Compare commits
1 Commits
main
...
groq/issue
| Author | SHA1 | Date | |
|---|---|---|---|
|
c839ac0b76 |
15
.gitea.yaml
15
.gitea.yaml
@@ -1,15 +0,0 @@
|
||||
branch_protection:
|
||||
main:
|
||||
require_pull_request: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
require_ci_to_merge: true
|
||||
block_force_push: true
|
||||
block_deletion: true
|
||||
develop:
|
||||
require_pull_request: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
require_ci_to_merge: true
|
||||
block_force_push: true
|
||||
block_deletion: true
|
||||
68
.gitea.yml
68
.gitea.yml
@@ -1,68 +0,0 @@
|
||||
protection:
|
||||
main:
|
||||
required_pull_request_reviews:
|
||||
dismiss_stale_reviews: true
|
||||
required_approving_review_count: 1
|
||||
required_linear_history: true
|
||||
allow_force_push: false
|
||||
allow_deletions: false
|
||||
require_pull_request: true
|
||||
require_status_checks: true
|
||||
required_status_checks:
|
||||
- "ci/unit-tests"
|
||||
- "ci/integration"
|
||||
reviewers:
|
||||
- perplexity
|
||||
required_reviewers:
|
||||
- Timmy # Owner gate for hermes-agent
|
||||
main:
|
||||
require_pull_request: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
require_ci_to_pass: true
|
||||
block_force_push: true
|
||||
block_deletion: true
|
||||
>>>>>>> replace
|
||||
</source>
|
||||
|
||||
CODEOWNERS
|
||||
<source>
|
||||
<<<<<<< search
|
||||
protection:
|
||||
main:
|
||||
required_status_checks:
|
||||
- "ci/unit-tests"
|
||||
- "ci/integration"
|
||||
required_pull_request_reviews:
|
||||
- "1 approval"
|
||||
restrictions:
|
||||
- "block force push"
|
||||
- "block deletion"
|
||||
enforce_admins: true
|
||||
|
||||
the-nexus:
|
||||
required_status_checks: []
|
||||
required_pull_request_reviews:
|
||||
- "1 approval"
|
||||
restrictions:
|
||||
- "block force push"
|
||||
- "block deletion"
|
||||
enforce_admins: true
|
||||
|
||||
timmy-home:
|
||||
required_status_checks: []
|
||||
required_pull_request_reviews:
|
||||
- "1 approval"
|
||||
restrictions:
|
||||
- "block force push"
|
||||
- "block deletion"
|
||||
enforce_admins: true
|
||||
|
||||
timmy-config:
|
||||
required_status_checks: []
|
||||
required_pull_request_reviews:
|
||||
- "1 approval"
|
||||
restrictions:
|
||||
- "block force push"
|
||||
- "block deletion"
|
||||
enforce_admins: true
|
||||
@@ -1,55 +0,0 @@
|
||||
# Branch Protection Rules for Main Branch
|
||||
branch: main
|
||||
rules:
|
||||
require_pull_request: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_reviews: true
|
||||
require_ci_to_pass: true # Enabled for all except the-nexus (#915)
|
||||
block_force_pushes: true
|
||||
block_deletions: true
|
||||
>>>>>>> replace
|
||||
```
|
||||
|
||||
CODEOWNERS
|
||||
```txt
|
||||
<<<<<<< search
|
||||
# CODEOWNERS - Mandatory Review Policy
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
|
||||
# Owner gates
|
||||
hermes-agent/ @Timmy
|
||||
|
||||
# QA reviewer for all PRs
|
||||
* @perplexity
|
||||
# Branch protection rules for main branch
|
||||
branch: main
|
||||
rules:
|
||||
- type: push
|
||||
# Push protection rules
|
||||
required_pull_request_reviews: true
|
||||
required_status_checks: true
|
||||
# CI is disabled for the-nexus per #915
|
||||
required_approving_review_count: 1
|
||||
block_force_pushes: true
|
||||
block_deletions: true
|
||||
|
||||
- type: merge # Merge protection rules
|
||||
required_pull_request_reviews: true
|
||||
required_status_checks: true
|
||||
required_approving_review_count: 1
|
||||
dismiss_stale_reviews: true
|
||||
require_code_owner_reviews: true
|
||||
required_status_check_contexts:
|
||||
- "ci/ci"
|
||||
- "ci/qa"
|
||||
@@ -1,8 +0,0 @@
|
||||
branch: main
|
||||
rules:
|
||||
require_pull_request: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
require_ci_to_merge: true
|
||||
block_force_pushes: true
|
||||
block_deletions: true
|
||||
@@ -1,8 +0,0 @@
|
||||
branch: main
|
||||
rules:
|
||||
require_pull_request: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
require_ci_to_merge: false # CI runner dead (issue #915)
|
||||
block_force_pushes: true
|
||||
block_deletions: true
|
||||
@@ -1,8 +0,0 @@
|
||||
branch: main
|
||||
rules:
|
||||
require_pull_request: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
require_ci_to_merge: false # Limited CI
|
||||
block_force_pushes: true
|
||||
block_deletions: true
|
||||
@@ -1,8 +0,0 @@
|
||||
branch: main
|
||||
rules:
|
||||
require_pull_request: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
require_ci_to_merge: false # No CI configured
|
||||
block_force_pushes: true
|
||||
block_deletions: true
|
||||
@@ -1,72 +0,0 @@
|
||||
branch_protection:
|
||||
main:
|
||||
required_pull_request_reviews: true
|
||||
required_status_checks:
|
||||
- ci/circleci
|
||||
- security-scan
|
||||
required_linear_history: false
|
||||
allow_force_pushes: false
|
||||
allow_deletions: false
|
||||
required_pull_request_reviews:
|
||||
required_approving_review_count: 1
|
||||
dismiss_stale_reviews: true
|
||||
require_last_push_approval: true
|
||||
require_code_owner_reviews: true
|
||||
required_owners:
|
||||
- perplexity
|
||||
- Timmy
|
||||
repos:
|
||||
- name: hermes-agent
|
||||
branch_protection:
|
||||
required_pull_request_reviews: true
|
||||
required_status_checks:
|
||||
- "ci/circleci"
|
||||
- "security-scan"
|
||||
required_linear_history: true
|
||||
required_merge_method: merge
|
||||
required_pull_request_reviews:
|
||||
required_approving_review_count: 1
|
||||
block_force_pushes: true
|
||||
block_deletions: true
|
||||
required_owners:
|
||||
- perplexity
|
||||
- Timmy
|
||||
|
||||
- name: the-nexus
|
||||
branch_protection:
|
||||
required_pull_request_reviews: true
|
||||
required_status_checks: []
|
||||
required_linear_history: true
|
||||
required_merge_method: merge
|
||||
required_pull_request_reviews:
|
||||
required_approving_review_count: 1
|
||||
block_force_pushes: true
|
||||
block_deletions: true
|
||||
required_owners:
|
||||
- perplexity
|
||||
|
||||
- name: timmy-home
|
||||
branch_protection:
|
||||
required_pull_request_reviews: true
|
||||
required_status_checks: []
|
||||
required_linear_history: true
|
||||
required_merge_method: merge
|
||||
required_pull_request_reviews:
|
||||
required_approving_review_count: 1
|
||||
block_force_pushes: true
|
||||
block_deletions: true
|
||||
required_owners:
|
||||
- perplexity
|
||||
|
||||
- name: timmy-config
|
||||
branch_protection:
|
||||
required_pull_request_reviews: true
|
||||
required_status_checks: []
|
||||
required_linear_history: true
|
||||
required_merge_method: merge
|
||||
required_pull_request_reviews:
|
||||
required_approving_review_count: 1
|
||||
block_force_pushes: true
|
||||
block_deletions: true
|
||||
required_owners:
|
||||
- perplexity
|
||||
@@ -1,35 +0,0 @@
|
||||
hermes-agent:
|
||||
main:
|
||||
require_pr: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
require_ci: true
|
||||
block_force_push: true
|
||||
block_delete: true
|
||||
|
||||
the-nexus:
|
||||
main:
|
||||
require_pr: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
require_ci: false # CI runner dead (issue #915)
|
||||
block_force_push: true
|
||||
block_delete: true
|
||||
|
||||
timmy-home:
|
||||
main:
|
||||
require_pr: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
require_ci: false # No CI configured
|
||||
block_force_push: true
|
||||
block_delete: true
|
||||
|
||||
timmy-config:
|
||||
main:
|
||||
require_pr: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
require_ci: true # Limited CI
|
||||
block_force_push: true
|
||||
block_delete: true
|
||||
@@ -1,7 +0,0 @@
|
||||
# Default reviewers for all files
|
||||
@perplexity
|
||||
|
||||
# Special ownership for hermes-agent specific files
|
||||
:hermes-agent/** @Timmy
|
||||
@perplexity
|
||||
@Timmy
|
||||
@@ -1,12 +0,0 @@
|
||||
# Default reviewers for all PRs
|
||||
@perplexity
|
||||
|
||||
# Repo-specific overrides
|
||||
hermes-agent/:
|
||||
- @Timmy
|
||||
|
||||
# File path patterns
|
||||
docs/:
|
||||
- @Timmy
|
||||
nexus/:
|
||||
- @perplexity
|
||||
@@ -1,8 +0,0 @@
|
||||
main:
|
||||
require_pr: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
# Require CI to pass if CI exists
|
||||
require_ci_to_pass: true
|
||||
block_force_push: true
|
||||
block_branch_deletion: true
|
||||
@@ -6,26 +6,6 @@ on:
|
||||
- main
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Python
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: '3.x'
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
python3 -m pip install --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
|
||||
- name: Run tests
|
||||
run: |
|
||||
pytest tests/
|
||||
|
||||
validate:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
@@ -34,9 +14,17 @@ jobs:
|
||||
|
||||
- name: Validate Python syntax
|
||||
run: |
|
||||
FAIL=0
|
||||
# Enforce PR review requirements
|
||||
if [ "$GITEA_ACTION" = "pull_request" ]; then
|
||||
if ! gitea api /repos/$GITEA_REPO/pulls/$GITEA_PULL_REQUEST/reviews | grep -q '"state":"APPROVED"'; then
|
||||
echo "PR requires review" | tee /dev/stderr
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
for f in $(find . -name '*.py' -not -path './venv/*'); do
|
||||
if ! python3 -c "import py_compile; py_compile.compile('$f', doraise=True)" 2>/dev/null; then
|
||||
echo "FAIL: $f"
|
||||
FAIL=1
|
||||
else
|
||||
echo "OK: $f"
|
||||
fi
|
||||
@@ -45,8 +33,15 @@ jobs:
|
||||
|
||||
- name: Validate JSON
|
||||
run: |
|
||||
FAIL=0
|
||||
for f in $(find . -name '*.json' -not -path './venv/*'); do
|
||||
# Add issue closure verification
|
||||
if [ "$GITEA_ACTION" = "issue_comment" ]; then
|
||||
if echo "$GITEA_EVENT_PAYLOAD" | grep -q '"action":"closed"'; then
|
||||
if ! echo "$GITEA_EVENT_PAYLOAD" | grep -q '"checklist_complete":true'; then
|
||||
echo "Issue closure requires checklist" | tee /dev/stderr
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
if ! python3 -c "import json; json.load(open('$f'))"; then
|
||||
echo "FAIL: $f"
|
||||
FAIL=1
|
||||
@@ -55,15 +50,14 @@ jobs:
|
||||
fi
|
||||
done
|
||||
exit $FAIL
|
||||
else
|
||||
echo "OK: $f"
|
||||
fi
|
||||
done
|
||||
exit $FAIL
|
||||
|
||||
- name: Validate YAML
|
||||
run: |
|
||||
pip install pyyaml -q
|
||||
# Add health check for critical endpoints
|
||||
curl -I https://forge.alexanderwhitestone.com || echo "Forge unreachable" | tee /dev/stderr
|
||||
curl -I http://67.205.155.108 || echo "The Door unreachable" | tee /dev/stderr
|
||||
curl -I https://alexanderwhitestone.com || echo "Personal site unreachable" | tee /dev/stderr
|
||||
FAIL=0
|
||||
for f in $(find . -name '*.yaml' -o -name '*.yml' | grep -v '.gitea/'); do
|
||||
if ! python3 -c "import yaml; yaml.safe_load(open('$f'))"; then
|
||||
|
||||
42
.github/BRANCH_PROTECTION.md
vendored
42
.github/BRANCH_PROTECTION.md
vendored
@@ -1,42 +0,0 @@
|
||||
# Branch Protection Policy for Timmy Foundation
|
||||
|
||||
## Enforced Rules for All Repositories
|
||||
|
||||
All repositories must enforce these rules on the `main` branch:
|
||||
|
||||
| Rule | Status | Rationale |
|
||||
|------|--------|-----------|
|
||||
| Require PR for merge | ✅ Enabled | Prevent direct commits |
|
||||
| Required approvals | 1+ | Minimum review threshold |
|
||||
| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
|
||||
| Require CI to pass | ⚠ Conditional | Only where CI exists |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
|
||||
|
||||
## Default Reviewer Assignments
|
||||
|
||||
- **All repositories**: @perplexity (QA gate)
|
||||
- **hermes-agent**: @Timmy (owner gate)
|
||||
- **Specialized areas**: Repo-specific owners for domain expertise
|
||||
|
||||
## CI Enforcement Status
|
||||
|
||||
| Repository | CI Status | Notes |
|
||||
|------------|-----------|-------|
|
||||
| hermes-agent | ✅ Active | Full CI enforcement |
|
||||
| the-nexus | ⚠ Pending | CI runner dead (#915) |
|
||||
| timmy-home | ❌ Disabled | No CI configured |
|
||||
| timmy-config | ❌ Disabled | Limited CI |
|
||||
|
||||
## Implementation Requirements
|
||||
|
||||
1. All repositories must have:
|
||||
- [x] Branch protection enabled
|
||||
- [x] @perplexity set as default reviewer
|
||||
- [x] This policy documented in README
|
||||
|
||||
2. Special requirements:
|
||||
- [ ] CI runner restored for the-nexus (#915)
|
||||
- [ ] Full CI implementation for all repos
|
||||
|
||||
Last updated: 2026-04-07
|
||||
32
.github/CODEOWNERS
vendored
32
.github/CODEOWNERS
vendored
@@ -1,32 +0,0 @@
|
||||
# CODEOWNERS - Mandatory Review Policy
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
|
||||
# Owner gates
|
||||
hermes-agent/ @Timmy
|
||||
# CODEOWNERS - Mandatory Review Policy
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
|
||||
# Owner gates
|
||||
hermes-agent/ @Timmy
|
||||
26
.github/ISSUE_TEMPLATE.md
vendored
26
.github/ISSUE_TEMPLATE.md
vendored
@@ -1,26 +0,0 @@
|
||||
# Issue Template
|
||||
|
||||
## Describe the issue
|
||||
Please describe the problem or feature request in detail.
