keisei/KeiSeiKit-1.0
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
108 commits 3 branches 11 tags 12 MiB
Commit graph

108 commits

This branch
This branch
All branches
Author SHA1 Message Date
Parfii-bot
c436eb105d feat(integration): register genesis-scan in MANIFEST core+full + README + install.sh sizing 2026-04-22 01:01:56 +08:00
Parfii-bot
b18727b257 feat(hooks): git-pre-commit-genesis — template for repo symlink into .git/hooks/pre-commit 2026-04-22 01:01:56 +08:00
Parfii-bot
10bc799d26 feat(primitives): genesis-scan Rust — sensitive IP leak detector (CI/pre-commit) 
26 forbidden patterns synced with ~/.claude/hooks/genesis-leak-guard.sh.
7 exempt scopes (KeiLab/theory/ml-keilab chatlogs/keinet-cfc-eigen/keinet-gpu-wgpu).
CLI: --path, --staged, --stdin, --format=human|json|github-actions, --exit-on-hit.
Self-reference resolved via EXEMPT_SUBSTRINGS + tempfile fixtures with runtime-assembled strings.
7/7 tests pass.
 2026-04-22 01:01:56 +08:00
Parfii-bot
75bceaf3a6 Merge branch 'feat/v0.9.1-interactive-menu' — interactive installer menu 2026-04-21 23:11:58 +08:00
Parfii-bot
b1ce0609ee feat(install): interactive menu (whiptail/dialog/plain) + confirm screen + --yes/--no-execute 
- TUI via whiptail (preferred) or dialog; plain-text fallback with zero deps
- Install Plan confirm screen: primitives, soft-deps status (✓/✗), estimates
- Skip menu on --profile/--add/--remove/--list or non-TTY (CI-safe)
- --yes skips confirm; --no-execute dry-run
- install.sh 844 → 1195 LOC, 10 new functions all <30 LOC
- README +8 LOC Interactive install section
 2026-04-21 23:11:58 +08:00
Parfii-bot
9bcbf069d5 Merge branch 'feat/v0.9-modular-install' — modular installer + MANIFEST.toml (BREAKING: default is minimal, was full) 2026-04-21 23:00:32 +08:00
Parfii-bot
c5078f8918 docs(readme): install profiles table + migration note for v0.9.0 2026-04-21 23:00:32 +08:00
Parfii-bot
67d6f5a15a feat(install): modular profiles + --add/--remove/--list incremental install 
Default changed: ./install.sh now installs minimal (no primitives) — ~5s,
~2 MB. Old full behavior available via --profile=full.

