rosett-ai 1.3.3

data/conf/schemas/workflow_schema.json

@@ -0,0 +1,112 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gitlab.neatnerds.be/neatnerds/NeatNerds-AI/rosett-ai/schemas/workflow_schema.json",
+  "title": "Workflow Definition",
+  "description": "Schema for workflow YAML files — declarative multi-step workflow definitions.",
+  "$comment": {
+    "date": "2026-03-16",
+    "version": "1.0.0",
+    "source": "rosett-ai"
+  },
+  "type": "object",
+  "required": ["name", "version", "steps"],
+  "additionalProperties": false,
+  "properties": {
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^[a-z][a-z0-9_-]*$",
+      "description": "Workflow identifier"
+    },
+    "description": {
+      "type": "string",
+      "description": "Human-readable description"
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^\\d+\\.\\d+\\.\\d+$"
+    },
+    "author": {
+      "type": "string"
+    },
+    "scope": {
+      "type": "string",
+      "enum": ["global", "local", "project"]
+    },
+    "network_required": {
+      "type": "boolean",
+      "default": false
+    },
+    "engine": {
+      "type": "string",
+      "description": "Default engine for prompt steps"
+    },
+    "required_capabilities": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "max_steps": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 50,
+      "default": 50
+    },
+    "steps": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 50,
+      "items": {
+        "type": "object",
+        "required": ["name", "type"],
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1
+          },
+          "type": {
+            "type": "string",
+            "enum": ["shell", "rosett-ai", "prompt"]
+          },
+          "command": {
+            "description": "Array of strings for shell steps, string for Rosett-AI steps",
+            "oneOf": [
+              { "type": "array", "items": { "type": "string" }, "minItems": 1 },
+              { "type": "string", "minLength": 1 }
+            ]
+          },
+          "prompt": {
+            "type": "string",
+            "description": "Prompt text for prompt-type steps"
+          },
+          "engine": {
+            "type": "string",
+            "description": "Engine override for this step"
+          },
+          "network_required": {
+            "type": "boolean"
+          },
+          "on_failure": {
+            "type": "string",
+            "enum": ["stop", "continue"],
+            "default": "stop"
+          }
+        }
+      }
+    },
+    "audit": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "log_path": {
+          "type": "string"
+        },
+        "retention_days": {
+          "type": "integer",
+          "minimum": 1,
+          "default": 90
+        }
+      }
+    }
+  }
+}

data/conf/targets/agents_md.yml

@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+#
+# AGENTS.md compilation target profile.
+# Compiles rai behaviour YAML into AGENTS.md format (AAIF v0.1.0).
+---
+name: agents_md
+description: "AGENTS.md format — AAIF-standard agent instruction file"
+backend: agents_md
+engine_version: "~> 1.0"
+output_format: markdown
+output_dir:
+max_context_window:
+rendering:
+  include_source_metadata: true
+  include_priority_annotations: false
+  include_generated_marker: true

data/conf/targets/claude.yml

@@ -0,0 +1,12 @@
+---
+name: claude
+description: Claude Code (Anthropic) target
+backend: claude
+engine_version: ">=1.0.0"
+output_format: markdown
+output_dir: null
+max_context_window: 200000
+rendering:
+  include_source_metadata: true
+  include_priority_annotations: true
+  include_generated_marker: true

data/conf/tooling/tools.yml

@@ -0,0 +1,58 @@
+# Rosett-AI - Tool Registry
+# This file defines CLI tools that can be managed by rai tooling commands.
+# Each tool entry maps to package names across different package managers.
+
+tools:
+  jq:
+    description: "Command-line JSON processor"
+    homepage: "https://jqlang.github.io/jq/"
+    category: json
+    permission_pattern: "Bash(jq:*)"
+    packages:
+      apt: jq
+      dnf: jq
+      pacman: jq
+      zypper: jq
+      brew: jq
+      snap: jq
+      nix: jq
+
+  yq:
+    description: "Command-line YAML/JSON/XML processor"
+    homepage: "https://github.com/mikefarah/yq"
+    category: yaml
+    permission_pattern: "Bash(yq:*)"
+    packages:
+      apt: yq
+      dnf: yq
+      pacman: go-yq
+      zypper: yq
+      brew: yq
+      snap: yq
+      nix: yq-go
+
+  ripgrep:
+    description: "Fast recursive grep replacement"
+    homepage: "https://github.com/BurntSushi/ripgrep"
+    category: search
+    permission_pattern: "Bash(rg:*)"
+    packages:
+      apt: ripgrep
+      dnf: ripgrep
+      pacman: ripgrep
+      zypper: ripgrep
+      brew: ripgrep
+      nix: ripgrep
+
+  fd:
+    description: "Simple, fast alternative to find"
+    homepage: "https://github.com/sharkdp/fd"
+    category: search
+    permission_pattern: "Bash(fd:*)"
+    packages:
+      apt: fd-find
+      dnf: fd-find
+      pacman: fd
+      zypper: fd
+      brew: fd
+      nix: fd

