diff --git a/AGENTS.md b/AGENTS.md index 3344af5..3e4332f 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -8,8 +8,8 @@ proofs assert that helpers cannot import or use those files, and that shape-valid minisign public blobs use invalid Ed25519 encodings. **Generated-real material never enters this repository.** Real throwaway -keypairs are produced only by `cmd/synthcorpus-gen` into an isolated dogfooding -directory outside git (default `~/dev/dogfooding/`). Do not copy dogfood +keypairs are produced only by `cmd/synthcorpus-gen` into an isolated output +root outside git (`--out`, or `$SYNTHCORPUS_OUT/`). Do not copy that output into the worktree. Do not commit private keys, passphrases from live systems, or scan output from real machines. @@ -50,8 +50,8 @@ Generator: ```sh # never run with --out inside a git worktree -./bin/synthcorpus-gen --out ~/dev/dogfooding/decernor decernor -./bin/synthcorpus-lexgen --seed 7312026 --out ~/dev/dogfooding/lexmatrix +./bin/synthcorpus-gen --out /path/to/isolated-root decernor +./bin/synthcorpus-lexgen --seed 7312026 --out /path/to/isolated-root ``` The lexical lane splits its output into a sterile plane (`fixtures.json`, diff --git a/CHANGELOG.md b/CHANGELOG.md index 2edcd57..3321f0f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,25 @@ and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.ht ## [Unreleased] +## [0.1.3] - 2026-08-25 + +### Added + +- Link-only `CODE_OF_CONDUCT.md`, `CONTRIBUTING.md`, and `SECURITY.md` pointers + to [3leaps/oss-policies](https://github.com/3leaps/oss-policies). + +### Changed + +- **Decernor consumer pin is tagged `v0.1.5`.** Machine pin and docs name + `min_version` `0.1.5`, `preferred_tag` `v0.1.5`, and `preferred_commit` + `5dfd574`. Exact committed-synthetic fingerprint goldens track that binary; + fingerprint output is unchanged from the prior tagged cut, so goldens are + not rewritten. Locate remains `DECERNOR_BIN` / PATH. +- Generator `--out` help and public examples no longer advertise a host layout + path. Empty `--out` prefers `$SYNTHCORPUS_OUT/` (or `…/lexmatrix`) + before the local isolated-root fallback. +- README wording refers to 3 Leaps detectors without a “galaxy” framing. + ## [0.1.2] - 2026-08-20 ### Added @@ -91,7 +110,8 @@ and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.ht - The generator rejects Git worktrees and Git directories, stages output before publication, and restricts replacement to synthcorpus-owned directories. -[Unreleased]: https://github.com/3leaps/synthcorpus/compare/v0.1.2...HEAD +[Unreleased]: https://github.com/3leaps/synthcorpus/compare/v0.1.3...HEAD +[0.1.3]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.3 [0.1.2]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.2 [0.1.1]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.1 [0.1.0]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.0 diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..f2d2365 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,4 @@ +# Code of Conduct + +This project follows the 3 Leaps Code of Conduct published in +[3leaps/oss-policies](https://github.com/3leaps/oss-policies). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..a2ccf05 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,6 @@ +# Contributing + +Contribution guidelines for 3 Leaps open source projects live in +[3leaps/oss-policies](https://github.com/3leaps/oss-policies). + +This repository conforms to the Sensitive Local Data policy published there. diff --git a/README.md b/README.md index 512225a..1bca241 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,10 @@ # synthcorpus — real-shaped, never real. -▎ The shared synthetic-fixture corpus for the 3 Leaps galaxy's security detectors. +▎ The shared synthetic-fixture corpus for 3 Leaps security detectors. ## Elevator -synthcorpus is the shared, synthetic security-fixture corpus for the 3 Leaps galaxy's detectors — decernor first, seclusor and others next. It commits provably-bogus, scanner-safe specimens of GPG, minisign, and SSH key material — including the passphrase-protected and deliberately-malformed shapes detectors trip on — plus golden manifests pinned against the real tool's output. For the cases that demand