From 9ffc6a143f1fd9afd38084cd39d79b73b64fd2c4 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 23 May 2026 03:14:03 +0100 Subject: [PATCH 01/11] feat(security): fleet-wide workflow hardening (SHA pinning + permissions) --- .github/workflows/ci.yml | 26 ++++++++++++++------------ .github/workflows/codeql.yml | 2 ++ 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 31fc124..d6d8601 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,6 +17,8 @@ env: OTP_VERSION: '26.2' REBAR3_VERSION: '3.22.1' +permissions: read-all + jobs: ########################################################################### # Build Job @@ -30,7 +32,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - name: Setup Erlang/OTP - uses: erlef/setup-beam@v1 + uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ env.OTP_VERSION }} rebar3-version: ${{ env.REBAR3_VERSION }} @@ -76,13 +78,13 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - name: Setup Erlang/OTP - uses: erlef/setup-beam@v1 + uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ matrix.otp }} rebar3-version: ${{ env.REBAR3_VERSION }} - name: Download build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: build-artifacts path: _build/ @@ -111,13 +113,13 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - name: Setup Erlang/OTP - uses: erlef/setup-beam@v1 + uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ env.OTP_VERSION }} rebar3-version: ${{ env.REBAR3_VERSION }} - name: Download build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: build-artifacts path: _build/ @@ -129,7 +131,7 @@ jobs: run: rebar3 cover --verbose - name: Upload coverage to Codecov - uses: codecov/codecov-action@v6 + uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6 with: files: _build/test/cover/cobertura.xml fail_ci_if_error: false @@ -148,7 +150,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - name: Setup Erlang/OTP - uses: erlef/setup-beam@v1 + uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ env.OTP_VERSION }} rebar3-version: ${{ env.REBAR3_VERSION }} @@ -162,7 +164,7 @@ jobs: ${{ runner.os }}-plt- - name: Download build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: build-artifacts path: _build/ @@ -275,13 +277,13 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - name: Setup Erlang/OTP - uses: erlef/setup-beam@v1 + uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ env.OTP_VERSION }} rebar3-version: ${{ env.REBAR3_VERSION }} - name: Download build artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: build-artifacts path: _build/ @@ -311,7 +313,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - name: Setup Erlang/OTP - uses: erlef/setup-beam@v1 + uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ env.OTP_VERSION }} rebar3-version: ${{ env.REBAR3_VERSION }} @@ -322,7 +324,7 @@ jobs: rebar3 as prod tar - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3 with: files: _build/prod/rel/safe_brute_force/*.tar.gz generate_release_notes: true diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d8898a7..168aeef 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,6 +20,8 @@ on: schedule: - cron: '37 15 * * 1' +permissions: read-all + jobs: analyze: name: Analyze (${{ matrix.language }}) From f34b82a4527f4d892b392b4ab3f555e303239a48 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 1 Jun 2026 00:58:11 +0100 Subject: [PATCH 02/11] ci: fix CI/CD configuration (campaigns C001-C005) - C001: CodeQL language fixes - C002: License identifier standardization - C003: Outdated actions audit - C004: Pin standards refs to SHA 861b5e9 - C005: Add workflow-level permissions --- .github/workflows/codeql.yml | 1 + .github/workflows/governance.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 168aeef..dd4114f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,6 +20,7 @@ on: schedule: - cron: '37 15 * * 1' + permissions: read-all jobs: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 653ef98..698d7e2 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -31,4 +31,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 From 3cacd04c153fa6c585b5c9447878ee345b6f6c36 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 3 Jun 2026 14:46:21 +0100 Subject: [PATCH 03/11] docs: add OpenSSF Best Practices registration badge --- README.adoc | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/README.adoc b/README.adoc index d1e474d..7d851d9 100644 --- a/README.adoc +++ b/README.adoc @@ -1,7 +1,10 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = 🔒 SafeBruteForce +image:https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=openssourcesecurity[OpenSSF Best Practices,link="https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/safe-brute-force"] -image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] -// SPDX-License-Identifier: MPL-2.0 + +image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[License: MPL-2.0,link="https://opensource.org/licenses/MPL-2.0"] // SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell [![RSR Compliance](https://img.shields.io/badge/RSR-Bronze-cd7f32)](RSR_COMPLIANCE.md) @@ -425,5 +428,6 @@ This project maintains the principle of *"Safety First"*: == License -Palimpsest License (PMPL-1.0) -2025 Jonathan D.A. Jewell +This project is licensed under the Mozilla Public License, v. 2.0. See the `LICENSE` file for details. + +SPDX-License-Identifier: MPL-2.0 \ No newline at end of file From bd2025fc4d201cbcbd04f4fd0d5e12a069070bf2 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 4 Jun 2026 16:14:28 +0100 Subject: [PATCH 04/11] test(ci): verify Hypatia SHA update from old to new TEST COMMIT - This repo used old SHA 915139d7 which lacks timeout-minutes in the reusable. Verify: - hypatia-scan.yml now uses SHA 6cd37728 - Scan completes with timeout from reusable - No hang, no red light Expected: Green check, scan completes in <20 min. Delete this commit after CI passes. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/TEST_CI_SHA.md | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 .github/TEST_CI_SHA.md diff --git a/.github/TEST_CI_SHA.md b/.github/TEST_CI_SHA.md new file mode 100644 index 0000000..14bda1e --- /dev/null +++ b/.github/TEST_CI_SHA.md @@ -0,0 +1,7 @@ +# CI TEST: Hypatia SHA update +# SPDX-License-Identifier: MPL-2.0 +# Copyright (c) Jonathan D.A. Jewell + +Test commit to verify Hypatia SHA update from 915139d7 to 6cd37728. + +DELETE AFTER VERIFICATION. From 82cb6fece31f3d58599942f89ca55b53667cb1a5 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 4 Jun 2026 17:47:44 +0100 Subject: [PATCH 05/11] chore: rename k9 directories to self-validating for clarity --- .claude/CLAUDE.md | 8 +- .github/ISSUE_TEMPLATE/bug_report.md | 4 + .github/ISSUE_TEMPLATE/custom.md | 4 + .github/ISSUE_TEMPLATE/documentation.md | 4 + .github/ISSUE_TEMPLATE/feature_request.md | 4 + .github/ISSUE_TEMPLATE/question.md | 4 + .github/copilot/coding-agent.yml | 6 + .github/workflows/ci.yml | 9 + .github/workflows/codeql.yml | 1 + .github/workflows/dependabot-automerge.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 3 +- .github/workflows/instant-sync.yml | 1 + .github/workflows/jekyll-gh-pages.yml | 2 + .github/workflows/mirror.yml | 1 + .github/workflows/scorecard-enforcer.yml | 3 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/workflow-linter.yml | 1 + .machine_readable/6a2/0-AI-MANIFEST.a2ml | 22 +++ .machine_readable/6a2/README.adoc | 20 +++ .machine_readable/svc/README.adoc | 2 + .../svc/{k9 => self-validating}/README.adoc | 1 + .../examples/ci-config.k9.ncl | 0 .../examples/project-metadata.k9.ncl | 0 .../examples/setup-repo.k9.ncl | 0 .../template-hunt.k9.ncl | 0 .../template-kennel.k9.ncl | 0 .../template-yard.k9.ncl | 0 CHANGELOG.adoc | 1 + CHANGELOG.md | 4 + CLAUDE.md | 4 + CODE_OF_CONDUCT.md | 4 + CONTRIBUTING.adoc | 1 + CONTRIBUTING.md | 4 + EXPLAINME.adoc | 10 ++ LICENSE | 165 +++++++----------- MAINTAINERS.adoc | 1 + MAINTAINERS.md | 4 + PALIMPSEST.adoc | 2 + PROJECT_SUMMARY.md | 4 + RSR_COMPLIANCE.md | 4 + SECURITY.md | 5 +- TEST-NEEDS.md | 4 + contractiles/README.adoc | 2 + docs/API_REFERENCE.md | 4 + docs/CITATIONS.adoc | 2 + docs/CONTRIBUTING.md | 4 + docs/MULTI_LANGUAGE_ARCHITECTURE.md | 4 + docs/QUICKSTART.md | 4 + docs/REPRODUCIBLE_BUILDS.md | 4 + docs/SECURITY.md | 4 + docs/TYPE_SAFETY_ROADMAP.md | 4 + docs/USAGE.md | 4 + docs/tech-debt-2026-05-26.md | 3 +- rescript_modules/README.md | 4 + rust_nif/README.md | 4 + rust_nif/src/lib.rs | 2 + 58 files changed, 264 insertions(+), 106 deletions(-) create mode 100644 .github/copilot/coding-agent.yml create mode 100644 .machine_readable/6a2/0-AI-MANIFEST.a2ml create mode 100644 .machine_readable/6a2/README.adoc rename .machine_readable/svc/{k9 => self-validating}/README.adoc (98%) rename .machine_readable/svc/{k9 => self-validating}/examples/ci-config.k9.ncl (100%) rename .machine_readable/svc/{k9 => self-validating}/examples/project-metadata.k9.ncl (100%) rename .machine_readable/svc/{k9 => self-validating}/examples/setup-repo.k9.ncl (100%) rename .machine_readable/svc/{k9 => self-validating}/template-hunt.k9.ncl (100%) rename .machine_readable/svc/{k9 => self-validating}/template-kennel.k9.ncl (100%) rename .machine_readable/svc/{k9 => self-validating}/template-yard.k9.ncl (100%) diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index c4f36ce..d554047 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -1,3 +1,7 @@ + ## Machine-Readable Artefacts The following files in `.machine_readable/` contain structured project metadata: @@ -43,7 +47,7 @@ The following files in `.machine_readable/` contain structured project metadata: | Bun | Deno | | pnpm/yarn | Deno | | Go | Rust | -| Python | Julia/Rust/ReScript | +| Python | Julia/Rust/AffineScript | | Java/Kotlin | Rust/Tauri/Dioxus | | Swift | Tauri/Dioxus | | React Native | Tauri/Dioxus | @@ -61,7 +65,7 @@ Both are FOSS with independent governance (no Big Tech). ### Enforcement Rules 1. **No new TypeScript files** - Convert existing TS to AffineScript -2. **No package.json for runtime deps** - Use deno.json imports +2. **No package.json - use deno.json deps** - Use deno.json imports 3. **No node_modules in production** - Deno caches deps automatically 4. **No Go code** - Use Rust instead 5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 987aab6..45a6c02 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -1,3 +1,7 @@ + --- name: Bug report about: Create a report to help us improve diff --git a/.github/ISSUE_TEMPLATE/custom.md b/.github/ISSUE_TEMPLATE/custom.md index 48d5f81..99ebf00 100644 --- a/.github/ISSUE_TEMPLATE/custom.md +++ b/.github/ISSUE_TEMPLATE/custom.md @@ -1,3 +1,7 @@ + --- name: Custom issue template about: Describe this issue template's purpose here. diff --git a/.github/ISSUE_TEMPLATE/documentation.md b/.github/ISSUE_TEMPLATE/documentation.md index 4fcb9f9..b1d16df 100644 --- a/.github/ISSUE_TEMPLATE/documentation.md +++ b/.github/ISSUE_TEMPLATE/documentation.md @@ -1,3 +1,7 @@ + --- name: Documentation about: Report unclear, missing, or incorrect documentation diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index 3e8fa7e..a5a5693 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,3 +1,7 @@ + --- name: Feature request about: Suggest an idea for this project diff --git a/.github/ISSUE_TEMPLATE/question.md b/.github/ISSUE_TEMPLATE/question.md index fd0e2a5..c2d1f57 100644 --- a/.github/ISSUE_TEMPLATE/question.md +++ b/.github/ISSUE_TEMPLATE/question.md @@ -1,3 +1,7 @@ + --- name: Question about: Ask a question about usage or behaviour diff --git a/.github/copilot/coding-agent.yml b/.github/copilot/coding-agent.yml new file mode 100644 index 0000000..a719a77 --- /dev/null +++ b/.github/copilot/coding-agent.yml @@ -0,0 +1,6 @@ +mcp_servers: + boj-server: + command: npx + args: ["-y", "@hyperpolymath/boj-server@latest"] + env: + BOJ_URL: http://localhost:7700 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d6d8601..94b8e38 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,6 +26,7 @@ jobs: build: name: Build runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -66,6 +67,7 @@ jobs: test: name: Test (OTP ${{ matrix.otp }}) runs-on: ubuntu-latest + timeout-minutes: 15 needs: build strategy: @@ -106,6 +108,7 @@ jobs: coverage: name: Test Coverage runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: @@ -143,6 +146,7 @@ jobs: dialyzer: name: Dialyzer Static Analysis runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: @@ -179,6 +183,7 @@ jobs: security: name: Security Checks runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -210,6 +215,7 @@ jobs: rsr-compliance: name: RSR Framework Compliance runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout code @@ -270,6 +276,7 @@ jobs: docs: name: Build Documentation runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: @@ -305,6 +312,7 @@ jobs: release: name: Create Release runs-on: ubuntu-latest + timeout-minutes: 15 needs: [test, coverage, security, rsr-compliance] if: startsWith(github.ref, 'refs/tags/v') @@ -339,6 +347,7 @@ jobs: notify: name: Notify on Failure runs-on: ubuntu-latest + timeout-minutes: 15 needs: [test, coverage, security, rsr-compliance] if: failure() diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index dd4114f..2b3d0ad 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,6 +32,7 @@ jobs: # - https://gh.io/using-larger-runners (GitHub.com only) # Consider