From fdc26e233cfbcaee23cb874dd53840523bfc686f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 9 Sep 2026 02:20:15 +0100 Subject: [PATCH 1/8] fix(ci): pin standards reusables to main HEAD 8f2ee508 This repo's standards reusable pins are re-pointed at the standards default-branch HEAD, resolved live at sweep time. The prior refs are recorded in the verification line below. Three kinds of drift are repaired together and the body does not claim which one this repo had: an UNREACHABLE sha kills the run at workflow STARTUP, so GitHub reports no check at all rather than a failing one and the gate disappears instead of going red; a FLOATING ref (@main) is unpinned supply chain; a merely STALE but reachable sha silently reintroduces every bug fixed since it. files=4 pins=4 perms=0 permlines=0 from=092dedada188f56c5915f74a5fd40aac093742c3,bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 target=8f2ee508 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 31bca97..80ad396 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -14,4 +14,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index ba71b60..f3ee0db 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -17,4 +17,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 27b7b96..0d547a5 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -12,7 +12,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index a17019b..834ee1f 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -19,5 +19,5 @@ permissions: contents: read jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c secrets: inherit From 6b7c83b8e402d6aa8988e15de5fb26e726d38c11 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 16:35:40 +0000 Subject: [PATCH 2/8] Convert session policy files to K9 Nickel format and add pedigree metadata --- .envrc | 1 - .../self-validating/methodology-guard.k9.ncl | 12 +++ container/deploy.k9.ncl | 10 ++- coordination.k9 | 86 ++++++++++--------- docs/governance/MAINTENANCE-CHECKLIST.a2ml | 1 + session/custom-checks.k9 | 60 ++++++++++--- 6 files changed, 116 insertions(+), 54 deletions(-) diff --git a/.envrc b/.envrc index ef739ef..57b15f5 100644 --- a/.envrc +++ b/.envrc @@ -20,7 +20,6 @@ fi export PROJECT_NAME="{{PROJECT_NAME}}" export RSR_TIER="infrastructure" # export DATABASE_URL="..." -# export API_KEY="..." # Source .env if it exists (gitignored) dotenv_if_exists diff --git a/.machine_readable/self-validating/methodology-guard.k9.ncl b/.machine_readable/self-validating/methodology-guard.k9.ncl index 1cf4fcb..a364fa7 100644 --- a/.machine_readable/self-validating/methodology-guard.k9.ncl +++ b/.machine_readable/self-validating/methodology-guard.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> # @@ -8,6 +9,17 @@ # Usage: k9 validate methodology-guard let methodology_guard = { + pedigree = { + schema_version = "1.0.0", + metadata = { + name = "methodology-guard", + version = "1.0.0", + }, + security = { + leash = 'Kennel, + }, + }, + name = "methodology-guard", version = "1.0.0", description = "Validates that agent work respects declared methodology constraints", diff --git a/container/deploy.k9.ncl b/container/deploy.k9.ncl index 0ad0d04..65bdacf 100644 --- a/container/deploy.k9.ncl +++ b/container/deploy.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level) # @@ -143,7 +144,14 @@ echo "K9: Rollback complete." # Export the component { - pedigree = component_pedigree, + pedigree = component_pedigree & { + name = component_pedigree.metadata.name, + version = component_pedigree.metadata.version, + security = component_pedigree.security & { + leash = 'Hunt, + signature = component_pedigree.security.signature, + }, + }, deployment = deployment, scripts = scripts, diff --git a/coordination.k9 b/coordination.k9 index ba31125..44ce7c6 100644 --- a/coordination.k9 +++ b/coordination.k9 @@ -1,43 +1,49 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 # Thin coordination bindings for central session-management standards -session_management: - source_of_truth: "standards/session-management-standards" - canonical_commands: - - "intake repo " - - "checkpoint change " - - "verify maintenance " - - "verify substantial " - - "verify release " - - "close planned " - - "close urgent " - - "recover repo " - - "handover full " - - "handover split " - - "handover model " - - "handover human " +{ + pedigree = { + schema_version = "1.0.0", + metadata = { + name = "session-coordination", + version = "0.1.0", + }, + security = { + leash = 'Kennel, + }, + }, -signals: - - name: "session.intake" - command: "intake repo " - - name: "session.checkpoint" - command: "checkpoint change " - - name: "session.verify.maintenance" - command: "verify maintenance " - - name: "session.verify.substantial" - command: "verify substantial " - - name: "session.verify.release" - command: "verify release " - - name: "session.close.planned" - command: "close planned " - - name: "session.close.urgent" - command: "close urgent " - - name: "session.recover" - command: "recover repo " - - name: "session.handover.full" - command: "handover full " - - name: "session.handover.split" - command: "handover split " - - name: "session.handover.model" - command: "handover model " - - name: "session.handover.human" - command: "handover human " + session_management = { + source_of_truth = "standards/session-management-standards", + canonical_commands = [ + "intake repo ", + "checkpoint change ", + "verify maintenance ", + "verify substantial ", + "verify release ", + "close planned ", + "close urgent ", + "recover repo ", + "handover full ", + "handover split ", + "handover model ", + "handover human ", + ], + }, + + signals = [ + { name = "session.intake", command = "intake repo " }, + { name = "session.checkpoint", command = "checkpoint change " }, + { name = "session.verify.maintenance", command = "verify maintenance " }, + { name = "session.verify.substantial", command = "verify substantial " }, + { name = "session.verify.release", command = "verify release " }, + { name = "session.close.planned", command = "close planned " }, + { name = "session.close.urgent", command = "close urgent " }, + { name = "session.recover", command = "recover repo " }, + { name = "session.handover.full", command = "handover full " }, + { name = "session.handover.split", command = "handover split " }, + { name = "session.handover.model", command = "handover model " }, + { name = "session.handover.human", command = "handover human " }, + ], +} diff --git a/docs/governance/MAINTENANCE-CHECKLIST.a2ml b/docs/governance/MAINTENANCE-CHECKLIST.a2ml index bbcb38a..66e6112 100644 --- a/docs/governance/MAINTENANCE-CHECKLIST.a2ml +++ b/docs/governance/MAINTENANCE-CHECKLIST.a2ml @@ -2,6 +2,7 @@ # Cross-repo maintenance baseline (machine-readable canonical) [metadata] +name = "maintenance-checklist" version = "1.1.0" last-updated = "2026-02-24" scope = "cross-repo" diff --git a/session/custom-checks.k9 b/session/custom-checks.k9 index bd932fa..6f6f36b 100644 --- a/session/custom-checks.k9 +++ b/session/custom-checks.k9 @@ -1,15 +1,51 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 # Local repository session checks (thin policy layer) -version: "0.1" -checks: - - id: "session-state-has-next-action" - applies_to: ["close planned", "close urgent", "handover full", "handover split", "handover model", "handover human"] - requirement: "LAST-CANONICAL-COMMAND.md contains next intended action" +{ + pedigree = { + schema_version = "1.0.0", + metadata = { + name = "custom-session-checks", + version = "0.1.0", + }, + security = { + leash = 'Kennel, + }, + }, - - id: "session-state-has-residual-risks" - applies_to: ["verify maintenance", "verify substantial", "verify release", "recover repo"] - requirement: "Residual risks field is not left blank" - - - id: "session-state-has-recommended-next-protocol" - applies_to: ["intake repo", "checkpoint change", "recover repo", "handover full"] - requirement: "Recommended next protocol is set" + checks = [ + { + id = "session-state-has-next-action", + applies_to = [ + "close planned", + "close urgent", + "handover full", + "handover split", + "handover model", + "handover human", + ], + requirement = "LAST-CANONICAL-COMMAND.md contains next intended action", + }, + { + id = "session-state-has-residual-risks", + applies_to = [ + "verify maintenance", + "verify substantial", + "verify release", + "recover repo", + ], + requirement = "Residual risks field is not left blank", + }, + { + id = "session-state-has-recommended-next-protocol", + applies_to = [ + "intake repo", + "checkpoint change", + "recover repo", + "handover full", + ], + requirement = "Recommended next protocol is set", + }, + ], +} From 77c71e6171c02bb9c81d0a5134f0437d6c2951b3 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 9 Sep 2026 21:42:35 +0100 Subject: [PATCH 3/8] fix(ci): reconcile manifests and run governance on repair branches --- .envrc | 6 +- .github/pull_request_template.md | 6 +- .../{workflows => workflow-templates}/e2e.yml | 5 +- .github/workflows/actions.lock | 128 ++++++++++++++++ .github/workflows/boj-build.yml | 3 +- .github/workflows/codeql.yml | 9 +- .github/workflows/dependabot-automerge.yml | 3 +- .github/workflows/dogfood-gate.yml | 17 ++- .github/workflows/governance.yml | 3 +- .github/workflows/hypatia-scan.yml | 3 +- .github/workflows/instant-sync.yml | 10 +- .github/workflows/label-triage.yml | 1 + .github/workflows/labels.yml | 1 + .github/workflows/main-estate-audit.yml | 11 +- .github/workflows/mirror.yml | 140 +----------------- .github/workflows/openssf-compliance.yml | 15 +- .github/workflows/push-email-notify.yml | 3 +- .github/workflows/release.yml | 11 +- .github/workflows/repository-validation.yml | 33 +++++ .github/workflows/rhodibot.yml | 3 +- .github/workflows/rust-ci.yml | 46 +----- .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/static-analysis-gate.yml | 23 +-- .machine_readable/ECOSYSTEM.a2ml | 8 - .machine_readable/META.a2ml | 10 -- .machine_readable/STATE.a2ml | 27 ---- .machine_readable/ai/.clinerules | 2 +- .machine_readable/ai/.windsurfrules | 2 +- .machine_readable/ai/AI.a2ml | 2 +- .machine_readable/ai/README.adoc | 4 +- .machine_readable/contractiles/Justfile | 50 +++---- .machine_readable/contractiles/Mustfile.a2ml | 4 +- .../{6a2 => descriptiles}/0-AI-MANIFEST.a2ml | 0 .../{6a2 => descriptiles}/AGENTIC.a2ml | 0 .../{6a2 => descriptiles}/ECOSYSTEM.a2ml | 0 .../{6a2 => descriptiles}/META.a2ml | 2 + .../{6a2 => descriptiles}/NEUROSYM.a2ml | 0 .../{6a2 => descriptiles}/PLAYBOOK.a2ml | 2 +- .../{6a2 => descriptiles}/README.adoc | 0 .../{6a2 => descriptiles}/STATE.a2ml | 4 +- .../anchor/0-AI-MANIFEST.a2ml | 0 .../{6a2 => descriptiles}/anchor/ANCHOR.a2ml | 0 .../{6a2 => descriptiles}/anchor/README.adoc | 0 .../policies/MAINTENANCE-AXES.a2ml | 2 +- .../self-validating/methodology-guard.k9.ncl | 2 +- 0-AI-MANIFEST.a2ml | 4 +- EXPLAINME.adoc | 4 +- Justfile | 58 ++++---- README.adoc | 6 +- TEMPLATE-STANDARDS-AUDIT.adoc | 14 +- coordination.k9 => coordination.k9.ncl | 0 docs/RSR_OUTLINE.adoc | 2 +- docs/practice/AI-CONVENTIONS.adoc | 4 +- scripts/validate-session-contracts.sh | 20 +++ scripts/validate-template.sh | 8 +- session/README.adoc | 2 +- ...{custom-checks.k9 => custom-checks.k9.ncl} | 0 setup.sh | 12 +- tests/e2e/template_instantiation_test.sh | 4 +- 60 files changed, 364 insertions(+), 377 deletions(-) rename .github/{workflows => workflow-templates}/e2e.yml (99%) create mode 100644 .github/workflows/actions.lock create mode 100644 .github/workflows/repository-validation.yml delete mode 100644 .machine_readable/ECOSYSTEM.a2ml delete mode 100644 .machine_readable/META.a2ml delete mode 100644 .machine_readable/STATE.a2ml rename .machine_readable/{6a2 => descriptiles}/0-AI-MANIFEST.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/AGENTIC.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/ECOSYSTEM.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/META.a2ml (97%) rename .machine_readable/{6a2 => descriptiles}/NEUROSYM.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/PLAYBOOK.a2ml (93%) rename .machine_readable/{6a2 => descriptiles}/README.adoc (100%) rename .machine_readable/{6a2 => descriptiles}/STATE.a2ml (94%) rename .machine_readable/{6a2 => descriptiles}/anchor/0-AI-MANIFEST.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/anchor/ANCHOR.