From 0866af839dc5167517f9777582b1c9a37a0310f0 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 5 Oct 2026 08:16:29 +0100 Subject: [PATCH] feat(yaml): KYAML step 5 - migrate non-workflow YAML to KYAML (22 files) Step 5 of KYAML adoption (standards#1024): migrate estate-authored non-bot YAML files to KYAML format. - Converted 22 non-workflow YAML files across standards repo - Used yq -o kyaml via scripts/kyaml-format.sh - Preserves all comments per yaml-comment-proof (standards#1021) - Added missing SPDX headers to 3 files - All files now pass kyaml-format.sh --check KYAML adoption ruled by D280: 'KYAML everywhere, workflows included.' --- .verisimdb/compose.yml | 67 +- .../PROTOCOL.yaml | 42 +- .../emergency-termination/PROTOCOL.yaml | 42 +- .../planned-session-close/PROTOCOL.yaml | 99 +- .../recovery-operation/PROTOCOL.yaml | 42 +- .../continuity/repo-intake/PROTOCOL.yaml | 42 +- .../collaborative-transfer/PROTOCOL.yaml | 42 +- .../handover/full-transfer/PROTOCOL.yaml | 42 +- .../handover/human-transfer/PROTOCOL.yaml | 42 +- .../handover/model-transfer/PROTOCOL.yaml | 42 +- .../verify/maintenance-sweep/PROTOCOL.yaml | 42 +- .../verify/release-audit/PROTOCOL.yaml | 42 +- .../substantial-completion/PROTOCOL.yaml | 42 +- rhodium-standard-repositories/FUNDING.yml | 34 +- .../examples/rhodium-minimal/FUNDING.yml | 9 +- .../palimpsest-license/.rvc/config.yml | 1048 ++++++++-------- .../TOOLS/validation/haskell/stack.yaml | 32 +- .../api/openapi/palimpsest-license-api.yaml | 1084 ++++++++++------- .../satellites/rsr-certifier/FUNDING.yml | 16 +- .../rsr-certifier/container/compose.yml | 489 ++++---- .../container/k8s/deployment.yaml | 335 +++-- .../satellites/state.scm/FUNDING.yml | 31 +- 22 files changed, 2065 insertions(+), 1641 deletions(-) diff --git a/.verisimdb/compose.yml b/.verisimdb/compose.yml index 22cfcffcf..705941e72 100644 --- a/.verisimdb/compose.yml +++ b/.verisimdb/compose.yml @@ -2,29 +2,44 @@ # Podman Compose file for the standards VeriSimDB instance. # Usage: podman-compose -f .verisimdb/compose.yml up -d -version: "3.8" - -services: - standards-verisimdb: - build: - context: .. - dockerfile: .verisimdb/Containerfile - image: standards-verisimdb:latest - container_name: standards-verisimdb - ports: - - "8097:8097" - volumes: - - standards-verisimdb-data:/app/data - environment: - VERISIMDB_LOG_LEVEL: info - VERISIMDB_INSTANCE: standards - restart: unless-stopped - healthcheck: - test: ["CMD", "wget", "-q", "--spider", "http://localhost:8097/health"] - interval: 30s - timeout: 5s - retries: 3 - -volumes: - standards-verisimdb-data: - name: standards-verisimdb-data +{ + version: "3.8", + services: { + standards-verisimdb: { + build: { + context: "..", + dockerfile: ".verisimdb/Containerfile", + }, + image: "standards-verisimdb:latest", + container_name: "standards-verisimdb", + ports: [ + "8097:8097", + ], + volumes: [ + "standards-verisimdb-data:/app/data", + ], + environment: { + VERISIMDB_LOG_LEVEL: "info", + VERISIMDB_INSTANCE: "standards", + }, + restart: "unless-stopped", + healthcheck: { + test: [ + "CMD", + "wget", + "-q", + "--spider", + "http://localhost:8097/health", + ], + interval: "30s", + timeout: "5s", + retries: 3, + }, + }, + }, + volumes: { + standards-verisimdb-data: { + name: "standards-verisimdb-data", + }, + }, +} diff --git a/3-practice/session-management-standards/continuity/checkpoint-before-major-change/PROTOCOL.yaml b/3-practice/session-management-standards/continuity/checkpoint-before-major-change/PROTOCOL.yaml index d8379a644..ec076f07b 100644 --- a/3-practice/session-management-standards/continuity/checkpoint-before-major-change/PROTOCOL.yaml +++ b/3-practice/session-management-standards/continuity/checkpoint-before-major-change/PROTOCOL.yaml @@ -1,23 +1,25 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # STUB: Session-management machine protocol contract -protocol: - family: "continuity" - name: "checkpoint-before-major-change" - canonical_command: "checkpoint change " - status: "stub" - -continuity_core: - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - -outputs: [] +{ + protocol: { + family: "continuity", + name: "checkpoint-before-major-change", + canonical_command: "checkpoint change ", + status: "stub", + }, + continuity_core: [ + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + ], + outputs: [], +} diff --git a/3-practice/session-management-standards/continuity/emergency-termination/PROTOCOL.yaml b/3-practice/session-management-standards/continuity/emergency-termination/PROTOCOL.yaml index f9840331f..6615404af 100644 --- a/3-practice/session-management-standards/continuity/emergency-termination/PROTOCOL.yaml +++ b/3-practice/session-management-standards/continuity/emergency-termination/PROTOCOL.yaml @@ -1,23 +1,25 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # STUB: Session-management machine protocol contract -protocol: - family: "continuity" - name: "emergency-termination" - canonical_command: "close urgent " - status: "stub" - -continuity_core: - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - -outputs: [] +{ + protocol: { + family: "continuity", + name: "emergency-termination", + canonical_command: "close urgent ", + status: "stub", + }, + continuity_core: [ + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + ], + outputs: [], +} diff --git a/3-practice/session-management-standards/continuity/planned-session-close/PROTOCOL.yaml b/3-practice/session-management-standards/continuity/planned-session-close/PROTOCOL.yaml index d43efa1e2..3498f49cd 100644 --- a/3-practice/session-management-standards/continuity/planned-session-close/PROTOCOL.yaml +++ b/3-practice/session-management-standards/continuity/planned-session-close/PROTOCOL.yaml @@ -1,50 +1,55 @@ # Machine protocol contract for planned-session-close # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) -protocol: - family: "continuity" - name: "planned-session-close" - canonical_command: "close planned " - status: "active" - version: "1.1.0" - -continuity_core: - # Metadata - - protocol - - protocol_version - - session_id - - session_start - - session_end - - assistant - - author - - format_schema - - archival_convention - - cross_references - # Core Content - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - # Tables/Lists - - commits_made - - verifications_run - - decisions_made - - decisions_deferred - - open_invitations - - memory_entries - - risk_register_delta - - discipline_check - -outputs: - - path: "SESSION-CLOSE--.adoc" - format: "asciidoc" - schema: "session-close.v1.enriched" - grounding: "required" - archival: "append-only" +{ + protocol: { + family: "continuity", + name: "planned-session-close", + canonical_command: "close planned ", + status: "active", + version: "1.1.0", + }, + continuity_core: [ + # Metadata + "protocol", + "protocol_version", + "session_id", + "session_start", + "session_end", + "assistant", + "author", + "format_schema", + "archival_convention", + "cross_references", + # Core Content + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + # Tables/Lists + "commits_made", + "verifications_run", + "decisions_made", + "decisions_deferred", + "open_invitations", + "memory_entries", + "risk_register_delta", + "discipline_check", + ], + outputs: [ + { + path: "SESSION-CLOSE--.adoc", + format: "asciidoc", + schema: "session-close.v1.enriched", + grounding: "required", + archival: "append-only", + }, + ], +} diff --git a/3-practice/session-management-standards/continuity/recovery-operation/PROTOCOL.yaml b/3-practice/session-management-standards/continuity/recovery-operation/PROTOCOL.yaml index e74c07c31..571e8af12 100644 --- a/3-practice/session-management-standards/continuity/recovery-operation/PROTOCOL.yaml +++ b/3-practice/session-management-standards/continuity/recovery-operation/PROTOCOL.yaml @@ -1,23 +1,25 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # STUB: Session-management machine protocol contract -protocol: - family: "continuity" - name: "recovery-operation" - canonical_command: "recover repo " - status: "stub" - -continuity_core: - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - -outputs: [] +{ + protocol: { + family: "continuity", + name: "recovery-operation", + canonical_command: "recover repo ", + status: "stub", + }, + continuity_core: [ + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + ], + outputs: [], +} diff --git a/3-practice/session-management-standards/continuity/repo-intake/PROTOCOL.yaml b/3-practice/session-management-standards/continuity/repo-intake/PROTOCOL.yaml index 06dd502d3..565568b4b 100644 --- a/3-practice/session-management-standards/continuity/repo-intake/PROTOCOL.yaml +++ b/3-practice/session-management-standards/continuity/repo-intake/PROTOCOL.yaml @@ -1,23 +1,25 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # STUB: Session-management machine protocol contract -protocol: - family: "continuity" - name: "repo-intake" - canonical_command: "intake repo " - status: "stub" - -continuity_core: - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - -outputs: [] +{ + protocol: { + family: "continuity", + name: "repo-intake", + canonical_command: "intake repo ", + status: "stub", + }, + continuity_core: [ + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + ], + outputs: [], +} diff --git a/3-practice/session-management-standards/handover/collaborative-transfer/PROTOCOL.yaml b/3-practice/session-management-standards/handover/collaborative-transfer/PROTOCOL.yaml index 9e8fb58d8..4e701499f 100644 --- a/3-practice/session-management-standards/handover/collaborative-transfer/PROTOCOL.yaml +++ b/3-practice/session-management-standards/handover/collaborative-transfer/PROTOCOL.yaml @@ -1,23 +1,25 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # STUB: Session-management machine protocol contract -protocol: - family: "handover" - name: "collaborative-transfer" - canonical_command: "handover split " - status: "stub" - -continuity_core: - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - -outputs: [] +{ + protocol: { + family: "handover", + name: "collaborative-transfer", + canonical_command: "handover split ", + status: "stub", + }, + continuity_core: [ + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + ], + outputs: [], +} diff --git a/3-practice/session-management-standards/handover/full-transfer/PROTOCOL.yaml b/3-practice/session-management-standards/handover/full-transfer/PROTOCOL.yaml index a5a45d2c8..ee7c2f83a 100644 --- a/3-practice/session-management-standards/handover/full-transfer/PROTOCOL.yaml +++ b/3-practice/session-management-standards/handover/full-transfer/PROTOCOL.yaml @@ -1,23 +1,25 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # STUB: Session-management machine protocol contract -protocol: - family: "handover" - name: "full-transfer" - canonical_command: "handover full " - status: "stub" - -continuity_core: - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - -outputs: [] +{ + protocol: { + family: "handover", + name: "full-transfer", + canonical_command: "handover full ", + status: "stub", + }, + continuity_core: [ + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + ], + outputs: [], +} diff --git a/3-practice/session-management-standards/handover/human-transfer/PROTOCOL.yaml b/3-practice/session-management-standards/handover/human-transfer/PROTOCOL.yaml index d396236b9..9473f42ed 100644 --- a/3-practice/session-management-standards/handover/human-transfer/PROTOCOL.yaml +++ b/3-practice/session-management-standards/handover/human-transfer/PROTOCOL.yaml @@ -1,23 +1,25 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # STUB: Session-management machine protocol contract -protocol: - family: "handover" - name: "human-transfer" - canonical_command: "handover human " - status: "stub" - -continuity_core: - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - -outputs: [] +{ + protocol: { + family: "handover", + name: "human-transfer", + canonical_command: "handover human ", + status: "stub", + }, + continuity_core: [ + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + ], + outputs: [], +} diff --git a/3-practice/session-management-standards/handover/model-transfer/PROTOCOL.yaml b/3-practice/session-management-standards/handover/model-transfer/PROTOCOL.yaml index ebde7e416..ac229b92e 100644 --- a/3-practice/session-management-standards/handover/model-transfer/PROTOCOL.yaml +++ b/3-practice/session-management-standards/handover/model-transfer/PROTOCOL.yaml @@ -1,23 +1,25 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # STUB: Session-management machine protocol contract -protocol: - family: "handover" - name: "model-transfer" - canonical_command: "handover model " - status: "stub" - -continuity_core: - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - -outputs: [] +{ + protocol: { + family: "handover", + name: "model-transfer", + canonical_command: "handover model ", + status: "stub", + }, + continuity_core: [ + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + ], + outputs: [], +} diff --git a/3-practice/session-management-standards/verify/maintenance-sweep/PROTOCOL.yaml b/3-practice/session-management-standards/verify/maintenance-sweep/PROTOCOL.yaml index d8287288c..0cbec5ebf 100644 --- a/3-practice/session-management-standards/verify/maintenance-sweep/PROTOCOL.yaml +++ b/3-practice/session-management-standards/verify/maintenance-sweep/PROTOCOL.yaml @@ -1,23 +1,25 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # STUB: Session-management machine protocol contract -protocol: - family: "verify" - name: "maintenance-sweep" - canonical_command: "verify maintenance " - status: "stub" - -continuity_core: - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - -outputs: [] +{ + protocol: { + family: "verify", + name: "maintenance-sweep", + canonical_command: "verify maintenance ", + status: "stub", + }, + continuity_core: [ + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + ], + outputs: [], +} diff --git a/3-practice/session-management-standards/verify/release-audit/PROTOCOL.yaml b/3-practice/session-management-standards/verify/release-audit/PROTOCOL.yaml index 9f292f66f..69576a303 100644 --- a/3-practice/session-management-standards/verify/release-audit/PROTOCOL.yaml +++ b/3-practice/session-management-standards/verify/release-audit/PROTOCOL.yaml @@ -1,23 +1,25 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # STUB: Session-management machine protocol contract -protocol: - family: "verify" - name: "release-audit" - canonical_command: "verify release " - status: "stub" - -continuity_core: - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - -outputs: [] +{ + protocol: { + family: "verify", + name: "release-audit", + canonical_command: "verify release ", + status: "stub", + }, + continuity_core: [ + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + ], + outputs: [], +} diff --git a/3-practice/session-management-standards/verify/substantial-completion/PROTOCOL.yaml b/3-practice/session-management-standards/verify/substantial-completion/PROTOCOL.yaml index b10a878ab..056e382a7 100644 --- a/3-practice/session-management-standards/verify/substantial-completion/PROTOCOL.yaml +++ b/3-practice/session-management-standards/verify/substantial-completion/PROTOCOL.yaml @@ -1,23 +1,25 @@ # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # STUB: Session-management machine protocol contract -protocol: - family: "verify" - name: "substantial-completion" - canonical_command: "verify substantial " - status: "stub" - -continuity_core: - - goal - - current_task - - last_completed_action - - next_intended_action - - repository - - branch - - head_commit - - files_of_interest - - known_blockers - - residual_risks - - recommended_next_protocol - -outputs: [] +{ + protocol: { + family: "verify", + name: "substantial-completion", + canonical_command: "verify substantial ", + status: "stub", + }, + continuity_core: [ + "goal", + "current_task", + "last_completed_action", + "next_intended_action", + "repository", + "branch", + "head_commit", + "files_of_interest", + "known_blockers", + "residual_risks", + "recommended_next_protocol", + ], + outputs: [], +} diff --git a/rhodium-standard-repositories/FUNDING.yml b/rhodium-standard-repositories/FUNDING.yml index 4beb20788..b907e2c4a 100644 --- a/rhodium-standard-repositories/FUNDING.yml +++ b/rhodium-standard-repositories/FUNDING.yml @@ -11,24 +11,22 @@ # github: hyperpolymath # Open Collective (community funding) -open_collective: rhodium-standard - -# Liberapay (recurring donations) -# liberapay: rhodium-standard - -# Ko-fi (one-time donations) -# ko_fi: rhodiumstandard - -# Patreon (monthly supporters) -# patreon: rhodiumstandard - -# Custom donation URLs -custom: - - "https://opencollective.com/rhodium-standard" - - "https://gitlab.com/hyperpolymath/rhodium-standard-repositories" - - "https://rhodium-standard.org/donate" - - "https://buymeacoffee.com/rhodiumstandard" - +{ + open_collective: "rhodium-standard", + # Liberapay (recurring donations) + # liberapay: rhodium-standard + # Ko-fi (one-time donations) + # ko_fi: rhodiumstandard + # Patreon (monthly supporters) + # patreon: rhodiumstandard + # Custom donation URLs + custom: [ + "https://opencollective.com/rhodium-standard", + "https://gitlab.com/hyperpolymath/rhodium-standard-repositories", + "https://rhodium-standard.org/donate", + "https://buymeacoffee.com/rhodiumstandard", + ], +} # Funding Philosophy # ------------------ # The Rhodium Standard embraces solidarity economics: diff --git a/rhodium-standard-repositories/examples/rhodium-minimal/FUNDING.yml b/rhodium-standard-repositories/examples/rhodium-minimal/FUNDING.yml index c226e3116..751c159b4 100644 --- a/rhodium-standard-repositories/examples/rhodium-minimal/FUNDING.yml +++ b/rhodium-standard-repositories/examples/rhodium-minimal/FUNDING.yml @@ -23,6 +23,9 @@ # ko_fi: rhodium_standard # Custom URLs -custom: - - "https://gitlab.com/hyperpolymath/rhodium-standard-repositories" - - "https://opencollective.com/rhodium-standard" +{ + custom: [ + "https://gitlab.com/hyperpolymath/rhodium-standard-repositories", + "https://opencollective.com/rhodium-standard", + ], +} diff --git a/rhodium-standard-repositories/satellites/palimpsest-license/.rvc/config.yml b/rhodium-standard-repositories/satellites/palimpsest-license/.rvc/config.yml index 6648f88c0..6b6e78937 100644 --- a/rhodium-standard-repositories/satellites/palimpsest-license/.rvc/config.yml +++ b/rhodium-standard-repositories/satellites/palimpsest-license/.rvc/config.yml @@ -4,517 +4,539 @@ # Version: 0.4.0 --- -rvc: - version: "1.0" - project: "palimpsest-license" - description: "Automated repository maintenance and cleanup" - enabled: true - schedule: "daily" # Options: hourly, daily, weekly, manual - -# ============================================================================ -# GIT CLEANUP -# ============================================================================ - -git: - enabled: true - - # Clean untracked files (with safety) - clean_untracked: - enabled: false # Disabled by default for safety - dry_run: true - exclude: - - ".env*" - - "*.backup" - - "TODO.md" - - "NOTES.md" - confirm: true - - # Garbage collection - gc: - enabled: true - aggressive: false - auto: true - prune: "30 days" # Prune objects older than 30 days - - # Repack repository - repack: - enabled: true - full: false - depth: 50 - window: 250 - - # Remove stale branches - prune_branches: - enabled: false # Manual only - merged_only: true - exclude: - - "main" - - "master" - - "develop" - - "claude/*" - confirm: true - - # Reflog cleanup - reflog: - enabled: true - expire: "90 days" - expire_unreachable: "30 days" - -# ============================================================================ -# BUILD ARTIFACT CLEANUP -# ============================================================================ - -build_artifacts: - enabled: true - - # Node.js artifacts - nodejs: - enabled: true - remove: - - "node_modules/.cache" - - "npm-debug.log*" - - "yarn-debug.log*" - - "yarn-error.log*" - - ".npm" - - ".eslintcache" - - ".stylelintcache" - preserve: - - "node_modules" # Don't remove entire node_modules - - "package-lock.json" - - # Haskell artifacts - haskell: - enabled: true - remove: - - "TOOLS/validation/haskell/dist/" - - "TOOLS/validation/haskell/dist-newstyle/" - - "TOOLS/validation/haskell/.ghc.environment.