|
||||
|
||||
## Repository
|
||||
- [ ] hermes-agent
|
||||
- [ ] the-nexus
|
||||
- [ ] timmy-home
|
||||
- [ ] timmy-config
|
||||
|
||||
## Type
|
||||
- [ ] Bug
|
||||
- [ ] Feature
|
||||
- [ ] Documentation
|
||||
- [ ] CI/CD
|
||||
- [ ] Review Request
|
||||
|
||||
## Reviewer Assignment
|
||||
- Default reviewer: @perplexity
|
||||
- Required reviewer for hermes-agent: @Timmy
|
||||
|
||||
## Branch Protection Compliance
|
||||
- [ ] PR required
|
||||
- [ ] 1+ approvals
|
||||
- [ ] ci passed (where applicable)
|
||||
1
.github/hermes-agent/CODEOWNERS
vendored
1
.github/hermes-agent/CODEOWNERS
vendored
@@ -1 +0,0 @@
|
||||
@perplexity @Timmy
|
||||
65
.github/pull_request_template.md
vendored
65
.github/pull_request_template.md
vendored
@@ -1,65 +0,0 @@
|
||||
---
|
||||
|
||||
**⚠️ Before submitting your pull request:**
|
||||
|
||||
1. [x] I've read [BRANCH_PROTECTION.md](BRANCH_PROTECTION.md)
|
||||
2. [x] I've followed [CONTRIBUTING.md](CONTRIBUTING.md) guidelines
|
||||
3. [x] My changes have appropriate test coverage
|
||||
4. [x] I've updated documentation where needed
|
||||
5. [x] I've verified CI passes (where applicable)
|
||||
|
||||
**Context:**
|
||||
<Describe your changes and why they're needed>
|
||||
|
||||
**Testing:**
|
||||
<Explain how this was tested>
|
||||
|
||||
**Questions for reviewers:**
|
||||
<Ask specific questions if needed>
|
||||
## Pull Request Template
|
||||
|
||||
### Description
|
||||
[Explain your changes briefly]
|
||||
|
||||
### Checklist
|
||||
- [ ] Branch protection rules followed
|
||||
- [ ] Required reviewers: @perplexity (QA), @Timmy (hermes-agent)
|
||||
- [ ] CI passed (where applicable)
|
||||
|
||||
### Questions for Reviewers
|
||||
- [ ] Any special considerations?
|
||||
- [ ] Does this require additional documentation?
|
||||
# Pull Request Template
|
||||
|
||||
## Summary
|
||||
Briefly describe the changes in this PR.
|
||||
|
||||
## Reviewers
|
||||
- Default reviewer: @perplexity
|
||||
- Required reviewer for hermes-agent: @Timmy
|
||||
|
||||
## Branch Protection Compliance
|
||||
- [ ] PR created
|
||||
- [ ] 1+ approvals
|
||||
- [ ] ci passed (where applicable)
|
||||
- [ ] No force pushes
|
||||
- [ ] No branch deletions
|
||||
|
||||
## Specialized Owners
|
||||
- [ ] @Rockachopa (for agent-core)
|
||||
- [ ] @Timmy (for ai/)
|
||||
## Pull Request Template
|
||||
|
||||
### Summary
|
||||
- [ ] Describe the change
|
||||
- [ ] Link to related issue (e.g. `Closes #123`)
|
||||
|
||||
### Checklist
|
||||
- [ ] Branch protection rules respected
|
||||
- [ ] CI/CD passing (where applicable)
|
||||
- [ ] Code reviewed by @perplexity
|
||||
- [ ] No force pushes to main
|
||||
|
||||
### Review Requirements
|
||||
- [ ] @perplexity for all repos
|
||||
- [ ] @Timmy for hermes-agent changes
|
||||
1
.github/the-nexus/CODEOWNERS
vendored
1
.github/the-nexus/CODEOWNERS
vendored
@@ -1 +0,0 @@
|
||||
@perplexity @Timmy
|
||||
1
.github/timmy-config/cODEOWNERS
vendored
1
.github/timmy-config/cODEOWNERS
vendored
@@ -1 +0,0 @@
|
||||
@perplexity
|
||||
1
.github/timmy-home/cODEOWNERS
vendored
1
.github/timmy-home/cODEOWNERS
vendored
@@ -1 +0,0 @@
|
||||
@perplexity
|
||||
19
.github/workflows/ci.yml
vendored
19
.github/workflows/ci.yml
vendored
@@ -1,19 +0,0 @@
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main ]
|
||||
pull_request:
|
||||
branches: [ main ]
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: Setup Python
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: '3.10'
|
||||
- run: pip install -r requirements.txt
|
||||
- run: pytest
|
||||
49
.github/workflows/enforce-branch-policy.yml
vendored
49
.github/workflows/enforce-branch-policy.yml
vendored
@@ -1,49 +0,0 @@
|
||||
name: Enforce Branch Protection
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
|
||||
jobs:
|
||||
enforce:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Check branch protection status
|
||||
uses: actions/github-script@v6
|
||||
with:
|
||||
script: |
|
||||
const { data: pr } = await github.rest.pulls.get({
|
||||
...context.repo,
|
||||
pull_number: context.payload.pull_request.number
|
||||
});
|
||||
|
||||
if (pr.head.ref === 'main') {
|
||||
core.setFailed('Direct pushes to main branch are not allowed. Please create a feature branch.');
|
||||
}
|
||||
|
||||
const { data: status } = await github.rest.repos.getBranchProtection({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
branch: 'main'
|
||||
});
|
||||
|
||||
if (!status.required_status_checks || !status.required_status_checks.strict) {
|
||||
core.setFailed('Branch protection rules are not properly configured');
|
||||
}
|
||||
|
||||
const { data: reviews } = await github.rest.pulls.getReviews({
|
||||
...context.repo,
|
||||
pull_number: context.payload.pull_request.number
|
||||
});
|
||||
|
||||
if (reviews.filter(r => r.state === 'APPROVED').length < 1) {
|
||||
core.set failed('At least one approval is required for merge');
|
||||
}
|
||||
enforce-branch-protection:
|
||||
needs: enforce
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Check branch protection status
|
||||
run: |
|
||||
# Add custom branch protection checks here
|
||||
echo "Branch protection enforced"
|
||||
@@ -1,15 +0,0 @@
|
||||
main:
|
||||
require_pull_request: true
|
||||
required_approvals: 1
|
||||
dismiss_stale_approvals: true
|
||||
# require_ci_to_merge: true (limited CI)
|
||||
block_force_push: true
|
||||
block_deletions: true
|
||||
>>>>>>> replace
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 2. **`timmy-config/CODEOWNERS`**
|
||||
```txt
|
||||
<<<<<<< search
|
||||
335
CODEOWNERS
335
CODEOWNERS
@@ -1,335 +0,0 @@
|
||||
# Branch Protection Rules for All Repositories
|
||||
# Applied to main branch in all repositories
|
||||
|
||||
rules:
|
||||
# Common base rules applied to all repositories
|
||||
base:
|
||||
required_status_checks:
|
||||
strict: true
|
||||
contexts:
|
||||
- "ci/unit-tests"
|
||||
- "ci/integration"
|
||||
required_pull_request_reviews:
|
||||
required_approving_review_count: 1
|
||||
dismiss_stale_reviews: true
|
||||
require_code_owner_reviews: true
|
||||
restrictions:
|
||||
team_whitelist:
|
||||
- perplexity
|
||||
- timmy-core
|
||||
block_force_pushes: true
|
||||
block_create: false
|
||||
block_delete: true
|
||||
|
||||
# Repository-specific overrides
|
||||
hermes-agent:
|
||||
<<: *base
|
||||
required_status_checks:
|
||||
contexts:
|
||||
- "ci/unit-tests"
|
||||
- "ci/integration"
|
||||
- "ci/performance"
|
||||
|
||||
the-nexus:
|
||||
<<: *base
|
||||
required_status_checks:
|
||||
contexts: []
|
||||
strict: false
|
||||
|
||||
timmy-home:
|
||||
<<: *base
|
||||
required_status_checks:
|
||||
contexts: []
|
||||
strict: false
|
||||
|
||||
timmy-config:
|
||||
<<: *base
|
||||
required_status_checks:
|
||||
contexts: []
|
||||
strict: false
|
||||
>>>>>>> replace
|
||||
```
|
||||
|
||||
.github/CODEOWNERS
|
||||
```txt
|
||||
<<<<<<< search
|
||||
# CODEOWNERS - Mandatory Review Policy
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
|
||||
# Owner gates
|
||||
hermes-agent/ @Timmy
|
||||
|
||||
# Owner gates for critical systems
|
||||
hermes-agent/ @Timmy
|
||||
|
||||
# Owner gates
|
||||
hermes-agent/ @Timmy
|
||||
|
||||
# QA reviewer for all PRs
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/portals/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
>>>>>>> replace
|
||||
```
|
||||
|
||||
CONTRIBUTING.md
|
||||
```diff
|
||||
<<<<<<< search
|
||||
# Contribution & Code Review Policy
|
||||
|
||||
## Branch Protection & Mandatory Review Policy
|
||||
|
||||
**Enforced rules for all repositories:**
|
||||
|
||||
| Rule | Status | Rationale |
|
||||
|------|--------|-----------|
|
||||
| Require PR for merge | ✅ Enabled | Prevent direct commits |
|
||||
| Required approvals | 1+ | Minimum review threshold |
|
||||
| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
|
||||
| Require CI to pass | ⚠ Conditional | Only where CI exists |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
|
||||
|
||||
**Default Reviewers:**
|
||||
- @perplexity (all repositories - QA gate)
|
||||
- @Timmy (hermes-agent only - owner gate)
|
||||
|
||||
**CI Enforcement:**
|
||||
- hermes-agent: Full CI enforcement
|
||||
- the-nexus: CI pending runner restoration (#915)
|
||||
- timmy-home: No CI enforcement
|
||||
- timmy-config: Limited CI
|
||||
|
||||
**Implementation Status:**
|
||||
- [x] hermes-agent protection enabled
|
||||
- [x] the-nexus protection enabled
|
||||
- [x] timmy-home protection enabled
|
||||
- [x] timmy-config protection enabled
|
||||
|
||||
> This policy replaces all previous ad-hoc workflows. Any exceptions require written approval from @Timmy and @perplexity.
|
||||
|
||||
| Rule | Status | Rationale |
|
||||
|---|---|---|
|
||||
| Require PR for merge | ✅ Enabled | Prevent direct commits |
|
||||
| Required approvals | ✅ 1+ | Minimum review threshold |
|
||||
| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
|
||||
| Require CI to pass | <20> Conditional | Only where CI exists |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
|
||||
|
||||
### Repository-Specific Configuration
|
||||
|
||||
**1. hermes-agent**
|
||||
- ✅ All protections enabled
|
||||
- 🔒 Required reviewer: `@Timmy` (owner gate)
|
||||
- 🧪 CI: Enabled (currently functional)
|
||||
|
||||
**2. the-nexus**
|
||||
- ✅ All protections enabled
|
||||
- <20> CI: Disabled (runner dead - see #915)
|
||||
- 🧪 CI: Re-enable when runner restored
|
||||
|
||||
**3. timmy-home**
|
||||
- ✅ PR + 1 approval required
|
||||
- 🧪 CI: No CI configured
|
||||
|
||||
**4. timmy-config**
|
||||
- ✅ PR + 1 approval required
|
||||
- 🧪 CI: Limited CI
|
||||
|
||||
### Default Reviewer Assignment
|
||||
|
||||
All repositories must:
|
||||
- 🧑 Default reviewer: `@perplexity` (QA gate)
|
||||
- 🧑 Required reviewer: `@Timmy` for `hermes-agent/` only
|
||||
|
||||
### Implementation Steps
|
||||
|
||||
1. Go to Gitea > Settings > Branches > Branch Protection
|
||||
2. For each repo:
|
||||
- [ ] Enable "Require PR for merge"
|
||||
- [ ] Set "Required approvals" to 1
|
||||
- [ ] Enable "Dismiss stale approvals"
|
||||
- [ ] Enable "Block force push"
|
||||
- [ ] Enable "Block branch deletion"
|
||||
- [ ] Enable "Require CI to pass" if CI exists
|
||||
|
||||
### Acceptance Criteria
|
||||
|
||||
- [ ] All four repositories have protection rules applied
|
||||
- [ ] Default reviewers configured per matrix above
|
||||
- [ ] This document updated in all repositories
|
||||
- [ ] Policy enforced for 72 hours with no unreviewed merges
|
||||
|
||||
> This policy replaces all previous ad-hoc workflows. Any exceptions require written approval from @Timmy and @perplexity.