using larger runners or machines with greater resources for possible analysis time improvements. runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + timeout-minutes: 15 permissions: # required for all workflows security-events: write diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index ca86baa..3d0e8de 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -50,6 +50,7 @@ jobs: # Only run for PRs actually authored by Dependabot. if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Fetch Dependabot metadata diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 698d7e2..1b4e269 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -32,3 +32,4 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 + timeout-minutes: 10 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index c68b9ed..a711616 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -25,5 +25,6 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242 + timeout-minutes: 10 secrets: inherit diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 4dab25d..32e9e3e 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -14,6 +14,7 @@ permissions: jobs: dispatch: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Trigger Propagation uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml index 1d303d3..bec7e50 100644 --- a/.github/workflows/jekyll-gh-pages.yml +++ b/.github/workflows/jekyll-gh-pages.yml @@ -26,6 +26,7 @@ jobs: # Build job build: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 @@ -45,6 +46,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest + timeout-minutes: 15 needs: build steps: - name: Deploy to GitHub Pages diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 2083ca6..ee8ea02 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -12,4 +12,5 @@ permissions: jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f + timeout-minutes: 10 secrets: inherit diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index 75e2385..50d765e 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -33,6 +33,7 @@ jobs: # uses-only; `check-score` is the gating job that emits the error. scorecard: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: security-events: write id-token: write # For OIDC @@ -63,6 +64,7 @@ jobs: check-score: needs: scorecard runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read steps: @@ -88,6 +90,7 @@ jobs: # Check specific high-priority items check-critical: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f99d361..d5b33eb 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,4 +13,5 @@ permissions: read-all jobs: analysis: uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef + timeout-minutes: 10 secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 097d2af..c7761fe 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -16,4 +16,5 @@ permissions: jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0 + timeout-minutes: 10 secrets: inherit diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 02b2e76..735f6a3 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -15,6 +15,7 @@ permissions: read-all jobs: lint-workflows: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 diff --git a/.machine_readable/6a2/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/0-AI-MANIFEST.a2ml new file mode 100644 index 0000000..cede8a9 --- /dev/null +++ b/.machine_readable/6a2/0-AI-MANIFEST.a2ml @@ -0,0 +1,22 @@ +# AI Manifest for 6a2 Directory + +## Purpose + +This manifest declares the AI-assistant context for the 6a2 machine-readable metadata directory. + +## Canonical Locations + +The 6 core A2ML files MUST exist in this directory: +1. AGENTIC.a2ml +2. ECOSYSTEM.a2ml +3. META.a2ml +4. NEUROSYM.a2ml +5. PLAYBOOK.a2ml +6. STATE.a2ml + +## Invariants + +- No duplicate files in root directory +- Single source of truth: this directory is authoritative +- No stale metadata + diff --git a/.machine_readable/6a2/README.adoc b/.machine_readable/6a2/README.adoc new file mode 100644 index 0000000..ac38c25 --- /dev/null +++ b/.machine_readable/6a2/README.adoc @@ -0,0 +1,20 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell +# A2ML 6a2 Directory + +This directory contains the 6 core A2ML machine-readable metadata files for this repository. + +## Files + +- `AGENTIC.a2ml` - AI agent operational gating, safety controls +- `ECOSYSTEM.a2ml` - Project ecosystem position, relationships, explicit boundaries +- `META.a2ml` - Architecture decisions (ADRs), development practices, design rationale +- `NEUROSYM.a2ml` - Symbolic semantics, composition algebra +- `PLAYBOOK.a2ml` - Executable plans, operational runbooks +- `STATE.a2ml` - Project state, phase, milestones, session history + +## Standards Compliance + +These files follow the A2ML Format Family specification from: +https://github.com/hyperpolymath/standards/tree/main/a2ml + diff --git a/.machine_readable/svc/README.adoc b/.machine_readable/svc/README.adoc index 6738331..00fb82d 100644 --- a/.machine_readable/svc/README.adoc +++ b/.machine_readable/svc/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = `.machine_readable/svc/` — Service components for safe-brute-force :toc: diff --git a/.machine_readable/svc/k9/README.adoc b/.machine_readable/svc/self-validating/README.adoc similarity index 98% rename from .machine_readable/svc/k9/README.adoc rename to .machine_readable/svc/self-validating/README.adoc index 9c3099f..ce1825f 100644 --- a/.machine_readable/svc/k9/README.adoc +++ b/.machine_readable/svc/self-validating/README.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = K9 Contractiles :toc: left :icons: font diff --git a/.machine_readable/svc/k9/examples/ci-config.k9.ncl b/.machine_readable/svc/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/examples/ci-config.k9.ncl rename to .machine_readable/svc/self-validating/examples/ci-config.k9.ncl diff --git a/.machine_readable/svc/k9/examples/project-metadata.k9.ncl b/.machine_readable/svc/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/examples/project-metadata.k9.ncl rename to .machine_readable/svc/self-validating/examples/project-metadata.k9.ncl diff --git a/.machine_readable/svc/k9/examples/setup-repo.k9.ncl b/.machine_readable/svc/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/examples/setup-repo.k9.ncl rename to .machine_readable/svc/self-validating/examples/setup-repo.k9.ncl diff --git a/.machine_readable/svc/k9/template-hunt.k9.ncl b/.machine_readable/svc/self-validating/template-hunt.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/template-hunt.k9.ncl rename to .machine_readable/svc/self-validating/template-hunt.k9.ncl diff --git a/.machine_readable/svc/k9/template-kennel.k9.ncl b/.machine_readable/svc/self-validating/template-kennel.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/template-kennel.k9.ncl rename to .machine_readable/svc/self-validating/template-kennel.k9.ncl diff --git a/.machine_readable/svc/k9/template-yard.k9.ncl b/.machine_readable/svc/self-validating/template-yard.k9.ncl similarity index 100% rename from .machine_readable/svc/k9/template-yard.k9.ncl rename to .machine_readable/svc/self-validating/template-yard.k9.ncl diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc index 1b2f8ab..7c23ee0 100644 --- a/CHANGELOG.adoc +++ b/CHANGELOG.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Changelog All notable changes to SafeBruteForce will be documented in this file. diff --git a/CHANGELOG.md b/CHANGELOG.md index d530e80..8919d0a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,7 @@ + # Changelog All notable changes to SafeBruteForce will be documented in this file. diff --git a/CLAUDE.md b/CLAUDE.md index 76ce182..a2753b8 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,3 +1,7 @@ + # CLAUDE.md - AI Assistant Guide for SafeBruteForce ## Project Overview diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 8ca3115..dc4129d 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -1,3 +1,7 @@ + # Contributor Covenant Code of Conduct ## Our Pledge diff --git a/CONTRIBUTING.adoc b/CONTRIBUTING.adoc index 1f34e60..2ead10c 100644 --- a/CONTRIBUTING.adoc +++ b/CONTRIBUTING.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contributing Guide == Getting Started diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a292402..c239302 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,3 +1,7 @@ + # Clone the repository git clone https://github.com/hyperpolymath/safe-brute-force.git cd safe-brute-force diff --git a/EXPLAINME.adoc b/EXPLAINME.adoc index d2a2e79..6fa82a0 100644 --- a/EXPLAINME.adoc +++ b/EXPLAINME.adoc @@ -1,6 +1,9 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell = SafeBruteForce — EXPLAINME +image:https://img.shields.io/badge/License-MPL_2.0-blue.svg[License: MPL-2.0,link="https://opensource.org/licenses/MPL-2.0"] + :toc: preamble :icons: font @@ -132,3 +135,10 @@ implementation is pure LFE. The web UI mentioned in the v0.2.0 roadmap section does not yet exist. SSH, FTP, and database connection modules are also roadmap items, not current capabilities. + + +== License + +This project is licensed under the Mozilla Public License, v. 2.0. See the `LICENSE` file for details. + +SPDX-License-Identifier: MPL-2.0 diff --git a/LICENSE b/LICENSE index 4a7f1aa..d0a1fa1 100644 --- a/LICENSE +++ b/LICENSE @@ -1,38 +1,3 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) - ------------------------------------------------------------------------- -PREFERRED LICENCE: Palimpsest License (MPL-2.0) ------------------------------------------------------------------------- - -This work is governed by the Palimpsest License (MPL-2.0) as -its primary intended licence. MPL-2.0 extends the Mozilla -Public License 2.0 (MPL-2.0) with additional provisions for ethical use, -post-quantum cryptographic provenance, and emotional lineage protection. -The canonical PMPL text and stewardship information are maintained at: - https://github.com/hyperpolymath/palimpsest-license - ------------------------------------------------------------------------- -FALLBACK LICENCE: Mozilla Public License 2.0 (MPL-2.0) ------------------------------------------------------------------------- - -Because MPL-2.0 is not yet recognised by the Open Source -Initiative (OSI) or equivalent bodies, this work also carries MPL-2.0 -as its legally-recognised fallback licence. - -In any jurisdiction, platform, or context where MPL-2.0 is -not accepted as a valid licence, or where an OSI-approved licence is -required, this work is instead governed by the Mozilla Public License, -Version 2.0. - -MPL-2.0 was chosen as the fallback because MPL-2.0 is -explicitly based on and extends MPL-2.0; it is therefore the closest -recognised equivalent to the intended licence. - -The complete MPL-2.0 text follows below. - ------------------------------------------------------------------------- - Mozilla Public License Version 2.0 ================================== @@ -109,17 +74,17 @@ Mozilla Public License Version 2.0 means the form of the work preferred for making modifications. 1.14. "You" (or "Your") - means an individual or a legal entity exercising rights under - this License. For legal entities, "You" includes any entity that - controls, is controlled by, or is under common control with You. - For the purposes of this definition, "control" means (a) the power, - direct or indirect, to cause the direction or management of such - entity, whether by contract or otherwise, or (b) ownership of more - than fifty percent (50%) of the outstanding shares or beneficial + means an individual or a legal entity exercising rights under this + License. For legal entities, "You" includes any entity that + controls, is controlled by, or is under common control with You. For + purposes of this definition, "control" means (a) the power, direct + or indirect, to cause the direction or management of such entity, + whether by contract or otherwise, or (b) ownership of more than + fifty percent (50%) of the outstanding shares or beneficial ownership of such entity. 2. License Grants and Conditions ---------------------------------- +-------------------------------- 2.1. Grants @@ -144,11 +109,11 @@ distributes such Contribution. 2.3. Limitations on Grant Scope -The licenses granted in this Section 2 are the only rights granted -under this License. No additional rights or licenses will be implied -from the distribution or licensing of Covered Software under this -License. Notwithstanding Section 2.1(b) above, no patent license is -granted by a Contributor: +The licenses granted in this Section 2 are the only rights granted under +this License. No additional rights or licenses will be implied from the +distribution or licensing of Covered Software under this License. +Notwithstanding Section 2.1(b) above, no patent license is granted by a +Contributor: (a) for any code that a Contributor has removed from Covered Software; or @@ -158,19 +123,19 @@ granted by a Contributor: Contributions with other software (except as part of its Contributor Version); or -(c) under Patent Claims infringed by Covered Software in the absence - of its Contributions. +(c) under Patent Claims infringed by Covered Software in the absence of + its Contributions. -This License does not grant any rights in the trademarks, service -marks, or logos of any Contributor (except as may be necessary to -comply with the notice requirements in Section 3.4). +This License does not grant any rights in the trademarks, service marks, +or logos of any Contributor (except as may be necessary to comply with +the notice requirements in Section 3.4). 