From cf3c9fc5c8379c793b6366b6008a7fa48a14d982 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:44:43 +0100 Subject: [PATCH 1/7] chore: estate-wide security compliance --- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/e2e.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-dispatch-intake.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/learning-loop.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/panicbot-sweep.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/repo-integrity-guard.yml | 1 + .github/workflows/rust.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/supervised-fleet-scan.yml | 1 + 19 files changed, 19 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index a8bed185..4210c07e 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -17,4 +17,5 @@ jobs: curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"} continue-on-error: true permissions: + actions: read contents: read diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 63982879..9ab734ef 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e1609526..50403a8d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,6 +20,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 652bb867..607e339d 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -13,6 +13,7 @@ on: branches: [main, master] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 04db86fb..b66b05bf 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -6,6 +6,7 @@ on: pull_request: branches: ['**'] permissions: + actions: read contents: read jobs: e2e: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 31b793c3..c396eb79 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -27,6 +27,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-dispatch-intake.yml b/.github/workflows/hypatia-dispatch-intake.yml index 2157eba9..8d4708a7 100644 --- a/.github/workflows/hypatia-dispatch-intake.yml +++ b/.github/workflows/hypatia-dispatch-intake.yml @@ -11,6 +11,7 @@ on: - hypatia-general-findings permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index df7c890a..f058a2cf 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -21,6 +21,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read security-events: write pull-requests: write diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 78be809b..779601af 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -9,6 +9,7 @@ on: types: [published] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/learning-loop.yml b/.github/workflows/learning-loop.yml index fd7b48d3..f0bfa3eb 100644 --- a/.github/workflows/learning-loop.yml +++ b/.github/workflows/learning-loop.yml @@ -8,6 +8,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index fe6f7afd..8d214aaf 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 85963742..50092a45 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -5,6 +5,7 @@ on: branches: [main, master] workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/panicbot-sweep.yml b/.github/workflows/panicbot-sweep.yml index 396b3f3a..6fadd390 100644 --- a/.github/workflows/panicbot-sweep.yml +++ b/.github/workflows/panicbot-sweep.yml @@ -28,6 +28,7 @@ on: - guardian permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 08167719..ce036e21 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/repo-integrity-guard.yml b/.github/workflows/repo-integrity-guard.yml index 8d10cc47..9f2d555e 100644 --- a/.github/workflows/repo-integrity-guard.yml +++ b/.github/workflows/repo-integrity-guard.yml @@ -22,6 +22,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read env: diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index f9f17e63..a3c87280 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -10,6 +10,7 @@ on: pull_request: branches: ['**'] permissions: + actions: read contents: read env: CARGO_TERM_COLOR: always diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 2d9ea22d..8afb3f3b 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: branches: [main] permissions: read-all + actions: read jobs: analysis: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 