diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..b2a9daa --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,34 @@ +--- +name: Bug report +about: Create a report to help us improve App Rotator +title: '[BUG] ' +labels: bug +assignees: '' +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**To Reproduce** +Steps to reproduce the behavior: +1. Go to '...' +2. Click on '....' +3. Scroll down to '....' +4. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + +**Environment (please complete the following information):** + - OS: [e.g. Windows 11 23H2 / 24H2] + - Python Version: [e.g. 3.11, 3.12, 3.13] + - App Rotator Version: [e.g. 0.2.3] + - Execution Mode: [e.g. RunAsInvoker, Tray background, CLI] + +**Governance & Runtime Verification:** +- [ ] Confirmed zero network egress / local-first operation +- [ ] Confirmed execution in unprivileged user-mode (Non-Elevation / RunAsInvoker) +- [ ] No private or confidential system credentials included in log snippets + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..aac0628 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,24 @@ +--- +name: Feature request +about: Suggest an idea or enhancement for App Rotator +title: '[FEAT] ' +labels: enhancement +assignees: '' +--- + +**Is your feature request related to a problem? Please describe.** +A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + +**Describe the solution you'd like** +A clear and concise description of what you want to happen. + +**Describe alternatives you've considered** +A clear and concise description of any alternative solutions or features you've considered. + +**Governance & Architecture Alignment:** +- [ ] Preserves 100% Local-First / Zero Network Egress invariants +- [ ] Operates in unprivileged user-mode (Non-Elevation / RunAsInvoker) +- [ ] Maintains fail-closed dry-run safety principles + +**Additional context** +Add any other context or screenshots about the feature request here. diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..3375d07 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,24 @@ +# Security-only: keine version-updates (limit 0), Security-Fixes gruppiert +version: 2 +updates: + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + groups: + security: + applies-to: security-updates + patterns: + - "*" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + groups: + security: + applies-to: security-updates + patterns: + - "*" diff --git a/.github/workflows/auto-assign.yml b/.github/workflows/auto-assign.yml index ad3b398..846c48c 100644 --- a/.github/workflows/auto-assign.yml +++ b/.github/workflows/auto-assign.yml @@ -16,6 +16,9 @@ jobs: assign: runs-on: ubuntu-latest timeout-minutes: 5 + # Dependabot & Bot PRs run under pull_request_target with a restricted token; + # assigning them returns 403 and turns automated checks red. + if: github.event.pull_request.user.type != 'Bot' steps: - uses: actions/github-script@v7 with: diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 657479f..697e0c4 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -5,6 +5,7 @@ on: branches: [master] pull_request: branches: [master] + workflow_dispatch: permissions: contents: read diff --git a/.gitignore b/.gitignore index c91b8bc..87fc348 100644 --- a/.gitignore +++ b/.gitignore @@ -17,8 +17,10 @@ __pycache__/ .turbo/ .nyc_output/ .coverage +.coverage.* htmlcov/ coverage.xml +*.prof .smoke/ .wheel-smoke/ @@ -67,6 +69,11 @@ LOCK.permissions.json LOCK.dev.* LOCK.antigravity.* LOCK.bugsearch.* +LOCK.orchestrator.