chore: fleet alignment — project manifest + v2 template sync - #274
Conversation
Adds the CueLABS .cuelabs/project.yaml manifest (standards catalog v2; surfaces recorded per program state), and syncs SECURITY.md and CONTRIBUTING.md to the v2 templates (private-vulnerability-reporting flow with the dedicated security mailbox; contributor setup via README, .env.example, and make help). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e06833bc0a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| deployment: | ||
| web: firebase-app-hosting | ||
| api: none |
There was a problem hiding this comment.
When CueLABS standards tooling consumes this manifest, api: none will classify the backend as having no cloud deployment and skip/misapply API deployment checks. This repository has a runnable api/common Go service in docker-compose.yml and its deployment contract explicitly assigns that service to Cloud Run (docs/deployment.md:12), so the manifest should declare the API deployment rather than none.
Useful? React with 👍 / 👎.
| backend: | ||
| common: planned |
There was a problem hiding this comment.
This declares the existing Go service as planned, so the standards tooling this manifest is intended to drive will omit active-backend checks for it. api/common is the repository's current Go REST API (README.md:12-16) and is built and started as api-common by the local stack, while only the mobile app is documented as planned; its surface state should therefore be active.
Useful? React with 👍 / 👎.
1 participant
Summary
.cuelabs/project.yaml— the CueLABS project manifest (standards catalog v2), recording surface truth per program state (gated programs areplanned, shipped surfacesactive)SECURITY.mdto the v2 template: private-vulnerability-reporting flow + dedicatedsecurity@cuesoft.iomailbox (reporting is verified enabled on this repo)CONTRIBUTING.mdto the v2 template: setup routes through README,.env.example, andmake helpValidation
cuelabs_standard.py auditagainst standards v2.0.1: manifest valid, Baseline conforming: yes🤖 Generated with Claude Code