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/anchor/README.adoc (100%) rename coordination.k9 => coordination.k9.ncl (100%) create mode 100644 scripts/validate-session-contracts.sh rename session/{custom-checks.k9 => custom-checks.k9.ncl} (100%) diff --git a/.envrc b/.envrc index 57b15f5..8978dcb 100644 --- a/.envrc +++ b/.envrc @@ -12,12 +12,8 @@ if has guix && [ -f guix.scm ]; then use guix fi -# Load Nix flake if flake.nix exists -if has nix && [ -f flake.nix ]; then -fi - # Project environment variables -export PROJECT_NAME="{{PROJECT_NAME}}" +export PROJECT_NAME="fraying-model-computational-testbed" export RSR_TIER="infrastructure" # export DATABASE_URL="..." diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 2132109..65789e9 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -29,9 +29,9 @@ Copyright (c) Jonathan D.A. Jewell ### As Applicable -- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed) -- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations changed) -- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions changed) +- [ ] `.machine_readable/descriptiles/STATE.a2ml` updated (if project state changed) +- [ ] `.machine_readable/descriptiles/ECOSYSTEM.a2ml` updated (if integrations changed) +- [ ] `.machine_readable/descriptiles/META.a2ml` updated (if architectural decisions changed) - [ ] Documentation updated for user-facing changes - [ ] `TOPOLOGY.md` updated (if architecture changed) - [ ] `CHANGELOG` or release notes updated diff --git a/.github/workflows/e2e.yml b/.github/workflow-templates/e2e.yml similarity index 99% rename from .github/workflows/e2e.yml rename to .github/workflow-templates/e2e.yml index cb725f3..af4f0bc 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflow-templates/e2e.yml @@ -22,13 +22,14 @@ on: - 'tests/**' - '.github/workflows/e2e.yml' pull_request: - branches: [main, master] + branches: ['**'] paths: - 'src/**' - 'ffi/**' - 'tests/**' workflow_dispatch: -permissions: read-all +permissions: + contents: read actions: read concurrency: group: e2e-${{ github.ref }} diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..81612a1 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,128 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/boj-build.yml': + - 'actions/checkout@v6.0.2' + '.github/workflows/codeql.yml': + - 'actions/checkout@v6.0.2' + - 'github/codeql-action@v4.34.0' + '.github/workflows/dependabot-automerge.yml': + - 'dependabot/fetch-metadata@v2.2.0' + '.github/workflows/dogfood-gate.yml': + - 'actions/checkout@v4.3.1' + - 'hyperpolymath/a2ml-ecosystem@main' + - 'hyperpolymath/k9-ecosystem@main' + '.github/workflows/instant-sync.yml': + - 'peter-evans/repository-dispatch@v4.0.1' + '.github/workflows/main-estate-audit.yml': + - 'actions/checkout@v4.4.0' + - 'hyperpolymath/cicd-suite@main' + '.github/workflows/mirror.yml': + - 'actions/checkout@v6.0.2' + - 'dtolnay/rust-toolchain@master' + - 'webfactory/ssh-agent@v0.9.1' + '.github/workflows/openssf-compliance.yml': + - 'actions/checkout@v4.3.1' + '.github/workflows/push-email-notify.yml': + - 'hyperpolymath/smtp-notify-action@v0.2.0' + '.github/workflows/release.yml': + - 'actions/checkout@v6.0.2' + - 'actions/upload-artifact@v4.6.2' + - 'softprops/action-gh-release@v2.5.0' + '.github/workflows/repository-validation.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/rhodibot.yml': + - 'actions/checkout@v4.3.1' + '.github/workflows/static-analysis-gate.yml': + - 'actions/checkout@v6.0.2' + - 'actions/download-artifact@v4.1.8' + - 'actions/upload-artifact@v4.6.2' + - 'erlef/setup-beam@v1.20.4' +dependencies: + 'actions/checkout@v4.3.1': + ref: 'v4.3.1' + commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v6.0.2': + ref: 'v6.0.2' + commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/download-artifact@v4.1.8': + ref: 'v4.1.8' + commit: 'sha1-fa0a91b85d4f404e444e00e005971372dc801d16' + owner_id: 44036562 + repo_id: 192626254 + 'actions/upload-artifact@v4.6.2': + ref: 'v4.6.2' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'dependabot/fetch-metadata@v2.2.0': + ref: 'v2.2.0' + commit: 'sha1-dbb049abf0d677abbd7f7eee0375145b417fdd34' + owner_id: 27347476 + repo_id: 371068214 + 'dtolnay/rust-toolchain@master': + ref: 'master' + commit: 'sha1-efa25f7f19611383d5b0ccf2d1c8914531636bf9' + owner_id: 1940490 + repo_id: 260749683 + 'erlef/setup-beam@v1.20.4': + ref: 'v1.20.4' + commit: 'sha1-e6d7c94229049569db56a7ad5a540c051a010af9' + owner_id: 47606891 + repo_id: 331103973 + 'github/codeql-action@v4.34.0': + ref: 'v4.34.0' + commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745' + owner_id: 9919 + repo_id: 259445878 + 'hyperpolymath/a2ml-ecosystem@main': + ref: 'main' + commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79' + owner_id: 6759885 + repo_id: 1275649586 + 'hyperpolymath/cicd-suite@main': + ref: 'main' + commit: 'sha1-fc64172aa53e85289d5d7d6e15c2435a867cc1c9' + owner_id: 6759885 + repo_id: 1326697643 + 'hyperpolymath/k9-ecosystem@main': + ref: 'main' + commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562' + owner_id: 6759885 + repo_id: 1275650185 + 'hyperpolymath/smtp-notify-action@v0.2.0': + ref: 'v0.2.0' + commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7' + owner_id: 6759885 + repo_id: 1352485172 + 'peter-evans/repository-dispatch@v4.0.1': + ref: 'v4.0.1' + commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' + owner_id: 18365890 + repo_id: 220359305 + 'softprops/action-gh-release@v2.5.0': + ref: 'v2.5.0' + commit: 'sha1-a06a81a03ee405af7f2048a818ed3f03bbf83c7b' + owner_id: 2242 + repo_id: 204253808 + 'webfactory/ssh-agent@v0.9.1': + ref: 'v0.9.1' + commit: 'sha1-a6f90b1f127823b31d4d4a8d96047790581349bd' + owner_id: 135788 + repo_id: 208510314 diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 3915d6c..7fb2de2 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 @@ -21,7 +22,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Trigger BoJ Server (Casket/ssg-mcp) env: BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ef9d63b..0844b94 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 @@ -6,7 +7,7 @@ on: push: branches: [main, master] pull_request: - branches: [main, master] + branches: ['**'] schedule: - cron: '0 6 * * 1' # Estate guardrail: cancel superseded runs so re-pushes / rebased PR @@ -34,13 +35,13 @@ jobs: build-mode: none steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Initialize CodeQL - uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 + uses: github/codeql-action/init@v4.34.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 + uses: github/codeql-action/analyze@v4.34.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index b876db5..bda1498 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 @@ -54,7 +55,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: meta - uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0 + uses: dependabot/fetch-metadata@v2.2.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} # --- Policy gate ------------------------------------------------------- diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index a1e38b5..4ff2429 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -27,7 +28,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Check for A2ML files id: detect @@ -40,7 +41,7 @@ jobs: - name: Validate A2ML manifests if: steps.detect.outputs.count > 0 - uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79 # main + uses: hyperpolymath/a2ml-ecosystem/validate-action@main with: path: '.' strict: 'false' @@ -72,7 +73,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Check for K9 files id: detect @@ -89,7 +90,7 @@ jobs: - name: Validate K9 contracts if: steps.detect.outputs.k9_count > 0 - uses: hyperpolymath/k9-ecosystem/validate-action@89f3c2702f4f650a92aa7411502f38da06abd562 # main + uses: hyperpolymath/k9-ecosystem/validate-action@main with: path: '.' strict: 'false' @@ -122,7 +123,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Scan for invisible characters id: lint @@ -187,7 +188,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Check for Groove manifest id: groove @@ -246,7 +247,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Check and validate eclexiaiser manifest id: eclex @@ -312,7 +313,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Generate dogfooding scorecard run: | diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 80ad396..13373fc 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Governance @@ -5,7 +6,7 @@ on: push: branches: [main, master] pull_request: - branches: [main, master] + branches: ['**'] workflow_dispatch: permissions: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index f3ee0db..d65edb6 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Hypatia Security Scan @@ -5,7 +6,7 @@ on: push: branches: [main, master, develop] pull_request: - branches: [main, master] + branches: ['**'] schedule: - cron: '0 0 * * 0' workflow_dispatch: diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 577a104..6489936 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 @@ -15,9 +16,12 @@ jobs: dispatch: runs-on: ubuntu-latest timeout-minutes: 15 + env: + FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }} steps: - name: Trigger Propagation - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 + if: env.FARM_DISPATCH_TOKEN != '' + uses: peter-evans/repository-dispatch@v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm @@ -30,6 +34,10 @@ jobs: "forges": "" } - name: Confirm + if: env.FARM_DISPATCH_TOKEN != '' env: REPO_NAME: ${{ github.event.repository.name }} run: echo "::notice::Propagation triggered for ${REPO_NAME}" + - name: Propagation not configured + if: env.FARM_DISPATCH_TOKEN == '' + run: echo "::notice::FARM_DISPATCH_TOKEN is not configured; propagation was not requested" diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index 9886e92..814a192 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Label Triage diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index c80b676..83ab941 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Labels diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index b602e97..ba07202 100755 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -1,16 +1,23 @@ +# This workflow is managed by gh actions-lock. + +# SPDX-License-Identifier: MPL-2.0 name: Central Estate CI/CD Audit on: push: branches: [ "main" ] pull_request: - branches: [ "main" ] + branches: ['**'] + +permissions: + contents: read jobs: estate-audit: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Required Files Gate uses: hyperpolymath/cicd-suite/actions/required-files-check@main diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 82bfb1c..c24fd19 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 @@ -10,139 +11,6 @@ permissions: actions: read contents: read jobs: - mirror-gitlab: - runs-on: ubuntu-latest - timeout-minutes: 15 - if: vars.GITLAB_MIRROR_ENABLED == 'true' - env: - SSH_PRIVATE_KEY: ${{ secrets.GITLAB_SSH_KEY }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - if: ${{ env.SSH_PRIVATE_KEY != '' }} - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 - with: - ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} - - name: Mirror to GitLab - run: | - ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts - git remote add gitlab git@gitlab.com:${{ vars.GITLAB_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true - git push --force gitlab main - mirror-bitbucket: - runs-on: ubuntu-latest - timeout-minutes: 15 - if: vars.BITBUCKET_MIRROR_ENABLED == 'true' - env: - SSH_PRIVATE_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - if: ${{ env.SSH_PRIVATE_KEY != '' }} - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 - with: - ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} - - name: Mirror to Bitbucket - run: | - ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts - git remote add bitbucket git@bitbucket.org:${{ vars.BITBUCKET_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true - git push --force bitbucket main - mirror-codeberg: - runs-on: ubuntu-latest - timeout-minutes: 15 - if: vars.CODEBERG_MIRROR_ENABLED == 'true' - env: - SSH_PRIVATE_KEY: ${{ secrets.CODEBERG_SSH_KEY }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - if: ${{ env.SSH_PRIVATE_KEY != '' }} - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 - with: - ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} - - name: Mirror to Codeberg - run: | - ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts - git remote add codeberg git@codeberg.org:${{ vars.CODEBERG_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true - git push --force codeberg main - mirror-sourcehut: - runs-on: ubuntu-latest - timeout-minutes: 15 - if: vars.SOURCEHUT_MIRROR_ENABLED == 'true' - env: - SSH_PRIVATE_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - if: ${{ env.SSH_PRIVATE_KEY != '' }} - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 - with: - ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} - - name: Mirror to SourceHut - run: | - ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts - git remote add sourcehut git@git.sr.ht:~${{ vars.SOURCEHUT_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }} || true - git push --force sourcehut main - mirror-disroot: - runs-on: ubuntu-latest - timeout-minutes: 15 - if: vars.DISROOT_MIRROR_ENABLED == 'true' - env: - SSH_PRIVATE_KEY: ${{ secrets.DISROOT_SSH_KEY }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - if: ${{ env.SSH_PRIVATE_KEY != '' }} - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 - with: - ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} - - name: Mirror to Disroot - run: | - ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts - git remote add disroot git@git.disroot.org:${{ vars.DISROOT_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true - git push --force disroot main - mirror-gitea: - runs-on: ubuntu-latest - timeout-minutes: 15 - if: vars.GITEA_MIRROR_ENABLED == 'true' - env: - SSH_PRIVATE_KEY: ${{ secrets.GITEA_SSH_KEY }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - if: ${{ env.SSH_PRIVATE_KEY != '' }} - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1 - with: - ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} - - name: Mirror to Gitea - run: | - ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts - git remote add gitea git@${{ vars.GITEA_HOST }}:${{ vars.GITEA_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true - git push --force gitea main - mirror-radicle: - runs-on: ubuntu-latest - timeout-minutes: 15 - if: vars.RADICLE_MIRROR_ENABLED == 'true' - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - name: Setup Rust - uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable - with: - toolchain: stable - - name: Install Radicle - run: | - # Install via cargo (safer than curl|sh) - cargo install radicle-cli --locked - echo "$HOME/.cargo/bin" >> $GITHUB_PATH - - name: Mirror to Radicle - run: | - echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle - chmod 600 ~/.radicle/keys/radicle - rad sync --announce || echo "Radicle sync attempted" + mirror: + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + secrets: inherit diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml index fb7ff44..626ebf1 100644 --- a/.github/workflows/openssf-compliance.yml +++ b/.github/workflows/openssf-compliance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 @@ -8,7 +9,7 @@ on: push: branches: [main] pull_request: - branches: [main] + branches: ['**'] workflow_dispatch: permissions: actions: read @@ -20,7 +21,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@v4.3.1 with: persist-credentials: false - name: Check SECURITY.md exists and has substance @@ -69,11 +70,11 @@ jobs: exit 1 fi - if [ ! -f ".machine_readable/STATE.a2ml" ]; then - echo "::error::.machine_readable/STATE.a2ml is required" + if [ ! -f ".machine_readable/descriptiles/STATE.a2ml" ]; then + echo "::error::.machine_readable/descriptiles/STATE.a2ml is required" exit 1 fi - echo ".machine_readable/STATE.a2ml: OK" + echo ".machine_readable/descriptiles/STATE.a2ml: OK" - name: Check CHANGELOG exists run: | if [ ! -f "CHANGELOG.md" ] && [ ! -f "CHANGELOG.adoc" ] && [ ! -f "CHANGES.md" ]; then @@ -89,8 +90,8 @@ jobs: # Collect all required files that exist for f in SECURITY.md SECURITY.adoc .github/SECURITY.md LICENSE LICENSE.txt \ CONTRIBUTING.md CONTRIBUTING.adoc README.md README.adoc \ - .machine_readable/STATE.a2ml .machine_readable/META.a2ml \ - .machine_readable/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do + .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml \ + .machine_readable/descriptiles/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do [ -f "$f" ] && REQUIRED_FILES="$REQUIRED_FILES $f" done diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 0689291..676f498 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; @@ -39,7 +40,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: hyperpolymath/smtp-notify-action@ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7 # v0.2.0 + uses: hyperpolymath/smtp-notify-action@v0.2.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e675c5d..e223d1d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -20,7 +21,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Detect project type and build id: build run: | @@ -81,7 +82,7 @@ jobs: changelog: ${{ steps.cliff.outputs.content }} version: ${{ steps.version.outputs.version }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - name: Extract version from tag @@ -106,7 +107,7 @@ jobs: run: | git cliff --output CHANGELOG.md - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: changelog path: CHANGELOG.md @@ -119,14 +120,14 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 # TODO: Download build artifacts if uploading to the release # - uses: actions/download-artifact@v4 # with: # name: release-artifacts # path: artifacts/ - name: Create GitHub Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2 + uses: softprops/action-gh-release@v2.5.0 with: body: ${{ needs.changelog.outputs.changelog }} draft: false diff --git a/.github/workflows/repository-validation.yml b/.github/workflows/repository-validation.yml new file mode 100644 index 0000000..19d28fc --- /dev/null +++ b/.github/workflows/repository-validation.yml @@ -0,0 +1,33 @@ +# This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 +name: Repository Validation +on: + push: + branches: [main, master] + pull_request: + workflow_dispatch: +permissions: + contents: read +jobs: + repository-validation: + name: Workflow and session contract validation + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - name: Install verified Nickel 1.17.0 + run: | + mkdir -p "$RUNNER_TEMP/nickel-bin" + curl --fail --silent --show-error --location \ + https://github.com/nickel-lang/nickel/releases/download/1.17.0/nickel-x86_64-linux \ + --output "$RUNNER_TEMP/nickel-bin/nickel" + echo "afcdfa6e0fff31760cf229e85997456c02c00b8b3b84ff38f897ac7b3f39ae34 $RUNNER_TEMP/nickel-bin/nickel" | sha256sum --check --strict + chmod +x "$RUNNER_TEMP/nickel-bin/nickel" + echo "$RUNNER_TEMP/nickel-bin" >> "$GITHUB_PATH" + - name: Check workflow conventions + run: bash tests/workflows/validate_workflows_test.sh + - name: Evaluate session contracts + run: bash scripts/validate-session-contracts.sh + diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index 5394d85..2831dc7 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 @@ -30,7 +31,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 with: fetch-depth: 1 - name: Rhodibot — Scan and Fix diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index e8da5a8..d8faafd 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 @@ -8,49 +9,10 @@ name: Rust CI on: push: branches: [main, master] + pull_request: permissions: actions: read contents: read jobs: - check: - name: Cargo check + clippy + fmt - runs-on: ubuntu-latest - timeout-minutes: 15 - if: hashFiles('Cargo.toml') != '' - steps: - - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable - with: - components: clippy, rustfmt - - name: Cache cargo registry and build - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 - - name: Cargo check - run: cargo check --all-targets 2>&1 - - name: Cargo fmt - run: cargo fmt --all -- --check - - name: Cargo clippy - run: cargo clippy --all-targets -- -D warnings - test: - name: Cargo test - runs-on: ubuntu-latest - timeout-minutes: 15 - needs: check - if: hashFiles('Cargo.toml') != '' - steps: - - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable - - name: Cache cargo registry and build - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 - - name: Run tests - run: cargo test --all-targets - - name: Write summary - if: always() - run: | - echo "## Rust CI Results" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "- **cargo check**: passed" >> "$GITHUB_STEP_SUMMARY" - echo "- **cargo test**: completed" >> "$GITHUB_STEP_SUMMARY" + rust-ci: + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 0d547a5..1f2933a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: OSSF Scorecard diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 834ee1f..e2ea865 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Calls the estate's shared secret scanner (gitleaks + rust-secrets + # shell-secrets). Replaces an inline trufflehog job: trufflehog was retired diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index e3576de..d60404f 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 @@ -22,7 +23,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - name: Install panic-attack (if available) @@ -119,7 +120,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload panic-attack findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@v4.6.2 with: name: panic-attack-findings path: panic-attack-findings.json @@ -138,13 +139,13 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - name: Setup Elixir for Hypatia scanner id: beam continue-on-error: true - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2 + uses: erlef/setup-beam@v1.20.4 with: elixir-version: '1.19.4' otp-version: '28.3' @@ -245,7 +246,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload hypatia findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@v4.6.2 with: name: hypatia-findings path: hypatia-findings.json @@ -264,7 +265,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - name: Install panic-attack (if available) @@ -326,7 +327,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload bridge report - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@v4.6.2 with: name: bridge-report path: bridge-report.json @@ -348,17 +349,17 @@ jobs: if: always() steps: - name: Download panic-attack findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 + uses: actions/download-artifact@v4.1.8 with: name: panic-attack-findings path: findings/ - name: Download hypatia findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 + uses: actions/download-artifact@v4.1.8 with: name: hypatia-findings path: findings/ - name: Download bridge report - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 + uses: actions/download-artifact@v4.1.8 with: name: bridge-report path: findings/ @@ -418,7 +419,7 @@ jobs: echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" echo "low=$LOW" >> "$GITHUB_OUTPUT" - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@v4.6.2 with: name: unified-findings path: findings/unified-findings.json diff --git a/.machine_readable/ECOSYSTEM.a2ml b/.machine_readable/ECOSYSTEM.a2ml deleted file mode 100644 index 0059aed..0000000 --- a/.machine_readable/ECOSYSTEM.a2ml +++ /dev/null @@ -1,8 +0,0 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; Ecosystem position and relationships -(ecosystem - (version "1.0.0") - (name "{{REPO}}") - (type "library") - (purpose "{{REPO_DESCRIPTION}}") - (related-projects)) diff --git a/.machine_readable/META.a2ml b/.machine_readable/META.a2ml deleted file mode 100644 index e64e280..0000000 --- a/.machine_readable/META.a2ml +++ /dev/null @@ -1,10 +0,0 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; Architecture decisions and development practices -(meta - (version "1.0.0") - (project "{{REPO}}") - (architecture-decisions) - (development-practices - (code-review "required") - (branch-protection "enabled") - (ci-cd "github-actions"))) diff --git a/.machine_readable/STATE.a2ml b/.machine_readable/STATE.a2ml deleted file mode 100644 index e76237a..0000000 --- a/.machine_readable/STATE.