Repository navigation
chore: adopt the Praetor governance files - #9
Merged
Merged
Conversation
Adopt cordanaLLM/knowledge under Praetor governance.
Archetype:
- template-seed (facets: security:high, agent:sandboxed)
Lock source:
- 268a4ac088bb94e453f5421047812574029efa99
(/home/kilian/dev/cordanaLLM/praetor)
Added and configured files:
- Governance: AGENTS.md, AGENTS.readonly.md, .standards.yaml,
.standards.lock, .standards-baseline.json (540 infractions recorded),
.config/labels.yaml, .config/archetypes/template-seed.yaml,
.config/archetypes/facets/security-high.yaml,
.config/archetypes/facets/agent-sandboxed.yaml, .gosec.json
- Agent harnesses & context sync: CLAUDE.md, .windsurfrules,
.cursor/rules/hiss-invariants.mdc, .github/copilot-instructions.md,
.gemini/GEMINI.md, .codex/rules.md, .paperclip/harness.json,
.paperclip/rules.md, .agents/agents/ (repo-auditor, repo-gatekeeper),
.claude/agents/, .github/agents/, .gemini/agents/, .codex/agents/,
.agents/skills/ (adhd-format, caveman, social-text), .claude/skills/
- Tooling & IDE integrations: Makefile, .gitattributes, lefthook.yml,
.config/lefthook/, .config/agent/, .devcontainer/, .editorconfig,
.clang-tidy, .vscode/, .idea/, .helix/, .zed/, .fleet/,
.dir-locals.el, .nvim.lua, lua/, standards.sublime-project
- Shared canonical JSON vectors:
testdata/canonical-json/v1/vectors.json (pinned to lusoris/k8s
6e769dbd188ab74ce583edc7b3dceb48955106bc, sha256
b12413cb0897ae14edfaf1a3e6e39f31e543f07c404ab39090612082747302cd),
PIN.json, README.md, tools/canonical_vectors.py with refresh-check
- Security & project docs: CONTRIBUTING.md, SECURITY.md, docs/adr/
- Secret gating: tools/secrets/gate/
- Reconciled: README.md, .gitignore, .github/rulesets/main.json
- Nested AGENTS.md tersely rewritten for caveman lint compliance:
tools/knowledge-registry/source-acquisition-plan-enumerator/AGENTS.md,
tools/knowledge-registry/source-acquisition-runner-v3/AGENTS.md
Verify-all steps and planted negative results:
- compile-context-verify: rc=0; planted drift line in CLAUDE.md gave
rc=2 ("target CLAUDE.md is out of sync with AGENTS.md"), restored via
cp backup plus cmp.
- caveman-sources: rc=0; planted article-heavy operating_contract line
in .paperclip/harness.json gave rc=2 ("register.sources sha256
mismatch"), restored via cp backup plus cmp.
- audit: rc=0; planted chmod 000 on .standards.lock gave rc=2
(".standards.lock is missing or unreadable: permission denied"),
restored via chmod 644 plus cmp.
- test: make refresh-check rc=0; tools/canonical_vectors.py check rc=0;
planted byte change in vectors.json failed with rc=1 (make test and
refresh-check failed with rc=2), restored via cp backup plus cmp.
Planted failing test in tools/knowledge-dogfood-evidence tests failed
with rc=1 (AssertionError), restored via cp backup plus cmp.
Remaining test failure: tools/knowledge-retrieval
(TestBM25FQualityGenerationAndPointerCarryProfile,
TestBM25FV11QualityGenerationAndPointerCarryProfile,
TestCurrentQueryUsesOnlySignedEvaluatedCurrentGeneration,
TestCurrentQueryFailsClosedWithoutPointerOrEvaluatedRunningBinary)
fails due to validateSSHKeygenBinary (lifecycle_signing.go:201)
requiring stat.Uid == 0, which is unmapped (uid 65534 nobody) in
sandboxed user namespace execution.
Order: engine-adoption-stragglers-rest-20261022
Signed-off-by: lusoris <lusoris@proton.me>
go build ./... in the tools with a main package wrote each binary into its source folder, so verify-all left five untracked files and the push gate refused the dirty tree. Build to /dev/null instead; every package still compiles and links. Order: engine-adoption-stragglers-rest-20261022 Signed-off-by: lusoris <lusoris@proton.me>
Signed-off-by: lusoris <lusoris@proton.me>
Signed-off-by: lusoris <lusoris@proton.me>
Three runners are frozen: the P1-SRC-02 runner, the P1-SRC-03 runner and the v3 runner. Their execution manifests or byte-identity tests pin nine files by sha256, so neither a fix nor a #nosec line mark can touch them. Their 99 gosec findings are declared per file with the rule ids gosec reports there, category D, entered 2026-10-23 and expiring 2027-02-20; they are fixed when the runners are frozen again. Signed-off-by: lusoris <lusoris@proton.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Description
This puts cordanaLLM/knowledge under Praetor governance: agent context files, the local gate (lefthook, Makefile verify-all), the HISS baseline and the security configuration. The three frozen source-acquisition runners carry their gosec findings as dated per-file exceptions instead of a gosec baseline.
.standards.yaml,.standards.lock, and.standards-baseline.jsonwith 540 recorded HISS infractions. That baseline holds no gosec entries.#nosecmark can touch them. Nine files carry dated exceptions in.standards.yaml(rulegosec, the gosec rule ids reported in each file, category D, entered 2026-10-23, expiring 2027-02-20). They cover 99 findings.Earlier fixes this depends on are already on main: #6 restored the pinned runner bytes, #7 made the knowledge-data tests read a declared root, and #8 removed the SSH string panic.
Pre-Merge Verification Checklist
standardsctl compile-context --verify