*" - - "**/*.hi" - - "**/*.o" - preserve: - - "cabal.project.freeze" - - # CSS/SCSS artifacts - styles: - enabled: true - remove: - - "styles/css/*.css.map" - - "**/.sass-cache" - preserve: - - "styles/css/*.css" # Keep compiled CSS - - # ReScript artifacts - rescript: - enabled: true - remove: - - "rescript/lib/bs/.ninja_log" - - "rescript/lib/bs/.bsbuild" - preserve: - - "rescript/lib/bs" # Keep compiled output - - # General artifacts - general: - enabled: true - remove: - - "**/*.log" - - "**/*.tmp" - - "**/.DS_Store" - - "**/Thumbs.db" - - "**/*.swp" - - "**/*.swo" - - "**/*~" - -# ============================================================================ -# CACHE CLEANUP -# ============================================================================ - -cache: - enabled: true - - # Development caches - dev_cache: - enabled: true - max_age: "30 days" - paths: - - ".cache" - - ".parcel-cache" - - ".next/cache" - - ".nuxt" - - # Package manager caches - package_cache: - enabled: false # Keep for faster installs - npm: - path: "~/.npm" - max_size: "1GB" - cabal: - path: "~/.cabal/store" - max_size: "2GB" - -# ============================================================================ -# DOCUMENTATION REGENERATION -# ============================================================================ - -documentation: - enabled: true - - # Regenerate table of contents - toc: - enabled: true - files: - - "README.md" - - "CONTRIBUTING.md" - - "GOVERNANCE.md" - - "GUIDES_v0.4/User_Guide.md" - - "GUIDES_v0.4/Developer_Guide.md" - tool: "markdown-toc" - - # Update timestamps - timestamps: - enabled: false # Manual only to avoid conflicts - files: - - "RSR_COMPLIANCE.md" - - "CHANGELOG.md" - - # Validate links - link_validation: - enabled: true - check_external: false # Only internal links - fix_broken: false # Report only, don't auto-fix - report_file: ".rvc/link-report.txt" - -# ============================================================================ -# CODE FORMATTING -# ============================================================================ - -formatting: - enabled: true - auto_fix: false # Report only by default - - # Prettier - prettier: - enabled: true - extensions: - - "md" - - "json" - - "yml" - - "yaml" - exclude: - - "node_modules" - - "dist" - - "lib" - - ".git" - - # Markdown lint - markdownlint: - enabled: true - auto_fix: false - config: ".markdownlint.json" - -# ============================================================================ -# DEPENDENCY UPDATES -# ============================================================================ - -dependencies: - enabled: true - auto_update: false # Manual review required - - # npm dependencies - npm: - enabled: true - check_outdated: true - security_audit: true - report_file: ".rvc/npm-outdated.txt" - - # Haskell dependencies - cabal: - enabled: true - check_outdated: true - report_file: ".rvc/cabal-outdated.txt" - - # Nix dependencies - nix: - enabled: true - update_flake: false # Manual only - check_updates: true - -# ============================================================================ -# SECURITY SCANNING -# ============================================================================ - -security: - enabled: true - - # Secret scanning - secrets: - enabled: true - tool: "gitleaks" # or "trufflehog" - config: ".rvc/gitleaks.toml" - report_file: ".rvc/secrets-report.txt" - - # Vulnerability scanning - vulnerabilities: - enabled: true - npm_audit: true - severity_threshold: "high" # Report high and critical - - # License compliance - license_check: - enabled: true - allowed_licenses: - - "Palimpsest-0.4" - - "MIT" - - "Apache-2.0" - - "BSD-3-Clause" - - "CC-BY-SA-4.0" - report_file: ".rvc/license-report.txt" - -# ============================================================================ -# METADATA VALIDATION -# ============================================================================ - -metadata: - enabled: true - - # JSON validation - json: - enabled: true - validate_schema: true - pretty_print: false - paths: - - "METADATA_v0.4/**/*.json" - - ".well-known/*.json" - - "package.json" - - # YAML validation - yaml: - enabled: true - paths: - - ".github/**/*.yml" - - ".rvc/*.yml" - - # SPDX headers - spdx: - enabled: true - check_presence: true - auto_add: false - file_types: - - "*.hs" - - "*.res" - - "*.js" - - "*.ncl" - -# ============================================================================ -# STATISTICS & REPORTING -# ============================================================================ - -statistics: - enabled: true - - # Generate statistics - generate: - enabled: true - output: ".rvc/stats.txt" - include: - - "line_count" - - "file_count" - - "commit_count" - - "contributor_count" - - "test_coverage" - - # Visualisations - visualisations: - enabled: false - tools: - - "git-stats" - - "cloc" - -# ============================================================================ -# BACKUP & ARCHIVAL -# ============================================================================ - -backup: - enabled: true - - # Create snapshots - snapshots: - enabled: true - frequency: "weekly" - retention: "4 weeks" - destination: ".rvc/snapshots" - compress: true - exclude: - - "node_modules" - - "dist-newstyle" - - ".git" - - # Export artifacts - export: - enabled: false - formats: - - "tar.gz" - - "zip" - destination: "dist/exports" - -# ============================================================================ -# NOTIFICATIONS -# ============================================================================ - -notifications: - enabled: true - - # Console output - console: - enabled: true - verbosity: "info" # debug, info, warn, error - colour: true - - # File reports - reports: - enabled: true - directory: ".rvc/reports" - formats: - - "txt" - - "json" - retention: "30 days" - - # Email (disabled by default) - email: - enabled: false - recipients: [] - smtp: - host: "" - port: 587 - use_tls: true - -# ============================================================================ -# EXECUTION RULES -# ============================================================================ - -execution: - # Dry run mode (preview changes without applying) - dry_run: false - - # Confirmation for destructive operations - confirm_destructive: true - - # Parallel execution - parallel: - enabled: true - max_workers: 4 - - # Timeouts - timeouts: - git_gc: "5 minutes" - npm_audit: "2 minutes" - link_validation: "10 minutes" - - # Error handling - error_handling: - continue_on_error: true - max_errors: 10 - log_errors: true - -# ============================================================================ -# EXCLUSIONS -# ============================================================================ - -exclusions: - # Paths to never touch - never_clean: - - "LICENSES/" - - "LICENSE_CORE/" - - ".git/" - - ".well-known/" - - "GOVERNANCE.md" - - "3-practice/SECURITY.md" - - "CODE_OF_PRACTICE.md" - - # Files to never modify - never_modify: - - "LICENSES/**/*.md" - - "LICENSE_CORE/**/*.md" - - "*.gpg" - - "*.asc" - - # Patterns to ignore - ignore_patterns: - - "*.backup" - - "*.bak" - - "*~" - - ".env*" - -# ============================================================================ -# CUSTOM SCRIPTS -# ============================================================================ - -custom_scripts: - enabled: true - - # Pre-cleanup hooks - pre_cleanup: - - name: "validate-state" - script: ".rvc/scripts/pre-cleanup.sh" - required: true - - # Post-cleanup hooks - post_cleanup: - - name: "generate-report" - script: ".rvc/scripts/post-cleanup.sh" - required: false - - # Custom maintenance tasks - maintenance: - - name: "update-copyright-years" - script: ".rvc/scripts/update-copyright.sh" - schedule: "yearly" - enabled: false - -# ============================================================================ -# LOGGING -# ============================================================================ - -logging: - enabled: true - level: "info" - format: "text" # text or json - destination: ".rvc/rvc.log" - max_size: "10MB" - max_files: 5 - compress_old: true - -# ============================================================================ -# COMPLIANCE -# ============================================================================ - -compliance: - # RSR compliance checks - rsr: - enabled: true - auto_fix: false - checks: - - "documentation_complete" - - "well_known_present" - - "spdx_headers" - - "license_files" - - # British English enforcement - spelling: - enabled: true - language: "en-GB" - auto_correct: false - report_only: true - -# ============================================================================ -# VERSION & METADATA -# ============================================================================ - -metadata: - version: "0.4.0" - last_updated: "2025-11-28" - author: "Palimpsest Stewardship Council" - license: "Palimpsest-0.4 OR MIT" - documentation: "https://palimpsest.license/docs/rvc" - ---- +{ + rvc: { + version: "1.0", + project: "palimpsest-license", + description: "Automated repository maintenance and cleanup", + enabled: true, + schedule: "daily", # Options: hourly, daily, weekly, manual + }, + # ============================================================================ + # GIT CLEANUP + # ============================================================================ + git: { + enabled: true, + # Clean untracked files (with safety) + clean_untracked: { + enabled: false, # Disabled by default for safety + dry_run: true, + exclude: [ + ".env*", + "*.backup", + "TODO.md", + "NOTES.md", + ], + confirm: true, + }, + # Garbage collection + gc: { + enabled: true, + aggressive: false, + auto: true, + prune: "30 days", # Prune objects older than 30 days + }, + # Repack repository + repack: { + enabled: true, + full: false, + depth: 50, + window: 250, + }, + # Remove stale branches + prune_branches: { + enabled: false, # Manual only + merged_only: true, + exclude: [ + "main", + "master", + "develop", + "claude/*", + ], + confirm: true, + }, + # Reflog cleanup + reflog: { + enabled: true, + expire: "90 days", + expire_unreachable: "30 days", + }, + }, + # ============================================================================ + # BUILD ARTIFACT CLEANUP + # ============================================================================ + build_artifacts: { + enabled: true, + # Node.js artifacts + nodejs: { + enabled: true, + remove: [ + "node_modules/.cache", + "npm-debug.log*", + "yarn-debug.log*", + "yarn-error.log*", + ".npm", + ".eslintcache", + ".stylelintcache", + ], + preserve: [ + "node_modules", # Don't remove entire node_modules + "package-lock.json", + ], + }, + # Haskell artifacts + haskell: { + enabled: true, + remove: [ + "TOOLS/validation/haskell/dist/", + "TOOLS/validation/haskell/dist-newstyle/", + "TOOLS/validation/haskell/.ghc.environment.