@etiquekit/etq 1.0.12 → 1.0.14

package/templates/DISPATCH_PREMISES.md

@@ -1,39 +0,0 @@
-# Dispatch Premises (Load-Bearing Premise Gate)
-
-Reusable discipline block for dispatch cards. A load-bearing premise is any
-claim whose falsity changes the dispatch's verdict, scope, or architecture.
-Refuted premises waste a full runner round trip; the gate moves the check to
-the dispatcher, where it is cheapest.
-
-## Gate Rules
-
-1. If a load-bearing premise is statically decidable at the routed base, the
-   dispatcher must VERIFY it before posting. Proof means a file:line whose
-   CONTENTS were read at the pinned base, on the CONSUMING surface's path.
-   Producer-side or sibling-binary evidence never verifies a consumer claim.
-   Name or path existence is never content.
-2. Premises decidable only at runtime or by an external system ship as a
-   labeled HYPOTHESIS with a paired stop-condition the runner can trigger.
-3. Budget: about 15 minutes and at most 5 premises. Beyond that, downgrade
-   the dispatch to a probe task whose deliverable IS the premise table.
-4. Lint tell: a stop-condition that restates a static premise verbatim is a
-   fence instead of a check — verify it at dispatch time instead.
-5. Runner stop-conditions remain the backstop, not the primary check. A
-   runner that finds a premise false must STOP and counter, never fabricate
-   a passing result.
-
-## Template Block
-
-Paste into the dispatch card and fill in:
-
-```markdown
-## Premises
-
-| # | premise | class | proof / stop-condition |
-| --- | --- | --- | --- |
-| P1 | <claim the dispatch depends on> | VERIFIED | <file:line, contents read at <base-sha>, on the consuming surface> |
-| P2 | <claim decidable only at runtime> | HYPOTHESIS | STOP if <observable falsifier>; counter instead of fabricating a pass |
-```
-
-Every load-bearing premise appears in the table. A dispatch with an
-unverified static premise is not ready to post.

package/templates/etiquette-vanilla-v0/source/control-seat/bin/access-assurance-check

@@ -1,55 +0,0 @@
-#!/bin/sh
-set -eu
-
-ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
-PROFILE="$ROOT/docs/work/access/workspace-secure-profile.v0.json"
-POLICY="$ROOT/docs/work/access/seat-access-policy.v0.json"
-CLAIMS="$ROOT/docs/work/access/access-assurance-claims.v0.json"
-
-json_string_field() {
-  sed -n "s/.*\"$2\"[[:space:]]*:[[:space:]]*\"\\([^\"]*\\)\".*/\\1/p" "$1" | head -n 1
-}
-
-json_bool_field() {
-  sed -n "s/.*\"$2\"[[:space:]]*:[[:space:]]*\\(true\\|false\\).*/\\1/p" "$1" | head -n 1
-}
-
-if [ ! -f "$PROFILE" ]; then
-  echo "access-assurance: fail missing docs/work/access/workspace-secure-profile.v0.json" >&2
-  exit 1
-fi
-
-mode=$(json_string_field "$PROFILE" mode)
-case "$mode" in
-  open|screening-warn|screening-enforced|enterprise-reactor) ;;
-  *)
-    echo "access-assurance: fail invalid mode=${mode:-missing}" >&2
-    exit 1
-    ;;
-esac
-
-if [ "$mode" = "open" ]; then
-  echo "access-assurance: pass mode=open policy=not-required"
-  exit 0
-fi
-
-if [ ! -f "$POLICY" ] || [ ! -f "$CLAIMS" ]; then
-  message="access-assurance: missing policy or claims for mode=$mode"
-  if [ "$mode" = "screening-warn" ]; then
-    echo "$message"
-    exit 0
-  fi
-  echo "$message" >&2
-  exit 1
-fi
-
-if [ "$mode" = "enterprise-reactor" ]; then
-  tighten_only=$(json_bool_field "$PROFILE" tighten_only)
-  reactor_can_grant=$(json_bool_field "$PROFILE" reactor_can_grant_or_loosen_access)
-  if [ "$tighten_only" != "true" ] || [ "$reactor_can_grant" != "false" ]; then
-    echo "access-assurance: fail enterprise-reactor requires tighten_only=true and reactor_can_grant_or_loosen_access=false" >&2
-    exit 1
-  fi
-fi
-
-echo "access-assurance: pass mode=$mode"

package/templates/etiquette-vanilla-v0/source/control-seat/docs/work/access/ACCESS-ASSURANCE.md

