diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index c57d956..4714ad5 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,12 +1,4 @@ # SPDX-License-Identifier: MPL-2.0 -# CODEOWNERS - Define code review assignments -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners - -# Default owners for everything -* @hyperpolymath - -# Security-sensitive files require explicit review -SECURITY.md @hyperpolymath -.github/workflows/ @hyperpolymath -Trustfile.a2ml @hyperpolymath -.machine_readable/ @hyperpolymath +# Solo-maintained hyperpolymath repo: no owner lines by policy. +# See hyperpolymath/standards CODEOWNERS-POLICY.adoc (Rule 1). +# Sole-maintainer review is moot; SPDX headers carry attribution. diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile index 5e6b22e..94134bc 100644 --- a/.machine_readable/contractiles/Justfile +++ b/.machine_readable/contractiles/Justfile @@ -385,8 +385,8 @@ container-init: read -rp "Primary port [8080]: " _PORT PORT="${_PORT:-8080}" - read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}" + read -rp "Container registry [ghcr.io/${OWNER:-hyperpolymath}]: " _REGISTRY + REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-hyperpolymath}}" echo "" echo " Service: $SERVICE_NAME" @@ -601,7 +601,7 @@ test-matrix suite="unit" verbosity="normal" parallel="true": @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}" # Container matrix: [build|run|push|shell|scan] x [registry] x [tag] -container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest": +container-matrix action="build" registry="ghcr.io/hyperpolymath" tag="latest": @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}" # CI matrix: [lint|test|build|security|all] x [quick|full] diff --git a/.machine_readable/contractiles/dust/Dustfile.a2ml b/.machine_readable/contractiles/dust/Dustfile.a2ml index 743bd2e..73c9f16 100644 --- a/.machine_readable/contractiles/dust/Dustfile.a2ml +++ b/.machine_readable/contractiles/dust/Dustfile.a2ml @@ -56,7 +56,7 @@ clean too. - description: No references to rsr-template-repo in generic template files - run: test -z "$(grep -r 'rsr-template-repo' machine-readable-design/ 2>/dev/null)" - severity: warning -- notes: Generic templates should use {{PROJECT_NAME}} or similar placeholders +- notes: Generic templates should use Scaffoldia or similar placeholders ### version-sync-checked - description: Version in canonical-directory-structure matches .machine_readable/contractiles diff --git a/0-AI-MANIFEST.a2ml b/0-AI-MANIFEST.a2ml index 54e9bdb..c449351 100644 --- a/0-AI-MANIFEST.a2ml +++ b/0-AI-MANIFEST.a2ml @@ -32,3 +32,20 @@ items = [ { agent = "GEMINI", task = "estate audits, cross-repo sweeps, long-context triage, pattern detection" }, { agent = "VIBE", task = "UI/frontend, PanLL panels, ReScript components, theming, rapid prototyping" }, ] + + + +## PRIORITY ACTION — this repository is not fully initialised + +20 substitution token(s) still have no value. **Read +`REQUIRES_INITIALISATION.md` in the repository root before doing anything +else here** — it lists every outstanding token, what it means, and which +files it belongs in. + +Do not fabricate values for them, and do not delete the sections that +contain them to quiet a gate. They are unfilled because they need a +decision, not because they were overlooked. Resolve what you legitimately +can, leave the rest, and delete `REQUIRES_INITIALISATION.md` only when +nothing outstanding remains. + + diff --git a/Justfile b/Justfile index 0b6e976..a06a1fc 100644 --- a/Justfile +++ b/Justfile @@ -329,8 +329,8 @@ container-init: read -rp "Primary port [8080]: " _PORT PORT="${_PORT:-8080}" - read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}" + read -rp "Container registry [ghcr.io/${OWNER:-hyperpolymath}]: " _REGISTRY + REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-hyperpolymath}}" echo "" echo " Service: $SERVICE_NAME" @@ -545,7 +545,7 @@ test-matrix suite="unit" verbosity="normal" parallel="true": @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}" # Container matrix: [build|run|push|shell|scan] x [registry] x [tag] -container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest": +container-matrix action="build" registry="ghcr.io/hyperpolymath" tag="latest": @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}" # CI matrix: [lint|test|build|security|all] x [quick|full] diff --git a/REQUIRES_INITIALISATION.md b/REQUIRES_INITIALISATION.md new file mode 100644 index 0000000..8c97ae0 --- /dev/null +++ b/REQUIRES_INITIALISATION.md @@ -0,0 +1,207 @@ + + +# REQUIRES INITIALISATION + +**This repository is not finished being set up.