npm - @marinjursic/prc-linux-arm64 - Versions diffs - 0.1.0 - Mend

@marinjursic/prc-linux-arm64 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (264) hide show

package/bin/catalog/objectives/core-repository.yaml ADDED Viewed

@@ -0,0 +1,243 @@
+schema_version: prc.objectives/v0.1
+catalog_version: 1.0.0
+objectives:
+  - id: USEQ-FDCA6C71
+    revision: 1
+    title: Operating entry point
+    statement: A current operating entry point or README exists.
+    source:
+      path: docs/engineering/05-code-quality-and-implementation.md
+      line: 61
+    domains: [documentation, repository]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-001]
+  - id: USEQ-6497B434
+    revision: 1
+    title: Published license
+    statement: Publish a clear license and ensure all included code and assets are legally compatible.
+    source:
+      path: docs/engineering/16-specialized-domains-and-release-assurance.md
+      line: 189
+    domains: [governance, repository, supply-chain]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-002]
+  - id: USEQ-89F5E97A
+    revision: 1
+    title: Contribution and release guidance
+    statement: Provide contribution, development, testing, review, security, and release guidance.
+    source:
+      path: docs/engineering/16-specialized-domains-and-release-assurance.md
+      line: 191
+    domains: [documentation, governance, repository]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-003]
+  - id: USEQ-AC6AC548
+    revision: 1
+    title: Security reporting information
+    statement: Provide security reporting and supported-version information.
+    source:
+      path: docs/engineering/16-specialized-domains-and-release-assurance.md
+      line: 396
+    domains: [documentation, security]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-004]
+  - id: USEQ-D73106BF
+    revision: 1
+    title: Open-source governance
+    statement: Define governance, maintainer roles, decision process, code of conduct, and conflict resolution.
+    source:
+      path: docs/engineering/16-specialized-domains-and-release-assurance.md
+      line: 190
+    domains: [governance, repository]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-005]
+  - id: USEQ-CA602113
+    revision: 1
+    title: Durable ownership
+    statement: Ensure code ownership and documentation survive staff changes and do not depend on one person.
+    source:
+      path: docs/engineering/05-code-quality-and-implementation.md
+      line: 651
+    domains: [governance, repository]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-006]
+  - id: USEQ-D1076D92
+    revision: 1
+    title: Pinned dependency inputs
+    statement: Dependency versions and build inputs are pinned sufficiently to prevent unexpected substitution.
+    source:
+      path: docs/engineering/11-developer-experience-platform-and-delivery.md
+      line: 32
+    domains: [delivery, repository, supply-chain]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-007, PRC-A-CORE-023, PRC-A-CORE-024, PRC-A-CORE-028]
+  - id: USEQ-F4D6E3B3
+    revision: 1
+    title: Pinned workflow tooling
+    statement: Pin toolchain, action, plugin, and dependency versions sufficiently for trustworthy results.
+    source:
+      path: docs/engineering/11-developer-experience-platform-and-delivery.md
+      line: 102
+    domains: [delivery, repository, supply-chain]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-008, PRC-A-CORE-017]
+  - id: USEQ-12655775
+    revision: 1
+    title: Automated engineering checks
+    statement: Use automated formatting, linting, compilation, type checking, static analysis, dependency scanning, and secret scanning appropriate to the code.
+    source:
+      path: docs/engineering/05-code-quality-and-implementation.md
+      line: 1012
+    domains: [code-quality, repository, testing]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-009, PRC-A-CORE-010, PRC-A-CORE-018, PRC-A-CORE-021]
+  - id: USEQ-73488048
+    revision: 1
+    title: Untrusted workflow isolation
+    statement: Untrusted contribution workflows cannot access production secrets or overwrite trusted artifacts.
+    source:
+      path: docs/engineering/11-developer-experience-platform-and-delivery.md
+      line: 37
+    domains: [delivery, security, supply-chain]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-011, PRC-A-CORE-020]
+  - id: USEQ-F0F5ACE7
+    revision: 1
+    title: Generated code review
+    statement: Treat generated or suggested code as untrusted input requiring the same ownership, review, testing, security, licensing, and provenance as handwritten code.
+    source:
+      path: docs/engineering/05-code-quality-and-implementation.md
+      line: 1046
+    domains: [ai, code-quality, governance]
+    automation_class: manual
+    assertion_ids: [PRC-A-CORE-012]
+  - id: USEQ-70E9D5AA
+    revision: 1
+    title: Applicable static analyses
+    statement: Run type, data-flow, control-flow, taint, dependency, configuration, infrastructure, secret, license, and policy analysis as applicable.