2.4. Subsequent Licenses No Contributor makes additional grants as a result of Your choice to distribute the Covered Software under a subsequent version of this -License (see Section 10.2) or under the terms of a Secondary License -(if permitted under the terms of Section 3.3). +License (see Section 10.2) or under the terms of a Secondary License (if +permitted under the terms of Section 3.3). 2.5. Representation @@ -186,11 +151,11 @@ equivalents. 2.7. Conditions -Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses -granted in Section 2.1. +Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted +in Section 2.1. 3. Responsibilities --------------------- +------------------- 3.1. Distribution of Source Form @@ -207,10 +172,10 @@ Form. If You distribute Covered Software in Executable Form then: (a) such Covered Software must also be made available in Source Code - Form, as described in Section 3.1, and You must inform recipients - of the Executable Form how they can obtain a copy of such Source - Code Form by reasonable means in a timely manner, at a charge no - more than the cost of distribution to the recipient; and + Form, as described in Section 3.1, and You must inform recipients of + the Executable Form how they can obtain a copy of such Source Code + Form by reasonable means in a timely manner, at a charge no more + than the cost of distribution to the recipient; and (b) You may distribute such Executable Form under the terms of this License, or sublicense it under different terms, provided that the @@ -222,8 +187,8 @@ If You distribute Covered Software in Executable Form then: You may create and distribute a Larger Work under terms of Your choice, provided that You also comply with the requirements of this License for the Covered Software. If the Larger Work is a combination of Covered -Software with a work governed by one or more Secondary Licenses, and -the Covered Software is not Incompatible With Secondary Licenses, this +Software with a work governed by one or more Secondary Licenses, and the +Covered Software is not Incompatible With Secondary Licenses, this License permits You to additionally distribute such Covered Software under the terms of such Secondary License(s), so that the recipient of the Larger Work may, at their option, further distribute the Covered @@ -241,28 +206,28 @@ the extent required to remedy known factual inaccuracies. 3.5. Application of Additional Terms You may choose to offer, and to charge a fee for, warranty, support, -indemnity or liability obligations to one or more recipients of -Covered Software. However, You may do so only on Your own behalf, and -not on behalf of any Contributor. You must make it absolutely clear -that any such warranty, support, indemnity, or liability obligation is -offered by You alone, and You hereby agree to indemnify every -Contributor for any liability incurred by such Contributor as a result -of warranty, support, indemnity or liability terms You offer. You may -include additional disclaimers of warranty and limitations of liability -specific to any jurisdiction. +indemnity or liability obligations to one or more recipients of Covered +Software. However, You may do so only on Your own behalf, and not on +behalf of any Contributor. You must make it absolutely clear that any +such warranty, support, indemnity, or liability obligation is offered by +You alone, and You hereby agree to indemnify every Contributor for any +liability incurred by such Contributor as a result of warranty, support, +indemnity or liability terms You offer. You may include additional +disclaimers of warranty and limitations of liability specific to any +jurisdiction. 4. Inability to Comply Due to Statute or Regulation ------------------------------------------------------ +--------------------------------------------------- If it is impossible for You to comply with any of the terms of this License with respect to some or all of the Covered Software due to statute, judicial order, or regulation then You must: (a) comply with the terms of this License to the maximum extent possible; and (b) -describe the limitations and the code they affect. Such description -must be placed in a text file included with all distributions of the -Covered Software under this License. Except to the extent prohibited -by statute or regulation, such description must be sufficiently -detailed for a recipient of ordinary skill to be able to understand it. +describe the limitations and the code they affect. Such description must +be placed in a text file included with all distributions of the Covered +Software under this License. Except to the extent prohibited by statute +or regulation, such description must be sufficiently detailed for a +recipient of ordinary skill to be able to understand it. 5. Termination -------------- @@ -271,27 +236,27 @@ detailed for a recipient of ordinary skill to be able to understand it. if You fail to comply with any of its terms. However, if You become compliant, then the rights granted under this License from a particular Contributor are reinstated (a) provisionally, unless and until such -Contributor explicitly and finally terminates Your grants, and (b) on -an ongoing basis, if such Contributor fails to notify You of the +Contributor explicitly and finally terminates Your grants, and (b) on an +ongoing basis, if such Contributor fails to notify You of the non-compliance by some reasonable means prior to 60 days after You have come back into compliance. Moreover, Your grants from a particular Contributor are reinstated on an ongoing basis if such Contributor -notifies You of the non-compliance by some reasonable means, this is -the first time You have received notice of non-compliance with this -License from such Contributor, and You become compliant prior to 30 -days after Your receipt of the notice. +notifies You of the non-compliance by some reasonable means, this is the +first time You have received notice of non-compliance with this License +from such Contributor, and You become compliant prior to 30 days after +Your receipt of the notice. -5.2. If You initiate litigation against any entity by asserting a -patent infringement claim (excluding declaratory judgment actions, +5.2. If You initiate litigation against any entity by asserting a patent +infringement claim (excluding declaratory judgment actions, counter-claims, and cross-claims) alleging that a Contributor Version directly or indirectly infringes any patent, then the rights granted to You by any and all Contributors for the Covered Software under Section 2.1 of this License shall terminate. 5.3. In the event of termination under Sections 5.1 or 5.2 above, all -end user license agreements (excluding distributors and resellers) -which have been validly granted by You or Your distributors under this -License prior to termination shall survive termination. +end user license agreements (excluding distributors and resellers) which +have been validly granted by You or Your distributors under this License +prior to termination shall survive termination. ************************************************************************ * * @@ -346,7 +311,7 @@ Nothing in this Section shall prevent a party's ability to bring cross-claims or counter-claims. 9. Miscellaneous ------------------ +---------------- This License represents the complete agreement concerning the subject matter hereof. If any provision of this License is held to be @@ -356,14 +321,14 @@ that the language of a contract shall be construed against the drafter shall not be used to construe this License against a Contributor. 10. Versions of the License ----------------------------- +--------------------------- 10.1. New Versions -Mozilla Foundation is the license steward. Except as provided in -Section 10.3, no one other than the license steward has the right to -modify or publish new versions of this License. Each version will be -given a distinguishing version number. +Mozilla Foundation is the license steward. Except as provided in Section +10.3, no one other than the license steward has the right to modify or +publish new versions of this License. Each version will be given a +distinguishing version number. 10.2. Effect of New Versions @@ -392,17 +357,17 @@ Exhibit A - Source Code Form License Notice This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this - file, You can obtain one at http://mozilla.org/MPL/2.0/. + file, You can obtain one at https://mozilla.org/MPL/2.0/. If it is not possible or desirable to put the notice in a particular file, then You may include the notice in a location (such as a LICENSE -file in a relevant directory) where a recipient would be likely to -look for such a notice. +file in a relevant directory) where a recipient would be likely to look +for such a notice. You may add additional accurate notices of copyright ownership. Exhibit B - "Incompatible With Secondary Licenses" Notice ----------------------------------------------------------- +--------------------------------------------------------- This Source Code Form is "Incompatible With Secondary Licenses", as defined by the Mozilla Public License, v. 2.0. diff --git a/MAINTAINERS.adoc b/MAINTAINERS.adoc index a1c6544..becaa3e 100644 --- a/MAINTAINERS.adoc +++ b/MAINTAINERS.adoc @@ -1,4 +1,5 @@ // SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Maintainers :toc: preamble diff --git a/MAINTAINERS.md b/MAINTAINERS.md index c96a89e..32c638a 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -1,3 +1,7 @@ + # Maintainers This document lists the maintainers of the SafeBruteForce project. diff --git a/PALIMPSEST.adoc b/PALIMPSEST.adoc index ebaa6d0..9660f13 100644 --- a/PALIMPSEST.adoc +++ b/PALIMPSEST.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Palimpsest License :toc: :toc-placement!: diff --git a/PROJECT_SUMMARY.md b/PROJECT_SUMMARY.md index 69e19b3..d04a0f7 100644 --- a/PROJECT_SUMMARY.md +++ b/PROJECT_SUMMARY.md @@ -1,3 +1,7 @@ + # SafeBruteForce v0.1.0 - Complete Implementation Summary This document summarizes the comprehensive implementation completed in this session. diff --git a/RSR_COMPLIANCE.md b/RSR_COMPLIANCE.md index ad9ab43..60a17bb 100644 --- a/RSR_COMPLIANCE.md +++ b/RSR_COMPLIANCE.md @@ -1,3 +1,7 @@ + # RSR Framework Compliance Report **Project**: SafeBruteForce diff --git a/SECURITY.md b/SECURITY.md index 60a5411..f19fd6d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,4 +1,7 @@ - + # Security Policy ## Supported Versions diff --git a/TEST-NEEDS.md b/TEST-NEEDS.md index bd5ac8f..0d1f045 100644 --- a/TEST-NEEDS.md +++ b/TEST-NEEDS.md @@ -1,3 +1,7 @@ + # TEST-NEEDS.md — CRG Grade B Test Documentation ## Grade B Status: 6 Test Targets diff --git a/contractiles/README.adoc b/contractiles/README.adoc index d19a387..70ad712 100644 --- a/contractiles/README.adoc +++ b/contractiles/README.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = Contractiles Template Set :toc: :sectnums: diff --git a/docs/API_REFERENCE.md b/docs/API_REFERENCE.md index bc380dc..2d58654 100644 --- a/docs/API_REFERENCE.md +++ b/docs/API_REFERENCE.md @@ -1,3 +1,7 @@ + # SafeBruteForce API Reference Complete API documentation for SafeBruteForce modules. diff --git a/docs/CITATIONS.adoc b/docs/CITATIONS.adoc index a5e2d86..34962f2 100644 --- a/docs/CITATIONS.adoc +++ b/docs/CITATIONS.adoc @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell = safe-brute-force - Citation Guide :toc: diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md index ef0ca27..89be607 100644 --- a/docs/CONTRIBUTING.md +++ b/docs/CONTRIBUTING.md @@ -1,3 +1,7 @@ + # Contributing to SafeBruteForce Thank you for your interest in contributing to SafeBruteForce! This document provides guidelines for contributing to the project. diff --git a/docs/MULTI_LANGUAGE_ARCHITECTURE.md b/docs/MULTI_LANGUAGE_ARCHITECTURE.md index da9e22a..ef0a642 100644 --- a/docs/MULTI_LANGUAGE_ARCHITECTURE.md +++ b/docs/MULTI_LANGUAGE_ARCHITECTURE.md @@ -1,3 +1,7 @@ + # Multi-Language Architecture (iSOS Model) SafeBruteForce now implements the **iSOS (Integrated Sound Operating System)** multi-language architecture from the RSR Framework, combining the strengths of multiple type-safe languages. diff --git a/docs/QUICKSTART.md b/docs/QUICKSTART.md index c12cb32..186e36f 100644 --- a/docs/QUICKSTART.md +++ b/docs/QUICKSTART.md @@ -1,3 +1,7 @@ + # SafeBruteForce Quick Start Guide Get up and running with SafeBruteForce in 5 minutes. diff --git a/docs/REPRODUCIBLE_BUILDS.md b/docs/REPRODUCIBLE_BUILDS.md index 48288fd..f7045e5 100644 --- a/docs/REPRODUCIBLE_BUILDS.md +++ b/docs/REPRODUCIBLE_BUILDS.md @@ -1,3 +1,7 @@ + # Reproducible Builds Status and Roadmap ## Current Status: PARTIAL ⚠ī¸ diff --git a/docs/SECURITY.md b/docs/SECURITY.md index 36e767b..52eafd1 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -1,3 +1,7 @@ + # Security Best Practices ## Legal and Ethical Considerations diff --git a/docs/TYPE_SAFETY_ROADMAP.md b/docs/TYPE_SAFETY_ROADMAP.md index 0375577..f7c1481 100644 --- a/docs/TYPE_SAFETY_ROADMAP.md +++ b/docs/TYPE_SAFETY_ROADMAP.md @@ -1,3 +1,7 @@ + # Type Safety Improvement Plan for SafeBruteForce ## Current Limitation diff --git a/docs/USAGE.md b/docs/USAGE.md index 460d9eb..7506d7b 100644 --- a/docs/USAGE.md +++ b/docs/USAGE.md @@ -1,3 +1,7 @@ + # SafeBruteForce Usage Guide ## Table of Contents diff --git a/docs/tech-debt-2026-05-26.md b/docs/tech-debt-2026-05-26.md index bc8d3b4..cf4ec0e 100644 --- a/docs/tech-debt-2026-05-26.md +++ b/docs/tech-debt-2026-05-26.md @@ -1,8 +1,7 @@ - # Tech-Debt Audit — safe-brute-force — 2026-05-26 **Source:** estate-wide automated scan 2026-05-26. diff --git a/rescript_modules/README.md b/rescript_modules/README.md index c9b2df9..f80ece4 100644 --- a/rescript_modules/README.md +++ b/rescript_modules/README.md @@ -1,3 +1,7 @@ + # ReScript Pattern Generation Module This module provides **100% type-safe pattern generation** for SafeBruteForce. diff --git a/rust_nif/README.md b/rust_nif/README.md index c086e93..3c169a0 100644 --- a/rust_nif/README.md +++ b/rust_nif/README.md @@ -1,3 +1,7 @@ + # Rust NIF Module for SafeBruteForce This module provides **100% type-safe AND memory-safe** high-performance pattern generation using Rust NIFs (Native Implemented Functions). diff --git a/rust_nif/src/lib.rs b/rust_nif/src/lib.rs index 5de7406..dc499b0 100644 --- a/rust_nif/src/lib.rs +++ b/rust_nif/src/lib.rs @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell //! SafeBruteForce Rust NIF - High-Performance Pattern Generation //! //! This module provides 100% type-safe and memory-safe pattern generation From 00bd623d078d1a40b365e2d6140369d4c69b77d1 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 4 Jun 2026 18:05:04 +0100 Subject: [PATCH 06/11] chore: flatten self-validating directory structure --- .machine_readable/{svc => }/self-validating/README.adoc | 0 .../{svc => }/self-validating/examples/ci-config.k9.ncl | 0 .../{svc => }/self-validating/examples/project-metadata.k9.ncl | 0 .../{svc => }/self-validating/examples/setup-repo.k9.ncl | 0 .machine_readable/{svc => }/self-validating/template-hunt.k9.ncl | 0 .../{svc => }/self-validating/template-kennel.k9.ncl | 0 .machine_readable/{svc => }/self-validating/template-yard.k9.ncl | 0 7 files changed, 0 insertions(+), 0 deletions(-) rename .machine_readable/{svc => }/self-validating/README.adoc (100%) rename .machine_readable/{svc => }/self-validating/examples/ci-config.k9.ncl (100%) rename .machine_readable/{svc => }/self-validating/examples/project-metadata.k9.ncl (100%) rename .machine_readable/{svc => }/self-validating/examples/setup-repo.k9.ncl (100%) rename .machine_readable/{svc => }/self-validating/template-hunt.k9.ncl (100%) rename .machine_readable/{svc => }/self-validating/template-kennel.k9.ncl (100%) rename .machine_readable/{svc => }/self-validating/template-yard.k9.ncl (100%) diff --git a/.machine_readable/svc/self-validating/README.adoc b/.machine_readable/self-validating/README.adoc similarity index 100% rename from .machine_readable/svc/self-validating/README.adoc rename to .machine_readable/self-validating/README.adoc diff --git a/.machine_readable/svc/self-validating/examples/ci-config.k9.ncl b/.machine_readable/self-validating/examples/ci-config.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/examples/ci-config.k9.ncl rename to .machine_readable/self-validating/examples/ci-config.k9.ncl diff --git a/.machine_readable/svc/self-validating/examples/project-metadata.k9.ncl b/.machine_readable/self-validating/examples/project-metadata.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/examples/project-metadata.k9.ncl rename to .machine_readable/self-validating/examples/project-metadata.k9.ncl diff --git a/.machine_readable/svc/self-validating/examples/setup-repo.k9.ncl b/.machine_readable/self-validating/examples/setup-repo.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/examples/setup-repo.k9.ncl rename to .machine_readable/self-validating/examples/setup-repo.k9.ncl diff --git a/.machine_readable/svc/self-validating/template-hunt.k9.ncl b/.machine_readable/self-validating/template-hunt.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/template-hunt.k9.ncl rename to .machine_readable/self-validating/template-hunt.k9.ncl diff --git a/.machine_readable/svc/self-validating/template-kennel.k9.ncl b/.machine_readable/self-validating/template-kennel.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/template-kennel.k9.ncl rename to .machine_readable/self-validating/template-kennel.k9.ncl diff --git a/.machine_readable/svc/self-validating/template-yard.k9.ncl b/.machine_readable/self-validating/template-yard.k9.ncl similarity index 100% rename from .machine_readable/svc/self-validating/template-yard.k9.ncl rename to .machine_readable/self-validating/template-yard.k9.ncl From a5ced3f1ba18b038e89e06d2c3010d3f0579c991 Mon Sep 17 00:00:00 2001 From: Mistral Vibe Date: Sun, 7 Jun 2026 09:03:10 +0100 Subject: [PATCH 07/11] docs: Add CODEOWNERS, MAINTAINERS, and GOVERNANCE documents --- .github/CODEOWNERS | 34 ++++++++++ GOVERNANCE.adoc | 162 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 196 insertions(+) create mode 100644 .github/CODEOWNERS create mode 100644 GOVERNANCE.adoc diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..3a3b7f2 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,34 @@ +# SPDX-License-Identifier: MPL-2.0 +# CODEOWNERS - Define code review assignments for GitHub +# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners + +# Default: sole maintainer for all files +* @hyperpolymath + +# Security-sensitive files require explicit ownership +SECURITY.md @hyperpolymath +.github/workflows/ @hyperpolymath +.machine_readable/ @hyperpolymath +contractiles/ @hyperpolymath + +# License files +LICENSE @hyperpolymath +LICENSES/ @hyperpolymath + +# Configuration +.gitignore @hyperpolymath +.github/ @hyperpolymath + +# Documentation +README* @hyperpolymath +CONTRIBUTING* @hyperpolymath +CODE_OF_CONDUCT* @hyperpolymath +GOVERNANCE* @hyperpolymath +MAINTAINERS* @hyperpolymath +CHANGELOG* @hyperpolymath +ROADMAP* @hyperpolymath + +# Build and CI +Justfile @hyperpolymath +Makefile @hyperpolymath +*.sh @hyperpolymath diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc new file mode 100644 index 0000000..8bbf167 --- /dev/null +++ b/GOVERNANCE.adoc @@ -0,0 +1,162 @@ +// SPDX-License-Identifier: MPL-2.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += Governance Model +:toc: preamble + +This document describes the governance model for this repository. + +== Overview + +This repository follows a **Sole Maintainer Governance Model**: + +* Single maintainer (@hyperpolymath) has full authority over the project +* All contributions are welcome and reviewed by the maintainer +* Decisions are made transparently through GitHub issues and discussions +* The project adheres to the hyperpolymath estate policies where applicable + +== Core Principles + +[cols="1,2"] +|=== +| Principle | Description + +| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input + +| **Meritocracy** | Contributions are judged on technical merit, not contributor identity + +| **Transparency** | All significant decisions are documented publicly + +| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary + +| **Open Contribution** | Anyone can contribute via fork and pull request + +|=== + +== Roles and Permissions + +[cols="1,2,2"] +|=== +| Role | Permissions | Assignment + +| **Maintainer** | Write access, merge rights, admin | @hyperpolymath +| **Contributors** | Read access, fork, submit PRs | All GitHub users +| **Users** | Use the software, report issues | All GitHub users + +|=== + +== Decision Making Framework + +=== Routine Decisions + +* Bug fixes +* Documentation improvements +* Minor feature additions +* Dependency updates + +**Process**: Maintainer reviews and merges PRs that meet quality standards. + +=== Significant Changes + +* New major features +* API changes +* Architecture modifications +* Breaking changes + +**Process**: +. Open issue describing the change +. Discuss with community (minimum 72 hours) +. Maintainer makes final decision +. Document rationale in issue/PR + +=== Structural Decisions + +* Repository purpose/renaming +* License changes +* Ownership transfer +* Deprecation/archival + +**Process**: +. Extended discussion (minimum 1 week) +. Maintainer makes final decision +. Document in CHANGELOG and governance docs + +== Contribution Lifecycle + +[cols="1,2"] +|=== +| Stage | Process + +| **Ideation** | Open issue, discuss feasibility + +| **Development** | Fork, implement, test thoroughly + +| **Review** | Submit PR, maintainer reviews within 7 days + +| **Merge** | Maintainer merges or requests changes + +| **Release** | Maintainer publishes according to project conventions + +|=== + +== Conflict Resolution + +In case of disagreements: + +. Discuss in the relevant GitHub issue or PR +. Provide technical justification for positions +. Maintainer mediates and makes final decision +. Decision is documented and can be revisited later + +== Project Policies + +This repository adheres to hyperpolymath estate-wide policies: + +* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc) +* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md +* **Security**: Follows hyperpolymath SECURITY.md +* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions + +== Repository-Specific Conventions + +[cols="1,2"] +|=== +| Convention | Description + +| **Signing** | All commits must be signed (SSH or GPG) + +| **SPDX Headers** | All source files must have SPDX license identifiers + +| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root + +| **Machine Readable** | META.a2ml in .machine_readable/6a2/ + +| **CI/CD** | GitHub Actions workflows in .github/workflows/ + +|=== + +== Governance Evolution + +As the project grows, this governance model may evolve: + +* **Adding Co-Maintainers**: When contribution volume warrants it +* **Forming a Team**: For complex multi-maintainer projects +* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories) + +Changes to this document require the same process as Significant Changes above. + +== See Also + +* link:MAINTAINERS.adoc[Maintainers] +* link:CODE_OF_CONDUCT.md[Code of Conduct] +* link:CONTRIBUTING.adoc[Contributing Guide] +* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy] +* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)] + +== Changelog + +[cols="1,1,1"] +|=== +| Date | Change | By + +| 2026-06-07 | Initial governance model established | @hyperpolymath +|=== From 5912a37b59e77a682ded6d41dd3fab955ac56725 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 7 Jun 2026 23:36:08 +0100 Subject: [PATCH 08/11] Apply estate standardization: governance docs, contractiles, CI/CD cleanup --- .../contractiles/Adjustfile.a2ml | 72 +++++++++++++ .../contractiles/Intentfile.a2ml | 99 +++++++++++++++++ .machine_readable/contractiles/Justfile | 88 +++++++++++++++ .machine_readable/contractiles/Mustfile.a2ml | 102 ++++++++++++++++++ .machine_readable/contractiles/Trustfile.a2ml | 88 +++++++++++++++ contractiles/README.adoc | 21 ---- contractiles/dust/Dustfile | 29 ----- contractiles/must/Mustfile | 35 ------ manifest.scm | 24 +++++ 9 files changed, 473 insertions(+), 85 deletions(-) create mode 100644 .machine_readable/contractiles/Adjustfile.a2ml create mode 100644 .machine_readable/contractiles/Intentfile.a2ml create mode 100644 .machine_readable/contractiles/Justfile create mode 100644 .machine_readable/contractiles/Mustfile.a2ml create mode 100644 .machine_readable/contractiles/Trustfile.a2ml delete mode 100644 contractiles/README.adoc delete mode 100644 contractiles/dust/Dustfile delete mode 100644 contractiles/must/Mustfile create mode 100644 manifest.scm diff --git a/.machine_readable/contractiles/Adjustfile.a2ml b/.machine_readable/contractiles/Adjustfile.a2ml new file mode 100644 index 0000000..6f01e89 --- /dev/null +++ b/.machine_readable/contractiles/Adjustfile.a2ml @@ -0,0 +1,72 @@ +# SPDX-License-Identifier: MPL-2.0 +# Adjustfile — Drift-tolerance contract for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Cumulative-drift catchment: tolerance bands + corrective actions. +# Authority: advisory (Yard) — continue-with-warnings; auto_fix where deterministic. +# Run with: adjust check +# Fix with: adjust fix (applies deterministic patches; advisory otherwise) + +@abstract: +Drift tolerances and corrective actions for rsr-template-repo. Unlike +MUST (hard gate), ADJUST tracks cumulative drift against tolerance bands +and proposes corrective actions. Advisory — it warns and trends, it does +not block. +@end + +## Template Drift + +### placeholder-drift +- description: Template placeholders should be replaced when copied +- tolerance: 0 placeholder markers in copied repos +- corrective: Search and replace all {{PLACEHOLDER}} markers +- severity: advisory +- notes: This check only applies to repos that copied from this template + +### template-version-drift +- description: Template version should match RSR spec version +- tolerance: Template version matches current RSR spec +- corrective: Update template to match latest RSR spec +- severity: advisory + +## Documentation Drift + +### readme-completeness +- description: README should document all template features +- tolerance: README covers all contractiles and directory structure +- corrective: Update README.adoc with missing sections +- severity: advisory + +### example-accuracy +- description: Examples in documentation should match actual template content +- tolerance: All code examples in docs are accurate +- corrective: Audit and fix examples in documentation +- severity: advisory + +## Structural Drift + +### contractile-sync +- description: All contractiles should have matching a2ml and ncl implementations +- tolerance: Every .a2ml has a corresponding .ncl +- corrective: Generate missing .ncl files from .a2ml +- severity: advisory + +### no-broken-symlinks +- description: No broken symbolic links in template structure +- tolerance: 0 broken symlinks +- corrective: Run symlink-check script +- severity: advisory + +## Accessibility Drift + +### adoc-not-md +- description: Template docs should prefer AsciiDoc +- tolerance: New prose docs are *.adoc +- corrective: Convert any new *.md to *.adoc +- severity: advisory + +### spdx-header-consistency +- description: All template files have correct SPDX headers +- tolerance: 0 files missing SPDX-License-Identifier +- corrective: Add SPDX headers to files that need them +- severity: advisory diff --git a/.machine_readable/contractiles/Intentfile.a2ml b/.machine_readable/contractiles/Intentfile.a2ml new file mode 100644 index 0000000..ef74f45 --- /dev/null +++ b/.machine_readable/contractiles/Intentfile.a2ml @@ -0,0 +1,99 @@ +# SPDX-License-Identifier: MPL-2.0 +# Intentfile (A2ML Canonical) — north-star contractile for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Paired runner: intend.ncl +# Verb: intend +# +# Semantics: North-star contractile. Declares BOTH concrete committed +# next-actions AND horizon aspirations the project wishes to +# become. Two sections share one file because they answer +# the same question at different ranges: +# [[intents]] — "we WILL do this; track progress" +# status: declared → in_progress → done | +# deferred | retired +# [[wishes]] — "we WISH this were true; revisit later" +# status: declared → in_progress → achieved | +# abandoned +# grouped by horizon: near / mid / far. +# Non-gating — this is a report, not a gate. See the `must` +# contractile for hard gates. + +@abstract: +North-star contractile for rsr-template-repo. This repository is the +canonical template for Rhodium Standard Repository compliance. It provides +the scaffold that all hyperpolymath repos should copy and customize. +@end + +## Purpose + +The rsr-template-repo serves as the master template for all hyperpolymath +repositories. It contains the complete set of contractile files, machine-readable +specifications, and governance documentation that define the Rhodium Standard. + +Every new repository in the hyperpolymath estate should be initialized by +copying this template and substituting the placeholder values with +repo-specific content. + +## Anti-Purpose + +This repository is NOT: +- A general-purpose project scaffold for external use (hyperpolymath-only) +- A replacement for per-repo customization (all files must be bespoke) +- A static template that never changes (evolves with RSR spec) +- A runtime library or framework (build-time only) + +## If In Doubt + +If you are unsure whether a change is in scope, ask. Sensitive areas: +- .machine_readable/ contractile definitions +- RSR specification files +- Governance templates +- License policy documents + +## Committed Next-Actions + +### repo-initialization +- description: Provide just copy-and-substitute template for new repos +- probe: test -f scripts/init-repo.sh +- status: done +- notes: Run with source scripts/init-repo.sh + +### contractile-completeness +- description: Every RSR contractile has an a2ml and ncl implementation +- probe: ls .machine_readable/contractiles/*.a2ml | wc -l | grep -q "^6$" +- status: in_progress +- notes: Currently 6 contractile verbs: intend, must, trust, adjust, bust, dust + +### automation-scripts +- description: All repetitive tasks have just recipes +- probe: grep -c "^# " Justfile | grep -q "^[6-9][0-9]*$" +- status: in_progress + +## Wishes + +### Near Horizon + +#### cross-repo-validation +- description: Tooling to validate all repos against RSR spec +- horizon: near +- status: declared + +#### automated-substitution +- description: Script to automate repo-specific substitution in template +- horizon: near +- status: declared + +### Mid Horizon + +#### formal-verification +- description: Idris2 proofs for all critical contractile invariants +- horizon: mid +- status: declared + +### Far Horizon + +#### ecosystem-visualization +- description: Interactive graph of all hyperpolymath repos and dependencies +- horizon: far +- status: declared diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile new file mode 100644 index 0000000..7999a6b --- /dev/null +++ b/.machine_readable/contractiles/Justfile @@ -0,0 +1,88 @@ +import? "contractile.just" + +# safe-brute-force - Nix Development Tasks +set shell := ["bash", "-uc"] +set dotenv-load := true + +project := "safe-brute-force" + +# Show all recipes +default: + @just --list --unsorted + +# Build with nix +build: + nix build + +# Build and show output path +build-show: + nix build --print-out-paths + +# Enter dev shell +develop: + nix develop + +# Check flake +check: + nix flake check + +# Update flake inputs +update: + nix flake update + +# Show flake info +info: + nix flake info + +# Format nix files +fmt: + nixfmt *.nix || nix fmt + +# Run nix linter +lint: + statix check . || true + +# Clean +clean: + rm -rf result + +# Show derivation +show-drv: + nix derivation show + +# All checks before commit +pre-commit: check + @echo "All checks passed!" + +# ── CRG Grade B: 6 independently runnable test targets ────────────────────── + +# T1: LFE unit tests via rebar3 +test-lfe: + rebar3 lfe test + +# T2: Structural validation (required files and directories) +test-structure: + bash tests/validate_structure.sh + +# T3: Compilation check (degrades gracefully on pre-existing code errors) +test-compile: + rebar3 compile && echo "PASS: rebar3 compile" || echo "SKIP: rebar3 compile errors in existing code (not a test-suite regression)" + +# T4: Static analysis (xref) +test-static: + rebar3 xref || true + +# T5: Nickel k9 contractile typecheck (strips K9! header before checking) +test-nickel: + @if command -v nickel &>/dev/null; then \ + tail -n +2 contractiles/k9/template-yard.k9.ncl | nickel typecheck /dev/stdin && echo "PASS: nickel typecheck"; \ + else \ + echo "SKIP: nickel not installed"; \ + fi + +# T6: Validate examples/*.lfe for syntax errors +test-examples: + bash tests/validate_examples.sh + +# Run all 6 Grade B test targets +test: test-lfe test-structure test-compile test-static test-nickel test-examples diff --git a/.machine_readable/contractiles/Mustfile.a2ml b/.machine_readable/contractiles/Mustfile.a2ml new file mode 100644 index 0000000..55f8ab4 --- /dev/null +++ b/.machine_readable/contractiles/Mustfile.a2ml @@ -0,0 +1,102 @@ +# SPDX-License-Identifier: MPL-2.0 +# Mustfile — Physical state contract for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# What MUST be true about this repository. Hard requirements. +# Run with: must check +# Fix with: must fix (where a deterministic fix exists) + +@abstract: +Physical-state invariants for rsr-template-repo. This is the canonical +RSR template repository. These are hard requirements — CI and pre-commit +hooks fail if any check fails. +@end + +## File Presence + +### license-present +- description: LICENSE file must exist +- run: test -f LICENSE +- severity: critical + +### readme-present +- description: README.adoc must exist +- run: test -f README.adoc +- severity: critical + +### security-policy +- description: SECURITY.md must exist +- run: test -f SECURITY.md +- severity: critical + +### ai-manifest +- description: 0-AI-MANIFEST.a2ml must exist +- run: test -f 0-AI-MANIFEST.a2ml +- severity: critical + +### governance-docs +- description: GOVERNANCE.adoc, MAINTAINERS.adoc, CODEOWNERS must exist +- run: test -f GOVERNANCE.adoc && test -f MAINTAINERS.adoc && test -f .github/CODEOWNERS +- severity: critical + +### machine-readable-dir +- description: .machine_readable/ directory must exist +- run: test -d .machine_readable +- severity: critical + +## Directory Structure + +### contractiles-complete +- description: All required contractile directories exist +- run: test -d .machine_readable/contractiles && test -d .machine_readable/contractiles/bust && test -d .machine_readable/contractiles/dust +- severity: critical + +### contractiles-files-present +- description: All four primary contractile files exist +- run: test -f .machine_readable/contractiles/Intentfile.a2ml && test -f .machine_readable/contractiles/Mustfile.a2ml && test -f .machine_readable/contractiles/Trustfile.a2ml && test -f .machine_readable/contractiles/Adjustfile.a2ml +- severity: critical + +### bust-dust-files-present +- description: Bustfile and Dustfile exist in their directories +- run: test -f .machine_readable/contractiles/bust/Bustfile.a2ml && test -f .machine_readable/contractiles/dust/Dustfile.a2ml +- severity: critical + +### six-directory-present +- description: 6a2 directory exists with required files +- run: test -d .machine_readable/6a2 && test -f .machine_readable/6a2/META.a2ml && test -f .machine_readable/6a2/ECOSYSTEM.a2ml && test -f .machine_readable/6a2/STATE.a2ml && test -f .machine_readable/6a2/PLAYBOOK.a2ml && test -f .machine_readable/6a2/AGENTIC.a2ml && test -f .machine_readable/6a2/NEUROSYM.a2ml +- severity: critical + +### anchors-directory +- description: anchors directory exists in 6a2 +- run: test -d .machine_readable/6a2/anchors +- severity: warning + +### self-validating-structure +- description: self-validating directory has k9-svc and examples +- run: test -d .machine_readable/self-validating && test -d .machine_readable/self-validating/k9-svc && test -d .machine_readable/self-validating/examples +- severity: warning + +## Template Integrity + +### no-placeholder-values +- description: No placeholder values remain in template files +- run: test -z "$(grep -r '{{' .machine_readable/contractiles/ 2>/dev/null)" +- severity: critical +- notes: All placeholders must be substituted when copying this template + +### template-readonly +- description: Template marker files are not modified +- run: grep -q 'RSR_TEMPLATE_DO_NOT_EDIT' .machine_readable/0.1-AI-MANIFEST.a2ml +- severity: warning + +## Git State + +### no-untracked-contractiles +- description: All contractile files are tracked in git +- run: test -z "$(git ls-files -o --exclude-standard .machine_readable/contractiles/ 2>/dev/null)" +- severity: critical + +### signed-commits +- description: All commits must be signed +- run: git verify-commit HEAD +- severity: critical diff --git a/.machine_readable/contractiles/Trustfile.a2ml b/.machine_readable/contractiles/Trustfile.a2ml new file mode 100644 index 0000000..e2028b5 --- /dev/null +++ b/.machine_readable/contractiles/Trustfile.a2ml @@ -0,0 +1,88 @@ +# SPDX-License-Identifier: MPL-2.0 +# Trustfile — Trust boundaries and integrity invariants for rsr-template-repo +# Author: Jonathan D.A. Jewell +# +# Defines what LLM/SLM agents are trusted to do without asking, and +# integrity invariants that verify the repo has not been tampered with. + +@abstract: +Trust boundaries and integrity checks for rsr-template-repo. This file +combines the trust-level definitions from the original TRUST.contractile +with the integrity invariants from the old Trustfile.a2ml. It defines +what AI agents may do autonomously and what requires human approval, +plus checks that verify repository integrity. +@end + +## Trust Levels + +The rsr-template-repo operates at trust level: maximal + +Trust levels: +- maximal: Agent may read, build, test, lint, format, heal freely. + Only destructive/external actions require approval. +- standard: Agent may read and build. Test/lint need approval. +- restricted: Agent may read only. All modifications need approval. +- minimal: Agent may read specific files only. Everything else blocked. + +Current trust level: maximal + +## Integrity Invariants + +### Secrets + +#### no-secrets-committed +- description: No credential files in repo +- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production +- severity: critical + +#### no-private-keys +- description: No private key files committed +- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." +- severity: critical + +#### no-tokens-in-source +- description: No hardcoded API tokens in source +- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." +- severity: critical + +## Provenance + +#### author-correct +- description: Git author matches expected identity +- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" +- severity: warning + +#### license-content +- description: LICENSE contains expected identifier +- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE +- severity: warning + +## Template-Specific Trust + +### template-files-readonly +- description: Template scaffold files should not be modified except by maintainer +- run: test -z "$(git status --short .machine_readable/ 2>/dev/null | grep -v '^??' || true)" +- severity: advisory +- notes: Changes to template files require careful review + +### trust-deny-areas +- description: Sensitive areas from INTENT.contractile require explicit approval +- run: echo "Check .machine_readable/ contractiles and governance docs" +- severity: advisory +- areas: + - .machine_readable/ + - GOVERNANCE.adoc + - MAINTAINERS.adoc + - .github/CODEOWNERS + +## Container Security + +#### container-images-pinned +- description: Containerfile uses pinned base images +- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile +- severity: warning + +#### no-dockerfile +- description: No Dockerfile (use Containerfile) +- run: test ! -f Dockerfile +- severity: warning diff --git a/contractiles/README.adoc b/contractiles/README.adoc deleted file mode 100644 index 70ad712..0000000 --- a/contractiles/README.adoc +++ /dev/null @@ -1,21 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) Jonathan D.A. Jewell -= Contractiles Template Set -:toc: -:sectnums: - -This directory contains the generalized contractiles templates. Copy the `contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework. - -== Fill-In Instructions - -1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports). -2. Replace Trustfile.hs placeholders with your actual key paths and verification commands. -3. Adjust Dustfile handlers to match your rollback and recovery tooling. -4. Update Intentfile to mirror the roadmap you want the system to evolve toward. - -== Contents - -* `must/Mustfile` - required invariants and validations. -* `trust/Trustfile.hs` - cryptographic verification steps. -* `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. diff --git a/contractiles/dust/Dustfile b/contractiles/dust/Dustfile deleted file mode 100644 index 6f93c6a..0000000 --- a/contractiles/dust/Dustfile +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: PLMP-1.0-or-later -# Dustfile template - recovery and rollback semantics - -version: 1 - -recovery: - logs: - - name: decision-log - path: logs/decisions.json - reversible: true - handler: "log-replay --reverse logs/decisions.json" - - policy: - - name: policy-rollback - path: policy/policy.ncl - rollback: "git checkout HEAD~1 -- policy/policy.ncl" - notes: "Rollback policy to the previous known-good revision." - - gateway: - - name: bad-deployment - event: "deploy.failure" - undo: "kubectl rollout undo deployment/gateway" - notes: "Undo a failed deployment while preserving audit logs." - - dust-events: - - name: decision-log-to-dust - source: logs/decisions.json - transform: "dustify --input logs/decisions.json --output logs/dust-events.json" - notes: "Map gateway decision logs into reversible dust events." diff --git a/contractiles/must/Mustfile b/contractiles/must/Mustfile deleted file mode 100644 index dc2c6b6..0000000 --- a/contractiles/must/Mustfile +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: PLMP-1.0-or-later -# Mustfile - declarative state contract (template) -# See: https://github.com/hyperpolymath/mustfile - -version: 1 - -metadata: - name: project-state-contract - spec: v0.0.1 - description: "Invariant checks for config, policy, gateway, logs, and schema." - -parameters: - gateway_port: "8080" - schema_version: "v0.0.1" - -checks: - - name: config-valid - description: "config/service.yaml must be valid." - run: "yq -e '.' config/service.yaml >/dev/null" - - - name: policy-compiles - description: "policy/policy.ncl must compile." - run: "nickel check policy/policy.ncl" - - - name: gateway-exposes-port - description: "Service must expose the configured port." - run: "bash -uc 'ss -lnt | rg \":${GATEWAY_PORT:-8080}\"'" - - - name: logs-are-json - description: "Logs must be JSON." - run: "bash -uc 'rg --files -g \"*.json\" logs | xargs -r jq -e .'" - - - name: schema-version-matches - description: "Schema must match version spec." - run: "bash -uc 'rg -n \"${SCHEMA_VERSION:-v0.0.1}\" schema'" diff --git a/manifest.scm b/manifest.scm new file mode 100644 index 0000000..dd942c7 --- /dev/null +++ b/manifest.scm @@ -0,0 +1,24 @@ +;;; SPDX-License-Identifier: MPL-2.0 +;;; manifest.scm — Generic Guix manifest for RSR-compliant projects +;;; +;;; Usage: +;;; guix shell -m manifest.scm +;;; + +(specifications->manifest + '(;; Core development tools + "git" + "just" + "nickel" + "curl" + "bash" + "coreutils" + + ;; Documentation + "asciidoctor" + "pandoc" + + ;; Common build dependencies + "openssl" + "zlib" + "pkg-config")) From f6866aee8d29dd6f65e7594d997c5dbeb8c61b1b Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 11 Jun 2026 22:15:51 +0100 Subject: [PATCH 09/11] security: standardize secret scanning on TruffleHog --- .github/workflows/ci.yml | 96 +------------------ .github/workflows/codeql.yml | 106 ++++++++++----------- .github/workflows/dependabot-automerge.yml | 12 +-- .github/workflows/governance.yml | 4 - .github/workflows/hypatia-scan.yml | 4 - .github/workflows/instant-sync.yml | 4 - .github/workflows/jekyll-gh-pages.yml | 6 -- .github/workflows/mirror.yml | 3 - .github/workflows/scorecard-enforcer.yml | 16 +--- .github/workflows/scorecard.yml | 3 - .github/workflows/secret-scanner.yml | 14 ++- .github/workflows/workflow-linter.yml | 6 -- .gitlab-ci.yml | 50 +++------- .machine_readable/contractiles/Justfile | 3 + Justfile | 3 + 15 files changed, 82 insertions(+), 248 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 94b8e38..df310e2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,22 +3,18 @@ # Erlang/OTP + LFE project name: CI - on: push: - branches: [ main, develop, claude/* ] + branches: [main, develop, claude/*] pull_request: - branches: [ main, develop ] + branches: [main, develop] schedule: # Run tests daily at 2 AM UTC - cron: '0 2 * * *' - env: OTP_VERSION: '26.2' REBAR3_VERSION: '3.22.1' - permissions: read-all - jobs: ########################################################################### # Build Job @@ -27,17 +23,14 @@ jobs: name: Build runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Setup Erlang/OTP uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ env.OTP_VERSION }} rebar3-version: ${{ env.REBAR3_VERSION }} - - name: Cache build artifacts uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4 with: @@ -47,20 +40,16 @@ jobs: key: ${{ runner.os }}-build-${{ hashFiles('rebar.config') }}-${{ hashFiles('rebar.lock') }} restore-keys: | ${{ runner.os }}-build- - - name: Get dependencies run: rebar3 get-deps - - name: Compile run: rebar3 compile - - name: Upload build artifacts uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-artifacts path: _build/ retention-days: 1 - ########################################################################### # Test Jobs ########################################################################### @@ -69,31 +58,25 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 needs: build - strategy: matrix: otp: ['26', '27'] fail-fast: false - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Setup Erlang/OTP uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ matrix.otp }} rebar3-version: ${{ env.REBAR3_VERSION }} - - name: Download build artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: build-artifacts path: _build/ - - name: Run tests run: rebar3 lfe test - - name: Upload test results if: always() uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 @@ -101,7 +84,6 @@ jobs: name: test-results-otp${{ matrix.otp }} path: _build/test/logs/ retention-days: 7 - ########################################################################### # Coverage Job ########################################################################### @@ -110,36 +92,29 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 needs: build - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Setup Erlang/OTP uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ env.OTP_VERSION }} rebar3-version: ${{ env.REBAR3_VERSION }} - - name: Download build artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: build-artifacts path: _build/ - - name: Run tests with coverage run: rebar3 lfe test --cover - - name: Generate coverage report run: rebar3 cover --verbose - - name: Upload coverage to Codecov uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6 with: files: _build/test/cover/cobertura.xml fail_ci_if_error: false verbose: true - ########################################################################### # Static Analysis ########################################################################### @@ -148,17 +123,14 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 needs: build - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Setup Erlang/OTP uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ env.OTP_VERSION }} rebar3-version: ${{ env.REBAR3_VERSION }} - - name: Cache PLT uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4 with: @@ -166,17 +138,14 @@ jobs: key: ${{ runner.os }}-plt-${{ hashFiles('rebar.config') }} restore-keys: | ${{ runner.os }}-plt- - - name: Download build artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: build-artifacts path: _build/ - - name: Run Dialyzer run: rebar3 dialyzer continue-on-error: true - ########################################################################### # Security Checks ########################################################################### @@ -184,11 +153,9 @@ jobs: name: Security Checks runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Check for hardcoded secrets run: | echo "Checking for hardcoded passwords..." @@ -198,7 +165,6 @@ jobs: echo "Checking for API keys..." ! grep -r "api_key\s*=" src/ || (echo "❌ Found hardcoded API keys" && exit 1) echo "✓ No hardcoded API keys found" - - name: Verify safety mechanisms run: | echo "Checking for pause mechanism..." @@ -208,7 +174,6 @@ jobs: echo "Checking for rate limiting..." grep -r "rate_limit" src/ || (echo "❌ Rate limiting missing!" && exit 1) echo "✓ Rate limiting verified" - ########################################################################### # RSR Compliance Check ########################################################################### @@ -216,60 +181,17 @@ jobs: name: RSR Framework Compliance runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Check required files - run: | - echo "Checking RSR Bronze Level compliance..." - - echo "✓ Checking core documentation..." - test -f README.md || (echo "❌ README.md missing" && exit 1) - test -f LICENSE || (echo "❌ LICENSE missing" && exit 1) - test -f CHANGELOG.md || (echo "❌ CHANGELOG.md missing" && exit 1) - test -f CODE_OF_CONDUCT.md || (echo "❌ CODE_OF_CONDUCT.md missing" && exit 1) - test -f MAINTAINERS.md || (echo "❌ MAINTAINERS.md missing" && exit 1) - - echo "✓ Checking documentation directory..." - test -f docs/CONTRIBUTING.md || (echo "❌ CONTRIBUTING.md missing" && exit 1) - test -f docs/SECURITY.md || (echo "❌ SECURITY.md missing" && exit 1) - test -f docs/USAGE.md || (echo "❌ USAGE.md missing" && exit 1) - test -f docs/API_REFERENCE.md || (echo "❌ API_REFERENCE.md missing" && exit 1) - test -f docs/QUICKSTART.md || (echo "❌ QUICKSTART.md missing" && exit 1) - - echo "✓ Checking .well-known directory..." - test -f .well-known/security.txt || (echo "❌ security.txt missing" && exit 1) - test -f .well-known/ai.txt || (echo "❌ ai.txt missing" && exit 1) - test -f .well-known/humans.txt || (echo "❌ humans.txt missing" && exit 1) - - echo "✓ Checking build system..." - test -f rebar.config || (echo "❌ rebar.config missing" && exit 1) - test -f Makefile || (echo "❌ Makefile missing" && exit 1) - - echo "" - echo "🎉 RSR Bronze Level Compliance: VERIFIED" - echo "" - echo "RSR Compliance Checklist:" - echo "✓ Documentation complete" - echo "✓ .well-known/ directory present" - echo "✓ Build system configured" - echo "✓ Code of Conduct adopted" - echo "✓ Security policy defined" - echo "✓ License specified (MIT)" - echo "✓ Contribution guidelines available" - echo "✓ Maintainers documented" - echo "" - echo "TPCF Perimeter: 3 (Community Sandbox)" - + run: "echo \"Checking RSR Bronze Level compliance...\"\n\necho \"✓ Checking core documentation...\"\ntest -f README.md || (echo \"❌ README.md missing\" && exit 1)\ntest -f LICENSE || (echo \"❌ LICENSE missing\" && exit 1)\ntest -f CHANGELOG.md || (echo \"❌ CHANGELOG.md missing\" && exit 1)\ntest -f CODE_OF_CONDUCT.md || (echo \"❌ CODE_OF_CONDUCT.md missing\" && exit 1)\ntest -f MAINTAINERS.md || (echo \"❌ MAINTAINERS.md missing\" && exit 1)\n\necho \"✓ Checking documentation directory...\"\ntest -f docs/CONTRIBUTING.md || (echo \"❌ CONTRIBUTING.md missing\" && exit 1)\ntest -f docs/SECURITY.md || (echo \"❌ SECURITY.md missing\" && exit 1)\ntest -f docs/USAGE.md || (echo \"❌ USAGE.md missing\" && exit 1)\ntest -f docs/API_REFERENCE.md || (echo \"❌ API_REFERENCE.md missing\" && exit 1)\ntest -f docs/QUICKSTART.md || (echo \"❌ QUICKSTART.md missing\" && exit 1)\n\necho \"✓ Checking .well-known directory...\"\ntest -f .well-known/security.txt || (echo \"❌ security.txt missing\" && exit 1)\ntest -f .well-known/ai.txt || (echo \"❌ ai.txt missing\" && exit 1)\ntest -f .well-known/humans.txt || (echo \"❌ humans.txt missing\" && exit 1)\n\necho \"✓ Checking build system...