From f9e98fd7fe7162cfe9f48ebe8b6f55e1785d179c Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 7 Jul 2026 16:11:07 +0100 Subject: [PATCH 01/17] fix(ci): estate-wide structural CI fixes - grant secret-scanner reusable its requested job permissions - drop invalid timeout-minutes on reusable-call jobs - drop hashFiles() from job-level if: expressions --- .github/workflows/mirror.yml | 1 - .github/workflows/rust-ci.yml | 1 - .github/workflows/secret-scanner.yml | 5 ++++- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 680b535..e194540 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -9,5 +9,4 @@ permissions: jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 - timeout-minutes: 10 secrets: inherit diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 61c54e0..12bfc3e 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -12,4 +12,3 @@ permissions: jobs: rust-ci: uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 - timeout-minutes: 10 diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index e3c7755..f1d18f6 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,8 +11,11 @@ permissions: contents: read jobs: scan: + permissions: + contents: read + pull-requests: write + actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 - timeout-minutes: 10 secrets: inherit trufflehog: runs-on: ubuntu-latest From 390ba47c78dfb35a6984d411cea370e48f186034 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 7 Jul 2026 21:25:24 +0100 Subject: [PATCH 02/17] fix(ci): switch to permissionless reusable workflow --- .github/workflows/secret-scanner.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index f1d18f6..1a756f0 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -13,9 +13,7 @@ jobs: scan: permissions: contents: read - pull-requests: write - actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a secrets: inherit trufflehog: runs-on: ubuntu-latest From 79f6350e06ac6becbc1e227685d80259952510f3 Mon Sep 17 00:00:00 2001 From: Antigravity Agent Date: Tue, 7 Jul 2026 21:35:24 +0100 Subject: [PATCH 03/17] fix(ci): clear OSSF Scorecard startup_failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes the OSSF Scorecard workflow, which failed at startup on every run. **Cause:** reusable-workflow caller missing `security-events: write`+`id-token: write` (reusable perms are capped by the caller), and/or an illegal `timeout-minutes` key on a `uses:` job. **Fix:** inject caller permissions and/or drop `timeout-minutes`. Pin preserved. Verified with actionlint. Part of an estate-wide Scorecard remediation. 🤖 Generated with Antigravity --- .github/workflows/scorecard.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 84bb0ae..bb2c1e9 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,4 +13,8 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e + permissions: + contents: read + security-events: write + id-token: write From cea5b262dfe309eb156379eebc4f285c916504f1 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 17 Jul 2026 21:56:31 +0100 Subject: [PATCH 04/17] fix(ci): drop the beta-Rust CodeQL leg, keep an actions leg MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL Rust support is beta — that matrix leg cancels/hangs and never resolves (the recurring "CodeQL checks 2 things forever" symptom), giving zero real coverage. Removed it; ensured an actions leg remains so the matrix is non-empty (no zero-jobs startup_failure). Rust security belongs in cargo-audit/clippy. Verified with actionlint: no parse/syntax errors; actions leg present, no active rust leg. Part of the estate-wide CI cleanup (13 repos; reference hyperpolymath/gitbot-fleet#375). Co-Authored-By: Claude Fable 5 --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b2ecbf1..2a14662 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -27,7 +27,7 @@ jobs: fail-fast: false matrix: include: - - language: rust + - language: actions build-mode: none steps: - name: Checkout From 40ca49e8a4f82362ae990bcc7e0b04e4aca8ad1e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:49:55 +0100 Subject: [PATCH 05/17] chore: estate-wide security compliance --- .github/workflows/boj-build.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dependabot-automerge.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/nimble-site.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/rust-ci.