@@ -1,39 +0,0 @@
-# Access Assurance
-
-The vanilla control seat starts in `open` mode. That keeps Etiquette usable as a
-local-first workflow kit without authentication, screening, hosted services, or
-a daemon.
-
-The workspace mode lives in `workspace-secure-profile.v0.json`.
-
-Modes:
-
-- `open`: no access-assurance gate is required.
-- `screening-warn`: restricted-seat policy and claims are checked, but failures
-  warn instead of blocking.
-- `screening-enforced`: restricted seats fail closed when policy or claims are
-  missing, expired, revoked, or not provider-backed.
-- `enterprise-reactor`: `screening-enforced` plus an optional tighten-only
-  daemon for revocation sync, badge refresh, kill-switch writes, and outbox
-  drain.
-
-The reactor may tighten access only. It must not grant access, authorize
-actions, close work, merge, or rewrite the ledger.
-
-Provider-backed secure deployments should keep raw identity material outside the
-repo:
-
-```text
-approved identity provider / assurance provider -> derived claims -> local access check
-```
-
-Repo-safe fields are provider refs, status, policy eligibility class, evidence
-hash, expiry, and audit timestamps. Passport images, document photos, full
-document numbers, ethnicity, provider secrets, and raw webhook payloads do not
-belong in Git.
-
-Check the mode:
-
-```sh
-sh bin/access-assurance-check
-```

package/templates/etiquette-vanilla-v0/source/control-seat/docs/work/access/workspace-secure-profile.v0.json

@@ -1,53 +0,0 @@
-{
-  "schema": "workspace-secure-profile.v0",
-  "workspace_id": "vanilla-control-seat",
-  "mode": "open",
-  "allowed_modes": [
-    "open",
-    "screening-warn",
-    "screening-enforced",
-    "enterprise-reactor"
-  ],
-  "mode_meanings": {
-    "open": "No access-assurance gate is required. Etiquette core remains local and unauthenticated.",
-    "screening-warn": "Restricted-seat claims are checked and reported, but missing or failed claims do not block local entry.",
-    "screening-enforced": "Restricted-seat claims are required before routing or entering restricted seats.",
-    "enterprise-reactor": "screening-enforced plus an optional tighten-only reactor for revocation sync, badge refresh, kill-switch writes, and outbox drain."
-  },
-  "identity_model": {
-    "authenticate": "operator_principals",
-    "assign_to": "seat_ids",
-    "authorize": "per_action_grants",
-    "workspace_role": "policy_scope",
-    "linear_role": "external_backlog_projection_only"
-  },
-  "claim_source": {
-    "kind": "none-required-for-open-mode",
-    "live_replacement": "approved identity provider plus derived assurance claim export",
-    "raw_pii_allowed_in_repo": false
-  },
-  "reactor": {
-    "required_for_mode": "enterprise-reactor",
-    "default_enabled": false,
-    "tighten_only": true,
-    "may_write": [
-      "kill_switch_entries",
-      "expired_assurance_markers",
-      "badge_refresh_cache",
-      "sync_outbox"
-    ],
-    "must_not": [
-      "grant_access",
-      "close_work",
-      "merge",
-      "rewrite_ledger",
-      "authorize_actions"
-    ]
-  },
-  "authority_boundary": {
-    "profile_can_authorize_work": false,
-    "profile_can_grant_seat": false,
-    "profile_can_merge_or_close": false,
-    "reactor_can_grant_or_loosen_access": false
-  }
-}

package/templates/hosted-receiver/README.md

@@ -1,41 +0,0 @@
-# Hosted Receiver Templates
-
-Opt-in templates for teams that want to expose Etiquette's W1 GitHub webhook
-receiver behind their own hosting layer.
-
-## W1 GitHub Receiver
-
-`w1-github-webhook-receiver.mjs` is a small Node HTTP server:
-
-- `GET /health` returns a readiness probe.
-- `POST /github` accepts GitHub `ping` and `push` webhook deliveries.
-- `ping` returns `200` only after the delivery is signature-verified.
-- `push` delegates to `etiquette notify webhook github`.
-- raw payloads are written only to a temporary file for the CLI call, then
-  removed.
-- emitted records stay pointer-only and authority-false.
-
-Run it with:
-
-```sh
-export ETIQUETTE_GITHUB_WEBHOOK_SECRET='<webhook-secret>'
-export ETIQUETTE_CLI='etiquette'
-node w1-github-webhook-receiver.mjs
-```
-
-Optional:
-
-```sh
-export PORT=8080
-export ETIQUETTE_WAKE_OUT_DIR=/var/lib/etiquette/wake
-```
-
-`ETIQUETTE_WAKE_OUT_DIR` stores only the verified pointer output, never the raw
-webhook body.
-
-## Boundary
-
-This template does not create a public endpoint, register repository webhooks,
-provision cloud infrastructure, start remote execution, or grant authority. Host
-selection, webhook registration, secret rotation, and retention policy remain
-operator decisions.