+    source:
+      path: docs/engineering/10-verification-and-testing.md
+      line: 559
+    domains: [code-quality, security, testing]
+    automation_class: contextual
+    assertion_ids: [PRC-A-CORE-013]
+  - id: USEQ-DAF77C8F
+    revision: 1
+    title: Machine-enforced source style
+    statement: Use a consistent machine-enforced style so review focuses on behavior and design.
+    source:
+      path: docs/engineering/05-code-quality-and-implementation.md
+      line: 114
+    domains: [code-quality, repository]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-014]
+  - id: USEQ-72088469
+    revision: 1
+    title: Exact assessed identity
+    statement: Evidence identifies the exact product, source revision, artifact, configuration, environment, data state, and date assessed.
+    source:
+      path: docs/engineering/01-governance-and-foundations.md
+      line: 18
+    domains: [evidence, governance, repository]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-015]
+  - id: PRC-36-011
+    revision: 1
+    title: Dependency update ownership
+    statement: Dependency-update ownership and cadence exist.
+    source:
+      path: docs/checklists/08-maintenance-vendors-compliance.md
+      line: 19
+    domains: [maintenance, repository, supply-chain]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-016]
+  - id: USEQ-B66A3064
+    revision: 1
+    title: Explicit execution bounds
+    statement: Time zones, locales, encodings, units, time synchronization, resource limits, and timeouts are explicit.
+    source:
+      path: docs/engineering/11-developer-experience-platform-and-delivery.md
+      line: 60
+    domains: [delivery, reliability]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-019, PRC-A-GO-002]
+  - id: USEQ-D60E6950
+    revision: 1
+    title: Intended package metadata
+    statement: Verify final packages contain only intended files, permissions, metadata, and dependencies.
+    source:
+      path: docs/engineering/11-developer-experience-platform-and-delivery.md
+      line: 154
+    domains: [delivery, repository, supply-chain]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-022]
+  - id: USEQ-0B7FDB5F
+    revision: 1
+    title: Supported runtime declarations
+    statement: Document supported runtimes, platforms, protocols, data versions, clients, and compatibility windows.
+    source:
+      path: docs/engineering/05-code-quality-and-implementation.md
+      line: 676
+    domains: [documentation, maintenance, repository]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-025]
+  - id: USEQ-7D4DA192
+    revision: 1
+    title: Immutable container bases
+    statement: Use minimal trusted base images pinned by immutable identity.
+    source:
+      path: docs/engineering/16-specialized-domains-and-release-assurance.md
+      line: 270
+    domains: [containers, security, supply-chain]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-026]
+  - id: USEQ-A3559C64
+    revision: 1
+    title: Non-root workloads
+    statement: Run workloads as non-root and without unnecessary privilege, capabilities, host access, or writable filesystem.
+    source:
+      path: docs/engineering/16-specialized-domains-and-release-assurance.md
+      line: 273
+    domains: [containers, kubernetes, security]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-027, PRC-A-CORE-029, PRC-A-K8S-001, PRC-A-K8S-002, PRC-A-K8S-003, PRC-A-K8S-004]
+  - id: USEQ-13CBD6C6
+    revision: 1
+    title: Workload resource policy
+    statement: Define resource requests, limits, priorities, disruption, and eviction behavior.
+    source:
+      path: docs/engineering/16-specialized-domains-and-release-assurance.md
+      line: 274
+    domains: [containers, kubernetes, reliability]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-030]
+  - id: USEQ-E85957E3
+    revision: 1
+    title: Secrets remain outside repository content
+    statement: Keep secrets out of source, history, artifacts, images, frontend bundles, tickets, chat, documentation, tests, analytics, and logs.
+    source:
+      path: docs/engineering/08-security-and-cryptography.md
+      line: 277
+    domains: [repository, security]
+    automation_class: partial
+    assertion_ids: [PRC-A-CORE-031]
+  - id: USEQ-F6ACEF15
+    revision: 1
+    title: Bounded outbound calls
+    statement: Every outbound call has an appropriate timeout.
+    source:
+      path: docs/engineering/06-application-services-and-apis.md
+      line: 22
+    domains: [code-quality, reliability, services]
+    automation_class: partial
+    assertion_ids: [PRC-A-GO-001]
+  - id: USEQ-13208C54
+    revision: 1
+    title: Controlled interface contracts
+    statement: Define every interface using a controlled, testable contract.
+    source:
+      path: docs/engineering/06-application-services-and-apis.md
+      line: 305
+    domains: [apis, architecture, testing]
+    automation_class: partial
+    assertion_ids: [PRC-A-API-001, PRC-A-API-002, PRC-A-API-003]