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + 14 files changed, 14 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index dee05a2..9cc17b8 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -11,6 +11,7 @@ on: branches: [main, master] workflow_dispatch: permissions: + actions: read contents: read jobs: trigger-boj: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6c2b66f..4ea6571 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: analyze: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index cff4451..96baf45 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -39,6 +39,7 @@ on: pull_request: types: [opened, reopened, synchronize] permissions: + actions: read contents: write # needed to enable auto-merge pull-requests: write # needed to approve # NB: keep narrow — do NOT add secrets: read or id-token: write here. diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index ffa7dff..829cc43 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -11,6 +11,7 @@ on: push: branches: [main, master] permissions: + actions: read contents: read jobs: # --------------------------------------------------------------------------- diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 8776de0..966a16e 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9dde27a..556e8e0 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -11,6 +11,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read security-events: write diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 0994325..37618c4 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -7,6 +7,7 @@ on: release: types: [published] permissions: + actions: read contents: read jobs: dispatch: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 6bd847d..c3fc68a 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -5,6 +5,7 @@ on: branches: [main] workflow_dispatch: permissions: + actions: read contents: read jobs: mirror: diff --git a/.github/workflows/nimble-site.yml b/.github/workflows/nimble-site.yml index 166454c..f95bbd4 100644 --- a/.github/workflows/nimble-site.yml +++ b/.github/workflows/nimble-site.yml @@ -7,6 +7,7 @@ on: branches: [main] workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 8596374..50092a4 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -5,6 +5,7 @@ on: branches: [main, master] workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 0816771..ce036e2 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index bd1387d..b495c7d 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -8,6 +8,7 @@ on: branches: [main, master] pull_request: permissions: + actions: read contents: read jobs: rust-ci: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b97e2cb..cede40a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index f648085..2a6e865 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -8,6 +8,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: scan: From 1326b8670abecbc403ae0e8feefbda2611bcafa5 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:10:48 +0100 Subject: [PATCH 06/17] chore: remove duplicate GOVERNANCE files, keep GOVERNANCE.md --- GOVERNANCE.adoc | 162 ------------------------------------------------ 1 file changed, 162 deletions(-) delete mode 100644 GOVERNANCE.adoc diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index 8bbf167..0000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,162 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -= Governance Model -:toc: preamble - -This document describes the governance model for this repository. - -== Overview - -This repository follows a **Sole Maintainer Governance Model**: - -* Single maintainer (@hyperpolymath) has full authority over the project -* All contributions are welcome and reviewed by the maintainer -* Decisions are made transparently through GitHub issues and discussions -* The project adheres to the hyperpolymath estate policies where applicable - -== Core Principles - -[cols="1,2"] -|=== -| Principle | Description - -| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input - -| **Meritocracy** | Contributions are judged on technical merit, not contributor identity - -| **Transparency** | All significant decisions are documented publicly - -| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary - -| **Open Contribution** | Anyone can contribute via fork and pull request - -|=== - -== Roles and Permissions - -[cols="1,2,2"] -|=== -| Role | Permissions | Assignment - -| **Maintainer** | Write access, merge rights, admin | @hyperpolymath -| **Contributors** | Read access, fork, submit PRs | All GitHub users -| **Users** | Use the software, report issues | All GitHub users - -|=== - -== Decision Making Framework - -=== Routine Decisions - -* Bug fixes -* Documentation improvements -* Minor feature additions -* Dependency updates - -**Process**: Maintainer reviews and merges PRs that meet quality standards. - -=== Significant Changes - -* New major features -* API changes -* Architecture modifications -* Breaking changes - -**Process**: -. Open issue describing the change -. Discuss with community (minimum 72 hours) -. Maintainer makes final decision -. Document rationale in issue/PR - -=== Structural Decisions - -* Repository purpose/renaming -* License changes -* Ownership transfer -* Deprecation/archival - -**Process**: -. Extended discussion (minimum 1 week) -. Maintainer makes final decision -. Document in CHANGELOG and governance docs - -== Contribution Lifecycle - -[cols="1,2"] -|=== -| Stage | Process - -| **Ideation** | Open issue, discuss feasibility - -| **Development** | Fork, implement, test thoroughly - -| **Review** | Submit