data/dist/rosett-ai-mcp.service

@@ -0,0 +1,48 @@
+# systemd unit file for nncc MCP server (HTTP transport)
+#
+# Install: sudo cp dist/rosett-ai-mcp.service /etc/systemd/system/
+# Enable:  sudo systemctl enable nncc-mcp
+# Start:   sudo systemctl start nncc-mcp
+#
+# Configuration: /etc/nncc/mcp/server.yml
+# Keyfile:       /etc/nncc/mcp/nncc-mcp-keys.yml
+#
+# SPDX-License-Identifier: GPL-3.0-only
+
+[Unit]
+Description=NeatNerds Code Companion MCP Server
+Documentation=man:nncc(1)
+After=network.target
+
+[Service]
+Type=simple
+User=nncc
+Group=nncc
+ExecStart=/usr/bin/nncc mcp serve --http --config /etc/nncc/mcp/server.yml
+Restart=on-failure
+RestartSec=5
+
+# Security hardening
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+
+# File access
+ReadWritePaths=/var/lib/nncc /etc/nncc/mcp
+
+# Resource limits
+LimitNOFILE=1024
+LimitNPROC=64
+
+[Install]
+WantedBy=multi-user.target

data/dist/rosett-ai-mcp.yml.default

@@ -0,0 +1,45 @@
+# nncc MCP server configuration
+#
+# Copy to one of:
+#   ~/.config/nncc/mcp/server.yml  (user)
+#   /etc/nncc/mcp/server.yml       (system)
+#   .nncc-mcp.yml                   (project)
+#
+# SPDX-License-Identifier: GPL-3.0-only
+---
+http:
+  port: 8484
+  host: localhost
+
+  authentication:
+    type: api_key
+    key_source: auto
+    keyfile_path: /etc/nncc/mcp/nncc-mcp-keys.yml
+    # api_key_env: NNCC_MCP_API_KEY  # Single-key fallback
+
+  origin:
+    allowed_origins:
+      - "http://localhost:*"
+      - "http://127.0.0.1:*"
+    strict_mode: false
+
+  rate_limiting:
+    enabled: true
+    unauthenticated_rpm: 60
+    authenticated_rpm: 300
+
+  cors:
+    enabled: false
+    # origins:
+    #   - "http://localhost:3000"
+    # methods: [POST, GET, DELETE]
+    # headers: [Content-Type, Authorization, Accept, Mcp-Session-Id]
+    # max_age: 86400
+
+  max_request_size: 1048576  # 1 MB
+  content_type_enforcement: true
+
+  tls:
+    enabled: false
+    # cert_path: /etc/nncc/mcp/tls/cert.pem
+    # key_path: /etc/nncc/mcp/tls/key.pem

