From cf3c9fc5c8379c793b6366b6008a7fa48a14d982 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:44:43 +0100 Subject: [PATCH 1/6] chore: estate-wide security compliance --- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/e2e.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-dispatch-intake.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/learning-loop.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/panicbot-sweep.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/repo-integrity-guard.yml | 1 + .github/workflows/rust.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/supervised-fleet-scan.yml | 1 + 19 files changed, 19 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index a8bed185..4210c07e 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -17,4 +17,5 @@ jobs: curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"} continue-on-error: true permissions: + actions: read contents: read diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 63982879..9ab734ef 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e1609526..50403a8d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,6 +20,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 652bb867..607e339d 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -13,6 +13,7 @@ on: branches: [main, master] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 04db86fb..b66b05bf 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -6,6 +6,7 @@ on: pull_request: branches: ['**'] permissions: + actions: read contents: read jobs: e2e: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 31b793c3..c396eb79 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -27,6 +27,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-dispatch-intake.yml b/.github/workflows/hypatia-dispatch-intake.yml index 2157eba9..8d4708a7 100644 --- a/.github/workflows/hypatia-dispatch-intake.yml +++ b/.github/workflows/hypatia-dispatch-intake.yml @@ -11,6 +11,7 @@ on: - hypatia-general-findings permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index df7c890a..f058a2cf 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -21,6 +21,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read security-events: write pull-requests: write diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 78be809b..779601af 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -9,6 +9,7 @@ on: types: [published] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/learning-loop.yml b/.github/workflows/learning-loop.yml index fd7b48d3..f0bfa3eb 100644 --- a/.github/workflows/learning-loop.yml +++ b/.github/workflows/learning-loop.yml @@ -8,6 +8,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index fe6f7afd..8d214aaf 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 85963742..50092a45 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -5,6 +5,7 @@ on: branches: [main, master] workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/panicbot-sweep.yml b/.github/workflows/panicbot-sweep.yml index 396b3f3a..6fadd390 100644 --- a/.github/workflows/panicbot-sweep.yml +++ b/.github/workflows/panicbot-sweep.yml @@ -28,6 +28,7 @@ on: - guardian permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 08167719..ce036e21 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/repo-integrity-guard.yml b/.github/workflows/repo-integrity-guard.yml index 8d10cc47..9f2d555e 100644 --- a/.github/workflows/repo-integrity-guard.yml +++ b/.github/workflows/repo-integrity-guard.yml @@ -22,6 +22,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read env: diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index f9f17e63..a3c87280 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -10,6 +10,7 @@ on: pull_request: branches: ['**'] permissions: + actions: read contents: read env: CARGO_TERM_COLOR: always diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 2d9ea22d..8afb3f3b 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: branches: [main] permissions: read-all + actions: read jobs: analysis: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 66572b82..e59938a0 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,6 +11,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/supervised-fleet-scan.yml b/.github/workflows/supervised-fleet-scan.yml index 66da24f2..3ac4df49 100644 --- a/.github/workflows/supervised-fleet-scan.yml +++ b/.github/workflows/supervised-fleet-scan.yml @@ -22,6 +22,7 @@ on: default: true permissions: + actions: read contents: read jobs: From 