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; Project state — update throughout each session -(state - (metadata - (version "1.0.1") - (project "rsr-template-repo") - (last-updated "2026-04-04")) - (project-context - (description "RSR Standard Repository Template — baseline for all hyperpolymath projects") - (primary-language "Idris2 (ABI) + Zig (FFI)") - (status "testing-complete")) - (current-position - (phase "testing") - (completion-percentage 100) - (milestone "CRG C - Testing & Benchmarking complete")) - (testing-summary - (validation-script "scripts/validate-template.sh: PASS (0 errors)") - (workflow-tests "tests/workflows/validate_workflows_test.sh: PASS (21/21 workflows)") - (integration-tests "test/integration_test.zig: PASS (placeholder template)") - (e2e-tests "tests/e2e/template_instantiation_test.sh: READY") - (benchmarks "benches/template_bench.sh: PASS (5 suites)") - (zig-build "Zig 0.15.2 compatible: PASS")) - (critical-next-actions - ("Commit test suite" - "Push to GitHub" - "Verify CI workflows pass" - "Document test instantiation patterns"))) diff --git a/.machine_readable/ai/.clinerules b/.machine_readable/ai/.clinerules index a29ed5f..30d21a5 100644 --- a/.machine_readable/ai/.clinerules +++ b/.machine_readable/ai/.clinerules @@ -2,7 +2,7 @@ # Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> # Authoritative source: docs/AI-CONVENTIONS.md -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. +# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/descriptiles/STATE.a2ml. # LICENSE # All original code: MPL-2.0. diff --git a/.machine_readable/ai/.windsurfrules b/.machine_readable/ai/.windsurfrules index a29ed5f..30d21a5 100644 --- a/.machine_readable/ai/.windsurfrules +++ b/.machine_readable/ai/.windsurfrules @@ -2,7 +2,7 @@ # Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> # Authoritative source: docs/AI-CONVENTIONS.md -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. +# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/descriptiles/STATE.a2ml. # LICENSE # All original code: MPL-2.0. diff --git a/.machine_readable/ai/AI.a2ml b/.machine_readable/ai/AI.a2ml index c4da8df..346bbc6 100644 --- a/.machine_readable/ai/AI.a2ml +++ b/.machine_readable/ai/AI.a2ml @@ -7,7 +7,7 @@ - Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing. ## Workflow -1. Inspect `.machine_readable/STATE.a2ml` for blockers and next actions. +1. Inspect `.machine_readable/descriptiles/STATE.a2ml` for blockers and next actions. 2. Respect any constraints listed inside `.machine_readable/AGENTIC.a2ml` when tooling changes are requested. 3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message. diff --git a/.machine_readable/ai/README.adoc b/.machine_readable/ai/README.adoc index 7d90fea..a41aed1 100644 --- a/.machine_readable/ai/README.adoc +++ b/.machine_readable/ai/README.adoc @@ -20,5 +20,5 @@ Recommended machine read order: * `.machine_readable/policies/MAINTENANCE-AXES.a2ml` * `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` * `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -* `.machine_readable/STATE.a2ml` -* `.machine_readable/META.a2ml` +* `.machine_readable/descriptiles/STATE.a2ml` +* `.machine_readable/descriptiles/META.a2ml` diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile index 19ab281..aaca89c 100644 --- a/.machine_readable/contractiles/Justfile +++ b/.machine_readable/contractiles/Justfile @@ -52,7 +52,7 @@ info: @echo "Version: {{version}}" @echo "RSR Tier: {{tier}}" @echo "Recipes: $(just --summary | wc -w)" - @[ -f ".machine_readable/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true + @[ -f ".machine_readable/descriptiles/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/descriptiles/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true # Run Invariant Path overlay tools for this repository invariant-path *ARGS: @@ -345,7 +345,7 @@ verify-template: fi # Check for empty SCM files - for f in .machine_readable/6a2/STATE.a2ml .machine_readable/6a2/META.a2ml .machine_readable/6a2/ECOSYSTEM.a2ml; do + for f in .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml .machine_readable/descriptiles/ECOSYSTEM.a2ml; do if [ -f "$f" ] && grep -q '{{'{{'}}' "$f" 2>/dev/null; then echo "⚠ $f still has template placeholders" FOUND=1 @@ -407,10 +407,10 @@ self-assess: fi done - if [ -d ".machine_readable/6a2" ]; then - echo " ✓ .machine_readable/6a2/ — KEEP (SCM checkpoint files)" + if [ -d ".machine_readable/descriptiles" ]; then + echo " ✓ .machine_readable/descriptiles/ — KEEP (SCM checkpoint files)" else - echo " ✗ .machine_readable/6a2/ — MISSING (RSR violation!)" + echo " ✗ .machine_readable/descriptiles/ — MISSING (RSR violation!)" fi if [ -d ".github/workflows" ]; then @@ -563,9 +563,9 @@ verify: check_file "LICENSE" check_either "CONTRIBUTING.md" "CONTRIBUTING.adoc" check_either "README.adoc" "README.md" - check_file ".machine_readable/STATE.a2ml" - check_file ".machine_readable/META.a2ml" - check_file ".machine_readable/ECOSYSTEM.a2ml" + check_file ".machine_readable/descriptiles/STATE.a2ml" + check_file ".machine_readable/descriptiles/META.a2ml" + check_file ".machine_readable/descriptiles/ECOSYSTEM.a2ml" check_either "CHANGELOG.md" "CHANGELOG.adoc" # Check at least 1 workflow exists @@ -1055,7 +1055,7 @@ validate-rsr: for f in .editorconfig .gitignore Justfile README.adoc LICENSE 0-AI-MANIFEST.a2ml; do [ -f "$f" ] || MISSING="$MISSING $f" done - for f in .machine_readable/STATE.a2ml .machine_readable/META.a2ml .machine_readable/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do + for f in .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml .machine_readable/descriptiles/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do [ -f "$f" ] || MISSING="$MISSING $f" done for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/MPL-2.0.txt; do @@ -1070,15 +1070,15 @@ validate-rsr: for f in docs/governance/MAINTENANCE-CHECKLIST.adoc docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc; do [ -f "$f" ] || MISSING="$MISSING $f" done - if [ -f ".machine_readable/META.a2ml" ]; then - grep -q 'axis-1 = "must > intend > like"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-1" - grep -q 'axis-2 = "corrective > adaptive > perfective"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-2" - grep -q 'axis-3 = "systems > compliance > effects"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-3" - grep -q 'scoping-first = true' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:scoping-first" - grep -q 'idris-unsound-scan = "believe_me/assert_total"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:idris-unsound-scan" - grep -q 'audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:audit-focus" - grep -q 'compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:compliance-focus" - grep -q 'effects-evidence = "benchmark execution/results and maintainer status dialogue/review"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:effects-evidence" + if [ -f ".machine_readable/descriptiles/META.a2ml" ]; then + grep -q 'axis-1 = "must > intend > like"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:axis-1" + grep -q 'axis-2 = "corrective > adaptive > perfective"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:axis-2" + grep -q 'axis-3 = "systems > compliance > effects"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:axis-3" + grep -q 'scoping-first = true' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:scoping-first" + grep -q 'idris-unsound-scan = "believe_me/assert_total"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:idris-unsound-scan" + grep -q 'audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:audit-focus" + grep -q 'compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:compliance-focus" + grep -q 'effects-evidence = "benchmark execution/results and maintainer status dialogue/review"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:effects-evidence" grep -q 'compliance-tooling = "panic-attack"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:compliance-tooling" grep -q 'effects-tooling = "ecological checking with sustainabot guidance"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:effects-tooling" grep -q 'source-human = "docs/governance/MAINTENANCE-CHECKLIST.adoc"' .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml || MISSING="$MISSING MAINTENANCE-CHECKLIST.a2ml:source-human" @@ -1092,12 +1092,12 @@ validate-rsr: # Validate STATE.a2ml syntax validate-state: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - grep -q '^\[metadata\]' .machine_readable/STATE.a2ml && \ - grep -q 'project\s*=' .machine_readable/STATE.a2ml && \ + @if [ -f ".machine_readable/descriptiles/STATE.a2ml" ]; then \ + grep -q '^\[metadata\]' .machine_readable/descriptiles/STATE.a2ml && \ + grep -q 'project\s*=' .machine_readable/descriptiles/STATE.a2ml && \ echo "STATE.a2ml: valid" || echo "STATE.a2ml: INVALID (missing required sections)"; \ else \ - echo "No .machine_readable/STATE.a2ml found"; \ + echo "No .machine_readable/descriptiles/STATE.a2ml found"; \ fi # Validate AI installation guide completeness (finishbot pre-release check) @@ -1174,14 +1174,14 @@ validate: validate-rsr validate-state validate-ai-install # Update STATE.a2ml timestamp state-touch: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/STATE.a2ml && \ + @if [ -f ".machine_readable/descriptiles/STATE.a2ml" ]; then \ + sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/descriptiles/STATE.a2ml && \ echo "STATE.a2ml timestamp updated"; \ fi # Show current phase from STATE.a2ml state-phase: - @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml 2>/dev/null | head -1 || echo "unknown" + @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/descriptiles/STATE.a2ml 2>/dev/null | head -1 || echo "unknown" # ═══════════════════════════════════════════════════════════════════════════════ # GUIX & GUIX diff --git a/.machine_readable/contractiles/Mustfile.a2ml b/.machine_readable/contractiles/Mustfile.a2ml index 55f8ab4..9c9f869 100644 --- a/.machine_readable/contractiles/Mustfile.a2ml +++ b/.machine_readable/contractiles/Mustfile.a2ml @@ -63,12 +63,12 @@ hooks fail if any check fails. ### six-directory-present - description: 6a2 directory exists with required files -- run: test -d .machine_readable/6a2 && test -f .machine_readable/6a2/META.a2ml && test -f .machine_readable/6a2/ECOSYSTEM.a2ml && test -f .machine_readable/6a2/STATE.a2ml && test -f .machine_readable/6a2/PLAYBOOK.a2ml && test -f .machine_readable/6a2/AGENTIC.a2ml && test -f .machine_readable/6a2/NEUROSYM.a2ml +- run: test -d .machine_readable/descriptiles && test -f .machine_readable/descriptiles/META.a2ml && test -f .machine_readable/descriptiles/ECOSYSTEM.a2ml && test -f .machine_readable/descriptiles/STATE.a2ml && test -f .machine_readable/descriptiles/PLAYBOOK.a2ml && test -f .machine_readable/descriptiles/AGENTIC.a2ml && test -f .machine_readable/descriptiles/NEUROSYM.a2ml - severity: critical ### anchors-directory - description: anchors directory exists in 6a2 -- run: test -d .machine_readable/6a2/anchors +- run: test -d .machine_readable/descriptiles/anchors - severity: warning ### self-validating-structure diff --git a/.machine_readable/6a2/0-AI-MANIFEST.a2ml b/.machine_readable/descriptiles/0-AI-MANIFEST.a2ml similarity index 100% rename from .machine_readable/6a2/0-AI-MANIFEST.a2ml rename to .machine_readable/descriptiles/0-AI-MANIFEST.a2ml diff --git a/.machine_readable/6a2/AGENTIC.a2ml b/.machine_readable/descriptiles/AGENTIC.a2ml similarity index 100% rename from .machine_readable/6a2/AGENTIC.a2ml rename to .machine_readable/descriptiles/AGENTIC.a2ml diff --git a/.machine_readable/6a2/ECOSYSTEM.a2ml b/.machine_readable/descriptiles/ECOSYSTEM.a2ml similarity index 100% rename from .machine_readable/6a2/ECOSYSTEM.a2ml rename to .machine_readable/descriptiles/ECOSYSTEM.a2ml diff --git a/.machine_readable/6a2/META.a2ml b/.machine_readable/descriptiles/META.a2ml similarity index 97% rename from .machine_readable/6a2/META.a2ml rename to .machine_readable/descriptiles/META.a2ml index ba3375c..7f563a6 100644 --- a/.machine_readable/6a2/META.a2ml +++ b/.machine_readable/descriptiles/META.a2ml @@ -19,6 +19,8 @@ author = "Jonathan D.A. Jewell (hyperpolymath)" # - { id = "ADR-001", title = "Use Zig for FFI", status = "accepted", date = "2026-02-14" } [development-practices] +code-review = "required" +branch-protection = "enabled" build-tool = "just" container-runtime = "podman" ci-platform = "github-actions" diff --git a/.machine_readable/6a2/NEUROSYM.a2ml b/.machine_readable/descriptiles/NEUROSYM.a2ml similarity index 100% rename from .machine_readable/6a2/NEUROSYM.a2ml rename to .machine_readable/descriptiles/NEUROSYM.a2ml diff --git a/.machine_readable/6a2/PLAYBOOK.a2ml b/.machine_readable/descriptiles/PLAYBOOK.a2ml similarity index 93% rename from .machine_readable/6a2/PLAYBOOK.a2ml rename to .machine_readable/descriptiles/PLAYBOOK.a2ml index 6408e1c..c7bd686 100644 --- a/.machine_readable/6a2/PLAYBOOK.a2ml +++ b/.machine_readable/descriptiles/PLAYBOOK.a2ml @@ -13,7 +13,7 @@ last-updated = "2026-04-11" # target = "container" # container | binary | library | wasm [incident-response] -# 1. Check .machine_readable/STATE.a2ml for current status +# 1. Check .machine_readable/descriptiles/STATE.a2ml for current status # 2. Review recent commits and CI results # 3. Run `just validate` to check compliance # 4. Run `just security` to audit for vulnerabilities diff --git a/.machine_readable/6a2/README.adoc b/.machine_readable/descriptiles/README.adoc similarity index 100% rename from .machine_readable/6a2/README.adoc rename to .machine_readable/descriptiles/README.adoc diff --git a/.machine_readable/6a2/STATE.a2ml b/.machine_readable/descriptiles/STATE.a2ml similarity index 94% rename from .machine_readable/6a2/STATE.a2ml rename to .machine_readable/descriptiles/STATE.a2ml index feefcec..974e069 100644 --- a/.machine_readable/6a2/STATE.a2ml +++ b/.machine_readable/descriptiles/STATE.a2ml @@ -4,7 +4,7 @@ # STATE.a2ml — Project state checkpoint (META-TEMPLATE) # # This is the STATE file for fraying-model-computational-testbed itself. -# When consumed by a new project, replace {{PLACEHOLDER}} tokens +# When consumed by a new project, replace template placeholder tokens # and customize sections below for the target project. [metadata] @@ -59,6 +59,6 @@ depends-on = ["stapeln", "selur-compose", "cerro-torre", "svalinn", "vordr", "k9 # --------------------------------------------------------------------------- # NOTE FOR CONSUMERS: When using this template to create a new repo, reset -# the fields above to your project's values and replace all {{PLACEHOLDER}} +# the fields above to your project's values and replace all template placeholder # tokens. The milestones above describe the TEMPLATE's evolution, not yours. # --------------------------------------------------------------------------- diff --git a/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml b/.machine_readable/descriptiles/anchor/0-AI-MANIFEST.a2ml similarity index 100% rename from .machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml rename to .machine_readable/descriptiles/anchor/0-AI-MANIFEST.a2ml diff --git a/.machine_readable/6a2/anchor/ANCHOR.a2ml b/.machine_readable/descriptiles/anchor/ANCHOR.a2ml similarity index 100% rename from .machine_readable/6a2/anchor/ANCHOR.a2ml rename to .machine_readable/descriptiles/anchor/ANCHOR.a2ml diff --git a/.machine_readable/6a2/anchor/README.adoc b/.machine_readable/descriptiles/anchor/README.adoc similarity index 100% rename from .machine_readable/6a2/anchor/README.adoc rename to .machine_readable/descriptiles/anchor/README.adoc diff --git a/.machine_readable/policies/MAINTENANCE-AXES.a2ml b/.machine_readable/policies/MAINTENANCE-AXES.a2ml index eeffd27..c073b9a 100644 --- a/.machine_readable/policies/MAINTENANCE-AXES.a2ml +++ b/.machine_readable/policies/MAINTENANCE-AXES.a2ml @@ -18,7 +18,7 @@ machine-entrypoints = [ ".machine_readable/policies/MAINTENANCE-AXES.a2ml", ".machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml", ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml", - ".machine_readable/META.a2ml", + ".machine_readable/descriptiles/META.a2ml", ".machine_readable/ai/README.adoc", ".machine_readable/bot_directives/README.scm", ] diff --git a/.machine_readable/self-validating/methodology-guard.k9.ncl b/.machine_readable/self-validating/methodology-guard.k9.ncl index a364fa7..3f62d2b 100644 --- a/.machine_readable/self-validating/methodology-guard.k9.ncl +++ b/.machine_readable/self-validating/methodology-guard.k9.ncl @@ -55,7 +55,7 @@ let methodology_guard = { state_not_template = { description = "STATE.a2ml must not contain template placeholders", severity = "warning", - file = ".machine_readable/6a2/STATE.a2ml", + file = ".machine_readable/descriptiles/STATE.a2ml", reject_patterns = ["{{PLACEHOLDER}}", "{{PROJECT}}", "rsr-template-repo"], }, diff --git a/0-AI-MANIFEST.a2ml b/0-AI-MANIFEST.a2ml index e83d9d2..4bac3d1 100644 --- a/0-AI-MANIFEST.a2ml +++ b/0-AI-MANIFEST.a2ml @@ -17,9 +17,9 @@ initialization (for example `just init`) or explicitly provides values. - Local integration authority (this repo): - `Justfile` session recipes - `session/dispatch.sh` - - `session/custom-checks.k9` + - `session/custom-checks.k9.ncl` - `session/local-hooks.sh` - - `coordination.k9` + - `coordination.k9.ncl` ## Canonical Session Commands diff --git a/EXPLAINME.adoc b/EXPLAINME.adoc index d8b6d97..dad7cb7 100644 --- a/EXPLAINME.adoc +++ b/EXPLAINME.adoc @@ -15,8 +15,8 @@ How this is implemented: * The local dispatcher (`session/dispatch.sh`) maps canonical commands to central protocol paths in `standards/session-management-standards`. -* Local files (`session/custom-checks.k9`, `session/local-hooks.sh`, - `coordination.k9`) are integration-only. +* Local files (`session/custom-checks.k9.ncl`, `session/local-hooks.sh`, + `coordination.k9.ncl`) are integration-only. Caveat: diff --git a/Justfile b/Justfile index 11a65f8..4c488a1 100644 --- a/Justfile +++ b/Justfile @@ -53,7 +53,7 @@ info: @echo "Version: {{version}}" @echo "RSR Tier: {{tier}}" @echo "Recipes: $(just --summary | wc -w)" - @[ -f ".machine_readable/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true + @[ -f ".machine_readable/descriptiles/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/descriptiles/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true # Run Invariant Path overlay tools for this repository invariant-path *ARGS: @@ -250,12 +250,8 @@ init: echo "All placeholders replaced successfully!" fi - # K9-SVC validation (if available) - if command -v k9-svc >/dev/null 2>&1; then - echo "" - echo "Running k9-svc validation..." - k9-svc validate . 2>/dev/null || true - fi + # These session policies are Nickel K9 documents. + bash scripts/validate-session-contracts.sh echo "" echo "Running OpenSSF compliance verification..." @@ -346,7 +342,7 @@ verify-template: fi # Check for empty SCM files - for f in .machine_readable/6a2/STATE.a2ml .machine_readable/6a2/META.a2ml .machine_readable/6a2/ECOSYSTEM.a2ml; do + for f in .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml .machine_readable/descriptiles/ECOSYSTEM.a2ml; do if [ -f "$f" ] && grep -q '{{'{{'}}' "$f" 2>/dev/null; then echo "⚠ $f still has template placeholders" FOUND=1 @@ -408,10 +404,10 @@ self-assess: fi done - if [ -d ".machine_readable/6a2" ]; then - echo " ✓ .machine_readable/6a2/ — KEEP (SCM checkpoint files)" + if [ -d ".machine_readable/descriptiles" ]; then + echo " ✓ .machine_readable/descriptiles/ — KEEP (SCM checkpoint files)" else - echo " ✗ .machine_readable/6a2/ — MISSING (RSR violation!)" + echo " ✗ .machine_readable/descriptiles/ — MISSING (RSR violation!)" fi if [ -d ".github/workflows" ]; then @@ -564,9 +560,9 @@ verify: check_file "LICENSE" check_either "CONTRIBUTING.md" "CONTRIBUTING.adoc" check_either "README.adoc" "README.md" - check_file ".machine_readable/STATE.a2ml" - check_file ".machine_readable/META.a2ml" - check_file ".machine_readable/ECOSYSTEM.a2ml" + check_file ".machine_readable/descriptiles/STATE.a2ml" + check_file ".machine_readable/descriptiles/META.a2ml" + check_file ".machine_readable/descriptiles/ECOSYSTEM.a2ml" check_either "CHANGELOG.md" "CHANGELOG.adoc" # Check at least 1 workflow exists @@ -1056,7 +1052,7 @@ validate-rsr: for f in .editorconfig .gitignore Justfile README.adoc LICENSE 0-AI-MANIFEST.a2ml; do [ -f "$f" ] || MISSING="$MISSING $f" done - for f in .machine_readable/STATE.a2ml .machine_readable/META.a2ml .machine_readable/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do + for f in .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml .machine_readable/descriptiles/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do [ -f "$f" ] || MISSING="$MISSING $f" done for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/MPL-2.0.txt; do @@ -1071,15 +1067,15 @@ validate-rsr: for f in docs/governance/MAINTENANCE-CHECKLIST.adoc docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc; do [ -f "$f" ] || MISSING="$MISSING $f" done - if [ -f ".machine_readable/META.a2ml" ]; then - grep -q 'axis-1 = "must > intend > like"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-1" - grep -q 'axis-2 = "corrective > adaptive > perfective"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-2" - grep -q 'axis-3 = "systems > compliance > effects"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-3" - grep -q 'scoping-first = true' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:scoping-first" - grep -q 'idris-unsound-scan = "believe_me/assert_total"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:idris-unsound-scan" - grep -q 'audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:audit-focus" - grep -q 'compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:compliance-focus" - grep -q 'effects-evidence = "benchmark execution/results and maintainer status dialogue/review"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:effects-evidence" + if [ -f ".machine_readable/descriptiles/META.a2ml" ]; then + grep -q 'axis-1 = "must > intend > like"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:axis-1" + grep -q 'axis-2 = "corrective > adaptive > perfective"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:axis-2" + grep -q 'axis-3 = "systems > compliance > effects"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:axis-3" + grep -q 'scoping-first = true' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:scoping-first" + grep -q 'idris-unsound-scan = "believe_me/assert_total"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:idris-unsound-scan" + grep -q 'audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:audit-focus" + grep -q 'compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:compliance-focus" + grep -q 'effects-evidence = "benchmark execution/results and maintainer status dialogue/review"' .machine_readable/descriptiles/META.a2ml || MISSING="$MISSING META.a2ml:effects-evidence" grep -q 'compliance-tooling = "panic-attack"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:compliance-tooling" grep -q 'effects-tooling = "ecological checking with sustainabot guidance"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:effects-tooling" grep -q 'source-human = "docs/governance/MAINTENANCE-CHECKLIST.adoc"' .