From 68ada0488da6d159d50b38feb226496dd49e2167 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 9 Sep 2026 22:55:23 +0100 Subject: [PATCH 1/4] docs: refresh policy and roadmap status --- .claude/CLAUDE.md | 37 ++++++++++++++++++------------------- ROADMAP.adoc | 12 ++++++++---- 2 files changed, 26 insertions(+), 23 deletions(-) diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index 996c553..40cbee2 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -1,13 +1,14 @@ ## Machine-Readable Artefacts -The following files in `.machine_readable/` contain structured project metadata: +The repository's canonical machine-readable metadata tree contains structured +project metadata, including: -- `.machine_readable/6a2/STATE.a2ml` - Current project state and progress -- `.machine_readable/6a2/META.a2ml` - Architecture decisions and development practices -- `.machine_readable/6a2/ECOSYSTEM.a2ml` - Position in the ecosystem and related projects -- `.machine_readable/6a2/AGENTIC.a2ml` - AI agent interaction patterns -- `.machine_readable/6a2/NEUROSYM.a2ml` - Neurosymbolic integration config -- `.machine_readable/6a2/PLAYBOOK.a2ml` - Operational runbook +- `STATE.a2ml` - Current project state and progress +- `META.a2ml` - Architecture decisions and development practices +- `ECOSYSTEM.a2ml` - Position in the ecosystem and related projects +- `AGENTIC.a2ml` - AI agent interaction patterns +- `NEUROSYM.a2ml` - Neurosymbolic integration config +- `PLAYBOOK.a2ml` - Operational runbook --- @@ -22,13 +23,13 @@ The following files in `.machine_readable/` contain structured project metadata: | **AffineScript** | Primary application code | Affine-typed, compiles to typed-wasm or ESM | | **Bun** | JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns. | | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools | -| **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI | +| **Gossamer** | Application shell | Estate-standard application shell | | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like | | **Gleam** | Backend services | Runs on BEAM or compiles to JS | | **Bash/POSIX Shell** | Scripts, automation | Keep minimal | | **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Bun APIs | | **Nickel** | Configuration language | For complex configs | -| **Guile Scheme** | State/meta files | .machine_readable/6a2/STATE.a2ml, .machine_readable/6a2/META.a2ml, .machine_readable/6a2/ECOSYSTEM.a2ml | +| **Guile Scheme** | State/meta files | The repository's canonical machine-readable metadata tree | | **Julia** | Batch scripts, data processing | Per RSR | | **OCaml** | AffineScript compiler | Language-specific | | **Ada** | Safety-critical systems | Where required | @@ -44,17 +45,17 @@ The following files in `.machine_readable/` contain structured project metadata: | npm | Bun | | pnpm/yarn | Bun | | Go | Rust | -| Python | Julia/Rust/AffineScript | -| Java/Kotlin | Rust/Tauri/Dioxus | -| Swift | Tauri/Dioxus | -| React Native | Tauri/Dioxus | -| Flutter/Dart | Tauri/Dioxus | +| Python | Rust/AffineScript | +| Java/Kotlin | Rust/Gossamer/Dioxus | +| Swift | Gossamer/Dioxus | +| React Native | Gossamer/Dioxus | +| Flutter/Dart | Gossamer/Dioxus | ### Mobile Development **No exceptions for Kotlin/Swift** - use Rust-first approach: -1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0 +1. **Gossamer** - Estate-standard application shell 2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0 Both are FOSS with independent governance (no Big Tech). @@ -65,13 +66,12 @@ Both are FOSS with independent governance (no Big Tech). 2. **Use `package.json` + `bun.lock` for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED 3. **`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock` 4. **No Go code** - Use Rust instead -5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps -6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus +5. **No Python anywhere** - Use Rust for systems and AffineScript for apps +6. **No Kotlin/Swift for mobile** - Use Gossamer or Dioxus ### Package Management - **Primary**: Guix (guix.scm) -- **Fallback**: Nix (flake.nix) - **JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun ` — a bare `bunx ` can fetch an unpinned package and may start Node via its shebang. ### Security Requirements @@ -81,4 +81,3 @@ Both are FOSS with independent governance (no Big Tech). - No hardcoded secrets - SHA-pinned dependencies - SPDX license headers on all files - diff --git a/ROADMAP.adoc b/ROADMAP.adoc index c4f81c8..08ff0b1 100644 --- a/ROADMAP.adoc +++ b/ROADMAP.adoc @@ -4,14 +4,18 @@ == Current Status -Initial development phase. +Active maintenance of the Rust proof-of-concept. The core reversibility +mechanism, project documentation, and CI/CD configuration are present; formal +proofs, comprehensive tests, and production readiness remain pending. The +current CI workflow health requires follow-up before it can support a passing +CI claim. == Milestones === v0.1.0 - Foundation -* [ ] Core functionality -* [ ] Basic documentation -* [ ] CI/CD pipeline +* [x] Core reversibility mechanism +* [x] Basic documentation +* [x] CI/CD configuration === v1.0.0 - Stable Release * [ ] Full feature set From 99a9a9dbc67644e58bc2214ef7d6690ecb07b56d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 9 Sep 2026 23:04:46 +0100 Subject: [PATCH 2/4] ci: repair workflow policy and metadata paths --- .claude/CLAUDE.md | 6 +- .github/workflows/actions.lock | 35 +++++++---- .github/workflows/boj-build.yml | 1 + .github/workflows/cargo-audit.yml | 2 +- .github/workflows/casket-pages.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dashboard-check.yml | 3 + .github/workflows/dependabot-automerge.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/e2e.yml | 10 +++- .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/label-triage.yml | 1 + .github/workflows/labels.yml | 1 + .github/workflows/main-estate-audit.yml | 6 +- .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/rust-ci.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/semgrep.yml | 1 + .github/workflows/workflow-linter.yml | 2 +- .../contractiles/Adjustfile.a2ml | 2 +- .machine_readable/contractiles/Mustfile.a2ml | 8 +-- .../{6a2 => descriptiles}/0-AI-MANIFEST.a2ml | 5 +- .../{6a2 => descriptiles}/AGENTIC.a2ml | 0 .../{6a2 => descriptiles}/ECOSYSTEM.a2ml | 0 .../{6a2 => descriptiles}/META.a2ml | 0 .../{6a2 => descriptiles}/NEUROSYM.a2ml | 0 .../{6a2 => descriptiles}/PLAYBOOK.a2ml | 2 +- .../{6a2 => descriptiles}/README.adoc | 3 +- .../{6a2 => descriptiles}/STATE.a2ml | 0 .../anchor/0-AI-MANIFEST.a2ml | 0 .../{6a2 => descriptiles}/anchor/ANCHOR.a2ml | 0 .../{6a2 => descriptiles}/anchor/README.adoc | 0 .../self-validating/methodology-guard.k9.ncl | 2 +- 0-AI-MANIFEST.a2ml | 34 +++++------ TESTING-REPORT.adoc | 2 +- TOPOLOGY.adoc | 2 +- crates/dashboard-check/src/main.rs | 58 +++++++++++++------ crates/januskey-cli/src/attestation.rs | 10 +--- crates/januskey-cli/src/keys_cli.rs | 4 +- docs/wiki/Home.adoc | 2 +- 45 files changed, 138 insertions(+), 77 deletions(-) rename .machine_readable/{6a2 => descriptiles}/0-AI-MANIFEST.a2ml (81%) rename .machine_readable/{6a2 => descriptiles}/AGENTIC.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/ECOSYSTEM.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/META.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/NEUROSYM.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/PLAYBOOK.a2ml (88%) rename .machine_readable/{6a2 => descriptiles}/README.adoc (97%) rename .machine_readable/{6a2 => descriptiles}/STATE.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/anchor/0-AI-MANIFEST.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/anchor/ANCHOR.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/anchor/README.adoc (100%) diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index 40cbee2..bb6ceb7 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -29,7 +29,7 @@ project metadata, including: | **Bash/POSIX Shell** | Scripts, automation | Keep minimal | | **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Bun APIs | | **Nickel** | Configuration language | For complex configs | -| **Guile Scheme** | State/meta files | The repository's canonical machine-readable metadata tree | +| **Guile Scheme** | State/meta files | `.machine_readable/descriptiles/` | | **Julia** | Batch scripts, data processing | Per RSR | | **OCaml** | AffineScript compiler | Language-specific | | **Ada** | Safety-critical systems | Where required | @@ -45,7 +45,7 @@ project metadata, including: | npm | Bun | | pnpm/yarn | Bun | | Go | Rust | -| Python | Rust/AffineScript | +| Python | Julia/Rust/AffineScript | | Java/Kotlin | Rust/Gossamer/Dioxus | | Swift | Gossamer/Dioxus | | React Native | Gossamer/Dioxus | @@ -66,7 +66,7 @@ Both are FOSS with independent governance (no Big Tech). 