neotoma 0.3.0 → 0.3.2

package/foundation/security/security_rules.md

@@ -1,163 +0,0 @@
-# Security Rules
-
-## Purpose
-
-Prevent accidental commits of private, sensitive, or confidential data and enforce security best practices.
-
-## Pre-Commit Security Audit
-
-Before staging or committing ANY changes, perform the following checks:
-
-### 1. Protected Directories Check
-
-**CRITICAL**: Check for any files in protected directories (configured in `foundation-config.yaml`):
-
-```bash
-# Check unstaged changes
-git status --porcelain | grep -E "^[AM]|^\?\?" | grep -E "docs/private/|data/" && echo "ERROR: Protected directory detected" && exit 1
-
-# Check staged changes (if any exist)
-git diff --cached --name-only | grep -E "docs/private/|data/" && echo "ERROR: Protected files already staged" && exit 1
-```
-
-**Action**: If any files match protected patterns, **ABORT** the commit immediately and alert the user.
-
-### 2. Environment Files Check
-
-Check for any `.env*` files (should be in `.gitignore` but verify):
-
-```bash
-git status --porcelain | grep -E "\.env" && echo "ERROR: Environment files detected" && exit 1
-git diff --cached --name-only | grep -E "\.env" && echo "ERROR: Environment files already staged" && exit 1
-```
-
-**Action**: If any `.env*` files are detected, **ABORT** the commit.
-
-### 3. Sensitive File Pattern Check
-
-Check for files with sensitive naming patterns:
-
-```bash
-# Check for files with "secret" or "private" in path (excluding legitimate code)
-git status --porcelain | grep -vE "(test|spec)" | grep -iE "(secret|private)" | grep -vE "docs/private" && echo "ERROR: Suspicious file patterns detected" && exit 1
-```
-
-**Note**: This check excludes test files and legitimate code files.
-
-### 4. Hardcoded Credentials Scan
-
-Scan staged and unstaged files for common credential patterns:
-
-```bash
-# Only scan text files, exclude binary files
-git diff --cached --name-only | xargs -I {} sh -c 'file {} | grep -q "text" && grep -lE "(api[_-]?key|password|secret|token)\s*[:=]\s*['\''"][^'\''\"]{10,}" {}' && echo "WARNING: Potential hardcoded credentials detected" && exit 1
-```
-
-**Action**: If potential credentials are found, review manually before proceeding.
-
-## Security Audit Execution
-
-The security audit MUST be executed **BEFORE** running `git add -A` or staging any files.
-
-### Audit Script
-
-```bash
-#!/bin/bash
-set -e
-
-echo "🔒 Running pre-commit security audit..."
-
-# Check 1: Protected directories
-if git status --porcelain | grep -E "^[AM]|^\?\?" | grep -qE "docs/private/|data/"; then
-    echo "❌ SECURITY VIOLATION: Files in protected directories detected!"
-    echo "Files:"
-    git status --porcelain | grep -E "^[AM]|^\?\?" | grep "docs/private/\|data/"
-    exit 1
-fi
-
-if git diff --cached --name-only 2>/dev/null | grep -qE "docs/private/|data/"; then
-    echo "❌ SECURITY VIOLATION: Protected files already staged!"
-    echo "Files:"
-    git diff --cached --name-only | grep "docs/private/\|data/"
-    exit 1
-fi
-
-# Check 2: Environment files
-if git status --porcelain | grep -qE "\.env"; then
-    echo "❌ SECURITY VIOLATION: .env files detected!"
-    git status --porcelain | grep "\.env"
-    exit 1
-fi
-
-if git diff --cached --name-only 2>/dev/null | grep -qE "\.env"; then
-    echo "❌ SECURITY VIOLATION: .env files already staged!"
-    git diff --cached --name-only | grep "\.env"
-    exit 1
-fi
-
-echo "✅ Security audit passed"
-```
-
-## Enforcement
-
-This security audit MUST be run:
-
-1. **Before** any `git add` command
-2. **Before** any `git commit` command
-3. As part of the commit command workflow
-
-## Failure Behavior
-
-If the security audit fails:
-
-1. **STOP** all git operations immediately
-2. **DO NOT** stage or commit any files
-3. Display clear error message to user
-4. List the specific files that triggered the violation
-5. Wait for user to resolve the issue before proceeding
-
-## Exceptions
-
-No exceptions. Protected files and credentials must never be committed to repositories.