Profiles: minimal / core / frontend / ops / dev / full.
Incremental: --add=name[,name] / --remove=name / --list.
Rust workspace scoped per install — only selected crates built.
 2026-04-21 23:00:32 +08:00
Parfii-bot
d75d782902 feat(primitives): MANIFEST.toml — SSoT for 21 primitives + 6 profiles 2026-04-21 23:00:32 +08:00
Parfii-bot
2796df2bf3 Merge branch 'integration/v0.8.0-globals' — README/install/settings/compose-solution refresh for v0.8.0 surface 2026-04-21 21:33:33 +08:00
Parfii-bot
7bffcdf037 docs(compose-solution): prior-art grep paths + phase-5 cross-refs for 10 pipelines + 21 primitives 2026-04-21 21:33:11 +08:00
Parfii-bot
7acacc8fb7 feat(install): copy _primitives/ + build Rust workspace; register agent-fork-logger + site-wysiwyd hooks 2026-04-21 21:33:11 +08:00
Parfii-bot
1b382b7fca feat(hooks): site-wysiwyd-check PostToolUse(Edit|Write) drift advisory 2026-04-21 21:33:11 +08:00
Parfii-bot
7b89aba305 docs(readme): v0.8.0 — 73 blocks / 34 skills / 21 primitives / 6 hooks / 11 bridges + pipelines section 2026-04-21 21:33:11 +08:00
Parfii-bot
c89352c87c Merge branch 'feat/frontend-v040' — 4 stacks + 3 Rust + 5 shell + 17 skills + /site-create (partial) 
Cargo.lock regenerated after 8-crate workspace merge.
 2026-04-21 21:17:19 +08:00
Parfii-bot
19850e1a45 Merge branch 'feat/v0.5-vm-security' — 7 blocks + 3 shell + 2 Rust + /vm-provision 
Workspace Cargo.toml reconciled: all 8 crates (kei-ledger, kei-migrate, kei-changelog, ssh-check, firewall-diff, mock-render, visual-diff, tokens-sync) as members.
 2026-04-21 21:15:49 +08:00
Parfii-bot
e5d565a11e Merge branch 'feat/v0.7-docs' — 5 blocks + kei-docs-scaffold + kei-changelog Rust + /docs-scaffold 2026-04-21 21:15:05 +08:00
Parfii-bot
f205a12348 Merge branch 'feat/v0.6-database' — 5 blocks + kei-migrate Rust + /schema-design 2026-04-21 21:14:50 +08:00
Parfii-bot
62e28450bc Merge branch 'feat/rule-0.12-agent-git-model' — kei-ledger Rust + hook + /new-project 2026-04-21 21:13:40 +08:00
Parfii-bot
0081bc8f46 Merge branch 'feat/v0.7-auth-iam' — 4 blocks + /auth-setup 2026-04-21 21:11:39 +08:00
Parfii-bot
6d382ee939 Merge branch 'feat/v0.7-api-design' — 4 blocks + /api-design 2026-04-21 21:11:17 +08:00
Parfii-bot
5d61866618 Merge branch 'feat/v0.6-cicd' — 4 blocks + kei-ci-lint + /ci-scaffold 2026-04-21 21:11:17 +08:00
Parfii-bot
40d11e7dac Merge branch 'feat/v0.7-testing-matrix' — 4 blocks + /test-matrix 2026-04-21 21:11:17 +08:00
Parfii-bot
7825e458b0 Merge branch 'feat/v0.6-observability' — 3 blocks + 2 primitives + /observability-setup 2026-04-21 21:11:17 +08:00
Parfii-bot
5d5362db3e feat(skills): /site-create pipeline (phases 0-4 — phases 5-6 deferred) 2026-04-21 21:08:14 +08:00
Parfii-bot
fd81aae515 feat(skills): port 17 generic frontend skills from ~/.claude/skills/ (a11y-audit, design-system, figma-to-code, form-builder, frontend-design, landing-page, motion-design, perf-audit, responsive-audit, scroll-animation, seo-audit, site-builder, site-teardown, ui-component, web-assets, web-deploy, web-effects) 2026-04-21 21:08:14 +08:00
Parfii-bot
8c60085862 feat(primitives): 5 shell primitives — design-scrape, live-preview, figma-tokens, frontend-inspect, screenshot-decode 2026-04-21 21:07:45 +08:00
Parfii-bot
ebf841c7d9 feat(primitives): 3 Rust cubes — mock-render, visual-diff, tokens-sync 2026-04-21 21:07:45 +08:00
Parfii-bot
c94646dd3c feat(blocks): stack-astro/react-vite/sveltekit/tailwind 2026-04-21 21:07:45 +08:00
Parfii-bot
2ba5754948 chore: gitignore _primitives/_rust/target 2026-04-21 21:07:45 +08:00
Parfii-bot
63b6b07c06 feat(skills): /docs-scaffold 5-phase pipeline 2026-04-21 21:01:28 +08:00
Parfii-bot
be20f5ba46 feat(primitives): kei-docs-scaffold shell + kei-changelog Rust 2026-04-21 21:01:28 +08:00
Parfii-bot
97d3fcb6ba feat(blocks): 5 documentation blocks — claude-md/decisions/runbook/readme/diagrams 2026-04-21 21:01:28 +08:00
Parfii-bot
eee5eecc20 feat(skills): /vm-provision 6-phase pipeline 
Hub-and-spoke skill:
- SKILL.md (index) + phase-1-select-provider, phase-2-plan,
  phase-3-provision, phase-4-harden, phase-5-verify, phase-6-handoff.

Pipeline: select provider → Plan Mode doc → provision (hetzner/vultr
primitives, SSH first-contact TOFU) → harden-base.sh over SSH →
ssh-check + firewall-diff HARD GATE → artefact ledger + optional
/web-deploy handoff.

Invariants:
- ≥ 6 AskUserQuestion calls (Phase 1×2, 2×1, 3×1, 4×1, 5×1).
- Hard gate: Phase 6 refuses to run unless ssh-check AND firewall-diff
  both exit 0. "Ignore and proceed" is BLOCKED by design.
- RULE 0.8 (secrets ENV-ref only), RULE 0.4 (cite provider specifics),
  RULE 0.5 (plan.md written to <run-dir>/plan.md before provisioning),
  RULE -1 (every failure branch returns 2-3 constructive paths).

Defensive-only — no scanning tools, no CVE probes, no third-party
attack-surface analysis. Every phase file ≤ 200 LOC per Constructor
Pattern.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-21 21:00:14 +08:00
Parfii-bot
521659bbfb feat(primitives): 2 Rust verification cubes 
- ssh-check — parse sshd_config + drop-ins, merge last-wins, lint against
  hardened baseline (pw-auth=no, root=prohibit-password, maxauthtries≤3,
  AllowUsers whitelist, no CBC ciphers, ETM MACs, no ssh-rsa host key).
  4 modules: main (clap CLI) + parse + rules + check. Tests: 9 pass
  (hardened baseline, password-auth-yes-fails, cbc-cipher-fails,
  allow-users-not-in-whitelist-fails, missing-required-fails, etc.).