*", + "**/*.hi", + "**/*.o", + ], + preserve: [ + "cabal.project.freeze", + ], + }, + # CSS/SCSS artifacts + styles: { + enabled: true, + remove: [ + "styles/css/*.css.map", + "**/.sass-cache", + ], + preserve: [ + "styles/css/*.css", # Keep compiled CSS + ], + }, + # ReScript artifacts + rescript: { + enabled: true, + remove: [ + "rescript/lib/bs/.ninja_log", + "rescript/lib/bs/.bsbuild", + ], + preserve: [ + "rescript/lib/bs", # Keep compiled output + ], + }, + # General artifacts + general: { + enabled: true, + remove: [ + "**/*.log", + "**/*.tmp", + "**/.DS_Store", + "**/Thumbs.db", + "**/*.swp", + "**/*.swo", + "**/*~", + ], + }, + }, + # ============================================================================ + # CACHE CLEANUP + # ============================================================================ + cache: { + enabled: true, + # Development caches + dev_cache: { + enabled: true, + max_age: "30 days", + paths: [ + ".cache", + ".parcel-cache", + ".next/cache", + ".nuxt", + ], + }, + # Package manager caches + package_cache: { + enabled: false, # Keep for faster installs + npm: { + path: "~/.npm", + max_size: "1GB", + }, + cabal: { + path: "~/.cabal/store", + max_size: "2GB", + }, + }, + }, + # ============================================================================ + # DOCUMENTATION REGENERATION + # ============================================================================ + documentation: { + enabled: true, + # Regenerate table of contents + toc: { + enabled: true, + files: [ + "README.md", + "CONTRIBUTING.md", + "GOVERNANCE.md", + "GUIDES_v0.4/User_Guide.md", + "GUIDES_v0.4/Developer_Guide.md", + ], + tool: "markdown-toc", + }, + # Update timestamps + timestamps: { + enabled: false, # Manual only to avoid conflicts + files: [ + "RSR_COMPLIANCE.md", + "CHANGELOG.md", + ], + }, + # Validate links + link_validation: { + enabled: true, + check_external: false, # Only internal links + fix_broken: false, # Report only, don't auto-fix + report_file: ".rvc/link-report.txt", + }, + }, + # ============================================================================ + # CODE FORMATTING + # ============================================================================ + formatting: { + enabled: true, + auto_fix: false, # Report only by default + # Prettier + prettier: { + enabled: true, + extensions: [ + "md", + "json", + "yml", + "yaml", + ], + exclude: [ + "node_modules", + "dist", + "lib", + ".git", + ], + }, + # Markdown lint + markdownlint: { + enabled: true, + auto_fix: false, + config: ".markdownlint.json", + }, + }, + # ============================================================================ + # DEPENDENCY UPDATES + # ============================================================================ + dependencies: { + enabled: true, + auto_update: false, # Manual review required + # npm dependencies + npm: { + enabled: true, + check_outdated: true, + security_audit: true, + report_file: ".rvc/npm-outdated.txt", + }, + # Haskell dependencies + cabal: { + enabled: true, + check_outdated: true, + report_file: ".rvc/cabal-outdated.txt", + }, + # Nix dependencies + nix: { + enabled: true, + update_flake: false, # Manual only + check_updates: true, + }, + }, + # ============================================================================ + # SECURITY SCANNING + # ============================================================================ + security: { + enabled: true, + # Secret scanning + secrets: { + enabled: true, + tool: "gitleaks", # or "trufflehog" + config: ".rvc/gitleaks.toml", + report_file: ".rvc/secrets-report.txt", + }, + # Vulnerability scanning + vulnerabilities: { + enabled: true, + npm_audit: true, + severity_threshold: "high", # Report high and critical + }, + # License compliance + license_check: { + enabled: true, + allowed_licenses: [ + "Palimpsest-0.4", + "MIT", + "Apache-2.0", + "BSD-3-Clause", + "CC-BY-SA-4.0", + ], + report_file: ".rvc/license-report.txt", + }, + }, + # ============================================================================ + # METADATA VALIDATION + # ============================================================================ + metadata: { + enabled: true, + # JSON validation + json: { + enabled: true, + validate_schema: true, + pretty_print: false, + paths: [ + "METADATA_v0.4/**/*.json", + ".well-known/*.json", + "package.json", + ], + }, + # YAML validation + yaml: { + enabled: true, + paths: [ + ".github/**/*.yml", + ".rvc/*.yml", + ], + }, + # SPDX headers + spdx: { + enabled: true, + check_presence: true, + auto_add: false, + file_types: [ + "*.hs", + "*.res", + "*.js", + "*.ncl", + ], + }, + }, + # ============================================================================ + # STATISTICS & REPORTING + # ============================================================================ + statistics: { + enabled: true, + # Generate statistics + generate: { + enabled: true, + output: ".rvc/stats.txt", + include: [ + "line_count", + "file_count", + "commit_count", + "contributor_count", + "test_coverage", + ], + }, + # Visualisations + visualisations: { + enabled: false, + tools: [ + "git-stats", + "cloc", + ], + }, + }, + # ============================================================================ + # BACKUP & ARCHIVAL + # ============================================================================ + backup: { + enabled: true, + # Create snapshots + snapshots: { + enabled: true, + frequency: "weekly", + retention: "4 weeks", + destination: ".rvc/snapshots", + compress: true, + exclude: [ + "node_modules", + "dist-newstyle", + ".git", + ], + }, + # Export artifacts + export: { + enabled: false, + formats: [ + "tar.gz", + "zip", + ], + destination: "dist/exports", + }, + }, + # ============================================================================ + # NOTIFICATIONS + # ============================================================================ + notifications: { + enabled: true, + # Console output + console: { + enabled: true, + verbosity: "info", # debug, info, warn, error + colour: true, + }, + # File reports + reports: { + enabled: true, + directory: ".rvc/reports", + formats: [ + "txt", + "json", + ], + retention: "30 days", + }, + # Email (disabled by default) + email: { + enabled: false, + recipients: [], + smtp: { + host: "", + port: 587, + use_tls: true, + }, + }, + }, + # ============================================================================ + # EXECUTION RULES + # ============================================================================ + execution: { + # Dry run mode (preview changes without applying) + dry_run: false, + # Confirmation for destructive operations + confirm_destructive: true, + # Parallel execution + parallel: { + enabled: true, + max_workers: 4, + }, + # Timeouts + timeouts: { + git_gc: "5 minutes", + npm_audit: "2 minutes", + link_validation: "10 minutes", + }, + # Error handling + error_handling: { + continue_on_error: true, + max_errors: 10, + log_errors: true, + }, + }, + # ============================================================================ + # EXCLUSIONS + # ============================================================================ + exclusions: { + # Paths to never touch + never_clean: [ + "LICENSES/", + "LICENSE_CORE/", + ".git/", + ".well-known/", + "GOVERNANCE.md", + "3-practice/SECURITY.md", + "CODE_OF_PRACTICE.md", + ], + # Files to never modify + never_modify: [ + "LICENSES/**/*.md", + "LICENSE_CORE/**/*.md", + "*.gpg", + "*.asc", + ], + # Patterns to ignore + ignore_patterns: [ + "*.backup", + "*.bak", + "*~", + ".env*", + ], + }, + # ============================================================================ + # CUSTOM SCRIPTS + # ============================================================================ + custom_scripts: { + enabled: true, + # Pre-cleanup hooks + pre_cleanup: [ + { + name: "validate-state", + script: ".rvc/scripts/pre-cleanup.sh", + required: true, + }, + ], + # Post-cleanup hooks + post_cleanup: [ + { + name: "generate-report", + script: ".rvc/scripts/post-cleanup.sh", + required: false, + }, + ], + # Custom maintenance tasks + maintenance: [ + { + name: "update-copyright-years", + script: ".rvc/scripts/update-copyright.sh", + schedule: "yearly", + enabled: false, + }, + ], + }, + # ============================================================================ + # LOGGING + # ============================================================================ + logging: { + enabled: true, + level: "info", + format: "text", # text or json + destination: ".rvc/rvc.log", + max_size: "10MB", + max_files: 5, + compress_old: true, + }, + # ============================================================================ + # COMPLIANCE + # ============================================================================ + compliance: { + # RSR compliance checks + rsr: { + enabled: true, + auto_fix: false, + checks: [ + "documentation_complete", + "well_known_present", + "spdx_headers", + "license_files", + ], + }, + # British English enforcement + spelling: { + enabled: true, + language: "en-GB", + auto_correct: false, + report_only: true, + }, + }, + # ============================================================================ + # VERSION & METADATA + # ============================================================================ + metadata: { + version: "0.4.0", + last_updated: "2025-11-28", + author: "Palimpsest Stewardship Council", + license: "Palimpsest-0.4 OR MIT", + documentation: "https://palimpsest.license/docs/rvc", + }, +} # End of RVC Configuration +--- +null diff --git a/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/haskell/stack.yaml b/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/haskell/stack.yaml index b3101a23e..5d2f95209 100644 --- a/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/haskell/stack.yaml +++ b/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/haskell/stack.yaml @@ -1,19 +1,19 @@ # SPDX-License-Identifier: MPL-2.0-or-later # SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council -resolver: lts-20.26 # GHC 9.2.8 - -packages: - - . - -extra-deps: [] - -# Build settings -build: - library-profiling: false - executable-profiling: false - copy-bins: true - haddock: false - -# Allow newer versions for compatibility -allow-newer: true +{ + resolver: "lts-20.26", # GHC 9.2.8 + packages: [ + ".", + ], + extra-deps: [], + # Build settings + build: { + library-profiling: false, + executable-profiling: false, + copy-bins: true, + haddock: false, + }, + # Allow newer versions for compatibility + allow-newer: true, +} diff --git a/rhodium-standard-repositories/satellites/palimpsest-license/integrations/api/openapi/palimpsest-license-api.yaml b/rhodium-standard-repositories/satellites/palimpsest-license/integrations/api/openapi/palimpsest-license-api.yaml index c3eab29b4..281d1edb9 100644 --- a/rhodium-standard-repositories/satellites/palimpsest-license/integrations/api/openapi/palimpsest-license-api.yaml +++ b/rhodium-standard-repositories/satellites/palimpsest-license/integrations/api/openapi/palimpsest-license-api.yaml @@ -1,441 +1,649 @@ # SPDX-License-Identifier: MPL-2.0-or-later # SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council -openapi: 3.1.0 -info: - title: Palimpsest License API - version: 0.4.0 - description: | - API for validating and retrieving Palimpsest License metadata. - - The Palimpsest License is a future-proof, layered licensing framework designed for - creative work in the age of AI. This API provides endpoints for license validation, - metadata retrieval, and compliance checking. - - contact: - name: Palimpsest License Team - email: hello@palimpsestlicense.org - url: https://palimpsestlicense.org - - license: - name: Palimpsest-0.4 - url: https://palimpsestlicense.org/v0.4 - -servers: - - url: https://api.palimpsestlicense.org/v1 - description: Production server - - url: https://staging-api.palimpsestlicense.org/v1 - description: Staging server - - url: http://localhost:3000/v1 - description: Development server - -tags: - - name: License - description: License information and validation - - name: Metadata - description: License metadata operations - - name: Validation - description: Validation and compliance checking - -paths: - /licenses/{version}: - get: - tags: - - License - summary: Get license information - description: Retrieve information about a specific version of the Palimpsest License - operationId: getLicenseVersion - parameters: - - name: version - in: path - required: true - description: License version (e.g., "0.4") - schema: - type: string - pattern: '^\d+\.\d+$' - example: "0.4" - - name: format - in: query - description: Response format - schema: - type: string - enum: [json, markdown, html, text] - default: json - responses: - '200': - description: License information retrieved successfully - content: - application/json: - schema: - $ref: '#/components/schemas/LicenseInfo' - '404': - description: License version not found - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /validate/metadata: - post: - tags: - - Validation - summary: Validate license metadata - description: Validate JSON-LD metadata for Palimpsest License compliance - operationId: validateMetadata - requestBody: - required: true - content: - application/json: - schema: - $ref: '#/components/schemas/Metadata' - responses: - '200': - description: Validation result - content: - application/json: - schema: - $ref: '#/components/schemas/ValidationResult' - '400': - description: Invalid request body - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /validate/url: - post: - tags: - - Validation - summary: Validate URL for license metadata - description: Check if a URL contains valid Palimpsest License metadata - operationId: validateUrl - requestBody: - required: true - content: - application/json: - schema: - type: object - required: - - url - properties: - url: - type: string - format: uri - description: URL to validate - example: https://example.com - checkHtml: - type: boolean - description: Check HTML meta tags - default: true - checkJsonLd: - type: boolean - description: Check JSON-LD metadata - default: true - responses: - '200': - description: URL validation result - content: - application/json: - schema: - $ref: '#/components/schemas/UrlValidationResult' - '400': - description: Invalid URL - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /metadata/generate: - post: - tags: - - Metadata - summary: Generate license metadata - description: Generate Palimpsest License metadata in various formats - operationId: generateMetadata - requestBody: - required: true - content: - application/json: - schema: - $ref: '#/components/schemas/MetadataGenerationRequest' - responses: - '200': - description: Metadata generated successfully - content: - application/json: - schema: - $ref: '#/components/schemas/GeneratedMetadata' - '400': - description: Invalid request - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - - /compliance/check: - post: - tags: - - Validation - summary: Check compliance status - description: Comprehensive compliance check for Palimpsest License - operationId: checkCompliance - requestBody: - required: true - content: - application/json: - schema: - type: object - required: - - metadata - properties: - metadata: - $ref: '#/components/schemas/Metadata' - strictMode: - type: boolean - description: Enable strict validation - default: false - responses: - '200': - description: Compliance check result - content: - application/json: - schema: - $ref: '#/components/schemas/ComplianceResult' - -components: - schemas: - LicenseInfo: - type: object - required: - - version - - name - - identifier - - url - properties: - version: - type: string - example: "0.4" - name: - type: string - example: "Palimpsest License v0.4" - identifier: - type: string - example: "Palimpsest-0.4" - url: - type: string - format: uri - example: "https://palimpsestlicense.org/v0.4" - fullText: - type: string - description: Full license text - summary: - type: string - description: Brief summary of the license - features: - type: array - items: - type: string - example: - - "Emotional lineage protection" - - "AGI consent requirements" - - "Metadata preservation" - - Metadata: - type: object - required: - - "@type" - - license - - author - properties: - "@context": - type: string - example: "https://schema.org" - "@type": - type: string - enum: [CreativeWork] - name: - type: string - description: Work title - license: - type: string - format: uri - description: License URL - author: - type: object - required: - - name - properties: - "@type": - type: string - enum: [Person, Organization] - name: - type: string - url: - type: string - format: uri - additionalProperty: - type: array - items: - $ref: '#/components/schemas/PropertyValue' - - PropertyValue: - type: object - required: - - "@type" - - name - - value - properties: - "@type": - type: string - enum: [PropertyValue] - name: - type: string - example: "Palimpsest:Version" - value: - oneOf: - - type: string - - type: boolean - - type: number - - ValidationResult: - type: object - required: - - valid - - errors - - warnings - properties: - valid: - type: boolean - description: Whether metadata is valid - errors: - type: array - items: - type: string - description: Validation errors - warnings: - type: array - items: - type: string - description: Validation warnings - metadata: - $ref: '#/components/schemas/Metadata' - - UrlValidationResult: - type: object - required: - - url - - valid - - metadataFound - properties: - url: - type: string - format: uri - valid: - type: boolean - metadataFound: - type: boolean - metadata: - $ref: '#/components/schemas/Metadata' - errors: - type: array - items: - type: string - sources: - type: array - items: - type: string - enum: [html-meta, jsonld, http-headers] - - MetadataGenerationRequest: - type: object - required: - - workTitle - - authorName - properties: - workTitle: - type: string - authorName: - type: string - authorUrl: - type: string - format: uri - emotionalLineage: - type: string - version: - type: string - default: "0.4" - agiConsentRequired: - type: boolean - default: true - format: - type: string - enum: [jsonld, html-meta, http-headers, all] - default: jsonld - - GeneratedMetadata: - type: object - properties: - jsonld: - type: string - description: JSON-LD metadata - htmlMeta: - type: string - description: HTML meta tags - httpHeaders: - type: object - additionalProperties: - type: string - description: HTTP headers - - ComplianceResult: - type: object - required: - - compliant - - checks - properties: - compliant: - type: boolean - checks: - type: object - properties: - metadataPresent: - type: boolean - requiredFieldsPresent: - type: boolean - emotionalLineageDeclared: - type: boolean - agiConsentSpecified: - type: boolean - recommendations: - type: array - items: - type: string - errors: - type: array - items: - type: string - - Error: - type: object - required: - - error - - message - properties: - error: - type: string - message: - type: string - code: - type: string - details: - type: object - - securitySchemes: - ApiKey: - type: apiKey - in: header - name: X-API-Key - description: API key for authentication - -security: - - ApiKey: [] +{ + openapi: "3.1.0", + info: { + title: "Palimpsest License API", + version: "0.4.0", + description: "API for validating and retrieving Palimpsest License metadata.\n\nThe Palimpsest License is a future-proof, layered licensing framework designed for\ncreative work in the age of AI. This API provides endpoints for license validation,\nmetadata retrieval, and compliance checking.