-
-## Configuration
-
-Configure protected paths and patterns in `foundation-config.yaml`:
-
-```yaml
-security:
-  enabled: true
-  pre_commit_audit:
-    enabled: true
-    protected_paths:
-      - "docs/private/"  # Repo-specific
-      - "data/"         # Repo-specific
-      - ".env*"
-    protected_patterns:
-      - "\.env"
-      - "secrets"
-      - "credentials"
-      - "password"
-  credential_management:
-    enabled: true
-    require_env_separation: false  # whether to require DEV_*/PROD_* prefixes
-```
-
-## Best Practices
-
-1. **Use `.gitignore`** to prevent protected files from being tracked
-2. **Store secrets securely** using secrets management tools
-3. **Use environment variables** for credentials (never hard-code)
-4. **Rotate credentials regularly** if accidentally committed
-5. **Use git hooks** to automate security checks
-6. **Review changes** before staging to catch issues early
-
-
-
-
-
-
-
-
-
-

package/foundation/strategy/README.md

@@ -1,279 +0,0 @@
-# Strategy Evaluation Framework
-
-Optional framework for product discovery and strategy validation.
-
-## Overview
-
-Foundation provides configuration and templates for strategy evaluation based on product discovery best practices, including:
-
-- **Discovery Process Framework** - Cagan's four risks (Value, Usability, Feasibility, Business Viability)
-- **Mom Test Methodology** - Unbiased user interview techniques
-- **Hypothesis Validation** - Structured testing of assumptions
-- **Go/No-Go Decision Framework** - Evidence-based decision making
-
-All strategy tools are optional and configurable via `foundation-config.yaml`.
-
-## Configuration
-
-```yaml
-strategy:
-  discovery:
-    enabled: true
-    framework: "cagan"  # or "lean", "jobs-to-be-done"
-    risks:
-      value:
-        enabled: true
-        method: "interviews"
-        success_threshold: 70  # % validating problem
-        min_participants: 5
-      usability:
-        enabled: true
-        method: "prototype_testing"
-        success_threshold: 80
-        min_participants: 5
-      feasibility:
-        enabled: true
-        method: "poc"
-      business_viability:
-        enabled: true
-        method: "pricing_interviews"
-        success_threshold: 50
-        min_participants: 5
-    mom_test:
-      enabled: true
-      require_live_interviews: true
-      commitment_signals:
-        - "time_spent"
-        - "money_spent"
-        - "reputation_risk"
-    continuous_discovery:
-      enabled: true
-      frequency: "weekly"
-      min_participants_per_cycle: 2
-```
-
-## Cagan's Four Risks
-
-### 1. Value Risk
-"Will users buy/use this?"
-
-**Methods:**
-- User interviews (Mom Test methodology)
-- Surveys
-- Prototype testing
-- Pre-orders/letters of intent
-
-### 2. Usability Risk
-"Can users figure out how to use this?"
-
-**Methods:**
-- Prototype testing
-- Usability studies
-- Think-aloud sessions
-- Wizard of Oz testing
-
-### 3. Feasibility Risk
-"Can we build this?"
-
-**Methods:**
-- Proof of concept (POC)
-- Technical spike
-- Architectural review
-- Dependency analysis
-
-### 4. Business Viability Risk
-"Will this work for the business?"
-
-**Methods:**
-- Pricing interviews
-- Cost analysis
-- Market sizing
-- Competitive analysis
-
-## Mom Test Methodology
-
-Framework for conducting unbiased user interviews.
-
-**Key Principles:**
-
-1. **Talk about their life, not your idea**
-   - Bad: "Would you use a feature that does X?"
-   - Good: "How do you currently handle X?"
-
-2. **Ask about past behavior, not future intent**
-   - Bad: "Would you pay for this?"
-   - Good: "How much did you spend on Y last month?"
-
-3. **Listen for commitment signals**
-   - Time: Have they spent time on this problem?
-   - Money: Have they spent money trying to solve it?
-   - Reputation: Have they put their reputation on the line?
-
-**Example Questions:**
-
-- "Tell me about the last time you dealt with [problem]..."
-- "How are you currently solving this?"
-- "What have you tried in the past?"
-- "How much time/money does this cost you?"
-
-## Hypothesis Validation
-
-Structure assumptions as testable hypotheses.
-
-**Format:**
-
-```
-We believe that [target user]
-has a problem with [problem description]
-because [reason/evidence].