66572b82..e59938a0 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,6 +11,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/supervised-fleet-scan.yml b/.github/workflows/supervised-fleet-scan.yml index 66da24f2..3ac4df49 100644 --- a/.github/workflows/supervised-fleet-scan.yml +++ b/.github/workflows/supervised-fleet-scan.yml @@ -22,6 +22,7 @@ on: default: true permissions: + actions: read contents: read jobs: From 7dfa3ed5c36543ffa903be21aadc9256be94689e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:09:08 +0100 Subject: [PATCH 2/7] chore: remove duplicate GOVERNANCE files, keep GOVERNANCE.md --- .claude/worktrees/actions-policy | 1 + GOVERNANCE.adoc | 162 ------------------------------- 2 files changed, 1 insertion(+), 162 deletions(-) create mode 160000 .claude/worktrees/actions-policy delete mode 100644 GOVERNANCE.adoc diff --git a/.claude/worktrees/actions-policy b/.claude/worktrees/actions-policy new file mode 160000 index 00000000..556f841e --- /dev/null +++ b/.claude/worktrees/actions-policy @@ -0,0 +1 @@ +Subproject commit 556f841e4e638555885ec15f28052223ecf849c1 diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index e41020d3..00000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,162 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -= Governance Model -:toc: preamble - -This document describes the governance model for this repository. - -== Overview - -This repository follows a **Sole Maintainer Governance Model**: - -* Single maintainer (@hyperpolymath) has full authority over the project -* All contributions are welcome and reviewed by the maintainer -* Decisions are made transparently through GitHub issues and discussions -* The project adheres to the hyperpolymath estate policies where applicable - -== Core Principles - -[cols="1,2"] -|=== -| Principle | Description - -| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input - -| **Meritocracy** | Contributions are judged on technical merit, not contributor identity - -| **Transparency** | All significant decisions are documented publicly - -| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary - -| **Open Contribution** | Anyone can contribute via fork and pull request - -|=== - -== Roles and Permissions - -[cols="1,2,2"] -|=== -| Role | Permissions | Assignment - -| **Maintainer** | Write access, merge rights, admin | @hyperpolymath -| **Contributors** | Read access, fork, submit PRs | All GitHub users -| **Users** | Use the software, report issues | All GitHub users - -|=== - -== Decision Making Framework - -=== Routine Decisions - -* Bug fixes -* Documentation improvements -* Minor feature additions -* Dependency updates - -**Process**: Maintainer reviews and merges PRs that meet quality standards. - -=== Significant Changes - -* New major features -* API changes -* Architecture modifications -* Breaking changes - -**Process**: -. Open issue describing the change -. Discuss with community (minimum 72 hours) -. Maintainer makes final decision -. Document rationale in issue/PR - -=== Structural Decisions - -* Repository purpose/renaming -* License changes -* Ownership transfer -* Deprecation/archival - -**Process**: -. Extended discussion (minimum 1 week) -. Maintainer makes final decision -. Document in CHANGELOG and governance docs - -== Contribution Lifecycle - -[cols="1,2"] -|=== -| Stage | Process - -| **Ideation** | Open issue, discuss feasibility - -| **Development** | Fork, implement, test thoroughly - -| **Review** | Submit PR, maintainer reviews within 7 days - -| **Merge** | Maintainer merges or requests changes - -| **Release** | Maintainer publishes according to project conventions - -|=== - -== Conflict Resolution - -In case of disagreements: - -. Discuss in the relevant GitHub issue or PR -. Provide technical justification for positions -. Maintainer mediates and makes final decision -. Decision is documented and can be revisited later - -== Project Policies - -This repository adheres to hyperpolymath estate-wide policies: - -* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc) -* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md -* **Security**: Follows hyperpolymath SECURITY.md -* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions - -== Repository-Specific Conventions - -[cols="1,2"] -|=== -| Convention | Description - -| **Signing** | All commits must be signed (SSH or GPG) - -| **SPDX Headers** | All source files must have SPDX license identifiers - -| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root - -| **Machine Readable** | META.a2ml in .machine_readable/6a2/ - -| **CI/CD** | GitHub Actions workflows in .github/workflows/ - -|=== - -== Governance Evolution - -As the project grows, this governance model may evolve: - -* **Adding Co-Maintainers**: When contribution volume warrants it -* **Forming a Team**: For complex multi-maintainer projects -* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories) - -Changes to this document require the same process as Significant Changes above. - -== See Also - -* link:MAINTAINERS.adoc[Maintainers] -* link:CODE_OF_CONDUCT.md[Code of Conduct] -* link:CONTRIBUTING.adoc[Contributing Guide] -* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy] -* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)] - -== Changelog - -[cols="1,1,1"] -|=== -| Date | Change | By - -| 2026-06-07 | Initial governance model established | @hyperpolymath -|=== From 1e626358dba6cd7948bd7d2984a5cf5c64eca80f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 16:00:18 +0100 Subject: [PATCH 3/7] chore: update guix.scm from squisher-corpus --- guix.scm | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/guix.scm b/guix.scm index e1a566da..c6dd7be8 100644 --- a/guix.scm +++ b/guix.scm @@ -1,5 +1,5 @@ ; SPDX-License-Identifier: MPL-2.0 -;; guix.scm — GNU Guix package definition for gitbot-fleet +;; guix.scm — GNU Guix package definition for squisher-corpus ;; Usage: guix shell -f guix.scm (use-modules (guix packages) @@ -7,12 +7,12 @@ (guix licenses)) (package - (name "gitbot-fleet") + (name "squisher-corpus") (version "0.1.0") (source #f) (build-system gnu-build-system) - (synopsis "gitbot-fleet") - (description "gitbot-fleet — part of the hyperpolymath ecosystem.") - (home-page "https://github.com/hyperpolymath/gitbot-fleet") - (license ((@@ (guix licenses) license) "MPL-2.0" + (synopsis "squisher-corpus") + (description "squisher-corpus — part of the hyperpolymath ecosystem.") + (home-page "https://github.com/hyperpolymath/squisher-corpus") + (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" "https://github.com/hyperpolymath/palimpsest-license"))) From 4d508d5ad03b27167154f301cc9b664faee7f83e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 16:00:24 +0100 Subject: [PATCH 4/7] chore: update guix.scm from squisher-corpus --- bots/echidnabot/guix.scm | 87 +++++++--------------------------------- 1 file changed, 15 insertions(+), 72 deletions(-) diff --git a/bots/echidnabot/guix.scm b/bots/echidnabot/guix.scm index 3ace6106..c6dd7be8 100644 --- a/bots/echidnabot/guix.scm +++ b/bots/echidnabot/guix.scm @@ -1,75 +1,18 @@ -;; echidnabot - Guix Package Definition -;; Development: guix shell -D -f guix.scm -;; Build: guix build -f guix.scm +; SPDX-License-Identifier: MPL-2.0 +;; guix.scm — GNU Guix package definition for squisher-corpus +;; Usage: guix shell -f guix.scm (use-modules (guix packages) - (guix gexp) - (guix git-download) - (guix build-system cargo) - ((guix licenses) #:prefix license:) - (gnu packages base) - (gnu packages crates-io) - (gnu packages rust) - (gnu packages rust-apps) - (gnu packages sqlite) - (gnu packages tls) - (gnu packages pkg-config)) + (guix build-system gnu) + (guix licenses)) -(define-public echidnabot - (package - (name "echidnabot") - (version "0.1.0") - (source (local-file "." "echidnabot-checkout" - #:recursive? #t - #:select? (git-predicate "."))) - (build-system cargo-build-system) - (arguments - `(#:cargo-inputs - (;; Core async runtime - ("rust-tokio" ,rust-tokio-1) - ;; HTTP framework - ("rust-axum" ,rust-axum-0.7) - ("rust-tower" ,rust-tower-0.4) - ("rust-tower-http" ,rust-tower-http-0.5) - ;; Serialization - ("rust-serde" ,rust-serde-1) - ("rust-serde-json" ,rust-serde-json-1) - ("rust-toml" ,rust-toml-0.8) - ;; Database - ("rust-sqlx" ,rust-sqlx-0.8) - ;; HTTP client - ("rust-reqwest" ,rust-reqwest-0.11) - ;; Utilities - ("rust-uuid" ,rust-uuid-1) - ("rust-chrono" ,rust-chrono-0.4) - ("rust-thiserror" ,rust-thiserror-1) - ("rust-anyhow" ,rust-anyhow-1) - ("rust-tracing" ,rust-tracing-0.1) - ("rust-tracing-subscriber" ,rust-tracing-subscriber-0.3) - ;; Crypto - ("rust-hmac" ,rust-hmac-0.12) - ("rust-sha2" ,rust-sha2-0.10) - ("rust-hex" ,rust-hex-0.4) - ;; CLI - ("rust-clap" ,rust-clap-4) - ("rust-config" ,rust-config-0.14)) - #:cargo-development-inputs - (("rust-tokio-test" ,rust-tokio-test-0.4) - ("rust-tempfile" ,rust-tempfile-3)))) - (native-inputs - (list pkg-config - rust - rust-cargo)) - (inputs - (list sqlite - openssl)) - (synopsis "Proof-aware CI bot for theorem prover repositories") - (description - "echidnabot monitors code repositories containing formal proofs and -delegates verification to ECHIDNA Core. It integrates with GitHub, GitLab, -and Bitbucket to provide automated proof checking via webhooks.") - (home-page "https://github.com/hyperpolymath/echidnabot") - (license license:agpl3+))) - -;; For development shell -echidnabot +(package + (name "squisher-corpus") + (version "0.1.0") + (source #f) + (build-system gnu-build-system) + (synopsis "squisher-corpus") + (description "squisher-corpus — part of the hyperpolymath ecosystem.") + (home-page "https://github.com/hyperpolymath/squisher-corpus") + (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" + "https://github.com/hyperpolymath/palimpsest-license"))) From 15fa5fdbe7b59fcfd77067322b9ff6683f3a7dc8 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 29 Jul 2026 08:57:48 +0100 Subject: [PATCH 5/7] chore: exclude data directories from gitbot-shared-context package Add exclude field to Cargo.toml to prevent packaging data files (findings/, learning/, dispatch/) which contain runtime data, not source code. This allows gitbot-shared-context to be packaged and published to crates.io. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- shared-context/Cargo.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/shared-context/Cargo.toml b/shared-context/Cargo.toml index b6036241..23c54f2e 100644 --- a/shared-context/Cargo.toml +++ b/shared-context/Cargo.toml @@ -9,6 +9,7 @@ license = "MPL-2.0" repository = "https://github.com/hyperpolymath/gitbot-fleet" keywords = ["gitbot-fleet", "coordination", "context", "ci-cd"] categories = ["development-tools"] +exclude = ["findings/", "learning/", "dispatch/"] [dependencies] # Serialization From 7e6cfd2accb902087b88ef6efee8f0ffa6fdef71 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 30 Jul 2026 23:59:13 +0100 Subject: [PATCH 6/7] feat(scripts): add python dependabot pruner to fix-dependabot.sh --- scripts/fix-dependabot.sh | 5 +-- scripts/prune-dependabot.py | 66 +++++++++++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+), 2 deletions(-) create mode 100755 scripts/prune-dependabot.py diff --git a/scripts/fix-dependabot.sh b/scripts/fix-dependabot.sh index 4864bbee..a988766e 100755 --- a/scripts/fix-dependabot.sh +++ b/scripts/fix-dependabot.sh @@ -17,10 +17,11 @@ source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true REPO_PATH="${1:?Usage: fix-dependabot.sh }" FINDING_JSON="${2:?Usage: fix-dependabot.sh }" -# --- Idempotency check --- +# --- Idempotency check & prune --- if [[ -f "${REPO_PATH}/.github/dependabot.yml" ]] || \ [[ -f "${REPO_PATH}/.github/dependabot.yaml" ]]; then - echo "[fix-dependabot] dependabot.yml already exists — skipping." + echo "[fix-dependabot] dependabot.yml already exists — pruning invalid ecosystems." + python3 "$SCRIPT_DIR/prune-dependabot.py" "$REPO_PATH" exit 0 fi diff --git a/scripts/prune-dependabot.py b/scripts/prune-dependabot.py new file mode 100755 index 00000000..1efaa575 --- /dev/null +++ b/scripts/prune-dependabot.py @@ -0,0 +1,66 @@ +#!