maref 0.37.0.dev0__tar.gz → 0.43.0__tar.gz

maref-0.43.0/.github/CODEOWNERS

@@ -0,0 +1,30 @@
+# CODEOWNERS
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+# NOTE: @maref-org/maintainers team must be created in GitHub organization settings
+
+# Default owners for everything in the repo
+* @maref-org @maref-org/maintainers
+
+# Python / backend
+*.py @maref-org @maref-org/maintainers
+src/ @maref-org @maref-org/maintainers
+
+# Frontend / GUI
+gui/ @maref-org @maref-org/maintainers
+gui/**/*.ts @maref-org @maref-org/maintainers
+gui/**/*.tsx @maref-org @maref-org/maintainers
+
+# Rust / Tauri
+gui/src-tauri/ @maref-org @maref-org/maintainers
+
+# CI/CD
+.github/workflows/ @maref-org @maref-org/maintainers
+.github/dependabot.yml @maref-org @maref-org/maintainers
+
+# Documentation
+docs/ @maref-org @maref-org/maintainers
+*.md @maref-org @maref-org/maintainers
+
+# Security
+security/ @maref-org @maref-org/maintainers
+DEPENDENCIES @maref-org @maref-org/maintainers

maref-0.43.0/.github/dependabot.yml

@@ -0,0 +1,57 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "python"
+    allow:
+      - dependency-type: "all"
+    # Auto-approve patch and minor updates
+    reviewers:
+      - "maref-org/maintainers"
+
+  - package-ecosystem: "npm"
+    directory: "/gui"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "frontend"
+    allow:
+      - dependency-type: "all"
+    reviewers:
+      - "maref-org/maintainers"
+
+  - package-ecosystem: "cargo"
+    directory: "/gui/src-tauri"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "rust"
+    allow:
+      - dependency-type: "all"
+    reviewers:
+      - "maref-org/maintainers"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "ci"
+    allow:
+      - dependency-type: "all"
+    reviewers:
+      - "maref-org/maintainers"

maref-0.43.0/.github/workflows/ci.yml

@@ -0,0 +1,127 @@
+name: MAREF CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install dependencies
+        run: pip install -e ".[dev,sidecar,otel,a2a,orchestration,identity]"
+      - name: Ruff lint
+        run: ruff check src/maref src/maref_lite
+      - name: Ruff format check
+        run: ruff format --check src/maref src/maref_lite
+      - name: Mypy type check
+        run: mypy src/maref src/maref_lite
+
+  test:
+    needs: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install dependencies
+        run: pip install -e ".[dev,sidecar,otel,a2a,orchestration,identity]"
+      - name: Run unit tests
+        run: |
+          coverage run -m pytest tests/ -x -q --timeout=120 -m "not integration and not chaos and not benchmark" --ignore=tests/maref/compliance
+      - name: Validate mock consistency
+        if: github.event_name != 'pull_request'
+        run: python -c "from maref.testing.mock_validator import MockValidator; v=MockValidator(schema_dir=Path('vault/schemas'), mock_dir=Path('vault/mocks')); errors=v.validate_all(); assert not errors, f'Mock mismatch: {errors}'"
+        continue-on-error: true
+      - name: Coverage report
+        run: coverage report --fail-under=40
+
+  security:
+    needs: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install dependencies
+        run: pip install -e ".[dev,sidecar,otel,a2a]"
+      - name: Bandit SAST
+        run: bandit -r src/ -c pyproject.toml || true
+      - name: pip-audit
+        run: pip-audit
+      - name: TruffleHog Secret Scan
+        run: |
+          pip install trufflehog
+          trufflehog filesystem . --config .trufflehog.yaml --since 2026-01-01
+
+  integrity:
+    needs: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check for hardcoded passed=True in validation code
+        run: |
+          # 禁止验证代码中硬编码 passed=True（T0-1 诚信修复项）
+          if grep -rn "passed=True" src/maref/recursive/tla_replay.py 2>/dev/null; then
+            echo "ERROR: tla_replay.py still contains hardcoded passed=True"
+            exit 1
+          fi
+          echo "✅ No hardcoded passed=True in validation code"
+      - name: Check for remaining 64-state claims
+        run: |
+          # 禁止"64-state"夸大声明
+          FILES=$(grep -rl "64.state" --include="*.md" .github/ .wiki/ docs/ website/ 2>/dev/null || true)
+          if [ -n "$FILES" ]; then
+            echo "ERROR: Found remaining '64-state' claims in:"
+            echo "$FILES"
+            exit 1
+          fi
+          echo "✅ No 64-state claims remain"
+      - name: Check for Sperner claims
+        run: |
+          if grep -rl "Sperner" --include="*.md" .github/ .wiki/ docs/ website/ README* 2>/dev/null; then
+            echo "ERROR: Found remaining Sperner claims"
+            exit 1
+          fi
+          echo "✅ No Sperner claims remain"
+      - name: Check for 82% coverage claims in product-facing docs
+        run: |
+          # Check product-facing docs only (README, wiki, website product pages)
+          # Skip plans/, research/, changelog (internal/historical records)
+          for f in README.md README.zh-CN.md .wiki/Home.md website/src/content/pages/product-overview.md docs/MAREF-Technical-Whitepaper-arXiv.md; do
+            if [ -f "$f" ] && grep -q "82%" "$f" 2>/dev/null; then
+              if grep -qi "cover" "$f" 2>/dev/null; then
+                echo "ERROR: $f still has 82% coverage claim"
+                exit 1
+              fi
+            fi
+          done
+          echo "✅ No 82% coverage claims in product-facing docs"
+
+  crypto-test:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install dependencies
+        run: pip install -e ".[dev,sidecar,otel,a2a,orchestration,identity]"
+      - name: Run cryptography tests
+        run: |
+          pytest tests/test_crypto.py -v