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml || MISSING="$MISSING MAINTENANCE-CHECKLIST.a2ml:source-human" @@ -1093,12 +1089,12 @@ validate-rsr: # Validate STATE.a2ml syntax validate-state: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - grep -q '^\[metadata\]' .machine_readable/STATE.a2ml && \ - grep -q 'project\s*=' .machine_readable/STATE.a2ml && \ + @if [ -f ".machine_readable/descriptiles/STATE.a2ml" ]; then \ + grep -q '^\[metadata\]' .machine_readable/descriptiles/STATE.a2ml && \ + grep -q 'project\s*=' .machine_readable/descriptiles/STATE.a2ml && \ echo "STATE.a2ml: valid" || echo "STATE.a2ml: INVALID (missing required sections)"; \ else \ - echo "No .machine_readable/STATE.a2ml found"; \ + echo "No .machine_readable/descriptiles/STATE.a2ml found"; \ fi # Validate AI installation guide completeness (finishbot pre-release check) @@ -1175,14 +1171,14 @@ validate: validate-rsr validate-state validate-ai-install # Update STATE.a2ml timestamp state-touch: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/STATE.a2ml && \ + @if [ -f ".machine_readable/descriptiles/STATE.a2ml" ]; then \ + sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/descriptiles/STATE.a2ml && \ echo "STATE.a2ml timestamp updated"; \ fi # Show current phase from STATE.a2ml state-phase: - @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml 2>/dev/null | head -1 || echo "unknown" + @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/descriptiles/STATE.a2ml 2>/dev/null | head -1 || echo "unknown" # ═══════════════════════════════════════════════════════════════════════════════ # GUIX & GUIX diff --git a/README.adoc b/README.adoc index cc9f320..a3d3032 100644 --- a/README.adoc +++ b/README.adoc @@ -36,10 +36,10 @@ Canonical command model: Local binding files in this template: * `+session/dispatch.sh+` -* `+session/custom-checks.k9+` +* `+session/custom-checks.k9.ncl+` * `+session/local-hooks.sh+` * `+session/README.md+` -* `+coordination.k9+` +* `+coordination.k9.ncl+` Run `+just+` `+session-help+` for local aliases. @@ -61,7 +61,7 @@ The template keeps a verified interface seam split: |`+session/+` |Thin local bindings to central session-management standards. -|`+coordination.k9+` |Local coordination wiring to canonical session +|`+coordination.k9.ncl+` |Local coordination wiring to canonical session commands. |`+docs/+` |Human-facing technical and governance documentation. diff --git a/TEMPLATE-STANDARDS-AUDIT.adoc b/TEMPLATE-STANDARDS-AUDIT.adoc index 9d931f3..f92272b 100644 --- a/TEMPLATE-STANDARDS-AUDIT.adoc +++ b/TEMPLATE-STANDARDS-AUDIT.adoc @@ -18,7 +18,7 @@ Audit scope: Inventory snapshot at audit time: * `rsr-template-repo` total tracked files discovered: `240` -* Session-local binding files discovered: `4` under `session/` plus `coordination.k9` +* Session-local binding files discovered: `4` under `session/` plus `coordination.k9.ncl` == Claim Vs Actual @@ -63,7 +63,7 @@ Inventory snapshot at audit time: | Session-management local binding files | target architecture -| `session/README.md`, `session/custom-checks.k9`, `session/local-hooks.sh`, `coordination.k9` +| `session/README.md`, `session/custom-checks.k9.ncl`, `session/local-hooks.sh`, `coordination.k9.ncl` | exists | Added as thin integration layer without protocol duplication. | Keep. @@ -90,7 +90,7 @@ Inventory snapshot at audit time: | Keep runtime artifacts out of authoritative standards docs. | Local policy hooks remain local -| `session/local-hooks.sh`, `session/custom-checks.k9` +| `session/local-hooks.sh`, `session/custom-checks.k9.ncl` | local session binding layer | exists | Policy/hook logic separated from central protocol definitions. @@ -107,10 +107,10 @@ Inventory snapshot at audit time: * `Justfile` canonical session aliases * `session/dispatch.sh` -* `session/custom-checks.k9` +* `session/custom-checks.k9.ncl` * `session/local-hooks.sh` * `session/README.md` -* `coordination.k9` +* `coordination.k9.ncl` * `AUDIT.adoc` (local gate summary) === Generated Runtime Artifact @@ -158,11 +158,11 @@ rsr-template-repo/ 0-AI-MANIFEST.a2ml EXPLAINME.adoc Justfile - coordination.k9 + coordination.k9.ncl session/ README.md dispatch.sh - custom-checks.k9 + custom-checks.k9.ncl local-hooks.sh docs/ ... (repo-local human docs) diff --git a/coordination.k9 b/coordination.k9.ncl similarity index 100% rename from coordination.k9 rename to coordination.k9.ncl diff --git a/docs/RSR_OUTLINE.adoc b/docs/RSR_OUTLINE.adoc index f807ec3..cc2464e 100644 --- a/docs/RSR_OUTLINE.adoc +++ b/docs/RSR_OUTLINE.adoc @@ -217,7 +217,7 @@ project/ * `Justfile` * `README.adoc` * `LICENSE` (MPL-2.0) -* `.machine_readable/STATE.a2ml` +* `.machine_readable/descriptiles/STATE.a2ml` * `.well-known/security.txt` * `.well-known/ai.txt` * `.well-known/humans.txt` diff --git a/docs/practice/AI-CONVENTIONS.adoc b/docs/practice/AI-CONVENTIONS.adoc index 2ad9a15..9af775a 100644 --- a/docs/practice/AI-CONVENTIONS.adoc +++ b/docs/practice/AI-CONVENTIONS.adoc @@ -12,7 +12,7 @@ Per-tool config files (.cursorrules, .clinerules, etc.) reference this document. ## Session Startup 1. Read `0-AI-MANIFEST.a2ml` FIRST (mandatory gatekeeper). -2. Read `.machine_readable/STATE.a2ml` for current status and blockers. +2. Read `.machine_readable/descriptiles/STATE.a2ml` for current status and blockers. 3. Read `.machine_readable/anchors/ANCHOR.a2ml` for canonical authority boundaries. 4. Read `.machine_readable/policies/MAINTENANCE-AXES.a2ml` for maintenance/audit sequencing. 5. Read `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` for baseline controls. @@ -80,7 +80,7 @@ Use `just` (Justfile) for all build, test, lint, and format tasks. - `0-AI-MANIFEST.a2ml` -- universal AI entry point - `.machine_readable/AGENTIC.a2ml` -- agent permissions and constraints -- `.machine_readable/STATE.a2ml` -- current project state +- `.machine_readable/descriptiles/STATE.a2ml` -- current project state - `.machine_readable/anchors/ANCHOR.a2ml` -- canonical authority and policy boundary - `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -- canonical axis sequencing and audit requirements - `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -- baseline maintenance checklist policy diff --git a/scripts/validate-session-contracts.sh b/scripts/validate-session-contracts.sh new file mode 100644 index 0000000..779faaf --- /dev/null +++ b/scripts/validate-session-contracts.sh @@ -0,0 +1,20 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +# Validate the two session policies with their actual Nickel evaluator. +set -euo pipefail +command -v nickel >/dev/null || { + echo "nickel is required to validate .k9.ncl session policies" >&2 + exit 2 +} +for file in coordination.k9.ncl session/custom-checks.k9.ncl; do + IFS= read -r magic < "$file" + if [[ "$magic" != 'K9!' ]]; then + echo "$file: missing K9! envelope" >&2 + exit 1 + fi + # K9! is a transport envelope, not a Nickel expression. These standalone + # records have no imports; evaluation also exercises their field contracts. + tail -n +2 "$file" | nickel export --format json >/dev/null + echo "$file: Nickel evaluation passed" +done + diff --git a/scripts/validate-template.sh b/scripts/validate-template.sh index f053202..f540d19 100755 --- a/scripts/validate-template.sh +++ b/scripts/validate-template.sh @@ -115,9 +115,9 @@ echo "" log_info "Phase 2: Machine-readable metadata (.machine_readable/)" echo "" -check_file_exists ".machine_readable/STATE.a2ml" "Project state" -check_file_exists ".machine_readable/META.a2ml" "Architecture decisions" -check_file_exists ".machine_readable/ECOSYSTEM.a2ml" "Ecosystem position" +check_file_exists ".machine_readable/descriptiles/STATE.a2ml" "Project state" +check_file_exists ".machine_readable/descriptiles/META.a2ml" "Architecture decisions" +check_file_exists ".machine_readable/descriptiles/ECOSYSTEM.a2ml" "Ecosystem position" check_file_exists ".machine_readable/anchors/ANCHOR.a2ml" "Semantic boundary anchor" check_file_exists ".machine_readable/policies/MAINTENANCE-AXES.a2ml" "Maintenance axes" @@ -213,7 +213,7 @@ if [ "$(basename "$REPO_ROOT")" = "rsr-template-repo" ]; then log_pass "Skipping placeholder check for template repo" else # Check that key files don't have unresolved placeholders - for file in "$REPO_ROOT/README.adoc" "$REPO_ROOT/Justfile" "$REPO_ROOT/.machine_readable/STATE.a2ml"; do + for file in "$REPO_ROOT/README.adoc" "$REPO_ROOT/Justfile" "$REPO_ROOT/.machine_readable/descriptiles/STATE.a2ml"; do if [ -f "$file" ]; then if has_placeholder "$file"; then log_warning "File contains unresolved placeholders: $(basename "$file")" diff --git a/session/README.adoc b/session/README.adoc index d14a6d7..29139e7 100644 --- a/session/README.adoc +++ b/session/README.adoc @@ -11,7 +11,7 @@ Authoritative protocols live in: This repo keeps only thin bindings: * `+dispatch.sh+` maps canonical commands to central protocol paths. -* `+custom-checks.k9+` defines repo-local policy checks. +* `+custom-checks.k9.ncl+` defines repo-local policy checks. * `+local-hooks.sh+` provides optional repo-specific hook behavior. === Canonical Commands diff --git a/session/custom-checks.k9 b/session/custom-checks.k9.ncl similarity index 100% rename from session/custom-checks.k9 rename to session/custom-checks.k9.ncl diff --git a/setup.sh b/setup.sh index 24c7e5e..87fbb2b 100755 --- a/setup.sh +++ b/setup.sh @@ -6,8 +6,7 @@ # Then hands off to `just setup` for project-specific configuration. # # Usage: -# curl -fsSL https://raw.githubusercontent.com/hyperpolymath/rsr-template-repo/main/setup.sh | sh -# # or after cloning: +# # After cloning and reviewing this repository: # ./setup.sh # # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -139,10 +138,7 @@ install_just() { case "$PKG_MGR" in dnf) sudo dnf install -y just ;; - apt) sudo apt-get install -y just 2>/dev/null || { - # just not in older apt repos — use installer - curl -fsSL https://just.systems/install.sh | bash -s -- --to /usr/local/bin - } ;; + apt) sudo apt-get install -y just ;; pacman) sudo pacman -S --noconfirm just ;; apk) sudo apk add just ;; brew) brew install just ;; @@ -152,8 +148,8 @@ install_just() { guix) guix install just ;; nix) nix-env -iA nixpkgs.just ;; *) - info "Using just installer script..." - curl -fsSL https://just.systems/install.sh | bash -s -- --to /usr/local/bin + fail "Install just with a trusted package manager: https://just.systems/" + return 1 ;; esac diff --git a/tests/e2e/template_instantiation_test.sh b/tests/e2e/template_instantiation_test.sh index 0d346d6..8d11346 100755 --- a/tests/e2e/template_instantiation_test.sh +++ b/tests/e2e/template_instantiation_test.sh @@ -236,8 +236,8 @@ done log_step "Verifying machine-readable metadata" METADATA_FILES=( - ".machine_readable/STATE.a2ml" - ".machine_readable/META.a2ml" + ".machine_readable/descriptiles/STATE.a2ml" + ".machine_readable/descriptiles/META.a2ml" ) for file in "${METADATA_FILES[@]}"; do From b8e971df681c8926bf967c4a1e716d8d90551080 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 9 Sep 2026 23:38:39 +0100 Subject: [PATCH 4/8] fix(ci): repair validator startup and consume shared workflow fixes --- .github/workflows/actions.lock | 18 +++++++++--------- .github/workflows/dogfood-gate.yml | 5 ++--- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/main-estate-audit.yml | 2 +- .github/workflows/mirror.yml | 11 +++++++++-- .github/workflows/repository-validation.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- MAINTAINERS | 3 ++- 11 files changed, 29 insertions(+), 22 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 81612a1..86bc909 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -12,8 +12,8 @@ workflows: - 'dependabot/fetch-metadata@v2.2.0' '.github/workflows/dogfood-gate.yml': - 'actions/checkout@v4.3.1' - - 'hyperpolymath/a2ml-ecosystem@main' - - 'hyperpolymath/k9-ecosystem@main' + - 'hyperpolymath/deed-ecosystem@main' + - 'hyperpolymath/k9-ecosystem@codex/science-ci-20260909' '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' '.github/workflows/main-estate-audit.yml': @@ -91,19 +91,19 @@ dependencies: commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745' owner_id: 9919 repo_id: 259445878 - 'hyperpolymath/a2ml-ecosystem@main': - ref: 'main' - commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79' - owner_id: 6759885 - repo_id: 1275649586 'hyperpolymath/cicd-suite@main': ref: 'main' commit: 'sha1-fc64172aa53e85289d5d7d6e15c2435a867cc1c9' owner_id: 6759885 repo_id: 1326697643 - 'hyperpolymath/k9-ecosystem@main': + 'hyperpolymath/deed-ecosystem@main': ref: 'main' - commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562' + commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d' + owner_id: 6759885 + repo_id: 1275649586 + 'hyperpolymath/k9-ecosystem@codex/science-ci-20260909': + ref: 'codex/science-ci-20260909' + commit: 'sha1-2ee51eed590b4722efcdca2fe4685ef24600bced' owner_id: 6759885 repo_id: 1275650185 'hyperpolymath/smtp-notify-action@v0.2.0': diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 4ff2429..3e1c75f 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -14,7 +14,6 @@ on: branches: [main, master] permissions: - actions: read contents: read jobs: @@ -41,7 +40,7 @@ jobs: - name: Validate A2ML manifests if: steps.detect.outputs.count > 0 - uses: hyperpolymath/a2ml-ecosystem/validate-action@main + uses: hyperpolymath/deed-ecosystem/validate-action@main with: path: '.' strict: 'false' @@ -90,7 +89,7 @@ jobs: - name: Validate K9 contracts if: steps.detect.outputs.k9_count > 0 - uses: hyperpolymath/k9-ecosystem/validate-action@main + uses: hyperpolymath/k9-ecosystem/validate-action@codex/science-ci-20260909 with: path: '.' strict: 'false' diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 13373fc..de406bf 