chore: establish phase 0 baseline

scripts/audit_workspace.py

@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+"""Audit the dependency-free bootstrap, licensing, and source inventory."""
+
+from __future__ import annotations
+
+import hashlib
+import sys
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+EXPECTED_LICENSE_SHA256 = "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0"
+
+
+def fail(message: str) -> None:
+    print(f"FAIL: {message}", file=sys.stderr)
+    raise SystemExit(1)
+
+
+def load(path: Path) -> dict:
+    with path.open("rb") as stream:
+        return tomllib.load(stream)
+
+
+def main() -> None:
+    workspace = load(ROOT / "Cargo.toml")
+    package_defaults = workspace["workspace"]["package"]
+    if package_defaults.get("license") != "AGPL-3.0-or-later":
+        fail("workspace package license is not AGPL-3.0-or-later")
+    if package_defaults.get("publish") is not False:
+        fail("private workspace packages must set publish = false")
+    if "repository" in package_defaults:
+        fail("private scaffold must not advertise a placeholder repository URL")
+
+    cli_manifest = load(ROOT / "crates" / "kiln-cli" / "Cargo.toml")
+    core_dependency = cli_manifest.get("dependencies", {}).get("kiln-core", {})
+    if core_dependency.get("version") != "=0.0.1":
+        fail("internal kiln-core dependency must use the exact workspace release version")
+    if core_dependency.get("path") != "../kiln-core":
+        fail("internal kiln-core dependency must resolve through the reviewed workspace path")
+
+    license_hash = hashlib.sha256((ROOT / "LICENSE").read_bytes()).hexdigest()
+    if license_hash != EXPECTED_LICENSE_SHA256:
+        fail(f"root LICENSE is not the canonical AGPL-3.0 text: {license_hash}")
+
+    lock = load(ROOT / "Cargo.lock")
+    external = [package for package in lock["package"] if "source" in package]
+    if external:
+        names = [f"{item['name']}@{item['version']}" for item in external]
+        fail(f"unreviewed external Rust dependencies entered the bootstrap: {names}")
+
+    inventory = load(ROOT / "docs" / "phase-0" / "source-inventory.toml")
+    components = {item["name"]: item for item in inventory["components"]}
+    toolchain = load(ROOT / "rust-toolchain.toml")["toolchain"]["channel"]
+    if components.get("rust", {}).get("version") != toolchain:
+        fail("source inventory Rust version does not match rust-toolchain.toml")
+    if components.get("cargo-deny", {}).get("version") != "0.20.2":
+        fail("cargo-deny is absent or not pinned to the reviewed version")
+
+    load(ROOT / "deny.toml")
+    print("PASS: workspace dependency, license, and source baseline")
+
+
+if __name__ == "__main__":
+    main()

scripts/scan_placeholders.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""Inventory temporary names and reject them from public/installable surfaces."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+TOKENS = ("Project Kiln", "kiln", "KILN_")
+IGNORED_PARTS = {".git", "target", "__pycache__"}
+PUBLIC_SURFACES = {"dist", "packaging", "public", "release"}
+TEXT_SUFFIXES = {"", ".csv", ".md", ".py", ".rs", ".toml", ".yml", ".yaml"}
+
+
+def main() -> None:
+    matches: list[tuple[Path, str]] = []
+    violations: list[tuple[Path, str]] = []
+    for path in ROOT.rglob("*"):
+        relative = path.relative_to(ROOT)
+        if not path.is_file() or any(part in IGNORED_PARTS for part in relative.parts):
+            continue
+        if path.suffix.lower() not in TEXT_SUFFIXES:
+            continue
+        try:
+            content = path.read_text()
+        except UnicodeDecodeError:
+            continue
+        for token in TOKENS:
+            if token not in content:
+                continue
+            matches.append((relative, token))
+            if any(part in PUBLIC_SURFACES for part in relative.parts):
+                violations.append((relative, token))
+    if violations:
+        for path, token in violations:
+            print(f"FAIL: temporary token {token!r} in public surface {path}", file=sys.stderr)
+        raise SystemExit(1)
+    if not matches:
+        print("FAIL: expected private placeholders were not found", file=sys.stderr)
+        raise SystemExit(1)
+    print(f"PASS: {len(matches)} temporary-name occurrences remain private and inventoried")
+
+
+if __name__ == "__main__":
+    main()
+

