diff --git a/.attest.json b/.attest.json new file mode 100644 index 0000000..ba4a063 --- /dev/null +++ b/.attest.json @@ -0,0 +1,4 @@ +{ + "requireAttestation": true, + "requireTestsPassed": true +} diff --git a/.augur.toml b/.augur.toml new file mode 100644 index 0000000..031b459 --- /dev/null +++ b/.augur.toml @@ -0,0 +1,3 @@ +[thresholds] +review = 35 +block = 65 diff --git a/.claude/commands/specsync/create-change.md b/.claude/commands/specsync/create-change.md new file mode 100644 index 0000000..04707cc --- /dev/null +++ b/.claude/commands/specsync/create-change.md @@ -0,0 +1,10 @@ +--- +description: Create and guide a verified spec-sync SDD change through its deterministic interview +argument-hint: +--- + +1. Run `specsync change new "$ARGUMENTS" --json`. +2. Read the returned `questions` array and interview the user one question at a time. +3. Record each answer with `specsync change answer --json`. +4. Continue until the question list is empty, then show the selected artifacts and next action. +5. Do not approve, implement, verify, accept, or archive until the corresponding human gate or work stage is reached. diff --git a/.claude/commands/specsync/create-spec.md b/.claude/commands/specsync/create-spec.md new file mode 100644 index 0000000..16cc07f --- /dev/null +++ b/.claude/commands/specsync/create-spec.md @@ -0,0 +1,39 @@ +--- +description: Scaffold a new spec-sync module spec from a module name or a natural-language feature description (full scaffold by default, or minimal with --minimal) +argument-hint: [--minimal] +--- + +Create a new spec-sync module spec. + +Arguments: `$ARGUMENTS` + +1. Remove `--minimal` if present, remember that minimal mode was requested, + and preserve the complete remaining input without choosing a module name yet. +2. Classify the complete remaining input. It will be one of: + - **A bare module name** — a short identifier like `auth-service` or + `billing`. Use it as-is. + - **A free-text feature description** — a sentence or phrase describing + what to build, e.g. `"I want a feature that lets users export their + data as CSV"`. In this case, invent a short, kebab-case module name that + captures the idea (e.g. `csv-export`). If the right name is ambiguous, + ask the user to confirm or rename it before continuing. Keep the full + description at hand — you'll use it in step 5. +3. If minimal mode was requested, run: + ``` + specsync new + ``` + This creates a minimal spec only (no companion files). +4. Otherwise (default), run: + ``` + specsync scaffold + ``` + This creates the spec, companion files (`tasks.md`, `requirements.md`, + `context.md`, `testing.md`, and `design.md` if `companions.design` is + enabled), a registry entry, and auto-detects related source files. +5. Open the newly created `specs//.spec.md` and fill + in the `Purpose`, `Invariants`, and `Public API` sections. If a free-text + description was given in step 2, use it directly to draft these sections — + ask clarifying questions if it's underspecified, but do not leave the + sections as unfilled placeholder text. Do the same for `requirements.md` + (acceptance criteria) and `tasks.md` (initial task breakdown), if present. +6. Run `specsync check` to confirm the new spec passes validation. diff --git a/.claude/skills/spec-sync/SKILL.md b/.claude/skills/spec-sync/SKILL.md new file mode 100644 index 0000000..311a220 --- /dev/null +++ b/.claude/skills/spec-sync/SKILL.md @@ -0,0 +1,75 @@ +--- +name: spec-sync +description: Keep markdown module specs in specs// synchronized with source code using spec-sync. Use this whenever creating, editing, or reviewing code in a module that has (or should have) a spec, or whenever the user mentions specs, spec-sync, companion files (tasks.md/requirements.md/context.md/testing.md/design.md), or asks to add/update a module's documentation. +--- + +# Spec-Sync Workflow + +This project uses [spec-sync](https://github.com/CorvidLabs/spec-sync) for bidirectional spec-to-code validation. Specs live in `specs//.spec.md`. + +## Verified SDD change lifecycle (5.0) + +For every meaningful source, test, public documentation, schema, or configuration change: + +1. Run `specsync change new "" --json` and conduct the returned interview with the user. +2. Use `specsync change answer --json` until no questions remain. +3. Complete the adaptively selected artifacts and semantic deltas. Requirements use stable + `REQ--` IDs, a normative SHALL statement, and acceptance criteria. +4. Ask the user for the definition approval, then run `specsync change approve `. +5. Run `specsync change start ` before editing implementation code. +6. Keep tasks and artifacts current, then run `specsync change verify `. +7. Present verification evidence and ask for closing approval. Only after explicit approval, + run `specsync change accept `; archive separately with `specsync change archive `. + +Never invent or self-grant either human approval. If an approved definition changes, its digest +becomes stale and must be approved again. `specsync check` validates canonical specs plus approved +active deltas, requirement-to-test evidence, change coverage, and CI gates. + +## Companion files + +Each canonical spec may have policy-selected companion files. Read and update the ones present; do not create empty companions only for ceremony: + +- **`tasks.md`** — Work items for this module. Check off tasks (`- [x]`) as you complete them. Add new tasks if you discover work needed. +- **`requirements.md`** — Acceptance criteria and user stories. These are permanent invariants, not tasks — do not check them off. Update if requirements change. +- **`context.md`** — Architectural decisions, key files, and current status. Update when you make design decisions or change what's in progress. +- **`testing.md`** — Test strategy: automated test locations, manual QA checklists, and edge cases/boundary conditions. +- **`design.md`** *(opt-in)* — Layout, component hierarchy, design tokens, and asset references. Present when `companions.design` is enabled in config. + +## Before modifying any module + +1. Read the relevant spec in `specs//.spec.md` +2. Read whichever companion files are present (`requirements.md`, `tasks.md`, `context.md`, `testing.md`, `design.md`, or project-defined files) +3. After changes, run `specsync check` to verify specs still pass + +## After completing work + +1. Mark completed items in `tasks.md` — check off finished tasks, add new ones discovered +2. Update `context.md` — record decisions made, update current status +3. If requirements changed, update `requirements.md` acceptance criteria +4. If test coverage changed, update `testing.md` with new test files or edge cases +5. If UI/layout changed, update `design.md` with revised layout, components, or tokens + +## Before creating a PR + +Run `specsync check --strict` — all specs must pass with zero warnings. + +## When adding new modules + +Run `specsync scaffold ` to create a spec, companion files, a registry +entry, and auto-detected source files — or `specsync new ` for a +minimal spec-only draft. Complete the spec before writing code. The +`/specsync:create-spec` command (or tool-equivalent) runs this for you, and +accepts either a bare module name or a natural-language feature description +(e.g. `/specsync:create-spec "I want a feature that lets users export their +data as CSV"`) — pass a description and it will pick a module name and use +the description to draft the spec's Purpose and Requirements. + +## Key commands + +- `specsync check` — validate all specs against source code +- `specsync check --json` — machine-readable validation output +- `specsync coverage` — show which modules lack specs +- `specsync score` — quality score for each spec (0-100) +- `specsync scaffold ` — full scaffold: spec + companions + registry entry + source detection +- `specsync new ` — quick-create a minimal spec (add `--full` for companions) +- `specsync resolve --remote` — verify cross-project dependencies diff --git a/.codex/skills/spec-sync/SKILL.md b/.codex/skills/spec-sync/SKILL.md new file mode 100644 index 0000000..311a220 --- /dev/null +++ b/.codex/skills/spec-sync/SKILL.md @@ -0,0 +1,75 @@ +--- +name: spec-sync +description: Keep markdown module specs in specs// synchronized with source code using spec-sync. Use this whenever creating, editing, or reviewing code in a module that has (or should have) a spec, or whenever the user mentions specs, spec-sync, companion files (tasks.md/requirements.md/context.md/testing.md/design.md), or asks to add/update a module's documentation. +--- + +# Spec-Sync Workflow + +This project uses [spec-sync](https://github.com/CorvidLabs/spec-sync) for bidirectional spec-to-code validation. Specs live in `specs//.spec.md`. + +## Verified SDD change lifecycle (5.0) + +For every meaningful source, test, public documentation, schema, or configuration change: + +1. Run `specsync change new "" --json` and conduct the returned interview with the user. +2. Use `specsync change answer --json` until no questions