package/bin/catalog/objectives/iac.yaml ADDED Viewed

@@ -0,0 +1,13 @@
+schema_version: prc.objectives/v0.1
+catalog_version: 1.0.0
+objectives:
+  - id: USEQ-212AE882
+    revision: 1
+    title: Infrastructure, configuration, and policy analysis
+    statement: Infrastructure, configuration, and policy analysis has run.
+    source:
+      path: docs/engineering/08-security-and-cryptography.md
+      line: 82
+    domains: [infrastructure, security]
+    automation_class: partial
+    assertion_ids: [PRC-A-IAC-001]

package/bin/catalog/objectives/supply-chain.yaml ADDED Viewed

@@ -0,0 +1,13 @@
+schema_version: prc.objectives/v0.1
+catalog_version: 1.0.0
+objectives:
+  - id: USEQ-A9032C59
+    revision: 1
+    title: Dependency, SBOM, and license analysis
+    statement: Dependency, SBOM, and license analysis has run.
+    source:
+      path: docs/engineering/08-security-and-cryptography.md
+      line: 80
+    domains: [security, supply-chain]
+    automation_class: partial
+    assertion_ids: [PRC-A-SUPPLY-001, PRC-A-SUPPLY-002]

package/bin/catalog/profiles/api.yaml ADDED Viewed

@@ -0,0 +1,12 @@
+schema_version: prc.profile/v0.1
+id: prc/api
+version: "0.1"
+title: API contract readiness
+description: Language-neutral bounded structural analysis of detected OpenAPI 3.0, 3.1, and 3.2 descriptions.
+assertion_ids:
+  - PRC-A-API-001
+  - PRC-A-API-002
+  - PRC-A-API-003
+terminal_policy:
+  block_on: [critical, high]
+  allow_manual_remaining: true

package/bin/catalog/profiles/core-repository.yaml ADDED Viewed

@@ -0,0 +1,49 @@
+schema_version: prc.profile/v0.1
+id: prc/core-repository
+version: "1.0"
+title: Core repository readiness
+description: Deterministic repository governance, documentation, workflow, dependency, security, API-contract, and test foundations.
+assertion_ids:
+  - PRC-A-CORE-001
+  - PRC-A-CORE-002
+  - PRC-A-CORE-003
+  - PRC-A-CORE-004
+  - PRC-A-CORE-005
+  - PRC-A-CORE-006
+  - PRC-A-CORE-007
+  - PRC-A-CORE-008
+  - PRC-A-CORE-009
+  - PRC-A-CORE-010
+  - PRC-A-CORE-011
+  - PRC-A-CORE-012
+  - PRC-A-CORE-013
+  - PRC-A-CORE-014
+  - PRC-A-CORE-015
+  - PRC-A-CORE-016
+  - PRC-A-CORE-017
+  - PRC-A-CORE-018
+  - PRC-A-CORE-019
+  - PRC-A-CORE-020
+  - PRC-A-CORE-021
+  - PRC-A-CORE-022
+  - PRC-A-CORE-023
+  - PRC-A-CORE-024
+  - PRC-A-CORE-025
+  - PRC-A-CORE-026
+  - PRC-A-CORE-027
+  - PRC-A-CORE-028
+  - PRC-A-CORE-029
+  - PRC-A-CORE-030
+  - PRC-A-K8S-001
+  - PRC-A-K8S-002
+  - PRC-A-K8S-003
+  - PRC-A-K8S-004
+  - PRC-A-CORE-031
+  - PRC-A-GO-001
+  - PRC-A-GO-002
+  - PRC-A-API-001
+  - PRC-A-API-002
+  - PRC-A-API-003
+terminal_policy:
+  block_on: [critical, high]
+  allow_manual_remaining: true

package/bin/catalog/profiles/iac.yaml ADDED Viewed

@@ -0,0 +1,18 @@
+schema_version: prc.profile/v0.1
+id: prc/iac
+version: "0.1"
+title: Infrastructure-as-code readiness
+description: Bounded native repository checks plus reviewed offline policy evidence for inventoried Terraform, Kubernetes, and container definitions.
+assertion_ids:
+  - PRC-A-CORE-027
+  - PRC-A-CORE-028
+  - PRC-A-CORE-029
+  - PRC-A-CORE-030
+  - PRC-A-K8S-001
+  - PRC-A-K8S-002
+  - PRC-A-K8S-003
+  - PRC-A-K8S-004
+  - PRC-A-IAC-001
+terminal_policy:
+  block_on: [critical, high]
+  allow_manual_remaining: true

package/bin/catalog/profiles/kubernetes.yaml ADDED Viewed

@@ -0,0 +1,15 @@
+schema_version: prc.profile/v0.1
+id: prc/kubernetes
+version: "0.1"
+title: Kubernetes workload readiness
+description: Bounded repository analysis of workload security contexts and resource declarations against selected Kubernetes Pod Security Standards.
+assertion_ids:
+  - PRC-A-CORE-029
+  - PRC-A-CORE-030
+  - PRC-A-K8S-001
+  - PRC-A-K8S-002
+  - PRC-A-K8S-003
+  - PRC-A-K8S-004
+terminal_policy:
+  block_on: [critical, high]
+  allow_manual_remaining: true

package/bin/catalog/profiles/quick.yaml ADDED Viewed

@@ -0,0 +1,27 @@
+schema_version: prc.profile/v0.1
+id: prc/quick
+version: "1.0"
+title: Quick repository risk screen
+description: A small language-neutral screen for high-signal repository, dependency, test, workflow, container, and workload risks; it is not a production-readiness certificate.
+assertion_ids:
+  - PRC-A-CORE-001
+  - PRC-A-CORE-004
+  - PRC-A-CORE-007
+  - PRC-A-CORE-008
+  - PRC-A-CORE-009
+  - PRC-A-CORE-010
+  - PRC-A-CORE-011
+  - PRC-A-CORE-015
+  - PRC-A-CORE-017
+  - PRC-A-CORE-018
+  - PRC-A-CORE-021
+  - PRC-A-CORE-023
+  - PRC-A-CORE-024
+  - PRC-A-CORE-025
+  - PRC-A-CORE-026
+  - PRC-A-CORE-027
+  - PRC-A-CORE-029
+  - PRC-A-CORE-030
+terminal_policy:
+  block_on: [critical, high]
+  allow_manual_remaining: true

package/bin/catalog/profiles/supply-chain.yaml ADDED Viewed

@@ -0,0 +1,20 @@
+schema_version: prc.profile/v0.1
+id: prc/supply-chain
+version: "0.2"
+title: Software supply-chain readiness
+description: Repository dependency, build-input, license, generated SBOM, and fresh offline known-vulnerability evidence without claiming built-artifact or runtime completeness.
+assertion_ids:
+  - PRC-A-CORE-002
+  - PRC-A-CORE-007
+  - PRC-A-CORE-008
+  - PRC-A-CORE-016
+  - PRC-A-CORE-023
+  - PRC-A-CORE-024
+  - PRC-A-CORE-025
+  - PRC-A-CORE-026
+  - PRC-A-CORE-028
+  - PRC-A-SUPPLY-001
+  - PRC-A-SUPPLY-002
+terminal_policy:
+  block_on: [critical, high]
+  allow_manual_remaining: true