From f3423f9774f9c54e4f2f71e2addc0aba0070bc06 Mon Sep 17 00:00:00 2001 From: Dave Thompson Date: Mon, 24 Aug 2026 17:27:21 -0400 Subject: [PATCH 1/3] chore(release): prepare v0.1.5 public-landing notes and identity Version identity is 0.1.5 (VERSION, app identity, embedded mirror). Landing surfaces add a README License pointer, overview status active, link-only community stubs to 3leaps/oss-policies, and drop the Fulmen Acceptable Use template block from LICENSE. Historical v0.1.2 notes use past tense. CHANGELOG, RELEASE_NOTES, and docs/releases/v0.1.5.md agree. make pr-final and make release-preflight pass on this tip. No visibility change. No retag of v0.1.4. Generated by Grok 4.5 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.5 Role: devlead Committer-of-Record: @3leapsdave --- .fulmen/app.yaml | 2 +- CHANGELOG.md | 29 +++++++++++++++++---- CODE_OF_CONDUCT.md | 4 +++ CONTRIBUTING.md | 6 +++++ LICENSE | 6 ----- README.md | 15 ++++++----- RELEASE_NOTES.md | 17 +++++++++--- SECURITY.md | 4 +++ VERSION | 2 +- docs/decernor-overview.md | 2 +- docs/releases/README.md | 3 ++- docs/releases/v0.1.2.md | 9 ++++--- docs/releases/v0.1.5.md | 39 ++++++++++++++++++++++++++++ internal/assets/appidentity/app.yaml | 2 +- 14 files changed, 110 insertions(+), 30 deletions(-) create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md create mode 100644 docs/releases/v0.1.5.md diff --git a/.fulmen/app.yaml b/.fulmen/app.yaml index 0ae3d7f..dc1d4f1 100644 --- a/.fulmen/app.yaml +++ b/.fulmen/app.yaml @@ -12,6 +12,6 @@ app: # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml. config_name: decernor description: "Local key-material hygiene and readiness checks" - version: "0.1.4" + version: "0.1.5" metadata: repository_category: cli diff --git a/CHANGELOG.md b/CHANGELOG.md index b6e610b..effb286 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,23 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [0.1.5] - 2026-08-24 + +Public-landing pack. Signed cut on the same two-phase provenance walk. +No new CLI verbs. + +### Changed + +- README adds a `## License` pointer to `LICENSE` and polishes the name note + for a public reader. +- Overview front-matter status is `active` (was `draft`). +- Stub `CODE_OF_CONDUCT.md`, `CONTRIBUTING.md`, and `SECURITY.md` link to + [3leaps/oss-policies](https://github.com/3leaps/oss-policies) (no forked + policy bodies). +- LICENSE drops the Fulmen "Acceptable Use" template section; MIT grant and + trademark notice remain. +- Historical `[0.1.2]` notes use past tense for the private-era snapshot. + ## [0.1.4] - 2026-08-20 Signed cut. Same two-phase provenance walk as v0.1.3. Toolchain and @@ -22,9 +39,9 @@ landing-page notes catch up; no new CLI verbs. ## [0.1.3] - 2026-08-18 -First **signed** private cut. Fingerprint pins are generated by -`decernor fingerprint` and staged into the checksum set before signing -([PDR-0001](docs/decisions/PDR-0001-committed-signing-anchors.md)). +First **signed** cut while the repository was private. Fingerprint pins are +generated by `decernor fingerprint` and staged into the checksum set before +signing ([PDR-0001](docs/decisions/PDR-0001-committed-signing-anchors.md)). ### Added @@ -35,8 +52,9 @@ First **signed** private cut. Fingerprint pins are generated by ## [0.1.2] - 2026-08-18 -First tagged snapshot of the Decernor CLI. Private repository; unsigned draft -release is the intended publish shape for this cut. +First tagged snapshot of the Decernor CLI. First tagged cut while the +repository was private; unsigned draft release was the intended publish +shape for that cut. ### Added @@ -73,6 +91,7 @@ release is the intended publish shape for this cut. - Upstream baseline changelog and release-note history inherited from the template. +[0.1.5]: https://github.com/3leaps/decernor/releases/tag/v0.1.5 [0.1.4]: https://github.com/3leaps/decernor/releases/tag/v0.1.4 [0.1.3]: https://github.com/3leaps/decernor/releases/tag/v0.1.3 [0.1.2]: https://github.com/3leaps/decernor/releases/tag/v0.1.2 diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..f2d2365 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,4 @@ +# Code of Conduct + +This project follows the 3 Leaps Code of Conduct published in +[3leaps/oss-policies](https://github.com/3leaps/oss-policies). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..a2ccf05 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,6 @@ +# Contributing + +Contribution guidelines for 3 Leaps open source projects live in +[3leaps/oss-policies](https://github.com/3leaps/oss-policies). + +This repository conforms to the Sensitive Local Data policy published there. diff --git a/LICENSE b/LICENSE index 5d99a3e..02aebc9 100644 --- a/LICENSE +++ b/LICENSE @@ -48,10 +48,4 @@ For questions regarding trademark usage, contact legal@3leaps.net. --- -## Acceptable Use of "Fulmen" - -"Fulmen" (Latin for lightning or thunderbolt) is a reusable project template by 3 Leaps, LLC, designed for lightning-fast, enterprise-grade solutions. Use "Fulmen" as a standalone noun (for example, "Use a fulmen to start your project") and avoid descriptors like "template" or "blueprint." We encourage referencing "fulmen" in contexts identifying permissibly licensed content, provided the `3leaps-` prefix is not used to avoid confusion with official 3 Leaps content. As a courtesy, acknowledge the origin by linking to `https://github.com/3leaps/decernor` in your documentation. For full branding guidelines, visit `https://fulmenhq.dev`. - ---- - For additional governance details and contributor obligations, see the 3 Leaps Open Source Policies at https://github.com/3leaps/oss-policies. diff --git a/README.md b/README.md index 3a32cb3..2c325bc 100644 --- a/README.md +++ b/README.md @@ -9,11 +9,8 @@ SSH keys, revocation certificates, public counterparts, and checksum manifests retain, or inspect. It reads the _state_, never the _secret_. > **Name note:** `decernor` (from Latin _decernere_, "to decide / determine / decree"; -> root _cernere_, "to sift, distinguish, discern") is the locked name for the tool -> previously proven in an internal prototype. Pronounced **deh-SUR-nor**. -> See [`NAMING.md`](NAMING.md) for the decision record. The binary, module path, and -> config surfaces below use the final name; mechanical rename of the prototype is a -> graduation task. +> root _cernere_, "to sift, distinguish, discern"). Pronounced **deh-SUR-nor**. +> See [`NAMING.md`](NAMING.md) for the decision record. ## Product Thesis @@ -103,7 +100,7 @@ Capabilities use a provider plus verb model: - `minisign/sign` - `ssh/auth` -The current prototype includes schema-backed config validation: +The current cut includes schema-backed config validation: ```sh go run ./cmd/decernor readiness validate-config examples/github-org-bootstrap.readiness.json @@ -237,7 +234,7 @@ Inserter: [`keys/README.md`](keys/README.md). ## Verify a signed release Consume fingerprints, not secrets. Per-cut commands live in -[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md). +[`docs/releases/v0.1.5.md`](docs/releases/v0.1.5.md). Download the release assets (archives, signed SUMS, exported publics, staged pin pair). Verify SUMS signatures, then: @@ -315,3 +312,7 @@ The repository avoids committed real keys and avoids full static secret-key fixt ## Provenance Decernor was initially built from the public Fulmen microtool forge baseline [`forge-microtool-gimlet`](https://github.com/fulmenhq/forge-microtool-gimlet), then adapted as a 3 Leaps OSS tool. + +## License + +This project is licensed under the MIT