diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index bed0bbd..ccb41be 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -91,9 +91,9 @@ Closes # - [ ] **Schema.org compliance** — new database tables, columns, or API fields map to Schema.org types, or the PR description justifies any deviation. - [ ] **Locked counts respected** — no change to the platform's locked counts - (17 mini-apps · 7 Enterprise products · 7 data layers · 7 covenants · - 40 interest categories · 12 manifesto sections · 3 sources of truth) - without Founder approval documented in the PR description. + (17 mini-apps · 7 data layers · 7 covenants · 40 interest categories · + 12 manifesto sections · 3 sources of truth) without Founder approval + documented in the PR description. - [ ] **Frontier defaults** — for user-facing or infrastructure work: offline / local-first behaviour has been considered; any new cryptographic primitive has a documented post-quantum migration path; diff --git a/.github/workflows/reusable-ci-typescript-lib.yml b/.github/workflows/reusable-ci-typescript-lib.yml index 1d1f139..bf984f0 100644 --- a/.github/workflows/reusable-ci-typescript-lib.yml +++ b/.github/workflows/reusable-ci-typescript-lib.yml @@ -50,13 +50,33 @@ permissions: contents: read jobs: + audit: + name: pnpm audit + runs-on: ubuntu-latest + defaults: + run: + working-directory: ${{ inputs.working-directory }} + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + with: + node-version-file: ${{ inputs.node-version-file }} + cache: pnpm + - run: pnpm install --frozen-lockfile + - name: pnpm audit + shell: bash + run: | + set -euo pipefail + pnpm audit --audit-level=moderate + changes: name: detect changes runs-on: ubuntu-latest outputs: typescript: ${{ steps.filter.outputs.typescript }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 with: fetch-depth: 0 - id: filter @@ -84,8 +104,8 @@ jobs: run: working-directory: ${{ inputs.working-directory }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - uses: pnpm/action-setup@71c92474e7e4f5bca283fb17ef80fba9cdb2b4b1 # v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version-file: ${{ inputs.node-version-file }} @@ -102,8 +122,8 @@ jobs: run: working-directory: ${{ inputs.working-directory }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - uses: pnpm/action-setup@71c92474e7e4f5bca283fb17ef80fba9cdb2b4b1 # v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version-file: ${{ inputs.node-version-file }} @@ -120,8 +140,8 @@ jobs: run: working-directory: ${{ inputs.working-directory }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - uses: pnpm/action-setup@71c92474e7e4f5bca283fb17ef80fba9cdb2b4b1 # v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version-file: ${{ inputs.node-version-file }} @@ -138,8 +158,8 @@ jobs: run: working-directory: ${{ inputs.working-directory }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - uses: pnpm/action-setup@71c92474e7e4f5bca283fb17ef80fba9cdb2b4b1 # v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version-file: ${{ inputs.node-version-file }} diff --git a/.github/workflows/reusable-ci-typescript.yml b/.github/workflows/reusable-ci-typescript.yml index 7a503dd..3c4cdb0 100644 --- a/.github/workflows/reusable-ci-typescript.yml +++ b/.github/workflows/reusable-ci-typescript.yml @@ -62,6 +62,23 @@ permissions: contents: read jobs: + audit: + name: pnpm audit + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + with: + node-version-file: ${{ inputs.node-version-file }} + cache: pnpm + - run: pnpm install --frozen-lockfile + - name: pnpm audit + shell: bash + run: | + set -euo pipefail + pnpm audit --audit-level=moderate + typecheck: name: tsc runs-on: ubuntu-latest diff --git a/CLAUDE.md b/CLAUDE.md index 2ea7179..cb6b9ee 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -62,11 +62,12 @@ contexts: ## Model selection -| Task | Model | -| ---------------------------------------------------------- | ----------------------------- | -| Routine edits, bug fixes, refactoring | `claude-sonnet-4-6` (default) | -| Architecture, security review, complex multi-step planning | `claude-opus-4-8` | -| Quick lookups, summaries, simple one-liners | `claude-haiku-4-5-20251001` | +| Task | Model | +| -------------------------------------------------------------------------- | ----------------------------- | +| Routine edits, bug fixes, refactoring | `claude-sonnet-4-6` (default) | +| Architecture, security review, complex multi-step planning | `claude-opus-4-8` | +| Maximum-depth analysis: novel attack surfaces, cross-repo audit sweeps | `claude-fable-5` | +| Quick lookups, summaries, simple one-liners | `claude-haiku-4-5-20251001` | Sub-agents inherit the parent model unless there is a specific reason to override. @@ -79,8 +80,8 @@ Honour a repo's declared check commands over these defaults: | Stack | Install | Full check | | -------------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| TypeScript / Next.js | `pnpm install` | `pnpm lint && pnpm typecheck && pnpm test && pnpm build` | -| TypeScript library | `pnpm install` | `pnpm typecheck && pnpm lint && pnpm test` | +| TypeScript / Next.js | `pnpm install` | `pnpm audit --audit-level=moderate && pnpm lint && pnpm typecheck && pnpm test && pnpm build` | +| TypeScript library | `pnpm install` | `pnpm audit --audit-level=moderate && pnpm typecheck && pnpm lint && pnpm test` | | Rust | (Cargo workspace) | `cargo fmt --check && cargo clippy --workspace --all-targets --all-features -- -D warnings && cargo nextest run --workspace --all-features && cargo test --workspace --doc` | | Python (uv) | `uv sync` | `uv run ruff check . && uv run ruff format --check . && uv run mypy packages && uv run pytest` | | Solidity (Foundry) | `forge install` | `forge fmt --check && forge build --sizes && forge test -vvv` | @@ -141,9 +142,10 @@ that would change them. - **No prohibited dependencies:** no Flutter, no Couchbase. - **Post-quantum migration path required** for every new cryptographic primitive adopted by the platform. -- **Locked counts:** 17 Mukoko mini-apps, 7 data layers, 40 interest - categories. Do not mutate via PR. **Nyuchi Enterprise products are - not a locked count** — that line grows; do not treat it as fixed. +- **Locked counts:** 17 Mukoko mini-apps · 7 data layers · 7 covenants · + 40 interest categories · 12 manifesto sections · 3 sources of truth. + Do not mutate via PR. **Nyuchi Enterprise products are not a locked + count** — that line grows; do not treat it as fixed. ---