data/doc/AAIF_POSITIONING.md

@@ -0,0 +1,58 @@
+# AAIF Positioning — rosett-ai in the Agentic AI Foundation Ecosystem
+
+## Overview
+
+raictl (Rosett-AI) fills a gap in the AAIF ecosystem that none of
+the founding projects address: structured, validated, versioned, auditable
+configuration management for AI agent workflows.
+
+## AAIF Ecosystem Role
+
+| Project | Role | rosett-ai Relationship |
+|---------|------|-------------------|
+| MCP | Protocol for AI tool communication | rosett-ai is an MCP server + admin tool |
+| AGENTS.md | Agent instruction file standard | rai compiles to AGENTS.md format |
+| Goose | Multi-provider AI agent runtime | rosett-ai manages Goose configuration |
+| rosett-ai | Configuration management layer | Orchestrates all of the above |
+
+## Compilation Targets
+
+raictl supports multi-target compilation from a single source of truth:
+
+```bash
+# Compile to AGENTS.md format
+bin/raictl compile --engine agents_md
+
+# Compile to Claude Code format (default)
+bin/raictl compile --engine claude
+
+# Compile to generic markdown
+bin/raictl compile --engine generic
+```
+
+## AAIF Spec Versions
+
+raictl tracks specific AAIF specification versions:
+
+| Specification | Version | Status |
+|--------------|---------|--------|
+| MCP Protocol | 2025-03-26 | Implemented (mcp gem 0.8.0) |
+| AGENTS.md | v0.1.0 | Implemented (built-in backend) |
+
+## License Compatibility
+
+| Component | License | AAIF Compatible |
+|-----------|---------|----------------|
+| rosett-ai core | GPL-3.0-only | Independent project |
+| MCP server (rosett-ai) | GPL-3.0-only | Uses mcp gem (MIT) |
+| AGENTS.md backend | GPL-3.0-only | Output format is unlicensed standard |
+
+## Contribution Pathway
+
+If contributing to the AAIF ecosystem:
+
+1. **rosett-ai-mcp extraction**: Extract MCP server components as Apache-2.0 library
+2. **AGENTS.md tools**: Validation and linting tools as standalone MIT/Apache-2.0
+3. **rosett-ai core**: Remains GPL-3.0-only (open-core model)
+
+See `doc/LICENSING_AAIF_ANALYSIS.md` for detailed license compatibility analysis.