\n", + contact: { + name: "Palimpsest License Team", + email: "hello@palimpsestlicense.org", + url: "https://palimpsestlicense.org", + }, + license: { + name: "Palimpsest-0.4", + url: "https://palimpsestlicense.org/v0.4", + }, + }, + servers: [ + { + url: "https://api.palimpsestlicense.org/v1", + description: "Production server", + }, + { + url: "https://staging-api.palimpsestlicense.org/v1", + description: "Staging server", + }, + { + url: "http://localhost:3000/v1", + description: "Development server", + }, + ], + tags: [ + { + name: "License", + description: "License information and validation", + }, + { + name: "Metadata", + description: "License metadata operations", + }, + { + name: "Validation", + description: "Validation and compliance checking", + }, + ], + paths: { + "/licenses/{version}": { + get: { + tags: [ + "License", + ], + summary: "Get license information", + description: "Retrieve information about a specific version of the Palimpsest License", + operationId: "getLicenseVersion", + parameters: [ + { + name: "version", + in: "path", + required: true, + description: "License version (e.g., \"0.4\")", + schema: { + type: "string", + pattern: "^\\d+\\.\\d+$", + example: "0.4", + }, + }, + { + name: "format", + in: "query", + description: "Response format", + schema: { + type: "string", + enum: [ + "json", + "markdown", + "html", + "text", + ], + default: "json", + }, + }, + ], + responses: { + "200": { + description: "License information retrieved successfully", + content: { + "application/json": { + schema: { + "$ref": "#/components/schemas/LicenseInfo", + }, + }, + }, + }, + "404": { + description: "License version not found", + content: { + "application/json": { + schema: { + "$ref": "#/components/schemas/Error", + }, + }, + }, + }, + }, + }, + }, + "/validate/metadata": { + post: { + tags: [ + "Validation", + ], + summary: "Validate license metadata", + description: "Validate JSON-LD metadata for Palimpsest License compliance", + operationId: "validateMetadata", + requestBody: { + required: true, + content: { + "application/json": { + schema: { + "$ref": "#/components/schemas/Metadata", + }, + }, + }, + }, + responses: { + "200": { + description: "Validation result", + content: { + "application/json": { + schema: { + "$ref": "#/components/schemas/ValidationResult", + }, + }, + }, + }, + "400": { + description: "Invalid request body", + content: { + "application/json": { + schema: { + "$ref": "#/components/schemas/Error", + }, + }, + }, + }, + }, + }, + }, + "/validate/url": { + post: { + tags: [ + "Validation", + ], + summary: "Validate URL for license metadata", + description: "Check if a URL contains valid Palimpsest License metadata", + operationId: "validateUrl", + requestBody: { + required: true, + content: { + "application/json": { + schema: { + type: "object", + required: [ + "url", + ], + properties: { + url: { + type: "string", + format: "uri", + description: "URL to validate", + example: "https://example.com", + }, + checkHtml: { + type: "boolean", + description: "Check HTML meta tags", + default: true, + }, + checkJsonLd: { + type: "boolean", + description: "Check JSON-LD metadata", + default: true, + }, + }, + }, + }, + }, + }, + responses: { + "200": { + description: "URL validation result", + content: { + "application/json": { + schema: { + "$ref": "#/components/schemas/UrlValidationResult", + }, + }, + }, + }, + "400": { + description: "Invalid URL", + content: { + "application/json": { + schema: { + "$ref": "#/components/schemas/Error", + }, + }, + }, + }, + }, + }, + }, + "/metadata/generate": { + post: { + tags: [ + "Metadata", + ], + summary: "Generate license metadata", + description: "Generate Palimpsest License metadata in various formats", + operationId: "generateMetadata", + requestBody: { + required: true, + content: { + "application/json": { + schema: { + "$ref": "#/components/schemas/MetadataGenerationRequest", + }, + }, + }, + }, + responses: { + "200": { + description: "Metadata generated successfully", + content: { + "application/json": { + schema: { + "$ref": "#/components/schemas/GeneratedMetadata", + }, + }, + }, + }, + "400": { + description: "Invalid request", + content: { + "application/json": { + schema: { + "$ref": "#/components/schemas/Error", + }, + }, + }, + }, + }, + }, + }, + "/compliance/check": { + post: { + tags: [ + "Validation", + ], + summary: "Check compliance status", + description: "Comprehensive compliance check for Palimpsest License", + operationId: "checkCompliance", + requestBody: { + required: true, + content: { + "application/json": { + schema: { + type: "object", + required: [ + "metadata", + ], + properties: { + metadata: { + "$ref": "#/components/schemas/Metadata", + }, + strictMode: { + type: "boolean", + description: "Enable strict validation", + default: false, + }, + }, + }, + }, + }, + }, + responses: { + "200": { + description: "Compliance check result", + content: { + "application/json": { + schema: { + "$ref": "#/components/schemas/ComplianceResult", + }, + }, + }, + }, + }, + }, + }, + }, + components: { + schemas: { + LicenseInfo: { + type: "object", + required: [ + "version", + "name", + "identifier", + "url", + ], + properties: { + version: { + type: "string", + example: "0.4", + }, + name: { + type: "string", + example: "Palimpsest License v0.4", + }, + identifier: { + type: "string", + example: "Palimpsest-0.4", + }, + url: { + type: "string", + format: "uri", + example: "https://palimpsestlicense.org/v0.4", + }, + fullText: { + type: "string", + description: "Full license text", + }, + summary: { + type: "string", + description: "Brief summary of the license", + }, + features: { + type: "array", + items: { + type: "string", + }, + example: [ + "Emotional lineage protection", + "AGI consent requirements", + "Metadata preservation", + ], + }, + }, + }, + Metadata: { + type: "object", + required: [ + "@type", + "license", + "author", + ], + properties: { + "@context": { + type: "string", + example: "https://schema.org", + }, + "@type": { + type: "string", + enum: [ + "CreativeWork", + ], + }, + name: { + type: "string", + description: "Work title", + }, + license: { + type: "string", + format: "uri", + description: "License URL", + }, + author: { + type: "object", + required: [ + "name", + ], + properties: { + "@type": { + type: "string", + enum: [ + "Person", + "Organization", + ], + }, + name: { + type: "string", + }, + url: { + type: "string", + format: "uri", + }, + }, + }, + additionalProperty: { + type: "array", + items: { + "$ref": "#/components/schemas/PropertyValue", + }, + }, + }, + }, + PropertyValue: { + type: "object", + required: [ + "@type", + "name", + "value", + ], + properties: { + "@type": { + type: "string", + enum: [ + "PropertyValue", + ], + }, + name: { + type: "string", + example: "Palimpsest:Version", + }, + value: { + oneOf: [ + { + type: "string", + }, + { + type: "boolean", + }, + { + type: "number", + }, + ], + }, + }, + }, + ValidationResult: { + type: "object", + required: [ + "valid", + "errors", + "warnings", + ], + properties: { + valid: { + type: "boolean", + description: "Whether metadata is valid", + }, + errors: { + type: "array", + items: { + type: "string", + }, + description: "Validation errors", + }, + warnings: { + type: "array", + items: { + type: "string", + }, + description: "Validation warnings", + }, + metadata: { + "$ref": "#/components/schemas/Metadata", + }, + }, + }, + UrlValidationResult: { + type: "object", + required: [ + "url", + "valid", + "metadataFound", + ], + properties: { + url: { + type: "string", + format: "uri", + }, + valid: { + type: "boolean", + }, + metadataFound: { + type: "boolean", + }, + metadata: { + "$ref": "#/components/schemas/Metadata", + }, + errors: { + type: "array", + items: { + type: "string", + }, + }, + sources: { + type: "array", + items: { + type: "string", + enum: [ + "html-meta", + "jsonld", + "http-headers", + ], + }, + }, + }, + }, + MetadataGenerationRequest: { + type: "object", + required: [ + "workTitle", + "authorName", + ], + properties: { + workTitle: { + type: "string", + }, + authorName: { + type: "string", + }, + authorUrl: { + type: "string", + format: "uri", + }, + emotionalLineage: { + type: "string", + }, + version: { + type: "string", + default: "0.4", + }, + agiConsentRequired: { + type: "boolean", + default: true, + }, + format: { + type: "string", + enum: [ + "jsonld", + "html-meta", + "http-headers", + "all", + ], + default: "jsonld", + }, + }, + }, + GeneratedMetadata: { + type: "object", + properties: { + jsonld: { + type: "string", + description: "JSON-LD metadata", + }, + htmlMeta: { + type: "string", + description: "HTML meta tags", + }, + httpHeaders: { + type: "object", + additionalProperties: { + type: "string", + }, + description: "HTTP headers", + }, + }, + }, + ComplianceResult: { + type: "object", + required: [ + "compliant", + "checks", + ], + properties: { + compliant: { + type: "boolean", + }, + checks: { + type: "object", + properties: { + metadataPresent: { + type: "boolean", + }, + requiredFieldsPresent: { + type: "boolean", + }, + emotionalLineageDeclared: { + type: "boolean", + }, + agiConsentSpecified: { + type: "boolean", + }, + }, + }, + recommendations: { + type: "array", + items: { + type: "string", + }, + }, + errors: { + type: "array", + items: { + type: "string", + }, + }, + }, + }, + Error: { + type: "object", + required: [ + "error", + "message", + ], + properties: { + error: { + type: "string", + }, + message: { + type: "string", + }, + code: { + type: "string", + }, + details: { + type: "object", + }, + }, + }, + }, + securitySchemes: { + ApiKey: { + type: "apiKey", + in: "header", + name: "X-API-Key", + description: "API key for authentication", + }, + }, + }, + security: [ + { + ApiKey: [], + }, + ], +} diff --git a/rhodium-standard-repositories/satellites/rsr-certifier/FUNDING.yml b/rhodium-standard-repositories/satellites/rsr-certifier/FUNDING.yml index 12a1eadb0..b23a3eebc 100644 --- a/rhodium-standard-repositories/satellites/rsr-certifier/FUNDING.yml +++ b/rhodium-standard-repositories/satellites/rsr-certifier/FUNDING.yml @@ -1,8 +1,14 @@ +# SPDX-License-Identifier: MPL-2.0 # RSR-Certified Funding # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository -github: [Hyperpolymath] -open_collective: rsr-certified -custom: - - https://rsr-certified.dev/donate - - https://buymeacoffee.com/rsrcertified +{ + github: [ + "Hyperpolymath", + ], + open_collective: "rsr-certified", + custom: [ + "https://rsr-certified.dev/donate", + "https://buymeacoffee.com/rsrcertified", + ], +} diff --git a/rhodium-standard-repositories/satellites/rsr-certifier/container/compose.yml b/rhodium-standard-repositories/satellites/rsr-certifier/container/compose.yml index 63089303a..bfa1317cb 100644 --- a/rhodium-standard-repositories/satellites/rsr-certifier/container/compose.yml +++ b/rhodium-standard-repositories/satellites/rsr-certifier/container/compose.