maref-0.43.0/.github/workflows/docker.yml

@@ -0,0 +1,247 @@
+name: Docker CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/maref
+  DOCKERHUB_IMAGE: maref/maref
+
+jobs:
+  build:
+    name: Build & Validate Docker Image
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.GHCR_IMAGE }}
+            ${{ env.DOCKERHUB_IMAGE }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=sha,format=short,prefix=sha-
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          load: true
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Verify image metadata
+        run: |
+          TAGS="${{ steps.meta.outputs.tags }}"
+          FIRST_TAG=$(echo "$TAGS" | head -1)
+          docker inspect "$FIRST_TAG" | python3 -c "
+          import json, sys
+          data = json.load(sys.stdin)[0]
+          labels = data['Config']['Labels']
+          print(f\"Image: {labels.get('org.opencontainers.image.title', 'N/A')}\")
+          print(f\"Version: {labels.get('org.opencontainers.image.version', 'N/A')}\")
+          print(f\"Size: {data['Size'] / 1024 / 1024:.1f} MB\")
+          assert 'MAREF' in labels.get('org.opencontainers.image.title', '')
+          " || true
+
+      - name: Start container with Xvfb
+        run: |
+          TAGS="${{ steps.meta.outputs.tags }}"
+          FIRST_TAG=$(echo "$TAGS" | head -1)
+          docker run -d --name maref-test \
+            -p 8080:8080 \
+            -e MAREF_DRY_RUN=true \
+            -e DISPLAY=:99 \
+            --entrypoint /bin/bash \
+            "$FIRST_TAG" \
+            -c "Xvfb :99 -screen 0 1280x720x24 & sleep 1 && maref serve --host 0.0.0.0 --port 8080"
+
+      - name: Wait for health endpoint
+        run: |
+          for i in $(seq 1 30); do
+            if curl -sf http://localhost:8080/api/health > /dev/null 2>&1; then
+              echo "✓ Container is healthy (attempt $i)!"
+              curl -s http://localhost:8080/api/health | python3 -m json.tool
+              exit 0
+            fi
+            echo "Attempt $i: Health endpoint not yet available"
+            sleep 2
+          done
+          echo "✗ Container failed to become healthy within 60s"
+          docker logs maref-test --tail 100
+          exit 1
+
+      - name: Container logs (on failure)
+        if: failure()
+        run: docker logs maref-test --tail 100
+
+      - name: Cleanup
+        if: always()
+        run: docker rm -f maref-test || true
+
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          image: ${{ steps.meta.outputs.tags }}
+          format: cyclonedx
+          output-file: sbom.cdx.json
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: sbom.cdx.json
+
+      - name: Image size report
+        run: |
+          TAGS="${{ steps.meta.outputs.tags }}"
+          FIRST_TAG=$(echo "$TAGS" | head -1)
+          echo "### Docker Image Size Report" >> $GITHUB_STEP_SUMMARY
+          docker images --format "| {{.Repository}}:{{.Tag}} | {{.Size}} |" "$FIRST_TAG" >> $GITHUB_STEP_SUMMARY
+
+  scan:
+    name: Docker Vulnerability Scan
+    runs-on: ubuntu-latest
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build image for scan
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          load: true
+          tags: maref/maref:scan
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@v0.20.0
+        with:
+          scan-type: image
+          scan-ref: maref/maref:scan
+          format: table
+          exit-code: 1
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+
+      - name: Run Trivy with SARIF output
+        uses: aquasecurity/trivy-action@v0.20.0
+        if: always()
+        with:
+          scan-type: image
+          scan-ref: maref/maref:scan
+          format: sarif
+          output: trivy-results.sarif
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+
+      - name: Upload Trivy results
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy-results.sarif
+          category: docker-vulnerability
+
+      - name: Scan summary
+        if: always()
+        run: |
+          echo "### Docker Vulnerability Scan Results" >> $GITHUB_STEP_SUMMARY
+          echo "Image: \`maref/maref:scan\`" >> $GITHUB_STEP_SUMMARY
+          echo "Severity: HIGH, CRITICAL" >> $GITHUB_STEP_SUMMARY
+          echo "Unfixed: ignored" >> $GITHUB_STEP_SUMMARY
+
+  push:
+    name: Push Docker Images to Registries
+    runs-on: ubuntu-latest
+    needs: [build, scan]
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.GHCR_IMAGE }}
+            ${{ env.DOCKERHUB_IMAGE }}
+          tags: |
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,format=short,prefix=sha-
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push Docker images
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/main'
+        uses: sigstore/cosign-installer@v3.7.0
+
+      - name: Sign container images (keyless)
+        if: github.ref == 'refs/heads/main'
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          cosign sign --yes \
+            -a "repo=${{ github.repository }}" \
+            -a "workflow=${{ github.workflow }}" \
+            -a "ref=${{ github.ref }}" \
+            -a "commit=${{ github.sha }}" \
+            "${{ env.GHCR_IMAGE }}@${{ steps.push.outputs.digest }}"
+
+      - name: Verify signature
+        if: github.ref == 'refs/heads/main'
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          cosign verify \
+            --certificate-identity-regexp "https://github.com/${{ github.repository }}/.github/workflows/" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            "${{ env.GHCR_IMAGE }}@${{ steps.push.outputs.digest }}"
+
+      - name: Push summary
+        run: |
+          echo "### Docker Image Push Summary" >> $GITHUB_STEP_SUMMARY
+          echo "| Registry | Image | Tags |" >> $GITHUB_STEP_SUMMARY
+          echo "|----------|-------|------|" >> $GITHUB_STEP_SUMMARY
+          echo "| GHCR | ${{ env.GHCR_IMAGE }} | ${{ steps.meta.outputs.tags }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Docker Hub | ${{ env.DOCKERHUB_IMAGE }} | ${{ steps.meta.outputs.tags }} |" >> $GITHUB_STEP_SUMMARY