/usr/bin/env python3 +import sys +import os +import yaml + +if len(sys.argv) < 2: + print("Usage: prune-dependabot.py ") + sys.exit(1) + +repo_path = sys.argv[1] +dependabot_yml = os.path.join(repo_path, '.github', 'dependabot.yml') +dependabot_yaml = os.path.join(repo_path, '.github', 'dependabot.yaml') + +file_to_process = None +if os.path.exists(dependabot_yml): + file_to_process = dependabot_yml +elif os.path.exists(dependabot_yaml): + file_to_process = dependabot_yaml + +if not file_to_process: + sys.exit(0) + +try: + with open(file_to_process, 'r') as f: + config = yaml.safe_load(f) +except Exception as e: + print(f"Failed to load yaml: {e}") + sys.exit(0) + +if not config or 'updates' not in config: + sys.exit(0) + +def has_manifest(repo, ecosystem): + if ecosystem == 'cargo': + return os.path.exists(os.path.join(repo, 'Cargo.toml')) + if ecosystem == 'mix': + return os.path.exists(os.path.join(repo, 'mix.exs')) + if ecosystem == 'npm': + return os.path.exists(os.path.join(repo, 'package.json')) + if ecosystem == 'bundler': + return os.path.exists(os.path.join(repo, 'Gemfile')) + if ecosystem == 'pip': + return os.path.exists(os.path.join(repo, 'requirements.txt')) or os.path.exists(os.path.join(repo, 'setup.py')) + if ecosystem == 'gomod': + return os.path.exists(os.path.join(repo, 'go.mod')) + if ecosystem == 'github-actions': + return True + return False + +original_updates = config['updates'] +new_updates = [] +changed = False + +for update in original_updates: + ecosystem = update.get('package-ecosystem') + if has_manifest(repo_path, ecosystem): + new_updates.append(update) + else: + changed = True + print(f"Pruned missing ecosystem: {ecosystem}") + +if changed: + config['updates'] = new_updates + with open(file_to_process, 'w') as f: + yaml.dump(config, f, sort_keys=False) + print("dependabot.yml updated.") From 9b86ff5c6418e1a08c8518db057e3d58133c76aa Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 31 Jul 2026 08:53:26 +0100 Subject: [PATCH 7/7] refactor(scripts): replace python pruner with yq in dependabot scripts --- .claude/worktrees/actions-policy | 2 +- .editorconfig | 64 ++++++++++++--- .gitattributes | 10 ++- .gitignore | 14 ++++ mise.toml | 79 ++++++------------- robot-repo-automaton/.editorconfig | 2 +- robot-repo-automaton/.gitattributes | 1 + .../.github/workflows/codeql.yml | 6 +- .../templates/skeleton/.editorconfig | 3 + .../templates/skeleton/.gitattributes | 17 +--- scripts/fix-dependabot.sh | 9 ++- scripts/prune-dependabot.py | 66 ---------------- .../academic-workflow-suite/latest.json | 1 - 13 files changed, 120 insertions(+), 154 deletions(-) delete mode 100755 scripts/prune-dependabot.py delete mode 120000 shared-context/findings/academic-workflow-suite/latest.json diff --git a/.claude/worktrees/actions-policy b/.claude/worktrees/actions-policy index 556f841e..e82290be 160000 --- a/.claude/worktrees/actions-policy +++ b/.claude/worktrees/actions-policy @@ -1 +1 @@ -Subproject commit 556f841e4e638555885ec15f28052223ecf849c1 +Subproject commit e82290be1edf92504522d242cc60ae0183f6b8ad diff --git a/.editorconfig b/.editorconfig index 38bb361d..fc6650ce 100644 --- a/.editorconfig +++ b/.editorconfig @@ -1,24 +1,68 @@ -# SPDX-License-Identifier: MPL-2.0 -# SPDX-FileCopyrightText: 2025 hyperpolymath +# RSR-template-repo - Editor Configuration +# https://editorconfig.org root = true [*] -indent_style = space -indent_size = 2 -end_of_line = lf charset = utf-8 -trim_trailing_whitespace = true +end_of_line = lf +indent_size = 2 +indent_style = space insert_final_newline = true +trim_trailing_whitespace = true + +[*.md] +trim_trailing_whitespace = false + +[*.adoc] +trim_trailing_whitespace = false [*.rs] indent_size = 4 +[*.ex] +indent_size = 2 + +[*.exs] +indent_size = 2 + +[*.zig] +indent_size = 4 + +[*.ada] +indent_size = 3 + +[*.adb] +indent_size = 3 + +[*.ads] +indent_size = 3 + +[*.hs] +indent_size = 2 + +[*.res] +indent_size = 2 + +[*.resi] +indent_size = 2 + +[*.ncl] +indent_size = 2 + +[*.rkt] +indent_size = 2 + [*.scm] indent_size = 2 -[Makefile] -indent_style = tab +[*.nix] +indent_size = 2 -[*.md] -trim_trailing_whitespace = false +[Justfile] +indent_style = space +indent_size = 4 + +[justfile] +indent_style = space +indent_size = 4 diff --git a/.gitattributes b/.gitattributes index 266d07d0..e860a85c 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,6 +1,8 @@ # SPDX-License-Identifier: MPL-2.0 # RSR-compliant .gitattributes + * text=auto eol=lf + # Source *.rs text eol=lf diff=rust *.ex text eol=lf diff=elixir @@ -16,23 +18,28 @@ *.scm text eol=lf *.ncl text eol=lf *.nix text eol=lf + # Docs *.md text eol=lf diff=markdown *.adoc text eol=lf *.txt text eol=lf + # Data *.json text eol=lf *.yaml text eol=lf *.yml text eol=lf *.toml text eol=lf + # Config .gitignore text eol=lf .gitattributes text eol=lf justfile text eol=lf Makefile text eol=lf Containerfile text eol=lf + # Scripts *.sh text eol=lf + # Binary *.png binary *.jpg binary @@ -41,6 +48,7 @@ Containerfile text eol=lf *.woff2 binary *.zip binary *.gz binary + # Lock files Cargo.lock text eol=lf -diff -shared-context/learning/*.jsonl filter=lfs diff=lfs merge=lfs -text +flake.lock text eol=lf -diff diff --git a/.gitignore b/.gitignore index 490c6777..74ac70f1 100644 --- a/.gitignore +++ b/.gitignore @@ -145,3 +145,17 @@ bun.lockb yarn.lock pnpm-lock.yaml .npmrc +*.db +*.db-journal +*.db-shm +*.db-wal +.claude/ +.editorconfig +.env.* +/exports/*.json +/exports/*.lgt +/logs/ +ai-cli-crash-capture/ +composer/*.beam +composer/build/ +secrets/ diff --git a/mise.toml b/mise.toml index e66c9f5e..6dd983f6 100644 --- a/mise.toml +++ b/mise.toml @@ -1,8 +1,3 @@ -# Every tool name below was checked against `mise registry` AND resolved with -# `mise ls-remote` before being written. The previous version of this file named -# 13 tools that do not exist in the registry, so mise emitted ~25 lines of -# warnings on every shell entry while installing none of them. - [tools] # Language runtimes node = "latest" @@ -12,16 +7,20 @@ go = "latest" zig = "latest" java = "latest" bun = "latest" -deno = "latest" # was `denojs` — not a registry name +denojs = "latest" -# Package managers / task runner +# Package managers npm = "latest" yarn = "latest" pnpm = "latest" -just = "latest" # the estate's task runner (Justfile) +pip = "latest" +cargo = "latest" +go-task = "latest" -# Formatting & linting +# Formatting & Linting +gofmt = "latest" black = "latest" +isort = "latest" ruff = "latest" prettier = "latest" shfmt = "latest" @@ -32,53 +31,27 @@ cmake = "latest" make = "latest" ninja = "latest" -# --------------------------------------------------------------------------- -# REMOVED — none of these resolve in the mise registry, so they installed -# nothing and only produced warnings. Grouped by why they were wrong: -# -# Already provided by a tool that IS listed above: -# cargo -> ships with `rust` -# gofmt -> ships with `go` -# pip -> ships with `python` -# -# Project-level dependencies, not system tools. These belong in -# package.json / pyproject.toml / mix.exs, not in a toolchain manager: -# vitest, jest, pytest, isort -# -# Base system binaries that mise should not be shadowing on Linux: -# git, gnu-sed, gnu-grep, gnu-tar -# (If a GNU-vs-BSD coreutils difference ever actually bites on macOS, add -# `coreutils`, which does exist in the registry, rather than these names.) -# -# Task runner that never installed: -# go-task -> not a registry name. NB the bare name `task` does not work -# either: `mise registry` LISTS it as `aqua:go-task/task`, but resolving -# `task@latest` still fails. Appearing in `mise registry` output is NOT -# sufficient to conclude a name resolves — check with `mise ls-remote`. -# `just` is listed above instead. -# --------------------------------------------------------------------------- +# Shell tools +git = "latest" +gnu-sed = "latest" +gnu-tar = "latest" +gnu-grep = "latest" + +# Testing +vitest = "latest" +pytest = "latest" +jest = "latest" [env] +# Common