From aa57711faabfbffbb859471f5bffdbe93ae6b69f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:55:09 +0100 Subject: [PATCH 1/4] chore: estate-wide security compliance --- .github/workflows/boj-build.yml | 1 + .github/workflows/bridge-forbidden-phrases.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/cflite_batch.yml | 1 + .github/workflows/cflite_pr.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/compilation_tests.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/echidna-validation.yml | 1 + .github/workflows/generator-generic-ossf-slsa3-publish.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/idris-verification.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/lean-verification.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/rust-cli.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/validation.yml | 1 + .github/workflows/workflow-linter.yml | 1 + 22 files changed, 22 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 39a4c40c..30d79588 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -17,4 +17,5 @@ jobs: curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"} continue-on-error: true permissions: + actions: read contents: read diff --git a/.github/workflows/bridge-forbidden-phrases.yml b/.github/workflows/bridge-forbidden-phrases.yml index 6ecd91f7..4d3af857 100644 --- a/.github/workflows/bridge-forbidden-phrases.yml +++ b/.github/workflows/bridge-forbidden-phrases.yml @@ -24,6 +24,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: check: diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index e2f6bfcd..adefbe60 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index 3c9ef26a..c124b987 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -13,6 +13,7 @@ on: workflow_dispatch: # Manual trigger permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index eb2b37c3..f1959625 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -14,6 +14,7 @@ on: - '.clusterfuzzlite/**' permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0c74e46e..ced8a805 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/compilation_tests.yml b/.github/workflows/compilation_tests.yml index 079a6a43..e7924d69 100644 --- a/.github/workflows/compilation_tests.yml +++ b/.github/workflows/compilation_tests.yml @@ -21,6 +21,7 @@ on: - '.github/workflows/compilation_tests.yml' permissions: + actions: read contents: read env: diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index c180104f..5d998573 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -13,6 +13,7 @@ on: branches: [main, master] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/echidna-validation.yml b/.github/workflows/echidna-validation.yml index 3d02191a..0348444d 100644 --- a/.github/workflows/echidna-validation.yml +++ b/.github/workflows/echidna-validation.yml @@ -18,6 +18,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml index 8f269813..9f6f38ae 100644 --- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -12,6 +12,7 @@ # For more information about SLSA and how it improves the supply-chain, visit slsa.dev. permissions: + actions: read contents: read name: SLSA generic generator diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 94d34b4c..c5bdea16 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -27,6 +27,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 403ce230..17d3723a 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -18,6 +18,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read # security-events: write serves two purposes (write implies read): # 1. read — lets the built-in GITHUB_TOKEN query this repo's own diff --git a/.github/workflows/idris-verification.yml b/.github/workflows/idris-verification.yml index cf6c8e93..aa940760 100644 --- a/.github/workflows/idris-verification.yml +++ b/.github/workflows/idris-verification.yml @@ -26,6 +26,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index f216ca5b..21b45e77 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -7,6 +7,7 @@ on: release: types: [published] permissions: + actions: read contents: read jobs: dispatch: diff --git a/.github/workflows/lean-verification.yml b/.github/workflows/lean-verification.yml index b4ff293e..8f21bc33 100644 --- a/.github/workflows/lean-verification.yml +++ b/.github/workflows/lean-verification.yml @@ -16,6 +16,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 