Review SCM files and security updates

STATE.scm

@@ -3,20 +3,99 @@
 ;; SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
 
 (define metadata
-  '((version . "0.1.0") (updated . "2025-12-15") (project . "robot-vacuum-cleaner")))
+  '((version . "0.1.0") (updated . "2025-12-17") (project . "robot-vacuum-cleaner")))
 
 (define current-position
-  '((phase . "v0.1 - Initial Setup")
-    (overall-completion . 25)
-    (components ((rsr-compliance ((status . "complete") (completion . 100)))))))
+  '((phase . "v0.1 - Foundation & Security Hardening")
+    (overall-completion . 30)
+    (components
+     ((rsr-compliance ((status . "complete") (completion . 100)))
+      (scm-files ((status . "complete") (completion . 100)))
+      (security-hardening ((status . "complete") (completion . 100)))
+      (rust-core ((status . "in-progress") (completion . 60)))
+      (julia-simulation ((status . "in-progress") (completion . 50)))
+      (graphql-api ((status . "partial") (completion . 30)))
+      (slam-algorithms ((status . "partial") (completion . 40)))
+      (ci-cd ((status . "complete") (completion . 95)))))))
 
-(define blockers-and-issues '((critical ()) (high-priority ())))
+(define blockers-and-issues
+  '((critical ())
+    (high-priority
+     (("Generate Cargo.lock for Nix builds" . "pending")
+      ("Update cargoHash in flake.nix after first build" . "pending")))))
+
+(define roadmap
+  '((v0.1-foundation
+     (status . "in-progress")
+     (target . "Q1 2026")
+     (items
+      (("RSR compliance setup" . "complete")
+       ("SCM files (guix.scm, flake.nix)" . "complete")
+       ("Security hardening" . "complete")
+       ("CI/CD pipeline" . "complete")
+       ("Basic Rust robot module" . "in-progress")
+       ("Basic Julia simulation" . "in-progress"))))
+
+    (v0.2-core-algorithms
+     (status . "planned")
+     (target . "Q2 2026")
+     (items
+      (("Complete SLAM implementation" . "planned")
+       ("A* pathfinding with optimizations" . "planned")
+       ("Coverage path planning" . "planned")
+       ("Obstacle detection system" . "planned")
+       ("Unit test coverage to 70%" . "planned"))))
+
+    (v0.3-simulation-environment
+     (status . "planned")
+     (target . "Q3 2026")
+     (items
+      (("Multi-room environment support" . "planned")
+       ("Dynamic obstacle handling" . "planned")
+       ("Battery simulation" . "planned")
+       ("Charging station docking" . "planned")
+       ("Environment visualization" . "planned"))))
+
+    (v0.4-api-integration
+     (status . "planned")
+     (target . "Q4 2026")
+     (items
+      (("Complete GraphQL API" . "planned")
+       ("Real-time simulation endpoints" . "planned")
+       ("Metrics and telemetry" . "planned")
+       ("WebSocket support" . "planned")
+       ("API documentation" . "planned"))))
+
+    (v1.0-production
+     (status . "planned")
+     (target . "Q1 2027")
+     (items
+      (("Performance optimization" . "planned")
+       ("Multi-agent support" . "planned")
+       ("Smart home integration protocols" . "planned")
+       ("Comprehensive documentation" . "planned")
+       ("Release preparation" . "planned"))))))
 
 (define critical-next-actions
-  '((immediate (("Verify CI/CD" . high))) (this-week (("Expand tests" . medium)))))
+  '((immediate
+     (("Generate Cargo.lock" . "high")
+      ("Verify flake.nix builds" . "high")))
+    (this-week
+     (("Complete robot movement system" . "medium")
+      ("Add pathfinding tests" . "medium")))
+    (this-month
+     (("SLAM occupancy grid implementation" . "medium")
+      ("Coverage path planning" . "medium")))))
 
 (define session-history
-  '((snapshots ((date . "2025-12-15") (session . "initial") (notes . "SCM files added")))))
+  '((snapshots
+     ((date . "2025-12-15") (session . "initial") (notes . "SCM files added"))
+     ((date . "2025-12-17") (session . "security-review")
+      (notes . "Security audit: fixed hardcoded token in cicd.sls, added flake.nix for Nix fallback, updated roadmap")))))
 
 (define state-summary
-  '((project . "robot-vacuum-cleaner") (completion . 25) (blockers . 0) (updated . "2025-12-15")))
+  '((project . "robot-vacuum-cleaner")
+    (completion . 30)
+    (blockers . 0)
+    (high-priority . 2)
+    (updated . "2025-12-17")))

flake.nix

@@ -0,0 +1,91 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
+# flake.nix — robot-vacuum-cleaner (Nix fallback, Guix is primary)
+{
+  description = "Robot Vacuum Cleaner - Simulation system with Julia and Rust implementations";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
+    flake-utils.url = "github:numtide/flake-utils";
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { self, nixpkgs, flake-utils, rust-overlay }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        overlays = [ (import rust-overlay) ];
+        pkgs = import nixpkgs {
+          inherit system overlays;
+        };
+        rustToolchain = pkgs.rust-bin.stable.latest.default.override {
+          extensions = [ "rust-src" "rust-analyzer" ];
+        };
+      in
+      {
+        devShells.default = pkgs.mkShell {
+          buildInputs = with pkgs; [
+            # Rust toolchain
+            rustToolchain
+            cargo-watch
+            cargo-audit
+            cargo-deny
+
+            # Julia
+            julia-bin
+
+            # Build tools
+            gnumake
+            just
+            pkg-config
+
+            # Security tools
+            gitleaks
+            trivy
+
+            # Development utilities
+            git
+            pre-commit
+            hadolint
+
+            # Container tools
+            podman
+            skopeo
+          ];
+
+          shellHook = ''
+            echo "robot-vacuum-cleaner development environment"
+            echo "Nix fallback shell (Guix is primary package manager)"
+            echo ""
+            echo "Available tools:"
+            echo "  - Rust: $(rustc --version)"
+            echo "  - Cargo: $(cargo --version)"
+            echo "  - Julia: $(julia --version 2>/dev/null || echo 'not in PATH')"
+            echo "  - Just: $(just --version)"
+            echo ""
+            echo "Run 'just' to see available commands"
+          '';
+
+          RUST_SRC_PATH = "${rustToolchain}/lib/rustlib/src/rust/library";
+        };
+
+        # NOTE: Build requires Cargo.lock to be generated first
+        # Run: cd src/rust && cargo generate-lockfile
+        packages.default = pkgs.rustPlatform.buildRustPackage {
+          pname = "robot-vacuum-cleaner";
+          version = "0.1.0";
+          src = ./src/rust;
+          cargoHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; # Update after first build
+
+          meta = with pkgs.lib; {
+            description = "Robot Vacuum Cleaner simulation system";
+            homepage = "https://github.com/hyperpolymath/robot-vacuum-cleaner";
+            license = with licenses; [ mit agpl3Plus ];
+            maintainers = [];
+          };
+        };
+      }
+    );
+}

salt/states/cicd.sls

@@ -81,7 +81,7 @@ gitlab_runner_config:
         [[runners]]
           name = "local-runner"
           url = "http://localhost"
-          token = "local-development-token"
+          token = "{{ pillar.get('gitlab_runner_token', 'REPLACE_WITH_TOKEN') }}"
           executor = "shell"
           shell = "bash"
           [runners.custom_build_dir]