\"\ntest -f rebar.config || (echo \"❌ rebar.config missing\" && exit 1)\ntest -f Makefile || (echo \"❌ Makefile missing\" && exit 1)\n\necho \"\"\necho \"\U0001F389 RSR Bronze Level Compliance: VERIFIED\"\necho \"\"\necho \"RSR Compliance Checklist:\"\necho \"✓ Documentation complete\"\necho \"✓ .well-known/ directory present\"\necho \"✓ Build system configured\"\necho \"✓ Code of Conduct adopted\"\necho \"✓ Security policy defined\"\necho \"✓ License specified (MIT)\"\necho \"✓ Contribution guidelines available\"\necho \"✓ Maintainers documented\"\necho \"\"\necho \"TPCF Perimeter: 3 (Community Sandbox)\"\n" - name: Validate security.txt (RFC 9116) run: | echo "Validating security.txt format..." grep -q "Contact:" .well-known/security.txt || (echo "❌ Missing Contact field" && exit 1) grep -q "Expires:" .well-known/security.txt || (echo "❌ Missing Expires field" && exit 1) echo "✓ security.txt format valid" - ########################################################################### # Documentation ########################################################################### @@ -278,34 +200,28 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 needs: build - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Setup Erlang/OTP uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ env.OTP_VERSION }} rebar3-version: ${{ env.REBAR3_VERSION }} - - name: Download build artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: build-artifacts path: _build/ - - name: Build EDoc run: rebar3 edoc continue-on-error: true - - name: Upload documentation uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: documentation path: doc/ retention-days: 30 - ########################################################################### # Release (on tags) ########################################################################### @@ -315,22 +231,18 @@ jobs: timeout-minutes: 15 needs: [test, coverage, security, rsr-compliance] if: startsWith(github.ref, 'refs/tags/v') - steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Setup Erlang/OTP uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1 with: otp-version: ${{ env.OTP_VERSION }} rebar3-version: ${{ env.REBAR3_VERSION }} - - name: Build release run: | rebar3 as prod release rebar3 as prod tar - - name: Create GitHub Release uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3 with: @@ -340,7 +252,6 @@ jobs: prerelease: false env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - ########################################################################### # Notify ########################################################################### @@ -350,7 +261,6 @@ jobs: timeout-minutes: 15 needs: [test, coverage, security, rsr-compliance] if: failure() - steps: - name: Notify failure run: | diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2b3d0ad..11cf6f9 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -11,18 +11,14 @@ # supported CodeQL languages. # name: "CodeQL Advanced" - on: push: - branches: [ "main" ] + branches: ["main"] pull_request: - branches: [ "main" ] + branches: ["main"] schedule: - cron: '37 15 * * 1' - - permissions: read-all - jobs: analyze: name: Analyze (${{ matrix.language }}) @@ -36,69 +32,63 @@ jobs: permissions: # required for all workflows security-events: write - # required to fetch internal or private CodeQL packs packages: read - # only required for workflows in private repositories actions: read contents: read - strategy: fail-fast: false matrix: include: - - language: javascript-typescript - build-mode: none - # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' - # Use `c-cpp` to analyze code written in C, C++ or both - # Use 'java-kotlin' to analyze code written in Java, Kotlin or both - # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both - # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, - # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. - # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how - # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages + - language: javascript-typescript + build-mode: none + # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' + # Use `c-cpp` to analyze code written in C, C++ or both + # Use 'java-kotlin' to analyze code written in Java, Kotlin or both + # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both + # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, + # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. + # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how + # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - # Add any setup steps before running the `github/codeql-action/init` action. - # This includes steps like installing compilers or runtimes (`actions/setup-node` - # or others). This is typically only required for manual builds. - # - name: Setup runtime (example) - # uses: actions/setup-example@v1 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@4bdb89f48054571735e3792627da6195c57459e2 # v3 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + # Add any setup steps before running the `github/codeql-action/init` action. + # This includes steps like installing compilers or runtimes (`actions/setup-node` + # or others). This is typically only required for manual builds. + # - name: Setup runtime (example) + # uses: actions/setup-example@v1 + uses: github/codeql-action/init@4bdb89f48054571735e3792627da6195c57459e2 # v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + # If the analyze step fails for one of the languages you are analyzing with + # "We were unable to automatically build your code", modify the matrix above + # to set the build mode to "manual" for that language. Then modify this step + # to build your code. + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + - name: Run manual build steps # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs # queries: security-extended,security-and-quality - # If the analyze step fails for one of the languages you are analyzing with - # "We were unable to automatically build your code", modify the matrix above - # to set the build mode to "manual" for that language. Then modify this step - # to build your code. - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - name: Run manual build steps - if: matrix.build-mode == 'manual' - shell: bash - run: | - echo 'If you are using a "manual" build mode for one or more of the' \ - 'languages you are analyzing, replace this with the commands to build' \ - 'your code, for example:' - echo ' make bootstrap' - echo ' make release' - exit 1 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@4bdb89f48054571735e3792627da6195c57459e2 # v3 - with: - category: "/language:${{matrix.language}}" + if: matrix.build-mode == 'manual' + shell: bash + run: | + echo 'If you are using a "manual" build mode for one or more of the' \ + 'languages you are analyzing, replace this with the commands to build' \ + 'your code, for example:' + echo ' make bootstrap' + echo ' make release' + exit 1 + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@4bdb89f48054571735e3792627da6195c57459e2 # v3 + with: + category: "/language:${{matrix.language}}" diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 3d0e8de..cff4451 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -35,30 +35,25 @@ # bumps for dependabot/fetch-metadata flow through the same path. name: Dependabot Auto-Merge - on: pull_request: types: [opened, reopened, synchronize] - permissions: - contents: write # needed to enable auto-merge - pull-requests: write # needed to approve + contents: write # needed to enable auto-merge + pull-requests: write # needed to approve # NB: keep narrow — do NOT add secrets: read or id-token: write here. - jobs: automerge: # Only run for PRs actually authored by Dependabot. if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest timeout-minutes: 15 - steps: - name: Fetch Dependabot metadata id: meta uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} - # --- Policy gate ------------------------------------------------------- # Outputs from fetch-metadata we care about: # update-type → version-update:semver-{patch,minor,major} @@ -107,7 +102,6 @@ jobs: echo "security=$is_security" >> "$GITHUB_OUTPUT" echo "update_type=$UPDATE_TYPE" >> "$GITHUB_OUTPUT" echo "ghsa=$GHSA_ID" >> "$GITHUB_OUTPUT" - - name: Approve PR (if policy allows) if: steps.policy.outputs.action == 'automerge' env: @@ -116,7 +110,6 @@ jobs: run: | gh pr review --approve "$PR_URL" \ --body "Auto-approving Dependabot security update (${{ steps.policy.outputs.ghsa }}, ${{ steps.policy.outputs.update_type }}). Policy: low/moderate security patches/minors only." - - name: Enable auto-merge (if policy allows) if: steps.policy.outputs.action == 'automerge' env: @@ -124,7 +117,6 @@ jobs: PR_URL: ${{ github.event.pull_request.html_url }} run: | gh pr merge --auto --squash "$PR_URL" - - name: Write decision to step summary env: ACTION: ${{ steps.policy.outputs.action }} diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 1b4e269..e0c379b 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -11,13 +11,11 @@ # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). name: Governance - on: push: branches: [main, master] pull_request: workflow_dispatch: - # Estate guardrail: cancel superseded runs so re-pushes / rebased PR # updates do not pile up queued runs against the shared account-wide # Actions concurrency pool. Applied only to read-only check workflows @@ -25,10 +23,8 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index a711616..0776fac 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -3,7 +3,6 @@ # See standards#191 for the reusable's purpose and design. name: Hypatia Security Scan - on: push: branches: [main, master, develop] @@ -12,17 +11,14 @@ on: schedule: - cron: '0 0 * * 0' workflow_dispatch: - # Estate guardrail: cancel superseded runs so re-pushes don't pile up. concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read security-events: write pull-requests: write - jobs: hypatia: uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242 diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 32e9e3e..78c70e7 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,16 +1,13 @@ # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync - on: push: branches: [main, master] release: types: [published] - permissions: contents: read - jobs: dispatch: runs-on: ubuntu-latest @@ -29,6 +26,5 @@ jobs: "sha": "${{ github.sha }}", "forges": "" } - - name: Confirm run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}" diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml index bec7e50..f3e77bb 100644 --- a/.github/workflows/jekyll-gh-pages.yml +++ b/.github/workflows/jekyll-gh-pages.yml @@ -1,27 +1,22 @@ # SPDX-License-Identifier: MPL-2.0 # Sample workflow for building and deploying a Jekyll site to GitHub Pages name: Deploy Jekyll with GitHub Pages dependencies preinstalled - on: # Runs on pushes targeting the default branch push: branches: ["main"] - # Allows you to run this workflow manually from the Actions tab workflow_dispatch: - # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages permissions: contents: read pages: write id-token: write - # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. concurrency: group: "pages" cancel-in-progress: false - jobs: # Build job build: @@ -39,7 +34,6 @@ jobs: destination: ./_site - name: Upload artifact uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 - # Deployment job deploy: environment: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index ee8ea02..fcff1f2 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,14 +1,11 @@ # SPDX-License-Identifier: MPL-2.0 name: Mirror to Git Forges - on: push: branches: [main] workflow_dispatch: - permissions: contents: read - jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index 50d765e..109b1eb 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -1,14 +1,12 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores name: OpenSSF Scorecard Enforcer - on: push: branches: [main] schedule: - - cron: '0 6 * * 1' # Weekly on Monday + - cron: '0 6 * * 1' # Weekly on Monday workflow_dispatch: - # Estate guardrail: cancel superseded runs so re-pushes / rebased PR # updates do not pile up queued runs against the shared account-wide # Actions concurrency pool. Applied only to read-only check workflows @@ -16,10 +14,8 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: # The OSSF Scorecard publish endpoint enforces a hard contract: the job that # runs `ossf/scorecard-action` with `publish_results: true` must contain @@ -36,31 +32,27 @@ jobs: timeout-minutes: 15 permissions: security-events: write - id-token: write # For OIDC + id-token: write # For OIDC steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - name: Run Scorecard uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 with: results_file: results.sarif results_format: sarif publish_results: true - - name: Upload SARIF uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4 with: sarif_file: results.sarif - - name: Persist SARIF for downstream score-gate job uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 with: name: scorecard-results path: results.sarif retention-days: 1 - check-score: needs: scorecard runs-on: ubuntu-latest @@ -72,7 +64,6 @@ jobs: uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v5.0.0 with: name: scorecard-results - - name: Check minimum score run: | SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0") @@ -86,21 +77,18 @@ jobs: echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE" exit 1 fi - # Check specific high-priority items check-critical: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Check SECURITY.md exists run: | if [ ! -f "SECURITY.md" ]; then echo "::error::SECURITY.md is required" exit 1 fi - - name: Check for pinned dependencies run: | # Check workflows for unpinned