-
-We will know we're right when we see [success metric].
-```
-
-**Example:**
-
-```
-We believe that small business owners
-have a problem with tracking financial documents
-because they spend 5+ hours per week on manual data entry.
-
-We will know we're right when 70% of interviewed owners
-confirm this is a significant pain point
-and are currently using spreadsheets or paper.
-```
-
-## Go/No-Go Decision Framework
-
-Make evidence-based decisions after discovery.
-
-**Decision Criteria:**
-
-- **GO**: All four risks sufficiently de-risked
-- **PIVOT**: Some risks validated, others not - change approach
-- **NO-GO**: Critical risks not validated - stop or defer
-
-**Thresholds (configurable):**
-
-- Value: 70%+ validate problem
-- Usability: 80%+ complete workflows
-- Feasibility: POC demonstrates viability
-- Business Viability: 50%+ willing to pay
-
-## Templates
-
-Foundation provides templates for discovery and competitive analysis:
-
-**Product Discovery:**
-- `discovery-templates/value-discovery-template.md`
-- `discovery-templates/usability-discovery-template.md`
-- `discovery-templates/business-viability-template.md`
-- `discovery-templates/discovery-report-template.md`
-
-**Competitive and Partnership Analysis:**
-- `competitive_analysis_template.md` - Systematic competitive positioning assessment (for products/projects)
-- `partnership_analysis_template.md` - Partnership potential evaluation (for products/projects)
-- `relevance_analysis_template.md` - Holistic relevance analysis (for content/thought leadership)
-- `project_assessment_framework.md` - Combined assessment methodology
-
-## Usage
-
-1. **Before building a feature:**
-   - Identify risks
-   - Define hypotheses
-   - Plan discovery activities
-   - Set success criteria
-
-2. **During discovery:**
-   - Conduct interviews (Mom Test)
-   - Test prototypes
-   - Build POCs
-   - Validate pricing
-
-3. **After discovery:**
-   - Analyze results
-   - Make go/no-go decision
-   - Document findings
-   - Share with team
-
-## Continuous Discovery
-
-Ongoing user research throughout development.
-
-**Recommended cadence:**
-- Weekly interviews (2-3 users)
-- Bi-weekly synthesis
-- Monthly strategy review
-
-**Activities:**
-- User interviews
-- Prototype testing
-- Usage analytics review
-- Customer feedback analysis
-
-## References
-
-- "Inspired" by Marty Cagan
-- "The Mom Test" by Rob Fitzpatrick
-- "Continuous Discovery Habits" by Teresa Torres
-
-## Competitive and Partnership Analysis
-
-Foundation includes tools for analyzing projects from competitive and partnership perspectives.
-
-### Analyze Command
-
-**Command:** `analyze <url_or_term>`
-
-**Purpose:** Systematically analyze any project (URL or term) from both competitive and partnership perspectives relative to your current repository.
-
-**Examples:**
-- `analyze memorae.ai`
-- `analyze https://memorae.ai`
-- `analyze "memory layer productivity"`
-
-**Process:**
-
-1. Dynamically discovers your repo's identity from foundational documents
-2. Researches target project via browser tools
-3. Generates competitive analysis using standardized template
-4. Generates partnership analysis using standardized template
-5. Saves both to `docs/private/competitive/` and `docs/private/partnerships/`
-
-**Output:**
-- `docs/private/competitive/[target_name]_competitive_analysis.md`
-- `docs/private/partnerships/[target_name]_partnership_analysis.md`
-
-**See:** `foundation/agent_instructions/cursor_commands/analyze.md` for complete documentation.
-
-### Framework and Templates
-
-**Project Assessment Framework:**
-- `project_assessment_framework.md` - Complete methodology for analyzing projects
-
-**Templates:**
-- `competitive_analysis_template.md` - Competitive positioning assessment
-- `partnership_analysis_template.md` - Partnership potential evaluation
-
-**All analysis is:**
-- Relative to your current repository
-- Dynamically discovers repo context from foundational docs
-- Generic and works for any repo using foundation as submodule
-- Stored in private docs submodule for confidentiality
-
----
-
-## Implementation
-
-Strategy evaluation is optional. Enable in `foundation-config.yaml` for projects that need product discovery.
-
-See Neotoma's `docs/feature_units/standards/discovery_process.md` for detailed implementation example.
