chore(spec): govern ai (Agent/Tool/Skill) + allowlist mode in the liveness gate #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Spec Liveness Check | |
| # For a metadata-driven platform the spec is the product surface — a parsed-but- | |
| # unenforced property is a silent no-op (and, for security props, false compliance). | |
| # This gate requires every authorable property in a GOVERNED category to declare a | |
| # liveness status with evidence in packages/spec/liveness/<category>.json. A new | |
| # unclassified property fails the check (the ratchet: no new undeclared surface). | |
| # Governed categories are rolled out highest-risk-first; see packages/spec/liveness/README.md. | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| paths: | |
| - 'packages/spec/**' | |
| permissions: | |
| contents: read | |
| jobs: | |
| liveness: | |
| name: Spec property liveness | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| - name: Enable Corepack | |
| run: corepack enable | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Generate JSON schemas | |
| run: pnpm --filter @objectstack/spec gen:schema | |
| - name: Check spec liveness | |
| run: node packages/spec/scripts/liveness/check-liveness.mjs |