** 20 substitution token(s) across 19 file(s) still have no value. + +## Why this is not already done + +This repo was created from `hyperpolymath/rsr-template-repo`. The mint +(`just repo-init`) fills every token that has a single mechanical answer — +owner, repo, author, dates, licence, branch — and it has done so here. + +The tokens below are the ones it *deliberately cannot* answer. They need a +decision or a fact that exists only in your head: what this project is for, +what command builds it, which port the service listens on, whether a PGP key +is held at all. The template's own token vocabulary says as much — you cannot +sensibly answer "required invariants" in a thirty-second bootstrap. + +They were left **visibly unfilled on purpose**. The alternatives were both +worse: inventing plausible values would put confident falsehoods into a +security policy and an architecture document, and silently deleting the +sections would hide the fact that a decision is owed. A visible gap is +honest; a fabricated answer is not. + +## Do not delete this file until every item below is resolved + +This file is the only marker that the work is outstanding. Deleting it early +does not finish the setup, it just conceals it — and the next person or agent +to arrive will reasonably assume the repo is complete. + +- **If you are a person:** delete this file yourself once the last item is done. +- **If you are an agent:** resolve what you legitimately can, leave the rest, + and delete this file only when no token below remains anywhere in the tree. + Do not delete it to make a gate go green. + +Re-running the estate top-up tool will remove this file automatically once +nothing is outstanding, so the safest way to finish is to fix the tokens and +let the check confirm it. + +## What is needed, and where it goes + +### `{{ARGS}}` + +Arguments for the justfile recipe this appears in. + +Appears in: + +- `.machine_readable/contractiles/Justfile` +- `Justfile` +- `machine-readable-design/harvested-registry/gitbot/fleet-bot.ncl` +- `machine-readable-design/harvested-registry/haskell/stack-library.ncl` +- `machine-readable-design/harvested-registry/rescript/deno-app.ncl` + +### `{{BACKUP_POINT_1}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml` + +### `{{BACKUP_POINT_2}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml` + +### `{{ESCALATION_STEP_1}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml` + +### `{{ESCALATION_STEP_2}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml` + +### `{{ESCALATION_STEP_3}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml` + +### `{{EXPECTED_AUTHOR}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/Trustfile.a2ml` + +### `{{LICENSE}}` + +SPDX identifier for this repo's licence. + +Appears in: + +- `container/Containerfile` +- `container/manifest.toml` + +### `{{MAIN_FUNCTION}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/Intentfile.a2ml` + +### `{{OPENSSF_PROJECT_ID}}` + +OpenSSF project ID, same registration. + +Appears in: + +- `docs/governance/TEMPLATE-STANDARDS-AUDIT.adoc` + +### `{{PORT}}` + +Port the container service listens on. + +Appears in: + +- `container/Containerfile` +- `container/compose.toml` +- `container/deploy.k9.ncl` +- `container/entrypoint.sh` +- `container/manifest.toml` +- `container/vordr.toml` + +### `{{PROJECT_DESCRIPTION}}` + +One-line description, matching the forge description. + +Appears in: + +- `container/Containerfile` +- `container/manifest.toml` + +### `{{REGISTRY}}` + +Container registry to publish to. + +Appears in: + +- `.machine_readable/configs/stapeln.toml` +- `container/compose.toml` +- `container/ct-build.sh` +- `container/deploy.k9.ncl` + +### `{{SCENARIO_1_NAME}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml` + +### `{{SCENARIO_1_ROLLBACK_PROCEDURE}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml` + +### `{{SCENARIO_2_NAME}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml` + +### `{{SCENARIO_2_ROLLBACK_PROCEDURE}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml` + +### `{{SERVICE_NAME}}` + +Container service name. + +Appears in: + +- `.machine_readable/configs/selur-compose.toml` +- `.machine_readable/configs/stapeln.toml` +- `container/.gatekeeper.yaml` +- `container/Containerfile` +- `container/compose.toml` +- `container/ct-build.sh` +- `container/deploy.k9.ncl` +- `container/entrypoint.sh` +- `container/manifest.toml` +- `container/vordr.toml` + +### `{{TARGET_AUDIENCE}}` + +Appears in: + +- `machine-readable-design/canonical-directory-structure/Intentfile.a2ml` + +### `{{VERSION}}` + +Version/tag for the container image. + +Appears in: + +- `container/deploy.k9.ncl` +- `container/manifest.toml` +- `container/vordr.toml` + +--- + +Generated by the estate top-up pass. Rationale and the governing rulings are +in `hyperpolymath/standards`; the token vocabulary is +`.machine_readable/ai/PLACEHOLDERS.adoc` in `rsr-template-repo`. diff --git a/container/.gatekeeper.yaml b/container/.gatekeeper.yaml index 4aac671..614abbc 100644 --- a/container/.gatekeeper.yaml +++ b/container/.gatekeeper.yaml @@ -1,6 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # -# Svalinn gatekeeper policy for {{PROJECT_NAME}} +# Svalinn gatekeeper policy for Scaffoldia # # Controls which operations are permitted through the edge gateway. # This template provides moderate security defaults — not wide-open test diff --git a/container/Containerfile b/container/Containerfile index ba85260..36b3b1b 100644 --- a/container/Containerfile +++ b/container/Containerfile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} Container Image +# Scaffoldia Container Image # # Multi-stage build template for Chainguard Wolfi base images. # Customise the builder stage for your language and copy the @@ -69,13 +69,13 @@ COPY . . FROM cgr.dev/chainguard/wolfi-base:latest # OCI image labels (compatible with cerro-torre .ctp bundle metadata) -LABEL org.opencontainers.image.title="{{PROJECT_NAME}}" \ +LABEL org.opencontainers.image.title="Scaffoldia" \ org.opencontainers.image.description="{{PROJECT_DESCRIPTION}}" \ - org.opencontainers.image.url="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.source="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.vendor="{{OWNER}}" \ + org.opencontainers.image.url="https://github.com/hyperpolymath/scaffoldia" \ + org.opencontainers.image.source="https://github.com/hyperpolymath/scaffoldia" \ + org.opencontainers.image.vendor="hyperpolymath" \ org.opencontainers.image.licenses="{{LICENSE}}" \ - org.opencontainers.image.authors="{{AUTHOR}} <{{AUTHOR_EMAIL}}>" \ + org.opencontainers.image.authors="Jonathan D.A. Jewell " \ dev.cerrotorre.manifest="container/manifest.toml" \ dev.cerrotorre.gatekeeper="container/.gatekeeper.yaml" \ dev.stapeln.compose="container/compose.toml" diff --git a/container/README.adoc b/container/README.adoc index 78275d2..739679d 100644 --- a/container/README.adoc +++ b/container/README.adoc @@ -1,6 +1,6 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // Copyright (c) Jonathan D.A. Jewell -= {{PROJECT_NAME}} Container Templates += Scaffoldia Container Templates :toc: left :toclevels: 3 :sectnums: diff --git a/container/compose.toml b/container/compose.toml index a14f8a0..bfce05e 100644 --- a/container/compose.toml +++ b/container/compose.toml @@ -1,6 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # -# {{PROJECT_NAME}} selur-compose configuration +# Scaffoldia selur-compose configuration # # Orchestrates the container stack as verified container bundles (.ctp). # Uses selur zero-copy IPC between services on the same host. diff --git a/container/ct-build.sh b/container/ct-build.sh index a54a541..31d5127 100755 --- a/container/ct-build.sh +++ b/container/ct-build.