* +LOCK.operator.* +LOCK.worker.* +LOCK.thinker.* +LOCK.reviewer.* .automation-lock *.lock uv.lock diff --git a/CHANGELOG.md b/CHANGELOG.md index c5bf01d..e458f63 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,20 @@ All notable changes to this project are documented here. ## [Unreleased] +### CI-Matrix-Härtung, Community Health, Dependabot Security & Level 1 SBOM Re-Audit (Pfad A, 2026-11-07) +- Provisioned security-only `.github/dependabot.yml` (pip and github-actions ecosystems, weekly schedule, open-pull-requests-limit: 0, grouped security updates) to enable automated vulnerability monitoring without unsolicited version bumps. +- Added bilingual `CODE_OF_CONDUCT.md` (Contributor Covenant v2.1, DE/EN) with verified maintainer contact addresses and link to GitHub Private Vulnerability Reporting. +- Provisioned structured GitHub Issue Templates in `.github/ISSUE_TEMPLATE/` (`bug_report.md` and `feature_request.md`) with explicit local-first, RunAsInvoker, and fail-closed architecture checklist items. +- Hardened CI workflows: + - Added `workflow_dispatch` trigger to `.github/workflows/tests.yml` for manual test runs. + - Added Bot/Dependabot guard (`if: github.event.pull_request.user.type != 'Bot'`) to `.github/workflows/auto-assign.yml` to prevent 403 errors on restricted token PRs. +- Hardened pytest configuration in `pyproject.toml` with `--strict-markers` and `xfail_strict = true`. +- Extended PEP 621 metadata: registered `Code of Conduct` under `[project.urls]` in `pyproject.toml`. +- Re-audited Level 1 SBOM in `THIRD_PARTY_LICENSES.md` and `THIRD_PARTY_LICENSES.txt` (Stand 2026-11-07), aligning setuptools build requirements to `>=77.0.3` and verifying zero-copyleft and non-elevation invariants. +- Extended `.gitignore` with multi-agent lock patterns (`LOCK.orchestrator.*`, `LOCK.operator.*`, `LOCK.worker.*`, `LOCK.thinker.*`, `LOCK.reviewer.*`), `.coverage.*`, and `*.prof`. +- Expanded automated contract test suite in `tests/test_metadata.py` with 6 new contract tests. +- Strictly preserved frozen version `0.2.3` per `T-20260920-167562623`. + ### Discoverability, UI Architecture Vector Preview & Re-Audit (Pfad B, 2026-11-01) - Designed and embedded high-fidelity vector architecture preview `assets/ui-architecture-preview.svg` in Section 6 (`README.md` and `README_de.md`), illustrating the pystray System Tray Context Menu, Native Settings Tkinter GUI with minute-based durations, and deterministic VRAM purge timing dynamics. - Synchronized Shields.io repository badges (`pytest-77 passed | 100% green`, `Verified-2026--11--01`, `Last Checked-2026--11--01`), `llms.txt`, and local `MARKETING-LOG.txt`. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..a7fce6a --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,74 @@ +# Verhaltenskodex / Code of Conduct + +## Deutsch + +### Unser Versprechen + +Wir als Mitglieder, Beitragende und Projektverantwortliche verpflichten uns, +die Teilnahme an unserer Community zu einer belästigungsfreien Erfahrung für +alle zu machen, unabhängig von Alter, Körpergröße, sichtbarer oder +unsichtbarer Behinderung, ethnischer Zugehörigkeit, Geschlechtsmerkmalen, +Geschlechtsidentität und -ausdruck, Erfahrungsgrad, Bildung, +sozioökonomischem Status, Nationalität, persönlichem Aussehen, Herkunft, +Religion oder sexueller Identität und Orientierung. + +### Unsere Standards + +Beispiele für Verhalten, das zu einem positiven Umfeld beiträgt: +- Verwendung einladender und inklusiver Sprache +- Respektvoller