remain. +3. Complete the adaptively selected artifacts and semantic deltas. Requirements use stable + `REQ--` IDs, a normative SHALL statement, and acceptance criteria. +4. Ask the user for the definition approval, then run `specsync change approve `. +5. Run `specsync change start ` before editing implementation code. +6. Keep tasks and artifacts current, then run `specsync change verify `. +7. Present verification evidence and ask for closing approval. Only after explicit approval, + run `specsync change accept `; archive separately with `specsync change archive `. + +Never invent or self-grant either human approval. If an approved definition changes, its digest +becomes stale and must be approved again. `specsync check` validates canonical specs plus approved +active deltas, requirement-to-test evidence, change coverage, and CI gates. + +## Companion files + +Each canonical spec may have policy-selected companion files. Read and update the ones present; do not create empty companions only for ceremony: + +- **`tasks.md`** — Work items for this module. Check off tasks (`- [x]`) as you complete them. Add new tasks if you discover work needed. +- **`requirements.md`** — Acceptance criteria and user stories. These are permanent invariants, not tasks — do not check them off. Update if requirements change. +- **`context.md`** — Architectural decisions, key files, and current status. Update when you make design decisions or change what's in progress. +- **`testing.md`** — Test strategy: automated test locations, manual QA checklists, and edge cases/boundary conditions. +- **`design.md`** *(opt-in)* — Layout, component hierarchy, design tokens, and asset references. Present when `companions.design` is enabled in config. + +## Before modifying any module + +1. Read the relevant spec in `specs//.spec.md` +2. Read whichever companion files are present (`requirements.md`, `tasks.md`, `context.md`, `testing.md`, `design.md`, or project-defined files) +3. After changes, run `specsync check` to verify specs still pass + +## After completing work + +1. Mark completed items in `tasks.md` — check off finished tasks, add new ones discovered +2. Update `context.md` — record decisions made, update current status +3. If requirements changed, update `requirements.md` acceptance criteria +4. If test coverage changed, update `testing.md` with new test files or edge cases +5. If UI/layout changed, update `design.md` with revised layout, components, or tokens + +## Before creating a PR + +Run `specsync check --strict` — all specs must pass with zero warnings. + +## When adding new modules + +Run `specsync scaffold ` to create a spec, companion files, a registry +entry, and auto-detected source files — or `specsync new ` for a +minimal spec-only draft. Complete the spec before writing code. The +`/specsync:create-spec` command (or tool-equivalent) runs this for you, and +accepts either a bare module name or a natural-language feature description +(e.g. `/specsync:create-spec "I want a feature that lets users export their +data as CSV"`) — pass a description and it will pick a module name and use +the description to draft the spec's Purpose and Requirements. + +## Key commands + +- `specsync check` — validate all specs against source code +- `specsync check --json` — machine-readable validation output +- `specsync coverage` — show which modules lack specs +- `specsync score` — quality score for each spec (0-100) +- `specsync scaffold ` — full scaffold: spec + companions + registry entry + source detection +- `specsync new ` — quick-create a minimal spec (add `--full` for companions) +- `specsync resolve --remote` — verify cross-project dependencies diff --git a/.cursor/commands/specsync-create-change.md b/.cursor/commands/specsync-create-change.md new file mode 100644 index 0000000..49402f3 --- /dev/null +++ b/.cursor/commands/specsync-create-change.md @@ -0,0 +1,9 @@ +Create a verified spec-sync SDD change. + +Arguments: $ARGUMENTS + +1. Run `specsync change new "$ARGUMENTS" --json`. +2. Read the returned `questions` array and interview the user one question at a time. +3. Record each answer with `specsync change answer --json`. +4. Continue until the question list is empty, then show the selected artifacts and next action. +5. Do not approve, implement, verify, accept, or archive until the corresponding human gate or work stage is reached. diff --git a/.cursor/commands/specsync-create-spec.md b/.cursor/commands/specsync-create-spec.md new file mode 100644 index 0000000..9af4a46 --- /dev/null +++ b/.cursor/commands/specsync-create-spec.md @@ -0,0 +1,34 @@ +Create a new spec-sync module spec. + +Arguments: $ARGUMENTS + +1. Remove `--minimal` if present, remember that minimal mode was requested, + and preserve the complete remaining input without choosing a module name yet. +2. Classify the complete remaining input. It will be one of: + - **A bare module name** — a short identifier like `auth-service` or + `billing`. Use it as-is. + - **A free-text feature description** — a sentence or phrase describing + what to build, e.g. `"I want a feature that lets users export their + data as CSV"`. In this case, invent a short, kebab-case module name that + captures the idea (e.g. `csv-export`). If the right name is ambiguous, + ask the user to confirm or rename it before continuing. Keep the full + description at hand — you'll use it in step 5. +3. If minimal mode was requested, run: + ``` + specsync new + ``` + This creates a minimal spec only (no companion files). +4. Otherwise (default), run: + ``` + specsync scaffold + ``` + This creates the spec, companion files (`tasks.md`, `requirements.md`, + `context.md`, `testing.md`, and `design.md` if `companions.design` is + enabled), a registry entry, and auto-detects related source files. +5. Open the newly created `specs//.spec.md` and fill + in the `Purpose`, `Invariants`, and `Public API` sections. If a free-text + description was given in step 2, use it directly to draft these sections — + ask clarifying questions if it's underspecified, but do not leave the + sections as unfilled placeholder text. Do the same for `requirements.md` + (acceptance criteria) and `tasks.md` (initial task breakdown), if present. +6. Run `specsync check` to confirm the new spec passes validation. diff --git a/.cursor/skills/spec-sync/SKILL.md b/.cursor/skills/spec-sync/SKILL.md new file mode 100644 index 0000000..311a220 --- /dev/null +++ b/.cursor/skills/spec-sync/SKILL.md @@ -0,0 +1,75 @@ +--- +name: spec-sync +description: Keep markdown module specs in specs// synchronized with source code using spec-sync. Use this whenever creating, editing, or reviewing code in a module that has (or should have) a spec, or whenever the user mentions specs, spec-sync, companion files (tasks.md/requirements.md/context.md/testing.md/design.md), or asks to add/update a module's documentation. +--- + +# Spec-Sync Workflow + +This project uses [spec-sync](https://github.com/CorvidLabs/spec-sync) for bidirectional spec-to-code validation. Specs live in `specs//.spec.md`. + +## Verified SDD change lifecycle (5.0) + +For every meaningful source, test, public documentation, schema, or configuration change: + +1. Run `specsync change new "" --json` and conduct the returned interview with the user. +2. Use `specsync change answer --json` until no questions remain. +3. Complete the adaptively selected artifacts and semantic deltas. Requirements use stable + `REQ--` IDs, a normative SHALL statement, and acceptance criteria. +4. Ask the user for the definition approval, then run `specsync change approve `. +5. Run `specsync change start ` before editing implementation code. +6. Keep tasks and artifacts current, then run `specsync change verify `. +7. Present verification evidence and ask for closing approval. Only after explicit approval, + run `specsync change accept `; archive separately with `specsync change archive `. + +Never invent or self-grant either human approval. If an approved definition changes, its digest +becomes stale and must be approved again. `specsync check` validates canonical specs plus approved +active deltas, requirement-to-test evidence, change coverage, and CI gates. + +## Companion files + +Each canonical spec may have policy-selected companion files. Read and update the ones present; do not create empty companions only for ceremony: + +- **`tasks.md`** — Work items for this module. Check off tasks (`- [x]`) as you complete them. Add new tasks if you discover work needed. +- **`requirements.md`** — Acceptance criteria and user stories. These are permanent invariants, not tasks — do not check them off. Update if requirements change. +- **`context.md`** — Architectural decisions, key files, and current status. Update when you make design decisions or change what's in progress. +- **`testing.md`** — Test strategy: automated test locations, manual QA checklists, and edge cases/boundary conditions. +- **`design.md`** *(opt-in)* — Layout, component hierarchy, design tokens, and asset references. Present