2. **Use `package.json` + `bun.lock` for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED 3. **`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock` 4. **No Go code** - Use Rust instead -5. **No Python anywhere** - Use Rust for systems and AffineScript for apps +5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, and AffineScript for apps 6. **No Kotlin/Swift for mobile** - Use Gossamer or Dioxus ### Package Management diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 14f606f..314affa 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,14 +3,6 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.2' workflows: - '.github/workflows/governance.yml': [] - '.github/workflows/hypatia-scan.yml': [] - '.github/workflows/label-triage.yml': [] - '.github/workflows/labels.yml': [] - '.github/workflows/mirror.yml': [] - '.github/workflows/rust-ci.yml': [] - '.github/workflows/scorecard.yml': [] - '.github/workflows/secret-scanner.yml': [] '.github/workflows/boj-build.yml': - 'actions/checkout@v7.0.1' '.github/workflows/cargo-audit.yml': @@ -38,14 +30,25 @@ workflows: - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' + '.github/workflows/governance.yml': [] + '.github/workflows/hypatia-scan.yml': [] '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' + '.github/workflows/label-triage.yml': [] + '.github/workflows/labels.yml': [] + '.github/workflows/main-estate-audit.yml': + - 'actions/checkout@v4.4.0' + - 'hyperpolymath/cicd-suite@main' + '.github/workflows/mirror.yml': [] '.github/workflows/pages.yml': - 'actions/checkout@v7.0.1' - 'actions/deploy-pages@v5.0.0' - 'actions/upload-pages-artifact@v5.0.0' '.github/workflows/push-email-notify.yml': - 'dawidd6/action-send-mail@v3.12.0' + '.github/workflows/rust-ci.yml': [] + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] '.github/workflows/semgrep.yml': - 'actions/checkout@v7.0.1' - 'github/codeql-action@v4.37.8' @@ -57,6 +60,11 @@ dependencies: commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' owner_id: 44036562 repo_id: 215566462 + 'actions/checkout@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' + owner_id: 44036562 + repo_id: 197814629 'actions/checkout@v7.0.1': ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' @@ -86,7 +94,7 @@ dependencies: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' 'dawidd6/action-send-mail@v3.12.0': ref: 'v3.12.0' - commit: 'sha1-0bbdab096651ee93f37ec02383e088183d41ff0b' + commit: 'sha1-2cea9617b09d79a095af21254fbcb7ae95903dde' owner_id: 9713907 repo_id: 222439721 'dependabot/fetch-metadata@v3.1.0': @@ -111,12 +119,17 @@ dependencies: repo_id: 623796603 'hyperpolymath/a2ml-ecosystem@main': ref: 'main' - commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79' + commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d' owner_id: 6759885 repo_id: 1275649586 + 'hyperpolymath/cicd-suite@main': + ref: 'main' + commit: 'sha1-fc64172aa53e85289d5d7d6e15c2435a867cc1c9' + owner_id: 6759885 + repo_id: 1326697643 'hyperpolymath/k9-ecosystem@main': ref: 'main' - commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562' + commit: 'sha1-347ee5d6a1b77831de56fe8da21a473724e4cac2' owner_id: 6759885 repo_id: 1275650185 'peter-evans/repository-dispatch@v4.0.1': diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 501fc6a..231ddad 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: BoJ Server Build Trigger diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml index acf01e3..e03918f 100644 --- a/.github/workflows/cargo-audit.yml +++ b/.github/workflows/cargo-audit.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Prevention workflow - audits Rust dependencies for vulnerabilities @@ -17,7 +18,6 @@ on: - cron: '0 6 * * 1' # Weekly on Monday permissions: read-all - actions: read jobs: audit: diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index f21070c..936a453 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: GitHub Pages diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index aa923b5..2006c8f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: CodeQL Security Analysis diff --git a/.github/workflows/dashboard-check.yml b/.github/workflows/dashboard-check.yml index 1e19f8d..ad2219e 100644 --- a/.github/workflows/dashboard-check.yml +++ b/.github/workflows/dashboard-check.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -27,6 +28,8 @@ jobs: uses: actions/checkout@v7.0.1 - uses: dtolnay/rust-toolchain@v1 + with: + toolchain: stable - name: Reconcile dashboards against STATE.a2ml run: cargo run -q -p dashboard-check -- --check . diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 607bd9d..02082ae 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 75f9e46..0c18d4f 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index aa0b663..9908ab4 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # JanusKey E2E + P2P + Aspect + Bench + Panic-Attack CI @@ -10,7 +11,6 @@ on: branches: [main] permissions: read-all - actions: read jobs: rust-build-test: @@ -20,6 +20,8 @@ jobs: steps: - uses: actions/checkout@v7.0.1 - uses: dtolnay/rust-toolchain@v1 + with: + toolchain: stable - uses: Swatinem/rust-cache@v2.9.2 - name: Build run: cargo build --release @@ -37,6 +39,8 @@ jobs: steps: - uses: actions/checkout@v7.0.1 - uses: dtolnay/rust-toolchain@v1 + with: + toolchain: stable - uses: Swatinem/rust-cache@v2.9.2 - name: Run benchmarks run: cargo bench -- --output-format bencher 2>/dev/null || echo "Benchmarks completed" @@ -48,6 +52,8 @@ jobs: steps: - uses: actions/checkout@v7.0.1 - uses: dtolnay/rust-toolchain@v1 + with: + toolchain: stable - uses: Swatinem/rust-cache@v2.9.2 - name: Build release run: cargo build --release @@ -87,6 +93,8 @@ jobs: steps: - uses: actions/checkout@v7.0.1 - uses: dtolnay/rust-toolchain@v1 + with: + toolchain: stable - name: Install panic-attack run: cargo install --git https://github.com/hyperpolymath/panic-attacker.git 2>/dev/null || echo "panic-attack unavailable" - name: Run assail scan diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 784d974..844828e 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 410fd2e..205a9b2 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml. diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 1a32c7a..a543408 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index 9886e92..814a192 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Label Triage diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index c80b676..83ab941 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Labels diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index b602e97..907e8ad 100755 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -1,3 +1,5 @@ +# This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 name: Central Estate CI/CD Audit on: @@ -6,11 +8,13 @@ on: pull_request: branches: [ "main" ] +permissions: read-all + jobs: estate-audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Required Files Gate uses: hyperpolymath/cicd-suite/actions/required-files-check@main diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index d4ac835..e3965f1 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Mirror to Git Forges diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index c458477..fd15980 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: GitHub Pages (Ddraig SSG) diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 360340c..b4f1073 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 43408cd..b4ffd22 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Rust CI — thin wrapper calling the shared estate reusable in diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 6a6fa72..d70c000 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Scorecards supply-chain security diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 89a1438..5013d1a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Secret Scanner diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 9132292..e3aecb6 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Semgrep SAST diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 52121f7..57208d9 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Prevention workflow - validates all workflows have proper security config @@ -12,7 +13,6 @@ on: - '.github/workflows/**' permissions: read-all - actions: read jobs: lint-workflows: diff --git a/.machine_readable/contractiles/Adjustfile.a2ml b/.machine_readable/contractiles/Adjustfile.a2ml index d40cca1..4dc88cd 100644 --- a/.machine_readable/contractiles/Adjustfile.a2ml +++ b/.machine_readable/contractiles/Adjustfile.a2ml @@ -88,7 +88,7 @@ Standard: WCAG-2.2-AA (CLI/TUI profile). - severity: advisory ### state-file-currency -- description: 6a2/STATE.a2ml should be refreshed when a work-wave lands +- description: descriptiles/STATE.a2ml should be refreshed when a work-wave lands - tolerance: last-updated within 90 days of the latest non-dependabot commit - corrective: Refresh STATE.a2ml from git log - severity: advisory diff --git a/.machine_readable/contractiles/Mustfile.a2ml b/.machine_readable/contractiles/Mustfile.a2ml index 21d3e66..859288c 100644 --- a/.machine_readable/contractiles/Mustfile.a2ml +++ b/.machine_readable/contractiles/Mustfile.a2ml @@ -63,13 +63,13 @@ trust level: even maximal-trust agents cannot violate MUST constraints. - severity: critical ### six-directory-present -- description: 6a2 directory exists with required files -- run: test -d .machine_readable/6a2 && test -f .machine_readable/6a2/META.a2ml && test -f .machine_readable/6a2/ECOSYSTEM.a2ml && test -f .machine_readable/6a2/STATE.a2ml && test -f .machine_readable/6a2/PLAYBOOK.a2ml && test -f .machine_readable/6a2/AGENTIC.a2ml && test -f .machine_readable/6a2/NEUROSYM.a2ml +- description: descriptiles directory exists with required files +- run: test -d .machine_readable/descriptiles && test -f .machine_readable/descriptiles/META.a2ml && test -f .machine_readable/descriptiles/ECOSYSTEM.a2ml && test -f .machine_readable/descriptiles/STATE.a2ml && test -f .machine_readable/descriptiles/PLAYBOOK.a2ml && test -f .machine_readable/descriptiles/AGENTIC.a2ml && test -f .machine_readable/descriptiles/NEUROSYM.a2ml - severity: critical ### anchor-directory -- description: anchor directory exists in 6a2 (renamed from anchors/ in the estate wave) -- run: test -d .machine_readable/6a2/anchor && test -f .machine_readable/6a2/anchor/ANCHOR.a2ml +- description: anchor directory exists in descriptiles +- run: test -d .machine_readable/descriptiles/anchor && test -f .machine_readable/descriptiles/anchor/ANCHOR.a2ml - severity: warning ### self-validating-structure diff --git a/.machine_readable/6a2/0-AI-MANIFEST.a2ml b/.machine_readable/descriptiles/0-AI-MANIFEST.a2ml similarity index 81% rename from .machine_readable/6a2/0-AI-MANIFEST.a2ml rename to .machine_readable/descriptiles/0-AI-MANIFEST.a2ml index 6bf1f8c..9187edb 100644 --- a/.machine_readable/6a2/0-AI-MANIFEST.a2ml +++ b/.machine_readable/descriptiles/0-AI-MANIFEST.a2ml @@ -1,8 +1,8 @@ -# AI Manifest for 6a2 Directory +# AI Manifest for the descriptiles Directory ## Purpose -This manifest declares the AI-assistant context for the 6a2 machine-readable metadata directory. +This manifest declares the AI-assistant context for the descriptiles machine-readable metadata directory. ## Canonical Locations @@ -28,4 +28,3 @@ When multiple agents may write to A2ML files concurrently: 3. Write updated file with new [provenance] metadata 4. Release by removing lock file 5. On conflict: re-read and retry if git-sha-at-read does not match HEAD - diff --git a/.machine_readable/6a2/AGENTIC.a2ml b/.machine_readable/descriptiles/AGENTIC.a2ml similarity index 100% rename from .machine_readable/6a2/AGENTIC.a2ml rename to .machine_readable/descriptiles/AGENTIC.a2ml diff --git a/.machine_readable/6a2/ECOSYSTEM.a2ml b/.machine_readable/descriptiles/ECOSYSTEM.a2ml similarity index 100% rename from .machine_readable/6a2/ECOSYSTEM.a2ml rename to .machine_readable/descriptiles/ECOSYSTEM.a2ml diff --git a/.machine_readable/6a2/META.a2ml b/.machine_readable/descriptiles/META.a2ml similarity index 100% rename from .machine_readable/6a2/META.a2ml rename to .machine_readable/descriptiles/META.a2ml diff --git a/.machine_readable/6a2/NEUROSYM.a2ml b/.machine_readable/descriptiles/NEUROSYM.a2ml similarity index 100% rename from .machine_readable/6a2/NEUROSYM.a2ml rename to .machine_readable/descriptiles/NEUROSYM.a2ml diff --git a/.machine_readable/6a2/PLAYBOOK.a2ml b/.machine_readable/descriptiles/PLAYBOOK.a2ml similarity index 88% rename from .machine_readable/6a2/PLAYBOOK.a2ml rename to .machine_readable/descriptiles/PLAYBOOK.a2ml index a961250..791847b 100644 --- a/.machine_readable/6a2/PLAYBOOK.a2ml +++ b/.machine_readable/descriptiles/PLAYBOOK.a2ml @@ -13,7 +13,7 @@ last-updated = "2026-03-16" # target = "container" [incident-response] -# 1. Check .machine_readable/STATE.a2ml for current status +# 1. Check .machine_readable/descriptiles/STATE.a2ml for current status # 2. Review recent commits and CI results # 3. Run just validate to check compliance diff --git a/.machine_readable/6a2/README.adoc b/.machine_readable/descriptiles/README.adoc similarity index 97% rename from .machine_readable/6a2/README.adoc rename to .machine_readable/descriptiles/README.adoc index 916a702..7671b14 100644 --- a/.machine_readable/6a2/README.adoc +++ b/.machine_readable/descriptiles/README.adoc @@ -1,6 +1,6 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // Copyright (c) Jonathan D.A. Jewell -# A2ML 6a2 Directory +# A2ML descriptiles Directory This directory contains the 6 core A2ML machine-readable metadata files for this repository. @@ -27,4 +27,3 @@ Source .scm files should be removed after successful transpilation. - [A2ML Repository Template](https://github.com/hyperpolymath/standards/blob/main/A2ML-REPO-TEMPLATE.adoc) - [6A2 Format Family](https://github.com/hyperpolymath/standards#a2ml-format-family-7-formats) - diff --git a/.machine_readable/6a2/STATE.a2ml b/.machine_readable/descriptiles/STATE.a2ml similarity index 100% rename from .machine_readable/6a2/STATE.a2ml rename to .machine_readable/descriptiles/STATE.a2ml diff --git a/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml b/.machine_readable/descriptiles/anchor/0-AI-MANIFEST.a2ml similarity index 100% rename from .machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml rename to .machine_readable/descriptiles/anchor/0-AI-MANIFEST.a2ml diff --git a/.machine_readable/6a2/anchor/ANCHOR.a2ml b/.machine_readable/descriptiles/anchor/ANCHOR.a2ml similarity index 100% rename from .machine_readable/6a2/anchor/ANCHOR.a2ml rename to .machine_readable/descriptiles/anchor/ANCHOR.a2ml diff --git a/.machine_readable/6a2/anchor/README.adoc b/.machine_readable/descriptiles/anchor/README.adoc similarity index 100% rename from .machine_readable/6a2/anchor/README.adoc rename to .machine_readable/descriptiles/anchor/README.adoc diff --git a/.machine_readable/self-validating/methodology-guard.k9.ncl b/.machine_readable/self-validating/methodology-guard.k9.ncl index 128575e..1b5ab44 100644 --- a/.machine_readable/self-validating/methodology-guard.k9.ncl +++ b/.machine_readable/self-validating/methodology-guard.k9.ncl @@ -60,7 +60,7 @@ let methodology_guard = { state_not_template = { description = "STATE.a2ml must not contain template placeholders", severity = "warning", - file = ".machine_readable/6a2/STATE.a2ml", + file = ".machine_readable/descriptiles/STATE.a2ml", reject_patterns = ["{{PLACEHOLDER}}", "{{PROJECT}}", "rsr-template-repo"], }, diff --git a/0-AI-MANIFEST.a2ml b/0-AI-MANIFEST.a2ml index 1f210f8..4b35f84 100644 --- a/0-AI-MANIFEST.a2ml +++ b/0-AI-MANIFEST.a2ml @@ -14,12 +14,12 @@ This is the AI manifest for **januskey**. It declares: ### Machine-Readable Metadata: `.machine_readable/` ONLY These 6 SCM files MUST exist in `.machine_readable/` directory ONLY: -1. **.machine_readable/6a2/STATE.a2ml** - Project state, progress, blockers -2. **.machine_readable/6a2/META.a2ml** - Architecture decisions, governance -3. **.machine_readable/6a2/ECOSYSTEM.a2ml** - Position in ecosystem, relationships -4. **.machine_readable/6a2/AGENTIC.a2ml** - AI agent interaction patterns -5. **.machine_readable/6a2/NEUROSYM.a2ml** - Neurosymbolic integration config -6. **.machine_readable/6a2/PLAYBOOK.a2ml** - Operational runbook +1. **.machine_readable/descriptiles/STATE.a2ml** - Project state, progress, blockers +2. **.machine_readable/descriptiles/META.a2ml** - Architecture decisions, governance +3. **.machine_readable/descriptiles/ECOSYSTEM.a2ml** - Position in ecosystem, relationships +4. **.machine_readable/descriptiles/AGENTIC.a2ml** - AI agent interaction patterns +5. **.machine_readable/descriptiles/NEUROSYM.a2ml** - Neurosymbolic integration config +6. **.machine_readable/descriptiles/PLAYBOOK.a2ml** - Operational runbook **CRITICAL:** If ANY of these files exist in the root directory, this is an ERROR. @@ -40,7 +40,7 @@ Bot-specific instructions for: ## CORE INVARIANTS -1. **No SCM duplication** - Root must NOT contain .machine_readable/6a2/STATE.a2ml, .machine_readable/6a2/META.a2ml, etc. +1. **No SCM duplication** - Root must NOT contain .machine_readable/descriptiles/STATE.a2ml, .machine_readable/descriptiles/META.a2ml, etc. 2. **Single source of truth** - `.machine_readable/` is authoritative 3. **No stale metadata** - If root SCMs exist, they are OUT OF DATE 