maref 0.37.0.dev0__tar.gz → 0.39.0__tar.gz

maref-0.39.0/.github/CODEOWNERS

@@ -0,0 +1,30 @@
+# CODEOWNERS
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+# NOTE: @maref-org/maintainers team must be created in GitHub organization settings
+
+# Default owners for everything in the repo
+* @maref-org @maref-org/maintainers
+
+# Python / backend
+*.py @maref-org @maref-org/maintainers
+src/ @maref-org @maref-org/maintainers
+
+# Frontend / GUI
+gui/ @maref-org @maref-org/maintainers
+gui/**/*.ts @maref-org @maref-org/maintainers
+gui/**/*.tsx @maref-org @maref-org/maintainers
+
+# Rust / Tauri
+gui/src-tauri/ @maref-org @maref-org/maintainers
+
+# CI/CD
+.github/workflows/ @maref-org @maref-org/maintainers
+.github/dependabot.yml @maref-org @maref-org/maintainers
+
+# Documentation
+docs/ @maref-org @maref-org/maintainers
+*.md @maref-org @maref-org/maintainers
+
+# Security
+security/ @maref-org @maref-org/maintainers
+DEPENDENCIES @maref-org @maref-org/maintainers

maref-0.39.0/.github/dependabot.yml

@@ -0,0 +1,57 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "python"
+    allow:
+      - dependency-type: "all"
+    # Auto-approve patch and minor updates
+    reviewers:
+      - "maref-org/maintainers"
+
+  - package-ecosystem: "npm"
+    directory: "/gui"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "frontend"
+    allow:
+      - dependency-type: "all"
+    reviewers:
+      - "maref-org/maintainers"
+
+  - package-ecosystem: "cargo"
+    directory: "/gui/src-tauri"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "rust"
+    allow:
+      - dependency-type: "all"
+    reviewers:
+      - "maref-org/maintainers"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "ci"
+    allow:
+      - dependency-type: "all"
+    reviewers:
+      - "maref-org/maintainers"

maref-0.39.0/.github/workflows/leak-detection.yml

@@ -0,0 +1,48 @@
+name: Leak Detection
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Scan for internal paths
+        run: |
+          echo "=== 检查内部卷路径 ==="
+          ! grep -r "/Volumes/1TB-M2" --include="*.py" --include="*.sh" \
+            --include="*.md" --include="*.yaml" --include="*.yml" \
+            --include="*.json" --include="*.toml" . 2>/dev/null || \
+            (echo "❌ 发现内部路径泄露" && exit 1)
+          echo "✅ 通过"
+
+      - name: Scan for API keys
+        run: |
+          echo "=== 检查 API 密钥 ==="
+          ! grep -rE "(sk-[a-zA-Z0-9]{32,}|nvapi-[a-zA-Z0-9_-]+|ark-[a-zA-Z0-9-]{20,})" \
+            --include="*.py" --include="*.sh" --include="*.env" --include="*.json" \
+            --include="*.yaml" . 2>/dev/null || \
+            (echo "❌ 发现 API 密钥泄露" && exit 1)
+          echo "✅ 通过"
+
+      - name: Scan for proprietary filenames
+        run: |
+          echo "=== 检查专有文件名 ==="
+          ! git ls-files | grep -E "(SOUL\.md|IDENTITY\.md|HEARTBEAT\.md|TOOLS\.md|USER\.md)$" || \
+            (echo "❌ 发现专有文件被追踪" && exit 1)
+          echo "✅ 通过"
+
+      - name: Scan for private org references
+        run: |
+          echo "=== 检查私有组织引用 ==="
+          ! grep -r "frankiehot-tech" --include="*.py" --include="*.sh" \
+            --include="*.md" --include="*.yaml" --include="*.yml" \
+            --include="*.json" . 2>/dev/null || \
+            (echo "❌ 发现私有组织名引用" && exit 1)
+          echo "✅ 通过"

maref-0.39.0/.github/workflows/report-deploy.yml

@@ -0,0 +1,92 @@
+name: Report Deploy — maref.cc/verify
+
+on:
+  schedule:
+    # Daily at 06:00 UTC
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+    inputs:
+      signing_key:
+        description: 'Path to signing key PEM'
+        required: false
+        default: ''
+
+jobs:
+  generate-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Generate audit log
+        run: |
+          python -c "
+          from maref.governance.audit import AuditLogger
+          from pathlib import Path
+          log = AuditLogger(log_path=Path('audit.jsonl'), hmac_key='ci-key')
+          import uuid
+          log.log('governance_decision', 'ci-runner', 'auto_report', f'Scheduled report generation {uuid.uuid4().hex[:8]}')
+          log.log('verify', 'ci-runner', 'integrity_check', 'All systems nominal')
+          "
+
+      - name: Generate GovernanceReport
+        env:
+          SIGNING_KEY: ${{ secrets.MAREF_REPORT_SIGNING_KEY || '' }}
+        run: |
+          KEY_ARGS=""
+          if [ -n "$SIGNING_KEY" ]; then
+            echo "$SIGNING_KEY" > maref-report-signing.pem
+            chmod 600 maref-report-signing.pem
+            KEY_ARGS="--signing-key maref-report-signing.pem"
+          fi
+          python -m maref_lite.cli report generate \
+            --audit-log audit.jsonl \
+            $KEY_ARGS \
+            --output docs/verify/latest.json
+
+      - name: Verify report
+        run: |
+          if [ -f "maref-report-signing.pub" ]; then
+            python -m maref_lite.cli report verify \
+              --file docs/verify/latest.json \
+              --pubkey maref-report-signing.pub
+          else
+            echo "No public key — basic verification only"
+            python -m maref_lite.cli report verify --file docs/verify/latest.json
+          fi
+
+      - name: Export HTML + index
+        run: |
+          python -m maref_lite.cli report export \
+            --file docs/verify/latest.json \
+            --format html \
+            --output docs/verify/latest.html
+
+          TIMESTAMP=$(date -u +"%Y%m%dT%H%M%SZ")
+          cp docs/verify/latest.json "docs/verify/report-${TIMESTAMP}.json"
+
+          python -c "
+          from maref.reporting.exporter import ReportExporter
+          from pathlib import Path
+          fp_path = Path('docs/verify/fingerprint.txt')
+          fp = fp_path.read_text().strip() if fp_path.exists() else ''
+          ReportExporter().export_index(Path('docs/verify'), Path('docs/verify/index.html'), signer_fingerprint=fp)
+          "
+
+      - name: Publish to GitHub Pages
+        uses: peaceiris/actions-gh-pages@v3
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: docs/verify
+          publish_branch: gh-pages
+          destination_dir: verify
+          keep_files: true

