Commit graph

24 commits

Author SHA1 Message Date
Parfii-bot
48b1a8cdcf Merge branch 'feat/v0.10-genesis-scan' — kei-memory + genesis-scan v0.10.0 reconciled 2026-04-22 01:04:32 +08:00
Parfii-bot
c436eb105d feat(integration): register genesis-scan in MANIFEST core+full + README + install.sh sizing 2026-04-22 01:01:56 +08:00
Parfii-bot
10bc799d26 feat(primitives): genesis-scan Rust — sensitive IP leak detector (CI/pre-commit)
26 forbidden patterns synced with ~/.claude/hooks/genesis-leak-guard.sh.
7 exempt scopes (KeiLab/theory/ml-keilab chatlogs/keinet-cfc-eigen/keinet-gpu-wgpu).
CLI: --path, --staged, --stdin, --format=human|json|github-actions, --exit-on-hit.
Self-reference resolved via EXEMPT_SUBSTRINGS + tempfile fixtures with runtime-assembled strings.
7/7 tests pass.
2026-04-22 01:01:56 +08:00
Parfii-bot
edeca916db feat(integration): wire kei-memory into MANIFEST + settings-snippet + README for v0.10 2026-04-22 00:50:04 +08:00
Parfii-bot
040e189b80 feat(primitives): kei-memory Rust crate — offline session analyzer (Genesis-clean) 2026-04-22 00:50:04 +08:00
Parfii-bot
d75d782902 feat(primitives): MANIFEST.toml — SSoT for 21 primitives + 6 profiles 2026-04-21 23:00:32 +08:00
Parfii-bot
c89352c87c Merge branch 'feat/frontend-v040' — 4 stacks + 3 Rust + 5 shell + 17 skills + /site-create (partial)
Cargo.lock regenerated after 8-crate workspace merge.
2026-04-21 21:17:19 +08:00
Parfii-bot
19850e1a45 Merge branch 'feat/v0.5-vm-security' — 7 blocks + 3 shell + 2 Rust + /vm-provision
Workspace Cargo.toml reconciled: all 8 crates (kei-ledger, kei-migrate, kei-changelog, ssh-check, firewall-diff, mock-render, visual-diff, tokens-sync) as members.
2026-04-21 21:15:49 +08:00
Parfii-bot
e5d565a11e Merge branch 'feat/v0.7-docs' — 5 blocks + kei-docs-scaffold + kei-changelog Rust + /docs-scaffold 2026-04-21 21:15:05 +08:00
Parfii-bot
f205a12348 Merge branch 'feat/v0.6-database' — 5 blocks + kei-migrate Rust + /schema-design 2026-04-21 21:14:50 +08:00
Parfii-bot
62e28450bc Merge branch 'feat/rule-0.12-agent-git-model' — kei-ledger Rust + hook + /new-project 2026-04-21 21:13:40 +08:00
Parfii-bot
5d61866618 Merge branch 'feat/v0.6-cicd' — 4 blocks + kei-ci-lint + /ci-scaffold 2026-04-21 21:11:17 +08:00
Parfii-bot
8c60085862 feat(primitives): 5 shell primitives — design-scrape, live-preview, figma-tokens, frontend-inspect, screenshot-decode 2026-04-21 21:07:45 +08:00
Parfii-bot
ebf841c7d9 feat(primitives): 3 Rust cubes — mock-render, visual-diff, tokens-sync 2026-04-21 21:07:45 +08:00
Parfii-bot
be20f5ba46 feat(primitives): kei-docs-scaffold shell + kei-changelog Rust 2026-04-21 21:01:28 +08:00
Parfii-bot
521659bbfb feat(primitives): 2 Rust verification cubes
- ssh-check — parse sshd_config + drop-ins, merge last-wins, lint against
  hardened baseline (pw-auth=no, root=prohibit-password, maxauthtries≤3,
  AllowUsers whitelist, no CBC ciphers, ETM MACs, no ssh-rsa host key).
  4 modules: main (clap CLI) + parse + rules + check. Tests: 9 pass
  (hardened baseline, password-auth-yes-fails, cbc-cipher-fails,
  allow-users-not-in-whitelist-fails, missing-required-fails, etc.).

- firewall-diff — diff intent YAML against `ufw status numbered` output.
  Defensive-only (never runs ufw). Stdin or --status-file input. Parses
  (v6) families, normalises "Anywhere"→"any". Exit 2 on any missing/
  extra rule. 4 modules: main + intent + ufw + diff. Tests: 8 pass
  (load-minimal-intent, exact-match-clean, missing-rule-surfaced,
  extra-live-rule-surfaced, inactive-ufw-fails, integration).

Workspace: clap 4 + serde + serde_yaml + serde_json. release opt-level=z,
LTO, strip. Constructor Pattern: largest file check.rs 213 LOC (93 non-
test); every function under 30 LOC.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-21 21:00:01 +08:00
Parfii-bot
969e24c6c4 feat(primitives): 3 shell provisioning + hardening
- provision-hetzner.sh — idempotent hcloud wrapper; create/destroy/status/list
  * HCLOUD_TOKEN from ~/.claude/secrets/.env (RULE 0.8)
- provision-vultr.sh — idempotent vultr-cli wrapper; Vultr resolves IP async
  * VULTR_API_KEY from ~/.claude/secrets/.env (RULE 0.8)
- harden-base.sh — Debian/Ubuntu baseline; apt → ssh → ufw → fail2ban →
  auditd → unattended-upgrades; idempotent; ports generic patterns from
  vortex/control/setup/setup.sh:13-53 (no Xray/sing-box/WG steps)

All three reject unsupported platforms early; harden-base.sh never
auto-reboots (surfaces needrestart hints only).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-21 20:59:38 +08:00
Parfii-bot
7e2afc366b feat(primitives): kei-ci-lint workflow YAML validator 2026-04-21 20:56:24 +08:00
Parfii-bot
c801715a49 feat(primitives): kei-ledger Rust SQLite agent ledger
SSoT for RULE 0.12 (agent git-model). Every non-trivial Agent invocation
logs a fork row; merge ceremony validates the 6-file artefact bundle.