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -15,4 +15,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index d65edb6..dab96a2 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -18,4 +18,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index ba07202..2b24b36 100755 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -1,6 +1,6 @@ # This workflow is managed by gh actions-lock. - # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Central Estate CI/CD Audit on: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c24fd19..6d6b11b 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -12,5 +12,12 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c - secrets: inherit + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 + secrets: + GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} + BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} + CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }} + SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} + DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }} + GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }} + RADICLE_KEY: ${{ secrets.RADICLE_KEY }} diff --git a/.github/workflows/repository-validation.yml b/.github/workflows/repository-validation.yml index 19d28fc..3a99055 100644 --- a/.github/workflows/repository-validation.yml +++ b/.github/workflows/repository-validation.yml @@ -20,7 +20,7 @@ jobs: - name: Install verified Nickel 1.17.0 run: | mkdir -p "$RUNNER_TEMP/nickel-bin" - curl --fail --silent --show-error --location \ + curl --proto '=https' --proto-redir '=https' --fail --silent --show-error --location \ https://github.com/nickel-lang/nickel/releases/download/1.17.0/nickel-x86_64-linux \ --output "$RUNNER_TEMP/nickel-bin/nickel" echo "afcdfa6e0fff31760cf229e85997456c02c00b8b3b84ff38f897ac7b3f39ae34 $RUNNER_TEMP/nickel-bin/nickel" | sha256sum --check --strict diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index d8faafd..5ad3e30 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -15,4 +15,4 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 1f2933a..2bb2118 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,7 +13,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index e2ea865..71a5b44 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -20,5 +20,5 @@ permissions: contents: read jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 secrets: inherit diff --git a/MAINTAINERS b/MAINTAINERS index 37f6411..b9b004c 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -6,7 +6,8 @@ This file lists the current maintainers of this project. | Name | GitHub | Role | Since | |------|--------|------|-------| -| Metadatastician | @metadatastician | Primary | Project Start | +| Jonathan D.A. Jewell | @hyperpolymath | Primary | Project Start | +| Metadatastician | @metadatastician | Maintainer | Project Start | ## Emeritus Maintainers From a3ab547c04eb6858e2ea13f43d03216bb81ec40e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 10 Sep 2026 01:49:41 +0100 Subject: [PATCH 5/8] fix(ci): finish canonical references and use validated shared gates --- .github/workflow-templates/e2e.yml | 4 ++-- .github/workflows/actions.lock | 17 ++++++++++++----- .github/workflows/dogfood-gate.yml | 2 +- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/repository-validation.yml | 2 ++ .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .machine_readable/ai/AI.a2ml | 2 +- .machine_readable/contractiles/Justfile | 2 +- .machine_readable/contractiles/Mustfile.a2ml | 2 +- Justfile | 19 +++++++++---------- docs/RSR_OUTLINE.adoc | 13 +++++++------ docs/practice/AI-CONVENTIONS.adoc | 8 ++++---- scripts/validate-session-contracts.sh | 16 +++++++++++++++- tests/{e2e.sh => templates/e2e.sh.template} | 0 tests/workflows/k9_typecheck_test.sh | 15 +++++++++++++++ 19 files changed, 76 insertions(+), 38 deletions(-) rename tests/{e2e.sh => templates/e2e.sh.template} (100%) create mode 100644 tests/workflows/k9_typecheck_test.sh diff --git a/.github/workflow-templates/e2e.yml b/.github/workflow-templates/e2e.yml index af4f0bc..b314a64 100644 --- a/.github/workflow-templates/e2e.yml +++ b/.github/workflow-templates/e2e.yml @@ -48,7 +48,7 @@ jobs: # - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable # - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 # - run: cargo build --release -# - run: bash tests/e2e.sh +# - run: bash tests/templates/e2e.sh.template # # OR: cargo test --test end_to_end -- --nocapture ## === ZIG FFI E2E === @@ -62,7 +62,7 @@ jobs: # with: # version: 0.15.0 # - run: cd ffi/zig && zig build test -# - run: bash tests/e2e.sh +# - run: bash tests/templates/e2e.sh.template ## === ELIXIR E2E === # e2e: diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 86bc909..71c0a3e 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -13,7 +13,7 @@ workflows: '.github/workflows/dogfood-gate.yml': - 'actions/checkout@v4.3.1' - 'hyperpolymath/deed-ecosystem@main' - - 'hyperpolymath/k9-ecosystem@codex/science-ci-20260909' + - 'hyperpolymath/k9-ecosystem@main' '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' '.github/workflows/main-estate-audit.yml': @@ -93,17 +93,24 @@ dependencies: repo_id: 259445878 'hyperpolymath/cicd-suite@main': ref: 'main' - commit: 'sha1-fc64172aa53e85289d5d7d6e15c2435a867cc1c9' + commit: 'sha1-5eb5ae8edac1a7213470ed40fc87499740476303' owner_id: 6759885 repo_id: 1326697643 + uses: + - 'hyperpolymath/deed-ecosystem@f7a40a4d5cc82b2e73f861119baa6818d77a448d' + 'hyperpolymath/deed-ecosystem@f7a40a4d5cc82b2e73f861119baa6818d77a448d': + ref: 'main' + commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d' + owner_id: 6759885 + repo_id: 1275649586 'hyperpolymath/deed-ecosystem@main': ref: 'main' commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d' owner_id: 6759885 repo_id: 1275649586 - 'hyperpolymath/k9-ecosystem@codex/science-ci-20260909': - ref: 'codex/science-ci-20260909' - commit: 'sha1-2ee51eed590b4722efcdca2fe4685ef24600bced' + 'hyperpolymath/k9-ecosystem@main': + ref: 'main' + commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb' owner_id: 6759885 repo_id: 1275650185 'hyperpolymath/smtp-notify-action@v0.2.0': diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 3e1c75f..a17a25e 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -89,7 +89,7 @@ jobs: - name: Validate K9 contracts if: steps.detect.outputs.k9_count > 0 - uses: hyperpolymath/k9-ecosystem/validate-action@codex/science-ci-20260909 + uses: hyperpolymath/k9-ecosystem/validate-action@main with: path: '.' strict: 'false' diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index de406bf..1a736f6 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -15,4 +15,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index dab96a2..63d32d9 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -18,4 +18,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 6d6b11b..9cdbe1e 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -12,7 +12,7 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a secrets: GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} diff --git a/.github/workflows/repository-validation.yml b/.github/workflows/repository-validation.yml index 3a99055..02edc53 100644 --- a/.github/workflows/repository-validation.yml +++ b/.github/workflows/repository-validation.yml @@ -28,6 +28,8 @@ jobs: echo "$RUNNER_TEMP/nickel-bin" >> "$GITHUB_PATH" - name: Check workflow conventions run: bash tests/workflows/validate_workflows_test.sh + - name: Check Nickel envelope regression controls + run: bash tests/workflows/k9_typecheck_test.sh - name: Evaluate session contracts run: bash scripts/validate-session-contracts.sh diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 5ad3e30..6856111 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -15,4 +15,4 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 2bb2118..f5f0b4a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,7 +13,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 71a5b44..0879b68 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -20,5 +20,5 @@ permissions: contents: read jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8e50188e183222ffeb44f9729dde056a33dded38 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a secrets: inherit diff --git a/.machine_readable/ai/AI.a2ml b/.machine_readable/ai/AI.a2ml index 346bbc6..ed3cd3c 100644 --- a/.machine_readable/ai/AI.a2ml +++ b/.machine_readable/ai/AI.a2ml @@ -8,7 +8,7 @@ ## Workflow 1. Inspect `.machine_readable/descriptiles/STATE.a2ml` for blockers and next actions. -2. Respect any constraints listed inside `.machine_readable/AGENTIC.a2ml` when tooling changes are requested. +2. Respect any constraints listed inside `.machine_readable/descriptiles/AGENTIC.a2ml` when tooling changes are requested. 3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message. ## Delivery Promises diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile index aaca89c..db39e05 100644 --- a/.machine_readable/contractiles/Justfile +++ b/.machine_readable/contractiles/Justfile @@ -1055,7 +1055,7 @@ validate-rsr: for f in .editorconfig .gitignore Justfile README.adoc LICENSE 0-AI-MANIFEST.a2ml; do [ -f "$f" ] || MISSING="$MISSING $f" done - for f in .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml .machine_readable/descriptiles/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do + for f in .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml .machine_readable/descriptiles/ECOSYSTEM.a2ml .machine_readable/descriptiles/anchor/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do [ -f "$f" ] || MISSING="$MISSING $f" done for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/MPL-2.0.txt; do diff --git a/.machine_readable/contractiles/Mustfile.a2ml b/.machine_readable/contractiles/Mustfile.a2ml index 9c9f869..9fa1d6b 100644 --- a/.machine_readable/contractiles/Mustfile.a2ml +++ b/.machine_readable/contractiles/Mustfile.a2ml @@ -68,7 +68,7 @@ hooks fail if any check fails. ### anchors-directory - description: anchors directory exists in 6a2 -- run: test -d .machine_readable/descriptiles/anchors +- run: test -d .machine_readable/descriptiles/anchor - severity: warning ### self-validating-structure diff --git a/Justfile b/Justfile index 4c488a1..f03f309 100644 --- a/Justfile +++ b/Justfile @@ -250,8 +250,12 @@ init: echo "All placeholders replaced successfully!" fi - # These session policies are Nickel K9 documents. - bash scripts/validate-session-contracts.sh + # CI always provisions Nickel; local initialisation can precede that environment. + if command -v nickel >/dev/null; then + bash scripts/validate-session-contracts.sh + else + echo "Session validation deferred: install Nickel 1.17.0, then run bash scripts/validate-session-contracts.sh" + fi echo "" echo "Running OpenSSF compliance verification..." @@ -652,13 +656,8 @@ test-smoke: # Run end-to-end tests (full pipeline: build → run → verify) e2e: - @echo "Running E2E tests..." - # TODO: Replace with your E2E test command. Examples: - # bash tests/e2e.sh # Shell-based E2E - # npx playwright test # Browser E2E - # mix test test/integration/e2e_test.exs # Elixir E2E - # cargo test --test end_to_end # Rust E2E - @echo "E2E tests passed!" + @echo "E2E tests are not implemented. Start from tests/templates/e2e.sh.template." >&2 + @exit 2 # Run aspect tests (cross-cutting concern validation) aspect: @@ -1052,7 +1051,7 @@ validate-rsr: for f in .editorconfig .gitignore Justfile README.adoc LICENSE 0-AI-MANIFEST.a2ml; do [ -f "$f" ] || MISSING="$MISSING $f" done - for f in .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml .machine_readable/descriptiles/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do + for f in .