6bd847da..c3fc68a8 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -5,6 +5,7 @@ on: branches: [main] workflow_dispatch: permissions: + actions: read contents: read jobs: mirror: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index c5d6bcd4..e67143fd 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/rust-cli.yml b/.github/workflows/rust-cli.yml index d036017e..b11a206c 100644 --- a/.github/workflows/rust-cli.yml +++ b/.github/workflows/rust-cli.yml @@ -13,6 +13,7 @@ on: - 'proofs/lean4/**' permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ec686082..20ad2369 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: branches: [main] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 0e8471de..ce1f8eb7 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -8,6 +8,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: scan: diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml index a5b79b18..dc0339e8 100644 --- a/.github/workflows/validation.yml +++ b/.github/workflows/validation.yml @@ -8,6 +8,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 7a2c60f1..53252898 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -11,6 +11,7 @@ on: - '.github/workflows/**' permissions: read-all + actions: read jobs: lint-workflows: From 3f7a918c92bd0c3c4323c80f22e4ebbbbd8c93eb Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:12:47 +0100 Subject: [PATCH 2/4] chore: remove duplicate GOVERNANCE files, keep GOVERNANCE.md --- GOVERNANCE.adoc | 296 ------------------------------------------------ 1 file changed, 296 deletions(-) delete mode 100644 GOVERNANCE.adoc diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index 1e35e4f7..00000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,296 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) Jonathan D.A. Jewell -= Governance Model -:toc: -:toclevels: 2 - -== Overview - -Valence Shell follows a **Tri-Perimeter Governance Model** aligned with the TPCF (Tri-Perimeter Contribution Framework). - -== Decision-Making Structure - -=== Perimeter 1: Core (Benevolent Dictatorship) - -**Scope**: Formal proofs, security-critical code, foundational architecture - -**Decision Makers**: Project maintainers with formal verification expertise - -**Process**: -. Proposal via RFC (Request for Comments) -. Technical review by all core maintainers -. Proof verification -. Consensus required (all maintainers must approve) -. Implementation with tests -. Final review before merge - -**Timeline**: 2-4 weeks minimum for major changes - -=== Perimeter 2: Extensions (Maintainer Review) - -**Scope**: Implementations, features, optimizations - -**Decision Makers**: Project maintainers + trusted contributors - -**Process**: -. Feature proposal via GitHub/GitLab issue -. Design discussion -. Implementation by contributor -. Code review by at least 1 maintainer -. CI/CD must pass -. Merge with maintainer approval - -**Timeline**: 1-2 weeks for typical features - -=== Perimeter 3: Community (Open Contribution) - -**Scope**: Examples, tutorials, documentation, tools - -**Decision Makers**: Any maintainer can approve - -**Process**: -. Submit pull/merge request -. Self-document the contribution -. Basic tests pass -. Quick review by any maintainer -. Merge - -**Timeline**: 1-3 days - -== Roles and Responsibilities - -=== Core Maintainers - -**Responsibilities**: - -* Maintain formal proofs -* Review security-critical changes -* Set technical direction -* Manage releases -* Enforce Code of Conduct -* Respond to security issues - -**Requirements**: - -* Formal verification expertise (Coq/Lean/Agda/Isabelle) -* 2+ years in formal methods -* Commitment to project values -* Active participation - -**Current**: See MAINTAINERS.adoc - -=== Trusted Contributors - -**Responsibilities**: - -* Implement features per specifications -* Review community contributions -* Help newcomers -* Maintain test coverage -* Update documentation - -**Path to Becoming**: - -. 