Chore/gossamer widgets

[hyperpolymath]

Summary

Changes

RSR Quality Checklist

Required

• Tests pass (just test / cargo test)
• Code is formatted (just fmt / cargo fmt --check)
• Linter is clean (cargo clippy --all-targets -- -D warnings)
• No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
• No unsafe blocks without // SAFETY: comments (esn/lsm use deny, all others forbid)
• No proof escape hatches (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry, assert_total)
• SPDX license headers present on all new/modified source files
• No secrets, credentials, or .env files included

As Applicable

• .machine_readable/6a2/STATE.a2ml updated (if project state changed)
• .machine_readable/6a2/ECOSYSTEM.a2ml updated (if integrations changed)
• .machine_readable/6a2/META.a2ml updated (if architectural decisions changed)
• proofs/README.adoc obligation table updated (if a proof obligation changed state)
• Documentation updated for user-facing changes
• TOPOLOGY.adoc updated (if architecture changed)
• CHANGELOG or release notes updated
• New dependencies reviewed for license compatibility (MPL-2.0)
• JNI surface changes validated (crates/neurophone-android host-testable + lifecycle typestate preserved)

Testing

Screenshots

---

Summary by Gitar

• CI/CD workflows:
  • Adopt standards reusable workflows for Scorecard, Hypatia, and Governance across .github/workflows/
  • Standardize secret scanning on TruffleHog in .github/workflows/secret-scanner.yml
• Governance & Documentation:
  • Add GOVERNANCE.adoc, CODEOWNERS, and MAINTAINERS documents
• Estate standardization:
  • Migrate contractiles to .machine_readable/contractiles/ and clean up legacy formats

_{This will update automatically on new commits.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 3 resolved / 3 findings

Adopts standardized CI/CD reusable workflows, TruffleHog secret scanning, and governance documentation, but fails due to mutable action ref pinning in the TruffleHog workflow, equal BASE/HEAD push event failure, and placeholder detection issues in the Mustfile check.

✅ 3 resolved

✅ Security: TruffleHog action pinned to mutable @main tag

📄 .github/workflows/secret-scanner.yml:19 📄 .github/workflows/secret-scanner.yml:23
The new trufflehog job pins trufflesecurity/trufflehog@main and actions/checkout@v4 to mutable refs, whereas every other workflow in this repo (e.g. cargo-audit.yml, codeql.yml) pins third-party actions to a full commit SHA. A mutable @main ref means any upstream change (or compromise) is pulled into CI automatically with secrets in scope — a supply-chain risk this repo's own Scorecard/pinning policy is meant to prevent. Pin both actions to a commit SHA, e.g. trufflesecurity/trufflehog@<sha> # vX.Y.Z.

✅ Bug: TruffleHog on push fails when BASE and HEAD are equal

📄 .github/workflows/secret-scanner.yml:16-25
The TruffleHog GitHub Action, when triggered on a push event, derives BASE/HEAD from the event and errors out ("BASE and HEAD commits are the same") for pushes that don't provide a distinct diff range (e.g. initial branch push or single-commit scenarios), causing the job with --fail to fail spuriously. Since this workflow triggers on push: branches: [main], consider scanning the full filesystem on push (matching the secret-scan-trufflehog just recipe: trufflehog filesystem . --only-verified) or explicitly setting base/head for the diff scan.

✅ Bug: Mustfile no-placeholder-values check matches {{ARGS}} in Justfile

📄 .machine_readable/contractiles/Mustfile.a2ml:81-85 📄 .machine_readable/contractiles/Justfile:51
The critical no-placeholder-values gate runs test -z "$(grep -r '{{' .machine_readable/contractiles/ ...)", but the sibling .machine_readable/contractiles/Justfile contains cargo run -- {{ARGS}} (and shields.io recipes use {{ }} interpolation). The {{ grep matches these legitimate just recipe tokens, so if this contractile is ever wired into CI/pre-commit it will fail unconditionally. Restrict the pattern to actual template placeholders (e.g. {{[A-Z_]\+}}) or exclude the Justfile.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}