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # RSR-Certified Docker/Podman Compose Configuration # # Multi-database architecture for production compliance tracking: @@ -9,219 +10,283 @@ # docker compose up -d # podman-compose up -d -name: rsr-certified - -services: - # ============================================================ - # RSR ENGINE - Core compliance checking service - # ============================================================ - rsr-engine: - build: - context: .. - dockerfile: container/Containerfile - image: ghcr.io/hyperpolymath/rsr-certified:latest - container_name: rsr-engine - restart: unless-stopped - ports: - - "8080:8080" - environment: - - RSR_LOG_LEVEL=${RSR_LOG_LEVEL:-info} - - RSR_PLATFORMS=${RSR_PLATFORMS:-github,gitlab,bitbucket,gitea} - # Database connections - - RSR_DRAGONFLY_URL=redis://dragonfly:6379 - - RSR_SURREALDB_URL=ws://surrealdb:8000 - - RSR_SURREALDB_NS=rsr - - RSR_SURREALDB_DB=compliance - - RSR_ARANGODB_URL=https://arangodb:8529 - - RSR_ARANGODB_DB=rsr_graphs - # Platform credentials (set via .env file) - - GITHUB_APP_ID=${GITHUB_APP_ID:-} - - GITHUB_PRIVATE_KEY=${GITHUB_PRIVATE_KEY:-} - - GITHUB_WEBHOOK_SECRET=${GITHUB_WEBHOOK_SECRET:-} - - GITLAB_TOKEN=${GITLAB_TOKEN:-} - - GITLAB_WEBHOOK_SECRET=${GITLAB_WEBHOOK_SECRET:-} - - BITBUCKET_TOKEN=${BITBUCKET_TOKEN:-} - - GITEA_TOKEN=${GITEA_TOKEN:-} - - GITEA_URL=${GITEA_URL:-} - volumes: - - rsr-config:/etc/rsr:ro - - rsr-cache:/var/cache/rsr - depends_on: - dragonfly: - condition: service_healthy - surrealdb: - condition: service_healthy - arangodb: - condition: service_healthy - healthcheck: - test: ["CMD", "wget", "--spider", "-q", "http://localhost:8080/health"] - interval: 30s - timeout: 10s - retries: 3 - start_period: 10s - networks: - - rsr-network - - # ============================================================ - # RSR WORKER - Background job processor - # ============================================================ - rsr-worker: - build: - context: .. - dockerfile: container/Containerfile - image: ghcr.io/hyperpolymath/rsr-certified:latest - container_name: rsr-worker - restart: unless-stopped - command: ["rsr", "serve", "--worker-only"] - environment: - - RSR_LOG_LEVEL=${RSR_LOG_LEVEL:-info} - - RSR_DRAGONFLY_URL=redis://dragonfly:6379 - - RSR_SURREALDB_URL=ws://surrealdb:8000 - - RSR_SURREALDB_NS=rsr - - RSR_SURREALDB_DB=compliance - - RSR_ARANGODB_URL=https://arangodb:8529 - - RSR_ARANGODB_DB=rsr_graphs - - GITHUB_TOKEN=${GITHUB_TOKEN:-} - - GITLAB_TOKEN=${GITLAB_TOKEN:-} - - BITBUCKET_TOKEN=${BITBUCKET_TOKEN:-} - volumes: - - rsr-config:/etc/rsr:ro - - rsr-cache:/var/cache/rsr - depends_on: - - dragonfly - - surrealdb - networks: - - rsr-network - - # ============================================================ - # DRAGONFLY - Redis-compatible cache and job queue - # 25x faster than Redis, drop-in replacement +{ + name: "rsr-certified", + services: { + # ============================================================ + # RSR ENGINE - Core compliance checking service + # ============================================================ + rsr-engine: { + build: { + context: "..", + dockerfile: "container/Containerfile", + }, + image: "ghcr.io/hyperpolymath/rsr-certified:latest", + container_name: "rsr-engine", + restart: "unless-stopped", + ports: [ + "8080:8080", + ], + environment: [ + "RSR_LOG_LEVEL=${RSR_LOG_LEVEL:-info}", + "RSR_PLATFORMS=${RSR_PLATFORMS:-github,gitlab,bitbucket,gitea}", + # Database connections + "RSR_DRAGONFLY_URL=redis://dragonfly:6379", + "RSR_SURREALDB_URL=ws://surrealdb:8000", + "RSR_SURREALDB_NS=rsr", + "RSR_SURREALDB_DB=compliance", + "RSR_ARANGODB_URL=https://arangodb:8529", + "RSR_ARANGODB_DB=rsr_graphs", + # Platform credentials (set via .env file) + "GITHUB_APP_ID=${GITHUB_APP_ID:-}", + "GITHUB_PRIVATE_KEY=${GITHUB_PRIVATE_KEY:-}", + "GITHUB_WEBHOOK_SECRET=${GITHUB_WEBHOOK_SECRET:-}", + "GITLAB_TOKEN=${GITLAB_TOKEN:-}", + "GITLAB_WEBHOOK_SECRET=${GITLAB_WEBHOOK_SECRET:-}", + "BITBUCKET_TOKEN=${BITBUCKET_TOKEN:-}", + "GITEA_TOKEN=${GITEA_TOKEN:-}", + "GITEA_URL=${GITEA_URL:-}", + ], + volumes: [ + "rsr-config:/etc/rsr:ro", + "rsr-cache:/var/cache/rsr", + ], + depends_on: { + dragonfly: { + condition: "service_healthy", + }, + surrealdb: { + condition: "service_healthy", + }, + arangodb: { + condition: "service_healthy", + }, + }, + healthcheck: { + test: [ + "CMD", + "wget", + "--spider", + "-q", + "http://localhost:8080/health", + ], + interval: "30s", + timeout: "10s", + retries: 3, + start_period: "10s", + }, + networks: [ + "rsr-network", + ], + }, + # ============================================================ + # RSR WORKER - Background job processor + # ============================================================ + rsr-worker: { + build: { + context: "..", + dockerfile: "container/Containerfile", + }, + image: "ghcr.io/hyperpolymath/rsr-certified:latest", + container_name: "rsr-worker", + restart: "unless-stopped", + command: [ + "rsr", + "serve", + "--worker-only", + ], + environment: [ + "RSR_LOG_LEVEL=${RSR_LOG_LEVEL:-info}", + "RSR_DRAGONFLY_URL=redis://dragonfly:6379", + "RSR_SURREALDB_URL=ws://surrealdb:8000", + "RSR_SURREALDB_NS=rsr", + "RSR_SURREALDB_DB=compliance", + "RSR_ARANGODB_URL=https://arangodb:8529", + "RSR_ARANGODB_DB=rsr_graphs", + "GITHUB_TOKEN=${GITHUB_TOKEN:-}", + "GITLAB_TOKEN=${GITLAB_TOKEN:-}", + "BITBUCKET_TOKEN=${BITBUCKET_TOKEN:-}", + ], + volumes: [ + "rsr-config:/etc/rsr:ro", + "rsr-cache:/var/cache/rsr", + ], + depends_on: [ + "dragonfly", + "surrealdb", + ], + networks: [ + "rsr-network", + ], + }, + # ============================================================ + # DRAGONFLY - Redis-compatible cache and job queue + # 25x faster than Redis, drop-in replacement + # ============================================================ + dragonfly: { + image: "docker.dragonflydb.io/dragonflydb/dragonfly:latest", + container_name: "rsr-dragonfly", + restart: "unless-stopped", + command: "--logtostderr --cache_mode=true --maxmemory=512mb --hz=100\n", + ports: [ + "6379:6379", + ], + volumes: [ + "dragonfly-data:/data", + ], + healthcheck: { + test: [ + "CMD", + "redis-cli", + "ping", + ], + interval: "10s", + timeout: "5s", + retries: 5, + }, + ulimits: { + memlock: -1, + }, + networks: [ + "rsr-network", + ], + }, + # ============================================================ + # SURREALDB - Multi-model database for compliance data + # Documents, graphs, and relations in one database + # ============================================================ + surrealdb: { + image: "surrealdb/surrealdb:latest", + container_name: "rsr-surrealdb", + restart: "unless-stopped", + command: "start --log trace --user root --pass ${SURREALDB_ROOT_PASSWORD:-changeme} file:/data/srdb.db\n", + ports: [ + "8000:8000", + ], + volumes: [ + "surrealdb-data:/data", + ], + healthcheck: { + test: [ + "CMD", + "curl", + "-f", + "http://localhost:8000/health", + ], + interval: "10s", + timeout: "5s", + retries: 5, + start_period: "10s", + }, + networks: [ + "rsr-network", + ], + }, + # ============================================================ + # ARANGODB - Graph database for dependency tracking + # Native graph queries, excellent for dependency trees + # ============================================================ + arangodb: { + image: "arangodb:3.11", + container_name: "rsr-arangodb", + restart: "unless-stopped", + environment: [ + "ARANGO_ROOT_PASSWORD=${ARANGODB_ROOT_PASSWORD:-changeme}", + "ARANGODB_OVERRIDE_DETECTED_TOTAL_MEMORY=1073741824", + ], + ports: [ + "8529:8529", + ], + volumes: [ + "arangodb-data:/var/lib/arangodb3", + "arangodb-apps:/var/lib/arangodb3-apps", + ], + healthcheck: { + test: [ + "CMD", + "curl", + "-f", + "http://localhost:8529/_api/version", + ], + interval: "10s", + timeout: "5s", + retries: 5, + start_period: "15s", + }, + networks: [ + "rsr-network", + ], + }, + # ============================================================ + # INIT CONTAINER - Database schema initialization + # ============================================================ + rsr-init: { + build: { + context: "..", + dockerfile: "container/Containerfile", + }, + image: "ghcr.io/hyperpolymath/rsr-certified:latest", + container_name: "rsr-init", + command: [ + "rsr", + "db", + "migrate", + ], + environment: [ + "RSR_SURREALDB_URL=ws://surrealdb:8000", + "RSR_SURREALDB_NS=rsr", + "RSR_SURREALDB_DB=compliance", + "RSR_SURREALDB_USER=root", + "RSR_SURREALDB_PASS=${SURREALDB_ROOT_PASSWORD:-changeme}", + "RSR_ARANGODB_URL=https://arangodb:8529", + "RSR_ARANGODB_DB=rsr_graphs", + "RSR_ARANGODB_USER=root", + "RSR_ARANGODB_PASS=${ARANGODB_ROOT_PASSWORD:-changeme}", + ], + depends_on: { + surrealdb: { + condition: "service_healthy", + }, + arangodb: { + condition: "service_healthy", + }, + }, + networks: [ + "rsr-network", + ], + restart: "no", + }, + }, # ============================================================ - dragonfly: - image: docker.dragonflydb.io/dragonflydb/dragonfly:latest - container_name: rsr-dragonfly - restart: unless-stopped - command: > - --logtostderr - --cache_mode=true - --maxmemory=512mb - --hz=100 - ports: - - "6379:6379" - volumes: - - dragonfly-data:/data - healthcheck: - test: ["CMD", "redis-cli", "ping"] - interval: 10s - timeout: 5s - retries: 5 - ulimits: - memlock: -1 - networks: - - rsr-network - - # ============================================================ - # SURREALDB - Multi-model database for compliance data - # Documents, graphs, and relations in one database - # ============================================================ - surrealdb: - image: surrealdb/surrealdb:latest - container_name: rsr-surrealdb - restart: unless-stopped - command: > - start - --log trace - --user root - --pass ${SURREALDB_ROOT_PASSWORD:-changeme} - file:/data/srdb.db - ports: - - "8000:8000" - volumes: - - surrealdb-data:/data - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:8000/health"] - interval: 10s - timeout: 5s - retries: 5 - start_period: 10s - networks: - - rsr-network - + # VOLUMES # ============================================================ - # ARANGODB - Graph database for dependency tracking - # Native graph queries, excellent for dependency trees + volumes: { + rsr-config: { + name: "rsr-config", + }, + rsr-cache: { + name: "rsr-cache", + }, + dragonfly-data: { + name: "rsr-dragonfly-data", + }, + surrealdb-data: { + name: "rsr-surrealdb-data", + }, + arangodb-data: { + name: "rsr-arangodb-data", + }, + arangodb-apps: { + name: "rsr-arangodb-apps", + }, + }, # ============================================================ - arangodb: - image: arangodb:3.11 - container_name: rsr-arangodb - restart: unless-stopped - environment: - - ARANGO_ROOT_PASSWORD=${ARANGODB_ROOT_PASSWORD:-changeme} - - ARANGODB_OVERRIDE_DETECTED_TOTAL_MEMORY=1073741824 - ports: - - "8529:8529" - volumes: - - arangodb-data:/var/lib/arangodb3 - - arangodb-apps:/var/lib/arangodb3-apps - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:8529/_api/version"] - interval: 10s - timeout: 5s - retries: 5 - start_period: 15s - networks: - - rsr-network - - # ============================================================ - # INIT CONTAINER - Database schema initialization + # NETWORKS # ============================================================ - rsr-init: - build: - context: .. - dockerfile: container/Containerfile - image: ghcr.io/hyperpolymath/rsr-certified:latest - container_name: rsr-init - command: ["rsr", "db", "migrate"] - environment: - - RSR_SURREALDB_URL=ws://surrealdb:8000 - - RSR_SURREALDB_NS=rsr - - RSR_SURREALDB_DB=compliance - - RSR_SURREALDB_USER=root - - RSR_SURREALDB_PASS=${SURREALDB_ROOT_PASSWORD:-changeme} - - RSR_ARANGODB_URL=https://arangodb:8529 - - RSR_ARANGODB_DB=rsr_graphs - - RSR_ARANGODB_USER=root - - RSR_ARANGODB_PASS=${ARANGODB_ROOT_PASSWORD:-changeme} - depends_on: - surrealdb: - condition: service_healthy - arangodb: - condition: service_healthy - networks: - - rsr-network - restart: "no" - -# ============================================================ -# VOLUMES -# ============================================================ -volumes: - rsr-config: - name: rsr-config - rsr-cache: - name: rsr-cache - dragonfly-data: - name: rsr-dragonfly-data - surrealdb-data: - name: rsr-surrealdb-data - arangodb-data: - name: rsr-arangodb-data - arangodb-apps: - name: rsr-arangodb-apps - -# ============================================================ -# NETWORKS -# ============================================================ -networks: - rsr-network: - name: rsr-network - driver: bridge + networks: { + rsr-network: { + name: "rsr-network", + driver: "bridge", + }, + }, +} diff --git a/rhodium-standard-repositories/satellites/rsr-certifier/container/k8s/deployment.yaml b/rhodium-standard-repositories/satellites/rsr-certifier/container/k8s/deployment.yaml index b0ad029b9..63728943a 100644 --- a/rhodium-standard-repositories/satellites/rsr-certifier/container/k8s/deployment.yaml +++ b/rhodium-standard-repositories/satellites/rsr-certifier/container/k8s/deployment.yaml @@ -1,130 +1,211 @@ +# SPDX-License-Identifier: MPL-2.0 # Kubernetes deployment for RSR-Certified -apiVersion: apps/v1 -kind: Deployment -metadata: - name: rsr-engine - labels: - app: rsr-certified - component: engine -spec: - replicas: 2 - selector: - matchLabels: - app: rsr-certified - component: engine - template: - metadata: - labels: - app: rsr-certified - component: engine - spec: - securityContext: - runAsNonRoot: true - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - containers: - - name: rsr-engine - image: ghcr.io/hyperpolymath/rsr-certified:latest - imagePullPolicy: Always - ports: - - name: http - containerPort: 8080 - protocol: TCP - env: - - name: RSR_LOG_LEVEL - value: "info" - - name: RSR_PLATFORMS - value: "github,gitlab,bitbucket" - - name: RSR_REDIS_URL - valueFrom: - secretKeyRef: - name: rsr-secrets - key: redis-url - - name: GITHUB_WEBHOOK_SECRET - valueFrom: - secretKeyRef: - name: rsr-secrets - key: github-webhook-secret - optional: true - resources: - requests: - memory: "128Mi" - cpu: "100m" - limits: - memory: "512Mi" - cpu: "500m" - livenessProbe: - httpGet: - path: /health - port: http - initialDelaySeconds: 10 - periodSeconds: 30 - timeoutSeconds: 5 - readinessProbe: - httpGet: - path: /health - port: http - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 3 - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - volumeMounts: - - name: cache - mountPath: /var/cache/rsr - - name: tmp - mountPath: /tmp - volumes: - - name: cache - emptyDir: {} - - name: tmp - emptyDir: {} +{ + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + name: "rsr-engine", + labels: { + app: "rsr-certified", + component: "engine", + }, + }, + spec: { + replicas: 2, + selector: { + matchLabels: { + app: "rsr-certified", + component: "engine", + }, + }, + template: { + metadata: { + labels: { + app: "rsr-certified", + component: "engine", + }, + }, + spec: { + securityContext: { + runAsNonRoot: true, + runAsUser: 1000, + runAsGroup: 1000, + fsGroup: 1000, + }, + containers: [ + { + name: "rsr-engine", + image: "ghcr.io/hyperpolymath/rsr-certified:latest", + imagePullPolicy: "Always", + ports: [ + { + name: "http", + containerPort: 8080, + protocol: "TCP", + }, + ], + env: [ + { + name: "RSR_LOG_LEVEL", + value: "info", + }, + { + name: "RSR_PLATFORMS", + value: "github,gitlab,bitbucket", + }, + { + name: "RSR_REDIS_URL", + valueFrom: { + secretKeyRef: { + name: "rsr-secrets", + key: "redis-url", + }, + }, + }, + { + name: "GITHUB_WEBHOOK_SECRET", + valueFrom: { + secretKeyRef: { + name: "rsr-secrets", + key: "github-webhook-secret", + optional: true, + }, + }, + }, + ], + resources: { + requests: { + memory: "128Mi", + cpu: "100m", + }, + limits: { + memory: "512Mi", + cpu: "500m", + }, + }, + livenessProbe: { + httpGet: { + path: "/health", + port: "http", + }, + initialDelaySeconds: 10, + periodSeconds: 30, + timeoutSeconds: 5, + }, + readinessProbe: { + httpGet: { + path: "/health", + port: "http", + }, + initialDelaySeconds: 5, + periodSeconds: 10, + timeoutSeconds: 3, + }, + securityContext: { + allowPrivilegeEscalation: false, + readOnlyRootFilesystem: true, + capabilities: { + drop: [ + "ALL", + ], + }, + }, + volumeMounts: [ + { + name: "cache", + mountPath: "/var/cache/rsr", + }, + { + name: "tmp", + mountPath: "/tmp", + }, + ], + }, + ], + volumes: [ + { + name: "cache", + emptyDir: {}, + }, + { + name: "tmp", + emptyDir: {}, + }, + ], + }, + }, + }, +} --- -apiVersion: v1 -kind: Service -metadata: - name: rsr-engine - labels: - app: rsr-certified - component: engine -spec: - type: ClusterIP - ports: - - port: 80 - targetPort: http - protocol: TCP - name: http - selector: - app: rsr-certified - component: engine +{ + apiVersion: "v1", + kind: "Service", + metadata: { + name: "rsr-engine", + labels: { + app: "rsr-certified", + component: "engine", + }, + }, + spec: { + type: "ClusterIP", + ports: [ + { + port: 80, + targetPort: "http", + protocol: "TCP", + name: "http", + }, + ], + selector: { + app: "rsr-certified", + component: "engine", + }, + }, +} --- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: rsr-engine - labels: - app: rsr-certified - annotations: - kubernetes.io/ingress.class: nginx - cert-manager.io/cluster-issuer: letsencrypt-prod -spec: - tls: - - hosts: - - rsr.example.com - secretName: rsr-tls - rules: - - host: rsr.example.com - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: rsr-engine - port: - name: http +{ + apiVersion: "networking.k8s.io/v1", + kind: "Ingress", + metadata: { + name: "rsr-engine", + labels: { + app: "rsr-certified", + }, + annotations: { + "kubernetes.io/ingress.class": "nginx", + "cert-manager.io/cluster-issuer": "letsencrypt-prod", + }, + }, + spec: { + tls: [ + { + hosts: [ + "rsr.example.com", + ], + secretName: "rsr-tls", + }, + ], + rules: [ + { + host: "rsr.example.com", + http: { + paths: [ + { + path: "/", + pathType: "Prefix", + backend: { + service: { + name: "rsr-engine", + port: { + name: "http", + }, + }, + }, + }, + ], + }, + }, + ], + }, +} diff --git a/rhodium-standard-repositories/satellites/state.scm/FUNDING.yml b/rhodium-standard-repositories/satellites/state.scm/FUNDING.yml index 3044e6899..d7205b6a6 100644 --- a/rhodium-standard-repositories/satellites/state.scm/FUNDING.yml +++ b/rhodium-standard-repositories/satellites/state.scm/FUNDING.yml @@ -3,25 +3,24 @@ # These are supported funding model platforms -github: [] # GitHub Sponsors username(s) -patreon: # Patreon username -open_collective: # Open Collective username -ko_fi: # Ko-fi username -tidelift: # Tidelift package name -community_bridge: # Community Bridge project name -liberapay: # Liberapay username -issuehunt: # IssueHunt username -otechie: # Otechie username -lfx_crowdfunding: # LFX Crowdfunding project name - -# Custom sponsorship URLs -custom: - # - https://your-sponsorship-link.com - +{ + github: [], # GitHub Sponsors username(s) + patreon: null, # Patreon username + open_collective: null, # Open Collective username + ko_fi: null, # Ko-fi username + tidelift: null, # Tidelift package name + community_bridge: null, # Community Bridge project name + liberapay: null, # Liberapay username + issuehunt: null, # IssueHunt username + otechie: null, # Otechie username + lfx_crowdfunding: null, # LFX Crowdfunding project name + # Custom sponsorship URLs + custom: null, +} # Cooperative economics statement # This project encourages support through: # 1. Direct code contributions # 2. Documentation improvements # 3. Bug reports and testing # 4. Financial support to maintainers -# 5. Support for cooperative/worker-owned tech enterprises +# 5. Support for cooperative/worker-owned tech enterprises# - https://your-sponsorship-link.com