License. See [`LICENSE`](LICENSE). diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index e802f5b..d268e48 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,7 +1,18 @@ # Release Notes Landing page for the latest Decernor cut. Per-cut payload: -[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md). +[`docs/releases/v0.1.5.md`](docs/releases/v0.1.5.md). + +## v0.1.5 — 2026-08-24 + +Public-landing pack on the same signed two-phase walk as v0.1.4. No new +CLI verbs. README gains a `## License` pointer; overview status is +`active`; community stubs link to `3leaps/oss-policies`; LICENSE drops the +Fulmen "Acceptable Use" template section. Historical v0.1.2 notes use past +tense for the private-era snapshot. + +Signing still uses `DECERNOR_*` environment variables only. No key paths +live in this repository. ## v0.1.4 — 2026-08-20 @@ -23,5 +34,5 @@ First signed cut. The repository was private for that tag. See ## v0.1.2 — 2026-08-18 -First tagged snapshot (unsigned draft). See -[`docs/releases/v0.1.2.md`](docs/releases/v0.1.2.md). +First tagged snapshot (unsigned draft) while the repository was private. +See [`docs/releases/v0.1.2.md`](docs/releases/v0.1.2.md). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..fa94924 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,4 @@ +# Security + +Security reporting and policy for 3 Leaps open source projects live in +[3leaps/oss-policies](https://github.com/3leaps/oss-policies). diff --git a/VERSION b/VERSION index 845639e..9faa1b7 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.1.4 +0.1.5 diff --git a/docs/decernor-overview.md b/docs/decernor-overview.md index 6b80381..1052e90 100644 --- a/docs/decernor-overview.md +++ b/docs/decernor-overview.md @@ -1,7 +1,7 @@ --- title: "Decernor Overview" description: "Local key-material hygiene and readiness checks" -status: "draft" +status: "active" --- # Decernor Overview diff --git a/docs/releases/README.md b/docs/releases/README.md index 13b36b8..a05acaf 100644 --- a/docs/releases/README.md +++ b/docs/releases/README.md @@ -2,6 +2,7 @@ Per-cut notes for tagged releases. Landing page: [`RELEASE_NOTES.md`](../../RELEASE_NOTES.md). +- [v0.1.5](v0.1.5.md) — public-landing pack; signed cut - [v0.1.4](v0.1.4.md) — signed cut; toolchain and provenance notes - [v0.1.3](v0.1.3.md) — first signed cut -- [v0.1.2](v0.1.2.md) — first tagged snapshot (unsigned) +- [v0.1.2](v0.1.2.md) — first tagged snapshot (unsigned; private-era) diff --git a/docs/releases/v0.1.2.md b/docs/releases/v0.1.2.md index 060e4a6..fa6bf3e 100644 --- a/docs/releases/v0.1.2.md +++ b/docs/releases/v0.1.2.md @@ -1,7 +1,8 @@ # v0.1.2 — 2026-08-18 -First tagged snapshot. **Private** repository. Draft GitHub release; -unsigned unless org public keys are inserted from `decernor fingerprint`. +First tagged snapshot while the repository was private. Draft GitHub +release; unsigned unless org public keys are inserted from +`decernor fingerprint`. **Shipped verbs:** `scan`, `guardread`, `fingerprint`/`fp`, `validate` (contract-base + classification gate), `readiness validate-config`, @@ -13,8 +14,8 @@ stdout, if that named file has 0 or more than one primary). Minisign trust-anchor field is lowercase 64-hex `minisign-public-blob-sha256-v1`. **Not in this cut:** static readiness evaluation, proof checks, -`derive-public-key`, `migrate`, embedded ceremony docs, public GitHub -visibility. +`derive-public-key`, `migrate`, embedded ceremony docs. Public GitHub +visibility was out of scope for that tag. ## Verify diff --git a/docs/releases/v0.1.5.md b/docs/releases/v0.1.5.md new file mode 100644 index 0000000..acb49fd --- /dev/null +++ b/docs/releases/v0.1.5.md @@ -0,0 +1,39 @@ +# v0.1.5 — 2026-08-24 + +Public-landing pack. Signed cut on the same two-phase provenance