4. **License consistency** - All code MPL-2.0 unless platform requires MPL-2.0 @@ -58,12 +58,12 @@ januskey/ ├── README.md # Project overview ├── [your source files] # Main code ├── .machine_readable/ # SCM files (6 files) -│ ├── .machine_readable/6a2/STATE.a2ml -│ ├── .machine_readable/6a2/META.a2ml -│ ├── .machine_readable/6a2/ECOSYSTEM.a2ml -│ ├── .machine_readable/6a2/AGENTIC.a2ml -│ ├── .machine_readable/6a2/NEUROSYM.a2ml -│ └── .machine_readable/6a2/PLAYBOOK.a2ml +│ ├── .machine_readable/descriptiles/STATE.a2ml +│ ├── .machine_readable/descriptiles/META.a2ml +│ ├── .machine_readable/descriptiles/ECOSYSTEM.a2ml +│ ├── .machine_readable/descriptiles/AGENTIC.a2ml +│ ├── .machine_readable/descriptiles/NEUROSYM.a2ml +│ └── .machine_readable/descriptiles/PLAYBOOK.a2ml └── .bot_directives/ # Bot instructions ``` @@ -73,8 +73,8 @@ januskey/ ✅ Understand canonical locations (.machine_readable/, .bot_directives/) ✅ Know the invariants (no SCM duplication, etc.) ✅ Check for MCP enforcement (if applicable) -✅ Read `.machine_readable/6a2/STATE.a2ml` for current status -✅ Read `.machine_readable/6a2/AGENTIC.a2ml` for interaction patterns +✅ Read `.machine_readable/descriptiles/STATE.a2ml` for current status +✅ Read `.machine_readable/descriptiles/AGENTIC.a2ml` for interaction patterns ## LIFECYCLE HOOKS @@ -86,7 +86,7 @@ When starting a new session: 2. Log session start (optional but recommended) - Format: `[YYYY-MM-DD HH:MM:SS] Session started: [agent-name]` - Location: `.machine_readable/session-log.txt` -3. Read `.machine_readable/6a2/STATE.a2ml` +3. Read `.machine_readable/descriptiles/STATE.a2ml` 4. Check for blockers 5. State understanding of canonical locations @@ -94,7 +94,7 @@ When starting a new session: When ending a session: -1. Update `.machine_readable/6a2/STATE.a2ml` if changes made +1. Update `.machine_readable/descriptiles/STATE.a2ml` if changes made 2. Log session end (optional but recommended) - Format: `[YYYY-MM-DD HH:MM:SS] Session ended: [summary]` - Location: `.machine_readable/session-log.txt` diff --git a/TESTING-REPORT.adoc b/TESTING-REPORT.adoc index a974b79..560dc70 100644 --- a/TESTING-REPORT.adoc +++ b/TESTING-REPORT.adoc @@ -17,7 +17,7 @@ functional" framing overstates the current state (homerolled attestation MAC, unimplemented asymmetric crypto, no fuzz/mutation/chaos testing). *For the current, authoritative test status see `READINESS.md` and -`.machine_readable/6a2/STATE.a2ml`.* +`.machine_readable/descriptiles/STATE.a2ml`.* ==== == Executive Summary diff --git a/TOPOLOGY.adoc b/TOPOLOGY.adoc index 44317e6..54136a3 100644 --- a/TOPOLOGY.adoc +++ b/TOPOLOGY.adoc @@ -47,7 +47,7 @@ === Completion Dashboard ____ -*Source of truth:* `+.machine_readable/6a2/STATE.a2ml+` (completion 60%, +*Source of truth:* `+.machine_readable/descriptiles/STATE.a2ml+` (completion 60%, CRG grade *D*) and `+READINESS.md+` (Grade *D — Alpha, Unstable*). This dashboard is a human-readable summary of those files; if they disagree, they win. Percentages below are qualitative, not measured coverage. This diff --git a/crates/dashboard-check/src/main.rs b/crates/dashboard-check/src/main.rs index 56b0f7f..f254b2f 100644 --- a/crates/dashboard-check/src/main.rs +++ b/crates/dashboard-check/src/main.rs @@ -54,10 +54,13 @@ fn extract_state(toml_src: &str) -> Result { .and_then(|v| v.as_str().map(str::to_string)) .or_else(|| get("crg-compliance", "tier").and_then(|v| v.as_str().map(str::to_string))); - let last_updated = get("metadata", "last-updated") - .and_then(|v| v.as_str().map(str::to_string)); + let last_updated = get("metadata", "last-updated").and_then(|v| v.as_str().map(str::to_string)); - Ok(StateFacts { completion, grade, last_updated }) + Ok(StateFacts { + completion, + grade, + last_updated, + }) } /// Coerce a TOML value (string `"60"` or integer `60`) into a percentage. @@ -106,7 +109,10 @@ fn extract_grade_after_token(text: &str, token: &str) -> Option { for line in text.lines() { if let Some(idx) = line.find(token) { let rest = line[idx + token.len()..].trim_start(); - let g: String = rest.chars().take_while(|c| c.is_ascii_alphabetic()).collect(); + let g: String = rest + .chars() + .take_while(|c| c.is_ascii_alphabetic()) + .collect(); if !g.is_empty() { return Some(g); } @@ -130,16 +136,16 @@ fn extract_last_updated(topology: &str) -> Option { .chars() .take_while(|c| c.is_ascii_digit() || *c == '-') .collect(); - if date.len() >= 8 { Some(date) } else { None } + if date.len() >= 8 { + Some(date) + } else { + None + } } /// Compare STATE against the dashboards; return a list of human-readable /// mismatch messages (empty = all good). Pure so it is unit-testable. -fn reconcile( - state: &StateFacts, - topology: Option<&str>, - readiness: Option<&str>, -) -> Vec { +fn reconcile(state: &StateFacts, topology: Option<&str>, readiness: Option<&str>) -> Vec { let mut problems = Vec::new(); if let (Some(pct), Some(topo)) = (state.completion, topology) { @@ -202,7 +208,7 @@ fn main() -> ExitCode { root = PathBuf::from(arg); } - let state_path = root.join(".machine_readable/6a2/STATE.a2ml"); + let state_path = root.join(".machine_readable/descriptiles/STATE.a2ml"); let state_src = match read_opt(&state_path) { Some(s) => s, None => { @@ -231,7 +237,10 @@ fn main() -> ExitCode { ); ExitCode::SUCCESS } else { - eprintln!("dashboard-check: {} divergence(s) from STATE.a2ml (the source of truth):", problems.len()); + eprintln!( + "dashboard-check: {} divergence(s) from STATE.a2ml (the source of truth):", + problems.len() + ); for p in &problems { eprintln!(" ✗ {p}"); } @@ -287,16 +296,25 @@ OVERALL: ██████░░░░ ~60% Grade #[test] fn extracts_dashboard_signals() { assert_eq!(extract_overall_pct(TOPOLOGY_60_D), Some(60)); - assert_eq!(extract_grade_after_token(TOPOLOGY_60_D, "Grade ").as_deref(), Some("D")); + assert_eq!( + extract_grade_after_token(TOPOLOGY_60_D, "Grade ").as_deref(), + Some("D") + ); assert_eq!(extract_grade_readiness(READINESS_D).as_deref(), Some("D")); - assert_eq!(extract_last_updated(TOPOLOGY_60_D).as_deref(), Some("2026-07-02")); + assert_eq!( + extract_last_updated(TOPOLOGY_60_D).as_deref(), + Some("2026-07-02") + ); } #[test] fn passes_when_aligned() { let s = extract_state(STATE_60_D).unwrap(); let problems = reconcile(&s, Some(TOPOLOGY_60_D), Some(READINESS_D)); - assert!(problems.is_empty(), "expected no problems, got {problems:?}"); + assert!( + problems.is_empty(), + "expected no problems, got {problems:?}" + ); } #[test] @@ -313,7 +331,10 @@ OVERALL: ██████░░░░ ~60% Grade let s = extract_state(STATE_60_D).unwrap(); let bad_topology = "OVERALL: ~60% Grade A — Production Ready\n"; let problems = reconcile(&s, Some(bad_topology), None); - assert!(problems.iter().any(|p| p.contains("grade mismatch")), "{problems:?}"); + assert!( + problems.iter().any(|p| p.contains("grade mismatch")), + "{problems:?}" + ); } #[test] @@ -337,6 +358,9 @@ OVERALL: ██████░░░░ ~60% Grade OVERALL: ~60% Grade D "; let problems = reconcile(&s, Some(stale), None); - assert!(problems.iter().any(|p| p.contains("staleness")), "{problems:?}"); + assert!( + problems.iter().any(|p| p.contains("staleness")), + "{problems:?}" + ); } } diff --git a/crates/januskey-cli/src/attestation.rs b/crates/januskey-cli/src/attestation.rs index daf7e46..08e54d3 100644 --- a/crates/januskey-cli/src/attestation.rs +++ b/crates/januskey-cli/src/attestation.rs @@ -200,11 +200,7 @@ impl AuditLog { /// Errors if no attestation key is set: an unkeyed attestation is /// forgeable and must never be silently produced (the previous /// `unwrap_or([0u8; 32])` all-zero-key fallback did exactly that). - fn compute_attestation( - &self, - data: &str, - previous_hash: &str, - ) -> std::io::Result { + fn compute_attestation(&self, data: &str, previous_hash: &str) -> std::io::Result { let key = self.attestation_key.ok_or_else(|| { std::io::Error::new( std::io::ErrorKind::PermissionDenied, @@ -213,8 +209,8 @@ impl AuditLog { ) })?; - let mut mac = >::new_from_slice(&key) - .expect("HMAC accepts keys of any length"); + let mut mac = + >::new_from_slice(&key).expect("HMAC accepts keys of any length"); mac.update(Self::ATTESTATION_SCHEME.as_bytes()); mac.update(b"\x00"); mac.update(data.as_bytes()); diff --git a/crates/januskey-cli/src/keys_cli.rs b/crates/januskey-cli/src/keys_cli.rs index a9197c6..a6da31d 100644 --- a/crates/januskey-cli/src/keys_cli.rs +++ b/crates/januskey-cli/src/keys_cli.rs @@ -293,9 +293,7 @@ fn cmd_generate( ) .into()) } - _ => { - return Err(format!("Unknown key type: {}. Use: aes256", key_type).into()) - } + _ => return Err(format!