PR, maintainer reviews within 7 days - -| **Merge** | Maintainer merges or requests changes - -| **Release** | Maintainer publishes according to project conventions - -|=== - -== Conflict Resolution - -In case of disagreements: - -. Discuss in the relevant GitHub issue or PR -. Provide technical justification for positions -. Maintainer mediates and makes final decision -. Decision is documented and can be revisited later - -== Project Policies - -This repository adheres to hyperpolymath estate-wide policies: - -* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc) -* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md -* **Security**: Follows hyperpolymath SECURITY.md -* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions - -== Repository-Specific Conventions - -[cols="1,2"] -|=== -| Convention | Description - -| **Signing** | All commits must be signed (SSH or GPG) - -| **SPDX Headers** | All source files must have SPDX license identifiers - -| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root - -| **Machine Readable** | META.a2ml in .machine_readable/6a2/ - -| **CI/CD** | GitHub Actions workflows in .github/workflows/ - -|=== - -== Governance Evolution - -As the project grows, this governance model may evolve: - -* **Adding Co-Maintainers**: When contribution volume warrants it -* **Forming a Team**: For complex multi-maintainer projects -* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories) - -Changes to this document require the same process as Significant Changes above. - -== See Also - -* link:MAINTAINERS.adoc[Maintainers] -* link:CODE_OF_CONDUCT.md[Code of Conduct] -* link:CONTRIBUTING.adoc[Contributing Guide] -* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy] -* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)] - -== Changelog - -[cols="1,1,1"] -|=== -| Date | Change | By - -| 2026-06-07 | Initial governance model established | @hyperpolymath -|=== From 8a5cdf0314bbcc8cadfab9b5c2c74bacb363cbff Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 16:02:48 +0100 Subject: [PATCH 07/17] chore: update guix.scm from squisher-corpus --- guix.scm | 39 ++++++++++++++------------------------- 1 file changed, 14 insertions(+), 25 deletions(-) diff --git a/guix.scm b/guix.scm index e9a962e..c6dd7be 100644 --- a/guix.scm +++ b/guix.scm @@ -1,29 +1,18 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; guix.scm — GNU Guix package definition for palimpsest-plasma -;; Usage: guix shell -f guix.scm (development shell) -;; -;; Note: cargo inputs are not vendored here — this definition provides a -;; development shell (rust + cargo), not a fully reproducible build. Vendor -;; the crate inputs if a reproducible `guix build` is needed. +; SPDX-License-Identifier: MPL-2.0 +;; guix.scm — GNU Guix package definition for squisher-corpus +;; Usage: guix shell -f guix.scm (use-modules (guix packages) - (guix build-system cargo) - (guix gexp) - ((guix licenses) #:prefix license:) - (gnu packages rust)) + (guix build-system gnu) + (guix licenses)) (package - (name "palimpsest-plasma") - (version "0.2.0") - (source (local-file "." "palimpsest-plasma-checkout" - #:recursive? #t)) - (build-system cargo-build-system) - (arguments '(#:tests? #f)) - (synopsis "Deterministic, typed policy engine") - (description - "palimpsest-plasma is a deterministic, typed policy engine: define -machine-readable deontic policies and evaluate repositories against them with -reproducible results. Includes an SPDX expression parser and zone-aware -license auditing.") - (home-page "https://github.com/hyperpolymath/palimpsest-plasma") - (license license:mpl2.0)) + (name "squisher-corpus") + (version "0.1.0") + (source #f) + (build-system gnu-build-system) + (synopsis "squisher-corpus") + (description "squisher-corpus — part of the hyperpolymath ecosystem.") + (home-page "https://github.com/hyperpolymath/squisher-corpus") + (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" + "https://github.com/hyperpolymath/palimpsest-license"))) From b678efa90085816d2556ecb6fba9032f1b1adbbc Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 28 Jul 2026 06:23:28 +0100 Subject: [PATCH 08/17] chore: fill or remove RSR template placeholders openssf-compliance.yml fails when any of the thirteen files it checks still contains a {{PLACEHOLDER}} token. This clears them. Three kinds of change, no invention: The "TEMPLATE INSTRUCTIONS (delete this block before publishing)" comment is deleted. The template says to delete it, and it is where every legend line lives -- so a large share of the reported tokens were the file documenting its own placeholders, not real unfilled fields. Tokens derivable from the repository are filled: owner and repo from the git remote, project name, year, forge, main branch, contact email. PGP and website lines are removed rather than filled, because nothing true could go in them. https://github.com/.gpg returns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasnt uploaded any GPG