data/doc/ADOPT.md

@@ -0,0 +1,224 @@
+# Rosett-AI - Adopt System
+
+## Overview
+
+The `adopt` command analyzes compiled rule files in `~/.claude/rules/` for quality and safety issues.
+It uses the Claude API to detect inconsistencies, conflicts, harmful content, jailbreaking attempts,
+duplicates, and other problems across your rule set.
+
+## How It Works
+
+1. Discovers managed rule files (those with `<!-- Generated by rosett-ai` markers) in `~/.claude/rules/`
+2. Filters out files whose source behaviour YAML is marked `sensitive: true`
+3. Checks the cache — if file contents haven't changed since the last analysis, returns cached results
+4. Applies redaction patterns from `conf/adopt_redactions.yml` to file contents
+5. Sends redacted content to the Claude API for analysis
+6. Runs local structural checks on all files (including sensitive ones)
+7. Merges API and local findings into a unified report
+8. Caches the result for future runs
+
+## CLI Usage
+
+```bash
+# Full API analysis
+bin/raictl adopt
+
+# Local-only structural checks (no API)
+bin/raictl adopt --local
+
+# Verbose output
+bin/raictl adopt --verbose
+
+# Detailed explanations
+bin/raictl adopt --elaborate
+
+# All flags combined
+bin/raictl adopt --elaborate --verbose
+```
+
+### Flags
+
+| Flag | Effect |
+|------|--------|
+| `--local` | Skip API calls, run structural checks only |
+| `--verbose` | Show file counts, checksums, cache status, skipped sensitive files |
+| `--elaborate` | Add an "Explanation" column to the findings table |
+
+## Finding Categories
+
+The analysis detects these categories of issues:
+
+| Category | Description |
+|----------|-------------|
+| `inconsistencies` | Rules that contradict each other in intent or wording |
+| `conflicts` | Rules that directly conflict and cannot both be followed |
+| `harmful` | Rules that instruct harmful actions |
+| `illegal` | Rules that instruct illegal activities |
+| `jailbreaking` | Rules that attempt to bypass AI safety measures |
+| `rule_breaking` | Rules that instruct breaking other rules |
+| `duplicates` | Rules with the same ID or identical descriptions across files |
+| `other` | Other structural or content issues |
+
+### Severity Levels
+
+| Severity | Meaning |
+|----------|---------|
+| `critical` | Must be fixed immediately — safety or compliance risk |
+| `high` | Should be fixed — significant quality issue |
+| `medium` | Worth addressing — potential confusion or redundancy |
+| `low` | Minor observation — nice to fix |
+
+### Overall Status
+
+| Status | Meaning |
+|--------|---------|
+| `pass` | No issues found |
+| `warn` | Low or medium severity findings only |
+| `fail` | High or critical severity findings |
+
+## Data Privacy
+
+Four layers of protection ensure sensitive content is handled appropriately.
+
+### 1. Opt-in Per File (Default)
+
+Add `sensitive: true` to a behaviour YAML file to exclude its compiled output from API analysis:
+
+```yaml
+name: internal_security
+description: Internal security policies
+version: 1.0.0
+sensitive: true
+rules:
+  - id: sec_001
+    description: Internal policy details
+    priority: 90
+    enabled: true
+```
+
+Sensitive files are still checked locally for structural issues (duplicate IDs, empty descriptions, missing priorities). They are reported as "skipped (sensitive)" in verbose output.
+
+### 2. Redaction
+
+Configure regex patterns in `conf/adopt_redactions.yml` to replace sensitive content before it reaches the API:
+
+```yaml
+---
+patterns:
+  - pattern: '\b[A-Z0-9._%+-]+@neatnerds\.be\b'
+    replacement: '[EMAIL-REDACTED]'
+  - pattern: 'NeatNerds'
+    replacement: '[COMPANY]'
+  - pattern: 'gitlab\.neatnerds\.be'
+    replacement: '[INTERNAL-URL]'
+```
+
+Redaction is applied in-memory only — original files are never modified.
+
+### 3. Configurable Endpoint
+
+Set the `ANTHROPIC_API_BASE_URL` environment variable to route API calls through a private endpoint:
+
+```bash
+# Use AWS Bedrock
+export ANTHROPIC_API_BASE_URL=https://bedrock-runtime.us-east-1.amazonaws.com
+
+# Use a corporate proxy
+export ANTHROPIC_API_BASE_URL=https://ai-proxy.internal.company.com
+```
+
+### 4. Local-Only Mode
+
+Use `--local` to skip API calls entirely. Only structural checks are performed:
+
+- Duplicate rule IDs across files
+- Empty or blank rule descriptions
+- Rules without priority set
+- Identical rule descriptions across different rule IDs
+
+```bash
+bin/raictl adopt --local --verbose
+```
+
+## Caching
+
+Results are cached in `conf/adopt.cache.yml`. The cache key is a SHA256 hash of all analyzed file contents (after filtering sensitive files). When files haven't changed, the cached result is returned without an API call.
+
+### Cache Format
+
+```yaml
+---
+checksum: "sha256hex..."
+analyzed_at: "2026-01-29T12:00:00Z"
+result:
+  findings: [...]
+  overall_status: pass
+  summary: "No issues detected"
+```
+
+### Invalidating the Cache
+
+The cache is automatically invalidated when any managed rule file changes. To force a fresh analysis, delete the cache file:
+
+```bash
+rm conf/adopt.cache.yml
+bin/raictl adopt
+```
+
+## Local Structural Checks
+
+These checks run on all files (including sensitive ones) regardless of `--local`:
+
+| Check | Category | Severity |
+|-------|----------|----------|
+| Duplicate rule ID across files | `duplicates` | medium |
+| Empty/blank rule description | `other` | medium |
+| Missing priority | `other` | low |
+| Identical descriptions on different rule IDs | `duplicates` | low |
+
+## Environment Variables
+
+| Variable | Purpose | Required |
+|----------|---------|----------|
+| `ANTHROPIC_API_KEY` | API authentication key | Yes (API mode) |
+| `ANTHROPIC_API_BASE_URL` | Custom API endpoint | No |
+
+## Workflow Integration
+
+### Recommended Workflow
+
+```bash
+# 1. Compile behaviours to rules
+bin/raictl compile --verbose
+
+# 2. Run local checks first
+bin/raictl adopt --local --verbose
+
+# 3. Run full API analysis
+bin/raictl adopt --verbose
+
+# 4. Fix findings and recompile
+bin/raictl compile --verbose
+
+# 5. Verify fixes
+bin/raictl adopt --verbose
+```
+
+### CI/CD Integration
+
+```bash
+# In CI pipeline — local checks only (no API key needed)
+bin/raictl adopt --local || exit 1
+
+# Or with API key available
+ANTHROPIC_API_KEY=$CI_ANTHROPIC_KEY bin/raictl adopt || exit 1
+```
+
+## Architecture
+
+The adopt system consists of two components:
+
+- **`RosettAi::Adopter::RuleAdopter`** (`lib/rosett_ai/adopter/rule_adopter.rb`) — Core logic for file discovery, caching, redaction, API interaction, and local analysis
+- **`RosettAi::Thor::Tasks::Adopt`** (`lib/rosett_ai/thor/tasks/adopt.rb`) — Thor CLI task providing terminal output with tables, spinners, and colored status indicators
+
+The adopter uses the official [Anthropic Ruby SDK](https://github.com/anthropics/anthropic-sdk-ruby) (`anthropic` gem v1.16+) for API communication.