@mseep/open-computer-use 1.0.0

package/.markdownlint.yaml

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+#
+# markdownlint configuration.
+#
+# Reference: https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md
+
+# Use the default rules as the baseline.
+default: true
+
+# MD013 — line length. Architecture docs use long table cells and citation
+# links that legitimately exceed 80 characters. Keep line-length enforcement
+# off and rely on prose discipline + the wc-budget script for size control.
+MD013: false
+
+# MD024 — multiple headings with the same content. Allowed if siblings differ
+# (e.g. "## Status" inside multiple ADRs).
+MD024:
+  siblings_only: true
+
+# MD033 — inline HTML. We use HTML comments for SPDX headers above YAML
+# front-matter, <details>/<summary> blocks, and angle-bracket placeholders
+# in templates (e.g. "# ADR-NNNN: <title>"). Disable entirely; placeholder
+# leakage into real ADRs is caught by ai-slop-detector and reviewer eyes.
+MD033: false
+
+# MD003 — heading-style. Disabled. markdownlint-cli2 doesn't understand
+# YAML front-matter and parses the closing `---` delimiter as a setext H2
+# underline, then flags the first ATX heading in the file as a violation
+# of "setext style" (which was never the file's actual style). Front-matter
+# is mandatory in our docs, so this rule cannot work as-is.
+MD003: false
+
+# MD022 — blanks-around-headings. Disabled — markdownlint mis-parses the
+# YAML front-matter delimiter (`---`) as a setext H2 underline and then
+# treats the line above it ("status: proposed") as a heading that needs
+# blank lines around it. False positive specific to our front-matter shape.
+MD022: false
+
+# MD041 — first line in file should be a top-level heading. Our docs lead
+# with an HTML license comment then YAML front-matter, so disable this.
+MD041: false
+
+# MD046 — code-block style. Allow both fenced and indented (research digests
+# sometimes inline indented blocks).
+MD046:
+  style: fenced
+
+# MD059 — link text should be descriptive. Allow "here" / "this" because we
+# use them in legitimate context-sentence patterns.
+MD059: false

package/.semgrepignore

@@ -0,0 +1,85 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+#
+# Semgrep exclusion list for legacy main-line code on next/v1.
+#
+# Why this file exists.
+# ---------------------
+# next/v1 carries forward the main-line PoC code (Dockerfile, FastAPI
+# server, Open WebUI patches, embedded skills) so the branch stays
+# buildable while the enterprise architecture is designed. That legacy
+# code does not pass the Layer 0 SAST gate — it has root-running
+# containers, wildcard CORS, md5 cache keys, stdlib XML parsing, etc.
+# None of it is shipped in the v1 GA architecture: every component is
+# rewritten from scratch under docs/architecture/ in Layer 6+, and each
+# new component PR removes its path from this file in the same commit.
+#
+# Policy: docs/architecture/adr/0001-layer-0-gate-legacy-exclusion.md
+# Process: docs/architecture/PROCESS.md ("Adding a component" step 4)
+#
+# Rules for editing this file.
+# ----------------------------
+# 1. Adding a path requires an ADR amendment. Do not silently add
+#    exclusions to make a finding go away.
+# 2. Removing a path is mandatory in the same PR that introduces a
+#    new-architecture component covering that area. CI must pass
+#    without the exclusion before the PR can merge.
+# 3. New code (anything under docs/architecture/ proper, .github/,
+#    helm/ once rewritten, future components/) is NEVER excluded.
+
+# --- Legacy main-line code ---------------------------------------------------
+
+# Sandbox image — root-running, sudo usage, dynamic urllib. Replaced by the
+# Sandbox Runtime component (Layer 6+, Kata + Cloud Hypervisor per BoM #5).
+Dockerfile
+
+# MCP orchestrator FastAPI service — wildcard CORS, md5 keys, stdlib XML.
+# Replaced by the Control Plane + Session Lifecycle components.
+computer-use-server/
+
+# Open WebUI integration — runs as root in container, no USER directive.
+# Replaced by an external IdP-driven UI integration (not bundled in v1 GA).
+openwebui/
+
+# Settings sidecar — root container. Folded into Control Plane in Layer 6+.
+settings-wrapper/
+
+# Cleanup cron container — root, sudo. Folded into k8s-native lifecycle
+# (Kyverno + controller) in Layer 6+.
+cron/
+cleanup/
+
+# Bundled-skills PoC code — defused-xml gaps, file-perms issues. v1 ships
+# zero default skills (per manifesto/04-non-goals.md); SkillProvider stays
+# TBD. These directories will be deleted, not refactored. Three specific
+# `skills/public/` subdirectories trip SAST today; the whole
+# `skills/examples/` tree is excluded because every example carries the
+# same upstream patterns. All three subtrees die together when v1 GA
+# locks in "zero bundled skills".
+skills/public/pptx/
+skills/public/docx/
+skills/public/webapp-testing/
+skills/examples/
+
+# Main-line Helm chart release workflow — pre-existing run-shell-injection
+# on its `gh release` step. Replaced by the Layer 6+ release workflow once
+# the supply-chain.yml pattern is extended to chart artifacts.
+.github/workflows/release-chart.yml
+
+# Main-line test code — stdlib XML parsing in PoC test fixtures. New
+# components ship their own tests under each component's directory.
+# The pattern is root-anchored (`/tests/`, not `tests/`) so it matches
+# only the top-level legacy tree, not nested `tests/` directories that
+# future components will own.
+/tests/
+
+# --- Not legacy, just out of scope for SAST ---------------------------------
+
+vendor/
+
+# In-progress architecture buffer. Prose, not source. Migrated to
+# docs/architecture/ over time.
+docs/future-architecture/
+
+# Planning cache, never executed.
+.planning/

package/.vale/styles/Architecture/ap13-data-class-substrate.yml

@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+#
+# AP-13 enforcement: data classification does not pick the sandbox substrate.
+# Per docs/architecture/manifesto/02-nfrs.md "Anti-pattern rows" AP-13.
+
+extends: existence
+message: "AP-13 (manifesto/02-nfrs.md): data classification does not pick the sandbox substrate. Trust profile picks the tier; data class governs custody / retention / residency."
+level: error
+ignorecase: true
+raw:
+  - '\b(NPI|RESTRICTED|CONFIDENTIAL)\s+(?:→|requires|->)\s+(?:microVM|hardware-virt)\b'

package/.vale/styles/Architecture/banned-phrases.yml

@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+#
+# Banned phrases: AI-slop and corporate-documentation tells.
+# Per CLAUDE.md "Documentation discipline".
+
+extends: existence
+message: "Banned phrase: '%s'. Cut the preamble; state the fact."
+level: error
+ignorecase: true
+raw:
+  - '\bIt(?:''s|\s+is) worth noting that\b'
+  - '\bIt(?:''s|\s+is) important to (?:note|consider|remember)\b'
+  - '\bIn this (?:section|document|chapter)(?:[, ]+we will|[, ]+we shall)\b'
+  - '\bThis (?:document|section|guide) will (?:cover|discuss|explain|describe)\b'
+  - '\bGoing forward\b'
+  - '\bMoving forward\b'
+  - '\bPlease (?:note|ensure|refer)\b'
+  - '\bKindly\b'
+  - '\bHappy coding\b'
+  - '\bWe hope this helps\b'
+  - '\bIn today''s fast-paced\b'
+  - '\bdelve into\b'

package/.vale/styles/Architecture/banned-vocab.yml

@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+#
+# Banned vocabulary: marketing adjectives that don't carry measurable referents.
+# Per CLAUDE.md "Documentation discipline" — state the specific property instead.
+
+extends: existence
+message: "Banned vocabulary: '%s' has no measurable referent. State the specific property instead (e.g. 'supports transactional DDL', not 'robust')."
+level: error
+ignorecase: true
+tokens:
+  - comprehensive
+  - robust
+  - seamless
+  - powerful
+  - best-in-class
+  - industry-leading
+  - elegant
+  - battle-tested
+  - cutting-edge
+  - next-generation
+  - state-of-the-art
+  - world-class

package/.vale/styles/Architecture/marketing-tone.yml

@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+#
+# Marketing-tone tells: hedges and "comprehensive guide" framing.
+# Per CLAUDE.md "Documentation discipline".
+
+extends: existence
+message: "Marketing tone: '%s'. Architecture docs state requirements, constraints, and trade-offs, not adjectives."
+level: warning
+ignorecase: true
+tokens:
+  - "comprehensive guide"
+  - "complete guide"
+  - "ultimate guide"
+  - "modern stack"
+  - "production-grade"
+  - "enterprise-ready"
+  - "scalable solution"
+  - "developer-friendly"

package/.vale.ini

@@ -0,0 +1,18 @@
+; SPDX-License-Identifier: FSL-1.1-Apache-2.0
+; Copyright (c) 2025 Open Computer Use Contributors
+;
+; Vale configuration: prose linting for architecture docs.
+;
+; Reference: https://vale.sh/docs/keys
+
+StylesPath = .vale/styles
+
+MinAlertLevel = warning
+
+[*.md]
+BasedOnStyles = Architecture
+
+; Skip YAML front-matter, inline code spans, fenced code blocks, and HTML
+; comments (SPDX headers). Rules apply to prose only.
+TokenIgnores = (?s)---\n.*?\n---, (?s)`[^`]+`
+BlockIgnores = (?s)^```.*?\n```, (?s)<!--.*?-->