diff --git a/.fulmen/app.yaml b/.fulmen/app.yaml index 0ae3d7f..dc1d4f1 100644 --- a/.fulmen/app.yaml +++ b/.fulmen/app.yaml @@ -12,6 +12,6 @@ app: # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml. config_name: decernor description: "Local key-material hygiene and readiness checks" - version: "0.1.4" + version: "0.1.5" metadata: repository_category: cli diff --git a/CHANGELOG.md b/CHANGELOG.md index b6e610b..9acd267 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [0.1.5] - 2026-08-24 + +Public-landing pack. Signed cut on the same two-phase provenance walk. +No new CLI verbs. + +### Changed + +- README adds a `## License` pointer to `LICENSE` and polishes the name note + for a public reader. +- Overview front-matter status is `active` (was `draft`). +- Stub `CODE_OF_CONDUCT.md`, `CONTRIBUTING.md`, and `SECURITY.md` link to + [3leaps/oss-policies](https://github.com/3leaps/oss-policies) (no forked + policy bodies). +- LICENSE drops the Fulmen "Acceptable Use" template section; MIT grant and + trademark notice remain. +- Historical `[0.1.2]` notes use past tense for the private-era snapshot. +- `make test-standalone-binary` copies the built binary into a `mktemp` + directory under `$${TMPDIR:-/var/tmp}` instead of hardcoded `/tmp` + (avoids host SIGKILL on `/tmp` executables). + ## [0.1.4] - 2026-08-20 Signed cut. Same two-phase provenance walk as v0.1.3. Toolchain and @@ -22,9 +42,9 @@ landing-page notes catch up; no new CLI verbs. ## [0.1.3] - 2026-08-18 -First **signed** private cut. Fingerprint pins are generated by -`decernor fingerprint` and staged into the checksum set before signing -([PDR-0001](docs/decisions/PDR-0001-committed-signing-anchors.md)). +First **signed** cut while the repository was private. Fingerprint pins are +generated by `decernor fingerprint` and staged into the checksum set before +signing ([PDR-0001](docs/decisions/PDR-0001-committed-signing-anchors.md)). ### Added @@ -35,8 +55,9 @@ First **signed** private cut. Fingerprint pins are generated by ## [0.1.2] - 2026-08-18 -First tagged snapshot of the Decernor CLI. Private repository; unsigned draft -release is the intended publish shape for this cut. +First tagged snapshot of the Decernor CLI. First tagged cut while the +repository was private; unsigned draft release was the intended publish +shape for that cut. ### Added @@ -73,6 +94,7 @@ release is the intended publish shape for this cut. - Upstream baseline changelog and release-note history inherited from the template. +[0.1.5]: https://github.com/3leaps/decernor/releases/tag/v0.1.5 [0.1.4]: https://github.com/3leaps/decernor/releases/tag/v0.1.4 [0.1.3]: https://github.com/3leaps/decernor/releases/tag/v0.1.3 [0.1.2]: https://github.com/3leaps/decernor/releases/tag/v0.1.2 diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..f2d2365 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,4 @@ +# Code of Conduct + +This project follows the 3 Leaps Code of Conduct published in +[3leaps/oss-policies](https://github.com/3leaps/oss-policies). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..a2ccf05 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,6 @@ +# Contributing + +Contribution guidelines for 3 Leaps open source projects live in +[3leaps/oss-policies](https://github.com/3leaps/oss-policies). + +This repository conforms to the Sensitive Local Data policy published there. diff --git a/LICENSE b/LICENSE index 5d99a3e..02aebc9 100644 --- a/LICENSE +++ b/LICENSE @@ -48,10 +48,4 @@ For questions regarding trademark usage, contact legal@3leaps.net. --- -## Acceptable Use of "Fulmen" - -"Fulmen" (Latin for lightning or thunderbolt) is a reusable project template by 3 Leaps, LLC, designed for lightning-fast, enterprise-grade solutions. Use "Fulmen" as a standalone noun (for example, "Use a fulmen to start your project") and avoid descriptors like "template" or "blueprint." We encourage referencing "fulmen" in contexts identifying permissibly licensed content, provided the `3leaps-` prefix is not used to avoid confusion with official 3 Leaps content. As a courtesy, acknowledge the origin by linking to `https://github.com/3leaps/decernor` in your documentation. For full branding guidelines, visit `https://fulmenhq.dev`. - ---- - For additional governance details and contributor obligations, see the 3 Leaps Open Source Policies at https://github.com/3leaps/oss-policies. diff --git a/Makefile b/Makefile index 257f7b6..8f14f01 100644 --- a/Makefile +++ b/Makefile @@ -312,10 +312,15 @@ install: build ## Install binary to BINDIR (default: ~/.local/bin) test-standalone-binary: build ## Verify built binary runs outside repo @echo "→ Standalone binary check (outside repo)..." - @cp "bin/$(BINARY_NAME)$(BINARY_EXT)" "/tmp/$(BINARY_NAME)$(BINARY_EXT)" - @"/tmp/$(BINARY_NAME)$(BINARY_EXT)" version >/dev/null - @"/tmp/$(BINARY_NAME)$(BINARY_EXT)" --help >/dev/null - @echo "✅ Standalone binary check passed" + @# POSIX /bin/sh (dash on Ubuntu CI): no pipefail. Keep outside-repo check + @# under $${TMPDIR:-/var/tmp} — hardcoded /tmp is SIGKILL'd on some macOS hosts. + @tmp=$$(mktemp -d "$${TMPDIR:-/var/tmp}/decernor-standalone.XXXXXX") && \ + cp "bin/$(BINARY_NAME)$(BINARY_EXT)" "$$tmp/$(BINARY_NAME)$(BINARY_EXT)" && \ + "$$tmp/$(BINARY_NAME)$(BINARY_EXT)" version >/dev/null && \ + "$$tmp/$(BINARY_NAME)$(BINARY_EXT)" --help >/dev/null && \ + rm -rf "$$tmp" && \ + echo "✅ Standalone binary check passed" || \ + (rm -rf "$$tmp"; exit 1) build-all: verify-embedded-identity ## Build multi-platform binaries and generate checksums @echo "→ Building for multiple platforms..." diff --git a/README.md b/README.md index 3a32cb3..2c325bc 100644 --- a/README.md +++ b/README.md @@ -9,11 +9,8 @@ SSH keys, revocation certificates, public counterparts, and checksum manifests retain, or inspect. It reads the _state_, never the _secret_. > **Name note:** `decernor` (from Latin _decernere_, "to decide / determine / decree"; -> root _cernere_, "to sift, distinguish, discern") is the locked name for the tool -> previously proven in an internal prototype. Pronounced **deh-SUR-nor**. -> See [`NAMING.md`](NAMING.md) for the decision record. The binary, module path, and -> config surfaces below use the final name; mechanical rename of the prototype is a -> graduation task. +> root _cernere_, "to sift, distinguish, discern"). Pronounced **deh-SUR-nor**. +> See [`NAMING.md`](NAMING.md) for the decision record. ## Product Thesis @@ -103,7 +100,7 @@ Capabilities use a provider plus verb model: - `minisign/sign` - `ssh/auth` -The current prototype includes schema-backed config validation: +The current cut includes schema-backed config validation: ```sh go run ./cmd/decernor readiness validate-config examples/github-org-bootstrap.readiness.json @@ -237,7 +234,7 @@ Inserter: [`keys/README.md`](keys/README.md). ## Verify a signed release Consume fingerprints, not secrets. Per-cut commands live in -[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md). +[`docs/releases/v0.1.5.md`](docs/releases/v0.1.5.md). Download the release assets (archives, signed SUMS, exported publics, staged pin pair). Verify SUMS signatures, then: @@ -315,3 +312,7 @@ The repository avoids committed real keys and avoids full static secret-key fixt ## Provenance Decernor was initially built from the public Fulmen microtool forge baseline [`forge-microtool-gimlet`](https://github.com/fulmenhq/forge-microtool-gimlet), then adapted as a 3 Leaps OSS tool. + +## License + +This project is licensed under the MIT License. See [`LICENSE`](LICENSE). diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index e802f5b..0883c1d 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,7 +1,19 @@ # Release Notes Landing page for the latest Decernor cut. Per-cut payload: -[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md). +[`docs/releases/v0.1.5.md`](docs/releases/v0.1.5.md). + +## v0.1.5 — 2026-08-24 + +Public-landing pack on the same signed two-phase walk as v0.1.4. No new +CLI verbs. README gains a `## License` pointer; overview status is +`active`; community stubs link to `3leaps/oss-policies`; LICENSE drops the +Fulmen "Acceptable Use" template section. Historical v0.1.2 notes use past +tense for the private-era snapshot. The standalone binary gate uses a +`mktemp` directory under `TMPDIR` instead of hardcoded `/tmp`. + +Signing still uses `DECERNOR_*` environment variables only. No key paths +live in this repository. ## v0.1.4 — 2026-08-20 @@ -23,5 +35,5 @@ First signed cut. The repository was private for that tag. See ## v0.1.2 — 2026-08-18 -First tagged snapshot (unsigned draft). See -[`docs/releases/v0.1.2.md`](docs/releases/v0.1.2.md). +First tagged snapshot (unsigned draft) while the repository was private. +See [`docs/releases/v0.1.2.md`](docs/releases/v0.1.2.md). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..fa94924 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,4 @@ +# Security + +Security reporting and policy for 3 Leaps open source projects live in +[3leaps/oss-policies](https://github.com/3leaps/oss-policies). diff --git a/VERSION b/VERSION index 845639e..9faa1b7 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.1.4 +0.1.5 diff --git a/docs/decernor-overview.md b/docs/decernor-overview.md index 6b80381..1052e90 100644 --- a/docs/decernor-overview.md +++ b/docs/decernor-overview.md @@ -1,7 +1,7 @@ --- title: "Decernor Overview" description: "Local key-material hygiene and readiness checks" -status: "draft" +status: "active" --- # Decernor Overview diff --git a/docs/releases/README.md b/docs/releases/README.md index 13b36b8..a05acaf 100644 --- a/docs/releases/README.md +++ b/docs/releases/README.md @@ -2,6 +2,7 @@ Per-cut notes for tagged releases. Landing page: [`RELEASE_NOTES.md`](../../RELEASE_NOTES.md). +- [v0.1.5](v0.1.5.md) — public-landing pack; signed cut - [v0.1.4](v0.1.4.md) — signed cut; toolchain and provenance notes - [v0.1.3](v0.1.3.md) — first signed cut -- [v0.1.2](v0.1.2.md) — first tagged snapshot (unsigned) +- [v0.1.2](v0.1.2.md) — first tagged snapshot (unsigned; private-era) diff --git a/docs/releases/v0.1.2.md b/docs/releases/v0.1.2.md index 060e4a6..fa6bf3e 100644 --- a/docs/releases/v0.1.2.md +++ b/docs/releases/v0.1.2.md @@ -1,7 +1,8 @@ # v0.1.2 — 2026-08-18 -First tagged snapshot. **Private** repository. Draft GitHub release; -unsigned unless org public keys are inserted from `decernor fingerprint`. +First tagged snapshot while the repository was private. Draft GitHub +release; unsigned unless org public keys are inserted from +`decernor fingerprint`. **Shipped verbs:** `scan`, `guardread`, `fingerprint`/`fp`, `validate` (contract-base + classification gate), `readiness validate-config`, @@ -13,8 +14,8 @@ stdout, if that named file has 0 or more than one primary). Minisign trust-anchor field is lowercase 64-hex `minisign-public-blob-sha256-v1`. **Not in this cut:** static readiness evaluation, proof checks, -`derive-public-key`, `migrate`, embedded ceremony docs, public GitHub -visibility. +`derive-public-key`, `migrate`, embedded ceremony docs. Public GitHub +visibility was out of scope for that tag. ## Verify diff --git a/docs/releases/v0.1.5.md b/docs/releases/v0.1.5.md new file mode 100644 index 0000000..1a2aa0c --- /dev/null +++ b/docs/releases/v0.1.5.md @@ -0,0 +1,40 @@ +# v0.1.5 — 2026-08-24 + +Public-landing pack. Signed cut on the same two-phase provenance walk as +v0.1.4. + +**Shipped verbs** are unchanged: `scan`, `guardread`, `fingerprint`/`fp`, +`validate`, `readiness validate-config`, `version`, `envinfo`, `doctor`. + +This cut prepares the repository landing surfaces for a public reader: +README `## License` pointer, overview status `active`, link-only community +stubs to `3leaps/oss-policies`, LICENSE without the Fulmen "Acceptable Use" +template section, and past-tense historical notes for the private-era +v0.1.2 snapshot. `make test-standalone-binary` uses a `mktemp` directory +under `TMPDIR` instead of hardcoded `/tmp`. + +Fingerprint pins are generated with `decernor fingerprint` on exported +public files and staged into the checksum set before signing. Bindings +are `DECERNOR_*` environment variables only. + +## Verify a signed release + +Download the assets: archives, `SHA256SUMS` / `SHA512SUMS` and their +signatures, exported publics, and the staged pin pair +(`expected-fingerprints.txt`, `expected-fingerprints.ndjson`). Check the +signatures on the SUMS, then check the SUMS against the files. + +Recompute fingerprints from the **exported publics** and compare them to +the two-line pin file. Do not hand-type hex. + +```sh +decernor fingerprint decernor-release-signing-key.asc \ + --class public --kind gpg --format json --path-mode none --gpg-role primary +decernor fingerprint decernor-minisign.pub \ + --class public --kind minisign --format json --path-mode none +``` + +The GPG primary fingerprint and the minisign public-blob SHA-256 must +match the `gpg` and `minisign` lines in `expected-fingerprints.txt`. +See `keys/README.md` and +`docs/decisions/PDR-0001-committed-signing-anchors.md`. diff --git a/internal/assets/appidentity/app.yaml b/internal/assets/appidentity/app.yaml index 0ae3d7f..dc1d4f1 100644 --- a/internal/assets/appidentity/app.yaml +++ b/internal/assets/appidentity/app.yaml @@ -12,6 +12,6 @@ app: # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml. config_name: decernor description: "Local key-material hygiene and readiness checks" - version: "0.1.4" + version: "0.1.5" metadata: repository_category: cli