Umgang mit unterschiedlichen Standpunkten und Erfahrungen +- Konstruktive Kritik höflich annehmen +- Fokus auf das Beste für die Community und transparente Software-Hygiene + +Inakzeptables Verhalten umfasst: +- Trolling, beleidigende Kommentare und persönliche oder politische Angriffe +- Öffentliche oder private Belästigung +- Veröffentlichung privater Informationen anderer ohne ausdrückliche Erlaubnis +- Kompromittierung von Sicherheits- und Governance-Vorgaben + +### Meldung und Durchsetzung + +Wenn Sie problematisches Verhalten beobachten, melden Sie es bitte über die im +Repository vorgesehenen GitHub-Kanäle oder vertraulich an die Maintainer: +- E-Mail: `security@open-bricks.org` oder `lukas@open-bricks.org` +- GitHub: [Private Vulnerability Reporting](https://github.com/dev-bricks/app-rotator/security/advisories) + +Sensible Meldungen sollen nicht in öffentlichen Issues gepostet werden. +Alle Beschwerden werden geprüft und angemessen bearbeitet. + +--- + +## English + +### Our Pledge + +We as members, contributors, and project maintainers pledge to make +participation in our community a harassment-free experience for everyone, +regardless of age, body size, visible or invisible disability, ethnicity, sex +characteristics, gender identity and expression, level of experience, +education, socio-economic status, nationality, personal appearance, race, +religion, or sexual identity and orientation. + +### Our Standards + +Examples of behavior that contributes to a positive environment: +- Using welcoming and inclusive language +- Being respectful of differing viewpoints and experiences +- Gracefully accepting constructive criticism +- Focusing on what is best for the community and rigorous software hygiene + +Unacceptable behavior includes: +- Trolling, insulting comments, and personal or political attacks +- Public or private harassment +- Publishing others' private information without explicit permission +- Compromising security or governance requirements + +### Enforcement & Reporting + +If you observe unacceptable behavior, please report it via GitHub or confidentially +to the project maintainers: +- Email: `security@open-bricks.org` or `lukas@open-bricks.org` +- GitHub: [Private Vulnerability Reporting](https://github.com/dev-bricks/app-rotator/security/advisories) + +Do not post sensitive reports in public issues. All complaints will be reviewed +fairly and handled with care. diff --git a/MARKETING-LOG.txt b/MARKETING-LOG.txt index 13d61a3..01484bf 100644 --- a/MARKETING-LOG.txt +++ b/MARKETING-LOG.txt @@ -4,6 +4,45 @@ Dieses Register dokumentiert Discoverability-, Marketing-, Visual-Design- und Ö --- +## [2026-11-07] — Pfad A: CI-Matrix-Härtung, Community Health, Dependabot Security & Level 1 SBOM Re-Audit + +- **Akteur:** Antigravity / Gemini (`WORKSTATION-LG`) +- **Version:** `0.2.3` (Version gemäß T-20260920-167562623 strikt eingefroren) +- **Typ:** `GITHUBBOT_ONE_REPO_CLEANER` (Pfad A) +- **Repo:** `dev-bricks/app-rotator` (`C:\_Local_DEV\repos\app-rotator`, Branch `chore/hygiene-ci-pep621-contract-tests-20261107`, Remote `https://github.com/dev-bricks/app-rotator.git`) +- **Auswahlgrund:** Pfad A Hygiene- und Wartungsturnus der Flotte, Arbeitsbaum 100% sauber, 0 offene Pull Requests vor Laufbeginn, 0 aktive Locks, strikte Lock-Freigabe bestätigt via `lock_status.py` (UNLOCKED). + +### Durchgeführte Maßnahmen: + +1. **Security-Only Dependabot Konfiguration (`.github/dependabot.yml`):** + - Provisionierung einer security-only