7dfa3ed5c36543ffa903be21aadc9256be94689e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:09:08 +0100 Subject: [PATCH 2/6] chore: remove duplicate GOVERNANCE files, keep GOVERNANCE.md --- .claude/worktrees/actions-policy | 1 + GOVERNANCE.adoc | 162 ------------------------------- 2 files changed, 1 insertion(+), 162 deletions(-) create mode 160000 .claude/worktrees/actions-policy delete mode 100644 GOVERNANCE.adoc diff --git a/.claude/worktrees/actions-policy b/.claude/worktrees/actions-policy new file mode 160000 index 00000000..556f841e --- /dev/null +++ b/.claude/worktrees/actions-policy @@ -0,0 +1 @@ +Subproject commit 556f841e4e638555885ec15f28052223ecf849c1 diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index e41020d3..00000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,162 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -= Governance Model -:toc: preamble - -This document describes the governance model for this repository. - -== Overview - -This repository follows a **Sole Maintainer Governance Model**: - -* Single maintainer (@hyperpolymath) has full authority over the project -* All contributions are welcome and reviewed by the maintainer -* Decisions are made transparently through GitHub issues and discussions -* The project adheres to the hyperpolymath estate policies where applicable - -== Core Principles - -[cols="1,2"] -|=== -| Principle | Description - -| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input - -| **Meritocracy** | Contributions are judged on technical merit, not contributor identity - -| **Transparency** | All significant decisions are documented publicly - -| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary - -| **Open Contribution** | Anyone can contribute via fork and pull request - -|=== - -== Roles and Permissions - -[cols="1,2,2"] -|=== -| Role | Permissions | Assignment - -| **Maintainer** | Write access, merge rights, admin | @hyperpolymath -| **Contributors** | Read access, fork, submit PRs | All GitHub users -| **Users** | Use the software, report issues | All GitHub users - -|=== - -== Decision Making Framework - -=== Routine Decisions - -* Bug fixes -* Documentation improvements -* Minor feature additions -* Dependency updates - -**Process**: Maintainer reviews and merges PRs that meet quality standards. - -=== Significant Changes - -* New major features -* API changes -* Architecture modifications -* Breaking changes - -**Process**: -. Open issue describing the change -. Discuss with community (minimum 72 hours) -. Maintainer makes final decision -. Document rationale in issue/PR - -=== Structural Decisions - -* Repository purpose/renaming -* License changes -* Ownership transfer -* Deprecation/archival - -**Process**: -. Extended discussion (minimum 1 week) -. Maintainer makes final decision -. Document in CHANGELOG and governance docs - -== Contribution Lifecycle - -[cols="1,2"] -|=== -| Stage | Process - -| **Ideation** | Open issue, discuss feasibility - -| **Development** | Fork, implement, test thoroughly - -| **Review** | Submit PR, maintainer reviews within 7 days - -| **Merge** | Maintainer merges or requests changes - -| **Release** | Maintainer publishes according to project conventions - -|=== - -== Conflict Resolution - -In case of disagreements: - -. Discuss in the relevant GitHub issue or PR -. Provide technical justification for positions -. Maintainer mediates and makes final decision -. Decision is documented and can be revisited later - -== Project Policies - -This repository adheres to hyperpolymath estate-wide policies: - -* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc) -* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md -* **Security**: Follows hyperpolymath SECURITY.md -* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions - -== Repository-Specific Conventions - -[cols="1,2"] -|=== -| Convention | Description - -| **Signing** | All commits must be signed (SSH or GPG) - -| **SPDX Headers** | All source files must have SPDX license identifiers - -| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root - -| **Machine Readable** | META.a2ml in .machine_readable/6a2/ - -| **CI/CD** | GitHub Actions workflows in .github/workflows/ - -|=== - -== Governance Evolution - -As the project grows, this governance model may evolve: - -* **Adding Co-Maintainers**: When contribution volume warrants it -* **Forming a Team**: For complex multi-maintainer projects -* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories) - -Changes to this document