diff --git a/.github/workflows/c5-regenerate.yml b/.github/workflows/c5-regenerate.yml index 2b1b44d..0655035 100644 --- a/.github/workflows/c5-regenerate.yml +++ b/.github/workflows/c5-regenerate.yml @@ -51,7 +51,7 @@ jobs: path: affinescript - name: Install OCaml - uses: ocaml/setup-ocaml@v3.9.0 + uses: ocaml/setup-ocaml@v3.8.0 with: ocaml-compiler: '4.14.2' diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index eee3880..a6ec77b 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -53,7 +53,7 @@ jobs: uses: actions/checkout@v7.0.1 - name: Set up Node.js - uses: actions/setup-node@v7.1.0 + uses: actions/setup-node@v7.0.0 with: node-version: '25' @@ -158,7 +158,7 @@ jobs: # ---- Node (for smoke test within E2E script) ---- - name: Set up Node.js - uses: actions/setup-node@v7.1.0 + uses: actions/setup-node@v7.0.0 with: node-version: '25' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3841579..4939a2d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -77,7 +77,7 @@ jobs: git cliff --output CHANGELOG.md - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@v7.0.1 with: name: changelog path: CHANGELOG.md diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index 280523b..c1e67b8 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -117,7 +117,7 @@ jobs: echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload panic-attack findings - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@v7.0.1 with: name: panic-attack-findings path: panic-attack-findings.json @@ -251,7 +251,7 @@ jobs: echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload hypatia findings - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@v7.0.1 with: name: hypatia-findings path: hypatia-findings.json @@ -341,7 +341,7 @@ jobs: echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload bridge report - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@v7.0.1 with: name: bridge-report path: bridge-report.json @@ -365,19 +365,19 @@ jobs: steps: - name: Download panic-attack findings - uses: actions/download-artifact@v8.0.2 + uses: actions/download-artifact@v8.0.1 with: name: panic-attack-findings path: findings/ - name: Download hypatia findings - uses: actions/download-artifact@v8.0.2 + uses: actions/download-artifact@v8.0.1 with: name: hypatia-findings path: findings/ - name: Download bridge report - uses: actions/download-artifact@v8.0.2 + uses: actions/download-artifact@v8.0.1 with: name: bridge-report path: findings/ @@ -439,7 +439,7 @@ jobs: echo "low=$LOW" >> "$GITHUB_OUTPUT" - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@v7.0.1 with: name: unified-findings path: findings/unified-findings.json diff --git a/README.adoc b/README.adoc index 49c3e33..ab420f8 100644 --- a/README.adoc +++ b/README.adoc @@ -223,7 +223,7 @@ PROOF-NEEDS.md # Outstanding proof obligations TEST-NEEDS.md # Outstanding test coverage docs/PRODUCTION-PATH.adoc # 6-phase plan to production-ready docs/onboarding/README.adoc # New here? Start here. -docs/WHITEPAPER.md # Full academic treatment +docs/WHITEPAPER.adoc # Full academic treatment AUDIT.adoc # Hard rules and audit posture ---- @@ -267,7 +267,7 @@ The post-codegen verifier's `verify_access_sites_from_module` pass shipped in PR GraalVM's Truffle framework has the same multi-language shared state problem. typed-wasm's approach could give GraalVM **compile-time guarantees** for cross-language interop, replacing runtime `InteropLibrary` dispatch with -compile-time schema agreement. See `docs/WHITEPAPER.md` for details. +compile-time schema agreement. See `docs/WHITEPAPER.adoc` for details. == License diff --git a/ROADMAP.adoc b/ROADMAP.adoc index f044194..8fbf15c 100644 --- a/ROADMAP.adoc +++ b/ROADMAP.adoc @@ -47,7 +47,7 @@ Key capabilities delivered: * `.twasm` grammar (spec/grammar.ebnf) -- EBNF surface syntax * 10-level spec (spec/type-safety-levels-for-wasm.adoc) -- checked DB-to-WASM core mapping * Example `.twasm` files for the checked core, plus draft higher-level examples -* Whitepaper drafts (docs/WHITEPAPER.md + docs/arxiv/typed-wasm.tex) under audit +* Whitepaper drafts (docs/WHITEPAPER.adoc + docs/arxiv/typed-wasm.tex) under audit * No unsound escape hatches in the checked Idris2 core (`believe_me`, `assert_total`) * Estate-axis accommodation (A15/A16, 2026-06-16): L11/L12/Echo now cross-document and mirror the canonical estate repos -- `tropical-resource-typing` (Lean4 diff --git a/tests/aspect/claim-envelope.mjs b/tests/aspect/claim-envelope.mjs index 856db59..ff8892a 100644 --- a/tests/aspect/claim-envelope.mjs +++ b/tests/aspect/claim-envelope.mjs @@ -5,7 +5,7 @@ // Claim-envelope aspect test. // // Every claim this repo makes in human-readable docs (README.adoc, -// ROADMAP.adoc, LEVEL-STATUS.md, EXPLAINME.adoc) is also a contract with +// ROADMAP.adoc, LEVEL-STATUS.adoc, EXPLAINME.adoc) is also a contract with // the artefacts it ships (src/abi/typed-wasm.ipkg, src/parser/*, Rust // crate constants, CI toolchain pins). When docs and artefacts drift, // nobody notices until an audit week later. @@ -106,7 +106,7 @@ function assertDocsAgreeOnL11L12(path, regex) { const stalePattern = /L11.