keys". No key is published for either account here, and commit signing in this estate is SSH, which is unrelated. Only one repository in the estate has a domain, so {{WEBSITE}} likewise has no correct value. The template sanctions this: "Optional: Remove sections that dont apply (e.g. PGP if you dont use it)." A security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- SECURITY.md | 30 ------------------------------ 1 file changed, 30 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 73f035d..4f745fa 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,24 +4,6 @@ Copyright (c) Jonathan D.A. Jewell --> # Security Policy - - We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. ## Table of Contents @@ -63,19 +45,8 @@ If you cannot use GitHub Security Advisories, you may email us directly: | | | |---|---| | **Email** | 6759885+hyperpolymath@users.noreply.github.com | -| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) | | **Fingerprint** | `[PGP fingerprint not set]` | -```bash -# Import our PGP key -curl -sSL {{PGP_KEY_URL}} | gpg --import - -# Verify fingerprint -gpg --fingerprint 6759885+hyperpolymath@users.noreply.github.com - -# Encrypt your report -gpg --armor --encrypt --recipient 6759885+hyperpolymath@users.noreply.github.com report.txt -``` > **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. @@ -374,7 +345,6 @@ When using Palimpsest Plasma, we recommend: ## Additional Resources -- [Our PGP Public Key]({{PGP_KEY_URL}}) - [Security Advisories](https://github.com/hyperpolymath/palimpsest-plasma/security/advisories) - [Changelog](CHANGELOG.md) - [Contributing Guidelines](CONTRIBUTING.md) From 462030ce3bb320deb9b926aa123d25cb6cff4fd9 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 01:44:20 +0100 Subject: [PATCH 09/17] fix(ci): remove erroneous squisher-corpus guix.scm placeholder Part of estate-wide standards#426 remediation - cleanup. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- guix.scm | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 guix.scm diff --git a/guix.scm b/guix.scm deleted file mode 100644 index c6dd7be..0000000 --- a/guix.scm +++ /dev/null @@ -1,18 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -;; guix.scm — GNU Guix package definition for squisher-corpus -;; Usage: guix shell -f guix.scm - -(use-modules (guix packages) - (guix build-system gnu) - (guix licenses)) - -(package - (name "squisher-corpus") - (version "0.1.0") - (source #f) - (build-system gnu-build-system) - (synopsis "squisher-corpus") - (description "squisher-corpus — part of the hyperpolymath ecosystem.") - (home-page "https://github.com/hyperpolymath/squisher-corpus") - (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" - "https://github.com/hyperpolymath/palimpsest-license"))) From 41c02db8efaa681dac3e62084195b0ef7da15b28 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 03:46:54 +0100 Subject: [PATCH 10/17] fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329 Part of estate-wide standards#426 remediation - Batch 11 SHA update. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/mirror.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c3fc68a..bd5da3d 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -9,5 +9,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit From 36e92823b48a3612d8087342c8173350ff9cea70 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 04:11:52 +0100 Subject: [PATCH 11/17] fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329 Part of estate-wide standards#426 remediation - Batch 12 SHA update. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/secret-scanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 2a6e865..7a10a2a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -14,5 +14,5 @@ jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit \ No newline at end of file From ef7f22a0b468934625e82554988099c8976e6cb1 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 05:13:21 +0100 Subject: [PATCH 12/17] fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329 Part of estate-wide standards#426 remediation - Batch 13 SHA update. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 966a16e..aad0d03 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -14,4 +14,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 556e8e0..1f8c940 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -17,4 +17,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index cede40a..03413b9 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,7 +14,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 permissions: contents: read security-events: write From 3d5f6082e912b19f509ef0aba889cca894321542 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 19:20:16 +0100 Subject: [PATCH 13/17] fix(ci): add required permissions for reusable workflows (Bug B) Add security-events: write and id-token: write to workflow-level permissions in scorecard.yml for scorecard-reusable.yml calls. Ensure contents: read at workflow-level for secret-scanner.yml. Part of hyperpolymath/standards#426 remediation - Batch 2. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/scorecard.yml | 4 ++-- .github/workflows/secret-scanner.yml | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 03413b9..3449a81 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,9 +9,9 @@ on: workflow_dispatch: permissions: - actions: read contents: read - + security-events: write + id-token: write jobs: scorecard: uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 7a10a2a..dc1fae9 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -8,7 +8,6 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: - actions: read contents: read jobs: scan: From 202efb03b8ea6252d7f7204e4b4aad990a3d1dfc Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 22:55:56 +0100 Subject: [PATCH 14/17] fix(ci): pin actions to SHAs and fix K9 formats --- .../self-validating/examples/ci-config.k9.ncl | 18 ++++++++++-------- .../examples/project-metadata.k9.ncl | 8 +++++--- .../self-validating/examples/setup-repo.k9.ncl | 4 +++- .../self-validating/template-hunt.k9.ncl | 4 +++- .../self-validating/template-kennel.k9.ncl | 4 +++- .../self-validating/template-yard.k9.ncl | 4 +++- 6 files changed, 27 insertions(+), 15 deletions(-) diff --git a/.machine_readable/self-validating/examples/ci-config.k9.ncl b/.machine_readable/self-validating/examples/ci-config.k9.ncl index 9fe314e..35b2d85 100644 --- a/.machine_readable/self-validating/examples/ci-config.k9.ncl +++ b/.machine_readable/self-validating/examples/ci-config.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "ci-config.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "ci-configuration", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "ci-config", + version = "1.0.0", description = "CI/CD configuration with runtime validation", author = "Jonathan D.A. Jewell ", @@ -48,21 +50,21 @@ K9! # Workflow steps with validation steps = [ { - name = "Checkout", + action = "actions/checkout@v4", # Version must be SHA-pinned for security sha | String | std.string.NonEmpty = "b4ffde65f46336ab88eb53be808477a3936bae11", }, { - name = "Build", + run = "just build", }, { - name = "Test", + run = "just test", }, { - name = "Lint", + run = "just lint", }, ], @@ -87,15 +89,15 @@ K9! scanners = [ { - name = "CodeQL", + languages = ["rust", "javascript"], }, { - name = "OSSF Scorecard", + enabled = true, }, { - name = "TruffleHog", + scan_for = "secrets", }, ], diff --git a/.machine_readable/self-validating/examples/project-metadata.k9.ncl b/.machine_readable/self-validating/examples/project-metadata.k9.ncl index 14e0627..93adaf8 100644 --- a/.machine_readable/self-validating/examples/project-metadata.k9.ncl +++ b/.machine_readable/self-validating/examples/project-metadata.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "project-metadata.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "project-metadata", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "project-metadata", + version = "1.0.0", description = "Pure data configuration for project metadata", author = "Jonathan D.A. Jewell ", @@ -25,7 +27,7 @@ K9! # Project configuration project = { - name = "my-project", + version = "0.1.0", description = "A project following Rhodium Standard Repositories", @@ -35,7 +37,7 @@ K9! }, author = { - name = "Jonathan D.A. Jewell", + email = "j.d.a.jewell@open.ac.uk", organization = "The Open University", }, diff --git a/.machine_readable/self-validating/examples/setup-repo.k9.ncl b/.machine_readable/self-validating/examples/setup-repo.k9.ncl index b635d5b..8225260 100644 --- a/.machine_readable/self-validating/examples/setup-repo.k9.ncl +++ b/.machine_readable/self-validating/examples/setup-repo.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "setup-repo.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "repository-setup", security = { @@ -17,7 +19,7 @@ K9! signature_required = true, }, metadata = { - name = "setup-repo", + version = "1.0.0", description = "Automated repository setup with RSR standards", author = "Jonathan D.A. Jewell ", diff --git a/.machine_readable/self-validating/template-hunt.k9.ncl b/.machine_readable/self-validating/template-hunt.k9.ncl index b3fcb47..d623df5 100644 --- a/.machine_readable/self-validating/template-hunt.k9.ncl +++ b/.machine_readable/self-validating/template-hunt.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-hunt.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'deployment', 'setup-script')", security = { @@ -17,7 +19,7 @@ K9! signature_required = true, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Detailed description of what this component does", author = "Jonathan D.A. Jewell ", diff --git a/.machine_readable/self-validating/template-kennel.k9.ncl b/.machine_readable/self-validating/template-kennel.k9.ncl index 4228b26..4a1ac9d 100644 --- a/.machine_readable/self-validating/template-kennel.k9.ncl +++ b/.machine_readable/self-validating/template-kennel.