From bf8b5d5f1fe8331dfe29bc6ca38f1638506e8ef0 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:50:14 +0100 Subject: [PATCH 1/5] chore: estate-wide security compliance --- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/workflow-linter.yml | 1 + 13 files changed, 13 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index c4f641d..4fe6b9a 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -17,4 +17,5 @@ jobs: curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"} continue-on-error: true permissions: + actions: read contents: read diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index a849da3..ae916dc 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7e233f9..a5bece6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 83cc24e..5d491b7 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -13,6 +13,7 @@ on: branches: [main, master] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 8776de0..966a16e 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9dde27a..556e8e0 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -11,6 +11,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read security-events: write diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 32e9e3e..61aa9f6 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -9,6 +9,7 @@ on: types: [published] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 81e9903..c25d3bc 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index a1a1aa3..31f3ddc 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -5,6 +5,7 @@ on: branches: [main, master] workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 2a95f5d..c08ea16 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b97e2cb..cede40a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index b3486fc..4839d60 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,6 +11,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 67b6a82..9ad08b3 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -11,6 +11,7 @@ on: - '.github/workflows/**' permissions: read-all + actions: read jobs: lint-workflows: From 2282fd3173ce9fd28467bf8b4602fcc16bf782c1 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:10:52 +0100 Subject: [PATCH 2/5] chore: remove duplicate GOVERNANCE files, keep GOVERNANCE.md --- GOVERNANCE.adoc | 295 ------------------------------------------------ 1 file changed, 295 deletions(-) delete mode 100644 GOVERNANCE.adoc diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index 2647537..0000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,295 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) Jonathan D.A. Jewell -= Governance -:toc: -:toc-placement!: -:sectnums: - -toc::[] - -== Overview - -polysafe-gitfixer is governed by principles of transparency, consensus-seeking, -and graduated trust. This document describes how decisions are made and how -contributors can participate in project governance. - -== Core Principles - -=== Consensus-Seeking - -We prefer consensus over voting. Decisions should emerge from discussion -where possible, with voting reserved for deadlocks. - -=== Graduated Trust - -The Tri-Perimeter Contribution Framework (TPCF) provides graduated access -based on demonstrated expertise and commitment. - -=== Reversibility - -Decisions should be reversible when practical. We prefer experiments over -permanent commitments. - -=== Transparency - -All governance discussions happen in public, with decisions documented -in issues or merge requests. - -=== Merit-Based - -Advancement is based on contributions and demonstrated judgment, not -tenure alone. - -== Tri-Perimeter Framework - -See link:CONTRIBUTING.adoc[CONTRIBUTING] for detailed framework description. - -[cols="1,2,3"] -|=== -|Perimeter |Access Level |Scope - -|3 - Community -|Open to all -|Documentation, bug reports, features, examples - -|2 - Expert -|Trusted contributors -|Code review, extensions, mentoring - -|1 - Core -|Maintainers only -|Security, CI/CD, releases, architecture -|=== - -== Decision-Making - -=== Decision Categories - -==== Routine Decisions - -* Typo fixes, documentation improvements -* Clear bug fixes with tests -* Approved by any maintainer - -==== Minor Decisions - -* Feature additions within existing architecture -* Dependency updates (non-breaking) -* Requires review from one core maintainer - -==== Major Decisions - -* New components or languages -* Breaking changes to public APIs -* Significant architectural changes -* Requires discussion period (1 week) and approval from 2+ maintainers - -==== Critical Decisions - -* Security-critical changes -* License modifications -* Governance changes -* Requires supermajority (2/3) of active maintainers - -=== Voting Process - -When consensus cannot be reached: - -1. Discussion period of at least 72 hours -2. Clear proposal documented in an issue -3. Voting period of 1 week -4. Each active maintainer gets one vote -5. Results documented publicly - -== Project Roles - -=== Community Contributor - -* Anyone who participates in discussions or reports bugs -* No special permissions required - -=== Regular Contributor - -* Has submitted multiple accepted contributions -* Demonstrates understanding of project goals -* May be invited to review PRs - -=== Trusted Contributor (Perimeter 2) - -* Requirements: -** 3+ months active participation, OR -** 10+ merged contributions, OR -** Demonstrated domain expertise -* Responsibilities: -** Review and approve merge requests -** Mentor new contributors -** Help with issue triage - -=== Core Maintainer (Perimeter 1) - -* Requirements: -** Sustained high-quality contributions -** Demonstrated good judgment -** Nominated by existing maintainer, approved by consensus -* Responsibilities: -** Merge to protected branches -** Release management -** Security response -** Final say on architectural decisions -* Listed in MAINTAINERS.md - -== Security Governance - -=== Security Team - -Core maintainers form the security response team. - -=== Response Process - -1. Vulnerability reported via SECURITY.md