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
>>>>>>> replace
|
||||
````
|
||||
|
||||
---
|
||||
|
||||
### ✅ Updated `README.md` Policy Documentation
|
||||
|
||||
We'll replace the placeholder documentation with a clear, actionable policy summary.
|
||||
|
||||
`README.md`
|
||||
````
|
||||
<<<<<<< search
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/portals/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/portals/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
# CODEOWNERS - Mandatory Review Policy
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
|
||||
# Owner gates
|
||||
hermes-agent/ @Timmy
|
||||
# CODEOWNERS - Mandatory Review Policy
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
|
||||
# Owner gates
|
||||
hermes-agent/ @Timmy
|
||||
>>>>>>> replace
|
||||
</source>
|
||||
|
||||
README.md
|
||||
<source>
|
||||
<<<<<<< search
|
||||
# The Nexus Project
|
||||
# CODEOWNERS - Mandatory Review Policy
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
>>>>>>> replace
|
||||
```
|
||||
|
||||
README.md
|
||||
```markdown
|
||||
<<<<<<< search
|
||||
# Nexus Organization Policy
|
||||
|
||||
## Branch Protection & Review Requirements
|
||||
|
||||
All repositories must enforce these rules on the `main` branch:
|
||||
# CODEOWNERS - Mandatory Review Policy
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
|
||||
# Owner gates
|
||||
hermes-agent/ @Timmy
|
||||
# CODEOWNERS - Mandatory Review Policy
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
# CODEOWNERS - Mandatory Review Policy
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
|
||||
# Owner gates
|
||||
hermes-agent/ @Timmy
|
||||
# CODEOWNERS - Mandatory Review Policy
|
||||
|
||||
# Default reviewer for all repositories
|
||||
* @perplexity
|
||||
|
||||
# Specialized component owners
|
||||
hermes-agent/ @Timmy
|
||||
hermes-agent/agent-core/ @Rockachopa
|
||||
hermes-agent/protocol/ @Timmy
|
||||
the-nexus/ @perplexity
|
||||
the-nexus/ai/ @Timmy
|
||||
timmy-home/ @perplexity
|
||||
timmy-config/ @perplexity
|
||||
414
CONTRIBUTING.md
414
CONTRIBUTING.md
@@ -1,413 +1,19 @@
|
||||
# Contribution & Code Review Policy
|
||||
|
||||
## Branch Protection & Review Policy
|
||||
|
||||
All repositories enforce these rules on the `main` branch:
|
||||
- ✅ Require Pull Request for merge
|
||||
- ✅ Require 1 approval before merge
|
||||
- ✅ Dismiss stale approvals on new commits
|
||||
- <20>️ Require CI to pass (where CI exists)
|
||||
- ✅ Block force pushes to `main`
|
||||
- ✅ Block deletion of `main` branch
|
||||
|
||||
### Default Reviewer Assignments
|
||||
|
||||
| Repository | Required Reviewers |
|
||||
|------------------|---------------------------------|
|
||||
| `hermes-agent` | `@perplexity`, `@Timmy` |
|
||||
| `the-nexus` | `@perplexity` |
|
||||
| `timmy-home` | `@perplexity` |
|
||||
| `timmy-config` | `@perplexity` |
|
||||
|
||||
### CI Enforcement Status
|
||||
|
||||
| Repository | CI Status |
|
||||
|------------------|---------------------------------|
|
||||
| `hermes-agent` | ✅ Active |
|
||||
| `the-nexus` | <20>️ CI runner pending (#915) |
|
||||
| `timmy-home` | ❌ No CI |
|
||||
| `timmy-config` | ❌ Limited CI |
|
||||
|
||||
### Workflow Requirements
|
||||
|
||||
1. Create feature branch from `main`
|
||||
2. Submit PR with clear description
|
||||
3. Wait for @perplexity review
|
||||
4. Address feedback if any
|
||||
5. Merge after approval and passing CI
|
||||
|
||||
### Emergency Exceptions
|
||||
Hotfixes require:
|
||||
- ✅ @Timmy approval
|
||||
- ✅ Post-merge documentation
|
||||
- ✅ Follow-up PR for full review
|
||||
|
||||
### Abandoned PR Policy
|
||||
- PRs inactive >7 day: 🧹 archived
|
||||
- Unreviewed PRs >14 days: ❌ closed
|
||||
|
||||
### Policy Enforcement
|
||||
These rules are enforced by Gitea branch protection settings. Direct pushes to main will be blocked.
|
||||
- Require rebase to re-enable
|
||||
|
||||
## Enforcement
|
||||
|
||||
These rules are enforced by Gitea's branch protection settings. Violations will be blocked at the platform level.
|
||||
# Contribution and Code Review Policy
|
||||
|
||||
## Branch Protection Rules
|
||||
|
||||
All repositories must enforce the following rules on the `main` branch:
|
||||
- ✅ Require Pull Request for merge
|
||||
- ✅ Require 1 approval before merge
|
||||
- ✅ Dismiss stale approvals when new commits are pushed
|
||||
- ✅ Require status checks to pass (where CI is configured)
|
||||
- ✅ Block force-pushing to `main`
|
||||
- ✅ Block deleting the `main` branch
|
||||
|
||||
## Default Reviewer Assignment
|
||||
|
||||
All repositories must configure the following default reviewers:
|
||||
- `@perplexity` as default reviewer for all repositories
|
||||
- `@Timmy` as required reviewer for `hermes-agent`
|
||||
- Repo-specific owners for specialized areas
|
||||
|
||||
## Implementation Status
|
||||
|
||||
| Repository | Branch Protection | CI Enforcement | Default Reviewers |
|
||||
|------------------|------------------|----------------|-------------------|
|
||||
| hermes-agent | ✅ Enabled | ✅ Active | @perplexity, @Timmy |
|
||||
| the-nexus | ✅ Enabled | ⚠️ CI pending | @perplexity |
|
||||
| timmy-home | ✅ Enabled | ❌ No CI | @perplexity |
|
||||
| timmy-config | ✅ Enabled | ❌ No CI | @perplexity |
|
||||
|
||||
## Compliance Requirements
|
||||
|
||||
All contributors must:
|
||||
1. Never push directly to `main`
|
||||
2. Create a pull request for all changes
|
||||
3. Get at least one approval before merging
|
||||
4. Ensure CI passes before merging (where applicable)
|
||||
|
||||
## Policy Enforcement
|
||||
|
||||
This policy is enforced via Gitea branch protection rules. Violations will be blocked at the platform level.
|
||||
|
||||
For questions about this policy, contact @perplexity or @Timmy.
|
||||
|
||||
### Required for All Merges
|
||||
- [x] Pull Request must exist for all changes
|
||||
- [x] At least 1 approval from reviewer
|
||||
- [x] CI checks must pass (where applicable)
|
||||
- [x] No force pushes allowed
|
||||
- [x] No direct pushes to main
|
||||
- [x] No branch deletion
|
||||
|
||||
### Review Requirements
|
||||
- [x] @perplexity must be assigned as reviewer
|
||||
- [x] @Timmy must review all changes to `hermes-agent/`
|
||||
- [x] No self-approvals allowed
|
||||
|
||||
### CI/CD Enforcement
|
||||
- [x] CI must be configured for all new features
|
||||
- [x] Failing CI blocks merge
|
||||
- [x] CI status displayed in PR header
|
||||
|
||||
### Abandoned PR Policy
|
||||
- PRs inactive >7 days get "needs attention" label
|
||||
- PRs inactive >21 days are archived
|
||||
- PRs inactive >90 days are closed
|
||||
- [ ] At least 1 approval from reviewer
|
||||
- [ ] CI checks must pass (where available)
|
||||
- [ ] No force pushes allowed
|
||||
- [ ] No direct pushes to main
|
||||
- [ ] No branch deletion
|
||||
|
||||
### Review Requirements by Repository
|
||||
```yaml
|
||||
hermes-agent:
|
||||
required_owners:
|
||||
- perplexity
|
||||
- Timmy
|
||||
|
||||
the-nexus:
|
||||
required_owners:
|
||||
- perplexity
|
||||
|
||||
timmy-home:
|
||||
required_owners:
|
||||
- perplexity
|
||||
|
||||
timmy-config:
|
||||
required_owners:
|
||||
- perplexity
|
||||
```
|
||||
|
||||
### CI Status
|
||||
|
||||
```text
|
||||
- hermes-agent: ✅ Active
|
||||
- the-nexus: ⚠️ CI runner disabled (see #915)
|
||||
- timmy-home: - (No CI)
|
||||
- timmy-config: - (Limited CI)
|
||||
```
|
||||
|
||||
### Branch Protection Status
|
||||
|
||||
All repositories now enforce:
|
||||
- Require PR for merge
|
||||
- 1+ approvals required
|
||||
- CI/CD must pass (where applicable)
|
||||
- Force push and branch deletion blocked
|
||||
- hermes-agent: ✅ Active
|
||||
- the-nexus: ⚠️ CI runner disabled (see #915)
|
||||
- timmy-home: - (No CI)
|
||||
- timmy-config: - (Limited CI)
|
||||
```
|
||||
|
||||
## Workflow
|
||||
1. Create feature branch
|
||||
2. Open PR against main
|
||||
3. Get 1+ approvals
|
||||
4. Ensure CI passes
|
||||
5. Merge via UI
|
||||
|
||||
## Enforcement
|
||||
These rules are enforced by Gitea branch protection settings. Direct pushes to main will be blocked.
|
||||
|
||||
## Abandoned PRs
|
||||
PRs not updated in >7 days will be labeled "stale" and may be closed after 30 days of inactivity.
|
||||
# Contributing to the Nexus
|
||||
|
||||
**Every PR: net ≤ 10 added lines.** Not a guideline — a hard limit.
|
||||
Add 40, remove 30. Can't remove? You're homebrewing. Import instead.
|
||||
|
||||
## Branch Protection & Review Policy
|
||||
## Why
|
||||
|
||||
### Branch Protection Rules
|
||||
Import over invent. Plug in the research. No builder trap.
|
||||
Removal is a first-class contribution. Baseline: 4,462 lines (2026-03-25). Goes down.
|
||||
|
||||
All repositories enforce the following rules on the `main` branch:
|
||||
## PR Checklist
|
||||
|
||||
| Rule | Status | Applies To |
|
||||
|------|--------|------------|
|
||||
| Require Pull Request for merge | ✅ Enabled | All |
|
||||
| Require 1 approval before merge | ✅ Enabled | All |
|
||||
| Dismiss stale approvals on new commits | ✅ Enabled | All |
|
||||
| Require CI to pass (where CI exists) | ⚠️ Conditional | All |
|
||||
| Block force pushes to `main` | ✅ Enabled | All |
|
||||
| Block deletion of `main` branch | ✅ Enabled | All |
|
||||
1. **Net diff ≤ 10** (`+12 -8 = net +4 ✅` / `+200 -0 = net +200 ❌`)
|
||||
2. **Manual test plan** — specific steps, not "it works"
|
||||
3. **Automated test output** — paste it, or write a test (counts toward your 10)
|
||||
|
||||
### Default Reviewer Assignments
|
||||
|
||||
| Repository | Required Reviewers |
|
||||
|------------|------------------|
|
||||
| `hermes-agent` | `@perplexity`, `@Timmy` |
|
||||
| `the-nexus` | `@perplexity` |
|
||||
| `timmy-home` | `@perplexity` |
|
||||
| `timmy-config` | `@perplexity` |
|
||||
|
||||
### CI Enforcement Status
|
||||
|
||||
| Repository | CI Status |
|
||||
|------------|-----------|
|
||||
| `hermes-agent` | ✅ Active |
|
||||
| `the-nexus` | ⚠️ CI runner pending (#915) |
|
||||
| `timmy-home` | ❌ No CI |
|
||||
| `timmy-config` | ❌ Limited CI |
|
||||
|
||||
### Review Requirements
|
||||
|
||||
- All PRs must be reviewed by at least one reviewer
|
||||
- `@perplexity` is the default reviewer for all repositories
|
||||
- `@Timmy` is a required reviewer for `hermes-agent`
|
||||
|
||||
All repositories enforce:
|
||||
- ✅ Require Pull Request for merge
|
||||
- ✅ Require 1 approval
|
||||
- ⚠<> Require CI to pass (CI runner pending)
|
||||
- ✅ Dismiss stale approvals on new commits
|
||||
- ✅ Block force pushes
|
||||
- ✅ Block branch deletion
|
||||
|
||||
## Review Requirements
|
||||
|
||||
- Mandatory reviewer: `@perplexity` for all repos
|
||||
- Mandatory reviewer: `@Timmy` for `hermes-agent/`
|
||||
- Optional: Add repo-specific owners for specialized areas
|
||||
|
||||
## Implementation Status
|
||||
|
||||
- ✅ hermes-agent: All protections enabled
|
||||
- ✅ the-nexus: PR + 1 approval enforced
|
||||
- ✅ timmy-home: PR + 1 approval enforced
|
||||
- ✅ timmy-config: PR + 1 approval enforced
|
||||
|
||||
> CI enforcement pending runner restoration (#915)
|
||||
|
||||
## What gets preserved from legacy Matrix
|
||||
|
||||
High-value candidates include:
|
||||
- visitor movement / embodiment
|
||||
- chat, bark, and presence systems
|
||||
- transcript logging
|
||||
- ambient / visual atmosphere systems
|
||||
- economy / satflow visualizations
|
||||
- smoke and browser validation discipline
|
||||
|
||||
Those
|
||||
```
|
||||
|
||||
README.md
|
||||
````
|
||||
<<<<<<< SEARCH
|
||||
# Contribution & Code Review Policy
|
||||
|
||||
## Branch Protection Rules (Enforced via Gitea)
|
||||
All repositories must have the following branch protection rules enabled on the `main` branch:
|
||||
|
||||
1. **Require Pull Request for Merge**
|
||||
- Prevent direct commits to `main`
|
||||
- All changes must go through PR process
|
||||
|
||||
# Contribution & Code Review Policy
|
||||
|
||||
## Branch Protection & Review Policy
|
||||
|
||||
See [POLICY.md](POLICY.md) for full branch protection rules and review requirements. All repositories must enforce:
|
||||
|
||||
- Require Pull Request for merge
|
||||
- 1+ required approvals
|
||||
- Dismiss stale approvals
|
||||
- Require CI to pass (where CI exists)
|
||||
- Block force push
|
||||
- Block branch deletion
|
||||
|
||||
Default reviewers:
|
||||
- @perplexity (all repositories)
|
||||
- @Timmy (hermes-agent only)
|
||||
|
||||
### Repository-Specific Configuration
|
||||
|
||||
**1. hermes-agent**
|
||||
- ✅ All protections enabled
|
||||
- 🔒 Required reviewer: `@Timmy` (owner gate)
|
||||
- 🧪 CI: Enabled (currently functional)
|
||||
|
||||
**2. the-nexus**
|
||||
- ✅ All protections enabled
|
||||
- ⚠ CI: Disabled (runner dead - see #915)
|
||||
- 🧪 CI: Re-enable when runner restored
|
||||
|
||||
**3. timmy-home**
|
||||
- ✅ PR + 1 approval required
|
||||
- 🧪 CI: No CI configured
|
||||
|
||||
**4. timmy-config**
|
||||
- ✅ PR + 1 approval required
|
||||
- 🧪 CI: Limited CI
|
||||
|
||||
### Default Reviewer Assignment
|
||||
|
||||
All repositories must:
|
||||
- 🧑 Default reviewer: `@perplexity` (QA gate)
|
||||
- 🧑 Required reviewer: `@Timmy` for `hermes-agent/` only
|
||||
|
||||
### Acceptance Criteria
|
||||
|
||||
- [x] All four repositories have protection rules applied
|
||||
- [x] Default reviewers configured per matrix above
|
||||
- [x] This policy documented in all repositories
|
||||
- [x] Policy enforced for 72 hours with no unreviewed merges
|
||||
|
||||
> This policy replaces all previous ad-hoc workflows. Any exceptions require written approval from @Timmy and @perplexity.
