From f985b5e9330bd05b97aa546c6e41c96488520b01 Mon Sep 17 00:00:00 2001 From: Constantin Jais <74049135+constantin-jais@users.noreply.github.com> Date: Wed, 7 Oct 2026 20:43:07 +0200 Subject: [PATCH 1/2] chore(card): name this repository and the authorities that exist The 2026-10-07 consolidation (ADR-0041 of libre-ai/project-governance) admitted this repository under its long name and retired the short-name donors. Its card had not followed: `repository:` still declared the donor, a repository deleted the same day, so the card identified this project as something that no longer exists. Its dependency pins named deleted repositories at commits now unreachable -- verified: each of those shas answers 422 on both surviving authorities, so no pin could be preserved as written. Each entry names the successor at a revision that exists: project-governance at generation 2024a4884b, which that authority's fleet-pins register declares, and schemas-and-contracts at d2767988. Measured before changing anything, because a false card and a broken build are not the same finding: 105 manifests across the 29 repositories of the organisation were read, and NO destination declares a build dependency on a deleted repository. The entries corrected here were declarations, not dependencies -- the one Cargo surface involved is the `[package] repository` metadata URL, which pointed at a deleted repository and now points at this one. Where several entries now name the same successor, they are kept separate: each states a distinct dependency reason, and one repository holding three capabilities is what a consolidation means. Validated against ecosystem/schemas/project.v1.schema.json. Claude-Session: https://claude.ai/code/session_01BRoYJKEsRC2BUSDPQBoNnA Signed-off-by: Constantin Jais <74049135+constantin-jais@users.noreply.github.com> --- Cargo.toml | 2 +- project.v1.yaml | 18 +++++++++++++----- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index a2b0715..1f0f666 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -4,7 +4,7 @@ version = "0.1.0" edition = "2024" rust-version = "1.97" license = "EUPL-1.2" -repository = "https://github.com/libre-ai/authz-biscuit" +repository = "https://github.com/libre-ai/capability-authorization" publish = false [dependencies] diff --git a/project.v1.yaml b/project.v1.yaml index ed84bdf..1af2054 100644 --- a/project.v1.yaml +++ b/project.v1.yaml @@ -2,7 +2,7 @@ # La section statut du README est générée depuis cette fiche (sentinelles). schema_version: libre-ai.project.v1 project: authz-biscuit -repository: libre-ai/authz-biscuit +repository: libre-ai/capability-authorization kind: satellite layer: couche-3 statement: @@ -35,12 +35,20 @@ non_goals: - "Authentifier l'utilisateur : elle autorise un principal déjà vérifié cryptographiquement, elle n'établit aucune identité et n'ouvre aucune session." - "Servir de bibliothèque Biscuit générale : elle expose un usage spécialisé et fermé, pas la surface de biscuit-auth — l'atténuation admise est bornée par TokenBounds et par le bloc initial canonique." dependencies: - - on: libre-ai/contracts + - on: libre-ai/schemas-and-contracts + # 2026-10-07 : le dépôt nommé ici a été retiré (ADR-0041). Le pin précédent + # désignait un commit désormais inatteignable ; il nomme son successeur, à une + # révision qui existe. Aucun manifeste de ce dépôt ne dépendait du retiré : + # mesuré sur 105 manifestes des 29 dépôts de l'organisation. why: "autorité des six politiques datalog projetées dans vendored/authz/ et vérifiées octet-exactes par check:schemas (I-05)" - pinned: "github:libre-ai/contracts#ee144f03cf7d3deeda02a9fcd5e10377c2e99cb4" - - on: libre-ai/governance + pinned: "github:libre-ai/schemas-and-contracts#d2767988c7b1a00b304b76c5d5ac92b93898bf30" + - on: libre-ai/project-governance + # 2026-10-07 : le dépôt nommé ici a été retiré (ADR-0041). Le pin précédent + # désignait un commit désormais inatteignable ; il nomme son successeur, à une + # révision qui existe. Aucun manifeste de ce dépôt ne dépendait du retiré : + # mesuré sur 105 manifestes des 29 dépôts de l'organisation. why: "gabarit de gates consommé en workflows réutilisables et git-dep d'outillage — jamais dupliqué" - pinned: "github:libre-ai/governance#8c238c09efd443a4866459160dac1cfee31d88be" + pinned: "github:libre-ai/project-governance#2024a4884b314df99be457618be9c3b48a0287f7" - on: biscuit-auth why: "primitives Biscuit Ed25519 — release exacte 6.0.0, default-features désactivées, résolue vers une copie vendorée (archive publiée + correctif amont #306, third_party/biscuit-auth-6.0.0/PATCH.md) retirée dès qu'une version publiée porte le correctif" pinned: "=6.0.0 via [patch.crates-io] (avec biscuit-parser =0.2.0, grammaire datalog 3.3 correspondante — preuve d'injectivité evidence/reviews/bfc2c0d/)" From cb7e28968c1d6e721f10b752b73b67fb0e185a0f Mon Sep 17 00:00:00 2001 From: Constantin Jais <74049135+constantin-jais@users.noreply.github.com> Date: Thu, 8 Oct 2026 02:14:10 +0200 Subject: [PATCH 2/2] chore(pins): pin the fleet authority at a declared generation This repository pinned libre-ai/project-governance at a commit that exists but that the authority's own ecosystem/fleet-pins.v1.yaml does not declare as a generation. The repaired fleet-pins gate named it; before the repair the gate read a hardcoded `main` on every surface and reported "2 assertion(s) hold" over a fleet carrying twenty-four drifts, this one among them. The pin moves to 2024a4884b, a declared generation and the first a consumer can actually install -- proved by the act: `bun install` in libre-ai/signalement against it resolves 32 packages, where the two generations before it failed on a workspace-local specifier. Measured before changing anything: the `workflow_call` signature of validate-composition.yml is BYTE-IDENTICAL between the sha pinned here and 2024a4884b, so the inputs this repository supplies are unchanged. The three other reusable workflows did not exist at the old sha at all -- it predates the doctrine transfer. Claude-Session: https://claude.ai/code/session_01BRoYJKEsRC2BUSDPQBoNnA Signed-off-by: Constantin Jais <74049135+constantin-jais@users.noreply.github.com> --- .github/workflows/code-validation.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/code-validation.yml b/.github/workflows/code-validation.yml index a3ffa2b..3db5c29 100644 --- a/.github/workflows/code-validation.yml +++ b/.github/workflows/code-validation.yml @@ -10,8 +10,8 @@ permissions: contents: read jobs: composition: - uses: libre-ai/project-governance/.github/workflows/validate-composition.yml@ed87f3fa5b9285adc08e7a07a94853872cb1bb16 + uses: libre-ai/project-governance/.github/workflows/validate-composition.yml@2024a4884b314df99be457618be9c3b48a0287f7 with: target: capability-authorization target_ref: ${{ github.sha }} - tooling_ref: ed87f3fa5b9285adc08e7a07a94853872cb1bb16 + tooling_ref: 2024a4884b314df99be457618be9c3b48a0287f7