-
-
-
-
-
-
-
-
-
-

package/foundation/strategy/competitive_analysis_template.md

@@ -1,271 +0,0 @@
-# Competitive Analysis Template
-
-This template provides a systematic framework for analyzing competitive positioning relative to your current repository.
-
-## Instructions
-
-1. **Load current repo context first** - Read foundational documents (`docs/foundation/core_identity.md`, `product_positioning.md`, etc.)
-2. **Research target project** - Navigate to URL, capture features, positioning, architecture
-3. **Fill out each section below** - All comparisons are relative to your current repo
-4. **Generate output** - Save to `docs/private/competitive/[target_name]_analysis.md`
-
----
-
-## 1. Project Overview
-
-**Target Project Name:** [Name]
-
-**URL/Source:** [URL or search term]
-
-**Analysis Date:** [YYYY-MM-DD]
-
-**Brief Description:**
-
-[One-paragraph summary of what the target project is and does]
-
-**Key Information:**
-- **Category:** [e.g., Personal memory tool, Productivity app, Developer platform]
-- **Stage:** [e.g., MVP, Early stage, Established, Mature]
-- **Business Model:** [e.g., Freemium, Subscription, Open source, Enterprise]
-- **Target Users:** [Who the target serves]
-- **Technology Stack:** [Key technologies identified]
-
----
-
-## 2. Current Repo Context
-
-**Current Repository:** [Discovered repo name from foundational docs]
-
-**Brief Summary:**
-
-[One-paragraph summary of what your current repo is and does, extracted from `docs/foundation/core_identity.md` or similar]
-
-**Core Positioning:**
-- **Category:** [Your repo's category]
-- **Value Proposition:** [Your repo's core value]
-- **Target Users:** [Your repo's target users]
-- **Defensible Differentiators:** [Your repo's defensible differentiators, if documented]
-
----
-
-## 3. Competitive Dynamic Summary
-
-**Overall Assessment:** [Direct Competitor / Adjacent / Complementary / Not Competitive]
-
-**Competitive Risk Level:** [High / Medium / Low / None]
-
-**Key Insight:**
-
-[One-sentence summary of the competitive relationship]
-
-**Rationale:**
-
-[2-3 paragraphs explaining why you assessed this way]
-
----
-
-## 4. Executive Summary
-
-[One-paragraph comparison: "[Target] vs. [Current Repo]"]
-
----
-
-## 5. Core Value Propositions
-
-| Dimension | Target Project | Current Repo |
-|-----------|---------------|--------------|
-| **Primary Value** | [What target provides] | [What you provide] |
-| **Problem Solved** | [Problem target addresses] | [Problem you address] |
-| **Key Benefit** | [Main user benefit] | [Main user benefit] |
-| **Unique Angle** | [Target's unique approach] | [Your unique approach] |
-| **Messaging** | [How target positions itself] | [How you position yourself] |
-
----
-
-## 6. Feature Comparison
-
-| Feature | Target Project | Current Repo | Assessment |
-|---------|---------------|--------------|------------|
-| **[Feature Category 1]** | [Target's implementation] | [Your implementation] | [Overlap/Divergence] |
-| **[Feature Category 2]** | [Target's implementation] | [Your implementation] | [Overlap/Divergence] |
-| **[Feature Category 3]** | [Target's implementation] | [Your implementation] | [Overlap/Divergence] |
-| **[Feature Category 4]** | [Target's implementation] | [Your implementation] | [Overlap/Divergence] |
-| **[Feature Category 5]** | [Target's implementation] | [Your implementation] | [Overlap/Divergence] |
-
-**Feature Overlap:** [High / Medium / Low / None]
-
----
-
-## 7. Use Case Differentiation
-
-### Target Project Use Cases
-
-1. **[Use Case 1]:** [Description]
-2. **[Use Case 2]:** [Description]
-3. **[Use Case 3]:** [Description]
-
-### Current Repo Use Cases
-
-1. **[Use Case 1]:** [Description]
-2. **[Use Case 2]:** [Description]
-3. **[Use Case 3]:** [Description]
-
-### Overlap vs. Divergence
-
-**Where They Overlap:**
-- [Overlap point 1]
-- [Overlap point 2]
-
-**Where They Diverge:**
-- [Divergence point 1]
-- [Divergence point 2]
-
----
-
-## 8. Technical Architecture Comparison