channels -2. Acknowledged within SLA timeframe -3. Assessed and assigned severity -4. Fix developed in private -5. Coordinated disclosure - -=== Emergency Authority - -In critical security situations, any core maintainer may: - -* Revert commits -* Disable features -* Push emergency patches - -Such actions must be documented immediately and reviewed by the team -within 24 hours. - -== Release Management - -=== Versioning - -We follow Semantic Versioning (SemVer): - -* MAJOR: Breaking changes -* MINOR: New features, backward compatible -* PATCH: Bug fixes, backward compatible - -=== Release Process - -1. Feature freeze announced -2. Release candidate prepared -3. Testing period (1 week for major, 3 days for minor) -4. Release notes drafted -5. Tag created and release published -6. Announcement posted - -=== Release Schedule - -* Patch releases: As needed -* Minor releases: Quarterly -* Major releases: When necessary, with migration guides - -== Conflict Resolution - -=== Technical Disagreements - -1. Discussion in relevant issue/MR -2. Seek input from domain experts -3. If unresolved, escalate to core maintainers -4. If still unresolved, vote - -=== Code of Conduct Violations - -See link:CODE_OF_CONDUCT.adoc[CODE OF CONDUCT] for enforcement procedures. - -=== Maintainer Disputes - -1. Private discussion between involved parties -2. Mediation by uninvolved maintainer -3. If unresolved, vote by all other maintainers - -== Succession Planning - -=== Bus Factor Mitigation - -* No single maintainer should have exclusive knowledge -* Critical systems documented in docs/ -* Multiple maintainers for each component - -=== Maintainer Transitions - -When a maintainer steps down: - -1. Knowledge transfer period (if possible) -2. Update MAINTAINERS.md -3. Credential rotation -4. Public acknowledgment - -=== Project Archival - -If the project becomes unmaintained: - -1. Clear announcement with 90-day notice -2. Fork recommendations documented -3. Archive repository (read-only) -4. Preserve issue history - -== Amendment Process - -=== Minor Amendments - -* Clarifications, typo fixes -* Single maintainer approval - -=== Major Amendments - -* Structural changes to governance -* Process: -1. Proposal issue created -2. 2-week discussion period -3. 2/3 supermajority vote required -4. 1-week implementation period - -== Financial Governance - -=== Transparency - -If the project receives funding: - -* All income and expenses documented -* Quarterly reports published -* OpenCollective or similar transparent platform preferred - -=== Spending Authority - -* Under $100: Any maintainer -* $100-$500: Two maintainer approval -* Over $500: Majority maintainer approval - -=== Budget Priorities - -1. Infrastructure and hosting -2. Security audits -3. Contributor compensation -4. Community events -5. Upstream support - -== Platform Governance - -=== Primary Platform - -GitLab (gitlab.com/Hyperpolymath/polysafe-gitfixer) - -=== Mirrors - -GitHub mirror maintained for discoverability. - -=== Credentials - -* Access credentials documented securely -* Rotation on maintainer departure -* 2FA required for all maintainers - -== Contact - -For governance questions, open an issue or contact maintainers listed -in MAINTAINERS.md. From afd9a8fea7e3c00224809e656130e7b8e3e19291 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:44:08 +0100 Subject: [PATCH 3/5] fix: update CodeQL actions to SHA-pinned v3 (29b1f65c) --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a5bece6..883c63c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -40,12 +40,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3 + uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3 + uses: github/codeql-action/analyze@29b1f65c1f735799893313399435a59f54045865 # v3 with: category: "/language:${{ matrix.language }}" From 5beef3e9e55aea6f2053a8e450a0e2e3645797a6 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 16:04:59 +0100 Subject: [PATCH 4/5] chore: update guix.scm from squisher-corpus --- guix.scm | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/guix.scm b/guix.scm index 5ec5f30..c6dd7be 100644 --- a/guix.scm +++ b/guix.scm @@ -1,5 +1,5 @@ ; SPDX-License-Identifier: MPL-2.0 -;; guix.scm — GNU Guix package definition for polysafe-gitfixer +;; guix.scm — GNU Guix package definition for squisher-corpus ;; Usage: guix shell -f guix.scm (use-modules (guix packages) @@ -7,12 +7,12 @@ (guix licenses)) (package - (name "polysafe-gitfixer") + (name "squisher-corpus") (version "0.1.0") (source #f) (build-system gnu-build-system) - (synopsis "polysafe-gitfixer") - (description "polysafe-gitfixer — part of the hyperpolymath ecosystem.") - (home-page "https://github.com/hyperpolymath/polysafe-gitfixer") - (license ((@@ (guix licenses) license) "MPL-2.0" + (synopsis "squisher-corpus") + (description "squisher-corpus — part of the hyperpolymath ecosystem.") + (home-page "https://github.com/hyperpolymath/squisher-corpus") + (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" "https://github.com/hyperpolymath/palimpsest-license"))) From fe5b92861b6bf10f77cf3f9e4b8f9476fbcf71b4 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 27 Jul 2026 19:08:01 +0100 Subject: [PATCH 5/5] fix(ci): repoint codeql-action at a SHA that exists github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository -- the GitHub API returns 422 for it. CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all. Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API. Found while auditing the estate: the same non-existent SHA is pinned in over 100 repositories, so CodeQL is dead across nearly all of them. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 883c63c..fbd7843 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -40,12 +40,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3 + uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@29b1f65c1f735799893313399435a59f54045865 # v3 + uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 with: category: "/language:${{ matrix.language }}"