walk as +v0.1.4. + +**Shipped verbs** are unchanged: `scan`, `guardread`, `fingerprint`/`fp`, +`validate`, `readiness validate-config`, `version`, `envinfo`, `doctor`. + +This cut prepares the repository landing surfaces for a public reader: +README `## License` pointer, overview status `active`, link-only community +stubs to `3leaps/oss-policies`, LICENSE without the Fulmen "Acceptable Use" +template section, and past-tense historical notes for the private-era +v0.1.2 snapshot. + +Fingerprint pins are generated with `decernor fingerprint` on exported +public files and staged into the checksum set before signing. Bindings +are `DECERNOR_*` environment variables only. + +## Verify a signed release + +Download the assets: archives, `SHA256SUMS` / `SHA512SUMS` and their +signatures, exported publics, and the staged pin pair +(`expected-fingerprints.txt`, `expected-fingerprints.ndjson`). Check the +signatures on the SUMS, then check the SUMS against the files. + +Recompute fingerprints from the **exported publics** and compare them to +the two-line pin file. Do not hand-type hex. + +```sh +decernor fingerprint decernor-release-signing-key.asc \ + --class public --kind gpg --format json --path-mode none --gpg-role primary +decernor fingerprint decernor-minisign.pub \ + --class public --kind minisign --format json --path-mode none +``` + +The GPG primary fingerprint and the minisign public-blob SHA-256 must +match the `gpg` and `minisign` lines in `expected-fingerprints.txt`. +See `keys/README.md` and +`docs/decisions/PDR-0001-committed-signing-anchors.md`. diff --git a/internal/assets/appidentity/app.yaml b/internal/assets/appidentity/app.yaml index 0ae3d7f..dc1d4f1 100644 --- a/internal/assets/appidentity/app.yaml +++ b/internal/assets/appidentity/app.yaml @@ -12,6 +12,6 @@ app: # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml. config_name: decernor description: "Local key-material hygiene and readiness checks" - version: "0.1.4" + version: "0.1.5" metadata: repository_category: cli From a9924bcbf63f9baff5b0366619a5100c00b7c1d0 Mon Sep 17 00:00:00 2001 From: Dave Thompson Date: Mon, 24 Aug 2026 17:58:31 -0400 Subject: [PATCH 2/3] fix(make): run standalone binary check under TMPDIR Hardcoded /tmp/decernor is SIGKILL'd (exit 137) on some macOS hosts. Copy into a mktemp directory under ${TMPDIR:-/var/tmp} instead, clean up on exit, and note the gate fix in the v0.1.5 surfaces. Generated by Grok 4.5 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.5 Role: devlead Committer-of-Record: @3leapsdave --- CHANGELOG.md | 3 +++ Makefile | 11 +++++++---- RELEASE_NOTES.md | 3 ++- docs/releases/v0.1.5.md | 3 ++- 4 files changed, 14 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index effb286..9acd267 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,6 +22,9 @@ No new CLI verbs. - LICENSE drops the Fulmen "Acceptable Use" template section; MIT grant and trademark notice remain. - Historical `[0.1.2]` notes use past tense for the private-era snapshot. +- `make test-standalone-binary` copies the built binary into a `mktemp` + directory under `$${TMPDIR:-/var/tmp}` instead of hardcoded `/tmp` + (avoids host SIGKILL on `/tmp` executables). ## [0.1.4] - 2026-08-20 diff --git a/Makefile b/Makefile index 257f7b6..519eda8 100644 --- a/Makefile +++ b/Makefile @@ -312,10 +312,13 @@ install: build ## Install binary to BINDIR (default: ~/.local/bin) test-standalone-binary: build ## Verify built binary runs outside repo @echo "→ Standalone binary check (outside repo)..." - @cp "bin/$(BINARY_NAME)$(BINARY_EXT)" "/tmp/$(BINARY_NAME)$(BINARY_EXT)" - @"/tmp/$(BINARY_NAME)$(BINARY_EXT)" version >/dev/null - @"/tmp/$(BINARY_NAME)$(BINARY_EXT)" --help >/dev/null - @echo "✅ Standalone binary check passed" + @set -euo pipefail; \ + tmp=$$(mktemp -d "$${TMPDIR:-/var/tmp}/decernor-standalone.XXXXXX"); \ + trap 'rm -rf "$$tmp"' EXIT; \ + cp "bin/$(BINARY_NAME)$(BINARY_EXT)" "$$tmp/$(BINARY_NAME)$(BINARY_EXT)"; \ + "$$tmp/$(BINARY_NAME)$(BINARY_EXT)" version >/dev/null; \ + "$$tmp/$(BINARY_NAME)$(BINARY_EXT)" --help >/dev/null; \ + echo "✅ Standalone binary check passed" build-all: verify-embedded-identity ## Build multi-platform binaries and generate checksums @echo "→ Building for multiple platforms..." diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index d268e48..0883c1d 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -9,7 +9,8 @@ Public-landing pack on the same signed two-phase walk as v0.1.4. No new CLI verbs. README gains a `## License` pointer; overview status is `active`; community stubs link to `3leaps/oss-policies`; LICENSE drops the Fulmen "Acceptable Use" template section. Historical v0.1.2 notes use past -tense for the private-era snapshot. +tense for the private-era snapshot. The standalone binary gate uses a +`mktemp` directory under `TMPDIR` instead of hardcoded `/tmp`. Signing still uses `DECERNOR_*` environment variables only. No key paths live in this repository. diff --git a/docs/releases/v0.1.5.md b/docs/releases/v0.1.5.md index acb49fd..1a2aa0c 100644 --- a/docs/releases/v0.1.5.md +++ b/docs/releases/v0.1.5.md @@ -10,7 +10,8 @@ This cut prepares the repository landing surfaces for a public reader: README `## License` pointer, overview status `active`, link-only community stubs to `3leaps/oss-policies`, LICENSE without the Fulmen "Acceptable Use" template section, and past-tense historical notes for the private-era -v0.1.2 snapshot. +v0.1.2 snapshot. `make test-standalone-binary` uses a `mktemp` directory +under `TMPDIR` instead of hardcoded `/tmp`. Fingerprint pins are generated with `decernor fingerprint` on exported public files and staged into the checksum set before signing. Bindings From e7634b131e4a6aa0f9d4a56f4822f59a853293d6 Mon Sep 17 00:00:00 2001 From: Dave Thompson Date: Mon, 24 Aug 2026 18:08:29 -0400 Subject: [PATCH 3/3] fix(make): keep standalone gate POSIX /bin/sh safe CI failed on Ubuntu: make invokes /bin/sh (dash), which rejects `set -o pipefail`. Use an `&&` chain with mktemp under TMPDIR instead. Generated by Grok 4.5 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.5 Role: devlead Committer-of-Record: @3leapsdave --- Makefile | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/Makefile b/Makefile index 519eda8..8f14f01 100644 --- a/Makefile +++ b/Makefile @@ -312,13 +312,15 @@ install: build ## Install binary to BINDIR (default: ~/.local/bin) test-standalone-binary: build ## Verify built binary runs outside repo @echo "→ Standalone binary check (outside repo)..." - @set -euo pipefail; \ - tmp=$$(mktemp -d "$${TMPDIR:-/var/tmp}/decernor-standalone.XXXXXX"); \ - trap 'rm -rf "$$tmp"' EXIT; \ - cp "bin/$(BINARY_NAME)$(BINARY_EXT)" "$$tmp/$(BINARY_NAME)$(BINARY_EXT)"; \ - "$$tmp/$(BINARY_NAME)$(BINARY_EXT)" version >/dev/null; \ - "$$tmp/$(BINARY_NAME)$(BINARY_EXT)" --help >/dev/null; \ - echo "✅ Standalone binary check passed" + @# POSIX /bin/sh (dash on Ubuntu CI): no pipefail. Keep outside-repo check + @# under $${TMPDIR:-/var/tmp} — hardcoded /tmp is SIGKILL'd on some macOS hosts. + @tmp=$$(mktemp -d "$${TMPDIR:-/var/tmp}/decernor-standalone.XXXXXX") && \ + cp "bin/$(BINARY_NAME)$(BINARY_EXT)" "$$tmp/$(BINARY_NAME)$(BINARY_EXT)" && \ + "$$tmp/$(BINARY_NAME)$(BINARY_EXT)" version >/dev/null && \ + "$$tmp/$(BINARY_NAME)$(BINARY_EXT)" --help >/dev/null && \ + rm -rf "$$tmp" && \ + echo "✅ Standalone binary check passed" || \ + (rm -rf "$$tmp"; exit 1) build-all: verify-embedded-identity ## Build multi-platform binaries and generate checksums @echo "→ Building for multiple platforms..."