actions diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d5b33eb..cdbffb0 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,15 +1,12 @@ # SPDX-License-Identifier: MPL-2.0 name: Scorecards supply-chain security - on: branch_protection_rule: schedule: - cron: '23 4 * * 1' push: branches: [main] - permissions: read-all - jobs: analysis: uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index c7761fe..10729d0 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,20 +1,26 @@ # SPDX-License-Identifier: MPL-2.0 name: Secret Scanner - on: pull_request: push: branches: [main] - concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - permissions: contents: read - jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0 timeout-minutes: 10 secrets: inherit + trufflehog: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: TruffleHog Secret Scan + uses: trufflesecurity/trufflehog@main + with: + extra_args: --only-verified --fail diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 735f6a3..c1cda78 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -1,7 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - validates all workflows have proper security config name: Workflow Security Linter - on: pull_request: paths: @@ -9,16 +8,13 @@ on: push: paths: - '.github/workflows/**' - permissions: read-all - jobs: lint-workflows: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - name: Check SPDX headers run: | errors=0 @@ -30,7 +26,6 @@ jobs: fi done exit $errors - - name: Check permissions declaration run: | errors=0 @@ -42,7 +37,6 @@ jobs: fi done exit $errors - - name: Check pinned actions run: | errors=0 diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 4cb9eaf..7e243fc 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -5,7 +5,6 @@ variables: OTP_VERSION: "26.2" REBAR3_VERSION: "3.22.1" LFE_VERSION: "2.1.5" - # Define stages stages: - build @@ -14,24 +13,20 @@ stages: - security - docs - deploy - # Cache dependencies cache: paths: - _build/ - rebar3 - # Default image default: image: erlang:${OTP_VERSION} before_script: - apt-get update -qq - apt-get install -y make git - ############################################################################### # Build Stage ############################################################################### - build: stage: build script: @@ -53,11 +48,9 @@ build: paths: - _build/ - rebar3 - ############################################################################### # Test Stage ############################################################################### - test:unit: stage: test dependencies: @@ -70,7 +63,6 @@ test:unit: junit: _build/test/logs/junit.xml when: always expire_in: 1 week - test:coverage: stage: test dependencies: @@ -88,8 +80,7 @@ test:coverage: coverage_format: cobertura path: _build/test/cover/cobertura.xml expire_in: 1 week - allow_failure: true # Coverage not yet 100% - + allow_failure: true # Coverage not yet 100% test:integration: stage: test dependencies: @@ -102,12 +93,10 @@ test:integration: - _build/test/logs/ when: always expire_in: 1 week - allow_failure: true # May not have integration tests yet - + allow_failure: true # May not have integration tests yet ############################################################################### # Lint Stage ############################################################################### - lint:dialyzer: stage: lint dependencies: @@ -115,8 +104,7 @@ lint:dialyzer: script: - echo "Running Dialyzer static analysis..." - ./rebar3 dialyzer - allow_failure: true # Dialyzer can be strict - + allow_failure: true # Dialyzer can be strict lint:format: stage: lint dependencies: @@ -126,11 +114,9 @@ lint:format: - find src -name "*.lfe" -type f - echo "LFE formatting check (manual review needed)" allow_failure: true - ############################################################################### # Security Stage ############################################################################### - security:dependencies: stage: security dependencies: @@ -140,7 +126,6 @@ security:dependencies: - ./rebar3 tree | grep -v "^" || true - echo "Manual security review of dependencies recommended" allow_failure: true - security:rsr-compliance: stage: security script: @@ -166,7 +151,6 @@ security:rsr-compliance: - echo "✓ CHANGELOG.md exists" - test -f CHANGELOG.md - echo "RSR Bronze Level compliance verified!" - security:ethical-check: stage: security script: @@ -181,11 +165,9 @@ security:ethical-check: - grep -r "rate_limit" src/ || (echo "❌ Rate limiting missing!" && exit 1) - echo "✓ Rate limiting found" - echo "Safety mechanisms verified!" - ############################################################################### # Documentation Stage ############################################################################### - docs:build: stage: docs dependencies: @@ -198,7 +180,6 @@ docs:build: - doc/ expire_in: 1 month allow_failure: true - docs:validate: stage: docs script: @@ -210,11 +191,9 @@ docs:validate: - test -f docs/API_REFERENCE.md || (echo "❌ API_REFERENCE.md missing!" && exit 1) - test -f docs/QUICKSTART.md || (echo "❌ QUICKSTART.md missing!" && exit 1) - echo "✓ All documentation present!" - ############################################################################### # Deploy Stage (for releases) ############################################################################### - deploy:release: stage: deploy dependencies: @@ -231,7 +210,6 @@ deploy:release: only: - tags - main - pages: stage: deploy dependencies: @@ -245,29 +223,23 @@ pages: - public only: - main - ############################################################################### # Multi-version testing ############################################################################### - .test_template: &test_definition stage: test script: - ./rebar3 lfe test - test:otp26: - <<: *test_definition + !!merge <<: *test_definition image: erlang:26 - test:otp27: - <<: *test_definition + !!merge <<: *test_definition image: erlang:27 - allow_failure: true # OTP 27 may not be stable yet - + allow_failure: true # OTP 27 may not be stable yet ############################################################################### # Release workflow ############################################################################### - release:prepare: stage: deploy script: @@ -278,11 +250,9 @@ release:prepare: - echo "✓ Release validation complete" only: - tags - ############################################################################### # Scheduled jobs ############################################################################### - dependency:update: stage: build script: @@ -291,11 +261,9 @@ dependency:update: only: - schedules allow_failure: true - ############################################################################### # Manual jobs ############################################################################### - security:audit: stage: security script: @@ -305,7 +273,6 @@ security:audit: - grep -r "api_key\s*=" src/ && exit 1 || echo "✓ No hardcoded API keys" - echo "Security audit complete" when: manual - clean:cache: stage: build script: @@ -316,3 +283,8 @@ clean:cache: policy: push key: ${CI_COMMIT_REF_SLUG} paths: [] +trufflehog: + stage: security + image: trufflesecurity/trufflehog:latest + script: + - trufflehog git file://. --only-verified --fail diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile index 7999a6b..a9d5cd9 100644 --- a/.machine_readable/contractiles/Justfile +++ b/.machine_readable/contractiles/Justfile @@ -86,3 +86,6 @@ test-examples: # Run all 6 Grade B test targets test: test-lfe test-structure test-compile test-static test-nickel test-examples + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true diff --git a/Justfile b/Justfile index 7999a6b..a9d5cd9 100644 --- a/Justfile +++ b/Justfile @@ -86,3 +86,6 @@ test-examples: # Run all 6 Grade B test targets test: test-lfe test-structure test-compile test-static test-nickel test-examples + +secret-scan-trufflehog: + @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true From b4f6291f13ede377b74c5f4fcb3cb5f20133678c Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 12 Jun 2026 00:24:52 +0100 Subject: [PATCH 10/11] fix(security/compliance): resolve Hypatia findings and ensure Owner metadata --- .github/workflows/ci.yml | 10 ++++++++++ .github/workflows/codeql.yml | 2 ++ .github/workflows/dependabot-automerge.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/jekyll-gh-pages.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/scorecard-enforcer.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 3 ++- .github/workflows/workflow-linter.yml | 1 + 12 files changed, 23 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e0fcbdf..88bace1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # GitHub Actions CI/CD for SafeBruteForce # Erlang/OTP + LFE project @@ -26,6 +27,7 @@ jobs: build: name: Build runs-on: ubuntu-latest + timeout-minutes: 10 steps: - name: Checkout code @@ -66,6 +68,7 @@ jobs: test: name: Test (OTP ${{ matrix.otp }}) runs-on: ubuntu-latest + timeout-minutes: 10 needs: build strategy: @@ -106,6 +109,7 @@ jobs: coverage: name: Test Coverage runs-on: ubuntu-latest + timeout-minutes: 10 needs: build steps: @@ -143,6 +147,7 @@ jobs: dialyzer: name: Dialyzer Static Analysis runs-on: ubuntu-latest + timeout-minutes: 10 needs: build steps: @@ -179,6 +184,7 @@ jobs: security: name: Security Checks runs-on: ubuntu-latest + timeout-minutes: 10 steps: - name: Checkout code @@ -210,6 +216,7 @@ jobs: rsr-compliance: name: RSR Framework Compliance runs-on: ubuntu-latest + timeout-minutes: 10 steps: - name: Checkout code @@ -270,6 +277,7 @@ jobs: docs: name: Build Documentation runs-on: ubuntu-latest + timeout-minutes: 10 needs: build steps: @@ -305,6 +313,7 @@ jobs: release: name: Create Release runs-on: ubuntu-latest + timeout-minutes: 10 needs: [test, coverage, security, rsr-compliance] if: startsWith(github.ref, 'refs/tags/v') @@ -339,6 +348,7 @@ jobs: notify: name: Notify on Failure runs-on: ubuntu-latest + timeout-minutes: 10 needs: [test, coverage, security, rsr-compliance] if: failure() diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 289e431..4805230 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # For most projects, this workflow file will not need changing; you simply need # to commit it to your repository. @@ -31,6 +32,7 @@ jobs: # - https://gh.io/using-larger-runners (GitHub.com only) # Consider using larger runners or machines with greater resources for possible analysis time improvements. runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + timeout-minutes: 10 permissions: # required for all workflows security-events: write diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index cff4451..64623c0 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # # dependabot-automerge.yml — enable GitHub's native auto-merge on diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index e0c379b..febd5bc 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 0776fac..111b2ad 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml. # See standards#191 for the reusable's purpose and design. diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 78c70e7..37e3fd4 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml index f3e77bb..49c298b 100644 --- a/.github/workflows/jekyll-gh-pages.yml +++ b/.github/workflows/jekyll-gh-pages.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Sample workflow for building and deploying a Jekyll site to GitHub Pages name: Deploy Jekyll with GitHub Pages dependencies preinstalled diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index fcff1f2..280df2a 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Mirror to Git Forges on: diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index b73e15a..04ba44e 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores name: OpenSSF Scorecard Enforcer diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index cdbffb0..7fcd4c3 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Scorecards supply-chain security on: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 10729d0..cbb7c29 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Secret Scanner on: @@ -17,7 +18,7 @@ jobs: trufflehog: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 with: fetch-depth: 0 - name: TruffleHog Secret Scan diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index c1cda78..d33c528 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -1,3 +1,4 @@ +# // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - validates all workflows have proper security config name: Workflow Security Linter From 77849c0b6e5484baf96243ebf076c57dc5f547e3 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 12 Jun 2026 00:25:42 +0100 Subject: [PATCH 11/11] fix(compliance): systemic injection of RSR metadata and CI hardening --- .gitlab-ci.yml | 2 ++ Justfile | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 7e243fc..7914a3b 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell # GitLab CI/CD Pipeline for SafeBruteForce # Erlang/OTP + LFE project diff --git a/Justfile b/Justfile index a9d5cd9..4ac9c57 100644 --- a/Justfile +++ b/Justfile @@ -1,3 +1,5 @@ +// SPDX-License-Identifier: MPL-2.0 +// Copyright (c) Jonathan D.A. Jewell import? "contractile.just" # safe-brute-force - Nix Development Tasks