maref-0.43.0/.github/workflows/leak-detection.yml

@@ -0,0 +1,48 @@
+name: Leak Detection
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Scan for internal paths
+        run: |
+          echo "=== 检查内部卷路径 ==="
+          ! grep -r "/Volumes/1TB-M2" --include="*.py" --include="*.sh" \
+            --include="*.md" --include="*.yaml" --include="*.yml" \
+            --include="*.json" --include="*.toml" . 2>/dev/null || \
+            (echo "❌ 发现内部路径泄露" && exit 1)
+          echo "✅ 通过"
+
+      - name: Scan for API keys
+        run: |
+          echo "=== 检查 API 密钥 ==="
+          ! grep -rE "(sk-[a-zA-Z0-9]{32,}|nvapi-[a-zA-Z0-9_-]+|ark-[a-zA-Z0-9-]{20,})" \
+            --include="*.py" --include="*.sh" --include="*.env" --include="*.json" \
+            --include="*.yaml" . 2>/dev/null || \
+            (echo "❌ 发现 API 密钥泄露" && exit 1)
+          echo "✅ 通过"
+
+      - name: Scan for proprietary filenames
+        run: |
+          echo "=== 检查专有文件名 ==="
+          ! git ls-files | grep -E "(SOUL\.md|IDENTITY\.md|HEARTBEAT\.md|TOOLS\.md|USER\.md)$" || \
+            (echo "❌ 发现专有文件被追踪" && exit 1)
+          echo "✅ 通过"
+
+      - name: Scan for private org references
+        run: |
+          echo "=== 检查私有组织引用 ==="
+          ! grep -r "frankiehot-tech" --include="*.py" --include="*.sh" \
+            --include="*.md" --include="*.yaml" --include="*.yml" \
+            --include="*.json" . 2>/dev/null || \
+            (echo "❌ 发现私有组织名引用" && exit 1)
+          echo "✅ 通过"