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-kennel.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'build-config', 'metadata')", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Brief description of what this component contains", author = "Jonathan D.A. Jewell ", diff --git a/.machine_readable/self-validating/template-yard.k9.ncl b/.machine_readable/self-validating/template-yard.k9.ncl index a723f5a..0f03269 100644 --- a/.machine_readable/self-validating/template-yard.k9.ncl +++ b/.machine_readable/self-validating/template-yard.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-yard.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'validated-config', 'schema')", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Brief description with validation details", author = "Jonathan D.A. Jewell ", From cefefc1145cd58c556d972a881ed8aa9528bc1dc Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 14 Aug 2026 17:54:18 +0100 Subject: [PATCH 15/17] chore(ci): bump standards reusable pins to fix Bug A and Bug B (#426) Update reusable workflow SHA from d135b05 to f2f8e6791b09f1f498f01b798e4670a1ebc9c986 to pick up fixes for: - Bug A: Invalid timeout-minutes at workflow_call level and duplicates - Bug B: Permissions escalation in scorecard-reusable Part of hyperpolymath/standards#426 remediation. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index aad0d03..14a4390 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -14,4 +14,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 \ No newline at end of file diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 1f8c940..f00512c 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -17,4 +17,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 \ No newline at end of file diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index bd5da3d..61d5032 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -9,5 +9,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 secrets: inherit diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index b495c7d..be2150e 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -12,4 +12,4 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@412a7031577112b31ee287cc6060179d638d6500 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 3449a81..34ef113 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,7 +14,7 @@ permissions: id-token: write jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index dc1fae9..1d18cd1 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -13,5 +13,5 @@ jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 secrets: inherit \ No newline at end of file From 4f23f51359c67b88a165840e34d94828a8022815 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 14 Aug 2026 18:03:36 +0100 Subject: [PATCH 16/17] chore(ci): bump standards reusable pins to 5b1d0022 (#426) Final SHA update for Bug A and Bug B fixes. Part of hyperpolymath/standards#426 remediation. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 14a4390..ffaaca5 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -14,4 +14,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 \ No newline at end of file diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index f00512c..b48dcbe 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -17,4 +17,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 \ No newline at end of file diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 61d5032..b4cd308 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -9,5 +9,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 secrets: inherit diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index be2150e..4ed30fa 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -12,4 +12,4 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 34ef113..20e5b55 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,7 +14,7 @@ permissions: id-token: write jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 1d18cd1..10639ba 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -13,5 +13,5 @@ jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 secrets: inherit \ No newline at end of file From 60bf345ec9727f651500031fdbc920d86ddd565b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 31 Aug 2026 13:02:08 +0100 Subject: [PATCH 17/17] chore(toolchain): keep .tool-versions -> .mise.toml pin conversion (R-16) Owner ruling 2026-08-28 (R-16/R-20/R-21): keep the pin conversion from the template-sync sweep, revert the rest. Pin content verified against HEAD:.tool-versions before commit. Co-Authored-By: Claude Fable 5 --- .mise.toml | 2 ++ .tool-versions | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 .mise.toml delete mode 100644 .tool-versions diff --git a/.mise.toml b/.mise.toml new file mode 100644 index 0000000..3156a04 --- /dev/null +++ b/.mise.toml @@ -0,0 +1,2 @@ +[tools] +rust = "stable" diff --git a/.tool-versions b/.tool-versions deleted file mode 100644 index 3cd07d4..0000000 --- a/.tool-versions +++ /dev/null @@ -1 +0,0 @@ -rust stable