CLI: init / fork / done / fail / merged / list / tree / validate.
Storage: ~/.claude/agents/ledger.sqlite (override via KEI_LEDGER_DB).
Schema versioned via PRAGMA user_version.

Tests: 9/9 passing (fork+done, fail flow, tree walk, list filter,
validate missing/complete, duplicate-id reject, done idempotency,
merged transition). cargo test --release 0.01s.

Constructor Pattern: schema.rs 50, ledger.rs 170, main.rs 177,
integration.rs 147 — all under 200 LOC.

Workspace update: adds kei-ledger to _primitives/_rust members list.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-21 20:52:20 +08:00
Parfii-bot
e49660cd69 feat(primitives): metrics-scrape + log-ship shell primitives 2026-04-21 20:41:17 +08:00
Parfii-bot
df857923d4 feat(primitives): kei-migrate Rust universal migration runner
Single binary, three backends (Postgres/SQLite/MySQL) autodetected
from DATABASE_URL scheme. Sequential .sql migrations tracked in
_kei_migrations with SHA-256 checksums.

Commands:
  kei-migrate up              — apply pending
  kei-migrate down [n]        — revert last N (requires .down.sql)
  kei-migrate status          — list applied vs pending
  kei-migrate create <name>   — scaffold up+down pair with UTC ts

Constructor Pattern: 10 source files, all <90 LOC, functions <30 LOC.
Deps: sqlx 0.8 (any+postgres+sqlite+mysql, rustls), clap 4, chrono,
sha2, anyhow, tokio.

Tests: 9/9 passing (cargo test, SQLite backend).
Clippy clean: cargo clippy --all-targets -- -D warnings.

Safety features:
- checksum drift detection on applied migrations
- IRREVERSIBLE marker blocks down-revert
- duplicate version detection at scan time
- each migration in its own transaction

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-21 20:35:29 +08:00
Parfii-bot
d155afc554 fix(audit-m): tomd cache path-salt; bridges respects rollback; rollback rm-rf guard; placeholder URLs; research skill role-tag note; stack frontend-gap doc
- M1 (RULE 0.4): replace fabricated URLs 'https://example.invalid/PROJECT-D'
  and 'https://…/PROJECT-D' with plain text ('user's personal CLI predecessor').
- M2: tomd-preread cache key = basename + mtime + 8-char shasum of full path,
  so two files with the same basename+mtime at different paths no longer
  collide. Portable shasum shim; falls back to 'nohash' if shasum absent.
- M3: install.sh --with-bridges gated on ROLLED_BACK=0 so bridges are NOT
  emitted into $PWD after an ERR-trap rollback.
- M4: rollback() guards rm -rf "$orig" behind an existence check.
- M5: skills/research/SKILL.md front-matter note — role tags like
  'web-researcher' / 'meta-critic' are ad-hoc prompt labels for the generic
  kei-researcher subagent, NOT separate manifests. Prevents fruitless
  grep in _manifests/.
- M6: README adds a 'Frontend-stack coverage gap' callout listing the
  planned-but-not-shipped frameworks (React-Vite, Vue-Nuxt, SvelteKit,
  Astro, Angular, plain-web).
- M7: no-hand-edit-agents.sh documents at case block that the GENERATED
  marker is the SOLE source of truth — legacy unmarked .md files pass
  silently by design; re-run the assembler to adopt them.
2026-04-21 20:09:24 +08:00
Parfii-bot
76420c47cb fix(primitives): make pandoc a per-format dep, not a core prereq
Smoke-test surfaced that check_deps hard-failed on missing pandoc even
for CSV / JSON / code-fence / image conversions that never call pandoc.
Pandoc is now checked lazily by need_pandoc(), invoked only from
convert_pandoc and convert_doc (the two paths that actually need it).
Matches install.sh soft-warn behavior: pandoc is opt-in for docx/pptx/
html, not a universal requirement.

Verified: tomd.sh /tmp/test.csv now returns markdown table with only
python3 + jq installed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-21 19:53:05 +08:00
Parfii-bot
75a7ae424b feat(primitives): port tomd markdown converter from PROJECT-D
- New _primitives/ directory, analogous to _blocks/_manifests/_bridges
- tomd.sh: standalone PDF/DOCX/XLSX/PPTX/CSV/code/image → markdown
  converter (180 LOC, ported from PROJECT-D bin/keiagent-tomd)
- [tomd] error tag for KeiSeiKit style, KEISEI_TOMD_CACHE env var
- README.md: purpose + invocation + compose-solution discovery

Primitives are first-class building blocks that agents and pipelines
depend on. Installed at $HOME/.claude/agents/_primitives/ by install.sh
in a follow-up commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-21 19:43:12 +08:00