Prepare the tree for the public repository - #1
Merged
Merged
Conversation
README.md is rewritten for a person arriving at the repository: what Trinity is, its status (pre-alpha, milestone M0 reached), how to run it from source, how the work is organised in slices, the milestones, the layout of the tree. The previous README was the plan package's own instructions for copying the plan into an empty repository, which stopped being true at commit 1. CONTRIBUTING.md is rewritten for contributors and states the commit-message rule in its own terms. The commit-msg hook and plan_check rule 8 keep the same behaviour under neutral wording. AGENTS.md, the Phoenix generator's stock guidance file, is removed from the tree; a copy is kept outside it. Em dashes are replaced with ordinary punctuation in every non-record file: docs, slice specifications from 010 onward, templates, ROADMAP.md, CLAUDE.md, VERSIONS.md (regenerated from lib/trinity/versions.ex), workflows, hooks, code comments and test descriptions. Records are left as written: NOTES.md, PROOF.md, docs/adr/ and the two approved slices. The final-commit convention becomes `feat(sNNN): complete slice NNN (<title>)` in CLAUDE.md, docs/03, the templates and every SLICE.md that states it. The README's permitted-names section keeps its heading; the name check's end marker is updated to the heading that now follows it. docs/00-vision.md no longer says the repository stays private. Gate steps run one at a time on this tree, each exit 0: format, compile --warnings-as-errors, credo --strict, sobelow, versions.verify, versions.gen --check, trinity.version_form, trinity.names (185 tracked files), trinity.secrets.scan, trinity.reuse, test (72 passed), trinity.coverage, plan_check (PASS). deps.audit is red on two advisories that predate this change (mint 1.10.0, igniter 0.8.3) and is not touched here. Signed-off-by: Ayla Croft <aylacroft@proton.me>
Both are transitive (mint through burrito, req and finch; igniter through ex_tauri and phoenix_live_view) and neither is a VERSIONS.md row, so this is a lock-file change only. mint 1.10.0 carried EEF-CVE-2026-82672 (MEDIUM), an unvalidated chunk-size line tail in the HTTP/1 client. igniter 0.8.3 carried EEF-CVE-2026-82584 (LOW), terminal escape injection in the igniter.install prompt. Both were published after the slice 001 merge; `mix deps.audit` on the unchanged tree exited 1 on 2026-09-19 and exits 0 with this change. `mix gate` on this tree: exit 0. 72 tests passed, plan_check PASS. Signed-off-by: Ayla Croft <aylacroft@proton.me>
…; record the pull-request merge rule Every action in the two workflows is pinned to a commit SHA with the release it resolves to in a comment (actions/checkout v4.4.0, actions/cache v4.3.0, actions/upload-artifact v4.6.2, erlef/setup-beam v1.24.1, mlugg/setup-zig v2.2.1), resolved from each repository's tag refs on 2026-09-19. The repository's Actions policy now allows GitHub-owned actions plus those two third parties by pattern, and nothing else. package.yml no longer runs on every push and pull request. Measured over 2026-09-05 to 2026-09-07: 31 runs, 1 600 runner-minutes, 1 171 of them on Windows, for a packaging path slice 001 had already proven. It now runs on a slice or release tag, on a change to a file packaging depends on, or by hand. .github/dependabot.yml watches Hex, GitHub Actions and the Tauri crate weekly. A Dependabot pull request is an alert with the gate run against it, not an upgrade; VERSIONS.md stays the pin list. The merge convention in CLAUDE.md section 4, docs/03 and CONTRIBUTING.md now states what the repository ruleset enforces: main takes only pull requests, merge-commit method, with the gate check green, no bypass for anyone; tags cannot be moved or deleted. The slice boundary a --no-ff merge kept visible is kept the same way by the merge-commit method. Signed-off-by: Ayla Croft <aylacroft@proton.me>
…e commit The first pull request on this repository ran the gate twice: the push run passed and the pull_request run failed at plan_check rule 8, on commit a0555b1 "Merge 3ef1631 into 72aad35", which GitHub creates for the event and which carries no Signed-off-by line because no person wrote it. Rule 8 was right to refuse it. The checkout step now reads the pull request's head sha on that event and github.sha otherwise, so the gate tests the commits people signed. The ruleset's strict status-check policy already requires the branch to be current with main before merging, so the head is what main receives. Signed-off-by: Ayla Croft <aylacroft@proton.me>
…idate, not a dependency Signed-off-by: Ayla Croft <aylacroft@proton.me>
HackTuah
added a commit
that referenced
this pull request
Sep 20, 2026
…seable The public-readiness change replaced an em dash in a step name with a colon, which turned the plain scalar into a mapping and made the whole file unparseable. GitHub reported it as a run named after the file path on the merge of pull request #1 (run 35477735783, zero jobs), and Dependabot's github-actions updater failed on the same file (dependency_file_not_parseable, job 1583380179). Reproduced locally with a YAML parser at line 173, column 25. No gate step parses the workflow files, so the gate was green on a workflow GitHub could not read. That is a rule that could be an enforcer and is not one yet; recorded as a follow-up for the next slice rather than added here. Signed-off-by: Ayla Croft <aylacroft@proton.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three commits, each signed off, each with its own message carrying the detail.
chore: prepare the tree for a public repository. README and CONTRIBUTING rewritten for people arriving at the repository; AGENTS.md (the generator's stock file) removed; em dashes replaced with ordinary punctuation in every non-record file. Records (NOTES.md, PROOF.md, ADRs, the two approved slices) are left as written.chore(deps): update mint to 1.10.1 and igniter to 0.8.4. Two advisories published after the slice 001 merge;mix deps.auditis green again.ci: pin actions to commits, narrow the package matrix, add Dependabot; record the pull-request merge rule. Every action pinned to a commit SHA;package.ymlruns on tags, packaging-relevant paths, or by hand, instead of every push; Dependabot for Hex, Actions and Cargo; CLAUDE.md, docs/03 and CONTRIBUTING state the merge rule the new ruleset enforces.Verified on the branch head, locally:
mix gateexit 0 (72 tests, plan_check PASS, no advisories). Thegatecheck on this pull request is the same command in CI, and it is the first run since Actions was unblocked.Not in this pull request: any slice work. Slice 010 starts after this lands.