Dependabot-Konfiguration für `pip` und `github-actions` mit wöchentlichem Zeitplan, `open-pull-requests-limit: 0` und gruppierten Security-Updates zur Vermeidung von unerwünschten Versions-Bumps. + +2. **Community Governance & Verhaltenskodex (`CODE_OF_CONDUCT.md`):** + - Bereitstellung des zweisprachigen Verhaltenskodex (`CODE_OF_CONDUCT.md`, DE/EN) nach Contributor Covenant v2.1 mit offiziellen Maintainer-Kontakten (`security@open-bricks.org`, `lukas@open-bricks.org`) und GitHub Private Vulnerability Reporting Link. + - Registrierung von `Code of Conduct` unter `[project.urls]` in `pyproject.toml`. + +3. **Strukturierte GitHub Issue Templates (`.github/ISSUE_TEMPLATE/`):** + - Erstellung von `bug_report.md` und `feature_request.md` mit Governance- und Architektur-Checklisten (100% Local-First / Zero Network Egress, RunAsInvoker Non-Elevation, Fail-Closed Dry-Run). + +4. **CI-Matrix & Workflow-Härtung:** + - Ergänzung des `workflow_dispatch`-Triggers in `.github/workflows/tests.yml` für manuelle CI-Testläufe. + - Härtung von `.github/workflows/auto-assign.yml` durch Bot-Guard (`if: github.event.pull_request.user.type != 'Bot'`) zur Vermeidung von 403-Fehlern bei Bot-/Dependabot-PRs. + - Härtung von `pyproject.toml` mit `--strict-markers` und `xfail_strict = true` in den pytest ini_options. + +5. **Multi-Agent Lock-Defense & Gitignore-Härtung (`.gitignore`):** + - Erweiterung von `.gitignore` um erweiterte Multi-Agent Lock-Muster (`LOCK.orchestrator.*`, `LOCK.operator.*`, `LOCK.worker.*`, `LOCK.thinker.*`, `LOCK.reviewer.*`), `.coverage.*` und `*.prof`. + +6. **Level 1 SBOM Re-Audit & Lizenz-Inventar (Stand 2026-11-07):** + - Re-Audit von `THIRD_PARTY_LICENSES.md` und Begleitdokument `THIRD_PARTY_LICENSES.txt` (Stand 2026-11-07). + - Abgleich des `setuptools`-Build-Requirements auf `>=77.0.3` konsistent zu `pyproject.toml`. + - Bestätigung aller 10 Invarianten `INV-LOCAL-01`..`INV-SLA-10`, unprivilegierter `RunAsInvoker` Modus und 100% Zero-Copyleft Isolation. + +7. **Vertragstest-Erweiterung (`tests/test_metadata.py`):** + - 6 neue automatisierte Vertragstests für Code of Conduct Integrität, Issue Templates, Dependabot Security-Konfiguration, Auto-Assign Bot-Guard, erweiterte Lock-Defense und Audit-Recency 2026-11-07 implementiert. + - Gesamtsuite erfolgreich auf 83 passed Tests (100% grün) ausgebaut. + +--- + ## [2026-11-01] — Pfad B: UI Architecture Vector Preview, Real-Time Tray & Settings Visualisation & 2026-11-01 Re-Audit - **Akteur:** Antigravity / Gemini (`WORKSTATION-LG`) diff --git a/README.md b/README.md index f2c34ce..9a49d73 100644 --- a/README.md +++ b/README.md @@ -18,12 +18,13 @@

CI Version 0.2.3 - Pytest Passing + Pytest Passing Python Versions Platform: Windows License: MIT Attribution: NOTICE Contributing: Guide + Code of Conduct: v2.1 Level 1 SBOM: Plain Text Privacy: Local-First Security: RunAsInvoker @@ -32,8 +33,8 @@ Org: dev-bricks Umbrella: open-bricks LLM Context - Verified Date - Last Checked + Verified Date + Last Checked

--- diff --git a/README_de.md b/README_de.md index 09515e8..12d4c6a 100644 --- a/README_de.md +++ b/README_de.md @@ -18,12 +18,13 @@

CI Version 0.2.3 - Pytest Passing + Pytest Passing Python-Versionen Plattform: Windows Lizenz: MIT Attribution: NOTICE Mitwirken: Leitfaden + Verhaltenskodex: v2.1 Level 1 SBOM: Plain Text Privatsphäre: Local-First Sicherheit: RunAsInvoker @@ -32,8 +33,8 @@ Org: dev-bricks Dachverband: open-bricks LLM-Kontext - Verifikationsdatum - Zuletzt geprüft + Verifikationsdatum + Zuletzt geprüft