scripts/verify_repo.py

@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+"""Dependency-free Phase 0 repository and specification checks."""
+
+from __future__ import annotations
+
+import csv
+import re
+import sys
+import tomllib
+from urllib.parse import unquote
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+SPEC = ROOT / "docs" / "spec"
+
+
+def fail(message: str) -> None:
+    print(f"FAIL: {message}", file=sys.stderr)
+    raise SystemExit(1)
+
+
+def check_toml() -> None:
+    manifests = [ROOT / "Cargo.toml", *sorted((ROOT / "crates").glob("*/Cargo.toml"))]
+    for manifest in manifests:
+        with manifest.open("rb") as stream:
+            tomllib.load(stream)
+    toolchain = tomllib.loads((ROOT / "rust-toolchain.toml").read_text())
+    if toolchain["toolchain"]["channel"] != "1.97.1":
+        fail("Rust toolchain is not pinned to 1.97.1")
+
+
+def check_spec() -> set[str]:
+    expected = {f"0{number}_" for number in range(8)}
+    files = sorted(SPEC.glob("0[0-7]_*.md"))
+    prefixes = {path.name[:3] for path in files}
+    if prefixes != expected:
+        fail(f"active spec set is incomplete: {sorted(prefixes)}")
+    combined = "\n".join(path.read_text() for path in files)
+    requirements = re.findall(r"^\| (R-\d{3})\s+\|", combined, re.MULTILINE)
+    decisions = re.findall(r"^\| (D-\d{3})\s+\|", combined, re.MULTILINE)
+    for label, identifiers in (("requirement", requirements), ("decision", decisions)):
+        duplicates = sorted({item for item in identifiers if identifiers.count(item) > 1})
+        if duplicates:
+            fail(f"duplicate {label} IDs: {duplicates}")
+    versions = re.findall(r"^\| \*\*Version\*\*\s+\| ([0-9.]+)", combined, re.MULTILINE)
+    if versions != ["0.18"]:
+        fail(f"active specification version markers are stale or ambiguous: {versions}")
+    return set(requirements)
+
+
+def check_traceability(required: set[str]) -> None:
+    path = ROOT / "docs" / "phase-0" / "traceability.csv"
+    with path.open(newline="") as stream:
+        rows = list(csv.DictReader(stream))
+    traced = {row["requirement_id"] for row in rows}
+    missing = sorted(required - traced)
+    if missing:
+        fail(f"requirements missing from traceability matrix: {missing}")
+
+
+def check_markdown_links() -> None:
+    broken: list[str] = []
+    for document in ROOT.rglob("*.md"):
+        if any(part in {".git", "target"} for part in document.relative_to(ROOT).parts):
+            continue
+        for destination in re.findall(r"\[[^]]*\]\(([^)]+)\)", document.read_text()):
+            target = destination.split("#", 1)[0]
+            if not target or "://" in target or target.startswith("mailto:"):
+                continue
+            resolved = (document.parent / unquote(target)).resolve()
+            if not resolved.exists():
+                broken.append(f"{document.relative_to(ROOT)} -> {destination}")
+    if broken:
+        fail(f"broken Markdown links: {broken}")
+
+
+def check_placeholders() -> None:
+    allowed_roots = {"crates", "docs", "scripts", ".github"}
+    for child in ROOT.iterdir():
+        if child.is_dir() and not child.name.startswith(".") and child.name not in allowed_roots:
+            fail(f"unexpected top-level directory: {child.name}")
+    manifest = (ROOT / "docs" / "phase-0" / "rename-manifest.md").read_text()
+    for token in ("kiln", "KILN", "Project Kiln"):
+        if token not in manifest:
+            fail(f"rename manifest does not track {token!r}")
+
+
+def check_verification_entrypoints() -> None:
+    makefile = (ROOT / "Makefile").read_text()
+    required = (
+        "python3 scripts/verify_repo.py",
+        "python3 scripts/audit_workspace.py",
+        "python3 scripts/scan_placeholders.py",
+        "python3 scripts/verify_rust_toolchain.py",
+        "cargo fmt --all --check",
+        "cargo test --workspace --all-targets --locked",
+        "cargo clippy --workspace --all-targets --locked -- -D warnings",
+        "cargo deny check advisories bans licenses sources",
+    )
+    missing = [command for command in required if command not in makefile]
+    if missing:
+        fail(f"Makefile is missing verification gates: {missing}")
+
+
+def main() -> None:
+    check_toml()
+    requirements = check_spec()
+    check_traceability(requirements)
+    check_markdown_links()
+    check_placeholders()
+    check_verification_entrypoints()
+    print(f"PASS: Phase 0 static baseline ({len(requirements)} requirements traced)")
+
+
+if __name__ == "__main__":
+    main()

scripts/verify_rust_toolchain.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+"""Require the exact reviewed Rust compiler before running Rust quality gates."""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+PIN = ROOT / "rust-toolchain.toml"
+
+
+def main() -> None:
+    with PIN.open("rb") as stream:
+        expected = tomllib.load(stream)["toolchain"]["channel"]
+    result = subprocess.run(
+        ["rustc", "--version"],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    match = re.match(r"rustc ([0-9]+\.[0-9]+\.[0-9]+)(?:\s|$)", result.stdout)
+    if match is None:
+        print(f"FAIL: could not parse compiler version: {result.stdout.strip()}", file=sys.stderr)
+        raise SystemExit(1)
+    actual = match.group(1)
+    if actual != expected:
+        print(
+            f"FAIL: rustc {actual} is active, but rust-toolchain.toml pins {expected}.\n"
+            "A distro-provided cargo/rustc may ignore rust-toolchain.toml; use the "
+            "pinned rustup toolchain or update the distro packages.",
+            file=sys.stderr,
+        )
+        raise SystemExit(1)
+    print(f"PASS: exact Rust toolchain {actual}")
+
+
+if __name__ == "__main__":
+    main()