boj-server/contractile.just at main · hyperpolymath/boj-server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
# Auto-generated by: contractile gen-just
# Source directory: .machine_readable/contractiles
# Re-generate with: contractile gen-just --dir .machine_readable/contractiles
#
# SPDX-License-Identifier: MPL-2.0

# === DUST (Recovery & Rollback) ===
# Source: Dustfile.a2ml

# List available dust recovery actions
dust-status:
    @echo '  dust-source-rollback: Revert all source changes to last commit [rollback]'

# Revert all source changes to last commit
dust-source-rollback:
    @echo 'Executing rollback for source-rollback'
    git checkout HEAD -- .


# === INTEND (Declared Future Intent) ===
# Source: Intentfile.a2ml

# Display declared future intents
intend-list:
    @echo '=== Declared Intent ==='
    @echo ''
    @echo 'Features:'
    @echo ''
    @echo 'Integrations:'
    @echo ''
    @echo 'Quality:'


# === MUST (Physical State Checks) ===
# Source: Mustfile.a2ml

# Run all must checks
must-check: must-license-present must-readme-present must-security-md-present must-justfile-present must-package-json-present must-no-banned-files must-no-env-files must-spdx-headers must-mcp-bridge-exists
    @echo 'All must checks passed'

# LICENSE file must exist
must-license-present:
    test -f LICENSE

# README must exist
must-readme-present:
    test -f README.adoc || test -f README.md

# SECURITY.md must exist
must-security-md-present:
    test -f SECURITY.md

# Justfile must exist
must-justfile-present:
    test -f Justfile

# package.json must exist (MCP server entry point)
must-package-json-present:
    test -f package.json

# No Dockerfiles or Makefiles
must-no-banned-files:
    test ! -f Dockerfile && test ! -f Makefile

# No .env files committed
must-no-env-files:
    test ! -f .env && test ! -f .env.local

# JS source files should have SPDX headers
must-spdx-headers:
    find . -name '*.js' -not -path '*/node_modules/*' | head -20 | xargs -r grep -L 'SPDX-License-Identifier' | wc -l | grep -q '^0$'

# MCP bridge entry point must exist
must-mcp-bridge-exists:
    test -f mcp-bridge/main.js


# === TRUST (Integrity & Provenance Verification) ===
# Source: Trustfile.a2ml

# Run all trust verifications
trust-verify: trust-license-content trust-no-secrets-committed trust-container-images-pinned
    @echo 'All trust verifications passed'

# LICENSE contains expected SPDX identifier
trust-license-content:
    grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE

# No .env or credential files in repo
trust-no-secrets-committed:
    test ! -f .env && test ! -f credentials.json && test ! -f .env.local

# Containerfile base images use pinned digests
trust-container-images-pinned:
    test ! -f Containerfile || grep -q '@sha256:' Containerfile