From dea9558ec274f3b965c48bacf7b640c87de15e46 Mon Sep 17 00:00:00 2001 From: Constantin <74049135+constantin-jais@users.noreply.github.com> Date: Thu, 8 Oct 2026 16:50:11 +0200 Subject: [PATCH] chore(context): conform agent context, Dependabot and status section Bring this repository in line with the fleet gates of libre-ai/project-governance, measured on 2026-10-08: - AGENTS.md on the couche-3 template (Authority, Boundaries, Quality gates, Agents; 33 lines under the 45-line cap), with a fetchable authority pointer to project-governance; CLAUDE.md is the byte-exact `@AGENTS.md` adapter (check-context-conformance). - .github/dependabot.yml, byte-exact copy of the cargo template variant (check-dependabot-conformance). - fast-uri override 4.1.4 -> 4.1.5 (published 2026-09-15, beyond the 3-day release-age floor), lockfile regenerated; clears GHSA-hrr3-gc8f-f4qj and GHSA-jvvf-x445-j334 (check-fleet-advisories). - README: generated project-status section inserted under a new "## Project status" heading by `heal:card-status`; `--check` is a no-op afterwards (check-fleet-presentation). The vendored biscuit-auth patch (I-28) and its provenance gate are untouched. Claude-Session: https://claude.ai/code/session_01Qw4AExV42cXJ67Sj9dqLVf Signed-off-by: Constantin <74049135+constantin-jais@users.noreply.github.com> --- .github/dependabot.yml | 80 ++++++++++++++++++++++++++++++++++++++++++ AGENTS.md | 33 +++++++++++++++++ CLAUDE.md | 1 + README.md | 14 ++++++++ bun.lock | 4 +-- package.json | 2 +- 6 files changed, 131 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 AGENTS.md create mode 100644 CLAUDE.md diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..7396789 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,80 @@ +# Canonical Dependabot configuration of the Libre AI fleet. +# +# Source of truth: libre-ai/project-governance, distribution/templates/dependabot/ — +# two variants, one per manifest set observed at main. github-actions is +# always present (every repository carries .github/workflows); cargo is added +# when Cargo.toml exists: github-actions.yml, cargo.yml. Every non-archived +# repository of ecosystem/repositories.v1.yaml carries the byte-exact copy of +# its variant at .github/dependabot.yml; the weekly "Inventory drift" job +# (ecosystem/check-dependabot-conformance.ts) names each repository that +# does not. Never edit this copy — change the template in governance and let +# the next fleet wave carry it. +# +# No bun entry, on purpose (owner decision 2026-09-08). The bun variants +# published on 2026-09-07 failed on their first run (governance run +# 34139635260, job "bun in /."): +# Dependabot::DependencyFileNotSupported — +# Unsupported bun.lock 'lockfileVersion' 2 in /bun.lock. +# The bun version Dependabot runs supports up to 1. +# Every fleet lockfile is written by bun 1.4 (lockfileVersion 2), so a bun +# entry is a permanent job error that opens no pull request — a guard that +# cannot prove it ran, which the doctrine forbids. Upstream: +# https://github.com/dependabot/dependabot-core/issues/16026 (open on +# 2026-09-08, "Bun 1.4 uses lockfile v2 which dependabot currently does not +# support"). Restore the entry when dependabot-core reads lockfileVersion 2 — +# an owner decision, proved by a trial pull request on one repository before +# any fleet wave. Until then bun dependencies are watched by the weekly +# "Fleet advisories" workflow (`bun audit` on every living lockfile, +# tools/security/check-fleet-advisories.ts) and bumped by agent waves. +# +# Release-age guard, on purpose: bunfig.toml pins minimumReleaseAge to +# 259200 seconds (3 days). A bump to a version younger than that fails +# `bun install --frozen-lockfile` in CI, and that red is the guard working — +# never widen minimumReleaseAgeExcludes to make a Dependabot pull request +# pass. `cooldown` below restates Dependabot's own 3-day default so both +# guards read the same number; Dependabot never replaces the CI floor. +# +# Labels are left to Dependabot's defaults (`dependencies` plus the ecosystem +# label, created on demand): a custom label absent from a repository is +# silently ignored, which across a fleet is a guard that cannot prove it ran. +# +# Dependabot commits are forge-authored: the DCO gate accepts them from +# governance generation 767ee84a (governance #29) onward and rejects them +# before it — bump the fleet pin before restoring Dependabot on a repository. +version: 2 +updates: + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + day: monday + time: "06:00" + timezone: Europe/Paris + open-pull-requests-limit: 5 + commit-message: + prefix: "chore(deps)" + cooldown: + default-days: 3 + groups: + github-actions: + patterns: + - "*" + - package-ecosystem: cargo + directory: "/" + schedule: + interval: weekly + day: monday + time: "06:00" + timezone: Europe/Paris + open-pull-requests-limit: 5 + commit-message: + prefix: "chore(deps)" + cooldown: + default-days: 3 + groups: + cargo-minor-and-patch: + patterns: + - "*" + update-types: + - minor + - patch diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..eafa895 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,33 @@ +# capability-authorization Canonical Agent Rules + +## Authority + +Deny-by-default capability authorization on Biscuit Ed25519 tokens, couche 3 +brick of the constellation. +Doctrine lives upstream: https://raw.githubusercontent.com/libre-ai/project-governance/HEAD/AGENTS.md +Project state lives in `project.v1.yaml`; the generated README status section +is rendered from it — never edit that section by hand. + +## Boundaries + +- The six Datalog policies under `vendored/authz/` are a byte-exact projection + of `libre-ai/schemas-and-contracts`: never edit them in place; a policy change + is a contracts pin bump followed by re-projection. +- `third_party/biscuit-auth-6.0.0/` and `third_party/patches/` hold the vendored + `biscuit-auth` patch (I-28) and its provenance gate + (`scripts/verify-vendored-biscuit-auth.sh`): never modify them outside a + dedicated, reviewed change. +- The revocation store and the key ring are consumed, never held here. +- Serialized tokens never cross the browser boundary. + +## Quality gates + +Run `bun run check` from the local composition (`docs/development.md`) before +pushing; never hide a red test. + +## Agents + +- Security > quality > performance > completeness, in that order on conflict. +- Stage files before running tree-walking gates. +- Never put token bytes, private keys or rejected terms in logs or errors. +- Never commit a machine-local absolute filesystem path. diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 0000000..43c994c --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1 @@ +@AGENTS.md diff --git a/README.md b/README.md index 5dd22ea..7997f73 100644 --- a/README.md +++ b/README.md @@ -18,4 +18,18 @@ Services need permissions that specify which action is allowed on which resource Source code and tests are available in this repository; no package is published to a registry. +## Project status + + + + +- Situation actuelle : Née verte en γ 3.4 ; six politiques datalog vendorées sous gate de dérive contre le pin contracts. +- Maturité : usable +- Exposition : spec-published +- Confiance : medium +- Preuves vérifiées le : 2026-07-30 +- Avancement : 50 % du périmètre actuellement déclaré + + + Explore the [Libre AI project catalogue](https://github.com/libre-ai/.github/blob/main/profile/README.md). diff --git a/bun.lock b/bun.lock index d091fda..852b741 100644 --- a/bun.lock +++ b/bun.lock @@ -15,7 +15,7 @@ }, "overrides": { "@libre-ai/governance": "file:../project-governance", - "fast-uri": "4.1.4", + "fast-uri": "4.1.5", }, "packages": { "@biomejs/biome": ["@biomejs/biome@2.5.3", "", { "optionalDependencies": { "@biomejs/cli-darwin-arm64": "2.5.3", "@biomejs/cli-darwin-x64": "2.5.3", "@biomejs/cli-linux-arm64": "2.5.3", "@biomejs/cli-linux-arm64-musl": "2.5.3", "@biomejs/cli-linux-x64": "2.5.3", "@biomejs/cli-linux-x64-musl": "2.5.3", "@biomejs/cli-win32-arm64": "2.5.3", "@biomejs/cli-win32-x64": "2.5.3" }, "bin": { "biome": "bin/biome" } }, "sha512-MrJswFdei9EfDwwUy2tQrPDpK0AO+RmMFvBoaaJ6ayBc3sUbHdCE+XG5N8vp+5So41ZupZJQm0roHFFhMGVD7A=="], @@ -98,7 +98,7 @@ "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="], - "fast-uri": ["fast-uri@4.1.4", "", {}, "sha512-dODXrIxlS9JSdgAnhIUKOosKV1oMtU2VtVw87QRaHzyl5jxO290Ii5tEZfCfzfWNHi3jKWwBSdQj0qIyshdZdQ=="], + "fast-uri": ["fast-uri@4.1.5", "", {}, "sha512-vZeoMRB4epNr7QfdHxel7te/RcX16CxyXI07JCCTFWZA2s4v1azGNESRj+2EoaHSaWFL/Z3GmKT2jF6A202jLg=="], "json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="], diff --git a/package.json b/package.json index 169b442..6914dff 100644 --- a/package.json +++ b/package.json @@ -8,7 +8,7 @@ "bun": ">=1.4.0" }, "overrides": { - "fast-uri": "4.1.4", + "fast-uri": "4.1.5", "@libre-ai/governance": "file:../project-governance" }, "devDependencies": {