when `companions.design` is enabled in config. + +## Before modifying any module + +1. Read the relevant spec in `specs//.spec.md` +2. Read whichever companion files are present (`requirements.md`, `tasks.md`, `context.md`, `testing.md`, `design.md`, or project-defined files) +3. After changes, run `specsync check` to verify specs still pass + +## After completing work + +1. Mark completed items in `tasks.md` — check off finished tasks, add new ones discovered +2. Update `context.md` — record decisions made, update current status +3. If requirements changed, update `requirements.md` acceptance criteria +4. If test coverage changed, update `testing.md` with new test files or edge cases +5. If UI/layout changed, update `design.md` with revised layout, components, or tokens + +## Before creating a PR + +Run `specsync check --strict` — all specs must pass with zero warnings. + +## When adding new modules + +Run `specsync scaffold ` to create a spec, companion files, a registry +entry, and auto-detected source files — or `specsync new ` for a +minimal spec-only draft. Complete the spec before writing code. The +`/specsync:create-spec` command (or tool-equivalent) runs this for you, and +accepts either a bare module name or a natural-language feature description +(e.g. `/specsync:create-spec "I want a feature that lets users export their +data as CSV"`) — pass a description and it will pick a module name and use +the description to draft the spec's Purpose and Requirements. + +## Key commands + +- `specsync check` — validate all specs against source code +- `specsync check --json` — machine-readable validation output +- `specsync coverage` — show which modules lack specs +- `specsync score` — quality score for each spec (0-100) +- `specsync scaffold ` — full scaffold: spec + companions + registry entry + source detection +- `specsync new ` — quick-create a minimal spec (add `--full` for companions) +- `specsync resolve --remote` — verify cross-project dependencies diff --git a/.gemini/commands/specsync/create-change.toml b/.gemini/commands/specsync/create-change.toml new file mode 100644 index 0000000..f46c572 --- /dev/null +++ b/.gemini/commands/specsync/create-change.toml @@ -0,0 +1,11 @@ +description = "Create and guide a verified spec-sync SDD change through its deterministic interview" + +prompt = """ +Arguments: {{args}} + +1. Treat the arguments shown above as the user's raw description, shell-escape them exactly once, and run `specsync change new --json`. +2. Read the returned `questions` array and interview the user one question at a time. +3. Record each answer with `specsync change answer --json`. +4. Continue until the question list is empty, then show the selected artifacts and next action. +5. Do not approve, implement, verify, accept, or archive until the corresponding human gate or work stage is reached. +""" diff --git a/.gemini/commands/specsync/create-spec.toml b/.gemini/commands/specsync/create-spec.toml new file mode 100644 index 0000000..c61dc4f --- /dev/null +++ b/.gemini/commands/specsync/create-spec.toml @@ -0,0 +1,34 @@ +description = "Scaffold a new spec-sync module spec from a module name or a natural-language feature description (full scaffold by default, or minimal with --minimal)" + +prompt = """ +Create a new spec-sync module spec. + +Arguments: {{args}} + +1. Remove --minimal if present, remember that minimal mode was requested, and + preserve the complete remaining input without choosing a module name yet. +2. Classify the complete remaining input. It will be one of: + - A bare module name - a short identifier like auth-service or billing. + Use it as-is. + - A free-text feature description - a sentence or phrase describing what + to build, e.g. "I want a feature that lets users export their data as + CSV". In this case, invent a short, kebab-case module name that captures + the idea (e.g. csv-export). If the right name is ambiguous, ask the user + to confirm or rename it before continuing. Keep the full description at + hand - you'll use it in step 5. +3. If minimal mode was requested, run: + specsync new + This creates a minimal spec only (no companion files). +4. Otherwise (default), run: + specsync scaffold + This creates the spec, companion files (tasks.md, requirements.md, + context.md, testing.md, and design.md if companions.design is enabled), + a registry entry, and auto-detects related source files. +5. Open the newly created specs//.spec.md and fill + in the Purpose, Invariants, and Public API sections. If a free-text + description was given in step 2, use it directly to draft these sections - + ask clarifying questions if it's underspecified, but do not leave the + sections as unfilled placeholder text. Do the same for requirements.md + (acceptance criteria) and tasks.md (initial task breakdown), if present. +6. Run specsync check to confirm the new spec passes validation. +""" diff --git a/.gemini/skills/spec-sync/SKILL.md b/.gemini/skills/spec-sync/SKILL.md new file mode 100644 index 0000000..311a220 --- /dev/null +++ b/.gemini/skills/spec-sync/SKILL.md @@ -0,0 +1,75 @@ +--- +name: spec-sync +description: Keep markdown module specs in specs// synchronized with source code using spec-sync. Use this whenever creating, editing, or reviewing code in a module that has (or should have) a spec, or whenever the user mentions specs, spec-sync, companion files (tasks.md/requirements.md/context.md/testing.md/design.md), or asks to add/update a module's documentation. +--- + +# Spec-Sync Workflow + +This project uses [spec-sync](https://github.com/CorvidLabs/spec-sync) for bidirectional spec-to-code validation. Specs live in `specs//.spec.md`. + +## Verified SDD change lifecycle (5.0) + +For every meaningful source, test, public documentation, schema, or configuration change: + +1. Run `specsync change new "" --json` and conduct the returned interview with the user. +2. Use `specsync change answer --json` until no questions remain. +3. Complete the adaptively selected artifacts and semantic deltas. Requirements use stable + `REQ--` IDs, a normative SHALL statement, and acceptance criteria. +4. Ask the user for the definition approval, then run `specsync change approve `. +5. Run `specsync change start ` before editing implementation code. +6. Keep tasks and artifacts current, then run `specsync change verify `. +7. Present verification evidence and ask for closing approval. Only after explicit approval, + run `specsync change accept `; archive separately with `specsync change archive `. + +Never invent or self-grant either human approval. If an approved definition changes, its digest +becomes stale and must be approved again. `specsync check` validates canonical specs plus approved +active deltas, requirement-to-test evidence, change coverage, and CI gates. + +## Companion files + +Each canonical spec may have policy-selected companion files. Read and update the ones present; do not create empty companions only for ceremony: + +- **`tasks.md`** — Work items for this module. Check off tasks (`- [x]`) as you complete them. Add new tasks if you discover work needed. +- **`requirements.md`** — Acceptance criteria and user stories. These are permanent invariants, not tasks — do not check them off. Update if requirements change. +- **`context.md`** — Architectural decisions, key files, and current status. Update when you make design decisions or change what's in progress. +- **`testing.md`** — Test strategy: automated test locations, manual QA checklists, and edge cases/boundary conditions. +- **`design.md`** *(opt-in)* — Layout, component hierarchy, design tokens, and asset references. Present when `companions.design` is enabled in config. + +## Before modifying any module + +1. Read the relevant spec in `specs//.spec.md` +2. Read whichever companion files are present (`requirements.md`, `tasks.md`, `context.md`, `testing.md`, `design.md`, or project-defined files) +3. After changes, run `specsync check` to verify specs still pass + +## After completing work + +1. Mark completed items in `tasks.md` — check off finished tasks, add new ones discovered +2. Update `context.md` — record decisions made, update current status +3. If requirements changed, update `requirements.md` acceptance criteria +4. If test coverage changed, update `testing.md` with new test files or edge cases +5. If UI/layout changed, update `design.md` with revised layout, components, or tokens + +## Before creating a PR + +Run `specsync check --strict` — all specs must pass with zero warnings. + +## When adding new modules + +Run `specsync scaffold ` to create a spec, companion files, a registry +entry, and auto-detected source files — or `specsync new ` for a +minimal spec-only draft. Complete the spec before writing code. The +`/specsync:create-spec` command (or tool-equivalent) runs this for you, and +accepts either a bare module name or a natural-language feature description +(e.g. `/specsync:create-spec "I want a feature that lets users export their +data as CSV"`) — pass a description