actual cryptographic material, it ships an on-demand generator that produces real-but-throwaway keypairs into an isolated dogfooding area that is never a git repo and never committed. The whole design turns on one line: generated-real material stays out of git; only synthetic fixtures land in the tree. That keeps a detector like decernor honest — provable against realistic, every-shape key material, without a single real credential ever entering a repo. +synthcorpus is the shared, synthetic security-fixture corpus for 3 Leaps detectors — decernor first, seclusor and others next. It commits provably-bogus, scanner-safe specimens of GPG, minisign, and SSH key material — including the passphrase-protected and deliberately-malformed shapes detectors trip on — plus golden manifests pinned against the real tool's output. For the cases that demand actual cryptographic material, it ships an on-demand generator that produces real-but-throwaway keypairs into an isolated output root that is never a git repo and never committed. The whole design turns on one line: generated-real material stays out of git; only synthetic fixtures land in the tree. That keeps a detector like decernor honest — provable against realistic, every-shape key material, without a single real credential ever entering a repo. --- @@ -20,8 +20,8 @@ One-line: Synthetic, scanner-safe security-fixture corpus + throwaway-key genera | `cmd/synthcorpus-gen` | Generated-real mint (dogfooding roots only; never inside git) | | `cmd/synthcorpus-lexgen` | Lexical-mutation corpus generator (same never-inside-git rule) | | `docs/lexical-matrix.md` | Lexical-mutation matrix v1 — grammar, cells, floors, output planes | -| `manifests/decernor-pin.json` | Consumer pin for drift-check locate-by-binary (tagged decernor `v0.1.4`) | -| `docs/releases/` | Per-cut notes; current pack is [`v0.1.2`](docs/releases/v0.1.2.md) | +| `manifests/decernor-pin.json` | Consumer pin for drift-check locate-by-binary (tagged decernor `v0.1.5`) | +| `docs/releases/` | Per-cut notes; current pack is [`v0.1.3`](docs/releases/v0.1.3.md) | | `manifests/decernor-fingerprint-golden.json` | Deterministic committed-synthetic fingerprint contract | | `manifests/decernor-generated-real-properties.json` | Property-only generated-real contract (no exact random values) | | `AGENTS.md` | Agent guide — **safety header first** | @@ -29,7 +29,7 @@ One-line: Synthetic, scanner-safe security-fixture corpus + throwaway-key genera ```sh make check-all DECERNOR_BIN=/absolute/path/to/decernor make contract -./bin/synthcorpus-gen --out ~/dev/dogfooding/decernor decernor # outside this repo +./bin/synthcorpus-gen --out /path/to/isolated-root decernor # outside this repo ``` ## License diff --git a/RELEASE_CHECKLIST.md b/RELEASE_CHECKLIST.md index a510196..3bac347 100644 --- a/RELEASE_CHECKLIST.md +++ b/RELEASE_CHECKLIST.md @@ -217,6 +217,6 @@ ceremony. - [ ] Confirm the tag and GitHub release resolve to the intended `main` commit. - [ ] Confirm the three required checks remain green on that commit. -- [ ] Verify `[Unreleased]` in `CHANGELOG.md` starts from `v0.1.2`. +- [ ] Verify `[Unreleased]` in `CHANGELOG.md` starts from `v0.1.3`. - [ ] Keep only the three most recent entries in `RELEASE_NOTES.md`; retain the complete per-release narrative under `docs/releases/`. diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 49e8097..b5c8c2c 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -4,6 +4,42 @@ This file contains release notes for up to the three most recent releases in rev --- +## v0.1.3 (2026-08-25) + +**Decernor v0.1.5 pin and public baseline** + +synthcorpus v0.1.3 pins the Decernor consumer contract to tagged `v0.1.5`, +adds link-only community stubs, and cleans public examples so they do not +advertise a host layout path. Generated-real material still never enters Git. +Releases remain signed tags plus notes. Early scaffold commits are historical; +the current tree is the public contract. + +### Highlights + +- **Decernor consumer pin is tagged `v0.1.5`.