diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 21d7548..d86b910 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -82,7 +82,7 @@ jobs: echo "k9_count=$COUNT" >> "$GITHUB_OUTPUT" echo "config_count=$CONFIG_COUNT" >> "$GITHUB_OUTPUT" if [ "$COUNT" -eq 0 ] && [ "$CONFIG_COUNT" -gt 0 ]; then - echo "::warning::Found $CONFIG_COUNT config files but no K9 contracts. Run k9iser to generate contracts." + echo "::warning::Found $CONFIG_COUNT config files but no K9 contracts. See standards 1-formats/k9/spec/K9-CONTRACT-SPEC.adoc." fi - name: Validate K9 contracts @@ -98,7 +98,7 @@ jobs: :warning: **No .a2ml/.deed manifest files found.** Every RSR-compliant repo should have a repo deed (`_chora.deed`) at its root. - Generate contracts with: `k9iser generate .` + Author them per hyperpolymath/standards `1-formats/k9/spec/K9-CONTRACT-SPEC.adoc` (D173). EOF else echo "## K9 Contract Validation" >> "$GITHUB_STEP_SUMMARY" diff --git a/generated/k9iser/cargo-manifest.k9 b/generated/k9iser/cargo-manifest.k9 deleted file mode 100644 index 0e313e0..0000000 --- a/generated/k9iser/cargo-manifest.k9 +++ /dev/null @@ -1,53 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# K9 contract for cargo-manifest; constraints from k9iser.toml. -# Hunt-tier signing is required before execution; this file contains no signature. - -{ - pedigree = { - schema_version = "1.0.0", - metadata = { - name = "cargo-manifest", - version = "1.0.0", - }, - security = { - leash = 'Hunt, - signature_required = true, - }, - }, - - config = { - source = "Cargo.toml", - format = "toml", - }, - - # Declarative requirements for the source configuration. - must = [ - "package.name == 'panic-attack'", - "package.edition == '2021'", - "package.rust-version is set", - "package.license-file is set", - "package.repository is non-empty", - "profile.release.lto is set", - "profile.release.codegen-units == 1", - "profile.release.strip == 'symbols'", - "profile.release.panic == 'unwind'", - "dependencies.blake3 is set", - "dependencies.sha2 is set", - "no dependency on md5", - "no dependency on sha1", - ], - - trust = { - "signed-by" = "ci-pipeline", - }, - - dust = { - remove = ["unused optional features"], - }, - - intend = { - "production-ready" = true, - "security-critical" = true, - }, -} diff --git a/generated/k9iser/container-build.k9 b/generated/k9iser/container-build.k9 deleted file mode 100644 index 99eb4e6..0000000 --- a/generated/k9iser/container-build.k9 +++ /dev/null @@ -1,58 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# K9 contract for container-build; constraints from k9iser.toml. -# Hunt-tier signing is required before execution; this file contains no signature. - -{ - pedigree = { - schema_version = "1.0.0", - metadata = { - name = "container-build", - version = "1.0.0", - }, - security = { - leash = 'Hunt, - signature_required = true, - }, - }, - - config = { - source = "stapeln.toml", - format = "toml", - }, - - # Declarative requirements for the source configuration. - must = [ - "metadata.license == 'MPL-2.0'", - "metadata.registry == 'ghcr.io/hyperpolymath'", - "build.runtime == 'podman'", - "layers.base.from starts-with 'cgr.dev/chainguard/'", - "layers.base.verify == true", - "layers.runtime.user == 'nonroot'", - "security.non-root == true", - "security.no-new-privileges == true", - "security.cap-drop contains 'ALL'", - "security.signing.algorithm == 'ML-DSA-87'", - "security.signing.provider == 'cerro-torre'", - "security.sbom.format == 'spdx-json'", - "security.sbom.include-deps == true", - "verify.vordr == true", - "verify.svalinn == true", - "verify.scan-on-build == true", - "verify.fail-on contains 'critical'", - "verify.fail-on contains 'high'", - ], - - trust = { - "signed-by" = "ci-pipeline", - }, - - dust = { - remove = ["deprecated layer definitions"], - }, - - intend = { - "production-ready" = true, - "supply-chain-verified" = true, - }, -} diff --git a/k9iser.toml b/k9iser.toml deleted file mode 100644 index 0e323cd..0000000 --- a/k9iser.toml +++ /dev/null @@ -1,70 +0,0 @@ -# k9iser manifest — wrap configs into self-validating K9 contracts -# SPDX-License-Identifier: MPL-2.0 -# -# panic-attack: universal static analysis and bug signature detection tool -# for 49 languages. Safety-tier "hunt" because this is a security tool whose -# own configuration must be above reproach. - -[project] -name = "panic-attack" -safety-tier = "hunt" # security tool — highest scrutiny - -# ── Cargo.toml — Rust package manifest ─────────────────────────────────────── - -[[configs]] -name = "cargo-manifest" -source = "Cargo.toml" -format = "toml" -must = [ - "package.name == 'panic-attack'", - "package.edition == '2021'", - "package.rust-version is set", # minimum MSRV declared - "package.license-file is set", # LICENSE present (MPL-2.0) - "package.repository is non-empty", - "profile.release.lto is set", # LTO enabled for security binary - "profile.release.codegen-units == 1", # single CGU for max optimisation - "profile.release.strip == 'symbols'", - "profile.release.panic == 'unwind'", # stack unwind required for proper error propagation - "dependencies.blake3 is set", # BLAKE3 hashing mandatory - "dependencies.sha2 is set", # SHA-2 hashing mandatory - "no dependency on md5", # MD5 banned for security tool - "no dependency on sha1", # SHA-1 banned for security tool -] -trust = ["signed-by: ci-pipeline"] -dust = ["remove: unused optional features"] -intend = ["production-ready", "security-critical"] - -# ── stapeln.toml — container build config ──────────────────────────────────── - -[[configs]] -name = "container-build" -source = "stapeln.toml" -format = "toml" -must = [ - "metadata.license == 'MPL-2.0'", - "metadata.registry == 'ghcr.io/hyperpolymath'", - "build.runtime == 'podman'", # Podman, never Docker - "layers.base.from starts-with 'cgr.dev/chainguard/'", # Chainguard base only - "layers.base.verify == true", - "layers.runtime.user == 'nonroot'", # never run as root - "security.non-root == true", - "security.no-new-privileges == true", - "security.cap-drop contains 'ALL'", - "security.signing.algorithm == 'ML-DSA-87'", # post-quantum signing - "security.signing.provider == 'cerro-torre'", - "security.sbom.format == 'spdx-json'", # SBOM mandatory - "security.sbom.include-deps == true", - "verify.vordr == true", - "verify.svalinn == true", - "verify.scan-on-build == true", - "verify.fail-on contains 'critical'", - "verify.fail-on contains 'high'", -] -trust = ["signed-by: ci-pipeline"] -dust = ["remove: deprecated layer definitions"] -intend = ["production-ready", "supply-chain-verified"] - -[validation] -strict = true -auto-fix = false -report-format = "text"