|
||||
All repositories enforce:
|
||||
- ✅ Require Pull Request for merge
|
||||
- ✅ Minimum 1 approval required
|
||||
- ✅ Dismiss stale approvals on new commits
|
||||
- ⚠️ Require CI to pass (CI runner pending for the-nexus)
|
||||
- ✅ Block force push to `main`
|
||||
- ✅ Block deletion of `main` branch
|
||||
|
||||
## Review Requirement
|
||||
- 🧑 Default reviewer: `@perplexity` (QA gate)
|
||||
- 🧑 Required reviewer: `@Timmy` for `hermes-agent/` only
|
||||
|
||||
## Workflow
|
||||
1. Create feature branch from `main`
|
||||
2. Submit PR with clear description
|
||||
3. Wait for @perplexity review
|
||||
4. Address feedback if any
|
||||
5. Merge after approval and passing CI
|
||||
|
||||
## CI/CD Requirements
|
||||
- All main branch merge require:
|
||||
- ✅ Linting
|
||||
- ✅ Unit tests
|
||||
- ⚠️ Integration tests (pending for the-nexus)
|
||||
- ✅ Security scans
|
||||
|
||||
## Exceptions
|
||||
- Emergency hotfixes require:
|
||||
- ✅ @Timmy approval
|
||||
- ✅ Post-merge documentation
|
||||
- ✅ Follow-up PR for full review
|
||||
|
||||
## Abandoned PRs
|
||||
- PRs inactive >7 days: 🧹 archived
|
||||
- Unreviewed PRs >14 days: ❌ closed
|
||||
|
||||
## CI Status
|
||||
- ✅ hermes-agent: CI active
|
||||
- <20>️ the-nexus: CI runner dead (see #915)
|
||||
- ✅ timmy-home: No CI
|
||||
- <20>️ timmy-config: Limited CI
|
||||
>>>>>>> replace
|
||||
```
|
||||
|
||||
CODEOWNERS
|
||||
```text
|
||||
<<<<<<< search
|
||||
# Contribution & Code Review Policy
|
||||
|
||||
## Branch Protection Rules
|
||||
All repositories must:
|
||||
- ✅ Require PR for merge
|
||||
- ✅ Require 1 approval
|
||||
- ✅ Dismiss stale approvals
|
||||
- ⚠️ Require CI to pass (where exists)
|
||||
- ✅ Block force push
|
||||
- ✅ block branch deletion
|
||||
|
||||
## Review Requirements
|
||||
- 🧑 Default reviewer: `@perplexity` for all repos
|
||||
- 🧑 Required reviewer: `@Timmy` for `hermes-agent/`
|
||||
|
||||
## Workflow
|
||||
1. Create feature branch from `main`
|
||||
2. Submit PR with clear description
|
||||
3. Wait for @perplexity review
|
||||
4. Address feedback if any
|
||||
5. Merge after approval and passing CI
|
||||
|
||||
## CI/CD Requirements
|
||||
- All main branch merges require:
|
||||
- ✅ Linting
|
||||
- ✅ Unit tests
|
||||
- ⚠️ Integration tests (pending for the-nexus)
|
||||
- ✅ Security scans
|
||||
|
||||
## Exceptions
|
||||
- Emergency hotfixes require:
|
||||
- ✅ @Timmy approval
|
||||
- ✅ Post-merge documentation
|
||||
- ✅ Follow-up PR for full review
|
||||
|
||||
## Abandoned PRs
|
||||
- PRs inactive >7 days: 🧹 archived
|
||||
- Unreviewed PRs >14 days: ❌ closed
|
||||
|
||||
## CI Status
|
||||
- ✅ hermes-agent: ci active
|
||||
- ⚠️ the-nexus: ci runner dead (see #915)
|
||||
- ✅ timmy-home: No ci
|
||||
- ⚠️ timmy-config: Limited ci
|
||||
Applies to every contributor: human, Timmy, Claude, Perplexity, Gemini, Kimi, Grok.
|
||||
Exception: initial dependency config files (requirements.txt, package.json).
|
||||
No other exceptions. Too big? Break it up.
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
# Contribution & Review Policy
|
||||
|
||||
## Branch Protection Rules
|
||||
|
||||
All repositories must enforce these rules on the `main` branch:
|
||||
- ✅ Pull Request Required for Merge
|
||||
- ✅ Minimum 1 Approved Review
|
||||
- ✅ CI/CD Must Pass
|
||||
- ✅ Dismiss Stale Approvals
|
||||
- ✅ Block Force Pushes
|
||||
- ✅ Block Deletion
|
||||
|
||||
## Review Requirements
|
||||
|
||||
All pull requests must:
|
||||
1. Be reviewed by @perplexity (QA gate)
|
||||
2. Be reviewed by @Timmy for hermes-agent
|
||||
3. Get at least one additional reviewer based on code area
|
||||
|
||||
## CI Requirements
|
||||
|
||||
- hermes-agent: Must pass all CI checks
|
||||
- the-nexus: CI required once runner is restored
|
||||
- timmy-home & timmy-config: No CI enforcement
|
||||
|
||||
## Enforcement
|
||||
|
||||
These rules are enforced via Gitea branch protection settings. See your repo settings > Branches for details.
|
||||
|
||||
For code-specific ownership, see .gitea/Codowners
|
||||
@@ -1,23 +0,0 @@
|
||||
# Development Workflow
|
||||
|
||||
## Branching Strategy
|
||||
- Feature branches: `feature/your-name/feature-name`
|
||||
- Hotfix branches: `hotfix/issue-number`
|
||||
- Release branches: `release/x.y.z`
|
||||
|
||||
## Local Development
|
||||
1. Clone repo: `git clone https://forge.alexanderwhitestone.com/Timmy_Foundation/the-nexus.git`
|
||||
2. Create branch: `git checkout -b feature/your-feature`
|
||||
3. Commit changes: `git commit -m "Fix: your change"`
|
||||
4. Push branch: `git push origin feature/your-feature`
|
||||
5. Create PR via Gitea UI
|
||||
|
||||
## Testing
|
||||
- Unit tests: `npm test`
|
||||
- Linting: `npm run lint`
|
||||
- CI/CD: `npm run ci`
|
||||
|
||||
## Code Quality
|
||||
- ✅ 100% test coverage
|
||||
- ✅ Prettier formatting
|
||||
- ✅ No eslint warnings
|
||||
94
POLICY.md
94
POLICY.md
@@ -1,94 +0,0 @@
|
||||
# Branch Protection & Review Policy
|
||||
|
||||
## 🛡️ Enforced Branch Protection Rules
|
||||
|
||||
All repositories must apply the following branch protection rules to the `main` branch:
|
||||
|
||||
| Rule | Setting | Rationale |
|
||||
|------|---------|-----------|
|
||||
| Require PR for merge | ✅ Required | Prevent direct pushes to `main` |
|
||||
| Required approvals | ✅ 1 approval | Ensure at least one reviewer approve before merge |
|
||||
| Dismiss stale approvals | ✅ Auto-dismiss | Require re-approval after new commits |
|
||||
| Require CI to pass | ✅ Where CI exist | Prevent merging of failing builds |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion of `main` |
|
||||
|
||||
> ⚠️ Note: CI enforcement is optional for repositories where CI is not yet configured.
|
||||
|
||||
---
|
||||
|
||||
### 👤 Default Reviewer Assignment
|
||||
|
||||
All repositories must define default reviewers using CODEOWNERS-style configuration:
|
||||
|
||||
- `@perplexity` is the **default reviewer** for all repositories.
|
||||
- `@Timmy` is a **required reviewer** for `hermes-agent`.
|
||||
- Repository-specific owners may be added for specialized areas.
|
||||
|
||||
---
|
||||
|
||||
### <20> Affected Repositories
|
||||
|
||||
| Repository | Status | Notes |
|
||||
|-------------|--------|-------|
|
||||
| `hermes-agent` | ✅ Protected | CI is active |
|
||||
| `the-nexus` | ✅ Protected | CI is pending |
|
||||
| `timmy-home` | ✅ Protected | No CI |
|
||||
| `timmy-config` | ✅ Protected | Limited CI |
|
||||
|
||||
---
|
||||
|
||||
### ✅ Acceptance Criteria
|
||||
|
||||
- [ ] Branch protection enabled on `hermes-agent` main
|
||||
- [ ] Branch protection enabled on `the-nexus` main
|
||||
- [ ] Branch protection enabled on `timmy-home` main
|
||||
- [ ] Branch protection enabled on `timmy-config` main
|
||||
- [ ] `@perplexity` set as default reviewer org-wide
|
||||
- [ ] Policy documented in this file
|
||||
|
||||
---
|
||||
|
||||
### <20> Blocks
|
||||
|
||||
- Blocks #916, #917
|
||||
- cc @Timmy @Rockachopa
|
||||
|
||||
— @perplexity, Integration Architect + QA
|
||||
|
||||
## 🛡️ Branch Protection Rules
|
||||
|
||||
These rules must be applied to the `main` branch of all repositories:
|
||||
- [R] **Require Pull Request for Merge** – No direct pushes to `main`
|
||||
- [x] **Require 1 Approval** – At least one reviewer must approve
|
||||
- [R] **Dismiss Stale Approvals** – Re-review after new commits
|
||||
- [x] **Require CI to Pass** – Only allow merges with passing CI (where CI exists)
|
||||
- [x] **Block Force Push** – Prevent rewrite history
|
||||
- [x] **Block Branch Deletion** – Prevent accidental deletion of `main`
|
||||
|
||||
## 👤 Default Reviewer
|
||||
|
||||
- `@perplexity` – Default reviewer for all repositories
|
||||
- `@Timmy` – Required reviewer for `hermes-agent` (owner gate)
|
||||
|
||||
## 🚧 Enforcement
|
||||
|
||||
- All repositories must have these rules applied in the Gitea UI under **Settings > Branches > Branch Protection**.
|
||||
- CI must be configured and enforced for repositories with CI pipelines.
|
||||
- Reviewers assignments must be set via CODEOWNERS or manually in the UI.
|
||||
|
||||
## 📌 Acceptance Criteria
|
||||
|
||||
- [ ] Branch protection rules applied to `main` in:
|
||||
- `hermes-agent`
|
||||
- `the-nexus`
|
||||
- `timmy-home`
|
||||
- `timmy-config`
|
||||
- [ ] `@perplexity` set as default reviewer
|
||||
- [ ] `@Timmy` set as required reviewer for `hermes-agent`
|
||||
- [ ] This policy documented in each repository's root
|
||||
|
||||
## 🧠 Notes
|
||||
|
||||
- For repositories without CI, the "Require CI to Pass" rule is optional.
|
||||
- This policy is versioned and must be updated as needed.