- firewall-diff — diff intent YAML against `ufw status numbered` output.
  Defensive-only (never runs ufw). Stdin or --status-file input. Parses
  (v6) families, normalises "Anywhere"→"any". Exit 2 on any missing/
  extra rule. 4 modules: main + intent + ufw + diff. Tests: 8 pass
  (load-minimal-intent, exact-match-clean, missing-rule-surfaced,
  extra-live-rule-surfaced, inactive-ufw-fails, integration).

Workspace: clap 4 + serde + serde_yaml + serde_json. release opt-level=z,
LTO, strip. Constructor Pattern: largest file check.rs 213 LOC (93 non-
test); every function under 30 LOC.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-21 21:00:01 +08:00
Parfii-bot
969e24c6c4 feat(primitives): 3 shell provisioning + hardening 
- provision-hetzner.sh — idempotent hcloud wrapper; create/destroy/status/list
  * HCLOUD_TOKEN from ~/.claude/secrets/.env (RULE 0.8)
- provision-vultr.sh — idempotent vultr-cli wrapper; Vultr resolves IP async
  * VULTR_API_KEY from ~/.claude/secrets/.env (RULE 0.8)
- harden-base.sh — Debian/Ubuntu baseline; apt → ssh → ufw → fail2ban →
  auditd → unattended-upgrades; idempotent; ports generic patterns from
  vortex/control/setup/setup.sh:13-53 (no Xray/sing-box/WG steps)

All three reject unsupported platforms early; harden-base.sh never
auto-reboots (surfaces needrestart hints only).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-21 20:59:38 +08:00
Parfii-bot
19cbdbd689 feat(blocks): 7 VM + security blocks 
- deploy-hetzner-cloud.md — CX22/CAX11 (€3.79/mo verified), hcloud TF
- deploy-vps-generic.md — provider-agnostic cloud-init + SSH first-contact
- security-ssh-hardening.md — sshd_config.d/99-kei.conf baseline matrix
- security-firewall-ufw.md — ufw default-deny + rate limiting + intent YAML
- security-tls-caddy.md — Caddy 2 auto-ACME, HTTP-01 / DNS-01, systemd
- security-audit-logging.md — auditd rules + journald persistence
- security-patching.md — unattended-upgrades + needrestart + reboot window

All blocks reference RULE 0.8 env-var-only secrets and cite provider
specifics per RULE 0.4.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-21 20:59:28 +08:00
Parfii-bot
cd7a983f98 feat(skills): /ci-scaffold 5-phase pipeline 2026-04-21 20:56:24 +08:00
Parfii-bot
7e2afc366b feat(primitives): kei-ci-lint workflow YAML validator 2026-04-21 20:56:24 +08:00
Parfii-bot
719324e0a9 feat(blocks): 4 CI/CD blocks — gh-actions/forgejo-actions/release/security-gate 2026-04-21 20:56:24 +08:00
Parfii-bot
2262cc3f69 feat(skills): /api-design 6-phase pipeline 2026-04-21 20:54:54 +08:00
Parfii-bot
e3c20b2b01 feat(blocks): 4 API design blocks — rest/openapi/graphql/versioning-pagination 2026-04-21 20:54:53 +08:00
Parfii-bot
4178147b0f feat(skills): /new-project 4-phase pipeline 
Hub-and-spoke orchestrator for RULE 0.12 at project scale. SKILL.md
indexes 4 phase files: intake, fork-skeleton, parallel-exec, merge-
ceremony.

Flow:
  Phase 1 — 1 free-text line (GOAL) + 1 batch of 5 AskUserQuestion
            (type, theory, fanout, main-agent, DB mode).
  Phase 2 — project/<slug> branch, kei-ledger fork root, theoretical
            sub-agent spawn confirmation click.
  Phase 3 — poll kei-ledger list --status running, aggregate
            progress.json, steering click (continue / add / kill /
            merge / pause).
  Phase 4 — kei-ledger validate per bundle, per-branch merge verdict
            click (merge --no-ff / squash / reject / defer), final
            integration + NO-DOWNGRADE close click if any rejected /
            deferred.

>=6 AskUserQuestion calls minimum (1 batch Phase 1 + 1 Phase 2 + 1
Phase 3 + >=2 per-branch Phase 4 + 1 close).