and it will pick a module name and use +the description to draft the spec's Purpose and Requirements. + +## Key commands + +- `specsync check` — validate all specs against source code +- `specsync check --json` — machine-readable validation output +- `specsync coverage` — show which modules lack specs +- `specsync score` — quality score for each spec (0-100) +- `specsync scaffold ` — full scaffold: spec + companions + registry entry + source detection +- `specsync new ` — quick-create a minimal spec (add `--full` for companions) +- `specsync resolve --remote` — verify cross-project dependencies diff --git a/.github/workflows/trust.yml b/.github/workflows/trust.yml new file mode 100644 index 0000000..2da4c2c --- /dev/null +++ b/.github/workflows/trust.yml @@ -0,0 +1,25 @@ +name: trust + +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +jobs: + trust: + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@v5 + with: + fetch-depth: 0 + - uses: dtolnay/rust-toolchain@stable + with: + components: clippy, rustfmt + - uses: Swatinem/rust-cache@v2 + - name: CorvidLabs Trust gate + id: trust + uses: CorvidLabs/trust@9d32b5786d2e9e4d39fc581c0091c721ee3d4226 # v1.0.0 diff --git a/.specsync/.gitignore b/.specsync/.gitignore new file mode 100644 index 0000000..a655086 --- /dev/null +++ b/.specsync/.gitignore @@ -0,0 +1,3 @@ +backup-3x/ +config.local.toml +hashes.json diff --git a/.specsync/adoption-report.json b/.specsync/adoption-report.json new file mode 100644 index 0000000..db72d5b --- /dev/null +++ b/.specsync/adoption-report.json @@ -0,0 +1,9 @@ +{ + "bootstrap_policy": { + "base_commit": "00dc3be8e8fcc0a0702d8cfc6fdcc9edd953eca8", + "digest": "60f4daa45898deb8dd8e2e13c1b50cea62ece0d84fb8e188c29b74668c0f2bc6", + "path": ".specsync/sdd.json" + }, + "generated_at": 1783878451, + "requirements_needing_ids": [] +} diff --git a/.specsync/change.lock b/.specsync/change.lock new file mode 100644 index 0000000..e69de29 diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/approvals.json b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/approvals.json new file mode 100644 index 0000000..97dd592 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/approvals.json @@ -0,0 +1,63 @@ +{ + "approvals": [ + { + "gate": "definition", + "actor": "user:0xLeif", + "timestamp": 1783953990, + "digest": "056a4131aed716912c6ea25b7d632114abde1c861f473db1ed190ae7c15be7f3", + "note": "Definition approved after artifact, review-correction, and preliminary native-verification audit." + }, + { + "gate": "acceptance", + "actor": "user:0xLeif", + "timestamp": 1783954149, + "digest": "4741795c0616d7aa414be4a932feb7987e5debf80d4397e34787bbd63cce531e", + "note": "Closing approval recorded after successful committed-head native verification with explicit requirement evidence." + }, + { + "gate": "acceptance", + "actor": "user:0xLeif", + "timestamp": 1783984313, + "digest": "c1ba5820419f440e7d04c0fb972ce3d136d73b78678288f6b45a586cd7f4a9c3", + "note": "Fresh native verification passed with CHG-0002 present; the previously applied canonical delta was not replayed. Hosted CI remains required before promotion." + } + ], + "reopenings": [ + { + "schema_version": 1, + "change_id": "CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin", + "actor": "user:0xLeif", + "reason": "CHG-0002 corrected the shared migration contract, verification lane, and governed agent inputs after the prior acceptance evidence.", + "timestamp": 1783984311, + "from_state": "accepted", + "to_state": "verifying", + "superseded_approval": { + "gate": "acceptance", + "actor": "user:0xLeif", + "timestamp": 1783954149, + "digest": "4741795c0616d7aa414be4a932feb7987e5debf80d4397e34787bbd63cce531e", + "note": "Closing approval recorded after successful committed-head native verification with explicit requirement evidence." + }, + "prior_verification": { + "timestamp": 1783954064, + "commit": "29d768ec824ca1f259385b7f3cdc0b9ec617ca77", + "contract_digest": "056a4131aed716912c6ea25b7d632114abde1c861f473db1ed190ae7c15be7f3", + "workspace_digest": "acdd90eaef375f1210db01fc38970d15eaded0567e0f5e11f49437fb5912fade", + "acceptance_input_digest": "fbb0446ae7259e20ab80a9a1f99661cfe98e086e5a21edf2ba311941668c48a9", + "passed": true, + "commands": [ + { + "command": "fledge lanes run verify", + "success": true, + "exit_code": 0 + } + ], + "requirement_ids": [ + "REQ-gitleaks-002" + ] + }, + "stale_acceptance_input_digest": "fbb0446ae7259e20ab80a9a1f99661cfe98e086e5a21edf2ba311941668c48a9", + "current_acceptance_input_digest": "f5e42793241bccf9d8e263b00f932e2bf3f6e59bf0db6ed9e76a67f3a7a17389" + } + ] +} diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/change.md b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/change.md new file mode 100644 index 0000000..2778705 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/change.md @@ -0,0 +1,27 @@ +--- +id: CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin +state: accepted +type: migration +base_commit: 00dc3be8e8fcc0a0702d8cfc6fdcc9edd953eca8 +--- + +# Adopt SpecSync 5.0.1 and Trust 1.0.0 governance for the Gitleaks Fledge plugin + +## Intent + +Adopt SpecSync 5.0.1 and Trust 1.0.0 governance for the Gitleaks Fledge plugin + +## Affected Canonical Specs + +- `gitleaks` + +## Acceptance Criteria + +- SpecSync strict coverage is 100%. +- Claude, Cursor, Codex, and Gemini integrations are installed. +- Trust doctor and verification pass. +- Rust formatting, clippy, tests, release build, and CLI help smoke remain green. + +## No-spec Rationale + +Not applicable diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/context.md b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/context.md new file mode 100644 index 0000000..80c4a74 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/context.md @@ -0,0 +1,10 @@ +--- +change: CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin +artifact: context +--- + +# Context + +The plugin already ships a Rust CLI, multi-platform release artifacts, tests, formatting, linting, and Pages documentation. The organization rollout adds the shared SpecSync 5.0.1 lifecycle and Trust 1.0.0 gate without replacing those specialized workflows. + +The canonical specification records the existing scan, check, and managed-hook behavior. This migration does not change the CLI contract. diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/deltas/gitleaks.md b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/deltas/gitleaks.md new file mode 100644 index 0000000..6bdd4f5 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/deltas/gitleaks.md @@ -0,0 +1,9 @@ +## MODIFIED + +### REQUIREMENT REQ-gitleaks-002 + +The CI check SHALL exit non-zero for findings, missing prerequisites, or scan failures. + +Acceptance Criteria +- The native Fledge verification lane passes formatting, clippy, tests, release build, and CLI help smoke. +- Hosted Trust and existing CI remain required after the owner-approved lifecycle is recorded. diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/design.md b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/design.md new file mode 100644 index 0000000..e3099ca --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/design.md @@ -0,0 +1,12 @@ +--- +change: CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin +artifact: design +--- + +# Design + +Add one active `gitleaks` module specification with stable requirement IDs mapped to `src/main.rs`. Configure the SDD lifecycle at version 5.0.1 and install the four supported agent integrations. + +The local `verify` lane runs formatting, Clippy with warnings denied, unit tests, a release build, and the CLI help smoke. Trust uses that lane for lifecycle evidence, blocks high risk, enforces 100% contract coverage, verifies provenance progressively, and leaves Atlas disabled. + +The new GitHub `trust` job uses the immutable Trust 1.0.0 commit and full Git history. Existing CI, release, and Pages workflows remain unchanged. diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/docs.md b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/docs.md new file mode 100644 index 0000000..8e311e4 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/docs.md @@ -0,0 +1,8 @@ +--- +change: CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin +artifact: docs +--- + +# Docs + +The managed `AGENTS.md` block tells contributors and agents to use the unified Trust verification path and keep specifications synchronized. Public plugin documentation does not require a behavior update because the CLI contract is unchanged. diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/plan.md b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/plan.md new file mode 100644 index 0000000..5acff53 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/plan.md @@ -0,0 +1,12 @@ +--- +change: CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin +artifact: plan +--- + +# Plan + +1. Adopt the SpecSync 5 lifecycle and document the existing plugin contract. +2. Install Claude, Cursor, Codex, and Gemini integrations. +3. Add