("Unknown key type: {}. Use: aes256", key_type).into()), }; let key_purpose = match purpose.to_lowercase().as_str() { diff --git a/docs/wiki/Home.adoc b/docs/wiki/Home.adoc index 7a2febb..8c542ed 100644 --- a/docs/wiki/Home.adoc +++ b/docs/wiki/Home.adoc @@ -15,7 +15,7 @@ JanusKey is a reversible file operations utility (formal proofs pending) that pu === Project Status (2026-06-12) Landed since 2026-04: estate standardization merged (flat contractiles, -`bot_directives/`, `6a2/anchor/`, `self-validating/`, GOVERNANCE + +`bot_directives/`, `descriptiles/anchor/`, `self-validating/`, GOVERNANCE + MAINTAINERS + CODEOWNERS); license migrated PMPL-1.0-or-later → MPL-2.0 (Cargo.toml aligned in #52); CI converted to SHA-pinned reusable-workflow wrappers (rust-ci #39, hypatia-scan #40/#46, mirror #42, secret-scanner #43, From 7c82346f0f37d1bc1ae917874dc0147587913bf1 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 10 Sep 2026 01:13:29 +0100 Subject: [PATCH 3/4] fix(ci): restore DEED action identity and repaired K9 lock --- .github/workflows/actions.lock | 14 +++++++------- .github/workflows/dogfood-gate.yml | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 314affa..33d479c 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -24,7 +24,7 @@ workflows: - 'dependabot/fetch-metadata@v3.1.0' '.github/workflows/dogfood-gate.yml': - 'actions/checkout@v7.0.1' - - 'hyperpolymath/a2ml-ecosystem@main' + - 'hyperpolymath/deed-ecosystem@main' - 'hyperpolymath/k9-ecosystem@main' '.github/workflows/e2e.yml': - 'actions/checkout@v7.0.1' @@ -117,19 +117,19 @@ dependencies: commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' owner_id: 75048950 repo_id: 623796603 - 'hyperpolymath/a2ml-ecosystem@main': - ref: 'main' - commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d' - owner_id: 6759885 - repo_id: 1275649586 'hyperpolymath/cicd-suite@main': ref: 'main' commit: 'sha1-fc64172aa53e85289d5d7d6e15c2435a867cc1c9' owner_id: 6759885 repo_id: 1326697643 + 'hyperpolymath/deed-ecosystem@main': + ref: 'main' + commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d' + owner_id: 6759885 + repo_id: 1275649586 'hyperpolymath/k9-ecosystem@main': ref: 'main' - commit: 'sha1-347ee5d6a1b77831de56fe8da21a473724e4cac2' + commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb' owner_id: 6759885 repo_id: 1275650185 'peter-evans/repository-dispatch@v4.0.1': diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 0c18d4f..7a315ef 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -42,7 +42,7 @@ jobs: - name: Validate A2ML manifests if: steps.detect.outputs.count > 0 - uses: hyperpolymath/a2ml-ecosystem/validate-action@main + uses: hyperpolymath/deed-ecosystem/validate-action@main with: path: '.' strict: 'false' From cd9590fbc266d334c36e0f7fe9af48221f70e279 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Thu, 10 Sep 2026 13:14:42 +0000 Subject: [PATCH 4/4] fix(ci): repair pre-merge checks and migrate metadata to 6a2 --- .claude/CLAUDE.md | 18 +++--- .github/workflows/actions.lock | 39 +++++-------- .github/workflows/boj-build.yml | 1 - .github/workflows/cargo-audit.yml | 2 +- .github/workflows/casket-pages.yml | 1 - .github/workflows/codeql.yml | 1 - .github/workflows/dashboard-check.yml | 3 - .github/workflows/dependabot-automerge.yml | 1 - .github/workflows/dogfood-gate.yml | 3 +- .github/workflows/e2e.yml | 10 +--- .github/workflows/governance.yml | 1 - .github/workflows/hypatia-scan.yml | 1 - .github/workflows/instant-sync.yml | 1 - .github/workflows/label-triage.yml | 1 - .github/workflows/labels.yml | 1 - .github/workflows/main-estate-audit.yml | 6 +- .github/workflows/mirror.yml | 1 - .github/workflows/pages.yml | 1 - .github/workflows/push-email-notify.yml | 1 - .github/workflows/rust-ci.yml | 1 - .github/workflows/scorecard.yml | 1 - .github/workflows/secret-scanner.yml | 1 - .github/workflows/semgrep.yml | 1 - .github/workflows/workflow-linter.yml | 2 +- .../{descriptiles => 6a2}/0-AI-MANIFEST.a2ml | 5 +- .../{descriptiles => 6a2}/AGENTIC.a2ml | 0 .../{descriptiles => 6a2}/ECOSYSTEM.a2ml | 0 .../{descriptiles => 6a2}/META.a2ml | 0 .../{descriptiles => 6a2}/NEUROSYM.a2ml | 0 .../{descriptiles => 6a2}/PLAYBOOK.a2ml | 2 +- .../{descriptiles => 6a2}/README.adoc | 3 +- .../{descriptiles => 6a2}/STATE.a2ml | 0 .../anchor/0-AI-MANIFEST.a2ml | 0 .../{descriptiles => 6a2}/anchor/ANCHOR.a2ml | 0 .../{descriptiles => 6a2}/anchor/README.adoc | 0 .../contractiles/Adjustfile.a2ml | 2 +- .machine_readable/contractiles/Mustfile.a2ml | 8 +-- .../self-validating/methodology-guard.k9.ncl | 2 +- 0-AI-MANIFEST.a2ml | 34 +++++------ TESTING-REPORT.adoc | 2 +- TOPOLOGY.adoc | 2 +- crates/dashboard-check/src/main.rs | 58 ++++++------------- crates/januskey-cli/src/attestation.rs | 10 +++- crates/januskey-cli/src/keys_cli.rs | 4 +- docs/wiki/Home.adoc | 2 +- 45 files changed, 86 insertions(+), 147 deletions(-) rename .machine_readable/{descriptiles => 6a2}/0-AI-MANIFEST.a2ml (81%) rename .machine_readable/{descriptiles => 6a2}/AGENTIC.a2ml (100%) rename .machine_readable/{descriptiles => 6a2}/ECOSYSTEM.a2ml (100%) rename .machine_readable/{descriptiles => 6a2}/META.a2ml (100%) rename .machine_readable/{descriptiles => 6a2}/NEUROSYM.a2ml (100%) rename .machine_readable/{descriptiles => 6a2}/PLAYBOOK.a2ml (88%) rename .machine_readable/{descriptiles => 6a2}/README.adoc (97%) rename .machine_readable/{descriptiles => 6a2}/STATE.a2ml (100%) rename .machine_readable/{descriptiles => 6a2}/anchor/0-AI-MANIFEST.a2ml (100%) rename .machine_readable/{descriptiles => 6a2}/anchor/ANCHOR.a2ml (100%) rename .machine_readable/{descriptiles => 6a2}/anchor/README.adoc (100%) diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index bb6ceb7..b162b00 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -3,12 +3,12 @@ The repository's canonical machine-readable metadata tree contains structured project metadata, including: -- `STATE.a2ml` - Current project state and progress -- `META.a2ml` - Architecture decisions and development practices -- `ECOSYSTEM.a2ml` - Position in the ecosystem and related projects -- `AGENTIC.a2ml` - AI agent interaction patterns -- `NEUROSYM.a2ml` - Neurosymbolic integration config -- `PLAYBOOK.a2ml` - Operational runbook +- `.machine_readable/6a2/STATE.a2ml` - Current project state and progress +- `.machine_readable/6a2/META.a2ml` - Architecture decisions and development practices +- `.machine_readable/6a2/ECOSYSTEM.a2ml` - Position in the ecosystem and related projects +- `.machine_readable/6a2/AGENTIC.a2ml` - AI agent interaction patterns +- `.machine_readable/6a2/NEUROSYM.a2ml` - Neurosymbolic integration config +- `.machine_readable/6a2/PLAYBOOK.a2ml` - Operational runbook --- @@ -29,7 +29,7 @@ project metadata, including: | **Bash/POSIX Shell** | Scripts, automation | Keep minimal | | **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Bun APIs | | **Nickel** | Configuration language | For complex configs | -| **Guile Scheme** | State/meta files | `.machine_readable/descriptiles/` | +| **Guile Scheme** | State/meta files | `.machine_readable/6a2/` | | **Julia** | Batch scripts, data processing | Per RSR | | **OCaml** | AffineScript compiler | Language-specific | | **Ada** | Safety-critical systems | Where required | @@ -45,7 +45,7 @@ project metadata, including: | npm | Bun | | pnpm/yarn | Bun | | Go | Rust | -| Python | Julia/Rust/AffineScript | +| Python | Rust/AffineScript | | Java/Kotlin | Rust/Gossamer/Dioxus | | Swift | Gossamer/Dioxus | | React Native | Gossamer/Dioxus | @@ -66,7 +66,7 @@ Both are FOSS with independent governance (no Big Tech). 2. **Use `package.json` + `bun.lock` for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED 3. **`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock` 4. **No Go code** - Use Rust instead -5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, and AffineScript for apps +5. **No Python anywhere** - Use Rust for systems and AffineScript for apps 6. **No Kotlin/Swift for mobile** - Use Gossamer or Dioxus ### Package Management diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 33d479c..14f606f 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,6 +3,14 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.2' workflows: + '.github/workflows/governance.yml': [] + '.github/workflows/hypatia-scan.yml': [] + '.github/workflows/label-triage.yml': [] + '.github/workflows/labels.yml': [] + '.github/workflows/mirror.yml': [] + '.github/workflows/rust-ci.yml': [] + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] '.github/workflows/boj-build.yml': - 'actions/checkout@v7.0.1' '.github/workflows/cargo-audit.yml': @@ -24,31 +32,20 @@ workflows: - 'dependabot/fetch-metadata@v3.1.0' '.github/workflows/dogfood-gate.yml': - 'actions/checkout@v7.0.1' - - 'hyperpolymath/deed-ecosystem@main' + - 'hyperpolymath/a2ml-ecosystem@main' - 'hyperpolymath/k9-ecosystem@main' '.github/workflows/e2e.