environment variables NODE_ENV = "development" PYTHONDONTWRITEBYTECODE = "1" PYTHONUNBUFFERED = "1" -# --------------------------------------------------------------------------- -# REMOVED — an `[alias]` section holding what were clearly meant to be tasks: -# -# [alias] -# task = "go-task" -# build = "cargo build --release || npm run build || go build" -# test = "cargo test || npm test || go test ./..." -# lint = "ruff check . || prettier --check . || black --check ." -# fmt = "ruff format . || prettier --write . || black ." -# -# mise's `[alias]` maps an alias to a TOOL PLUGIN — it does not define tasks, -# so none of these ever ran. mise also warns that `[alias]` is deprecated in -# favour of `[tool_alias]`. -# -# They are not re-added as `[tasks]`: the estate drives builds through the -# Justfile, and a second task runner sharing the verbs `build`/`test`/`lint`/ -# `fmt` — one of which silently falls through `||` chains into a different -# language's build — is worse than one. Use `just `. -# --------------------------------------------------------------------------- +# Task runner alias +[alias] +task = "go-task" +build = "cargo build --release || npm run build || go build" +test = "cargo test || npm test || go test ./..." +lint = "ruff check . || prettier --check . || black --check ." +fmt = "ruff format . || prettier --write . || black ." diff --git a/robot-repo-automaton/.editorconfig b/robot-repo-automaton/.editorconfig index 6fa3f907..fc6650ce 100644 --- a/robot-repo-automaton/.editorconfig +++ b/robot-repo-automaton/.editorconfig @@ -1,4 +1,4 @@ -# robot-repo-bot - Editor Configuration +# RSR-template-repo - Editor Configuration # https://editorconfig.org root = true diff --git a/robot-repo-automaton/.gitattributes b/robot-repo-automaton/.gitattributes index 8919e4d1..e860a85c 100644 --- a/robot-repo-automaton/.gitattributes +++ b/robot-repo-automaton/.gitattributes @@ -51,3 +51,4 @@ Containerfile text eol=lf # Lock files Cargo.lock text eol=lf -diff +flake.lock text eol=lf -diff diff --git a/robot-repo-automaton/.github/workflows/codeql.yml b/robot-repo-automaton/.github/workflows/codeql.yml index 178b6eb5..beba3e12 100644 --- a/robot-repo-automaton/.github/workflows/codeql.yml +++ b/robot-repo-automaton/.github/workflows/codeql.yml @@ -25,16 +25,16 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Initialize CodeQL - uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.28.1 + uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3 with: languages: ${{ matrix.language }} queries: +security-and-quality continue-on-error: true - name: Autobuild - uses: github/codeql-action/autobuild@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.28.1 + uses: github/codeql-action/autobuild@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3 continue-on-error: true - name: Perform Analysis - uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.28.1 + uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3 continue-on-error: true diff --git a/robot-repo-automaton/templates/skeleton/.editorconfig b/robot-repo-automaton/templates/skeleton/.editorconfig index bcdbb4de..fc6650ce 100644 --- a/robot-repo-automaton/templates/skeleton/.editorconfig +++ b/robot-repo-automaton/templates/skeleton/.editorconfig @@ -63,3 +63,6 @@ indent_size = 2 indent_style = space indent_size = 4 +[justfile] +indent_style = space +indent_size = 4 diff --git a/robot-repo-automaton/templates/skeleton/.gitattributes b/robot-repo-automaton/templates/skeleton/.gitattributes index 02607c79..e860a85c 100644 --- a/robot-repo-automaton/templates/skeleton/.gitattributes +++ b/robot-repo-automaton/templates/skeleton/.gitattributes @@ -16,7 +16,6 @@ *.hs text eol=lf *.chpl text eol=lf *.scm text eol=lf -*.a2ml text eol=lf linguist-language=TOML *.ncl text eol=lf *.nix text eol=lf @@ -30,24 +29,11 @@ *.yaml text eol=lf *.yml text eol=lf *.toml text eol=lf -*.jsonl text eol=lf - -# Generated / large-corpora hygiene (estate guardrail) -# Keep large data corpora and generated emit out of