--- diff --git a/THIRD_PARTY_LICENSES.md b/THIRD_PARTY_LICENSES.md index a4eda5f..c52b937 100644 --- a/THIRD_PARTY_LICENSES.md +++ b/THIRD_PARTY_LICENSES.md @@ -3,7 +3,7 @@ - **Project:** `App Rotator` (`dev-bricks/app-rotator`) - **License:** [MIT License](LICENSE) - **Version:** `0.2.3` -- **Audit Date:** 2026-11-01 +- **Audit Date:** 2026-11-07 - **Organization:** [dev-bricks](https://github.com/dev-bricks) - **Umbrella Ecosystem:** [open-bricks](https://github.com/open-bricks) - **Security & Non-Elevation:** Non-elevation user-mode (`RunAsInvoker`) under `%LOCALAPPDATA%` @@ -30,7 +30,7 @@ This document provides a Level 1 Software Bill of Materials (SBOM) and inventory | :--- | :--- | :--- | :--- | :--- | | **pytest** | `>=8.0` | MIT | https://pytest.org/ | Test framework for unit, integration, and metadata contract testing. | | **ruff** | `>=0.6` | MIT / Apache-2.0 | https://astral.sh/ruff | Fast Python linter and static analysis engine. | -| **setuptools** | `>=69.0` | MIT | https://github.com/pypa/setuptools | PEP 517 / 621 package build and distribution backend. | +| **setuptools** | `>=77.0.3` | MIT | https://github.com/pypa/setuptools | PEP 517 / 621 package build and distribution backend. | --- diff --git a/THIRD_PARTY_LICENSES.txt b/THIRD_PARTY_LICENSES.txt index 261263e..ba7261d 100644 --- a/THIRD_PARTY_LICENSES.txt +++ b/THIRD_PARTY_LICENSES.txt @@ -3,7 +3,7 @@ THIRD-PARTY SOFTWARE LICENSES & TRANSPARENCY NOTICE (LEVEL 1 SBOM) Project: App Rotator (app-rotator) Organization: dev-bricks (Ecosystem: open-bricks) Canonical Repository: https://github.com/dev-bricks/app-rotator -Audit Date: 2026-11-01 +Audit Date: 2026-11-07 Primary License: MIT (see LICENSE) Attribution: NOTICE Level 1 SBOM Plain-Text Companion: THIRD_PARTY_LICENSES.txt diff --git a/llms.txt b/llms.txt index 2b21af2..4f762a5 100644 --- a/llms.txt +++ b/llms.txt @@ -9,14 +9,14 @@ - Attribution: `NOTICE` (Lukas Geiger, dev-bricks, open-bricks) - Language: Python >= 3.11 (Microsoft Windows only) - Version: 0.2.3 -- Last-checked: 2026-11-01 +- Last-checked: 2026-11-07 - Entry points: `app-rotator` CLI (`run`, `tray`, `play`, `pause`, `stop`, `status`, `config-init`, `config-validate`) - State: `%LOCALAPPDATA%\AppRotator\state.json`, events in `events.jsonl`, single-instance file lock (`app-rotator.lock`) - Security: `SECURITY.md` (100% Local-First, Fail-Closed, Path-Restricted, Non-Elevation `RunAsInvoker`, Zero Network Egress, 48h Response SLA & 5-Day Triage Guarantee) - Licenses: `THIRD_PARTY_LICENSES.md` (Level 1 SBOM, Invariant Cross-Reference Matrix, Pillow, psutil, pystray, pytest, ruff, setuptools), plain-text Level 1 SBOM companion inventory in `THIRD_PARTY_LICENSES.txt` - Marketing & Audit: `MARKETING-LOG.txt` (Pfad B Discoverability, 18-Point Bilingual Quick Navigation Parity, Four-View ASCII Architecture Topology Projection, System Tray & Settings UI Wireframe Blueprints, Target Personas, 10-Dimension Comparative Matrix, Dual Mermaid Architecture, 10 Governance Invariants, § 521 BGB Statutory Disclaimer, Ecosystem Parity) - CI: `.github/workflows/` (`tests.yml` Windows matrix across Python 3.11, 3.12, 3.13; `auto-assign.yml`, `label-sync.yml`, `stale.yml`, `welcome.yml`) -- Documentation: `README.md` (EN), `README_de.md` (DE), `CONTRIBUTING.md` (EN/DE Guidelines & Plan D), `CHANGELOG.md` +- Documentation: `README.md` (EN), `README_de.md` (DE), `CONTRIBUTING.md` (EN/DE Guidelines & Plan D), `CODE_OF_CONDUCT.md` (Bilingual), `CHANGELOG.md` ## 10 Governance & Runtime Invariants @@ -36,5 +36,5 @@ - `src/app_rotator/` — engine, controller, processes, settings, tray, config - `src/app_rotator/assets/` — packaged high-resolution application icons - `scripts/install-desktop-shortcut.ps1` — unprivileged per-user desktop installer below `%LOCALAPPDATA%` -- `tests/` — pytest test suite (77 passing contract & unit tests) +- `tests/` — pytest test suite (83 passing contract & unit tests) - `tests/test_metadata.py` — automated metadata contract tests verifying PEP 621, URLs, badges, 18-point quick navigation, reciprocal dual HTML anchors, Four-View ASCII Topology, target personas, 10-dimension comparative matrix, Level 1 SBOM, dual Mermaid diagrams, 10 invariants, ecosystem matrix, licenses, and SECURITY SLAs diff --git a/pyproject.toml b/pyproject.toml index 378b72f..27415f5 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -70,6 +70,7 @@ Umbrella = "https://github.com/open-bricks" "Plain-Text License" = "https://github.com/dev-bricks/app-rotator/blob/master/THIRD_PARTY_LICENSES.txt" Notice = "https://github.com/dev-bricks/app-rotator/blob/master/NOTICE" Contributing = "https://github.com/dev-bricks/app-rotator/blob/master/CONTRIBUTING.md" +"Code of Conduct" = "https://github.com/dev-bricks/app-rotator/blob/master/CODE_OF_CONDUCT.md" "LLM Ready" = "https://github.com/dev-bricks/app-rotator/blob/master/llms.txt" "Marketing" = "https://github.com/dev-bricks/app-rotator/blob/master/MARKETING-LOG.txt" @@ -90,7 +91,8 @@ app_rotator = ["assets/*.png", "assets/*.ico"] [tool.pytest.ini_options] minversion = "7.0" -addopts = "-ra -v --basetemp=.pytest_temp" +addopts = "-ra -v --basetemp=.pytest_temp --strict-markers" +xfail_strict = true testpaths = ["tests"] pythonpath = ["src"] norecursedirs = [".git", ".pytest_cache", ".pytest_temp", "__pycache__", "build", "dist", ".venv", ".hypothesis", ".turbo", ".tox", ".nyc_output"] diff --git a/tests/test_metadata.py b/tests/test_metadata.py index 8f0f9dd..dc22533 100644 --- a/tests/test_metadata.py +++ b/tests/test_metadata.py @@ -113,6 +113,7 @@ def test_llms_txt_and_docs_sync() -> None: or "Last-checked: 2026-10-03" in content or "Last-checked: 2026-10-30" in content or "Last-checked: 2026-11-01" in content + or "Last-checked: 2026-11-07" in content ) assert "https://github.com/dev-bricks/app-rotator" in content assert "0.2.3" in content @@ -151,6 +152,7 @@ def test_readme_badges_consistency() -> None: or "2026--10--03" in readme or "2026--10--30" in readme or "2026--11--01" in readme + or "2026--11--07" in readme ) @@ -570,6 +572,7 @@ def test_third_party_licenses_audit_recency() -> None: or "Audit Date:** 2026-10-03" in content or "Audit Date:** 2026-10-30" in content or "Audit Date:** 2026-11-01" in content + or "Audit Date:** 2026-11-07" in content ) assert "Version:** `0.2.3`" in content assert "RunAsInvoker" in content @@ -653,6 +656,7 @@ def test_level1_sbom_plain_text_companion_invariants() -> None: or "Audit Date: 2026-10-03" in content or "Audit Date: 2026-10-30" in content or "Audit Date: 2026-11-01" in content + or "Audit Date: 2026-11-07" in content ) assert "EXECUTIVE COMPLIANCE & ZERO-COPYLEFT ASSURANCE" in content assert "INVARIANT CROSS-REFERENCE MATRIX" in content @@ -904,3 +908,93 @@ def test_marketing_log_audit_recency_20261101() -> None: assert "REC-20261101-01" in content assert "REC-20261101-02" in content + +def test_code_of_conduct_bilingual_integrity() -> None: + """Verify CODE_OF_CONDUCT.md exists, is bilingual, and contains security