
-
-Changes to this document require the same process as Significant Changes above.
-
-== See Also
-
-* link:MAINTAINERS.adoc[Maintainers]
-* link:CODE_OF_CONDUCT.md[Code of Conduct]
-* link:CONTRIBUTING.adoc[Contributing Guide]
-* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy]
-* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)]
-
-== Changelog
-
-[cols="1,1,1"]
-|===
-| Date | Change | By
-
-| 2026-06-07 | Initial governance model established | @hyperpolymath
-|===
From f2af8013905d44a20537c010e634bfd1e284a4a2 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 28 Jul 2026 06:23:35 +0100
Subject: [PATCH 3/4] chore: fill or remove RSR template placeholders
openssf-compliance.yml fails when any of the thirteen files it checks
still contains a {{PLACEHOLDER}} token. This clears them.
Three kinds of change, no invention:
The "TEMPLATE INSTRUCTIONS (delete this block before publishing)" comment
is deleted. The template says to delete it, and it is where every legend
line lives -- so a large share of the reported tokens were the file
documenting its own placeholders, not real unfilled fields.
Tokens derivable from the repository are filled: owner and repo from the
git remote, project name, year, forge, main branch, contact email.
PGP and website lines are removed rather than filled, because nothing
true could go in them. https://github.com/.gpg returns HTTP 200 for
every account; with no key uploaded the body is a stub reading "This user
hasnt uploaded any GPG keys". No key is published for either account
here, and commit signing in this estate is SSH, which is unrelated. Only
one repository in the estate has a domain, so {{WEBSITE}} likewise has no
correct value. The template sanctions this: "Optional: Remove sections
that dont apply (e.g. PGP if you dont use it)." A security policy telling
a researcher to encrypt to a key that does not exist is worse than one
that does not mention encryption.
Co-Authored-By: Claude Opus 5
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
.github/SECURITY.md | 31 -------------------------------
1 file changed, 31 deletions(-)
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index 6bda286..11ff386 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -4,24 +4,6 @@ Copyright (c) Jonathan D.A. Jewell
-->
# Security Policy
-
-
We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions.
## Table of Contents
@@ -63,19 +45,7 @@ If you cannot use GitHub Security Advisories, you may email us directly:
| | |
|---|---|
| **Email** | j.d.a.jewell@open.ac.uk |
-| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) |
-| **Fingerprint** | `{{PGP_FINGERPRINT}}` |
-
-```bash
-# Import our PGP key
-curl -sSL {{PGP_KEY_URL}} | gpg --import
-# Verify fingerprint
-gpg --fingerprint j.d.a.jewell@open.ac.uk
-
-# Encrypt your report
-gpg --armor --encrypt --recipient j.d.a.jewell@open.ac.uk report.txt
-```
> **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media.
@@ -374,7 +344,6 @@ When using Proof Burrower, we recommend:
## Additional Resources
-- [Our PGP Public Key]({{PGP_KEY_URL}})
- [Security Advisories](https://github.com/hyperpolymath/proof-burrower/security/advisories)
- [Changelog](CHANGELOG.md)
- [Contributing Guidelines](CONTRIBUTING.md)
From a666ddf2b4c0ecc1af83e6fa8a91abb2caeb9eec Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 28 Jul 2026 19:17:59 +0100
Subject: [PATCH 4/4] chore: estate-wide cleanup - remove rsr-antipattern
workflows, update config
- Add justfile rule to .editorconfig
- Normalize justfile case in .gitattributes, remove .a2ml TOML mapping
- Delete rsr-antipattern.yml workflow files (root and affinescript/)
- Update .gitignore with additional patterns
- Remove AffineScript source rule from affinescript/.gitattributes
- Normalize CodeQL version tags from v3.28.1 to v3
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe
---
.editorconfig | 3 +
.gitattributes | 3 +-
.github/workflows/rsr-antipattern.yml | 16 ----
.gitignore | 10 +++
affinescript/.gitattributes | 3 -
affinescript/.github/workflows/codeql.yml | 4 +-
.../.github/workflows/rsr-antipattern.yml | 82 -------------------
7 files changed, 16 insertions(+), 105 deletions(-)
delete mode 100644 .github/workflows/rsr-antipattern.yml
delete mode 100644 affinescript/.github/workflows/rsr-antipattern.yml
diff --git a/.editorconfig b/.editorconfig
index bcdbb4d..fc6650c 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -63,3 +63,6 @@ indent_size = 2
indent_style = space
indent_size = 4
+[justfile]
+indent_style = space
+indent_size = 4
diff --git a/.gitattributes b/.gitattributes
index c95d5eb..e860a85 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -16,7 +16,6 @@
*.hs text eol=lf
*.chpl text eol=lf
*.scm text eol=lf
-*.a2ml text eol=lf linguist-language=TOML
*.ncl text eol=lf
*.nix text eol=lf
@@ -34,7 +33,7 @@
# Config
.gitignore text eol=lf