language stats and -# collapsed in diffs so they don't drown review or skew the language bar. -# (No git-lfs: this template does not configure lfs, so we do not introduce -# it here — gitignore + linguist attributes only.) -*.jsonl linguist-generated=true -*.res.js linguist-generated=true -*.cmj linguist-generated=true -*.cmi linguist-generated=true -*.cmt linguist-generated=true -*.cmti linguist-generated=true # Config .gitignore text eol=lf .gitattributes text eol=lf -Justfile text eol=lf +justfile text eol=lf Makefile text eol=lf Containerfile text eol=lf @@ -65,3 +51,4 @@ Containerfile text eol=lf # Lock files Cargo.lock text eol=lf -diff +flake.lock text eol=lf -diff diff --git a/scripts/fix-dependabot.sh b/scripts/fix-dependabot.sh index a988766e..193c16d5 100755 --- a/scripts/fix-dependabot.sh +++ b/scripts/fix-dependabot.sh @@ -18,10 +18,13 @@ REPO_PATH="${1:?Usage: fix-dependabot.sh }" FINDING_JSON="${2:?Usage: fix-dependabot.sh }" # --- Idempotency check & prune --- -if [[ -f "${REPO_PATH}/.github/dependabot.yml" ]] || \ - [[ -f "${REPO_PATH}/.github/dependabot.yaml" ]]; then +if [[ -f "${REPO_PATH}/.github/dependabot.yml" ]]; then echo "[fix-dependabot] dependabot.yml already exists — pruning invalid ecosystems." - python3 "$SCRIPT_DIR/prune-dependabot.py" "$REPO_PATH" + yq -i 'del(.updates[] | select(.package-ecosystem == "npm"))' "${REPO_PATH}/.github/dependabot.yml" + exit 0 +elif [[ -f "${REPO_PATH}/.github/dependabot.yaml" ]]; then + echo "[fix-dependabot] dependabot.yaml already exists — pruning invalid ecosystems." + yq -i 'del(.updates[] | select(.package-ecosystem == "npm"))' "${REPO_PATH}/.github/dependabot.yaml" exit 0 fi diff --git a/scripts/prune-dependabot.py b/scripts/prune-dependabot.py deleted file mode 100755 index 1efaa575..00000000 --- a/scripts/prune-dependabot.py +++ /dev/null @@ -1,66 +0,0 @@ -#!/usr/bin/env python3 -import sys -import os -import yaml - -if len(sys.argv) < 2: - print("Usage: prune-dependabot.py ") - sys.exit(1) - -repo_path = sys.argv[1] -dependabot_yml = os.path.join(repo_path, '.github', 'dependabot.yml') -dependabot_yaml = os.path.join(repo_path, '.github', 'dependabot.yaml') - -file_to_process = None -if os.path.exists(dependabot_yml): - file_to_process = dependabot_yml -elif os.path.exists(dependabot_yaml): - file_to_process = dependabot_yaml - -if not file_to_process: - sys.exit(0) - -try: - with open(file_to_process, 'r') as f: - config = yaml.safe_load(f) -except Exception as e: - print(f"Failed to load yaml: {e}") - sys.exit(0) - -if not config or 'updates' not in config: - sys.exit(0) - -def has_manifest(repo, ecosystem): - if ecosystem == 'cargo': - return os.path.exists(os.path.join(repo, 'Cargo.toml')) - if ecosystem == 'mix': - return os.path.exists(os.path.join(repo, 'mix.exs')) - if ecosystem == 'npm': - return os.path.exists(os.path.join(repo, 'package.json')) - if ecosystem == 'bundler': - return os.path.exists(os.path.join(repo, 'Gemfile')) - if ecosystem == 'pip': - return os.path.exists(os.path.join(repo, 'requirements.txt')) or os.path.exists(os.path.join(repo, 'setup.py')) - if ecosystem == 'gomod': - return os.path.exists(os.path.join(repo, 'go.mod')) - if ecosystem == 'github-actions': - return True - return False - -original_updates = config['updates'] -new_updates = [] -changed = False - -for update in original_updates: - ecosystem = update.get('package-ecosystem') - if has_manifest(repo_path, ecosystem): - new_updates.append(update) - else: - changed = True - print(f"Pruned missing ecosystem: {ecosystem}") - -if changed: - config['updates'] = new_updates - with open(file_to_process, 'w') as f: - yaml.dump(config, f, sort_keys=False) - print("dependabot.yml updated.") diff --git a/shared-context/findings/academic-workflow-suite/latest.json b/shared-context/findings/academic-workflow-suite/latest.json deleted file mode 120000 index bf359298..00000000 --- a/shared-context/findings/academic-workflow-suite/latest.json +++ /dev/null @@ -1 +0,0 @@ -1773540005.json \ No newline at end of file