diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml index c75ee7e..c2d8076 100644 --- a/.gds/bundle.lock.yaml +++ b/.gds/bundle.lock.yaml @@ -4,12 +4,12 @@ schema_version: 1 bundle: version: "0.9.7-dev" release_sequence: 0 - source_tree_digest: "sha256:ded7c4bf86c660a0c0a3836a58894b9c89499f56b04df854dfae7b45a1953b2d" - digest: "sha256:64bad36f22023c1fbb9cca7c53ec6280cb8d19da5866b038fd272d11fb1e17f7" + source_tree_digest: "sha256:55fd8cbc5bff26a6c719ed604c7e8124b88d5d584e73951ce0ad617eae831ead" + digest: "sha256:3d95d9514fbf5681ceadd059e8e0614b3a54c70f00801608e5fec7706efa1af7" projection: - input_digest: "sha256:cbb704aacb737d289beb059e60854fea90cbe93abac61a38c2cc872efe2fae73" - output_digest: "sha256:64176f613336b14946af312b0a02eb5ef35f713302e0088913c844c6dc8e19e4" + input_digest: "sha256:f27f694d156d4a166d3428152981b6928f21a100debf753764b2e85203a9d9a1" + output_digest: "sha256:f702b796c054c54bc8a0c47c14ce60c1d7257b10b777715a3872904facbe7b40" files: - path: ".gds/compiled-policy.json" - digest: "sha256:83aae3d9096c04f6a8eeb1b57dcea9a904a0ec125afa0a2cb551f8bf3bded3c3" + digest: "sha256:2a54bd5cc7d4dd38292e47e8d03ea2ca2b6d567f7182557d274f2d810e1b207c" diff --git a/.gds/compiled-policy.json b/.gds/compiled-policy.json index ccc0b28..8533f52 100644 --- a/.gds/compiled-policy.json +++ b/.gds/compiled-policy.json @@ -3,7 +3,7 @@ "compiled_policy": { "repository_id": "repo_01M31VT30CX00DFPH82QNQ0ZDH", "bundle_version": "0.9.7-dev", - "digest": "sha256:38b969c5141a57461038070a95372a849880e94b289292515605c6fa368b2810" + "digest": "sha256:5536ecfb4dcc2e890dc81b1eeb4c6a82bc69d43e7f38dda435a0644060b54ff7" }, "sources": [ { @@ -15,12 +15,12 @@ "digest": "sha256:0ea560cc2653184e07c6f744455f745a34f764a5c0dcda55f2dc76fa5296f2f0" }, { - "id": "opennetwork-default", + "id": "organization-default", "tier": "owner", - "priority": 110, + "priority": 100, "distribution": "public", - "path": "policies/owners/opennetwork-default.yaml", - "digest": "sha256:096b9781b05c37fd5b440a171a6e5599cda3ef77983db72bf9c68d3d40b34ab4" + "path": "policies/owners/organization-default.yaml", + "digest": "sha256:fe271769a3e50404a5073ca6d045ad19f784069e7d6fdceab80254c06781ed55" } ], "effective": { @@ -381,10 +381,10 @@ "operation": "set" }, "/effective/rollout/mode": { - "source": "opennetwork-default", + "source": "organization-default", "tier": "owner", - "priority": 110, - "file": "policies/owners/opennetwork-default.yaml", + "priority": 100, + "file": "policies/owners/organization-default.yaml", "operation": "set" }, "/effective/security/external_write_requires_approval": { diff --git a/.gds/repository.yaml b/.gds/repository.yaml index 6753380..99484a8 100644 --- a/.gds/repository.yaml +++ b/.gds/repository.yaml @@ -1,78 +1,71 @@ schema_version: 1 - repository: - id: "repo_01M31VT30CX00DFPH82QNQ0ZDH" - display_name: "hack-setup" + id: repo_01M31VT30CX00DFPH82QNQ0ZDH + display_name: hack-setup roles: - - "project" - - "superproject" - lifecycle: "active" - + - project + - superproject + lifecycle: active provider: - type: "github" - installation: "installation:github-opennetwork" + type: github + installation: installation:github-nddev-technocracy-opennetwork repository_id: 1377434323 - owner: "NDDev-OpenNetwork" - name: "hack-setup" - + owner: NDDev-Technocracy-OpenNetwork + name: hack-setup + aliases: + - owner: NDDev-OpenNetwork + name: hack-setup + - owner: NDDev-Technocracy-Archive + name: hack-setup classification: portfolios: - - "portfolio:opennetwork-projects" - visibility_contract: "public" - data_classification: "public" - + - portfolio:nddev-technocracy-opennetwork + visibility_contract: public + data_classification: public product: - purpose: >- - The Saint Tibo hackathon operating setup: the pinned Codex toolchain, - plugins, standards, lane enforcement and server deploy watchers for the - three-person team. It carries toolchain and instructions, not product - code; the product skeleton is consumed as the `product/vibestrap` - submodule. + purpose: Shared agent setup and reproducible development tooling for hackathon teams. + Codex project surfaces and pinned toolchain. capabilities: - - "pinned Codex CLI, models, MCP servers, hooks and plugin marketplace" - - "lane enforcement, merge gate and hack-mode hooks for worker threads" - - "server-side pull deploy watchers for dev and prod" + - pinned Codex CLI, models, MCP servers, hooks and plugin marketplace + - lane enforcement, merge gate and hack-mode hooks for worker threads + - server-side pull deploy watchers for dev and prod entrypoints: - - change: "what this repository is and what it may do" - path: ".gds/repository.yaml" - - change: "the operating contract every session loads" - path: "AGENTS.md" - - change: "toolchain and product stack pins" - path: "build" - - change: "deploy watcher kit for the product repository" - path: "install/deploy" - + - change: what this repository is and what it may do + path: .gds/repository.yaml + - change: the operating contract every session loads + path: AGENTS.md + - change: toolchain and product stack pins + path: build + - change: deploy watcher kit for the product repository + path: install/deploy policy: profiles: - - "repository-default" - - "opennetwork-default" - rollout_ring: "standard" - + - repository-default + - organization-default + rollout_ring: standard git: - default_branch: "main" - integration: "pull-request" - branch_model: "task-branches" - handoff_pr: "preferred" - cleanup: "merged-only" - + default_branch: main + integration: pull-request + branch_model: task-branches + handoff_pr: preferred + cleanup: merged-only agent: - context_profile: "project-default" + context_profile: project-default generated_agents: false serena: enabled: false provenance_required: false - verification: commands: - test: ["just check"] - full: ["just gate"] + test: + - just check + full: + - just gate required: - - "test" - + - test release: - mode: "none" - + mode: none relationships: - - type: "git-submodule-consumer" - target: "repo_01M31VT2VXJ1V8S1SMKVZKHD2W" - gitmodules_name: "product/vibestrap" \ No newline at end of file +- type: git-submodule-consumer + target: repo_01M31VT2VXJ1V8S1SMKVZKHD2W + gitmodules_name: product/vibestrap diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index c8ba773..3083ca7 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -212,7 +212,7 @@ jobs: git -C "$work" push -q /tmp/upstream.git HEAD:dev sudo touch /opt/hack-app/.env want=$(git -C "$work" rev-parse HEAD) - for i in $(seq 1 24); do + for _ in $(seq 1 24); do sudo test -f /opt/hack-app/.deployed-sha && break sleep 5 done diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 0000000..d9ccbef --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,6 @@ +# Official Telegram Ed25519 verification PUBLIC keys, not credentials. See https://core.telegram.org/bots/webapps#validating-data-for-third-party-use. +# Fingerprints suppress only these reviewed historical findings; future findings remain enabled. +7474f8e1c1f61b3bb910c1dc6a63a7517b86514a:build/stack-pin.json:generic-api-key:430 +7474f8e1c1f61b3bb910c1dc6a63a7517b86514a:build/stack-pin.json:generic-api-key:431 +fff17cd387b668042ee1e4a54aa741ed5a44a4af:devin-setup/build/stack-pin.json:generic-api-key:782 +fff17cd387b668042ee1e4a54aa741ed5a44a4af:devin-setup/build/stack-pin.json:generic-api-key:783 diff --git a/.serena/memories/CORE-01-INDEX.md b/.serena/memories/CORE-01-INDEX.md index 5f17986..a2ce9c5 100644 --- a/.serena/memories/CORE-01-INDEX.md +++ b/.serena/memories/CORE-01-INDEX.md @@ -42,7 +42,7 @@ Index durable knowledge for the Codex 0.157.1 team setup repository. No applicat ## Current Behavior -Author remote is `NDDev-Archive/hack-setup`. Later working remote is `BAITC-Hacks/hack-a58598e0-saint-tibo` and is not pushed unless the owner asks. `./setup --member ` installs member identity + Codex + Node/bun/uv/Python/`just` + all five plugins (module 15 derives git identity from the authenticated `gh` login — wrong login fails the install). `devin-setup/` is the self-contained Devin CLI twin (own entries, checker, CI jobs). Web typescript is only `7.0.2`. Codex session models are `gpt-6-astra` / `gpt-6-sol` at `xhigh`, window `872000` / compact `700000`. Codex subagents are off. Setup owner stream is Danil. This public repo may land setup commits on `main` when Danil asked. The catalogue and layer skills exist. Product trees do not. All GitHub issues are closed as of 2026-09-21. +Author remote is `NDDev-Technocracy-OpenNetwork/hack-setup`. Later working remote is `BAITC-Hacks/hack-a58598e0-saint-tibo` and is not pushed unless the owner asks. `./setup --member ` installs member identity + Codex + Node/bun/uv/Python/`just` + all five plugins (module 15 derives git identity from the authenticated `gh` login — wrong login fails the install). `devin-setup/` is the self-contained Devin CLI twin (own entries, checker, CI jobs). Web typescript is only `7.0.2`. Codex session models are `gpt-6-astra` / `gpt-6-sol` at `xhigh`, window `872000` / compact `700000`. Codex subagents are off. Setup owner stream is Danil. This public repo may land setup commits on `main` when Danil asked. The catalogue and layer skills exist. Product trees do not. All GitHub issues are closed as of 2026-09-21. ## Open Items (durable) diff --git a/README.md b/README.md index 5117024..ec62ce4 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,16 @@ + # hack-setup +Shared agent setup and reproducible development tooling for hackathon teams. Codex project surfaces and pinned toolchain. + +[NDDev OpenNetwork](https://github.com/NDDev-Technocracy-OpenNetwork) · [Repository](https://github.com/NDDev-Technocracy-OpenNetwork/hack-setup) + +This repository is a hackathon prototype or supporting tool. Follow the project-specific setup below; cloud integrations require your own configuration and credentials. + +--- + +## hack-setup + Shared Codex `0.157.1` setup for a three-person team that will later work in one private repo: `BAITC-Hacks/hack-a58598e0-saint-tibo`. @@ -24,7 +35,7 @@ cd hack-setup Windows (PowerShell): ```powershell -git clone https://github.com/NDDev-Archive/hack-setup.git +git clone https://github.com/NDDev-Technocracy-OpenNetwork/hack-setup.git cd hack-setup powershell -NoProfile -ExecutionPolicy Bypass -File .\setup.ps1 --member . .\install\env.ps1 diff --git a/devin-setup/build/stack-pin.json b/devin-setup/build/stack-pin.json index 457ec86..009e7a7 100644 --- a/devin-setup/build/stack-pin.json +++ b/devin-setup/build/stack-pin.json @@ -195,7 +195,7 @@ "SessionEnd", "Interrupt" ], - "note": "project-layer hooks; plugin manifests cannot carry hooks in 0.155.1 (plugin_hooks feature removed, openai/codex#39895). hack_mode.py: SessionStart (no matcher = every source: startup|resume|clear|compact) injects the ruleset \u2014 a forked/edited thread re-fires startup and DUPLICATES context (upstream #39951); compact sources queue until the next user