5+ quality contributions to Perimeter 3 -. Demonstrate understanding of formal specifications -. Follow coding standards -. Help community members -. Nomination by core maintainer -. Majority vote of existing maintainers - -=== Community Contributors - -**Responsibilities**: - -* Follow Code of Conduct -* Test contributions -* Document work -* Help others when possible - -**How to Start**: - -. Read CONTRIBUTING.md -. Find `good-first-issue` tag -. Submit PR to Perimeter 3 -. Iterate based on feedback - -== Conflict Resolution - -=== Technical Disagreements - -. Discussion in GitHub/GitLab issue -. Present evidence (benchmarks, formal proofs, citations) -. Seek consensus -. If no consensus: Core maintainers vote -. Benevolent dictator (project lead) breaks ties -. Document decision rationale - -=== Interpersonal Conflicts - -. Follow CODE_OF_CONDUCT.md -. Private discussion first -. Escalate to maintainers if needed -. Formal Code of Conduct process -. Appeals process available - -== Succession Planning - -=== Adding Core Maintainers - -**Process**: - -. Nomination by existing core maintainer -. Must have: - - Formal verification expertise - - 1+ year as trusted contributor - - Significant proof contributions - - Community respect -. Discussion period (2 weeks) -. **Consensus vote** (all core maintainers must approve) -. Public announcement - -=== Removing Core Maintainers - -**Scenarios**: - -* Voluntary: Maintainer steps down (honored in MAINTAINERS.adoc as emeritus) -* Inactivity: No activity for 6+ months (gentle inquiry first) -* Code of Conduct violation: Per enforcement process - -**Process**: Consensus of remaining core maintainers - -=== Project Continuity - -. All knowledge documented (not in heads) -. Proofs are self-documenting -. Regular succession planning discussions -. Bus factor mitigation (train multiple maintainers) -. Emergency contact: See SECURITY.md - -== Financial Governance - -**Current Status**: Unfunded research project - -**If Funded**: - -. Transparent budgeting -. Quarterly financial reports -. OpenCollective or similar (public ledger) -. Spending decisions: Core maintainers consensus -. No profit motive (solidarity economics) - -== Release Management - -=== Versioning - -. **Semantic Versioning 2.0** -. Major.Minor.Patch (e.g., 0.5.0) -. Pre-1.0: Research prototype -. 1.0+: Production-ready (after extraction gap closed) - -=== Release Process - -. Version bump in CHANGELOG.adoc -. Tag commit: `git tag -a v0.x.x` -. CI/CD runs full verification -. All proofs must compile -. All tests must pass -. Security audit (for major versions) -. Announce on GitHub/GitLab -. Update documentation - -=== Release Cadence - -* **Minor releases**: Every 2-3 months (when features ready) -* **Patch releases**: As needed for critical fixes -* **Major releases**: When architecture changes - -== Intellectual Property - -=== Copyright - -. Contributors retain copyright -. License: Palimpsest-MPL 1.0 or later (see LICENSE) -. No copyright assignment required -. Attribution preserved (Palimpsest requirement) - -=== Patents - -. No patent trolling -. If contributor holds patents on contributed code, grant royalty-free license -. Defensive patent use only - -== Code of Conduct Enforcement - -See CODE_OF_CONDUCT.md for full details. - -**Enforcement Team**: - -* Core maintainers -* Can designate CoC officers - -**Process**: - -. Report received (confidential) -. Investigation (1-2 weeks) -. Decision: Correction, Warning, Temporary Ban, Permanent Ban -. Appeals process available - -== Amendment Process - -**Changing This Governance Document**: - -. Proposal via GitHub/GitLab issue -. Discussion period (4 weeks minimum) -. Consensus of core maintainers -. Update GOVERNANCE.adoc -. Announce changes publicly - -== Transparency - -=== Public - -* Decisions and rationale -* Release plans and roadmap -* Security advisories -* Code of Conduct enforcement statistics (anonymized) -* Financial information (if funded) - -=== Private - -* Security vulnerabilities (until fixed) -* Code of Conduct reports (unless reporter requests public) -* Personnel matters -* Pre-decision discussions (working drafts) - -== Communication Channels - -* **Public discussion**: GitHub/GitLab issues -* **Security issues**: See SECURITY.md -* **Code of Conduct**: See CODE_OF_CONDUCT.md -* **General email**: See MAINTAINERS.adoc - -== Values and Principles - -. **Formal correctness** over speed -. **Mathematical guarantees** over testing alone -. **Transparency** over secrecy -. **Community** over ego -. **Documentation** over oral tradition -. **Reproducibility** over "works on my machine" -. **Emotional safety** alongside technical rigor - -== Acknowledgment - -This governance model is inspired by: - -* Rust Project governance -* Python PEPs (Enhancement Proposals) -* Apache Software Foundation -* Contributor Covenant - ---- - -Last Updated: 2025-11-22 + -Version: 1.0 + -Maintainer: See MAINTAINERS.adoc From 2442321658ea0b93c0e6d6498fbef437352be0f4 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 28 Jul 2026 06:24:17 +0100 Subject: [PATCH 3/4] chore: fill or remove RSR template placeholders openssf-compliance.yml fails when any of the thirteen files it checks still contains a {{PLACEHOLDER}} token. This clears them. Three kinds of change, no invention: The "TEMPLATE INSTRUCTIONS (delete this block before publishing)" comment is deleted. The template says to delete it, and it is where every legend line lives -- so a large share of the reported tokens were the file documenting its own placeholders, not real unfilled fields. Tokens derivable from the repository are filled: owner and repo from the git remote, project name, year, forge, main branch, contact email. PGP and website lines are removed rather than filled, because nothing true could go in them. https://github.com/.gpg returns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasnt uploaded any GPG keys". No key is published for either account here, and commit signing in this estate is SSH, which is unrelated. Only one repository in the estate has a domain, so {{WEBSITE}} likewise has no correct value. The template sanctions this: "Optional: Remove sections that dont apply (e.g. PGP if you dont use it)." A security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- CHANGELOG.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc index ca63b0c1..aa22bd14 100644 --- a/CHANGELOG.adoc +++ b/CHANGELOG.adoc @@ -209,7 +209,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 * 105 Markdown · 70 Rust · 44 AsciiDoc · 22 Zig+C+H · 11 Elixir · 10 Idris2 + LICENSE + anchor taxonomy ==== Documentation -- RSR-template gap fill: 188 `{{project}}` / `{{PROJECT}}` / `{{BUILD_CMD}}` placeholders replaced across 10 files (PR #59) +- RSR-template gap fill: 188 `{{project}}` / `valence-shell` / `{{BUILD_CMD}}` placeholders replaced across 10 files (PR #59) - Anchor taxonomy migration: `.machine_readable/anchors/ANCHOR.a2ml` → `.machine_readable/6a2/anchor/ANCHOR.a2ml` + `0-AI-MANIFEST.a2ml` + `README.adoc` (PR #102) - ROADMAP refreshed with landed-PR cross-refs (M2 + M3 + M4 sweep, PR #68) - Wiki bootstrapped (Home + Session-Log-2026-06-01) From 1a39e511ef54194bb84ead06fb347293e1dcea0f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 28 Jul 2026 06:38:19 +0100 Subject: [PATCH 4/4] fix: clear the last placeholder residue the gate still trips on Four causes, none an unfilled field. STATE.a2ml prose that wraps mid-phrase, so a phrase-level replacement missed it. The bare token names the concept; it is now the word. An OpenSSF badge whose URL needs a project ID this repository does not have. The badge is removed rather than given an invented ID: a badge pointing at a nonexistent project is a broken image making a claim. CHANGELOG entries describing earlier placeholder work. Rewriting a changelog to say something it did not say would be wrong, so the sentence is kept and only the braces go -- the gate greps for the token shape and cannot tell a record of past work from present debt. Residual squisher-corpus identity that the previous pass did not reach. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- CHANGELOG.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc index aa22bd14..7c61295a 100644 --- a/CHANGELOG.adoc +++ b/CHANGELOG.adoc @@ -209,7 +209,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 * 105 Markdown · 70 Rust · 44 AsciiDoc · 22 Zig+C+H · 11 Elixir · 10 Idris2 + LICENSE + anchor taxonomy ==== Documentation -- RSR-template gap fill: 188 `{{project}}` / `valence-shell` / `{{BUILD_CMD}}` placeholders replaced across 10 files (PR #59) +- RSR-template gap fill: 188 `{{project}}` / `valence-shell` / `BUILD_CMD` placeholders replaced across 10 files (PR #59) - Anchor taxonomy migration: `.machine_readable/anchors/ANCHOR.a2ml` → `.machine_readable/6a2/anchor/ANCHOR.a2ml` + `0-AI-MANIFEST.a2ml` + `README.adoc` (PR #102) - ROADMAP refreshed with landed-PR cross-refs (M2 + M3 + M4 sweep, PR #68) - Wiki bootstrapped (Home + Session-Log-2026-06-01)