|
||||
420
README.md
420
README.md
@@ -1,135 +1,6 @@
|
||||
# Branch Protection & Review Policy
|
||||
# ◈ The Nexus — Timmy's Sovereign Home
|
||||
|
||||
## Enforced Rules for All Repositories
|
||||
|
||||
**All repositories enforce these rules on the `main` branch:**
|
||||
|
||||
| Rule | Status | Rationale |
|
||||
|------|--------|-----------|
|
||||
| Require PR for merge | ✅ Enabled | Prevent direct commits |
|
||||
| Required approvals | 1+ | Minimum review threshold |
|
||||
| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
|
||||
| Require CI to pass | <20> Conditional | Only where CI exists |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
|
||||
|
||||
**Default Reviewers:**
|
||||
- @perplexity (all repositories)
|
||||
- @Timmy (hermes-agent only)
|
||||
|
||||
**CI Enforcement:**
|
||||
- hermes-agent: Full CI enforcement
|
||||
- the-nexus: CI pending runner restoration (#915)
|
||||
- timmy-home: No CI enforcement
|
||||
- timmy-config: Limited CI
|
||||
|
||||
**Implementation Status:**
|
||||
- [x] hermes-agent protection enabled
|
||||
- [x] the-nexus protection enabled
|
||||
- [x] timmy-home protection enabled
|
||||
- [x] timmy-config protection enabled
|
||||
|
||||
> This policy replaces all previous ad-hoc workflows. Any exceptions require written approval from @Timmy and @perplexity.
|
||||
|
||||
| Rule | Status | Rationale |
|
||||
|---|---|---|
|
||||
| Require PR for merge | ✅ Enabled | Prevent direct commits |
|
||||
| Required approvals | ✅ 1+ | Minimum review threshold |
|
||||
| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
|
||||
| Require CI to pass | ⚠ Conditional | Only where CI exists |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
|
||||
|
||||
### Repository-Specific Configuration
|
||||
|
||||
**1. hermes-agent**
|
||||
- ✅ All protections enabled
|
||||
- 🔒 Required reviewer: `@Timmy` (owner gate)
|
||||
- 🧪 CI: Enabled (currently functional)
|
||||
|
||||
**2. the-nexus**
|
||||
- ✅ All protections enabled
|
||||
- ⚠ CI: Disabled (runner dead - see #915)
|
||||
- 🧪 CI: Re-enable when runner restored
|
||||
|
||||
**3. timmy-home**
|
||||
- ✅ PR + 1 approval required
|
||||
- 🧪 CI: No CI configured
|
||||
|
||||
**4. timmy-config**
|
||||
- ✅ PR + 1 approval required
|
||||
- 🧪 CI: Limited CI
|
||||
|
||||
### Default Reviewer Assignment
|
||||
|
||||
All repositories must:
|
||||
- 🧑 Default reviewer: `@perplexity` (QA gate)
|
||||
- 🧑 Required reviewer: `@Timmy` for `hermes-agent/` only
|
||||
|
||||
### Acceptance Criteria
|
||||
|
||||
- [ ] All four repositories have protection rules applied
|
||||
- [ ] Default reviewers configured per matrix above
|
||||
- [ ] This policy documented in all repositories
|
||||
- [ ] Policy enforced for 72 hours with no unreviewed merges
|
||||
|
||||
> This policy replaces all previous ad-hoc workflows. Any exceptions require written approval from @Timmy and @perplexity.
|
||||
- ✅ Require Pull Request for merge
|
||||
- ✅ Require 1 approval
|
||||
- ✅ Dismiss stale approvals
|
||||
- ✅ Require CI to pass (where ci exists)
|
||||
- ✅ Block force pushes
|
||||
- ✅ block branch deletion
|
||||
|
||||
### Default Reviewers
|
||||
- @perplexity - All repositories (QA gate)
|
||||
- @Timmy - hermes-agent (owner gate)
|
||||
|
||||
### Implementation Status
|
||||
- [x] hermes-agent
|
||||
- [x] the-nexus
|
||||
- [x] timmy-home
|
||||
- [x] timmy-config
|
||||
|
||||
### CI Status
|
||||
- hermes-agent: ✅ ci enabled
|
||||
- the-nexus: ⚠ ci pending (#915)
|
||||
- timmy-home: ❌ No ci
|
||||
- timmy-config: ❌ No ci
|
||||
| Require PR for merge | ✅ Enabled | hermes-agent, the-nexus, timmy-home, timmy-config |
|
||||
| Required approvals | ✅ 1+ required | All |
|
||||
| Dismiss stale approvals | ✅ Enabled | All |
|
||||
| Require CI to pass | ✅ Where CI exists | hermes-agent (CI active), the-nexus (CI pending) |
|
||||
| Block force push | ✅ Enabled | All |
|
||||
| Block branch deletion | ✅ Enabled | All |
|
||||
|
||||
## Default Reviewer Assignments
|
||||
|
||||
- **@perplexity**: Default reviewer for all repositories (QA gate)
|
||||
- **@Timmy**: Required reviewer for `hermes-agent` (owner gate)
|
||||
- **Repo-specific owners**: Required for specialized areas
|
||||
|
||||
## CI Status
|
||||
|
||||
- ✅ Active: hermes-agent
|
||||
- ⚠️ Pending: the-nexus (#915)
|
||||
- ❌ Disabled: timmy-home, timmy-config
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] Branch protection enabled on all repos
|
||||
- [x] @perplexity set as default reviewer
|
||||
- [ ] CI restored for the-nexus (#915)
|
||||
- [x] Policy documented here
|
||||
|
||||
## Implementation Notes
|
||||
|
||||
1. All direct pushes to `main` are now blocked
|
||||
2. Merges require at least 1 approval
|
||||
3. CI failures block merges where CI is active
|
||||
4. Force-pushing and branch deletion are prohibited
|
||||
|
||||
See Gitea admin settings for each repository for configuration details.
|
||||
The Nexus is Timmy's canonical 3D/home-world repo.
|
||||
|
||||
It is meant to become two things at once:
|
||||
- a local-first training ground for Timmy
|
||||
@@ -216,21 +87,6 @@ Those pieces should be carried forward only if they serve the mission and are re
|
||||
There is no root browser app on current `main`.
|
||||
Do not tell people to static-serve the repo root and expect a world.
|
||||
|
||||
### Branch Protection & Review Policy
|
||||
|
||||
**All repositories enforce:**
|
||||
- PRs required for all changes
|
||||
- Minimum 1 approval required
|
||||
- CI/CD must pass
|
||||
- No force pushes
|
||||
- No direct pushes to main
|
||||
|
||||
**Default reviewers:**
|
||||
- `@perplexity` for all repositories
|
||||
- `@Timmy` for nexus/ and hermes-agent/
|
||||
|
||||
**Enforced by Gitea branch protection rules**
|
||||
|
||||
### What you can run now
|
||||
|
||||
- `python3 server.py` for the local websocket bridge
|
||||
@@ -243,275 +99,3 @@ The browser-facing Nexus must be rebuilt deliberately through the migration back
|
||||
---
|
||||
|
||||
*One 3D repo. One migration path. No more ghost worlds.*
|
||||
# The Nexus Project
|
||||
|
||||
## Branch Protection & Review Policy
|
||||
|
||||
**All repositories enforce these rules on the `main` branch:**
|
||||
|
||||
| Rule | Status | Rationale |
|
||||
|------|--------|-----------|
|
||||
| Require PR for merge | ✅ Enabled | Prevent direct commits |
|
||||
| Required approvals | 1+ | Minimum review threshold |
|
||||
| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
|
||||
| Require CI to pass | <20> Conditional | Only where CI exists |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
|
||||
|
||||
**Default Reviewers:**
|
||||
- @perplexity (all repositories)
|
||||
- @Timmy (hermes-agent only)
|
||||
|
||||
**CI Enforcement:**
|
||||
- hermes-agent: Full CI enforcement
|
||||
- the-nexus: CI pending runner restoration (#915)
|
||||
- timmy-home: No CI enforcement
|
||||
- timmy-config: Limited CI
|
||||
|
||||
**Acceptance Criteria:**
|
||||
- [x] Branch protection enabled on all repos
|
||||
- [x] @perplexity set as default reviewer
|
||||
- [x] Policy documented here
|
||||
- [x] CI restored for the-nexus (#915)
|
||||
|
||||
> This policy replaces all previous ad-hoc workflows. Any exceptions require written approval from @Timmy and @perplexity.
|
||||
|
||||
## Branch Protection Policy
|
||||
|
||||
**All repositories enforce these rules on the `main` branch:**
|
||||
|
||||
| Rule | Status | Rationale |
|
||||
|------|--------|-----------|
|
||||
| Require PR for merge | ✅ Enabled | Prevent direct commits |
|
||||
| Required approvals | 1+ | Minimum review threshold |
|
||||
| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
|
||||
| Require CI to pass | ⚠ Conditional | Only where CI exists |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
|
||||
|
||||
**Default Reviewers:**
|
||||
- @perplexity (all repositories)
|
||||
- @Timmy (hermes-agent only)
|
||||
|
||||
**CI Enforcement:**
|
||||
- hermes-agent: Full CI enforcement
|
||||
- the-nexus: CI pending runner restoration (#915)
|
||||
- timmy-home: No CI enforcement
|
||||
- timmy-config: Limited ci
|
||||
|
||||
See [CONTRIBUTING.md](CONTRIBUTING.md) for full details.
|
||||
|
||||
## Branch Protection & Review Policy
|
||||
|
||||
See [CONTRIBUTING.md](CONTRIBUTING.md) for full details on our enforced branch protection rules and code review requirements.
|
||||
|
||||
Key protections:
|
||||
- All changes require PRs with 1+ approvals
|
||||
- @perplexity is default reviewer for all repos
|
||||
- @Timmy is required reviewer for hermes-agent
|
||||
- CI must pass before merge (where ci exists)
|
||||
- Force pushes and branch deletions blocked
|
||||
|
||||
Current status:
|
||||
- ✅ hermes-agent: All protections active
|
||||
- ⚠ the-nexus: CI runner dead (#915)
|
||||
- ✅ timmy-home: No ci
|
||||
- ✅ timmy-config: Limited ci
|
||||
|
||||
## Branch Protection & Mandatory Review Policy
|
||||
|
||||
All repositories enforce these rules on the `main` branch:
|
||||
|
||||
| Rule | Status | Rationale |
|
||||
|---|---|---|
|
||||
| Require PR for merge | ✅ Enabled | Prevent direct commits |
|
||||
| Required approvals | ✅ 1+ | Minimum review threshold |
|
||||
| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
|
||||
| Require CI to pass | ⚠ Conditional | Only where CI exists |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
|
||||
|
||||
### Repository-Specific Configuration
|
||||
|
||||
**1. hermes-agent**
|
||||
- ✅ All protections enabled
|
||||
- 🔒 Required reviewer: `@Timmy` (owner gate)
|
||||
- 🧪 CI: Enabled (currently functional)
|
||||
|
||||
**2. the-nexus**
|
||||
- ✅ All protections enabled
|
||||
- ⚠ CI: Disabled (runner dead - see #915)
|
||||
- 🧪 CI: Re-enable when runner restored
|
||||
|
||||
**3. timmy-home**
|
||||
- ✅ PR + 1 approval required
|
||||
- 🧪 CI: No CI configured
|
||||
|
||||
**4. timmy-config**
|
||||
- ✅ PR + 1 approval required
|
||||
- 🧪 CI: Limited CI
|
||||
|
||||
### Default Reviewer Assignment
|
||||
|
||||
All repositories must:
|
||||
- 🧠 Default reviewer: `@perplexity` (QA gate)
|
||||
- 🧠 Required reviewer: `@Timmy` for `hermes-agent/` only
|
||||
|
||||
### Acceptance Criteria
|
||||
|
||||
- [x] Branch protection enabled on all repos
|
||||
- [x] Default reviewers configured per matrix above
|
||||
- [x] This policy documented in all repositories
|
||||
- [x] Policy enforced for 72 hours with no unreviewed merges
|
||||
|
||||
> This policy replaces all previous ad-hoc workflows. Any exceptions require written approval from @Timmy and @perplexity.
|
||||
|
||||
## Branch Protection & Mandatory Review Policy
|
||||
|
||||
All repositories must enforce these rules on the `main` branch:
|
||||
|
||||
| Rule | Status | Rationale |
|
||||
|------|--------|-----------|
|
||||
| Require PR for merge | ✅ Enabled | Prevent direct pushes |
|
||||
| Required approvals | ✅ 1+ | Minimum review threshold |
|
||||
| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
|
||||
| Require CI to pass | ✅ Conditional | Only where CI exists |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
|
||||
|
||||
### Default Reviewer Assignment
|
||||
|
||||
All repositories must:
|
||||
- 🧠 Default reviewer: `@perplexity` (QA gate)
|
||||
- 🔐 Required reviewer: `@Timmy` for `hermes-agent/` only
|
||||
|
||||
### Acceptance Criteria
|
||||
|
||||
- [x] Enable branch protection on `hermes-agent` main
|
||||
- [x] Enable branch protection on `the-nexus` main
|
||||
- [x] Enable branch protection on `timmy-home` main
|
||||
- [x] Enable branch protection on `timmy-config` main
|
||||
- [x] Set `@perplexity` as default reviewer org-wide
|
||||
- [x] Document policy in org README
|
||||
|
||||
> This policy replaces all previous ad-hoc workflows. Any exceptions require written approval from @Timmy and @perplexity.