turn (#28736); UserPromptSubmit emits reminder + git/issues STATUS; PreToolUse matcher 'Bash|exec_command|write_stdin|shell' (0.155.1 sends tool_name 'exec_command' with tool_input.cmd for exec, 'write_stdin' with .chars, 'Bash' is the PostToolUse normalized name) denies pushes whose tail names a protected branch, --all/--mirror, bare/HEAD pushes when HEAD is protected, gh pr merge, and gh api merge endpoints, unless the checkout carries .agent/orchestrator (lane law activates via tracked .codex/lanes.json); PostToolUse reminds ship-verify after git push; SessionEnd and Interrupt append .agent/session-log.ndjson (their timeout caps at 3s). commandWindows mirrors every command for hosts without python3. Non-managed hooks run only when a hooks.state trusted_hash in the USER config layer matches the definition hash \u2014 repair/module 20 write the managed block (ADR 0016). compact_prompt is ignored under remote compaction (openai/codex#34428) \u2014 SessionStart re-injection is the real channel; Codex App threads can shadow project developer_instructions (#33238). additionalContext only works on PreToolUse/PostToolUse/SessionStart/UserPromptSubmit/SubagentStart. Standalone 'normal mode'/'hack ultra'/'hack mode' toggles per-project state under ~/.codex/hack-mode-.json" + "note": "project-layer hooks; plugin manifests cannot carry hooks in 0.157.1 (plugin_hooks feature removed, openai/codex#39895). hack_mode.py: SessionStart (no matcher = every source: startup|resume|clear|compact) injects the ruleset \u2014 a forked/edited thread re-fires startup and DUPLICATES context (upstream #39951); compact sources queue until the next user turn (#28736); UserPromptSubmit emits reminder + git/issues STATUS; PreToolUse matcher 'Bash|exec_command|write_stdin|shell' (0.157.1 sends tool_name 'exec_command' with tool_input.cmd for exec, 'write_stdin' with .chars, 'Bash' is the PostToolUse normalized name) denies pushes whose tail names a protected branch, --all/--mirror, bare/HEAD pushes when HEAD is protected, gh pr merge, and gh api merge endpoints, unless the checkout carries .agent/orchestrator (lane law activates via tracked .codex/lanes.json); PostToolUse reminds ship-verify after git push; SessionEnd and Interrupt append .agent/session-log.ndjson (their timeout caps at 3s). commandWindows mirrors every command for hosts without python3. Non-managed hooks run only when a hooks.state trusted_hash in the USER config layer matches the definition hash \u2014 repair/module 20 write the managed block (ADR 0016). compact_prompt is ignored under remote compaction (openai/codex#34428) \u2014 SessionStart re-injection is the real channel; Codex App threads can shadow project developer_instructions (#33238). additionalContext only works on PreToolUse/PostToolUse/SessionStart/UserPromptSubmit/SubagentStart. Standalone 'normal mode'/'hack ultra'/'hack mode' toggles per-project state under ~/.codex/hack-mode-.json" }, "deploy": { "model": "server-side pull watcher, no GitHub admin rights needed", @@ -243,7 +243,7 @@ }, "context7": { "url": "https://mcp.context7.com/mcp", - "note": "keyless by default \u2014 Codex 0.155.1 hard-errors when a bearer_token_env_var is unset (rmcp_client.rs), so no env ref is declared; hosts wanting higher limits export CONTEXT7_API_KEY and add bearer_token_env_var in their USER config layer" + "note": "keyless by default \u2014 Codex 0.157.1 hard-errors when a bearer_token_env_var is unset (rmcp_client.rs), so no env ref is declared; hosts wanting higher limits export CONTEXT7_API_KEY and add bearer_token_env_var in their USER config layer" }, "grep": { "url": "https://mcp.grep.app",