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml .machine_readable/descriptiles/ECOSYSTEM.a2ml .machine_readable/descriptiles/anchor/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do [ -f "$f" ] || MISSING="$MISSING $f" done for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/MPL-2.0.txt; do diff --git a/docs/RSR_OUTLINE.adoc b/docs/RSR_OUTLINE.adoc index cc2464e..81075e1 100644 --- a/docs/RSR_OUTLINE.adoc +++ b/docs/RSR_OUTLINE.adoc @@ -161,12 +161,13 @@ project/ │ ├── humans.txt │ └── security.txt ├── .machine_readable/ # ALL machine-readable content -│ ├── STATE.a2ml # Project state, progress, blockers -│ ├── META.a2ml # Architecture decisions, governance -│ ├── ECOSYSTEM.a2ml # Ecosystem position, relationships -│ ├── AGENTIC.a2ml # AI agent interaction patterns -│ ├── NEUROSYM.a2ml # Neurosymbolic integration config -│ ├── PLAYBOOK.a2ml # Operational runbook +│ ├── descriptiles/ # Canonical descriptive anchors +│ │ ├── STATE.a2ml # Project state, progress, blockers +│ │ ├── META.a2ml # Architecture decisions, governance +│ │ ├── ECOSYSTEM.a2ml # Ecosystem position, relationships +│ │ ├── AGENTIC.a2ml # AI agent interaction patterns +│ │ ├── NEUROSYM.a2ml # Neurosymbolic integration config +│ │ └── PLAYBOOK.a2ml # Operational runbook │ ├── bot_directives/ # Per-bot rules and constraints │ └── contractiles/ # Policy enforcement contracts │ ├── k9/ # Security levels (Kennel/Yard/Hunt) diff --git a/docs/practice/AI-CONVENTIONS.adoc b/docs/practice/AI-CONVENTIONS.adoc index 9af775a..fc9c822 100644 --- a/docs/practice/AI-CONVENTIONS.adoc +++ b/docs/practice/AI-CONVENTIONS.adoc @@ -13,11 +13,11 @@ Per-tool config files (.cursorrules, .clinerules, etc.) reference this document. 1. Read `0-AI-MANIFEST.a2ml` FIRST (mandatory gatekeeper). 2. Read `.machine_readable/descriptiles/STATE.a2ml` for current status and blockers. -3. Read `.machine_readable/anchors/ANCHOR.a2ml` for canonical authority boundaries. +3. Read `.machine_readable/descriptiles/anchor/ANCHOR.a2ml` for canonical authority boundaries. 4. Read `.machine_readable/policies/MAINTENANCE-AXES.a2ml` for maintenance/audit sequencing. 5. Read `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` for baseline controls. 6. Read `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` for execution order. -7. Read `.machine_readable/AGENTIC.a2ml` for agent constraints. +7. Read `.machine_readable/descriptiles/AGENTIC.a2ml` for agent constraints. ## License @@ -79,9 +79,9 @@ Use `just` (Justfile) for all build, test, lint, and format tasks. ## References - `0-AI-MANIFEST.a2ml` -- universal AI entry point -- `.machine_readable/AGENTIC.a2ml` -- agent permissions and constraints +- `.machine_readable/descriptiles/AGENTIC.a2ml` -- agent permissions and constraints - `.machine_readable/descriptiles/STATE.a2ml` -- current project state -- `.machine_readable/anchors/ANCHOR.a2ml` -- canonical authority and policy boundary +- `.machine_readable/descriptiles/anchor/ANCHOR.a2ml` -- canonical authority and policy boundary - `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -- canonical axis sequencing and audit requirements - `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -- baseline maintenance checklist policy - `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -- axis execution approach policy diff --git a/scripts/validate-session-contracts.sh b/scripts/validate-session-contracts.sh index 779faaf..54dd1cc 100644 --- a/scripts/validate-session-contracts.sh +++ b/scripts/validate-session-contracts.sh @@ -6,6 +6,21 @@ command -v nickel >/dev/null || { echo "nickel is required to validate .k9.ncl session policies" >&2 exit 2 } +if [[ "${1:-}" == --typecheck ]]; then + shift + [[ $# -gt 0 ]] || { echo 'Supply the instantiated Nickel or K9 files to typecheck' >&2; exit 2; } + for file in "$@"; do + IFS= read -r magic < "$file" + if [[ "$magic" == 'K9!' ]]; then + tail -n +2 "$file" | (cd -- "$(dirname -- "$file")" && nickel typecheck) + else + nickel typecheck "$file" + fi + echo "$file: Nickel typecheck passed (deployment not executed)" + done + exit 0 +fi +[[ $# -eq 0 ]] || { echo 'Usage: validate-session-contracts.sh [--typecheck FILE...]' >&2; exit 2; } for file in coordination.k9.ncl session/custom-checks.k9.ncl; do IFS= read -r magic < "$file" if [[ "$magic" != 'K9!' ]]; then @@ -17,4 +32,3 @@ for file in coordination.k9.ncl session/custom-checks.k9.ncl; do tail -n +2 "$file" | nickel export --format json >/dev/null echo "$file: Nickel evaluation passed" done - diff --git a/tests/e2e.sh b/tests/templates/e2e.sh.template similarity index 100% rename from tests/e2e.sh rename to tests/templates/e2e.sh.template diff --git a/tests/workflows/k9_typecheck_test.sh b/tests/workflows/k9_typecheck_test.sh new file mode 100644 index 0000000..5b38a91 --- /dev/null +++ b/tests/workflows/k9_typecheck_test.sh @@ -0,0 +1,15 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: MPL-2.0 +set -euo pipefail +root="$(cd "$(dirname "$0")/../.." && pwd)" +fixture="$(mktemp -d)" +trap 'rm -rf "$fixture"' EXIT +printf '%s\n' '{ value = 1 }' > "$fixture/plain.ncl" +printf '%s\n' 'K9!' '{ value = 1 }' > "$fixture/wrapped.k9.ncl" +printf '%s\n' 'K9!' '{ value = }' > "$fixture/bad.k9.ncl" +bash "$root/scripts/validate-session-contracts.sh" --typecheck "$fixture/plain.ncl" "$fixture/wrapped.k9.ncl" +if bash "$root/scripts/validate-session-contracts.sh" --typecheck "$fixture/bad.k9.ncl"; then + echo 'Invalid Nickel was accepted' >&2 + exit 1 +fi +echo 'PASS: plain and wrapped Nickel accepted; malformed Nickel rejected' From b9633971ef777bca39b72b3abc103383d8d1d71c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 10 Sep 2026 01:50:11 +0100 Subject: [PATCH 6/8] docs: name the existing session guide correctly --- TEMPLATE-STANDARDS-AUDIT.adoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/TEMPLATE-STANDARDS-AUDIT.adoc b/TEMPLATE-STANDARDS-AUDIT.adoc index f92272b..0148cd7 100644 --- a/TEMPLATE-STANDARDS-AUDIT.adoc +++ b/TEMPLATE-STANDARDS-AUDIT.adoc @@ -63,7 +63,7 @@ Inventory snapshot at audit time: | Session-management local binding files | target architecture -| `session/README.md`, `session/custom-checks.k9.ncl`, `session/local-hooks.sh`, `coordination.k9.ncl` +| `session/README.adoc`, `session/custom-checks.k9.ncl`, `session/local-hooks.sh`, `coordination.k9.ncl` | exists | Added as thin integration layer without protocol duplication. | Keep. @@ -83,7 +83,7 @@ Inventory snapshot at audit time: | Keep. | Runtime session artifacts stay per-repo -| `session/README.md`, `session/dispatch.sh` +| `session/README.adoc`, `session/dispatch.sh` | `.session/` in target repo path | exists | Dispatcher records canonical commands into runtime `.session/` files. @@ -109,7 +109,7 @@ Inventory snapshot at audit time: * `session/dispatch.sh` * `session/custom-checks.k9.ncl` * `session/local-hooks.sh` -* `session/README.md` +* `session/README.adoc` * `coordination.k9.ncl` * `AUDIT.adoc` (local gate summary) From 325174a167aea85a47f993a4a04df63d0b7510cd Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 10 Sep 2026 02:52:06 +0100 Subject: [PATCH 7/8] fix(ci): use native composite locks and current scanner contracts --- .github/workflows/actions.lock | 4 +++- .github/workflows/dependabot-automerge.yml | 2 +- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 4 +++- .github/workflows/secret-scanner.yml | 6 ++---- .github/workflows/static-analysis-gate.yml | 6 +++--- tests/templates/e2e.sh.template | 8 ++++---- tests/workflows/k9_typecheck_test.sh | 1 + 11 files changed, 21 insertions(+), 18 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 71c0a3e..280624c 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -93,11 +93,13 @@ dependencies: repo_id: 259445878 'hyperpolymath/cicd-suite@main': ref: 'main' - commit: 'sha1-5eb5ae8edac1a7213470ed40fc87499740476303' + commit: 'sha1-0405f138caa8e9ac10bc181f3b46224bbdcda693' owner_id: 6759885 repo_id: 1326697643 uses: - 'hyperpolymath/deed-ecosystem@f7a40a4d5cc82b2e73f861119baa6818d77a448d' + - 'hyperpolymath/deed-ecosystem@main' + - 'hyperpolymath/k9-ecosystem@main' 'hyperpolymath/deed-ecosystem@f7a40a4d5cc82b2e73f861119baa6818d77a448d': ref: 'main' commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d' diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index bda1498..7c49590 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -49,7 +49,7 @@ permissions: jobs: automerge: # Only run for PRs actually authored by Dependabot. - if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' + if: github.actor_id == '49699333' && github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest timeout-minutes: 15 steps: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 1a736f6..3c51090 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -15,4 +15,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 63d32d9..b3c3bae 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -18,4 +18,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 9cdbe1e..9087230 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -12,7 +12,7 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 secrets: GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 6856111..688afcd 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -15,4 +15,4 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f5f0b4a..13f46c8 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -3,6 +3,8 @@ name: OSSF Scorecard on: + pull_request: + branches: ["**"] schedule: - cron: '0 4 * * *' workflow_dispatch: @@ -13,7 +15,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 0879b68..2fdb749 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -5,8 +5,7 @@ # estate-wide as redundant, and this repo had no other leak scanning, so the # scanner is UPGRADED here rather than removed. # -# `secrets: inherit` is REQUIRED — without it the gitleaks action's inner -# secrets.GITHUB_TOKEN is empty and the scan silently degrades. +# The reusable runs the pinned scanners directly and needs no caller secrets. name: 'Secret Scanner' on: pull_request: @@ -20,5 +19,4 @@ permissions: contents: read jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@e9fa12b965897f485f8ec143e048a424b52f689a - secrets: inherit + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index d60404f..6a12927 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -70,7 +70,7 @@ jobs: TOTAL=$(jq '. | length' panic-attack-findings.json 2>/dev/null || echo 0) CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' panic-attack-findings.json 2>/dev/null || echo 0) HIGH=$(jq '[.[] | select(.severity == "high")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' panic-attack-findings.json 2>/dev/null || echo 0) + MEDIUM=$(jq '[.[] | select(.severity == "medium" or .severity == "warn")] | length' panic-attack-findings.json 2>/dev/null || echo 0) LOW=$(jq '[.[] | select(.severity == "low")] | length' panic-attack-findings.json 2>/dev/null || echo 0) echo "total=$TOTAL" >> "$GITHUB_OUTPUT" @@ -198,7 +198,7 @@ jobs: TOTAL=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0) CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json 2>/dev/null || echo 0) HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json 2>/dev/null || echo 0) + MEDIUM=$(jq '[.[] | select(.severity == "medium" or .severity == "warn")] | length' hypatia-findings.json 2>/dev/null || echo 0) LOW=$(jq '[.[] | select(.severity == "low")] | length' hypatia-findings.json 2>/dev/null || echo 0) echo "total=$TOTAL" >> "$GITHUB_OUTPUT" @@ -410,7 +410,7 @@ jobs: TOTAL=$(jq '.findings | length' findings/unified-findings.json) CRITICAL=$(jq '[.findings[] | select(.severity == "critical")] | length' findings/unified-findings.json) HIGH=$(jq '[.findings[] | select(.severity == "high")] | length' findings/unified-findings.json) - MEDIUM=$(jq '[.findings[] | select(.severity == "medium")] | length' findings/unified-findings.json) + MEDIUM=$(jq '[.findings[] | select(.severity == "medium" or .severity == "warn")] | length' findings/unified-findings.json) LOW=$(jq '[.findings[] | select(.severity == "low")] | length' findings/unified-findings.json) echo "total=$TOTAL" >> "$GITHUB_OUTPUT" diff --git a/tests/templates/e2e.sh.template b/tests/templates/e2e.sh.template index 11143fc..2b55c8b 100755 --- a/tests/templates/e2e.sh.template +++ b/tests/templates/e2e.sh.template @@ -8,8 +8,8 @@ # Customise this file for your project. Delete the examples that don't apply. # # Usage: -# bash tests/e2e.sh -# just e2e +# bash tests/templates/e2e.sh.template +# Enable the workflow template only after replacing the examples with real checks. # # Merge requirements (STANDING): All 6 test categories must pass before merge: # P2P, E2E (this file), aspect, execution, lifecycle, benchmarks @@ -17,7 +17,7 @@ set -euo pipefail SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)" +PROJECT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)" PASS=0 FAIL=0 @@ -34,7 +34,7 @@ bold() { printf '\033[1m%s\033[0m\n' "$*"; } # check