{0,4}L12[^\n]{0,180}?(not part of|not in.*(?:package|ipkg)|standalone.*fail)/i; assertDocsAgreeOnL11L12("ROADMAP.adoc", stalePattern); -assertDocsAgreeOnL11L12("LEVEL-STATUS.md", stalePattern); +assertDocsAgreeOnL11L12("LEVEL-STATUS.adoc", stalePattern); assertDocsAgreeOnL11L12("README.adoc", stalePattern); // ---------------------------------------------------------------------- @@ -318,10 +318,10 @@ const rsrFiles = [ "LICENSE", "Justfile", "0-AI-MANIFEST.a2ml", - "LEVEL-STATUS.md", + "LEVEL-STATUS.adoc", "ROADMAP.adoc", - "PROOF-NEEDS.md", - "TEST-NEEDS.md", + "PROOF-NEEDS.adoc", + "TEST-NEEDS.adoc", "docs/PRODUCTION-PATH.adoc", // canonical strategic plan (added 2026-05-24) "docs/onboarding/README.adoc", // RSR taxonomy (added 2026-05-25) "docs/status/README.adoc", // RSR taxonomy (added 2026-05-25) diff --git a/tests/aspect/security-envelope.mjs b/tests/aspect/security-envelope.mjs index 743c249..27d1377 100644 --- a/tests/aspect/security-envelope.mjs +++ b/tests/aspect/security-envelope.mjs @@ -8,7 +8,7 @@ // checks that human-readable doc claims match shipped artefacts in // general, this file specifically checks SECURITY claims: // -// - SECURITY.md contact email matches .well-known/security.txt +// - SECURITY.md contact email matches www/.well-known/security.txt // - SPDX-License-Identifier headers present on all source files // - "believe_me: 0" README badge matches actual code (not comments) // - No committed secrets / private keys @@ -58,15 +58,15 @@ function maybeRead(rel) { } // ---------------------------------------------------------------------- -// 1. SECURITY.md ↔ .well-known/security.txt — contact alignment +// 1. SECURITY.md ↔ www/.well-known/security.txt — contact alignment // ---------------------------------------------------------------------- -section("1. SECURITY.md and .well-known/security.txt agree on contact"); +section("1. SECURITY.md and www/.well-known/security.txt agree on contact"); const securityMd = maybeRead("SECURITY.md"); -const securityTxt = maybeRead(".well-known/security.txt"); +const securityTxt = maybeRead("www/.well-known/security.txt"); if (!securityMd) bad("SECURITY.md missing"); -if (!securityTxt) bad(".well-known/security.txt missing"); +if (!securityTxt) bad("www/.well-known/security.txt missing"); if (securityMd && securityTxt) { const mdEmail = (securityMd.match(/[\w._%+-]+@[\w.-]+\.[A-Za-z]{2,}/) || [])[0]; @@ -74,7 +74,7 @@ if (securityMd && securityTxt) { || (securityTxt.match(/[\w._%+-]+@[\w.-]+\.[A-Za-z]{2,}/) || [])[0]; if (!mdEmail) bad("SECURITY.md has no contact email"); - else if (!txtEmail) bad(".well-known/security.txt has no Contact: line"); + else if (!txtEmail) bad("www/.well-known/security.txt has no Contact: line"); else if (mdEmail.toLowerCase() !== txtEmail.toLowerCase()) { bad(`Contact email mismatch: SECURITY.md=${mdEmail} vs security.txt=${txtEmail}`); } else { diff --git a/tests/e2e.sh b/tests/e2e.sh index c9f329a..e826725 100755 --- a/tests/e2e.sh +++ b/tests/e2e.sh @@ -11,7 +11,7 @@ # 4. Zig FFI implementation files are present # 5. ReScript parser source files are present # 6. JSON/TOML/IPKG configuration files are well-formed -# 7. LEVEL-STATUS.md documents all 12 levels +# 7. LEVEL-STATUS.adoc documents all 12 levels # 8. Grammar document is non-trivial # 9. SPDX licence headers are present on key files # @@ -65,17 +65,17 @@ else fail "Missing: spec/type-safety-levels-for-wasm.adoc" fi -# LEVEL-STATUS.md documents all 12 levels -if [ -f "LEVEL-STATUS.md" ]; then +# LEVEL-STATUS.adoc documents all 12 levels (AsciiDoc table rows read "|N |...") +if [ -f "LEVEL-STATUS.adoc" ]; then for lvl in $(seq 1 12); do - if grep -q "| $lvl |" "LEVEL-STATUS.md" 2>/dev/null; then - pass "LEVEL-STATUS.md contains level $lvl" + if grep -qE "^\|${lvl} \|" "LEVEL-STATUS.adoc" 2>/dev/null; then + pass "LEVEL-STATUS.adoc contains level $lvl" else - fail "LEVEL-STATUS.md missing entry for level $lvl" + fail "LEVEL-STATUS.adoc missing entry for level $lvl" fi done else - fail "Missing: LEVEL-STATUS.md" + fail "Missing: LEVEL-STATUS.adoc" fi # Grammar document