.gitattributes text eol=lf
-Justfile text eol=lf
+justfile text eol=lf
Makefile text eol=lf
Containerfile text eol=lf
diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml
deleted file mode 100644
index e4b6c9d..0000000
--- a/.github/workflows/rsr-antipattern.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# RSR Anti-Pattern Check - Uses reusable workflow from standards
-
-name: RSR Anti-Pattern Check
-on:
- push:
- branches: [main, master, develop]
- pull_request:
- branches: [main, master, develop]
-permissions:
- actions: read
- contents: read
-
-jobs:
- antipattern-check:
- uses: hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml@main
diff --git a/.gitignore b/.gitignore
index 42a33bc..ecb49e1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -106,3 +106,13 @@ deps/
.cache/
build/
dist/
+*.db
+*.db-journal
+*.db-shm
+*.db-wal
+.claude/
+.editorconfig
+/exports/*.json
+/exports/*.lgt
+composer/*.beam
+composer/build/
diff --git a/affinescript/.gitattributes b/affinescript/.gitattributes
index 61e929b..e860a85 100644
--- a/affinescript/.gitattributes
+++ b/affinescript/.gitattributes
@@ -3,9 +3,6 @@
* text=auto eol=lf
-# AffineScript source
-*.affine text eol=lf linguist-language=AffineScript
-
# Source
*.rs text eol=lf diff=rust
*.ex text eol=lf diff=elixir
diff --git a/affinescript/.github/workflows/codeql.yml b/affinescript/.github/workflows/codeql.yml
index e37d960..1526568 100644
--- a/affinescript/.github/workflows/codeql.yml
+++ b/affinescript/.github/workflows/codeql.yml
@@ -27,11 +27,11 @@ jobs:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Initialize CodeQL
- uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v3.28.1
+ uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v3
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v3.28.1
+ uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v3
with:
category: "/language:${{ matrix.language }}"
diff --git a/affinescript/.github/workflows/rsr-antipattern.yml b/affinescript/.github/workflows/rsr-antipattern.yml
deleted file mode 100644
index 491cbed..0000000
--- a/affinescript/.github/workflows/rsr-antipattern.yml
+++ /dev/null
@@ -1,82 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# RSR Anti-Pattern CI Check
-# SPDX-License-Identifier: MPL-2.0
-#
-# Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm
-# Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme
-
-name: RSR Anti-Pattern Check
-on:
- push:
- branches: [main, master, develop]
- pull_request:
- branches: [main, master, develop]
-permissions: read-all
-jobs:
- antipattern-check:
- runs-on: ubuntu-latest
- timeout-minutes: 15
- permissions:
- contents: read
- steps:
- - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- - name: Check for TypeScript
- run: |
- # Exclude bindings/deno/ - those are Deno FFI files using Deno.dlopen, not plain TypeScript
- # Exclude .d.ts files - those are TypeScript type declarations for ReScript FFI
- TS_FILES=$(find . \( -name "*.ts" -o -name "*.tsx" \) | grep -v node_modules | grep -v 'bindings/deno' | grep -v '\.d\.ts$' || true)
- if [ -n "$TS_FILES" ]; then
- echo "❌ TypeScript files detected - use ReScript instead"
- echo "$TS_FILES"
- exit 1
- fi
- echo "✅ No TypeScript files (Deno FFI bindings excluded)"
- - name: Check for Go
- run: |
- if find . -name "*.go" | grep -q .; then
- echo "❌ Go files detected - use Rust/WASM instead"
- find . -name "*.go"
- exit 1
- fi
- echo "✅ No Go files"
- - name: Check for Python (non-SaltStack)
- run: |
- PY_FILES=$(find . -name "*.py" | grep -v salt | grep -v _states | grep -v _modules | grep -v pillar | grep -v venv | grep -v __pycache__ || true)
- if [ -n "$PY_FILES" ]; then
- echo "❌ Python files detected - only allowed for SaltStack"
- echo "$PY_FILES"
- exit 1
- fi
- echo "✅ No non-SaltStack Python files"
- - name: Check for npm lockfiles
- run: |
- if [ -f "package-lock.json" ] || [ -f "yarn.lock" ]; then
- echo "❌ npm/yarn lockfile detected - use Deno instead"
- exit 1
- fi
- echo "✅ No npm lockfiles"
- - name: Check for tsconfig
- run: |
- if [ -f "tsconfig.json" ]; then
- echo "❌ tsconfig.json detected - use ReScript instead"
- exit 1
- fi
- echo "✅ No tsconfig.json"
- - name: Verify Deno presence (if package.json exists)
- run: |
- if [ -f "package.json" ]; then
- if [ ! -f "deno.json" ] && [ ! -f "deno.jsonc" ]; then
- echo "⚠️ Warning: package.json without deno.json - migration recommended"
- fi
- fi
- echo "✅ Deno configuration check complete"
- - name: Summary
- run: |
- echo "╔════════════════════════════════════════════════════════════╗"
- echo "║ RSR Anti-Pattern Check Passed ✅ ║"
- echo "║ ║"
- echo "║ Allowed: ReScript, Deno, WASM, Rust, OCaml, Haskell, ║"
- echo "║ Guile/Scheme, SaltStack (Python) ║"
- echo "║ ║"
- echo "║ Blocked: TypeScript, Go, npm, Python (non-Salt) ║"
- echo "╚════════════════════════════════════════════════════════════╝"