maref-0.39.0/.gitignore

@@ -0,0 +1,209 @@
+# macOS
+.DS_Store
+.AppleDouble
+.LSOverride
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Virtual environments
+venv/
+ENV/
+env/
+.venv
+
+# IDEs
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+.tox/
+
+# MyPy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Data & logs
+data/cache/*
+!data/cache/.gitkeep
+data/logs/*
+!data/logs/.gitkeep
+data/raw/*
+!data/raw/.gitkeep
+results/experiments/*
+!results/experiments/.gitkeep
+
+# Environment variables
+.env
+.env.local
+*.env
+!*.example.env
+!*.example.*.env
+
+# Credentials and secrets
+*.key
+*.pem
+*.secret
+credentials/
+.gaas_api_key
+.maraf_hmac_key
+
+# Generated LaunchAgent plists (machine-specific)
+scripts/*.plist
+!scripts/*.template.plist
+!scripts/*.plist.template
+
+# TLA+
+*.tlc
+*.tla.out
+states/
+
+# Runtime generated files
+policy_versions/*.json
+research_output/*
+!research_output/.gitkeep
+output-test/
+
+# OS / accidental artifacts
+:m*:
+*.swp
+*.swo
+
+# Build artifacts / legacy packages
+/sidecar/
+
+# Runtime audit / data files
+*_audit.jsonl
+governance_audit.jsonl
+recursive_governance_audit.jsonl
+knowledge_graph.json
+
+# IDE workspace metadata
+.trae/
+node_modules
+*.tsbuildinfo
+.worktrees/
+
+# Runtime generated large files
+coverage.json
+htmlcov/
+coverage_html/
+bandit_report.json
+coverage_per_module_report.json
+governance_audit*.jsonl
+governance_observations.db
+*.db
+
+# CodeDepth index (regeneratable)
+.codedepth/
+
+# Debug / development utilities
+debug_bus.py
+debug_test.py
+_test_desktop_debug*.py
+
+# Telemetry server data
+telemetry-server/data/
+
+# OpenCode config
+.opencode/
+
+# Website (maref.cc) — track source, ignore build artifacts
+website/dist/
+website/node_modules/
+website/.astro/
+website/.wrangler/
+website/.DS_Store
+!docs/website/blog/
+!docs/website/blog/**
+
+# Policy versions (runtime generated)
+policy_versions/
+
+# Mission workspaces (internal)
+.missions/
+
+# Old virtual environments
+.venv2/
+.venv3/
+
+# External project directories
+agent-constitution-framework/
+maref-governance/
+
+# Cache
+cache/
+
+# Reports (Chinese-language internal)
+reports/
+
+# Raw research output
+research_output/
+
+# Rust/Tauri build artifacts (large binary files >50 MB)
+gui/src-tauri/target/
+
+# Audit logs (large JSONL files >100 MB)
+governance_audit_*.jsonl
+athena-governance.jsonc
+AUDIT_REPORT_*
+docs/.obsidian/
+docs/arxiv-endorsement-emails*
+data/convergence_history.jsonl
+docs/assets/
+docs/submission-pipeline/
+docs/github-auto-agent-audit-*
+docs/plans/
+docs/arxiv-endorsement-targets.csv
+findings.md
+progress.md
+task_plan.md
+opencode.jsonc.bak.*
+
+# Generated release files (auto-generated by evolution daemon)
+rel_gen_*.py
+
+# Evolution runtime artifacts (regenerated on each run)
+evolution_results/
+.evolution_vault/
+
+# Governance runtime data (sidecar state)
+.governance/
+
+# Internal backup workspaces
+.maref_backups/
+
+# Experiments (ad-hoc, not source code)
+experiments/
+
+# Auto-generated logs
+.self_healing_logs/
+
+# Coverage reports
+coverage.xml

maref-0.39.0/.pre-commit-config.yaml

@@ -0,0 +1,25 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.4.10
+    hooks:
+      - id: ruff
+        args: [--fix, --exit-non-zero-on-fix]
+      - id: ruff-format
+
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: v1.10.0
+    hooks:
+      - id: mypy
+        additional_dependencies: [types-PyYAML]
+        args: [--ignore-missing-imports]
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-toml
+      - id: check-added-large-files
+        args: [--maxkb=1000]
+      - id: detect-private-key