contacts.""" + coc_path = ROOT / "CODE_OF_CONDUCT.md" + assert coc_path.is_file(), "CODE_OF_CONDUCT.md must exist" + + content = coc_path.read_text(encoding="utf-8") + assert "## Deutsch" in content + assert "## English" in content + assert "security@open-bricks.org" in content + assert "lukas@open-bricks.org" in content + assert "Private Vulnerability Reporting" in content + + pyproject_path = ROOT / "pyproject.toml" + data = tomllib.loads(pyproject_path.read_text(encoding="utf-8")) + urls = data.get("project", {}).get("urls", {}) + assert "Code of Conduct" in urls, "pyproject.toml must link Code of Conduct" + assert urls["Code of Conduct"].endswith("CODE_OF_CONDUCT.md") + + +def test_issue_templates_exist() -> None: + """Verify GitHub Issue templates exist with local-first and fail-closed checklists.""" + bug_template = ROOT / ".github" / "ISSUE_TEMPLATE" / "bug_report.md" + feat_template = ROOT / ".github" / "ISSUE_TEMPLATE" / "feature_request.md" + + assert bug_template.is_file(), "bug_report.md must exist" + assert feat_template.is_file(), "feature_request.md must exist" + + bug_content = bug_template.read_text(encoding="utf-8") + assert "RunAsInvoker" in bug_content + assert "zero network egress" in bug_content + + feat_content = feat_template.read_text(encoding="utf-8") + assert "Local-First" in feat_content + assert "fail-closed" in feat_content + + +def test_dependabot_security_config() -> None: + """Verify dependabot.yml enforces zero version bumps and security-only groups.""" + dep_path = ROOT / ".github" / "dependabot.yml" + assert dep_path.is_file(), ".github/dependabot.yml must exist" + + content = dep_path.read_text(encoding="utf-8") + assert "open-pull-requests-limit: 0" in content + assert "security-updates" in content + assert "pip" in content + assert "github-actions" in content + + +def test_auto_assign_bot_guard_and_workflow_dispatch() -> None: + """Verify auto-assign guards against bot PRs and CI supports workflow_dispatch.""" + auto_assign_path = ROOT / ".github" / "workflows" / "auto-assign.yml" + auto_assign_content = auto_assign_path.read_text(encoding="utf-8") + assert "github.event.pull_request.user.type != 'Bot'" in auto_assign_content + + ci_path = ROOT / ".github" / "workflows" / "tests.yml" + ci_content = ci_path.read_text(encoding="utf-8") + assert "workflow_dispatch:" in ci_content + + +def test_extended_lock_defense_and_pytest_hardening() -> None: + """Verify multi-agent lock patterns in .gitignore and pytest hardening flags.""" + gitignore_path = ROOT / ".gitignore" + git_content = gitignore_path.read_text(encoding="utf-8") + for lock_pattern in [ + "LOCK.orchestrator.*", + "LOCK.operator.*", + "LOCK.worker.*", + "LOCK.thinker.*", + "LOCK.reviewer.*", + ]: + assert lock_pattern in git_content, f"Missing {lock_pattern} in .gitignore" + + pyproject_path = ROOT / "pyproject.toml" + data = tomllib.loads(pyproject_path.read_text(encoding="utf-8")) + pytest_opts = data.get("tool", {}).get("pytest", {}).get("ini_options", {}) + assert "--strict-markers" in pytest_opts.get("addopts", "") + assert pytest_opts.get("xfail_strict") is True + + +def test_marketing_log_audit_recency_20261107() -> None: + """Verify MARKETING-LOG.txt documents the 2026-11-07 Pfad A hygiene audit.""" + marketing_path = ROOT / "MARKETING-LOG.txt" + content = marketing_path.read_text(encoding="utf-8") + + assert "## [2026-11-07]" in content + assert "Pfad A" in content + assert "CI-Matrix-Härtung" in content + assert "Level 1 SBOM Re-Audit" in content +