the native Fledge verification lane and Trust policy files. +4. Add the immutable unified Trust workflow while preserving existing workflows. +5. Validate strict coverage, integrations, Trust configuration, and native checks locally. diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/research.md b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/research.md new file mode 100644 index 0000000..d9437b0 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/research.md @@ -0,0 +1,10 @@ +--- +change: CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin +artifact: research +--- + +# Research + +The existing CI runs tests and release builds on Linux, macOS, and Windows, plus blocking Rust formatting and Clippy checks on Linux. The release workflow packages multiple architectures and must remain independent. + +All implementation is in `src/main.rs`, so SpecSync can enforce 100% companion coverage. Pages remains the repository's independent publication path, so Trust-managed Atlas publication stays disabled. diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/state.json b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/state.json new file mode 100644 index 0000000..d34401c --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/state.json @@ -0,0 +1,48 @@ +{ + "schema_version": 1, + "id": "CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin", + "slug": "adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin", + "title": "Adopt SpecSync 5.0.1 and Trust 1.0.0 governance for the Gitleaks Fledge plugin", + "description": "Adopt SpecSync 5.0.1 and Trust 1.0.0 governance for the Gitleaks Fledge plugin", + "kind": "migration", + "state": "accepted", + "canonical_applied": true, + "base_commit": "00dc3be8e8fcc0a0702d8cfc6fdcc9edd953eca8", + "created_at": 1783878536, + "updated_at": 1783984313, + "affected_specs": [ + "gitleaks" + ], + "affected_paths": [ + "src/", + "Cargo.toml", + "Cargo.lock", + "fledge.toml", + ".github/", + ".specsync/", + "specs/", + ".trust.toml" + ], + "no_spec_change": false, + "no_spec_change_rationale": null, + "acceptance_criteria": [ + "SpecSync strict coverage is 100%.", + "Claude, Cursor, Codex, and Gemini integrations are installed.", + "Trust doctor and verification pass.", + "Rust formatting, clippy, tests, release build, and CLI help smoke remain green." + ], + "selected_artifacts": [ + "context", + "research", + "design", + "plan", + "tasks", + "testing", + "docs" + ], + "dependencies": [], + "answers": { + "architecture_risk": "yes", + "public_contract": "no" + } +} diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/tasks.md b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/tasks.md new file mode 100644 index 0000000..923abb2 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/tasks.md @@ -0,0 +1,15 @@ +--- +change: CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin +artifact: tasks +--- + +# Tasks + +- [x] Create the canonical Gitleaks specification and stable requirements. +- [x] Adopt and stamp SpecSync 5.0.1. +- [x] Install all four agent integrations. +- [x] Configure the Fledge verification lane and Trust policy. +- [x] Add the immutable Trust 1.0.0 workflow. +- [x] Run native verification and strict SpecSync coverage locally. +- [x] Prepare the change workspace for owner-gated definition approval and verified lifecycle execution. +- [x] Configure hosted Trust alongside existing checks and retain the existing branch target. diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/testing.md b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/testing.md new file mode 100644 index 0000000..90f5f3c --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/testing.md @@ -0,0 +1,17 @@ +--- +change: CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin +artifact: testing +--- + +# Testing + +Local acceptance requires: + +- `fledge lanes run verify` +- `REQ-gitleaks-002` evidence is provided by the native verification lane and existing CI checks. +- `specsync check --strict --require-coverage 100 --force` +- `specsync agents status` +- `fledge trust doctor` +- `git diff --check` + +Hosted acceptance requires the new `trust` job plus every existing CI, release-relevant, security, and compatibility check to remain green on the repository's normal runners. diff --git a/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/verification.json b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/verification.json new file mode 100644 index 0000000..0f54bf4 --- /dev/null +++ b/.specsync/changes/CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin/verification.json @@ -0,0 +1,18 @@ +{ + "timestamp": 1783984312, + "commit": "7128abdcc34663554453babc14ca28e748223903", + "contract_digest": "056a4131aed716912c6ea25b7d632114abde1c861f473db1ed190ae7c15be7f3", + "workspace_digest": "a725aefee6a45a9d9b7850cc9e541cda62e01050e249c75c175d410184f270e1", + "acceptance_input_digest": "f5e42793241bccf9d8e263b00f932e2bf3f6e59bf0db6ed9e76a67f3a7a17389", + "passed": true, + "commands": [ + { + "command": "fledge lanes run verify", + "success": true, + "exit_code": 0 + } + ], + "requirement_ids": [ + "REQ-gitleaks-002" + ] +} diff --git a/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/approvals.json b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/approvals.json new file mode 100644 index 0000000..cd728bf --- /dev/null +++ b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/approvals.json @@ -0,0 +1,26 @@ +{ + "approvals": [ + { + "gate": "definition", + "actor": "user:0xLeif", + "timestamp": 1783984250, + "digest": "4ad61f6fde98ceb8362e18d57a9c71187eff66b633579d219f4bef6592754ee5", + "note": "Approved portable definition for the reviewed migration contract and cross-platform governance corrections." + }, + { + "gate": "definition", + "actor": "user:0xLeif", + "timestamp": 1783984297, + "digest": "76a77ac4f55b351d5e13718050e907a149d2f2a351738bd76a6ec407b0320cdb", + "note": "Definition refreshed with explicit direct-source evidence for the corrected existing hook contract." + }, + { + "gate": "acceptance", + "actor": "user:0xLeif", + "timestamp": 1783984311, + "digest": "37510169684bb2256b50d83c394183fbdfb1f32c4e1d7c1354578c902d4818a5", + "note": "Native formatting, clippy, four Rust tests, release build, platform-neutral help smoke, and direct-source contract evidence passed. Hosted CI remains required before promotion." + } + ], + "reopenings": [] +} diff --git a/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/change.md b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/change.md new file mode 100644 index 0000000..39a43a4 --- /dev/null +++ b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/change.md @@ -0,0 +1,26 @@ +--- +id: CHG-0002-correct-the-migration-contract-and-portable-verification-guidance +state: accepted +type: bug_fix +base_commit: 7128abdcc34663554453babc14ca28e748223903 +--- + +# Correct the migration contract and portable verification guidance + +## Intent + +Correct the migration contract and portable verification guidance + +## Affected Canonical Specs + +- `gitleaks` + +## Acceptance Criteria + +- The canonical hook contract matches the existing marker-based whole-file install and removal behavior without promising partial-content preservation; Claude +- Cursor +- and Gemini correctly preserve full SpecSync input; documentation changes under docs require the SDD lifecycle; the native smoke command is cross-platform; Fledge verification and strict SpecSync 100% coverage pass. + +## No-spec Rationale + +Not applicable diff --git a/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/context.md b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/context.md new file mode 100644 index 0000000..37289c8 --- /dev/null +++ b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/context.md @@ -0,0 +1,10 @@ +--- +change: CHG-0002-correct-the-migration-contract-and-portable-verification-guidance +artifact: context +--- + +# Context + +Review found that the migration spec promised partial managed-hook removal, while the existing Rust implementation owns the complete marker-bearing hook file and removes that file as a unit. The same review identified generated agent prompts that mishandle natural-language input, a Gemini variable that is not interpolated, an SDD policy that tracks a nonexistent `site/` instead of published `docs/`, and a Unix-only release-binary smoke path. + +This correction changes governance, tests, and the canonical description of current behavior. It does not modify Rust implementation code. diff --git a/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/deltas/gitleaks.md b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/deltas/gitleaks.md new file mode 100644 index 0000000..4c67f40 --- /dev/null +++ b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/deltas/gitleaks.md @@ -0,0 +1,12 @@ +## MODIFIED + +### REQUIREMENT REQ-gitleaks-004 + +Hook installation and removal SHALL preserve unmanaged hooks by refusing to overwrite or delete any hook that lacks the