Constructor Pattern: SKILL.md 109 LOC, phase files 80-108 LOC each —
all under 150 LOC.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-21 20:52:49 +08:00
Parfii-bot
cc8d1868be feat(hooks): agent-fork-logger PreToolUse:Agent 
Advisory hook (RULE 0.12). Reads Agent tool_input JSON from stdin, hashes
the prompt (SHA-256 first 16), derives agent id and branch per isolation
mode, emits kei-ledger fork row.

NEVER blocks: every exit path is exit 0. Missing jq / kei-ledger / git
= silent no-op. Advisory because isolation=false trivial agents are
expected to slip through (RULE 0.12 Exceptions 1-2).

Constructor Pattern: 51 LOC, POSIX sh, chmod +x.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-21 20:52:29 +08:00
Parfii-bot
c801715a49 feat(primitives): kei-ledger Rust SQLite agent ledger 
SSoT for RULE 0.12 (agent git-model). Every non-trivial Agent invocation
logs a fork row; merge ceremony validates the 6-file artefact bundle.

CLI: init / fork / done / fail / merged / list / tree / validate.
Storage: ~/.claude/agents/ledger.sqlite (override via KEI_LEDGER_DB).
Schema versioned via PRAGMA user_version.

Tests: 9/9 passing (fork+done, fail flow, tree walk, list filter,
validate missing/complete, duplicate-id reject, done idempotency,
merged transition). cargo test --release 0.01s.

Constructor Pattern: schema.rs 50, ledger.rs 170, main.rs 177,
integration.rs 147 — all under 200 LOC.

Workspace update: adds kei-ledger to _primitives/_rust members list.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-21 20:52:20 +08:00
Parfii-bot
505e727dcf feat(skills): /auth-setup 5-phase pipeline 
Hub-and-spoke skill that converts "I need auth for app X" into a
reviewable plan across 5 phases: intake (flows/stack/storage/MFA),
identity-provider pick + env scaffold, session strategy + cookies,
authorization model + permission matrix, and threats + mitigations.

- 8 AskUserQuestion calls total (≥6 hub-and-spoke contract; 4 in Phase 1
  + 1 each in Phases 2–5).
- Reads all four _blocks/auth-*.md; never writes production code or
  secret values.
- RULE 0.8 (Secrets SSoT): emits env VARIABLE NAMES only; storage path
  is secrets/auth.env per domain-has-secrets.md.
- Constructor Pattern: 6 files, largest 115 LOC (<200 limit).
- Fail-closed default + NO DOWNGRADE on unsafe combinations
  (passkey-only without recovery → return recovery-path options, not
  "not supported").

Evidence grade [E2] — pipeline mirrors OWASP ASVS v4.0.3 chapters 2–4.
 2026-04-21 20:47:21 +08:00
Parfii-bot
c10e169806 feat(skills): /schema-design 5-phase pipeline 
Hub-and-spoke skill that converts "I need a database for app X" into a
designed relational schema + first migration + optional seed.

Pipeline (5 phases, 9 AskUserQuestion calls total, pure-click after intake):
- Phase 1 — batched DB/ORM/scale/style/migration-control click
- Phase 2 — entity list + relations matrix (auto-junction tables)
- Phase 3 — generate DDL with indexes, FKs, constraints; review/revise loop
- Phase 4 — scaffold migrations/ + first timestamped migration + kei-migrate wiring
- Phase 5 — optional seed (smoke / rich / test fixtures / skip)

Cross-refs the five db-* blocks + the kei-migrate Rust primitive added in
commits f884891 and df85792 on this branch. Emits ENV-VAR NAMES only for
DATABASE_URL (RULE 0.8 secrets SSoT). Every file ≤ 121 LOC.
 2026-04-21 20:46:32 +08:00
Parfii-bot
56ddccfddb feat(skills): /test-matrix 5-phase pipeline 
Adds hub-and-spoke testing-matrix skill complementing /test-gen:
SKILL.md index + phase-1-intake (language/coverage/critical/CI),
phase-2-matrix (test-type × language multi-select), phase-3-scaffold
(config + corpus + fixtures per cell), phase-4-ci-wire (per-type
failure policy + artifacts), phase-5-triage (crash/regression runbook).
Cross-refs _blocks/test-fuzz.md, test-property.md, test-load.md,
test-e2e.md. Adds "complements" note to skills/test-gen/SKILL.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-21 20:46:02 +08:00
Parfii-bot
0d3b4efd30 feat(skills): /observability-setup 5-phase pipeline 2026-04-21 20:41:17 +08:00
Parfii-bot
e49660cd69 feat(primitives): metrics-scrape + log-ship shell primitives 2026-04-21 20:41:17 +08:00