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' - '.github/workflows/governance.yml': [] - '.github/workflows/hypatia-scan.yml': [] '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' - '.github/workflows/label-triage.yml': [] - '.github/workflows/labels.yml': [] - '.github/workflows/main-estate-audit.yml': - - 'actions/checkout@v4.4.0' - - 'hyperpolymath/cicd-suite@main' - '.github/workflows/mirror.yml': [] '.github/workflows/pages.yml': - 'actions/checkout@v7.0.1' - 'actions/deploy-pages@v5.0.0' - 'actions/upload-pages-artifact@v5.0.0' '.github/workflows/push-email-notify.yml': - 'dawidd6/action-send-mail@v3.12.0' - '.github/workflows/rust-ci.yml': [] - '.github/workflows/scorecard.yml': [] - '.github/workflows/secret-scanner.yml': [] '.github/workflows/semgrep.yml': - 'actions/checkout@v7.0.1' - 'github/codeql-action@v4.37.8' @@ -60,11 +57,6 @@ dependencies: commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' owner_id: 44036562 repo_id: 215566462 - 'actions/checkout@v4.4.0': - ref: 'v4.4.0' - commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' - owner_id: 44036562 - repo_id: 197814629 'actions/checkout@v7.0.1': ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' @@ -94,7 +86,7 @@ dependencies: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' 'dawidd6/action-send-mail@v3.12.0': ref: 'v3.12.0' - commit: 'sha1-2cea9617b09d79a095af21254fbcb7ae95903dde' + commit: 'sha1-0bbdab096651ee93f37ec02383e088183d41ff0b' owner_id: 9713907 repo_id: 222439721 'dependabot/fetch-metadata@v3.1.0': @@ -117,19 +109,14 @@ dependencies: commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' owner_id: 75048950 repo_id: 623796603 - 'hyperpolymath/cicd-suite@main': - ref: 'main' - commit: 'sha1-fc64172aa53e85289d5d7d6e15c2435a867cc1c9' - owner_id: 6759885 - repo_id: 1326697643 - 'hyperpolymath/deed-ecosystem@main': + 'hyperpolymath/a2ml-ecosystem@main': ref: 'main' - commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d' + commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79' owner_id: 6759885 repo_id: 1275649586 'hyperpolymath/k9-ecosystem@main': ref: 'main' - commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb' + commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562' owner_id: 6759885 repo_id: 1275650185 'peter-evans/repository-dispatch@v4.0.1': diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 231ddad..501fc6a 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: BoJ Server Build Trigger diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml index e03918f..acf01e3 100644 --- a/.github/workflows/cargo-audit.yml +++ b/.github/workflows/cargo-audit.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Prevention workflow - audits Rust dependencies for vulnerabilities @@ -18,6 +17,7 @@ on: - cron: '0 6 * * 1' # Weekly on Monday permissions: read-all + actions: read jobs: audit: diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 936a453..f21070c 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: GitHub Pages diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2006c8f..aa923b5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: CodeQL Security Analysis diff --git a/.github/workflows/dashboard-check.yml b/.github/workflows/dashboard-check.yml index ad2219e..1e19f8d 100644 --- a/.github/workflows/dashboard-check.yml +++ b/.github/workflows/dashboard-check.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -28,8 +27,6 @@ jobs: uses: actions/checkout@v7.0.1 - uses: dtolnay/rust-toolchain@v1 - with: - toolchain: stable - name: Reconcile dashboards against STATE.a2ml run: cargo run -q -p dashboard-check -- --check . diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 02082ae..607bd9d 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 7a315ef..75f9e46 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -42,7 +41,7 @@ jobs: - name: Validate A2ML manifests if: steps.detect.outputs.count > 0 - uses: hyperpolymath/deed-ecosystem/validate-action@main + uses: hyperpolymath/a2ml-ecosystem/validate-action@main with: path: '.' strict: 'false' diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 9908ab4..aa0b663 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # JanusKey E2E + P2P + Aspect + Bench + Panic-Attack CI @@ -11,6 +10,7 @@ on: branches: [main] permissions: read-all + actions: read jobs: rust-build-test: @@ -20,8 +20,6 @@ jobs: steps: - uses: actions/checkout@v7.0.1 - uses: dtolnay/rust-toolchain@v1 - with: - toolchain: stable - uses: Swatinem/rust-cache@v2.9.2 - name: Build run: cargo build --release @@ -39,8 +37,6 @@ jobs: steps: - uses: actions/checkout@v7.0.1 - uses: dtolnay/rust-toolchain@v1 - with: - toolchain: stable - uses: Swatinem/rust-cache@v2.9.2 - name: Run benchmarks run: cargo bench -- --output-format bencher 2>/dev/null || echo "Benchmarks completed" @@ -52,8 +48,6 @@ jobs: steps: - uses: actions/checkout@v7.0.1 - uses: dtolnay/rust-toolchain@v1 - with: - toolchain: stable - uses: Swatinem/rust-cache@v2.9.2 - name: Build release run: cargo build --release @@ -93,8 +87,6 @@ jobs: steps: - uses: actions/checkout@v7.0.1 - uses: dtolnay/rust-toolchain@v1 - with: - toolchain: stable - name: Install panic-attack run: cargo install --git https://github.com/hyperpolymath/panic-attacker.git 2>/dev/null || echo "panic-attack unavailable" - name: Run assail scan diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 844828e..784d974 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 205a9b2..410fd2e 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml. diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index a543408..1a32c7a 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index 814a192..9886e92 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Label Triage diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index 83ab941..c80b676 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Labels diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index 907e8ad..b602e97 100755 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -1,5 +1,3 @@ -# This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 name: Central Estate CI/CD Audit on: @@ -8,13 +6,11 @@ on: pull_request: branches: [ "main" ] -permissions: read-all - jobs: estate-audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4.4.0 + - uses: actions/checkout@v4 - name: Required Files Gate uses: hyperpolymath/cicd-suite/actions/required-files-check@main diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index e3965f1..d4ac835 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Mirror to Git Forges diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index fd15980..c458477 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: GitHub Pages (Ddraig SSG) diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index b4f1073..360340c 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index b4ffd22..43408cd 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Rust CI — thin wrapper calling the shared estate reusable in diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d70c000..6a6fa72 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Scorecards supply-chain security diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 5013d1a..89a1438 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Secret Scanner diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index e3aecb6..9132292 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Semgrep SAST diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 57208d9..52121f7 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -1,4 +1,3 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Prevention workflow - validates all workflows have proper security config @@ -13,6 +12,7 @@ on: - '.github/workflows/**' permissions: read-all + actions: read jobs: lint-workflows: diff --git a/.machine_readable/descriptiles/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/0-AI-MANIFEST.a2ml similarity index 81% rename from .machine_readable/descriptiles/0-AI-MANIFEST.a2ml rename to .machine_readable/6a2/0-AI-MANIFEST.a2ml index 9187edb..6bf1f8c 100644 --- a/.machine_readable/descriptiles/0-AI-MANIFEST.a2ml +++ b/.machine_readable/6a2/0-AI-MANIFEST.a2ml @@ -1,8 +1,8 @@ -# AI Manifest for the descriptiles Directory +# AI Manifest for 6a2 Directory ## Purpose -This manifest declares the AI-assistant context for the descriptiles machine-readable metadata directory. +This manifest declares the AI-assistant context for the 6a2 machine-readable metadata directory. ## Canonical Locations @@ -28,3 +28,4 @@ When multiple agents may write to A2ML files concurrently: 3. Write updated file with new [provenance] metadata 4. Release by removing lock file 5. On conflict: re-read and retry if git-sha-at-read does not match HEAD + diff --git