maref-0.43.0/.github/workflows/meta-audit-gate.yml

@@ -0,0 +1,64 @@
+name: Meta-Audit Gate
+
+on:
+  schedule:
+    - cron: '*/5 * * * *'  # Every 5 minutes
+  workflow_dispatch:
+    inputs:
+      single_run:
+        description: 'Run once and report'
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  meta-audit-m0-m3:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+          
+      - name: Install dependencies
+        run: |
+          pip install -e ".[dev]"
+          
+      - name: Run meta-monitor — M0 Survivability
+        env:
+          MAREF_HMAC_SECRET_KEY: ${{ secrets.MAREF_HMAC_SECRET_KEY || '' }}
+          MAREF_ED25519_PRIVATE_KEY: ${{ secrets.MAREF_ED25519_PRIVATE_KEY || '' }}
+          MAREF_GAAS_ENABLED: 'false'
+          MAREF_META_PATH: '.openclaw'
+        run: |
+          python -m maref.observability.meta_monitor --single-run
+          
+      - name: Upload meta-audit report
+        uses: actions/upload-artifact@v4
+        with:
+          name: meta-audit-report
+          path: .openclaw/meta-monitor-report.json
+          retention-days: 7
+          
+      - name: Check meta-audit result
+        run: |
+          python3 -c "
+          import json
+          path = '.openclaw/meta-monitor-report.json'
+          with open(path) as f:
+              report = json.load(f)
+          summary = report.get('summary', {})
+          print(f'M0: {\"PASS\" if summary.get(\"m0_passed\") else \"FAIL\"}')
+          print(f'M1: {\"PASS\" if summary.get(\"m1_passed\") else \"FAIL\"}')
+          print(f'M2: {\"PASS\" if summary.get(\"m2_passed\") else \"FAIL\"}')
+          print(f'M3: {\"PASS\" if summary.get(\"m3_passed\") else \"FAIL\"}')
+          print(f'ALL: {\"PASS\" if summary.get(\"all_passed\") else \"FAIL\"}')
+          if not summary.get('all_passed'):
+              print('::warning::Meta-audit gate failure detected')
+              exit(1)
+          "

maref-0.43.0/.github/workflows/report-deploy.yml

@@ -0,0 +1,92 @@
+name: Report Deploy — maref.cc/verify
+
+on:
+  schedule:
+    # Daily at 06:00 UTC
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+    inputs:
+      signing_key:
+        description: 'Path to signing key PEM'
+        required: false
+        default: ''
+
+jobs:
+  generate-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Generate audit log
+        run: |
+          python -c "
+          from maref.governance.audit import AuditLogger
+          from pathlib import Path
+          log = AuditLogger(log_path=Path('audit.jsonl'), hmac_key='ci-key')
+          import uuid
+          log.log('governance_decision', 'ci-runner', 'auto_report', f'Scheduled report generation {uuid.uuid4().hex[:8]}')
+          log.log('verify', 'ci-runner', 'integrity_check', 'All systems nominal')
+          "
+
+      - name: Generate GovernanceReport
+        env:
+          SIGNING_KEY: ${{ secrets.MAREF_REPORT_SIGNING_KEY || '' }}
+        run: |
+          KEY_ARGS=""
+          if [ -n "$SIGNING_KEY" ]; then
+            echo "$SIGNING_KEY" > maref-report-signing.pem
+            chmod 600 maref-report-signing.pem
+            KEY_ARGS="--signing-key maref-report-signing.pem"
+          fi
+          python -m maref_lite.cli report generate \
+            --audit-log audit.jsonl \
+            $KEY_ARGS \
+            --output docs/verify/latest.json
+
+      - name: Verify report
+        run: |
+          if [ -f "maref-report-signing.pub" ]; then
+            python -m maref_lite.cli report verify \
+              --file docs/verify/latest.json \
+              --pubkey maref-report-signing.pub
+          else
+            echo "No public key — basic verification only"
+            python -m maref_lite.cli report verify --file docs/verify/latest.json
+          fi
+
+      - name: Export HTML + index
+        run: |
+          python -m maref_lite.cli report export \
+            --file docs/verify/latest.json \
+            --format html \
+            --output docs/verify/latest.html
+
+          TIMESTAMP=$(date -u +"%Y%m%dT%H%M%SZ")
+          cp docs/verify/latest.json "docs/verify/report-${TIMESTAMP}.json"
+
+          python -c "
+          from maref.reporting.exporter import ReportExporter
+          from pathlib import Path
+          fp_path = Path('docs/verify/fingerprint.txt')
+          fp = fp_path.read_text().strip() if fp_path.exists() else ''
+          ReportExporter().export_index(Path('docs/verify'), Path('docs/verify/index.html'), signer_fingerprint=fp)
+          "
+
+      - name: Publish to GitHub Pages
+        uses: peaceiris/actions-gh-pages@v3
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: docs/verify
+          publish_branch: gh-pages
+          destination_dir: verify
+          keep_files: true