package/templates/hosted-receiver/w1-github-webhook-receiver.mjs

@@ -1,129 +0,0 @@
-#!/usr/bin/env node
-import { createServer } from 'node:http';
-import { randomUUID } from 'node:crypto';
-import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { spawnSync } from 'node:child_process';
-
-const port = Number(process.env.PORT || '8080');
-const etiquetteCli = process.env.ETIQUETTE_CLI || 'etiquette';
-const secret = process.env.ETIQUETTE_GITHUB_WEBHOOK_SECRET;
-const outDir = process.env.ETIQUETTE_WAKE_OUT_DIR || '';
-
-if (!secret) throw new Error('ETIQUETTE_GITHUB_WEBHOOK_SECRET is required');
-
-function readRaw(req) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    req.on('data', (chunk) => chunks.push(chunk));
-    req.on('end', () => resolve(Buffer.concat(chunks)));
-    req.on('error', reject);
-  });
-}
-
-function writeJson(res, status, value) {
-  res.writeHead(status, {
-    'content-type': 'application/json',
-    'cache-control': 'no-store',
-  });
-  res.end(`${JSON.stringify(value, null, 2)}\n`);
-}
-
-function publicRecord(record) {
-  return {
-    ok: true,
-    schema: record.schema,
-    event: record.event,
-    delivery_id: record.delivery_id,
-    repository: record.repository.full_name,
-    ref: record.ref || null,
-    after: record.after || null,
-    signature_verified: record.transport.signature_verified,
-    pointers_only: record.payload_boundary.pointers_only,
-    notification_is_authority: record.authority_boundary.notification_is_authority,
-    next_action: record.next_action,
-  };
-}
-
-async function verifyDelivery(req, event, delivery, signature) {
-  const raw = await readRaw(req);
-  const payloadPath = join(tmpdir(), `etiquette-webhook-${delivery}-${randomUUID()}.json`);
-  writeFileSync(payloadPath, raw);
-  try {
-    const result = spawnSync(etiquetteCli, [
-      'notify',
-      'webhook',
-      'github',
-      '--payload',
-      payloadPath,
-      '--delivery',
-      delivery,
-      '--event',
-      event,
-      '--signature-256',
-      signature,
-      '--json',
-    ], {
-      encoding: 'utf8',
-      env: {
-        ...process.env,
-        ETIQUETTE_GITHUB_WEBHOOK_SECRET: secret,
-      },
-    });
-    if (result.status !== 0) {
-      return {
-        ok: false,
-        status: 401,
-        body: {
-          ok: false,
-          error: 'signature_or_payload_rejected',
-          detail: result.stderr.trim().slice(0, 200),
-        },
-      };
-    }
-    const record = JSON.parse(result.stdout);
-    if (outDir) {
-      mkdirSync(outDir, { recursive: true });
-      writeFileSync(join(outDir, 'latest.json'), `${JSON.stringify(record, null, 2)}\n`);
-      writeFileSync(join(outDir, `${delivery}.json`), `${JSON.stringify(record, null, 2)}\n`);
-    }
-    return { ok: true, status: 200, body: publicRecord(record) };
-  } finally {
-    rmSync(payloadPath, { force: true });
-  }
-}
-
-const server = createServer(async (req, res) => {
-  try {
-    if (req.method === 'GET' && req.url === '/health') {
-      writeJson(res, 200, { ok: true, authority: false });
-      return;
-    }
-    if (req.method !== 'POST' || req.url !== '/github') {
-      writeJson(res, 404, { ok: false, error: 'not_found' });
-      return;
-    }
-
-    const event = String(req.headers['x-github-event'] || '');
-    const delivery = String(req.headers['x-github-delivery'] || randomUUID());
-    const signature = String(req.headers['x-hub-signature-256'] || '');
-    if (event !== 'push' && event !== 'ping') {
-      writeJson(res, 400, { ok: false, error: 'unsupported_event', event });
-      return;
-    }
-    if (!signature.startsWith('sha256=')) {
-      writeJson(res, 401, { ok: false, error: 'missing_signature' });
-      return;
-    }
-
-    const result = await verifyDelivery(req, event, delivery, signature);
-    writeJson(res, result.status, result.body);
-  } catch (error) {
-    writeJson(res, 500, { ok: false, error: String(error?.message || error) });
-  }
-});
-
-server.listen(port, '0.0.0.0', () => {
-  console.log(`etiquette_w1_receiver: listening on ${port}`);
-});