a/.machine_readable/descriptiles/AGENTIC.a2ml b/.machine_readable/6a2/AGENTIC.a2ml similarity index 100% rename from .machine_readable/descriptiles/AGENTIC.a2ml rename to .machine_readable/6a2/AGENTIC.a2ml diff --git a/.machine_readable/descriptiles/ECOSYSTEM.a2ml b/.machine_readable/6a2/ECOSYSTEM.a2ml similarity index 100% rename from .machine_readable/descriptiles/ECOSYSTEM.a2ml rename to .machine_readable/6a2/ECOSYSTEM.a2ml diff --git a/.machine_readable/descriptiles/META.a2ml b/.machine_readable/6a2/META.a2ml similarity index 100% rename from .machine_readable/descriptiles/META.a2ml rename to .machine_readable/6a2/META.a2ml diff --git a/.machine_readable/descriptiles/NEUROSYM.a2ml b/.machine_readable/6a2/NEUROSYM.a2ml similarity index 100% rename from .machine_readable/descriptiles/NEUROSYM.a2ml rename to .machine_readable/6a2/NEUROSYM.a2ml diff --git a/.machine_readable/descriptiles/PLAYBOOK.a2ml b/.machine_readable/6a2/PLAYBOOK.a2ml similarity index 88% rename from .machine_readable/descriptiles/PLAYBOOK.a2ml rename to .machine_readable/6a2/PLAYBOOK.a2ml index 791847b..a961250 100644 --- a/.machine_readable/descriptiles/PLAYBOOK.a2ml +++ b/.machine_readable/6a2/PLAYBOOK.a2ml @@ -13,7 +13,7 @@ last-updated = "2026-03-16" # target = "container" [incident-response] -# 1. Check .machine_readable/descriptiles/STATE.a2ml for current status +# 1. Check .machine_readable/STATE.a2ml for current status # 2. Review recent commits and CI results # 3. Run just validate to check compliance diff --git a/.machine_readable/descriptiles/README.adoc b/.machine_readable/6a2/README.adoc similarity index 97% rename from .machine_readable/descriptiles/README.adoc rename to .machine_readable/6a2/README.adoc index 7671b14..916a702 100644 --- a/.machine_readable/descriptiles/README.adoc +++ b/.machine_readable/6a2/README.adoc @@ -1,6 +1,6 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // Copyright (c) Jonathan D.A. Jewell -# A2ML descriptiles Directory +# A2ML 6a2 Directory This directory contains the 6 core A2ML machine-readable metadata files for this repository. @@ -27,3 +27,4 @@ Source .scm files should be removed after successful transpilation. - [A2ML Repository Template](https://github.com/hyperpolymath/standards/blob/main/A2ML-REPO-TEMPLATE.adoc) - [6A2 Format Family](https://github.com/hyperpolymath/standards#a2ml-format-family-7-formats) + diff --git a/.machine_readable/descriptiles/STATE.a2ml b/.machine_readable/6a2/STATE.a2ml similarity index 100% rename from .machine_readable/descriptiles/STATE.a2ml rename to .machine_readable/6a2/STATE.a2ml diff --git a/.machine_readable/descriptiles/anchor/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml similarity index 100% rename from .machine_readable/descriptiles/anchor/0-AI-MANIFEST.a2ml rename to .machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml diff --git a/.machine_readable/descriptiles/anchor/ANCHOR.a2ml b/.machine_readable/6a2/anchor/ANCHOR.a2ml similarity index 100% rename from .machine_readable/descriptiles/anchor/ANCHOR.a2ml rename to .machine_readable/6a2/anchor/ANCHOR.a2ml diff --git a/.machine_readable/descriptiles/anchor/README.adoc b/.machine_readable/6a2/anchor/README.adoc similarity index 100% rename from .machine_readable/descriptiles/anchor/README.adoc rename to .machine_readable/6a2/anchor/README.adoc diff --git a/.machine_readable/contractiles/Adjustfile.a2ml b/.machine_readable/contractiles/Adjustfile.a2ml index 4dc88cd..d40cca1 100644 --- a/.machine_readable/contractiles/Adjustfile.a2ml +++ b/.machine_readable/contractiles/Adjustfile.a2ml @@ -88,7 +88,7 @@ Standard: WCAG-2.2-AA (CLI/TUI profile). - severity: advisory ### state-file-currency -- description: descriptiles/STATE.a2ml should be refreshed when a work-wave lands +- description: 6a2/STATE.a2ml should be refreshed when a work-wave lands - tolerance: last-updated within 90 days of the latest non-dependabot commit - corrective: Refresh STATE.a2ml from git log - severity: advisory diff --git a/.machine_readable/contractiles/Mustfile.a2ml b/.machine_readable/contractiles/Mustfile.a2ml index 859288c..21d3e66 100644 --- a/.machine_readable/contractiles/Mustfile.a2ml +++ b/.machine_readable/contractiles/Mustfile.a2ml @@ -63,13 +63,13 @@ trust level: even maximal-trust agents cannot violate MUST constraints. - severity: critical ### six-directory-present -- description: descriptiles directory exists with required files -- run: test -d .machine_readable/descriptiles && test -f .machine_readable/descriptiles/META.a2ml && test -f .machine_readable/descriptiles/ECOSYSTEM.a2ml && test -f .machine_readable/descriptiles/STATE.a2ml && test -f .machine_readable/descriptiles/PLAYBOOK.a2ml && test -f .machine_readable/descriptiles/AGENTIC.a2ml && test -f .machine_readable/descriptiles/NEUROSYM.a2ml +- description: 6a2 directory exists with required files +- run: test -d .machine_readable/6a2 && test -f .machine_readable/6a2/META.a2ml && test -f .machine_readable/6a2/ECOSYSTEM.a2ml && test -f .machine_readable/6a2/STATE.a2ml && test -f .machine_readable/6a2/PLAYBOOK.a2ml && test -f .machine_readable/6a2/AGENTIC.a2ml && test -f .machine_readable/6a2/NEUROSYM.a2ml - severity: critical ### anchor-directory -- description: anchor directory exists in descriptiles -- run: test -d .machine_readable/descriptiles/anchor && test -f .machine_readable/descriptiles/anchor/ANCHOR.a2ml +- description: anchor directory exists in 6a2 (renamed from anchors/ in the estate wave) +- run: test -d .machine_readable/6a2/anchor && test -f .machine_readable/6a2/anchor/ANCHOR.a2ml - severity: warning ### self-validating-structure diff --git a/.machine_readable/self-validating/methodology-guard.k9.ncl b/.machine_readable/self-validating/methodology-guard.k9.ncl index 1b5ab44..128575e 100644 --- a/.machine_readable/self-validating/methodology-guard.k9.ncl +++ b/.machine_readable/self-validating/methodology-guard.k9.ncl @@ -60,7 +60,7 @@ let methodology_guard = { state_not_template = { description = "STATE.a2ml must not contain template placeholders", severity = "warning", - file = ".machine_readable/descriptiles/STATE.a2ml", + file = ".machine_readable/6a2/STATE.a2ml", reject_patterns = ["{{PLACEHOLDER}}", "{{PROJECT}}", "rsr-template-repo"], }, diff --git a/0-AI-MANIFEST.a2ml b/0-AI-MANIFEST.a2ml index 4b35f84..1f210f8 100644 --- a/0-AI-MANIFEST.a2ml +++ b/0-AI-MANIFEST.a2ml @@ -14,12 +14,12 @@ This is the AI manifest for **januskey**. It declares: ### Machine-Readable Metadata: `.machine_readable/` ONLY These 6 SCM files MUST exist in `.machine_readable/` directory ONLY: -1. **.machine_readable/descriptiles/STATE.a2ml** - Project state, progress, blockers -2. **.machine_readable/descriptiles/META.a2ml** - Architecture decisions, governance -3. **.machine_readable/descriptiles/ECOSYSTEM.a2ml** - Position in ecosystem, relationships -4. **.machine_readable/descriptiles/AGENTIC.a2ml** - AI agent interaction patterns -5. **.machine_readable/descriptiles/NEUROSYM.a2ml** - Neurosymbolic integration config -6. **.machine_readable/descriptiles/PLAYBOOK.a2ml** - Operational runbook +1. **.machine_readable/6a2/STATE.a2ml** - Project state, progress, blockers +2. **.machine_readable/6a2/META.a2ml** - Architecture decisions, governance +3. **.machine_readable/6a2/ECOSYSTEM.a2ml** - Position in ecosystem, relationships +4. **.machine_readable/6a2/AGENTIC.a2ml** - AI agent interaction patterns +5. **.machine_readable/6a2/NEUROSYM.a2ml** - Neurosymbolic integration config +6. **.machine_readable/6a2/PLAYBOOK.a2ml** - Operational runbook **CRITICAL:** If ANY of these files exist in the root directory, this is an ERROR. @@ -40,7 +40,7 @@ Bot-specific instructions for: ## CORE INVARIANTS -1. **No SCM duplication** - Root must NOT contain .machine_readable/descriptiles/STATE.a2ml, .machine_readable/descriptiles/META.a2ml, etc. +1. **No SCM duplication** - Root must NOT contain .machine_readable/6a2/STATE.a2ml, .machine_readable/6a2/META.a2ml, etc. 2. **Single source of truth** - `.machine_readable/` is authoritative 3. **No stale metadata** - If root SCMs exist, they are OUT OF DATE 4. **License consistency** - All code MPL-2.0 unless platform requires MPL-2.0 @@ -58,12 +58,12 @@ januskey/ ├── README.md # Project overview ├── [your source files] # Main code ├── .machine_readable/ # SCM files (6 files) -│ ├── .machine_readable/descriptiles/STATE.a2ml -│ ├── .machine_readable/descriptiles/META.a2ml -│ ├── .machine_readable/descriptiles/ECOSYSTEM.a2ml -│ ├── .machine_readable/descriptiles/AGENTIC.a2ml -│ ├── .machine_readable/descriptiles/NEUROSYM.a2ml -│ └── .machine_readable/descriptiles/PLAYBOOK.a2ml +│ ├── .machine_readable/6a2/STATE.a2ml +│ ├── .machine_readable/6a2/META.a2ml +│ ├── .machine_readable/6a2/ECOSYSTEM.a2ml +│ ├── .machine_readable/6a2/AGENTIC.a2ml +│ ├── .machine_readable/6a2/NEUROSYM.a2ml +│ └── .machine_readable/6a2/PLAYBOOK.a2ml └── .bot_directives/ # Bot instructions ``` @@ -73,8 +73,8 @@ januskey/ ✅ Understand canonical locations (.machine_readable/, .bot_directives/) ✅ Know the invariants (no SCM duplication, etc.) ✅ Check for MCP enforcement (if applicable) -✅ Read `.machine_readable/descriptiles/STATE.a2ml` for current status -✅ Read `.machine_readable/descriptiles/AGENTIC.a2ml` for interaction patterns +✅ Read `.machine_readable/6a2/STATE.a2ml` for current status +✅ Read `.machine_readable/6a2/AGENTIC.a2ml` for interaction patterns ## LIFECYCLE HOOKS @@ -86,7 +86,7 @@ When starting a new session: 2. Log session start (optional but recommended) - Format: `[YYYY-MM-DD HH:MM:SS] Session started: [agent-name]` - Location: `.machine_readable/session-log.txt` -3. Read `.machine_readable/descriptiles/STATE.a2ml` +3. Read `.machine_readable/6a2/STATE.a2ml` 4. Check for blockers 5. State understanding of canonical locations @@ -94,7 +94,7 @@ When starting a new session: When ending a session: -1. Update `.machine_readable/descriptiles/STATE.a2ml` if changes made +1. Update `.machine_readable/6a2/STATE.a2ml` if changes made 2. Log session end (optional but recommended) - Format: `[YYYY-MM-DD HH:MM:SS] Session ended: [summary]` - Location: `.machine_readable/session-log.txt` diff --git a/TESTING-REPORT.adoc b/TESTING-REPORT.adoc index 560dc70..a974b79 100644 --- a/TESTING-REPORT.adoc +++ b/TESTING-REPORT.adoc @@ -17,7 +17,7 @@ functional" framing overstates the current state (homerolled attestation MAC, unimplemented asymmetric crypto, no fuzz/mutation/chaos testing). *For the current, authoritative test status see `READINESS.md` and -`.machine_readable/descriptiles/STATE.a2ml`.* +`.machine_readable/6a2/STATE.a2ml`.* ==== == Executive Summary diff --git a/TOPOLOGY.adoc b/TOPOLOGY.adoc index 54136a3..44317e6 100644 --- a/TOPOLOGY.adoc +++ b/TOPOLOGY.adoc @@ -47,7 +47,7 @@ === Completion Dashboard ____ -*Source of truth:* `+.machine_readable/descriptiles/STATE.a2ml+` (completion 60%, +*Source of truth:* `+.machine_readable/6a2/STATE.a2ml+` (completion 60%, CRG grade *D*) and `+READINESS.md+` (Grade *D — Alpha, Unstable*). This dashboard is a human-readable summary of those files; if they disagree, they win. Percentages below are qualitative, not measured coverage. This diff --git a/crates/dashboard-check/src/main.rs b/crates/dashboard-check/src/main.rs index f254b2f..56b0f7f 100644 --- a/crates/dashboard-check/src/main.rs +++ b/crates/dashboard-check/src/main.rs @@ -54,13 +54,10 @@ fn extract_state(toml_src: &str) -> Result { .and_then(|v| v.as_str().map(str::to_string)) .or_else(|| get("crg-compliance", "tier").and_then(|v| v.as_str().map(str::to_string))); - let last_updated = get("metadata", "last-updated").and_then(|v| v.as_str().map(str::to_string)); + let last_updated = get("metadata", "last-updated") + .and_then(|v| v.as_str().map(str::to_string)); - Ok(StateFacts { - completion, - grade, - last_updated, - }) + Ok(StateFacts { completion, grade, last_updated }) } /// Coerce a TOML value (string `"60"` or integer `60`) into a percentage. @@ -109,10 +106,7 @@ fn extract_grade_after_token(text: &str, token: &str) -> Option { for line in text.lines() { if let Some(idx) = line.find(token) { let rest = line[idx + token.len()..].trim_start(); - let g: String = rest - .chars() - .take_while(|c| c.is_ascii_alphabetic()) - .collect(); + let g: String = rest.chars().take_while(|c| c.is_ascii_alphabetic()).collect(); if !g.is_empty() { return Some(g); } @@ -136,16 +130,16 @@ fn extract_last_updated(topology: &str) -> Option { .chars() .take_while(|c| c.is_ascii_digit() || *c == '-') .collect(); - if date.len() >= 8 { - Some(date) - } else { - None - } + if date.len() >= 8 { Some(date) } else { None } } /// Compare STATE against the dashboards; return a list of human-readable /// mismatch messages (empty = all good). Pure so it is unit-testable. -fn reconcile(state: &StateFacts, topology: Option<&str>, readiness: Option<&str>) -> Vec { +fn reconcile( + state: &StateFacts, + topology: Option<&str>, + readiness: Option<&str>, +) -> Vec { let mut problems = Vec::new(); if let (Some(pct), Some(topo)) = (state.completion, topology) { @@ -208,7 +202,7 @@ fn main() -> ExitCode { root = PathBuf::from(arg); } - let state_path = root.join(".machine_readable/descriptiles/STATE.a2ml"); + let state_path = root.join(".machine_readable/6a2/STATE.a2ml"); let state_src = match read_opt(&state_path) { Some(s) => s, None => { @@ -237,10 +231,7 @@ fn main() -> ExitCode { ); ExitCode::SUCCESS } else { - eprintln!( - "dashboard-check: {} divergence(s) from STATE.a2ml (the source of truth):", - problems.len() - ); + eprintln!("dashboard-check: {} divergence(s) from STATE.a2ml (the source of truth):", problems.len()); for p in &problems { eprintln!(" ✗ {p}"); } @@ -296,25 +287,16 @@ OVERALL: ██████░░░░ ~60% Grade #[test] fn extracts_dashboard_signals() { assert_eq!(extract_overall_pct(TOPOLOGY_60_D), Some(60)); - assert_eq!( - extract_grade_after_token(TOPOLOGY_60_D, "Grade ").as_deref(), - Some("D") - ); + assert_eq!(extract_grade_after_token(TOPOLOGY_60_D, "Grade ").as_deref(), Some("D")); assert_eq!(extract_grade_readiness(READINESS_D).as_deref(), Some("D")); - assert_eq!( - extract_last_updated(TOPOLOGY_60_D).as_deref(), - Some("2026-07-02") - ); + assert_eq!(extract_last_updated(TOPOLOGY_60_D).as_deref(), Some("2026-07-02")); } #[test] fn passes_when_aligned() { let s = extract_state(STATE_60_D).unwrap(); let problems = reconcile(&s, Some(TOPOLOGY_60_D), Some(READINESS_D)); - assert!( - problems.is_empty(), - "expected no problems, got {problems:?}" - ); + assert!(problems.is_empty(), "expected no problems, got {problems:?}"); } #[test] @@ -331,10 +313,7 @@ OVERALL: ██████░░░░ ~60% Grade let s = extract_state(STATE_60_D).unwrap(); let bad_topology = "OVERALL: ~60% Grade A — Production Ready\n"; let problems = reconcile(&s, Some(bad_topology), None); - assert!( - problems.iter().any(|p| p.contains("grade mismatch")), - "{problems:?}" - ); + assert!(problems.iter().any(|p| p.contains("grade mismatch")), "{problems:?}"); } #[test] @@ -358,9 +337,6 @@ OVERALL: ██████░░░░ ~60% Grade OVERALL: ~60% Grade D "; let problems = reconcile(&s, Some(stale), None); - assert!( - problems.iter().any(|p| p.contains("staleness")), - "{problems:?}" - ); + assert!(problems.iter().any(|p| p.contains("staleness")), "{problems:?}"); } } diff --git a/crates/januskey-cli/src/attestation.rs b/crates/januskey-cli/src/attestation.rs index 08e54d3..daf7e46 100644 --- a/crates/januskey-cli/src/attestation.rs +++ b/crates/januskey-cli/src/attestation.rs @@ -200,7 +200,11 @@ impl AuditLog { /// Errors if no attestation key is set: an unkeyed attestation is /// forgeable and must never be silently produced (the previous /// `unwrap_or([0u8; 32])` all-zero-key fallback did exactly that). - fn compute_attestation(&self, data: &str, previous_hash: &str) -> std::io::Result { + fn compute_attestation( + &self, + data: &str, + previous_hash: &str, + ) -> std::io::Result { let key = self.attestation_key.ok_or_else(|| { std::io::Error::new( std::io::ErrorKind::PermissionDenied, @@ -209,8 +213,8 @@ impl AuditLog { ) })?; - let mut mac = - >::new_from_slice(&key).expect("HMAC accepts keys of any length"); + let mut mac = >::new_from_slice(&key) + .expect("HMAC accepts keys of any length"); mac.update(Self::ATTESTATION_SCHEME.as_bytes()); mac.update(b"\x00"); mac.update(data.as_bytes()); diff --git a/crates/januskey-cli/src/keys_cli.rs b/crates/januskey-cli/src/keys_cli.rs index a6da31d..a9197c6 100644 --- a/crates/januskey-cli/src/keys_cli.rs +++ b/crates/januskey-cli/src/keys_cli.rs @@ -293,7 +293,9 @@ fn cmd_generate( ) .into()) } - _ => return Err(format!("Unknown key type: {}. Use: aes256", key_type).into()), + _ => { + return Err(format!("Unknown key type: {}. Use: aes256", key_type).into()) + } }; let key_purpose = match purpose.to_lowercase().as_str() { diff --git a/docs/wiki/Home.adoc b/docs/wiki/Home.adoc index 8c542ed..7a2febb 100644 --- a/docs/wiki/Home.adoc +++ b/docs/wiki/Home.adoc @@ -15,7 +15,7 @@ JanusKey is a reversible file operations utility (formal proofs pending) that pu === Project Status (2026-06-12) Landed since 2026-04: estate standardization merged (flat contractiles, -`bot_directives/`, `descriptiles/anchor/`, `self-validating/`, GOVERNANCE + +`bot_directives/`, `6a2/anchor/`, `self-validating/`, GOVERNANCE + MAINTAINERS + CODEOWNERS); license migrated PMPL-1.0-or-later → MPL-2.0 (Cargo.toml aligned in #52); CI converted to SHA-pinned reusable-workflow wrappers (rust-ci #39, hypatia-scan #40/#46, mirror #42, secret-scanner #43,