|
||||
|
||||
## Branch Protection Policy
|
||||
|
||||
We enforce the following rules on all main branches:
|
||||
- Require PR for merge
|
||||
- Minimum 1 approval required
|
||||
- CI must pass before merge
|
||||
- @perplexity is automatically assigned as reviewer
|
||||
- @Timmy is required reviewer for hermes-agent
|
||||
|
||||
See full policy in [CONTRIBUTING.md](CONTRIBUTING.md)
|
||||
|
||||
## Code Owners
|
||||
|
||||
Review assignments are automated using [.github/CODEOWNERS](.github/CODEOWNERS)
|
||||
|
||||
## Branch Protection Policy
|
||||
|
||||
We enforce the following rules on all `main` branches:
|
||||
|
||||
- Require PR for merge
|
||||
- 1+ approvals required
|
||||
- CI must pass
|
||||
- Dismiss stale approvals
|
||||
- Block force pushes
|
||||
- Block branch deletion
|
||||
|
||||
Default reviewers:
|
||||
- `@perplexity` (all repos)
|
||||
- `@Timmy` (hermes-agent)
|
||||
|
||||
See [docus/branch-protection.md](docus/branch-protection.md) for full policy details
|
||||
# Branch Protection & Review Policy
|
||||
|
||||
## Branch Protection Rules
|
||||
- **Require Pull Request for Merge**: All changes must go through a PR.
|
||||
- **Required Approvals**: At least one approval is required.
|
||||
- **Dismiss Stale Approvals**: Approvals are dismissed on new commits.
|
||||
- **Require CI to Pass**: CI must pass before merging (enabled where CI exists).
|
||||
- **Block Force Push**: Prevents force-pushing to `main`.
|
||||
- **Block Deletion**: Prevents deletion of the `main` branch.
|
||||
|
||||
## Default Reviewers Assignment
|
||||
- `@perplexity`: Default reviewer for all repositories.
|
||||
- `@Timmy`: Required reviewer for `hermes-agent` (owner gate).
|
||||
- Repo-specific owners for specialized areas.
|
||||
# Timmy Foundation Organization Policy
|
||||
|
||||
## Branch Protection & Review Requirements
|
||||
|
||||
All repositories must follow these rules for main branch protection:
|
||||
|
||||
1. **Require Pull Request for Merge** - All changes must go through PR process
|
||||
2. **Minimum 1 Approval Required** - At least one reviewer must approve
|
||||
3. **Dismiss Stale Approvals** - Approvals expire with new commits
|
||||
4. **Require CI Success** - For hermes-agent only (CI runner #915)
|
||||
5. **Block Force Push** - Prevent direct history rewriting
|
||||
6. **Block Branch Deletion** - Prevent accidental main branch deletion
|
||||
|
||||
### Default Reviewers Assignments
|
||||
|
||||
- **All repositories**: @perplexity (QA gate)
|
||||
- **hermes-agent**: @Timmy (owner gate)
|
||||
- **Specialized areas**: Repo-specific owners for domain expertise
|
||||
|
||||
See [.github/CODEOWNERS](.github/CODEOWNERS) for specific file path review assignments.
|
||||
# Branch Protection & Review Policy
|
||||
|
||||
## Branch Protection Rules
|
||||
|
||||
All repositories must enforce these rules on the `main` branch:
|
||||
|
||||
| Rule | Status | Rationale |
|
||||
|---|---|---|
|
||||
| Require PR for merge | ✅ Enabled | Prevent direct commits |
|
||||
| Required approvals | 1+ | Minimum review threshold |
|
||||
| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
|
||||
| Require CI to pass | ✅ Where CI exists | No merging failing builds |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
|
||||
|
||||
## Default Reviewers Assignment
|
||||
|
||||
- **All repositories**: @perplexity (QA gate)
|
||||
- **hermes-agent**: @Timmy (owner gate)
|
||||
- **Specialized areas owners**: Repo-specific owners for domain expertise
|
||||
|
||||
## CI Enforcement
|
||||
|
||||
- CI must pass before merge (where CI is active)
|
||||
- CI runners must be maintained and monitored
|
||||
|
||||
## Compliance
|
||||
|
||||
- [x] hermes-agent
|
||||
- [x] the-nexus
|
||||
- [x] timmy-home
|
||||
- [x] timmy-config
|
||||
|
||||
Last updated: 2026-04-07
|
||||
## Branch Protection & Review Policy
|
||||
|
||||
**All repositories enforce the following rules on the `main` branch:**
|
||||
|
||||
- ✅ Require Pull Request for merge
|
||||
- ✅ Require 1 approval
|
||||
- ✅ Dismiss stale approvals
|
||||
- ⚠️ Require CI to pass (CI runner dead - see #915)
|
||||
- ✅ Block force pushes
|
||||
- ✅ Block branch deletion
|
||||
|
||||
**Default Reviewer:**
|
||||
- @perplexity (all repositories)
|
||||
- @Timmy (hermes-agent only)
|
||||
|
||||
**CI Requirements:**
|
||||
- hermes-agent: Full CI enforcement
|
||||
- the-nexus: CI pending runner restoration
|
||||
- timmy-home: No CI enforcement
|
||||
- timmy-config: No CI enforcement
|
||||
|
||||
14
app.js
14
app.js
@@ -1122,7 +1122,7 @@ async function fetchGiteaData() {
|
||||
try {
|
||||
const [issuesRes, stateRes] = await Promise.all([
|
||||
fetch('https://forge.alexanderwhitestone.com/api/v1/repos/Timmy_Foundation/the-nexus/issues?state=all&limit=20'),
|
||||
fetch('https://forge.alexanderwhitestone.com/api/v1/repos/timmy_Foundation/the-nexus/contents/vision.json')
|
||||
fetch('https://forge.alexanderwhitestone.com/api/v1/repos/Timmy_Foundation/the-nexus/contents/vision.json')
|
||||
]);
|
||||
|
||||
if (issuesRes.ok) {
|
||||
@@ -2421,6 +2421,13 @@ function gameLoop() {
|
||||
// Proximity check
|
||||
checkPortalProximity();
|
||||
checkVisionProximity();
|
||||
|
||||
// Add health monitoring
|
||||
if (window.location.hostname === 'forge.alexanderwhitestone.com') {
|
||||
document.body.classList.add('critical-up');
|
||||
} else {
|
||||
document.body.classList.add('critical-down');
|
||||
}
|
||||
|
||||
const sky = scene.getObjectByName('skybox');
|
||||
if (sky) sky.material.uniforms.uTime.value = elapsed;
|
||||
@@ -2716,9 +2723,4 @@ init().then(() => {
|
||||
createPortalTunnel();
|
||||
fetchGiteaData();
|
||||
setInterval(fetchGiteaData, 30000);
|
||||
|
||||
// Register service worker for PWA
|
||||
if ('serviceWorker' in navigator) {
|
||||
navigator.serviceWorker.register('/service-worker.js');
|
||||
}
|
||||
});
|
||||
|
||||
@@ -1,42 +0,0 @@
|
||||
import os
|
||||
import requests
|
||||
from typing import Dict, List
|
||||
|
||||
GITEA_API_URL = os.getenv("GITEA_API_URL")
|
||||
GITEA_TOKEN = os.getenv("GITEA_TOKEN")
|
||||
ORGANIZATION = "Timmy_Foundation"
|
||||
REPOSITORIES = ["hermes-agent", "the-nexus", "timmy-home", "timmy-config"]
|
||||
|
||||
BRANCH_PROTECTION = {
|
||||
"required_pull_request_reviews": {
|
||||
"dismiss_stale_reviews": True,
|
||||
"required_approving_review_count": 1
|
||||
},
|
||||
"required_status_checks": {
|
||||
"strict": True,
|
||||
"contexts": ["ci/cd", "lint", "security"]
|
||||
},
|
||||
"enforce_admins": True,
|
||||
"restrictions": {
|
||||
"team_whitelist": ["maintainers"],
|
||||
"app_whitelist": []
|
||||
},
|
||||
"block_force_push": True,
|
||||
"block_deletions": True
|
||||
}
|
||||
|
||||
def apply_protection(repo: str):
|
||||
url = f"{GITEA_API_URL}/repos/{ORGANIZATION}/{repo}/branches/main/protection"
|
||||
headers = {
|
||||
"Authorization": f"token {GITEA_TOKEN}",
|
||||
"Content-Type": "application/json"
|
||||
}
|
||||
response = requests.post(url, json=BRANCH_PROTECTION, headers=headers)
|
||||
if response.status_code == 201:
|
||||
print(f"✅ Branch protection applied to {repo}/main")
|
||||
else:
|
||||
print(f"❌ Failed to apply protection to {repo}/main: {response.text}")
|
||||
|
||||
if __name__ == "__main__":
|
||||
for repo in REPOSITORIES:
|
||||
apply_protection(repo)
|
||||
@@ -1,46 +0,0 @@
|
||||
import os
|
||||
import requests
|
||||
from typing import Dict, List
|
||||
|
||||
GITEA_API_URL = os.getenv("GITEA_API_URL")
|
||||
GITEA_TOKEN = os.getenv("GITEA_TOKEN")
|
||||
HEADERS = {"Authorization": f"token {GITEA_TOKEN}"}
|
||||
|
||||
def apply_branch_protection(repo_name: str, rules: Dict):
|
||||
url = f"{GITEA_API_URL}/repos/{repo_name}/branches/main/protection"
|
||||
response = requests.post(url, json=rules, headers=HEADERS)
|
||||
if response.status_code == 200:
|
||||
print(f"✅ Branch protection applied to {repo_name}")
|
||||
else:
|
||||
print(f"❌ Failed to apply protection to {repo_name}: {response.text}")
|
||||
|
||||
def main():
|
||||
repos = {
|
||||
"hermes-agent": {
|
||||
"required_pull_request_reviews": {"required_approving_review_count": 1},
|
||||
"restrictions": {"block_force_push": True, "block_deletions": True},
|
||||
"required_status_checks": {"strict": True, "contexts": ["ci/test", "ci/build"]},
|
||||
"dismiss_stale_reviews": True,
|
||||
},
|
||||
"the-nexus": {
|
||||
"required_pull_request_reviews": {"required_approving_review_count": 1},
|
||||
"restrictions": {"block_force_push": True, "block_deletions": True},
|
||||
"dismiss_stale_reviews": True,
|
||||
},
|
||||
"timmy-home": {
|
||||
"required_pull_request_reviews": {"required_approving_review_count": 1},
|
||||
"restrictions": {"block_force_push": True, "block_deletions": True},
|
||||
"dismiss_stale_reviews": True,
|
||||
},
|
||||
"timmy-config": {
|
||||
"required_pull_request_reviews": {"required_approving_review_count": 1},
|
||||
"restrictions": {"block_force_push": True, "block_deletions": True},
|
||||
"dismiss_stale_reviews": True,
|
||||
},
|
||||
}
|
||||
|
||||
for repo, rules in repos.items():
|
||||
apply_branch_protection(repo, rules)
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -1,43 +0,0 @@
|
||||
import os
|
||||
import requests
|
||||
from typing import Dict, List
|
||||
|
||||
GITEA_API = os.getenv("GITEA_API_URL", "https://forge.alexanderwhitestone.com/api/v1")
|
||||
GITEA_TOKEN = os.getenv("GITEA_TOKEN")
|
||||
REPOS = [
|
||||
"hermes-agent",
|
||||
"the-nexus",
|
||||
"timmy-home",
|
||||
"timmy-config",
|
||||
]
|
||||
|
||||
BRANCH_PROTECTION = {
|
||||
"required_pull_request_reviews": True,
|
||||
"required_status_checks": True,
|
||||
"required_signatures": False,
|
||||
"required_linear_history": False,
|
||||
"allow_force_push": False,
|
||||
"allow_deletions": False,
|
||||
"required_approvals": 1,
|
||||
"dismiss_stale_reviews": True,
|
||||
"restrictions": {
|
||||
"users": ["@perplexity"],
|
||||
"teams": []
|
||||
}
|
||||
}
|
||||
|
||||
def apply_protection(repo: str):
|
||||
url = f"{GITEA_API}/repos/Timmy_Foundation/{repo}/branches/main/protection"
|
||||
headers = {
|
||||
"Authorization": f"token {GITEA_TOKEN}",
|
||||
"Content-Type": "application/json"
|
||||
}
|
||||
response = requests.post(url, json=BRANCH_PROTECTION, headers=headers)
|
||||
if response.status_code == 200:
|
||||
print(f"✅ Protection applied to {repo}/main")
|
||||
else:
|
||||
print(f"❌ Failed to apply protection to {repo}/main: {response.text}")
|
||||
|
||||
if __name__ == "__main__":
|
||||
for repo in REPOS:
|
||||
apply_protection(repo)
|
||||
@@ -1,33 +0,0 @@
|
||||
# Branch Protection & Mandatory Review Policy
|
||||
|
||||
## Overview
|
||||
|
||||
This policy ensures that all changes to the `main` branch are reviewed and tested before being merged. It applies to all repositories in the organization.
|
||||
|
||||
## Enforced Rules
|
||||
|
||||
| Rule | Description |
|
||||
|------|-------------|
|
||||
| ✅ Require Pull Request | Direct pushes to `main` are blocked |
|
||||
| ✅ Require 1 Approval | At least one reviewer must approve |
|
||||
| ✅ Dismiss Stale Approvals | Approvals are dismissed on new commits |
|
||||
| ✅ Require CI to Pass | Merges are blocked if CI fails |
|
||||
| ✅ Block Force Push | Prevents rewriting of `main` history |
|
||||
| ✅ Block Branch Deletion | Prevents accidental deletion of `main` |
|
||||
|
||||
## Default Reviewers
|
||||
|
||||
- `@perplexity` is the default reviewer for all repositories
|
||||
- `@Timmy` is a required reviewer for `hermes-agent`
|
||||
|
||||
## Compliance
|
||||
|
||||
This policy is enforced via automation using the `bin/enforce_branch_protection.py` script, which applies these rules to all repositories.
|
||||
|
||||
## Exceptions
|
||||
|
||||
No exceptions are currently defined. All repositories must comply with this policy.
|
||||
|
||||
## Audit
|
||||
|
||||
This policy is audited quarterly to ensure compliance and effectiveness.
