[hyperpolymath]

Summary

Gives BoJ Server a real symbol. The old favicon was the word "BoJ" set in monospace. The new mark is a pair of JSON-RPC braces holding a stack of cartridges, drawn in the site's existing palette (#0d1117 ground, #58a6ff / #a78bfa accents). The same mark is used as the favicon and the README header, and in a 1280×640 social preview card for GitHub and Open Graph.

The owner picked this concept (D · Braces) from four candidates.

Changes

• site/assets/favicon.svg: replaced with the braces mark on the dark tile. It now has an intrinsic size of 96×96, so the derived README.md does not stretch it to full width.
• site/assets/social-preview.svg (new): source for the 1280×640 card. The card has no tool or cartridge counts, because those change between releases and a PNG would go stale.
• site/assets/social-preview.png (new): the card rendered at 1280×640. Owner step: upload it under Settings → General → Social preview. GitHub has no API for that upload.
• README.adoc: the mark appears as a block image under the title.
• README.md: regenerated from README.adoc, as readme-derive.yml requires.
• site/index.html: adds og:image (https://boj-server.net/assets/social-preview.png), its width, height and alt text, plus twitter:card=summary_large_image.
• site/README.adoc, docs/website/CLOUDFLARE-SETUP.adoc: the asset lists now name the new files.

📌 New pins

Head SHA: 8206a37

None. This PR changes no uses: SHAs, actions.lock entries, lockfiles or container digests.

RSR Quality Checklist

Required

• Tests pass: no code changed. The checks that cover these files were run locally: README derivation and the vocab gate (see Testing).
• Code is formatted: no code changed. The SVGs and HTML follow the indentation of the files around them.
• Linter is clean: no code changed.
• No banned language patterns: SVG, AsciiDoc, HTML and one PNG only.
• No unsafe blocks: none touched.
• No banned functions: none touched.
• SPDX headers: both SVGs carry MPL-2.0, and the edited .adoc and .html files keep their existing headers. The PNG cannot carry a header and is covered by the Files: * stanza in .reuse/dep5.
• No secrets, credentials or .env files.

As Applicable

• .machine_readable/ state: not applicable, because project state, integrations and architecture are unchanged.
• Documentation updated: the asset lists in site/README.adoc and docs/website/CLOUDFLARE-SETUP.adoc.
• TOPOLOGY.md: not applicable, because the architecture is unchanged.
• CHANGELOG: not updated. Branding only; whoever cuts the next release decides whether it gets a line.
• New dependencies: none.
• ABI/FFI changes: none.

Testing

• README derivation control. Ran the pinned derivation (asciidoctor-reducer → asciidoctor -b docbook5 → pandoc -t gfm, with pandoc 3.10 and Asciidoctor 2.0.26, the same versions as readme-derive-reusable.yml@5a0891e9) on the unchanged README.adoc first. The output was byte-identical to the committed README.md. The same pipeline then produced this PR's README.md, and a second run gave the same bytes.
• Vocab gate. readme-vocab-gate.sh README.adoc README.md 98 from the pinned standards commit: 781/791 tokens retained (98.7%), passed.
• Rendering. Rendered in headless Chromium: the mark at 16, 32 and 96 px on white and on #0d1117, and the social card at 1280×640. Every element is inside the frame, and the braces are legible at 16 px.
• Not tested: the live og:image URL. It resolves only after the site deploys from main.

Deferred red checks

Both were already red on main at f9348ae with identical output. This PR does not cause either.

• SonarQube: SonarCloud returns 403 on SONAR_TOKEN. Tracked in Three pre-existing red non-required checks on main: Allowlist Preflight (empty GH_TOKEN), Workflow security linter (duplicate with in abi-drift.yml), SonarQube (403) #338.
• governance / UUID v7 conformance: a v5 UUID literal in .machine_readable/CLADE.a2ml, which this PR does not touch. Tracked in governance / UUID v7 conformance is red on main: v5 UUID literal in .machine_readable/CLADE.a2ml #347.

Screenshots

site/assets/social-preview.png in this PR is the rendered card itself.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Wo32J8Ym7XpPr9EYdBCgVB

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 0863e140-489a-41ac-ba5d-25db47ae8a1f

📥 Commits

Reviewing files that changed from the base of the PR and between f9348ae and 8206a37.

⛔ Files ignored due to path filters (3)

• site/assets/favicon.svg is excluded by !**/*.svg
• site/assets/social-preview.png is excluded by !**/*.png
• site/assets/social-preview.svg is excluded by !**/*.svg

📒 Files selected for processing (5)

• README.adoc
• README.md
• docs/website/CLOUDFLARE-SETUP.adoc
• site/README.adoc
• site/index.html

 ___________________________________________________________________________________________________________________________________
< Finish what you start. Where possible, the routine or object that allocates a resource should be responsible for deallocating it. >
 -----------------------------------------------------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Hypatia Security Scan

Findings: 113 issues detected

Severity	Count
🔴 Critical	10
🟠 High	20
🟡 Medium	83

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `sonarqube` in build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sonarqube"
  },
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "reason": "Job `deploy` in pages-deploy.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deploy"
  },
  {
    "reason": "Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
    "type": "secret_action_without_presence_gate",
    "file": ".github/workflows/instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high",
    "fix_recipe": "add_secret_presence_gate"
  },
  {
    "reason": "codeql.yml does not list `language: actions` in its matrix, but the repo has workflow files. CodeQL's `actions` language scans workflow YAML for injection and other CI/CD-specific weaknesses — every repo with workflows benefits. Add an entry to `matrix.include` with `language: actions` + `build-mode: none`.",
    "type": "codeql_missing_actions_language",
    "file": ".github/workflows/codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "fix_recipe": "add_codeql_actions_language"
  },
  {
    "line": 39,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 46,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 32,
    "reason": "job in .github/workflows/build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/build.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/container-publish.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/container-publish.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence