code-foundry 0.1.4

package/.github/workflows/security.yml

@@ -0,0 +1,228 @@
+name: Security
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  profile:
+    name: Profile
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+    outputs:
+      javascript: ${{ steps.profile.outputs.javascript }}
+      rust: ${{ steps.profile.outputs.rust }}
+      python: ${{ steps.profile.outputs.python }}
+      python_requirements: ${{ steps.profile.outputs.python_requirements }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            .npmrc
+            .pnpmfile.cjs
+            .yarnrc*
+            **/package.json
+            **/bun.lock
+            **/bun.lockb
+            **/pnpm-lock.yaml
+            **/yarn.lock
+            **/package-lock.json
+            **/Cargo.toml
+            **/Cargo.lock
+            **/.cargo/**
+            **/pyproject.toml
+            **/requirements*.txt
+            **/setup.py
+            **/setup.cfg
+            **/Pipfile
+            **/Pipfile.lock
+            **/poetry.lock
+            **/uv.lock
+          sparse-checkout-cone-mode: false
+      - name: Detect
+        id: profile
+        run: bash .github/scripts/security.sh profile >> "$GITHUB_OUTPUT"
+
+  dependency-audit-javascript:
+    name: Dependency Audit (JavaScript)
+    runs-on: ubuntu-slim
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          # JavaScript audits only need manifests, lockfiles, and audit config.
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            .npmrc
+            .pnpmfile.cjs
+            .yarnrc*
+            **/package.json
+            **/bun.lock
+            **/bun.lockb
+            **/pnpm-lock.yaml
+            **/yarn.lock
+            **/package-lock.json
+          sparse-checkout-cone-mode: false
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/security.sh should_run javascript >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          mise-scope: javascript
+          cache-save: ${{ github.event_name != 'pull_request' }}
+      - name: Audit dependencies
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/security.sh audit javascript
+
+  dependency-audit-rust:
+    name: Dependency Audit (Rust)
+    # ubuntu-latest ships with Cargo/Rust; use it for the audit-only job and
+    # fall back to the repository toolchain when the image lacks Rust.
+    runs-on: ${{ vars.REPO_FOUNDRY_RUST_AUDIT_RUNNER || 'ubuntu-latest' }}
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          # Rust audits only need manifests, Cargo configuration, and audit config.
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            **/Cargo.toml
+            **/Cargo.lock
+            **/.cargo/**
+          sparse-checkout-cone-mode: false
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/security.sh should_run rust >> "$GITHUB_OUTPUT"
+      - name: Check Rust
+        id: system-rust
+        if: steps.applicability.outputs.applicable == 'true'
+        shell: bash
+        run: |
+          if command -v cargo >/dev/null 2>&1 && command -v rustc >/dev/null 2>&1; then
+            cargo --version
+            rustc --version
+            echo 'available=true' >> "$GITHUB_OUTPUT"
+          else
+            echo 'available=false' >> "$GITHUB_OUTPUT"
+          fi
+      - name: Setup
+        if: >-
+          steps.applicability.outputs.applicable == 'true' &&
+          steps.system-rust.outputs.available != 'true'
+        uses: ./.github/actions/setup
+        with:
+          mise-scope: rust
+          cache-save: ${{ github.event_name != 'pull_request' }}
+      - name: Install cargo-audit
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit
+      - name: Audit dependencies
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/security.sh audit rust
+
+  dependency-audit-python:
+    name: Dependency Audit (Python) / ${{ matrix.requirement }}
+    needs: profile
+    if: >-
+      ${{ needs.profile.result == 'success' &&
+      needs.profile.outputs.python == 'true' &&
+      needs.profile.outputs.python_requirements != '["none"]' }}
+    strategy:
+      fail-fast: false
+      max-parallel: 8
+      matrix:
+        requirement: ${{ fromJSON(needs.profile.outputs.python_requirements) }}
+    runs-on: ubuntu-slim
+    timeout-minutes: 20
+    env:
+      REPO_FOUNDRY_PYTHON_REQUIREMENT: ${{ matrix.requirement }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          # Python audits only need manifests, lockfiles, and audit config.
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            **/pyproject.toml
+            **/requirements*.txt
+            **/setup.py
+            **/setup.cfg
+            **/Pipfile
+            **/Pipfile.lock
+            **/poetry.lock
+            **/uv.lock
+          sparse-checkout-cone-mode: false
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          mise-scope: python
+          cache-save: ${{ github.event_name != 'pull_request' }}
+      - name: Audit dependencies
+        run: bash .github/scripts/security.sh audit python
+
+  dependency-audit-python-gate:
+    name: Dependency Audit (Python)
+    needs: [profile, dependency-audit-python]
+    if: always()
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+    steps:
+      - name: Gate
+        env:
+          PROFILE_RESULT: ${{ needs.profile.result }}
+          AUDIT_RESULT: ${{ needs.dependency-audit-python.result }}
+        run: |
+          if [ "$PROFILE_RESULT" != success ]; then
+            echo "Python audit profile failed: $PROFILE_RESULT" >&2
+            exit 1
+          fi
+          case "$AUDIT_RESULT" in
+            success|skipped) exit 0 ;;
+            *) echo "Python dependency audit failed: $AUDIT_RESULT" >&2; exit 1 ;;
+          esac
+
+  dependency-review:
+    name: Dependency Review
+    if: ${{ github.event_name == 'pull_request' && !github.event.repository.private }}
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+    steps:
+      - name: Review
+        uses: actions/dependency-review-action@v5
+        with:
+          fail-on-severity: high
+          license-check: true

package/.github/workflows/test.yml

@@ -0,0 +1,175 @@
+name: Test
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  unit:
+    name: Unit
+    # Keep ordinary suites on the lean image. Set the repository variable
+    # REPO_FOUNDRY_UNIT_RUNNER=ubuntu-latest for native/system-dependent tests.
+    runs-on: ${{ vars.REPO_FOUNDRY_UNIT_RUNNER || 'ubuntu-slim' }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh task_profile unit >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: true
+          install-javascript: ${{ steps.applicability.outputs.javascript == 'true' }}
+          install-python: ${{ steps.applicability.outputs.python == 'true' }}
+          install-rust: ${{ steps.applicability.outputs.rust == 'true' }}
+          cache-build: false
+          cache-environment: false
+          cache-packages: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
+          task: unit
+          task-javascript: ${{ steps.applicability.outputs.javascript }}
+          task-python: ${{ steps.applicability.outputs.python }}
+          task-rust: ${{ steps.applicability.outputs.rust }}
+      - name: Unit
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/ci.sh unit
+      - name: Upload coverage
+        if: >-
+          always() &&
+          steps.applicability.outputs.applicable == 'true' &&
+          hashFiles('coverage/**', 'htmlcov/**', '.coverage*', 'target/llvm-cov/**') != ''
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-unit-${{ github.run_id }}
+          path: |
+            coverage/**
+            htmlcov/**
+            .coverage*
+            target/llvm-cov/**
+          compression-level: 1
+          if-no-files-found: ignore
+          retention-days: 14
+
+  integration:
+    name: Integration
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh task_profile integration >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: true
+          install-javascript: ${{ steps.applicability.outputs.javascript == 'true' }}
+          install-python: ${{ steps.applicability.outputs.python == 'true' }}
+          install-rust: ${{ steps.applicability.outputs.rust == 'true' }}
+          cache-build: ${{ steps.applicability.outputs.rust == 'true' }}
+          cache-environment: false
+          cache-save: ${{ github.event_name == 'push' }}
+          task: integration
+          task-javascript: ${{ steps.applicability.outputs.javascript }}
+          task-python: ${{ steps.applicability.outputs.python }}
+          task-rust: ${{ steps.applicability.outputs.rust }}
+      - name: Integration
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/ci.sh integration
+
+  e2e:
+    name: E2E
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh task_profile e2e >> "$GITHUB_OUTPUT"
+      - name: Cache browser binaries
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.browser == 'true'
+        uses: ./.github/actions/cache
+        with:
+          save: ${{ github.event_name == 'push' }}
+          path: |
+            ~/.cache/ms-playwright
+            ~/.cache/Cypress
+            ~/.cache/puppeteer
+          key: ${{ runner.os }}-e2e-browsers-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json', '**/playwright.config.*', '**/cypress.config.*') }}
+          restore-keys: |
+            ${{ runner.os }}-e2e-browsers-
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: true
+          install-javascript: ${{ steps.applicability.outputs.javascript == 'true' }}
+          install-python: ${{ steps.applicability.outputs.python == 'true' }}
+          install-rust: ${{ steps.applicability.outputs.rust == 'true' }}
+          cache-build: false
+          cache-environment: false
+          cache-save: ${{ github.event_name == 'push' }}
+          task: e2e
+          task-javascript: ${{ steps.applicability.outputs.javascript }}
+          task-python: ${{ steps.applicability.outputs.python }}
+          task-rust: ${{ steps.applicability.outputs.rust }}
+      - name: E2E
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/ci.sh e2e
+
+  smoke:
+    name: Smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh task_profile smoke >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: true
+          install-javascript: ${{ steps.applicability.outputs.javascript == 'true' }}
+          install-python: ${{ steps.applicability.outputs.python == 'true' }}
+          install-rust: ${{ steps.applicability.outputs.rust == 'true' }}
+          cache-build: false
+          cache-environment: false
+          cache-save: ${{ github.event_name == 'push' }}
+          task: smoke
+          task-javascript: ${{ steps.applicability.outputs.javascript }}
+          task-python: ${{ steps.applicability.outputs.python }}
+          task-rust: ${{ steps.applicability.outputs.rust }}
+      - name: Smoke
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/ci.sh smoke

package/.gitignore

@@ -0,0 +1,77 @@
+# Operating system
+.DS_Store
+Thumbs.db
+.Trashes
+
+# Secrets and local environment
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+
+# JavaScript and TypeScript
+node_modules/
+.pnp/
+.pnp.js
+.turbo/
+*.tsbuildinfo
+next-env.d.ts
+
+# Python
+.venv/
+venv/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+
+# Rust
+target/
+
+# Build and test output
+dist/
+build/
+out/
+coverage/
+htmlcov/
+.coverage*
+.next/
+artifacts/
+cache/
+!.github/actions/cache/
+!.github/actions/cache/action.yml
+typechain/
+coverage.json
+tests/.bin/
+**/.app/
+
+# Logs and temporary files
+*.log
+*.tmp
+*.pid
+npm-debug.log*
+yarn-debug.log*
+pnpm-debug.log*
+
+# Editors, agents, and local tools
+.claude/
+.kilo/
+.codex/
+.cursor/
+.windsurf/
+.vscode/
+.idea/
+.zed/
+.fleet/
+.opencode/
+.kluster/
+.direnv/
+.envrc
+.vercel/
+mise.local.toml
+.mise.local.toml
+mise.local.lock
+.mise.local.lock
+*.code-workspace

package/.mise.toml

@@ -0,0 +1,6 @@
+[tools]
+node = "24.18.0"
+bun = "1.3.14"
+
+[settings]
+experimental = true

package/.prettierrc

@@ -0,0 +1,6 @@
+{
+  "semi": false,
+  "singleQuote": true,
+  "trailingComma": "es5",
+  "printWidth": 100
+}

package/AGENTS.md

@@ -0,0 +1,155 @@
+# Agent Instructions
+
+These instructions are the repository-level operating contract for coding agents, including Hermes, OpenCode, and other automation.
+
+They complement `CONTRIBUTING.md`. More specific instructions in nested `AGENTS.md` files and project documentation take precedence for their directory.
+
+## Mission
+
+- Keep formatting, linting, type checking, builds, tests, and coverage reproducible locally and in CI.
+- Prefer the versions pinned in `.mise.toml`.
+- Do not commit secrets, generated credentials, local environment files, or machine-specific paths.
+- Add tests for behavior changes and keep coverage thresholds explicit in the project configuration.
+- Make the smallest complete, well-tested change that solves the requested problem without disturbing unrelated work.
+
+This repository may contain TypeScript, Rust, Python, or any combination of them. Detect the active stack from the files present; do not assume every check applies.
+
+## Read before acting
+
+Before editing:
+
+1. Read this file and `.github/CONTRIBUTING.md`.
+2. Find and read any nested `AGENTS.md` that covers the files you will touch.
+3. Read the nearest README, package manifest, build configuration, and relevant tests.
+4. Inspect the current branch, worktree, remotes, and recent history:
+
+   ```sh
+   git status --short --branch
+   git remote -v
+   git log -5 --oneline
+   ```
+
+5. Identify the repository's package manager, lockfile, runtime versions, test commands, deployment assumptions, and generated files.
+
+If the worktree is dirty, preserve existing changes and avoid overlapping edits until their ownership is clear.
+
+## Priorities
+
+When instructions conflict, use this order:
+
+1. System and user instructions
+2. This repository's instructions and explicit task scope
+3. Nested directory instructions
+4. Existing project conventions
+5. General best practices
+
+Ask for clarification when a missing decision would materially change the implementation. Otherwise make the smallest reasonable assumption and document it.
+
+## Safety boundaries
+
+- Do not discard, reset, overwrite, or rewrite user-owned changes.
+- Do not expose or commit secrets, credentials, tokens, private keys, local environment files, or personal machine paths.
+- Do not modify production resources, repository settings, branch protections, secrets, deployments, or external systems unless explicitly requested.
+- Do not add organization- or product-specific details to this reusable baseline.
+- Do not change dependency managers or lockfiles unnecessarily.
+- Do not bypass hooks, tests, review requirements, or required checks to hide a failure.
+- Do not claim completion while required validation, review, deployment, or user decisions remain pending.
+- Publishing, committing, or opening a pull request requires explicit task scope or user authorization.
+
+## Standard workflow
+
+1. Restate the desired outcome and identify the files or systems in scope.
+2. Inspect before editing; preserve unrelated work.
+3. Plan the smallest coherent change.
+4. Implement with existing project patterns.
+5. Run bash .github/scripts/bootstrap.sh for a new checkout, or bash .github/scripts/doctor.sh to diagnose setup drift.
+6. Run focused checks while iterating.
+7. Inspect the final diff for accidental changes, secrets, formatting, and generated files.
+8. Run the broadest applicable validation available.
+9. Report what changed, exact checks and results, skipped checks with reasons, risks, and remaining work.
+
+For normal feature work, branch from `staging` and target pull requests at `staging`. Treat `main` as the protected release branch. Follow `.github/CONTRIBUTING.md` for the complete internal and external contribution flow.
+
+## Toolchain and dependencies
+
+- Use the versions pinned in `.mise.toml`; run `mise install` when needed.
+- Use the package manager indicated by the existing lockfile:
+  - `bun.lock` or `bun.lockb` → Bun
+  - `pnpm-lock.yaml` → pnpm
+  - `yarn.lock` → Yarn
+  - `package-lock.json` → npm
+- Use the existing Python environment and dependency manifest. Prefer a project-managed virtual environment.
+- Use Cargo commands and the committed Cargo lockfile for Rust projects.
+- Do not mix package managers or regenerate lockfiles as a side effect.
+- Keep dependency additions narrowly scoped and explain security, licensing, and runtime impact.
+
+## Validation
+
+Use the shared scripts when present. They detect supported tools and skip inapplicable checks:
+
+```sh
+bash .github/scripts/ci.sh format
+bash .github/scripts/ci.sh lint
+bash .github/scripts/ci.sh type_check
+bash .github/scripts/ci.sh build
+bash .github/scripts/ci.sh unit
+bash .github/scripts/ci.sh integration
+bash .github/scripts/ci.sh e2e
+bash .github/scripts/ci.sh smoke
+bash .github/scripts/security.sh
+```
+
+Run focused tests first, then the complete applicable set for release, security, workflow, dependency, and configuration changes.
+
+At minimum:
+
+- TypeScript/JavaScript: Prettier formatting, ESLint linting, type-check, build, and Bun's native test runner for unit/integration tests; use the project's native browser runner for E2E tests
+- Do not add Vitest. Preserve specialized native runners such as Matchstick for The Graph and Hardhat for smart contracts.
+- Rust: default rustfmt, Clippy with warnings treated as errors, check, unit/integration tests, and dependency audit
+- Python: Ruff formatting and linting, compile or type checks, pytest, coverage, and dependency audit
+- Mixed projects: validate each active ecosystem and its integration boundaries
+
+If a check cannot run, state the exact reason. A skipped check is not a passing check.
+
+## Tests and coverage
+
+- Add or update tests for behavior changes and regressions.
+- Keep unit, integration, E2E, and smoke coverage in the suite where each applies.
+- Preserve project-specific coverage thresholds; do not lower them to make CI green.
+- Keep test data deterministic and remove secrets from logs and fixtures.
+- Use the narrowest test command while iterating, then run the affected package or workspace suite.
+
+## GitHub workflows and configuration
+
+- Keep workflows concise, independently runnable, and safe to re-run.
+- Use `push` for `main, staging` and `pull_request` for `staging` unless a workflow has a documented event-specific reason.
+- Give workflows clear names and jobs concise names; avoid repeating the workflow name in the job name.
+- Use per-workflow concurrency groups that cancel superseded runs while allowing independent workflows to run in parallel.
+- Keep setup language-aware and cache dependency downloads by lockfile; do not cache secrets, `node_modules`, virtual environments, or broad build output without a measured reason.
+- Use least-privilege permissions and pin action versions consistently with the template.
+- Keep CI, Test, Security, CodeQL, Draft PR, Release PR, and Release concerns separated.
+- Security and CodeQL may skip when repository visibility or GitHub plan support does not permit them. Do not make an unavailable check required.
+- Optional Turborepo Remote Caching uses `TURBO_TOKEN` and `TURBO_TEAM`; do not add Vercel deployment behavior just to enable caching.
+- Update branch protection when adding or renaming required job checks; verify the actual GitHub status context.
+
+## Documentation and generated files
+
+- Update documentation when behavior, setup, configuration, commands, or operational procedures change.
+- Keep `.env.example` limited to variable names and safe placeholders.
+- Do not commit build output, caches, coverage output, dependency directories, generated credentials, or temporary files.
+- Preserve formatting and line-ending conventions from `.editorconfig` and `.gitattributes`.
+
+## Completion report
+
+End every agent task with:
+
+```text
+Summary:
+Files changed:
+Validation:
+Skipped checks:
+Risks or follow-up:
+Branch/PR:
+```
+
+Use exact command names and outcomes. Mention external changes separately from local changes, and distinguish completed work from recommendations.

package/CHANGELOG.md

@@ -0,0 +1,3 @@
+# Changelog
+
+All notable changes to this project are documented here.