** Machine pin and docs name + `0.1.5` / `v0.1.5` / `5dfd574`. Exact committed-synthetic fingerprint + goldens track that binary. Fingerprint output is unchanged from the prior + tagged cut; goldens are not rewritten. Locate remains `DECERNOR_BIN` / PATH. +- Link-only `CODE_OF_CONDUCT.md`, `CONTRIBUTING.md`, and `SECURITY.md` point at + `3leaps/oss-policies` (no forked policy bodies). +- Generator help and public examples use `--out /path/to/isolated-root` or + `$SYNTHCORPUS_OUT`; they no longer advertise a host path. +- Repository and generator report version `0.1.3`. No-publish posture is + unchanged: no prebuilt generator binary or attached corpus bundle. + +### Governing invariant + +Generated-real material never enters the repository. Only registered, +provably unusable committed-synthetic specimens live under `fixtures/`. + +### Compatibility + +No migration is required. Consumer contract callers must supply a Decernor +binary that satisfies `manifests/decernor-pin.json` (`v0.1.5` / `5dfd574`). + +See [docs/releases/v0.1.3.md](docs/releases/v0.1.3.md) for the complete release +narrative. + ## v0.1.2 (2026-08-20) **MIT license** @@ -28,7 +64,8 @@ provably unusable committed-synthetic specimens live under `fixtures/`. ### Compatibility -No migration is required. The Decernor consumer pin remains tagged `v0.1.4`. +No migration is required. The Decernor consumer pin remained tagged `v0.1.4` +for that cut. See [docs/releases/v0.1.2.md](docs/releases/v0.1.2.md) for the complete release narrative. @@ -69,51 +106,3 @@ binary that satisfies `manifests/decernor-pin.json` (`v0.1.4` / `32d0176`). See [docs/releases/v0.1.1.md](docs/releases/v0.1.1.md) for the complete release narrative. - -## v0.1.0 (2026-07-22) - -**Synthetic Security Fixtures with Provable Boundaries** - -synthcorpus v0.1.0 provides a shared, real-shaped security-fixture corpus for -detectors while keeping real credentials out of Git. The initial release pairs -provably unusable committed fixtures with an isolated throwaway-key generator -for the cases that require genuine cryptographic structure. - -### Highlights - -- **Committed-synthetic security fixtures.** Real-shaped GPG, minisign, SSH, - and malformed specimens are synthetic by construction and backed by - structural and negative-crypto proofs. -- **Isolated generated-real minting.** `synthcorpus-gen` creates throwaway real - key material only in guarded dogfooding directories outside Git worktrees. -- **Decernor consumer contracts.** A locate-by-binary pin, deterministic golden - fingerprints for committed fixtures, and property-only generated-real checks - detect consumer drift without committing real key material. -- **Cross-platform guardrail CI.** Ubuntu and macOS run the complete default Go - lane and prove guardrail tests execute without skips; a separate redacted - Gitleaks lane scans the tree and runs hermetic scanner canaries. -- **Declared platform coverage.** A machine-checked five-platform matrix - separates required coverage from observed execution. Only active lanes count; - blocked, deferred, and excluded states require a missing capability, reason, - and lift condition instead of silent skips or emulation. -- **Release identity and structural no-publish enforcement.** The repository - and generator report version `0.1.0`; workflow policy rejects capabilities - outside its exact allowed set, and repository policy forbids defined packaging - and release-automation surfaces. Releases are signed tags plus notes, with no - prebuilt generator binary, package-manager artifact, separately attached - corpus bundle, artifact signature or key, checksum manifest, or provenance - asset. GitHub's automatic source archives contain only repository content and - therefore no generated-real material. - -### Governing invariant - -Generated-real material never enters the repository. Only registered, -provably unusable committed-synthetic specimens live under `fixtures/`. - -### Compatibility - -This is the initial release. There is no upgrade or migration requirement. -The generator remains a repository-local dogfooding tool and is not distributed. - -See [docs/releases/v0.1.0.md](docs/releases/v0.1.0.md) for the complete release -narrative. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..fa94924 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,4 @@ +# Security + +Security reporting and policy for 3 Leaps open source projects live in +[3leaps/oss-policies](https://github.com/3leaps/oss-policies). diff --git a/VERSION b/VERSION index d917d3e..b1e80bb 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.1.2 +0.1.3 diff --git a/cmd/synthcorpus-gen/main.go b/cmd/synthcorpus-gen/main.go index 88c6c25..b9997fd 100644 --- a/cmd/synthcorpus-gen/main.go +++ b/cmd/synthcorpus-gen/main.go @@ -7,6 +7,7 @@ import ( "io" "os" "path/filepath" + "strings" "github.com/3leaps/synthcorpus" "github.com/3leaps/synthcorpus/internal/generator" @@ -26,7 +27,7 @@ func run(args []string, stdout, stderr io.Writer) error { var out string var force bool var showVersion bool - fs.StringVar(&out, "out", "", "output directory; defaults to ~/dev/dogfooding/") + fs.StringVar(&out, "out", "", "output directory outside any git worktree; empty uses $SYNTHCORPUS_OUT/ or a local isolated root") fs.BoolVar(&force, "force", false, "replace an existing synthcorpus-owned generated-real directory") fs.BoolVar(&showVersion, "version", false, "print version and exit") @@ -43,11 +44,15 @@ func run(args []string, stdout, stderr io.Writer) error { tool := fs.Arg(0) if out == "" { - home, err := os.UserHomeDir() - if err != nil { - return fmt.Errorf("resolve home directory: %w", err) + if root := strings.TrimSpace(os.Getenv("SYNTHCORPUS_OUT")); root != "" { + out = filepath.Join(root, tool) + } else { + home, err := os.UserHomeDir() + if err != nil { + return fmt.Errorf("resolve home directory: %w", err) + } + out = filepath.Join(home, "dev", "dogfooding", tool) } - out = filepath.Join(home, "dev", "dogfooding", tool) } return generator.Generate(context.Background(), generator.Options{ diff --git a/cmd/synthcorpus-lexgen/main.go b/cmd/synthcorpus-lexgen/main.go index 0d99d1e..29a7615 100644 --- a/cmd/synthcorpus-lexgen/main.go +++ b/cmd/synthcorpus-lexgen/main.go @@ -6,6 +6,7 @@ import ( "io" "os" "path/filepath" + "strings" "github.com/3leaps/synthcorpus" "github.com/3leaps/synthcorpus/internal/lexmatrix" @@ -29,7 +30,7 @@ func run(args []string, stdout, stderr io.Writer) error { var includeExtensions bool var showVersion bool - fs.StringVar(&out, "out", "", "output directory; defaults to ~/dev/dogfooding/lexmatrix") + fs.StringVar(&out, "out", "", "output directory outside any git worktree; empty uses $SYNTHCORPUS_OUT/lexmatrix or a local isolated root") fs.UintVar(&seed, "seed", 0, "generation seed (0-4294967295)") fs.StringVar(&profile, "profile", "seed", "corpus profile label recorded in the fixture set; does not change generation") fs.BoolVar(&force, "force", false, "replace an existing synthcorpus-owned output directory") @@ -56,11 +57,15 @@ func run(args []string, stdout, stderr io.Writer) error { } if out == "" { - home, err := os.UserHomeDir() - if err != nil { - return fmt.Errorf("resolve home directory: %w", err) + if root := strings.TrimSpace(os.Getenv("SYNTHCORPUS_OUT")); root != "" { + out = filepath.Join(root, "lexmatrix") + } else { + home, err := os.UserHomeDir() + if err != nil { + return fmt.Errorf("resolve home directory: %w", err) + } + out = filepath.Join(home, "dev", "dogfooding", "lexmatrix") } - out = filepath.Join(home, "dev", "dogfooding", "lexmatrix") } result, err := lexmatrix.Generate(lexmatrix.Options{ diff --git a/docs/decernor-pin.md b/docs/decernor-pin.md index 9a993a6..793c08c 100644 --- a/docs/decernor-pin.md +++ b/docs/decernor-pin.md @@ -8,9 +8,9 @@ worktree path, never a Go module import from decernor into synthcorpus. | Field | Value | |-------|-------| | Source | https://github.com/3leaps/decernor | -| Min version | `0.1.4` | -| Preferred tag | `v0.1.4` | -| Preferred commit | `32d0176` (object named by the tag; GPG-primary contract token and hex minisign blob SHA) | +| Min version | `0.1.5` | +| Preferred tag | `v0.1.5` | +| Preferred commit | `5dfd574` (object named by the tag; GPG-primary contract token and hex minisign blob SHA) | | Machine pin file | [`manifests/decernor-pin.json`](../manifests/decernor-pin.json) | The **tag** is the locate contract. `preferred_commit` records the tagged @@ -28,8 +28,8 @@ Verify identity with extended version output (never parse secret material): ```sh "$DECERNOR_BIN" version -e -# Version: 0.1.4 -# Commit: 32d0176 +# Version: 0.1.5 +# Commit: 5dfd574 ``` Package helper: `internal/decernorloc` (`Locate`, `ReadIdentity`, `CheckPin`). diff --git a/docs/decisions/ADR-0001-generated-real-boundary.md b/docs/decisions/ADR-0001-generated-real-boundary.md index c51d762..c3eb8dc 100644 --- a/docs/decisions/ADR-0001-generated-real-boundary.md +++ b/docs/decisions/ADR-0001-generated-real-boundary.md @@ -15,7 +15,7 @@ The repository exists because detector repos must not mint or commit real key ma ## Decision -Generated-real material is produced only by `cmd/synthcorpus-gen` into an output root outside git, defaulting to `~/dev/dogfooding/`. The generator refuses to use an output path inside a git worktree and writes a synthcorpus ownership marker so `--force` can only replace directories it owns. +Generated-real material is produced only by `cmd/synthcorpus-gen` into an output root outside git (`--out`, or `$SYNTHCORPUS_OUT/`, with a local isolated-root fallback). The generator refuses to use an output path inside a git worktree and writes a synthcorpus ownership marker so `--force` can only replace directories it owns. Committed fixtures, added in later briefs, must be synthetic by construction and must carry their own proof that they are not usable keys. diff --git a/docs/lexical-matrix.md b/docs/lexical-matrix.md index 95866ec..5801db7 100644 --- a/docs/lexical-matrix.md +++ b/docs/lexical-matrix.md @@ -98,7 +98,7 @@ are flagged `critical_seed`: the answer key asserts these are never missed. ## Output ```sh -./bin/synthcorpus-lexgen --seed 7312026 --out ~/dev/dogfooding/lexmatrix +./bin/synthcorpus-lexgen --seed 7312026 --out /path/to/isolated-root ``` | Flag | Effect | diff --git a/docs/releases/v0.1.0.md b/docs/releases/v0.1.0.md index d1b1e11..0f9d7eb 100644 --- a/docs/releases/v0.1.0.md +++ b/docs/releases/v0.1.0.md @@ -60,7 +60,7 @@ with the bounded synthcorpus ownership marker. ```sh make build ./bin/synthcorpus-gen -version -./bin/synthcorpus-gen --out ~/dev/dogfooding/decernor decernor +./bin/synthcorpus-gen --out /path/to/isolated-root decernor ``` Never copy generated dogfooding output into this repository. diff --git a/docs/releases/v0.1.1.md b/docs/releases/v0.1.1.md index 1ae4886..5dda6aa 100644 --- a/docs/releases/v0.1.1.md +++ b/docs/releases/v0.1.1.md @@ -61,8 +61,8 @@ synthcorpus ownership marker for that lane. make build ./bin/synthcorpus-gen -version ./bin/synthcorpus-lexgen --version -./bin/synthcorpus-gen --out ~/dev/dogfooding/decernor decernor -./bin/synthcorpus-lexgen --seed 7312026 --out ~/dev/dogfooding/lexmatrix +./bin/synthcorpus-gen --out /path/to/isolated-root decernor +./bin/synthcorpus-lexgen --seed 7312026 --out /path/to/isolated-root ``` Never copy generated dogfooding output into this repository. diff --git a/docs/releases/v0.1.3.md b/docs/releases/v0.1.3.md new file mode 100644 index 0000000..48487cc --- /dev/null +++ b/docs/releases/v0.1.3.md @@ -0,0 +1,63 @@ +# synthcorpus v0.1.3 Release Notes + +**Release date:** 2026-08-25 + +## Summary + +**Decernor v0.1.5 pin and public baseline** + +synthcorpus v0.1.3 pins the Decernor consumer contract to tagged `v0.1.5`, +adds link-only community stubs, and cleans public generator examples so they +do not advertise a host layout path. The committed-synthetic corpus and +generated-real boundary are unchanged. Early scaffold commits remain in +history as historical artifacts; the current tree is the public contract. + +## Highlights + +- **Decernor consumer pin is tagged `v0.1.5`.** Machine pin and docs name + `min_version` `0.1.5`, `preferred_tag` `v0.1.5`, and `preferred_commit` + `5dfd574`. Exact committed-synthetic fingerprint goldens track that binary. + Fingerprint output is unchanged from the prior tagged cut; goldens are not + rewritten. Locate remains `DECERNOR_BIN` / PATH. +- Link-only `CODE_OF_CONDUCT.md`, `CONTRIBUTING.md`, and `SECURITY.md` point at + [3leaps/oss-policies](https://github.com/3leaps/oss-policies) without forked + policy bodies. +- Generator `--out` help prefers `$SYNTHCORPUS_OUT` when set; public examples + use `--out /path/to/isolated-root`. +- README refers to 3 Leaps detectors without a “galaxy” framing. +- Repository and generator report version `0.1.3`. + +## Governing invariant + +Generated-real material never enters the repository. Only registered, +provably unusable committed-synthetic specimens live under `fixtures/`. + +## Decernor contract + +The consumer pin is tagged Decernor `v0.1.5` (`5dfd574`). Locate stays +`DECERNOR_BIN` or `PATH`. Exact goldens are unchanged from the prior pin. + +## Verification + +- `make test` runs the portable pure-Go suite. +- `DECERNOR_BIN=/absolute/path/to/decernor make contract` runs the exact + committed-synthetic and property-only generated-real consumer lanes. +- `make check-all` combines formatting, tests, build, scanner, proof, contract, + and diff-clean gates. + +## Compatibility + +No migration is required. The generator remains a repository-local tool and is +not distributed. Consumer contract callers must supply a Decernor binary that +satisfies `manifests/decernor-pin.json` (`v0.1.5` / `5dfd574`). + +## Release vehicle + +v0.1.3 is a GPG-signed Git tag plus GitHub release notes. Version tag refs are +protected against unauthorized creation or mutation by the repository ruleset. +GitHub's automatic source archives are expected; they contain the committed +repository, including the committed-synthetic corpus, and no generated-real +material. No prebuilt generator binary, package-manager artifact, separately +attached corpus bundle, artifact signature or key, checksum manifest, or +provenance asset is published. This posture is governed by +[`docs/decisions/ADR-0002-no-publish-no-worktree-generator.md`](../decisions/ADR-0002-no-publish-no-worktree-generator.md). diff --git a/internal/decernorloc/locate_test.go b/internal/decernorloc/locate_test.go index cb61243..0ec0230 100644 --- a/internal/decernorloc/locate_test.go +++ b/internal/decernorloc/locate_test.go @@ -72,7 +72,7 @@ func TestLoadPinRoundTrip(t *testing.T) { if err != nil { t.Fatal(err) } - if pin.MinVersion != "0.1.4" || pin.PreferredTag != "v0.1.4" || pin.PreferredCommit != "32d0176" { + if pin.MinVersion != "0.1.5" || pin.PreferredTag != "v0.1.5" || pin.PreferredCommit != "5dfd574" { t.Fatalf("pin = %#v", pin) } if pin.Locate.Env != EnvBinary { diff --git a/internal/generator/generator.go b/internal/generator/generator.go index 760247e..a60c11a 100644 --- a/internal/generator/generator.go +++ b/internal/generator/generator.go @@ -15,9 +15,9 @@ import ( // stagingDirPrefix is a short, marker-style name for the mint staging root. // Longer historical names (.synthcorpus-staging--) pushed -// isolated GNUPGHOME paths over macOS AF_UNIX limits on shallow dogfood -// parents such as ~/dev/dogfooding, so gpg-agent could not start even though -// the final published root would have been short enough. +// isolated GNUPGHOME paths over macOS AF_UNIX limits on shallow isolated +// output parents, so gpg-agent could not start even though the final +// published root would have been short enough. const stagingDirPrefix = ".sc-stg-" const ( diff --git a/internal/generator/gpg_home.go b/internal/generator/gpg_home.go index 620140d..a35b585 100644 --- a/internal/generator/gpg_home.go +++ b/internal/generator/gpg_home.go @@ -12,8 +12,8 @@ import ( // home+"/S.gpg-agent" stays safely under the limit with a few bytes of slack. // // 104 - 13 (socket) - 1 (NUL) - slack → keep homes ≤ 80 when create-socketdir -// is unavailable. Historical long staging names under ~/dev/dogfooding reached -// ~88 chars and gpg-agent failed to start on macOS without /run/user. +// is unavailable. Historical long staging names under shallow isolated roots +// reached ~88 chars and gpg-agent failed to start on macOS without /run/user. const maxGNUPGHomeWithoutSocketdir = 80 // prepareGPGHome ensures the isolated home is ready for agent use. Deep diff --git a/manifests/decernor-pin.json b/manifests/decernor-pin.json index 5004aad..fac8833 100644 --- a/manifests/decernor-pin.json +++ b/manifests/decernor-pin.json @@ -3,9 +3,9 @@ "kind": "synthcorpus-decernor-pin", "consumer": "synthcorpus", "tool": "decernor", - "min_version": "0.1.4", - "preferred_tag": "v0.1.4", - "preferred_commit": "32d0176", + "min_version": "0.1.5", + "preferred_tag": "v0.1.5", + "preferred_commit": "5dfd574", "source_repo": "https://github.com/3leaps/decernor", "locate": { "env": "DECERNOR_BIN",