-
-| Dimension | Target Project | Current Repo |
-|-----------|---------------|--------------|
-| **Architecture** | [e.g., Monolith, Microservices, Serverless] | [Your architecture] |
-| **Storage** | [e.g., PostgreSQL, MongoDB, Local-first] | [Your storage] |
-| **Processing** | [e.g., ML-based, Rule-based, Hybrid] | [Your processing] |
-| **Deployment** | [e.g., Cloud, On-premise, Hybrid] | [Your deployment] |
-| **Security** | [Security approach] | [Your security approach] |
-| **Extensibility** | [Extension model] | [Your extension model] |
-
----
-
-## 9. Market Positioning
-
-| Dimension | Target Project | Current Repo |
-|-----------|---------------|--------------|
-| **Category** | [Target's category] | [Your category] |
-| **Positioning** | [How target positions] | [How you position] |
-| **Target Users** | [Target's users] | [Your users] |
-| **Pricing** | [Target's pricing model] | [Your pricing model] |
-| **GTM Strategy** | [Target's go-to-market] | [Your go-to-market] |
-
-**Market Overlap:** [Same / Adjacent / Different]
-
-**User Overlap:** [Same / Adjacent / Different]
-
----
-
-## 10. Competitive Advantages
-
-### Target Project's Advantages
-
-1. **[Advantage 1]:** [Description]
-2. **[Advantage 2]:** [Description]
-3. **[Advantage 3]:** [Description]
-
-### Current Repo's Advantages
-
-1. **[Advantage 1]:** [Description]
-2. **[Advantage 2]:** [Description]
-3. **[Advantage 3]:** [Description]
-
----
-
-## 11. Overlap and Distinction
-
-### Where They Overlap
-
-**Shared Characteristics:**
-- [Overlap 1]
-- [Overlap 2]
-- [Overlap 3]
-
-### Where They Diverge
-
-| Dimension | Target Project | Current Repo |
-|-----------|---------------|--------------|
-| **[Dimension 1]** | [Target's approach] | [Your approach] |
-| **[Dimension 2]** | [Target's approach] | [Your approach] |
-| **[Dimension 3]** | [Target's approach] | [Your approach] |
-
----
-
-## 12. Defensible Differentiation Assessment
-
-**Current Repo's Defensible Differentiators:**
-
-[List your repo's defensible differentiators extracted from foundational docs, if available]
-
-1. **[Differentiator 1]:** [Description]
-2. **[Differentiator 2]:** [Description]
-3. **[Differentiator 3]:** [Description]
-
-**Target Project Evaluation:**
-
-| Differentiator | Can Target Pursue This? | Reason |
-|----------------|-------------------------|--------|
-| **[Differentiator 1]** | [Yes / No / Partially] | [Structural constraints or lack thereof] |
-| **[Differentiator 2]** | [Yes / No / Partially] | [Structural constraints or lack thereof] |
-| **[Differentiator 3]** | [Yes / No / Partially] | [Structural constraints or lack thereof] |
-
-**Assessment:**
-
-[2-3 paragraphs evaluating whether target can pursue your defensible differentiators and vice versa]
-
----
-
-## 13. Strategic Implications
-
-### Risk Level to Current Repo
-
-**Competitive Risk:** [Direct / Adjacent / Complementary / None]
-
-**Rationale:**
-
-[Explanation of risk assessment]
-
-### Response Strategy
-
-**Recommended Actions:**
-
-1. **[Action 1]:** [Description]
-2. **[Action 2]:** [Description]
-3. **[Action 3]:** [Description]
-
-**Positioning Recommendations:**
-
-- **Emphasize:** [What to emphasize in your positioning]
-- **De-emphasize:** [What to de-emphasize]
-- **Monitor:** [What to monitor over time]
-
----
-
-## 14. Conclusion
-
-**Summary:**
-
-[2-3 paragraphs summarizing the competitive analysis]
-
-**Key Takeaways:**
-
-1. **[Takeaway 1]**
-2. **[Takeaway 2]**
-3. **[Takeaway 3]**
-
-**Recommendations for Current Repo:**
-
-1. **[Recommendation 1]**
-2. **[Recommendation 2]**
-3. **[Recommendation 3]**
-
----
-
-## Related Documents
-
-- Current repo foundational docs (if available):
-  - `docs/foundation/core_identity.md`
-  - `docs/foundation/product_positioning.md`
-  - `docs/foundation/problem_statement.md`
-- Defensible differentiation framework (if available):
-  - `docs/private/competitive/defensible_differentiation_framework.md`
-
-
-
-
-