|
||||
@@ -1,26 +0,0 @@
|
||||
# Branch Protection & Review Policy
|
||||
|
||||
## Enforcement Rules
|
||||
|
||||
All repositories must:
|
||||
- Require PR for main branch merges
|
||||
- Require 1 approval
|
||||
- Dismiss stale approvals
|
||||
- Block force pushes
|
||||
- Block branch deletion
|
||||
|
||||
## Reviewer Assignments
|
||||
- All repos: @perplexity (QA gate)
|
||||
- hermes-agent: @Timmy (owner gate)
|
||||
|
||||
## CI Requirements
|
||||
- hermes-agent: Full CI required
|
||||
- the-nexus: CI pending (issue #915)
|
||||
- timmy-config: Limited ci
|
||||
|
||||
## Compliance
|
||||
This policy blocks:
|
||||
- Direct pushes to main
|
||||
- Unreviewed merges
|
||||
- Merges with failing ci
|
||||
- History rewriting
|
||||
@@ -1,42 +0,0 @@
|
||||
# PR Reviewer Assignment Policy
|
||||
|
||||
**Effective: 2026-04-07** — Established after org-wide PR hygiene audit (issue #916).
|
||||
|
||||
## Rule: Every PR must have at least one reviewer assigned before merge.
|
||||
|
||||
No exceptions. Unreviewed PRs will not be merged.
|
||||
|
||||
## Who to assign
|
||||
|
||||
| PR type | Default reviewer |
|
||||
|---|---|
|
||||
| Security / auth changes | @perplexity |
|
||||
| Infrastructure / fleet | @perplexity |
|
||||
| Sovereignty / local inference | @perplexity |
|
||||
| Documentation | any team member |
|
||||
| Agent-generated PRs | @perplexity |
|
||||
|
||||
When in doubt, assign @perplexity.
|
||||
|
||||
## Why this policy exists
|
||||
|
||||
Audit on 2026-04-07 found 5 open PRs across the org — zero had a reviewer assigned.
|
||||
Two PRs containing critical security and sovereignty work (hermes-agent #131, #170) drifted
|
||||
400+ commits from `main` and became unmergeable because nobody reviewed them while main advanced.
|
||||
|
||||
The cost: weeks of rebase work to rescue two commits of actual changes.
|
||||
|
||||
## PR hygiene rules
|
||||
|
||||
1. **Assign a reviewer on open.** Don't open a PR without a reviewer.
|
||||
2. **Rebase within 2 weeks.** If a PR sits for 2 weeks, rebase it or close it.
|
||||
3. **Close zombie PRs.** A PR with 0 commits ahead of base should be closed immediately.
|
||||
4. **Cherry-pick, don't rebase 400 commits.** When a branch drifts far, extract the actual
|
||||
changes onto a fresh branch rather than rebasing the entire history.
|
||||
|
||||
## Enforcement
|
||||
|
||||
Agent-opened PRs (Timmy, Claude, etc.) must include `reviewers` in the PR creation payload.
|
||||
The forge API accepts `"reviewers": ["perplexity"]` in the PR body.
|
||||
|
||||
See: issue #916 for the audit that established this policy.
|
||||
@@ -1,49 +0,0 @@
|
||||
# Branch Protection Policy
|
||||
|
||||
## Enforcement Rules
|
||||
|
||||
All repositories must have the following branch protection rules enabled on the `main` branch:
|
||||
|
||||
| Rule | Status | Description |
|
||||
|------|--------|-------------|
|
||||
| Require PR for merge | ✅ Enabled | No direct pushes to main |
|
||||
| Required approvals | ✅ 1 approval | At least one reviewer must approve |
|
||||
| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
|
||||
| Require CI to pass | ✅ Where CI exists | No merging with failing CI |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental main deletion |
|
||||
|
||||
## Reviewer Assignments
|
||||
|
||||
- `@perplexity` - Default reviewer for all repositories
|
||||
- `@Timmy` - Required reviewer for `hermes-agent`
|
||||
|
||||
- Repo-specific owners for specialized areas (e.g., `@Rockachopa` for infrastructure)
|
||||
|
||||
## Implementation Status
|
||||
|
||||
- [x] `hermes-agent`: All rules enabled
|
||||
- [x] `the-nexus`: All rules enabled (CI pending)
|
||||
- [x] `timmy-home`: PR + 1 approval
|
||||
- [x] `timmy-config`: PR + 1 approval
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] Branch protection enabled on all main branches
|
||||
- [x] `@perplexity` set as default reviewer
|
||||
- [x] This documentation added to all repositories
|
||||
|
||||
## Blocked Issues
|
||||
|
||||
- [ ] #916 - CI implementation for `the-nexus`
|
||||
- [ ] #917 - Reviewer assignment automation
|
||||
|
||||
## Implementation Notes
|
||||
|
||||
1. Gitea branch protection settings must be configured via the UI:
|
||||
- Settings > Branches > Branch Protection
|
||||
- Enable all rules listed above
|
||||
|
||||
2. `CODEOWNERS` file must be committed to the root of each repository
|
||||
|
||||
3. CI status should be verified before merging
|
||||
@@ -1,75 +0,0 @@
|
||||
const GiteaApiUrl = 'https://forge.alexanderwhitestone.com/api/v1';
|
||||
const token = process.env.GITEA_TOKEN; // Should be stored securely in environment variables
|
||||
const repos = ['hermes-agent', 'the-nexus', 'timmy-home', 'timmy-config'];
|
||||
|
||||
const branchProtectionSettings = {
|
||||
enablePush: false,
|
||||
enableMerge: true,
|
||||
requiredApprovals: 1,
|
||||
dismissStaleApprovals: true,
|
||||
requiredStatusChecks: true,
|
||||
blockForcePush: true,
|
||||
blockDelete: true
|
||||
// Special handling for the-nexus (CI disabled)
|
||||
};
|
||||
|
||||
async function applyBranchProtection(repo) {
|
||||
try {
|
||||
const response = await fetch(`${giteaApiUrl}/repos/Timmy_Foundation/${repo}/branches/main/protection`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Authorization': `token ${token}`,
|
||||
'Content-Type': 'application/json'
|
||||
},
|
||||
body: JSON.stringify({
|
||||
...branchProtectionSettings,
|
||||
// Special handling for the-nexus (CI disabled)
|
||||
requiredStatusChecks: repo === 'the-nexus' ? false : true
|
||||
})
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
throw new Error(`Failed to apply branch protection to ${repo}: ${await response.text()}`);
|
||||
}
|
||||
|
||||
console.log(`✅ Branch protection applied to ${repo}`);
|
||||
} catch (error) {
|
||||
console.error(`❌ Error applying branch protection to ${repo}: ${error.message}`);
|
||||
}
|
||||
}
|
||||
|
||||
async function applyBranchProtection(repo) {
|
||||
try {
|
||||
const response = await fetch(`${giteaApiUrl}/repos/Timmy_Foundation/${repo}/branches/main/protection`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Authorization': `token ${token}`,
|
||||
'Content-Type': 'application/json'
|
||||
},
|
||||
body: JSON.stringify({
|
||||
...branchProtectionSettings,
|
||||
requiredApprovals: repo === 'hermes-agent' ? 2 : 1,
|
||||
requiredStatusChecks: repo === 'the-nexus' ? false : true
|
||||
})
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
throw new Error(`Failed to apply branch protection to ${repo}: ${await response.text()}`);
|
||||
}
|
||||
|
||||
console.log(`✅ Branch protection applied to ${repo}`);
|
||||
} catch (error) {
|
||||
console.error(`❌ Error applying branch protection to ${repo}: ${error.message}`);
|
||||
}
|
||||
}
|
||||
|
||||
async function setupAllBranchProtections() {
|
||||
console.log('🚀 Applying branch protections to all repositories...');
|
||||
for (const repo of repos) {
|
||||
await applyBranchProtection(repo);
|
||||
}
|
||||
console.log('✅ All branch protections applied successfully');
|
||||
}
|
||||
|
||||
// Run the setup
|
||||
setupAllBranchProtections();
|
||||
@@ -1,44 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Apply branch protections to all repositories
|
||||
# Requires GITEA_TOKEN env var
|
||||
|
||||
REPOS=("hermes-agent" "the-nexus" "timmy-home" "timmy-config")
|
||||
|
||||
for repo in "${REPOS[@]}"
|
||||
do
|
||||
curl -X POST "https://forge.alexanderwhitestone.com/api/v1/repos/Timmy_Foundation/$repo/branches/main/protection" \
|
||||
-H "Authorization: token $GITEA_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{
|
||||
"required_reviews": 1,
|
||||
"dismiss_stale_reviews": true,
|
||||
"block_force_push": true,
|
||||
"block_deletions": true
|
||||
}'
|
||||
done
|
||||
#!/bin/bash
|
||||
|
||||
# Gitea API credentials
|
||||
GITEA_TOKEN="your-personal-access-token"
|
||||
GITEA_API="https://forge.alexanderwhitestone.com/api/v1"
|
||||
|
||||
# Repos to protect
|
||||
REPOS=("hermes-agent" "the-nexus" "timmy-home" "timmy-config")
|
||||
|
||||
for REPO in "${REPO[@]}"; do
|
||||
echo "Configuring branch protection for $REPO..."
|
||||
|
||||
curl -X POST -H "Authorization: token $GITEA_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{
|
||||
"name": "main",
|
||||
"require_pull_request": true,
|
||||
"required_approvals": 1,
|
||||
"dismiss_stale_approvals": true,
|
||||
"required_status_checks": '"$(test "$REPO" = "hermes-agent" && echo "true" || echo "false")"',
|
||||
"block_force_push": true,
|
||||
"block_delete": true
|
||||
}' \
|
||||
"$GITEA_API/repos/Timmy_Foundation/$REPO/branch_protection"
|
||||
done
|
||||
@@ -1,36 +0,0 @@
|
||||
import os
|
||||
import requests
|
||||
from datetime import datetime
|
||||
|
||||
GITEA_API = os.getenv('Gitea_api_url', 'https://forge.alexanderwhitestone.com/api/v1')
|
||||
Gitea_token = os.getenv('GITEA_TOKEN')
|
||||
|
||||
headers = {
|
||||
'Authorization': f'token {gitea_token}',
|
||||
'Accept': 'application/json'
|
||||
}
|
||||
|
||||
def apply_branch_protection(owner, repo, branch='main'):
|
||||
payload = {
|
||||
"protected": True,
|
||||
"merge_method": "merge",
|
||||
"push": False,
|
||||
"pull_request": True,
|
||||
"required_signoff": False,
|
||||
"required_reviews": 1,
|
||||
"required_status_checks": True,
|
||||
"restrict_owners": True,
|
||||
"delete": False,
|
||||
"force_push": False
|
||||
}
|
||||
|
||||
url = f"{GITEA_API}/repos/{owner}/{repo}/branches/{branch}/protection"
|
||||
r = requests.post(url, json=payload, headers=headers)
|
||||
return r.status_code, r.json()
|
||||
|
||||
if __name__ == '__main__':
|
||||
# Apply to all repos
|
||||
for repo in ['hermes-agent', 'the-nexus', 'timmy-home', 'timmy-config']:
|
||||
print(f"Configuring {repo}...")
|
||||
status, resp = apply_branch_protection('Timmy_Foundation', repo)
|
||||
print(f"Status: {status} {resp}")
|
||||
10
hermes-agent/.github/CODEOWNERS
vendored
10
hermes-agent/.github/CODEOWNERS
vendored
@@ -1,10 +0,0 @@
|
||||
# CODEOWNERS for hermes-agent
|
||||
* @perplexity
|
||||
@Timmy
|
||||
# CODEOWNERS for the-nexus
|
||||
|
||||
* @perplexity
|
||||
@Rockachopa
|
||||
# CODEOWNERS for timmy-config
|
||||
|
||||
* @perplexity
|
||||
@@ -1,3 +0,0 @@
|
||||
@Timmy
|
||||
* @perplexity
|
||||
**/src @Timmy
|
||||
@@ -1,18 +0,0 @@
|
||||
# Contribution Policy for hermes-agent
|
||||
|
||||
## Branch Protection Rules
|
||||
All changes to the `main` branch require:
|
||||
- Pull Request with at least 1 approval
|
||||
- CI checks passing
|
||||
- No direct commits or force pushes
|
||||
- No deletion of the main branch
|
||||
|
||||
## Review Requirements
|
||||
- All PRs must be reviewed by @perplexity
|
||||
- Additional review required from @Timmy
|
||||
|
||||
## Stale PR Policy
|
||||
- Stale approvals are dismissed on new commits
|
||||
- Abandoned PRs will be closed after 7 days of inactivity
|
||||
|
||||
For urgent fixes, create a hotfix branch and follow the same review process.