require the same process as Significant Changes above. - -== See Also - -* link:MAINTAINERS.adoc[Maintainers] -* link:CODE_OF_CONDUCT.md[Code of Conduct] -* link:CONTRIBUTING.adoc[Contributing Guide] -* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy] -* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)] - -== Changelog - -[cols="1,1,1"] -|=== -| Date | Change | By - -| 2026-06-07 | Initial governance model established | @hyperpolymath -|=== From 1e626358dba6cd7948bd7d2984a5cf5c64eca80f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 16:00:18 +0100 Subject: [PATCH 3/6] chore: update guix.scm from squisher-corpus --- guix.scm | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/guix.scm b/guix.scm index e1a566da..c6dd7be8 100644 --- a/guix.scm +++ b/guix.scm @@ -1,5 +1,5 @@ ; SPDX-License-Identifier: MPL-2.0 -;; guix.scm — GNU Guix package definition for gitbot-fleet +;; guix.scm — GNU Guix package definition for squisher-corpus ;; Usage: guix shell -f guix.scm (use-modules (guix packages) @@ -7,12 +7,12 @@ (guix licenses)) (package - (name "gitbot-fleet") + (name "squisher-corpus") (version "0.1.0") (source #f) (build-system gnu-build-system) - (synopsis "gitbot-fleet") - (description "gitbot-fleet — part of the hyperpolymath ecosystem.") - (home-page "https://github.com/hyperpolymath/gitbot-fleet") - (license ((@@ (guix licenses) license) "MPL-2.0" + (synopsis "squisher-corpus") + (description "squisher-corpus — part of the hyperpolymath ecosystem.") + (home-page "https://github.com/hyperpolymath/squisher-corpus") + (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" "https://github.com/hyperpolymath/palimpsest-license"))) From 4d508d5ad03b27167154f301cc9b664faee7f83e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 16:00:24 +0100 Subject: [PATCH 4/6] chore: update guix.scm from squisher-corpus --- bots/echidnabot/guix.scm | 87 +++++++--------------------------------- 1 file changed, 15 insertions(+), 72 deletions(-) diff --git a/bots/echidnabot/guix.scm b/bots/echidnabot/guix.scm index 3ace6106..c6dd7be8 100644 --- a/bots/echidnabot/guix.scm +++ b/bots/echidnabot/guix.scm @@ -1,75 +1,18 @@ -;; echidnabot - Guix Package Definition -;; Development: guix shell -D -f guix.scm -;; Build: guix build -f guix.scm +; SPDX-License-Identifier: MPL-2.0 +;; guix.scm — GNU Guix package definition for squisher-corpus +;; Usage: guix shell -f guix.scm (use-modules (guix packages) - (guix gexp) - (guix git-download) - (guix build-system cargo) - ((guix licenses) #:prefix license:) - (gnu packages base) - (gnu packages crates-io) - (gnu packages rust) - (gnu packages rust-apps) - (gnu packages sqlite) - (gnu packages tls) - (gnu packages pkg-config)) + (guix build-system gnu) + (guix licenses)) -(define-public echidnabot - (package - (name "echidnabot") - (version "0.1.0") - (source (local-file "." "echidnabot-checkout" - #:recursive? #t - #:select? (git-predicate "."))) - (build-system cargo-build-system) - (arguments - `(#:cargo-inputs - (;; Core async runtime - ("rust-tokio" ,rust-tokio-1) - ;; HTTP framework - ("rust-axum" ,rust-axum-0.7) - ("rust-tower" ,rust-tower-0.4) - ("rust-tower-http" ,rust-tower-http-0.5) - ;; Serialization - ("rust-serde" ,rust-serde-1) - ("rust-serde-json" ,rust-serde-json-1) - ("rust-toml" ,rust-toml-0.8) - ;; Database - ("rust-sqlx" ,rust-sqlx-0.8) - ;; HTTP client - ("rust-reqwest" ,rust-reqwest-0.11) - ;; Utilities - ("rust-uuid" ,rust-uuid-1) - ("rust-chrono" ,rust-chrono-0.4) - ("rust-thiserror" ,rust-thiserror-1) - ("rust-anyhow" ,rust-anyhow-1) - ("rust-tracing" ,rust-tracing-0.1) - ("rust-tracing-subscriber" ,rust-tracing-subscriber-0.3) - ;; Crypto - ("rust-hmac" ,rust-hmac-0.12) - ("rust-sha2" ,rust-sha2-0.10) - ("rust-hex" ,rust-hex-0.4) - ;; CLI - ("rust-clap" ,rust-clap-4) - ("rust-config" ,rust-config-0.14)) - #:cargo-development-inputs - (("rust-tokio-test" ,rust-tokio-test-0.4) - ("rust-tempfile" ,rust-tempfile-3)))) - (native-inputs - (list pkg-config - rust - rust-cargo)) - (inputs - (list sqlite - openssl)) - (synopsis "Proof-aware CI bot for theorem prover repositories") - (description - "echidnabot monitors code repositories containing formal proofs and -delegates verification to ECHIDNA Core. It integrates with GitHub, GitLab, -and Bitbucket to provide automated proof checking via webhooks.") - (home-page "https://github.com/hyperpolymath/echidnabot") - (license license:agpl3+))) - -;; For development shell -echidnabot +(package + (name "squisher-corpus") + (version "0.1.0") + (source #f) + (build-system gnu-build-system) + (synopsis "squisher-corpus") + (description "squisher-corpus — part of the hyperpolymath ecosystem.") + (home-page "https://github.com/hyperpolymath/squisher-corpus") + (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" + "https://github.com/hyperpolymath/palimpsest-license"))) From 15fa5fdbe7b59fcfd77067322b9ff6683f3a7dc8 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 29 Jul 2026 08:57:48 +0100 Subject: [PATCH 5/6] chore: exclude data directories from gitbot-shared-context package Add exclude field to Cargo.toml to prevent packaging data files (findings/, learning/, dispatch/) which contain runtime data, not source code. This allows gitbot-shared-context to be packaged and published to crates.io. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- shared-context/Cargo.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/shared-context/Cargo.toml b/shared-context/Cargo.toml index b6036241..23c54f2e 100644 --- a/shared-context/Cargo.toml +++ b/shared-context/Cargo.toml @@ -9,6 +9,7 @@ license = "MPL-2.0" repository = "https://github.com/hyperpolymath/gitbot-fleet" keywords = ["gitbot-fleet", "coordination", "context", "ci-cd"] categories = ["development-tools"] +exclude = ["findings/", "learning/", "dispatch/"] [dependencies] # Serialization From 7e6cfd2accb902087b88ef6efee8f0ffa6fdef71 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 30 Jul 2026 23:59:13 +0100 Subject: [PATCH 6/6] feat(scripts): add python dependabot pruner to fix-dependabot.sh --- scripts/fix-dependabot.sh | 5 +-- scripts/prune-dependabot.py | 66 +++++++++++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+), 2 deletions(-) create mode 100755 scripts/prune-dependabot.py diff --git a/scripts/fix-dependabot.sh b/scripts/fix-dependabot.sh index 4864bbee..a988766e 100755 --- a/scripts/fix-dependabot.sh +++ b/scripts/fix-dependabot.sh @@ -17,10 +17,11 @@ source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true REPO_PATH="${1:?Usage: fix-dependabot.sh }" FINDING_JSON="${2:?Usage: fix-dependabot.sh }" -# --- Idempotency check --- +# --- Idempotency check & prune --- if [[ -f "${REPO_PATH}/.github/dependabot.yml" ]] || \ [[ -f "${REPO_PATH}/.github/dependabot.yaml" ]]; then - echo "[fix-dependabot] dependabot.yml already exists — skipping." + echo "[fix-dependabot] dependabot.yml already exists — pruning invalid ecosystems." + python3 "$SCRIPT_DIR/prune-dependabot.py" "$REPO_PATH" exit 0 fi diff --git a/scripts/prune-dependabot.py b/scripts/prune-dependabot.py new file mode 100755 index 00000000..1efaa575 --- /dev/null +++ b/scripts/prune-dependabot.py @@ -0,0 +1,66 @@ +#!/usr/bin/env python3 +import sys +import os +import yaml + +if len(sys.argv) < 2: + print("Usage: prune-dependabot.py ") + sys.exit(1) + +repo_path = sys.argv[1] +dependabot_yml = os.path.join(repo_path, '.github', 'dependabot.yml') +dependabot_yaml = os.path.join(repo_path, '.github', 'dependabot.yaml') + +file_to_process = None +if os.path.exists(dependabot_yml): + file_to_process = dependabot_yml +elif os.path.exists(dependabot_yaml): + file_to_process = dependabot_yaml + +if not file_to_process: + sys.exit(0) + +try: + with open(file_to_process, 'r') as f: + config = yaml.safe_load(f) +except Exception as e: + print(f"Failed to load yaml: {e}") + sys.exit(0) + +if not config or 'updates' not in config: + sys.exit(0) + +def has_manifest(repo, ecosystem): + if ecosystem == 'cargo': + return os.path.exists(os.path.join(repo, 'Cargo.toml')) + if ecosystem == 'mix': + return os.path.exists(os.path.join(repo, 'mix.exs')) + if ecosystem == 'npm': + return os.path.exists(os.path.join(repo, 'package.json')) + if ecosystem == 'bundler': + return os.path.exists(os.path.join(repo, 'Gemfile')) + if ecosystem == 'pip': + return os.path.exists(os.path.join(repo, 'requirements.txt')) or os.path.exists(os.path.join(repo, 'setup.py')) + if ecosystem == 'gomod': + return os.path.exists(os.path.join(repo, 'go.mod')) + if ecosystem == 'github-actions': + return True + return False + +original_updates = config['updates'] +new_updates = [] +changed = False + +for update in original_updates: + ecosystem = update.get('package-ecosystem') + if has_manifest(repo_path, ecosystem): + new_updates.append(update) + else: + changed = True + print(f"Pruned missing ecosystem: {ecosystem}") + +if changed: + config['updates'] = new_updates + with open(file_to_process, 'w') as f: + yaml.dump(config, f, sort_keys=False) + print("dependabot.yml updated.")