chore: establish phase 0 baseline

scripts/audit_workspace.py

@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+"""Audit the dependency-free bootstrap, licensing, and source inventory."""
+
+from __future__ import annotations
+
+import hashlib
+import sys
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+EXPECTED_LICENSE_SHA256 = "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0"
+
+
+def fail(message: str) -> None:
+    print(f"FAIL: {message}", file=sys.stderr)
+    raise SystemExit(1)
+
+
+def load(path: Path) -> dict:
+    with path.open("rb") as stream:
+        return tomllib.load(stream)
+
+
+def main() -> None:
+    workspace = load(ROOT / "Cargo.toml")
+    package_defaults = workspace["workspace"]["package"]
+    if package_defaults.get("license") != "AGPL-3.0-or-later":
+        fail("workspace package license is not AGPL-3.0-or-later")
+    if package_defaults.get("publish") is not False:
+        fail("private workspace packages must set publish = false")
+    if "repository" in package_defaults:
+        fail("private scaffold must not advertise a placeholder repository URL")
+
+    cli_manifest = load(ROOT / "crates" / "kiln-cli" / "Cargo.toml")
+    core_dependency = cli_manifest.get("dependencies", {}).get("kiln-core", {})
+    if core_dependency.get("version") != "=0.0.1":
+        fail("internal kiln-core dependency must use the exact workspace release version")
+    if core_dependency.get("path") != "../kiln-core":
+        fail("internal kiln-core dependency must resolve through the reviewed workspace path")
+
+    license_hash = hashlib.sha256((ROOT / "LICENSE").read_bytes()).hexdigest()
+    if license_hash != EXPECTED_LICENSE_SHA256:
+        fail(f"root LICENSE is not the canonical AGPL-3.0 text: {license_hash}")
+
+    lock = load(ROOT / "Cargo.lock")
+    external = [package for package in lock["package"] if "source" in package]
+    if external:
+        names = [f"{item['name']}@{item['version']}" for item in external]
+        fail(f"unreviewed external Rust dependencies entered the bootstrap: {names}")
+
+    inventory = load(ROOT / "docs" / "phase-0" / "source-inventory.toml")
+    components = {item["name"]: item for item in inventory["components"]}
+    toolchain = load(ROOT / "rust-toolchain.toml")["toolchain"]["channel"]
+    if components.get("rust", {}).get("version") != toolchain:
+        fail("source inventory Rust version does not match rust-toolchain.toml")
+    if components.get("cargo-deny", {}).get("version") != "0.20.2":
+        fail("cargo-deny is absent or not pinned to the reviewed version")
+
+    load(ROOT / "deny.toml")
+    print("PASS: workspace dependency, license, and source baseline")
+
+
+if __name__ == "__main__":
+    main()