plugin's managed marker. + +Acceptance Criteria + +- Installation creates the marker-bearing staged-check hook only when no hook exists, and repeated installation recognizes the managed marker. +- Installation refuses an existing hook without the managed marker. +- Removal deletes the complete hook file when the managed marker is present. +- Removal refuses a hook without the managed marker. diff --git a/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/design.md b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/design.md new file mode 100644 index 0000000..c93f897 --- /dev/null +++ b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/design.md @@ -0,0 +1,10 @@ +--- +change: CHG-0002-correct-the-migration-contract-and-portable-verification-guidance +artifact: design +--- + +# Design + +Narrow the hook contract to the implementation's actual ownership boundary: unmanaged hooks are preserved through refusal, while a marker-bearing managed hook is removed as a complete file. Keep installation idempotent when the marker is already present. + +Use the same full-input create-spec guidance for Claude, Cursor, and Gemini, and make Gemini create-change shell-escape the displayed raw arguments once. Replace `site/` with `docs/` in lifecycle policy and invoke the release help smoke through `cargo run` so Cargo selects the correct executable name on every supported runner. diff --git a/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/docs.md b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/docs.md new file mode 100644 index 0000000..e3cc9dd --- /dev/null +++ b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/docs.md @@ -0,0 +1,8 @@ +--- +change: CHG-0002-correct-the-migration-contract-and-portable-verification-guidance +artifact: docs +--- + +# Docs + +The canonical spec now distinguishes marker-owned whole-file hooks from unmanaged hooks. No README command changes are required because the `install-hook` and `uninstall-hook` CLI names and runtime implementation remain unchanged. diff --git a/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/requirements.md b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/requirements.md new file mode 100644 index 0000000..4576f61 --- /dev/null +++ b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/requirements.md @@ -0,0 +1,11 @@ +--- +change: CHG-0002-correct-the-migration-contract-and-portable-verification-guidance +artifact: requirements +--- + +# Requirements + +- The canonical hook requirement must describe the current marker-based whole-file ownership model. +- Agent integrations must preserve the complete request before deriving a module name or shell command. +- Published documentation under `docs/` must require a SpecSync change lifecycle. +- The native help smoke must run through Cargo without assuming a Unix artifact path. diff --git a/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/state.json b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/state.json new file mode 100644 index 0000000..31d24cc --- /dev/null +++ b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/state.json @@ -0,0 +1,46 @@ +{ + "schema_version": 1, + "id": "CHG-0002-correct-the-migration-contract-and-portable-verification-guidance", + "slug": "correct-the-migration-contract-and-portable-verification-guidance", + "title": "Correct the migration contract and portable verification guidance", + "description": "Correct the migration contract and portable verification guidance", + "kind": "bug_fix", + "state": "accepted", + "canonical_applied": true, + "base_commit": "7128abdcc34663554453babc14ca28e748223903", + "created_at": 1783984097, + "updated_at": 1783984311, + "affected_specs": [ + "gitleaks" + ], + "affected_paths": [ + "specs/gitleaks/gitleaks.spec.md", + "specs/gitleaks/requirements.md", + "fledge.toml", + ".specsync/sdd.json", + ".claude/commands/specsync/create-spec.md", + ".cursor/commands/specsync-create-spec.md", + ".gemini/commands/specsync/create-spec.toml", + ".gemini/commands/specsync/create-change.toml" + ], + "no_spec_change": false, + "no_spec_change_rationale": null, + "acceptance_criteria": [ + "The canonical hook contract matches the existing marker-based whole-file install and removal behavior without promising partial-content preservation; Claude", + "Cursor", + "and Gemini correctly preserve full SpecSync input; documentation changes under docs require the SDD lifecycle; the native smoke command is cross-platform; Fledge verification and strict SpecSync 100% coverage pass." + ], + "selected_artifacts": [ + "context", + "testing", + "tasks", + "design", + "requirements", + "docs" + ], + "dependencies": [], + "answers": { + "architecture_risk": "no", + "public_contract": "yes" + } +} diff --git a/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/tasks.md b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/tasks.md new file mode 100644 index 0000000..96cef2e --- /dev/null +++ b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/tasks.md @@ -0,0 +1,13 @@ +--- +change: CHG-0002-correct-the-migration-contract-and-portable-verification-guidance +artifact: tasks +--- + +# Tasks + +- [x] Align the canonical hook contract with marker-based whole-file ownership. +- [x] Correct full-input handling in Claude, Cursor, and Gemini guidance. +- [x] Correct Gemini create-change argument handling. +- [x] Govern the published `docs/` path and committed policy files. +- [x] Replace the Unix-only help smoke with a Cargo-managed invocation. +- [x] Preserve the existing Linux, macOS, Windows, Trust, and CodeQL jobs as required post-push evidence before promotion. diff --git a/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/testing.md b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/testing.md new file mode 100644 index 0000000..3b41910 --- /dev/null +++ b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/testing.md @@ -0,0 +1,12 @@ +--- +change: CHG-0002-correct-the-migration-contract-and-portable-verification-guidance +artifact: testing +--- + +# Testing + +- Run `fledge lanes run verify` for formatting, clippy, four Rust unit tests, release build, and platform-neutral CLI help. +- Run `specsync check --strict --require-coverage 100 --force` and require real Rust file and LOC coverage. +- Confirm the canonical hook requirement matches `install_hook` and `uninstall_hook` without claiming partial-content preservation. +- `REQ-gitleaks-004` evidence is direct source inspection of `HOOK_MARKER`, `install_hook`, and `uninstall_hook`; this migration does not alter their Rust behavior. +- Require the hosted Linux, macOS, Windows, Trust, and CodeQL jobs before promotion. diff --git a/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/verification.json b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/verification.json new file mode 100644 index 0000000..76e2d4b --- /dev/null +++ b/.specsync/changes/CHG-0002-correct-the-migration-contract-and-portable-verification-guidance/verification.json @@ -0,0 +1,18 @@ +{ + "timestamp": 1783984299, + "commit": "7128abdcc34663554453babc14ca28e748223903", + "contract_digest": "76a77ac4f55b351d5e13718050e907a149d2f2a351738bd76a6ec407b0320cdb", + "workspace_digest": "272f90a396191457e414a664d6d439b29d210de7058ff12d3784e67515f977d3", + "acceptance_input_digest": "915b72b61b285ebadaeb05105a73023c44d3db13d40fa70b6eaa74802cb57b6b", + "passed": true, + "commands": [ + { + "command": "fledge lanes run verify", + "success": true, + "exit_code": 0 + } + ], + "requirement_ids": [ + "REQ-gitleaks-004" + ] +} diff --git a/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/approvals.json b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/approvals.json new file mode 100644 index 0000000..a82d1a3 --- /dev/null +++ b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/approvals.json @@ -0,0 +1,19 @@ +{ + "approvals": [ + { + "gate": "definition", + "actor": "user:0xLeif", + "timestamp": 1783984456, + "digest": "bef7e7dec72a646e00b46f9ef9ba17afa9c00ab43495adbc534b012b14175230", + "note": "Approved portable no-spec definition for the exact rollout governance paths reported by hosted SpecSync." + }, + { + "gate": "acceptance", + "actor": "user:0xLeif", + "timestamp": 1783984462, + "digest": "405a81b79a0e6d0bd2bf0eba1dbc3e9de11b21a843b5e297c0cf6c1ec76d3788", + "note": "Native verification passed for the exact rollout path coverage; hosted CI remains required before promotion and is not claimed here." + } + ], + "reopenings": [] +} diff --git a/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/change.md b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/change.md new file mode 100644 index 0000000..4a6065c --- /dev/null +++ b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/change.md @@ -0,0 +1,28 @@ +--- +id: CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle +state: accepted +type: migration +base_commit: 0ae5e3a2cd3f8da88210c4d9dd79749e8223b3b1 +--- + +# Cover remaining rollout governance files in the SDD lifecycle + +## Intent + +Cover remaining rollout governance