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash # SPDX-License-Identifier: MPL-2.0 # -# {{PROJECT_NAME}} — Cerro Torre build, sign, and verify pipeline +# Scaffoldia — Cerro Torre build, sign, and verify pipeline # # Builds the container image, packages it as a verified .ctp bundle, # signs it with Ed25519, and verifies the result. Gracefully degrades @@ -46,7 +46,7 @@ IMAGE_NAME="{{SERVICE_NAME}}" FULL_IMAGE="${CT_REGISTRY}/${IMAGE_NAME}:${CT_TAG}" CTP_FILE="${SCRIPT_DIR}/${IMAGE_NAME}-${CT_TAG}.ctp" -echo "=== {{PROJECT_NAME}} Cerro Torre Build Pipeline ===" +echo "=== Scaffoldia Cerro Torre Build Pipeline ===" echo " Image: ${FULL_IMAGE}" echo " Key: ${CT_KEY_ID}" echo " Bundle: ${CTP_FILE}" diff --git a/container/deploy.k9.ncl b/container/deploy.k9.ncl index 13b6397..faac6ca 100644 --- a/container/deploy.k9.ncl +++ b/container/deploy.k9.ncl @@ -1,6 +1,6 @@ K9! # SPDX-License-Identifier: MPL-2.0 -# deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level) +# deploy.k9.ncl — Scaffoldia deployment component (Hunt level) # # k9-svc deployment specification with full pedigree (L1-L5). # Security Level: 'Hunt (requires cryptographic handshake for execution). @@ -23,7 +23,7 @@ let component_pedigree = { version = "{{VERSION}}", breed = "application/vnd.k9+nickel", magic_number = "K9!", - description = "{{PROJECT_NAME}} deployment component (Hunt level)", + description = "Scaffoldia deployment component (Hunt level)", }, # ───────────────────────────────────────────────────────────── diff --git a/container/entrypoint.sh b/container/entrypoint.sh index a7a0369..c9a66a5 100755 --- a/container/entrypoint.sh +++ b/container/entrypoint.sh @@ -1,6 +1,6 @@ #!/bin/sh # SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} container entrypoint +# Scaffoldia container entrypoint # # Handles signal propagation, startup logging, and health check # preparation before exec-ing into the main application process. diff --git a/container/manifest.toml b/container/manifest.toml index f55fcb3..8a362e1 100644 --- a/container/manifest.toml +++ b/container/manifest.toml @@ -1,6 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # -# Cerro Torre manifest for {{PROJECT_NAME}} .ctp bundle +# Cerro Torre manifest for Scaffoldia .ctp bundle # # This manifest describes the container image for verified # container packaging. Used by `ct pack` to create .ctp bundles. @@ -11,17 +11,17 @@ version = "{{VERSION}}" revision = 1 summary = "{{PROJECT_DESCRIPTION}}" description = """ -{{PROJECT_NAME}} — containerised service packaged as a verified +Scaffoldia — containerised service packaged as a verified cerro-torre .ctp bundle with Ed25519 signing and full provenance tracking. """ license = "{{LICENSE}}" -homepage = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -maintainer = "{{AUTHOR}} <{{EMAIL}}>" +homepage = "https://github.com/hyperpolymath/scaffoldia" +maintainer = "Jonathan D.A. Jewell " [provenance] -upstream = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -import_date = {{CURRENT_DATE}}T00:00:00Z +upstream = "https://github.com/hyperpolymath/scaffoldia" +import_date = 2026-08-05T00:00:00Z [dependencies] runtime = ["ca-certificates", "curl"] diff --git a/container/vordr.toml b/container/vordr.toml index af38fc5..7e3ce42 100644 --- a/container/vordr.toml +++ b/container/vordr.toml @@ -1,6 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # -# Vordr runtime monitoring configuration for {{PROJECT_NAME}} +# Vordr runtime monitoring configuration for Scaffoldia # # Vordr watches container health, detects crashes, tracks resource usage, # and emits structured logs. It runs alongside the application stack and @@ -94,7 +94,7 @@ output = "stdout" # on = ["failure", "recovery", "resource_critical"] # [notifications.email] -# to = "{{EMAIL}}" +# to = "j.d.a.jewell@open.ac.uk" # from = "vordr@{{SERVICE_NAME}}.local" # smtp = "smtp://localhost:25" # on = ["failure", "resource_critical"] diff --git a/docs/governance/TEMPLATE-STANDARDS-AUDIT.adoc b/docs/governance/TEMPLATE-STANDARDS-AUDIT.adoc index b0a26a7..067aff0 100644 --- a/docs/governance/TEMPLATE-STANDARDS-AUDIT.adoc +++ b/docs/governance/TEMPLATE-STANDARDS-AUDIT.adoc @@ -28,7 +28,7 @@ Inventory snapshot at audit time: | Placeholder badge tokens in README | `README.adoc` -| `{{OPENSSF_PROJECT_ID}}`, `{{OWNER}}`, `{{REPO}}` +| `{{OPENSSF_PROJECT_ID}}`, `hyperpolymath`, `scaffoldia` | resolved (2026-07-27 instantiation cure) | README's badges now use scaffoldia's real identity (`hyperpolymath/scaffoldia`); no placeholder tokens remain. | Closed. diff --git a/machine-readable-design/canonical-directory-structure/Intentfile.a2ml b/machine-readable-design/canonical-directory-structure/Intentfile.a2ml index 11509ca..b2866e2 100644 --- a/machine-readable-design/canonical-directory-structure/Intentfile.a2ml +++ b/machine-readable-design/canonical-directory-structure/Intentfile.a2ml @@ -29,7 +29,7 @@ committed next-actions and aspirational wishes. [REPLACE WITH PROJECT-SPECIFIC PURPOSE] -Example: The {{PROJECT_NAME}} provides {{MAIN_FUNCTION}} for {{TARGET_AUDIENCE}}. +Example: The Scaffoldia provides {{MAIN_FUNCTION}} for {{TARGET_AUDIENCE}}. ## Anti-Purpose diff --git a/machine-readable-design/canonical-directory-structure/README.adoc b/machine-readable-design/canonical-directory-structure/README.adoc index 62bfc50..124185d 100644 --- a/machine-readable-design/canonical-directory-structure/README.adoc +++ b/machine-readable-design/canonical-directory-structure/README.adoc @@ -99,7 +99,7 @@ To initialize a new repository with contractiles: . Create `.machine_readable/contractiles/` directory . Copy all files from this `canonical-directory-structure/` directory . Customize each file with your project-specific content -. Remove all template markers (e.g., `{{PROJECT_NAME}}`) +. Remove all template markers (e.g., `Scaffoldia`) . Ensure all checks pass: `must check`, `adjust check`, etc. == See Also diff --git a/machine-readable-design/canonical-directory-structure/Trustfile.a2ml b/machine-readable-design/canonical-directory-structure/Trustfile.a2ml index 342fe03..5280e23 100644 --- a/machine-readable-design/canonical-directory-structure/Trustfile.a2ml +++ b/machine-readable-design/canonical-directory-structure/Trustfile.a2ml @@ -13,7 +13,7 @@ plus checks that verify repository integrity. ## Trust Levels -The {{PROJECT_NAME}} operates at trust level: [maximal | standard | restricted | minimal] +The Scaffoldia operates at trust level: [maximal | standard | restricted | minimal] Trust levels: - maximal: Agent may read, build, test, lint, format, heal freely. diff --git a/machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml b/machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml index 992851f..abbc40f 100644 --- a/machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml +++ b/machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml @@ -2,7 +2,7 @@ // SPDX-License-Identifier: MPL-2.0 Bust { - name: "{{PROJECT_NAME}}" + name: "Scaffoldia" version: "1.0.0" description: "Rollback procedures when something breaks in this repository" diff --git a/machine-readable-design/harvested-registry/gitbot/fleet-bot.ncl b/machine-readable-design/harvested-registry/gitbot/fleet-bot.ncl index 4ad5d35..1077862 100644 --- a/machine-readable-design/harvested-registry/gitbot/fleet-bot.ncl +++ b/machine-readable-design/harvested-registry/gitbot/fleet-bot.ncl @@ -316,7 +316,7 @@ watch: rescript build -w run REPO *ARGS: - deno run --allow-read --allow-write --allow-env --allow-net --allow-run src/main.mjs {{REPO}} {{ARGS}} + deno run --allow-read --allow-write --allow-env --allow-net --allow-run src/main.mjs scaffoldia {{ARGS}} test: deno test --allow-read --allow-write --allow-env --allow-net tests/