From 2da14ab96cdbfa6b77022a23eb26ecd001820bc4 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 18:30:35 +0000 Subject: [PATCH 1/2] chore(k9): retire the k9iser output and manifest generated/k9iser/cargo-manifest.k9 and container-build.k9 are k9iser output in a [must]/[trust] section format that predates K9 contract v1.0.0 (D173): no K9! envelope, no pedigree, not a Nickel component. The Validate K9 contracts gate rejects both, nothing in this repository reads them, echidna already gitignores the same directory, and no k9iser repository exists in the estate any more. The two gate messages that told people to run k9iser now point at the K9 contract spec. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- generated/k9iser/cargo-manifest.k9 | 19 -------- generated/k9iser/container-build.k9 | 28 ------------ k9iser.toml | 70 ----------------------------- 3 files changed, 117 deletions(-) delete mode 100644 generated/k9iser/cargo-manifest.k9 delete mode 100644 generated/k9iser/container-build.k9 delete mode 100644 k9iser.toml diff --git a/generated/k9iser/cargo-manifest.k9 b/generated/k9iser/cargo-manifest.k9 deleted file mode 100644 index ad723ab..0000000 --- a/generated/k9iser/cargo-manifest.k9 +++ /dev/null @@ -1,19 +0,0 @@ -# Auto-generated K9 contract for cargo-manifest -# Safety tier: hunt - -[must] -package.name : string { == 'panic-attack' } -package.edition : string { == '2021' } -profile.release.codegen-units : string { == 1 } -profile.release.strip : string { == 'symbols' } -profile.release.panic : string { == 'unwind' } - -[trust] -signed-by = "ci-pipeline" - -[dust] -remove = ["unused optional features"] - -[intend] -production-ready = true -security-critical = true diff --git a/generated/k9iser/container-build.k9 b/generated/k9iser/container-build.k9 deleted file mode 100644 index 0f79c65..0000000 --- a/generated/k9iser/container-build.k9 +++ /dev/null @@ -1,28 +0,0 @@ -# Auto-generated K9 contract for container-build -# Safety tier: hunt - -[must] -metadata.license : string { == 'MPL-2.0' } -metadata.registry : string { == 'ghcr.io/hyperpolymath' } -build.runtime : string { == 'podman' } -layers.base.verify : bool { == true } -layers.runtime.user : string { == 'nonroot' } -security.non-root : bool { == true } -security.no-new-privileges : bool { == true } -security.signing.algorithm : string { == 'ML-DSA-87' } -security.signing.provider : string { == 'cerro-torre' } -security.sbom.format : string { == 'spdx-json' } -security.sbom.include-deps : bool { == true } -verify.vordr : bool { == true } -verify.svalinn : bool { == true } -verify.scan-on-build : bool { == true } - -[trust] -signed-by = "ci-pipeline" - -[dust] -remove = ["deprecated layer definitions"] - -[intend] -production-ready = true -supply-chain-verified = true diff --git a/k9iser.toml b/k9iser.toml deleted file mode 100644 index 0e323cd..0000000 --- a/k9iser.toml +++ /dev/null @@ -1,70 +0,0 @@ -# k9iser manifest — wrap configs into self-validating K9 contracts -# SPDX-License-Identifier: MPL-2.0 -# -# panic-attack: universal static analysis and bug signature detection tool -# for 49 languages. Safety-tier "hunt" because this is a security tool whose -# own configuration must be above reproach. - -[project] -name = "panic-attack" -safety-tier = "hunt" # security tool — highest scrutiny - -# ── Cargo.toml — Rust package manifest ─────────────────────────────────────── - -[[configs]] -name = "cargo-manifest" -source = "Cargo.toml" -format = "toml" -must = [ - "package.name == 'panic-attack'", - "package.edition == '2021'", - "package.rust-version is set", # minimum MSRV declared - "package.license-file is set", # LICENSE present (MPL-2.0) - "package.repository is non-empty", - "profile.release.lto is set", # LTO enabled for security binary - "profile.release.codegen-units == 1", # single CGU for max optimisation - "profile.release.strip == 'symbols'", - "profile.release.panic == 'unwind'", # stack unwind required for proper error propagation - "dependencies.blake3 is set", # BLAKE3 hashing mandatory - "dependencies.sha2 is set", # SHA-2 hashing mandatory - "no dependency on md5", # MD5 banned for security tool - "no dependency on sha1", # SHA-1 banned for security tool -] -trust = ["signed-by: ci-pipeline"] -dust = ["remove: unused optional features"] -intend = ["production-ready", "security-critical"] - -# ── stapeln.toml — container build config ──────────────────────────────────── - -[[configs]] -name = "container-build" -source = "stapeln.toml" -format = "toml" -must = [ - "metadata.license == 'MPL-2.0'", - "metadata.registry == 'ghcr.io/hyperpolymath'", - "build.runtime == 'podman'", # Podman, never Docker - "layers.base.from starts-with 'cgr.dev/chainguard/'", # Chainguard base only - "layers.base.verify == true", - "layers.runtime.user == 'nonroot'", # never run as root - "security.non-root == true", - "security.no-new-privileges == true", - "security.cap-drop contains 'ALL'", - "security.signing.algorithm == 'ML-DSA-87'", # post-quantum signing - "security.signing.provider == 'cerro-torre'", - "security.sbom.format == 'spdx-json'", # SBOM mandatory - "security.sbom.include-deps == true", - "verify.vordr == true", - "verify.svalinn == true", - "verify.scan-on-build == true", - "verify.fail-on contains 'critical'", - "verify.fail-on contains 'high'", -] -trust = ["signed-by: ci-pipeline"] -dust = ["remove: deprecated layer definitions"] -intend = ["production-ready", "supply-chain-verified"] - -[validation] -strict = true -auto-fix = false -report-format = "text" From 9873d0849e71798cc84b1041c19f3391d5da85e0 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 21:38:50 +0000 Subject: [PATCH 2/2] chore(k9): point the remaining dogfood-gate hints at the K9 spec, not k9iser Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/dogfood-gate.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 21d7548..d86b910 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -82,7 +82,7 @@ jobs: echo "k9_count=$COUNT" >> "$GITHUB_OUTPUT" echo "config_count=$CONFIG_COUNT" >> "$GITHUB_OUTPUT" if [ "$COUNT" -eq 0 ] && [ "$CONFIG_COUNT" -gt 0 ]; then - echo "::warning::Found $CONFIG_COUNT config files but no K9 contracts. Run k9iser to generate contracts." + echo "::warning::Found $CONFIG_COUNT config files but no K9 contracts. See standards 1-formats/k9/spec/K9-CONTRACT-SPEC.adoc." fi - name: Validate K9 contracts @@ -98,7 +98,7 @@ jobs: :warning: **No .a2ml/.deed manifest files found.** Every RSR-compliant repo should have a repo deed (`_chora.deed`) at its root. - Generate contracts with: `k9iser generate .` + Author them per hyperpolymath/standards `1-formats/k9/spec/K9-CONTRACT-SPEC.adoc` (D173). EOF else echo "## K9 Contract Validation" >> "$GITHUB_STEP_SUMMARY"