files in the SDD lifecycle + +## Affected Canonical Specs + +- None + +## Acceptance Criteria + +- SpecSync recognizes the Attest +- Augur +- Claude +- Cursor +- and Gemini rollout files as covered delivery inputs; strict validation retains real 1/1 file and 326/326 LOC coverage; the native Fledge lane and hosted Trust contract gate pass. + +## No-spec Rationale + +Declare the already-migrated Attest, Augur, and generated agent governance files as delivery inputs so the pull-request range is fully covered without changing Gitleaks requirements or Rust behavior. diff --git a/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/context.md b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/context.md new file mode 100644 index 0000000..45f0423 --- /dev/null +++ b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/context.md @@ -0,0 +1,10 @@ +--- +change: CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle +artifact: context +--- + +# Context + +Expanding `meaningful_paths` made the migration's committed Attest, Augur, and generated agent files subject to change coverage. Those files were already part of the rollout branch, but CHG-0001 did not enumerate each path, so hosted SpecSync correctly rejected the pull-request range as uncovered. + +This workspace supplies portable coverage metadata for those already-migrated governance files. It does not modify their contents or Gitleaks runtime behavior. diff --git a/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/design.md b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/design.md new file mode 100644 index 0000000..21c1d8c --- /dev/null +++ b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/design.md @@ -0,0 +1,8 @@ +--- +change: CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle +artifact: design +--- + +# Design + +Keep the stricter meaningful-path policy and add a no-spec change whose delivery paths exactly match the already-modified policy and generated integration files reported by hosted SpecSync. Preserve all file contents, the canonical Gitleaks contract, and the Rust implementation. diff --git a/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/docs.md b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/docs.md new file mode 100644 index 0000000..3bc8907 --- /dev/null +++ b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/docs.md @@ -0,0 +1,8 @@ +--- +change: CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle +artifact: docs +--- + +# Docs + +No user-facing documentation changes are required. This change records SDD delivery coverage for existing rollout policy and generated integration files only. diff --git a/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/plan.md b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/plan.md new file mode 100644 index 0000000..b078b46 --- /dev/null +++ b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/plan.md @@ -0,0 +1,11 @@ +--- +change: CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle +artifact: plan +--- + +# Plan + +1. Record the seven uncovered rollout paths in a portable no-spec change. +2. Verify the complete native lane and strict 100% SpecSync coverage. +3. Refresh older accepted delivery evidence made stale by the added workspace. +4. Push once and require a fresh hosted Trust pass before promotion. diff --git a/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/research.md b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/research.md new file mode 100644 index 0000000..a706815 --- /dev/null +++ b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/research.md @@ -0,0 +1,8 @@ +--- +change: CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle +artifact: research +--- + +# Research + +The hosted Trust log identified exactly seven uncovered paths: two policy files and five generated Claude, Cursor, and Gemini instruction files. The failure occurred only after the SDD policy correctly classified those surfaces as meaningful. Explicitly enumerating them in a no-spec migration change is the supported way to cover the existing rollout without weakening lifecycle policy. diff --git a/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/state.json b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/state.json new file mode 100644 index 0000000..e66bb76 --- /dev/null +++ b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/state.json @@ -0,0 +1,46 @@ +{ + "schema_version": 1, + "id": "CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle", + "slug": "cover-remaining-rollout-governance-files-in-the-sdd-lifecycle", + "title": "Cover remaining rollout governance files in the SDD lifecycle", + "description": "Cover remaining rollout governance files in the SDD lifecycle", + "kind": "migration", + "state": "accepted", + "canonical_applied": true, + "base_commit": "0ae5e3a2cd3f8da88210c4d9dd79749e8223b3b1", + "created_at": 1783984414, + "updated_at": 1783984462, + "affected_specs": [], + "affected_paths": [ + ".attest.json", + ".augur.toml", + ".claude/commands/specsync/create-change.md", + ".claude/skills/spec-sync/SKILL.md", + ".cursor/commands/specsync-create-change.md", + ".cursor/skills/spec-sync/SKILL.md", + ".gemini/skills/spec-sync/SKILL.md" + ], + "no_spec_change": true, + "no_spec_change_rationale": "Declare the already-migrated Attest, Augur, and generated agent governance files as delivery inputs so the pull-request range is fully covered without changing Gitleaks requirements or Rust behavior.", + "acceptance_criteria": [ + "SpecSync recognizes the Attest", + "Augur", + "Claude", + "Cursor", + "and Gemini rollout files as covered delivery inputs; strict validation retains real 1/1 file and 326/326 LOC coverage; the native Fledge lane and hosted Trust contract gate pass." + ], + "selected_artifacts": [ + "context", + "research", + "design", + "plan", + "tasks", + "testing", + "docs" + ], + "dependencies": [], + "answers": { + "architecture_risk": "no", + "public_contract": "no" + } +} diff --git a/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/tasks.md b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/tasks.md new file mode 100644 index 0000000..01ce639 --- /dev/null +++ b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/tasks.md @@ -0,0 +1,11 @@ +--- +change: CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle +artifact: tasks +--- + +# Tasks + +- [x] Enumerate the exact policy and generated-agent paths reported by hosted SpecSync. +- [x] Preserve their existing migration contents without semantic or runtime changes. +- [x] Keep the strict meaningful-path policy enabled. +- [x] Preserve the Linux, macOS, Windows, Trust, and CodeQL jobs as required post-push evidence before promotion. diff --git a/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/testing.md b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/testing.md new file mode 100644 index 0000000..8bcbf9d --- /dev/null +++ b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/testing.md @@ -0,0 +1,10 @@ +--- +change: CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle +artifact: testing +--- + +# Testing + +- Run `fledge lanes run verify` for formatting, clippy, four Rust tests, release build, and CLI help. +- Run `specsync check --strict --require-coverage 100 --force` and require 1/1 file plus 326/326 LOC coverage. +- Confirm the hosted Trust contract gate no longer reports the seven rollout governance paths as uncovered. diff --git a/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/verification.json b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/verification.json new file mode 100644 index 0000000..75a5df9 --- /dev/null +++ b/.specsync/changes/CHG-0003-cover-remaining-rollout-governance-files-in-the-sdd-lifecycle/verification.json @@ -0,0 +1,16 @@ +{ + "timestamp": 1783984457, + "commit": "0ae5e3a2cd3f8da88210c4d9dd79749e8223b3b1", + "contract_digest": "bef7e7dec72a646e00b46f9ef9ba17afa9c00ab43495adbc534b012b14175230", + "workspace_digest": "a725aefee6a45a9d9b7850cc9e541cda62e01050e249c75c175d410184f270e1", + "acceptance_input_digest": "9cd9eeeeb0866005ce860fff6e61aba34a809989af06cfad4031ea9ccb4e15e6", + "passed": true, + "commands": [ + { + "command": "fledge lanes run verify", + "success": true, + "exit_code": 0 + } + ], + "requirement_ids": [] +} diff --git a/.specsync/config.toml b/.specsync/config.toml new file mode 100644 index 0000000..a470655 --- /dev/null +++ b/.specsync/config.toml @@ -0,0 +1,12 @@ +# SpecSync 5 configuration +# Docs: https://github.com/CorvidLabs/spec-sync + +specs_dir = "specs" +source_dirs = ["src"] +exclude_dirs = [] +exclude_patterns = [] +required_sections = ["Purpose", "Public API", "Invariants", "Behavioral Examples", "Error Cases", "Dependencies", "Change Log"] +enforcement = "strict" + +[lifecycle] +track_history = false diff --git a/.specsync/registry.toml b/.specsync/registry.toml new file mode 100644 index 0000000..ef08b37 --- /dev/null +++ b/.specsync/registry.toml @@ -0,0 +1,5 @@ +[registry] +name = "fledge-plugin-gitleaks-trust-wave4" + +[specs] +gitleaks = "specs/gitleaks/gitleaks.spec.md" diff --git a/.specsync/sdd.json b/.specsync/sdd.json new file mode 100644 index 0000000..4a42c51 --- /dev/null +++ b/.specsync/sdd.json @@ -0,0 +1,48 @@ +{ + "version": 1, + "enabled": true, + "require_change_for_meaningful_files": true, + "meaningful_paths": [ + "src/", + "tests/", + "docs/", + "README.md", + "plugin.toml", + "fledge.toml", + ".trust.toml", + ".augur.toml", + ".attest.json", + ".claude/", + ".cursor/", + ".gemini/", + ".github/", + "Cargo.toml", + "Cargo.lock", + "action.yml", + "package.json", + "bun.lock", + "package-lock.json", + "pnpm-lock.yaml", + "yarn.lock", + "Package.swift", + "Package.resolved", + "go.mod", + "go.sum", + "pyproject.toml", + "uv.lock", + "requirements.txt", + ".specsync/sdd.json", + ".specsync/config.toml", + ".specsync/config.json", + ".specsync/version" + ], + "ignored_paths": [ + ".specsync/", + "specs/" + ], + "verification_commands": [ + "fledge lanes run verify" + ], + "custom_artifacts": {}, + "principles_file": null +} diff --git a/.specsync/version b/.specsync/version new file mode 100644 index 0000000..6b244dc --- /dev/null +++ b/.specsync/version @@ -0,0 +1 @@ +5.0.1 diff --git a/.trust.toml b/.trust.toml new file mode 100644 index 0000000..12e0013 --- /dev/null +++ b/.trust.toml @@ -0,0 +1,22 @@ +schema_version = 1 +profile = "standard" + +[lifecycle] +command = ["fledge", "lanes", "run", "verify"] + +[contract] +enabled = true +require_coverage = 100 +skip_reason = "" + +[risk] +threshold = "block" + +[provenance] +mode = "soft" +policy = ".attest.json" +skip_reason = "" + +[atlas] +enabled = false +skip_reason = "Standalone Pages publication remains independently managed" diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..3da08a2 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,12 @@ + +## CorvidLabs trust toolchain + +This repository uses one trust gate. Every session must use it and must not bypass or weaken it. + +- Run `fledge trust verify` before calling a change complete. +- Keep module specs synchronized with implementation changes. +- Treat an Augur block verdict as a hard stop that must be surfaced and de-risked. +- Record and verify provenance with Attest after the repository's verification lane passes. +- Keep generated trust configuration and this managed block in place. + + diff --git a/fledge.toml b/fledge.toml index d3da7a6..fbbcea3 100644 --- a/fledge.toml +++ b/fledge.toml @@ -4,3 +4,8 @@ build = "cargo build --release" test = "cargo test" lint = "cargo clippy -- -D warnings" fmt = "cargo fmt --check" +smoke = "cargo run --release -- --help" + +[lanes.verify] +description = "Format, lint, test, build, and smoke-test the Gitleaks plugin" +steps = ["fmt", "lint", "test", "smoke"] diff --git a/specs/gitleaks/context.md b/specs/gitleaks/context.md new file mode 100644 index 0000000..9eb68a7 --- /dev/null +++ b/specs/gitleaks/context.md @@ -0,0 +1,17 @@ +--- +spec: gitleaks.spec.md +--- + +## Context + +This Rust plugin replaces an archived custom scanner with a thin, auditable wrapper over the established gitleaks engine. + +## Related Modules + +- gitleaks CLI and configuration +- Git pre-commit hooks + +## Design Decisions + +- Delegate detection to gitleaks rather than maintain custom patterns. +- Mark and remove only plugin-owned hook content. diff --git a/specs/gitleaks/gitleaks.spec.md b/specs/gitleaks/gitleaks.spec.md new file mode 100644 index 0000000..32c8b17 --- /dev/null +++ b/specs/gitleaks/gitleaks.spec.md @@ -0,0 +1,68 @@ +--- +module: gitleaks +version: 3 +status: active +files: + - src/main.rs + +db_tables: [] +depends_on: [] +--- + +# Gitleaks + +## Purpose + +Wrap the installed gitleaks binary for working-tree and staged secret scanning, provide human/CI result modes, and install or remove a marker-owned pre-commit hook without overwriting an unmanaged existing hook. + +## Public API + +| Command | Behavior | +|---------|----------| +| scan | Run gitleaks against the working tree or staged changes and pretty-print findings. | +| check | Run CI-style detection and return non-zero when secrets are found or scanning fails. | +| install-hook | Create the managed staged-check pre-commit hook, or refuse an unmanaged existing hook. | +| uninstall-hook | Remove the complete marker-bearing managed hook, or refuse an unmanaged hook. | + +## Invariants + +1. The plugin delegates secret detection and `.gitleaks.toml` semantics to the installed gitleaks binary. +2. Staged mode scans only staged changes and is the mode installed into pre-commit. +3. Check exits non-zero when findings exist or gitleaks cannot complete successfully. +4. Hook installation is idempotent for a marker-bearing hook and refuses to overwrite an unmanaged existing hook. +5. Hook removal deletes the complete marker-bearing hook and refuses to delete a hook without the managed marker. +6. A newly installed hook is executable on Unix platforms. +7. Missing gitleaks produces installation guidance rather than a false pass. + +## Behavioral Examples + +``` +Given a pre-commit hook without the plugin's managed marker +When install-hook or uninstall-hook runs +Then the command refuses to overwrite or remove that unmanaged hook +``` + +## Error Cases + +| Error | When | Behavior | +|-------|------|----------| +| Gitleaks unavailable | Scan/check starts without the binary | Report prerequisite guidance and exit non-zero. | +| Secret detected | Gitleaks reports findings | Pretty-print findings and make check fail. | +| Not a Git repository | Staged or hook operation has no Git context | Report the repository precondition and exit non-zero. | +| Hook write failure | Hook directory/file cannot be updated | Preserve existing content and surface the I/O failure. | +| Unknown subcommand/options | CLI input is unsupported | Print scoped help and exit non-zero. | + +## Dependencies + +- Rust 1.89 or later +- installed gitleaks binary +- Git repository for staged scans and hooks +- `clap`, `serde`, `serde_json`, and `anyhow` + +## Change Log + +| Version | Date | Changes | +|---------|------|---------| +| 1 | 2026-07-12 | Document existing gitleaks scan, check, and managed-hook behavior for SpecSync 5 adoption. | +| 2 | 2026-07-13 | CHG-0001-adopt-specsync-5-0-1-and-trust-1-0-0-governance-for-the-gitleaks-fledge-plugin: Adopt SpecSync 5.0.1 and Trust 1.0.0 governance for the Gitleaks Fledge plugin | +| 3 | 2026-07-13 | CHG-0002-correct-the-migration-contract-and-portable-verification-guidance: Correct the migration contract and portable verification guidance | diff --git a/specs/gitleaks/requirements.md b/specs/gitleaks/requirements.md new file mode 100644 index 0000000..fdfb20b --- /dev/null +++ b/specs/gitleaks/requirements.md @@ -0,0 +1,45 @@ +--- +spec: gitleaks.spec.md +--- + +## User Stories + +- As a developer, I want working-tree and staged secret scans through fledge. +- As a repository owner, I want a managed pre-commit check without losing existing hook behavior. + +## Acceptance Criteria + +### REQ-gitleaks-001 + +The plugin SHALL run working-tree and staged gitleaks scans and honor repository configuration. + +### REQ-gitleaks-002 + +The CI check SHALL exit non-zero for findings, missing prerequisites, or scan failures. + +Acceptance Criteria +- The native Fledge verification lane passes formatting, clippy, tests, release build, and CLI help smoke. +- Hosted Trust and existing CI remain required after the owner-approved lifecycle is recorded. + +### REQ-gitleaks-003 + +Hook installation SHALL be idempotent and invoke the staged check. + +### REQ-gitleaks-004 + +Hook installation and removal SHALL preserve unmanaged hooks by refusing to overwrite or delete any hook that lacks the plugin's managed marker. + +Acceptance Criteria + +- Installation creates the marker-bearing staged-check hook only when no hook exists, and repeated installation recognizes the managed marker. +- Installation refuses an existing hook without the managed marker. +- Removal deletes the complete hook file when the managed marker is present. +- Removal refuses a hook without the managed marker. + +## Constraints + +- Requires gitleaks; staged and hook operations require Git repository context. + +## Out of Scope + +- Reimplementing secret detection, installing gitleaks, and modifying unrelated hooks. diff --git a/specs/gitleaks/tasks.md b/specs/gitleaks/tasks.md new file mode 100644 index 0000000..75c70e3 --- /dev/null +++ b/specs/gitleaks/tasks.md @@ -0,0 +1,8 @@ +--- +spec: gitleaks.spec.md +--- + +## Tasks + +- [x] Document scan, check, and hook behavior. +- [x] Preserve build, test, lint, formatting, smoke, and packaging matrices. diff --git a/specs/gitleaks/testing.md b/specs/gitleaks/testing.md new file mode 100644 index 0000000..acd58ca --- /dev/null +++ b/specs/gitleaks/testing.md @@ -0,0 +1,13 @@ +--- +spec: gitleaks.spec.md +--- + +## Test Plan + +### Integration Tests + +- `cargo fmt --check` +- `cargo clippy -- -D warnings` +- `cargo test` +- `cargo build --release` +- Verify root and all subcommand help surfaces.