|
||||
105
index.html
105
index.html
@@ -32,6 +32,14 @@
|
||||
}
|
||||
}
|
||||
</script>
|
||||
<!-- Add DNS health check -->
|
||||
<script>
|
||||
window.addEventListener('load', () => {
|
||||
fetch('https://forge.alexanderwhitestone.com/health', { cache: 'no-store' })
|
||||
.then(r => r.ok ? console.log('Forge OK') : console.error('Forge down'))
|
||||
.catch(e => console.error('Forge unreachable:', e));
|
||||
});
|
||||
</script>
|
||||
</head>
|
||||
<body>
|
||||
<!-- Loading Screen -->
|
||||
@@ -246,92 +254,6 @@
|
||||
<a href="https://www.perplexity.ai/computer" target="_blank" rel="noopener noreferrer">
|
||||
Created with Perplexity Computer
|
||||
</a>
|
||||
<a href="POLICY.md" target="_blank" rel="noopener noreferrer">
|
||||
View Contribution Policy
|
||||
</a>
|
||||
<div class="branch-policy" style="margin-top: 10px; font-size: 12px; color: #aaa;">
|
||||
<strong>BRANCH PROTECTION POLICY</strong><br>
|
||||
<ul style="margin:0; padding-left:15px;">
|
||||
<li>• Require PR for merge ✅</li>
|
||||
<li>• Require 1 approval ✅</li>
|
||||
<li>• Dismiss stale approvals ✅</li>
|
||||
<li>• Require CI ✅ (where available)</li>
|
||||
<li>• Block force push ✅</li>
|
||||
<li>• Block branch deletion ✅</li>
|
||||
</ul>
|
||||
<div style="margin-top: 8px;">
|
||||
<strong>DEFAULT REVIEWERS</strong><br>
|
||||
<span style="color:#4af0c0;">@perplexity</span> (QA gate on all repos) |
|
||||
<span style="color:#7b5cff;">@Timmy</span> (owner gate on hermes-agent)
|
||||
</div>
|
||||
<div style="margin-top: 10px;">
|
||||
<strong>IMPLEMENTATION STATUS</strong><br>
|
||||
<ul style="margin:0; padding-left:15px;">
|
||||
<li>• hermes-agent: Require PR + 1 approval + CI ✅</li>
|
||||
<li>• the-nexus: Require PR + 1 approval ⚠️ (CI disabled)</li>
|
||||
<li>• timmy-home: Require PR + 1 approval ✅</li>
|
||||
<li>• timmy-config: Require PR + 1 approval ✅</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
<div style="margin-top: 10px; font-size: 12px; color: #aaa;">
|
||||
<strong>BRANCH PROTECTION POLICY</strong><br>
|
||||
<ul style="margin:0; padding-left:15px;">
|
||||
<li>• Require PR for merge ✅</li>
|
||||
<li>• Require 1 approval ✅</li>
|
||||
<li>• Dismiss stale approvals ✅</li>
|
||||
<li>• Require CI ✅ (where available)</li>
|
||||
<li>• Block force push ✅</li>
|
||||
<li>• Block branch deletion ✅</li>
|
||||
</ul>
|
||||
<div style="margin-top: 8px;">
|
||||
<strong>DEFAULT REVIEWERS</strong><br>
|
||||
<span style="color:#4af0c0;">@perplexity</span> (QA gate on all repos) |
|
||||
<span style="color:#7b5cff;">@Timmy</span> (owner gate on hermes-agent)
|
||||
</div>
|
||||
</div>
|
||||
<div style="margin-top: 10px; font-size: 12px; color: #aaa;">
|
||||
<strong>BRANCH PROTECTION STATUS</strong><br>
|
||||
<div style="margin-top: 5px; display: flex; flex-direction: column; gap: 2px;">
|
||||
<div>• <span style="color:#4af0c0;">hermes-agent</span>: Require PR + 1 approval + CI ✅</div>
|
||||
<div>• <span style="color:#7b5cff;">the-nexus</span>: Require PR + 1 approval ⚠️ (CI disabled)</div>
|
||||
<div>• <span style="color:#ffd700;">timmy-home</span>: Require PR + 1 approval ✅</div>
|
||||
<div>• <span style="color:#ab8d0;">timmy-config</span>: Require PR + 1 approval ✅</div>
|
||||
</div>
|
||||
</div>
|
||||
>>>>>>> replace
|
||||
```
|
||||
|
||||
index.html
|
||||
```html
|
||||
<<<<<<< search
|
||||
<div class="branch-policy" style="margin-top: 10px; font-size: 12px; color: #aaa;">
|
||||
<strong>BRANCH PROTECTION POLICY</strong><br>
|
||||
<ul style="margin:0; padding-left:15px;">
|
||||
<li>• Require PR for merge ✅</li>
|
||||
<li>• Require 1 approval ✅</li>
|
||||
<li>• Dismiss stale approvals ✅</li>
|
||||
<li>• Require CI ✅ (where available)</li>
|
||||
<li>• Block force push ✅</li>
|
||||
<li>• Block branch deletion ✅</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="default-reviewers" style="margin-top: 8px;">
|
||||
<strong>DEFAULT REVIEWERS</strong><br>
|
||||
<ul style="margin:0; padding-left:15px;">
|
||||
<li>• <span style="color:#4af0c0;">@perplexity</span> (QA gate on all repos)</li>
|
||||
<li>• <span style="color:#7b5cff;">@Timmy</span> (owner gate on hermes-agent)</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="implementation-status" style="margin-top: 10px;">
|
||||
<strong>IMPLEMENTATION STATUS</strong><br>
|
||||
<div style="margin-top: 5px; display: flex; flex-direction: column; gap: 2px;">
|
||||
<div>• <span style="color:#4af0c0;">hermes-agent</span>: Require PR + 1 approval + CI ✅</div>
|
||||
<div>• <span style="color:#7b5cff;">the-nexus</span>: Require PR + 1 approval ⚠<> (CI disabled)</div>
|
||||
<div>• <span style="color:#ffd700;">timmy-home</span>: Require PR + 1 approval ✅</div>
|
||||
<div>• <span style="color:#ab8d00;">timmy-config</span>: Require PR + 1 approval ✅</div>
|
||||
</div>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
<script type="module" src="./app.js"></script>
|
||||
@@ -367,17 +289,6 @@ index.html
|
||||
if (!sha) return;
|
||||
if (knownSha === null) { knownSha = sha; return; }
|
||||
if (sha !== knownSha) {
|
||||
// Check branch protection rules
|
||||
const branchRules = await fetch(`${GITEA}/repos/${REPO}/branches/${BRANCH}/protection`);
|
||||
if (!branchRules.ok) {
|
||||
console.error('Branch protection rules not enforced');
|
||||
return;
|
||||
}
|
||||
const rules = await branchRules.json();
|
||||
if (!rules.require_pr && !rules.require_approvals) {
|
||||
console.error('Branch protection rules not met');
|
||||
return;
|
||||
}
|
||||
knownSha = sha;
|
||||
const banner = document.getElementById('live-refresh-banner');
|
||||
const countdown = document.getElementById('lr-countdown');
|
||||
|
||||
@@ -8,14 +8,9 @@
|
||||
"theme_color": "#4af0c0",
|
||||
"icons": [
|
||||
{
|
||||
"src": "/icons/icon-192x192.png",
|
||||
"sizes": "192x192",
|
||||
"type": "image/png"
|
||||
},
|
||||
{
|
||||
"src": "/icons/icon-512x512.png",
|
||||
"sizes": "512x512",
|
||||
"type": "image/png"
|
||||
"src": "/favicon.ico",
|
||||
"sizes": "64x64",
|
||||
"type": "image/x-icon"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
# Branch Protection Policy
|
||||
|
||||
All repositories must follow these rules for the `main` branch:
|
||||
|
||||
- 🔐 **Require Pull Request for Merge**
|
||||
- 👥 **Require 1 approval**
|
||||
- 🔄 **Dismiss stale approvals**
|
||||
- 🚫 **Block force push**
|
||||
- 🚫 **Block branch deletion**
|
||||
- 🧪 **Default reviewers**: `@perplexity`
|
||||
- 🧪 **Required reviewers**:
|
||||
- `@Timmy` on `hermes-agent`
|
||||
|
||||
All changes must be reviewed and CI must pass before merging.
|
||||
@@ -1,8 +1,5 @@
|
||||
# Deep Dive Environment Configuration
|
||||
|
||||
# Gitea API token for branch protection
|
||||
GITEA_TOKEN=your_gitea_api_token_here
|
||||
|
||||
# Telegram (required for delivery)
|
||||
TELEGRAM_BOT_TOKEN=your_bot_token_here
|
||||
TELEGRAM_CHANNEL_ID=-1001234567890
|
||||
|
||||
@@ -11,7 +11,6 @@ import signal
|
||||
import sys
|
||||
from typing import Set
|
||||
|
||||
# Branch protected file - see POLICY.md
|
||||
import websockets
|
||||
|
||||
# Configuration
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
const CACHE_NAME = 'nexus-v1.1';
|
||||
const ASSETS_TO_CACHE = [
|
||||
'/',
|
||||
'/index.html',
|
||||
'/app.js',
|
||||
'/style.css',
|
||||
'/manifest.json',
|
||||
'/icons/icon-192x192.png',
|
||||
'/icons/icon-512x512.png'
|
||||
];
|
||||
|
||||
self.addEventListener('install', (event) => {
|
||||
event.waitUntil(
|
||||
caches.open(CachedName).then(cache => {
|
||||
return cache.addAll(ASSETS_TO_CACHE);
|
||||
})
|
||||
);
|
||||
});
|
||||
|
||||
self.addEventListener('fetch', (event) => {
|
||||
event.respondWith(
|
||||
caches.match(event.request).then(response => {
|
||||
return response || fetch(event.request);
|
||||
})
|
||||
);
|
||||
});
|
||||
11
style.css
11
style.css
@@ -46,6 +46,15 @@ html, body {
|
||||
overflow: hidden;
|
||||
background: var(--color-bg);
|
||||
font-family: var(--font-body);
|
||||
/* Add critical status indicators */
|
||||
.critical-down {
|
||||
background: #ff4466 !important;
|
||||
border: 2px solid #ff4466 !important;
|
||||
}
|
||||
.critical-up {
|
||||
background: #4af0c0 !important;
|
||||
border: 2px solid #4af0c0 !important;
|
||||
}
|
||||
color: var(--color-text);
|
||||
-webkit-font-smoothing: antialiased;
|
||||
}
|
||||
@@ -970,7 +979,7 @@ canvas#nexus-canvas {
|
||||
right: 12px;
|
||||
bottom: 12px;
|
||||
}
|
||||
.hud-agent-log {
|
||||
.hud-controls {
|
||||
display: none;
|
||||
}
|
||||
.loader-title {
|
||||
|
||||
1
the-nexus/.github/CODEOWNERS
vendored
1
the-nexus/.github/CODEOWNERS
vendored
@@ -1 +0,0 @@
|
||||
@perplexity
|
||||
@@ -1,13 +0,0 @@
|
||||
@Timmy
|
||||
@perplexity
|
||||
>>>>>>> replace
|
||||
```
|
||||
|
||||
#### 2. `the-nexus/CODEOWNERS`
|
||||
Ensure `@perplexity` is the default reviewer.
|
||||
|
||||
```python
|
||||
the-nexus/CODEOWNERS
|
||||
<<<<<<< search
|
||||
@perplexity
|
||||
* @perplexity
|
||||
@@ -1,17 +0,0 @@
|
||||
# Contribution Policy for the-nexus
|
||||
|
||||
## Branch Protection Rules
|
||||
All changes to the `main` branch require:
|
||||
- Pull Request with at least 1 approval
|
||||
- CI checks passing (when available)
|
||||
- No direct commits or force pushes
|
||||
- No deletion of the main branch
|
||||
|
||||
## Review Requirements
|
||||
- All PRs must be reviewed by @perplexity
|
||||
|
||||
## Stale PR Policy
|
||||
- Stale approvals are dismissed on new commits
|
||||
- Abandoned PRs will be closed after 7 days of inactivity
|
||||
|
||||
For urgent fixes, create a hotfix branch and follow the same review process.
|
||||
4
timmy-config/.github/CODEOWNERS
vendored
4
timmy-config/.github/CODEOWNERS
vendored
@@ -1,4 +0,0 @@
|
||||
# CODEOWNERS for timmy-config
|
||||
# This file defines default reviewers for pull requests
|
||||
|
||||
* @perplexity
|
||||
@@ -1,3 +0,0 @@
|
||||
* @perplexity
|
||||
/timmy-config/** @Timmy
|
||||
* @perplexity
|
||||
@@ -1,17 +0,0 @@
|
||||
# Contribution Policy for timmy-config
|
||||
|
||||
## Branch Protection Rules
|
||||
All changes to the `main` branch require:
|
||||
- Pull Request with at least 1 approval
|
||||
- Limited CI checks (when available)
|
||||
- No direct commits or force pushes
|
||||
- No deletion of the main branch
|
||||
|
||||
## Review Requirements
|
||||
- All PRs must be reviewed by @perplexity
|
||||
|
||||
## Stale PR Policy
|
||||
- Stale approvals are dismissed on new commits
|
||||
- Abandoned PRs will be closed after 7 days of inactivity
|
||||
|
||||
For urgent fixes, create a hotfix branch and follow the same review process.
|
||||
4
timmy-home/.github/CODEOWNERS
vendored
4
timmy-home/.github/CODEOWNERS
vendored
@@ -1,4 +0,0 @@
|
||||
# CODEOWNERS for timmy-home
|
||||
# This file defines default reviewers for pull requests
|
||||
|
||||
* @perplexity
|
||||
@@ -1,3 +0,0 @@
|
||||
@perplexity
|
||||
@perplexity
|
||||
* @perplexity
|
||||
@@ -1,16 +0,0 @@
|
||||
# Contribution Policy for timmy-home
|
||||
|
||||
## Branch Protection Rules
|
||||
All changes to the `main` branch require:
|
||||
- Pull Request with at least 1 approval
|
||||
- No direct commits or force pushes
|
||||
- No deletion of the main branch
|
||||
|
||||
## Review Requirements
|
||||
- All PRs must be reviewed by @perplexity
|
||||
|
||||
## Stale PR Policy
|
||||
- Stale approvals are dismissed on new commits
|
||||
- Abandoned PRs will be closed after 7 days of inactivity
|
||||
|
||||
For urgent fixes, create a hotfix branch and follow the same review process.
|
||||
Reference in New Issue
Block a user