From f8314df96575f12881fbb5d562958f193b0e5af7 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Thu, 29 Oct 2026 10:20:51 -0400 Subject: [PATCH 01/45] feat: land P7 crunch carry (plugins) Brings the P7 crunch carry (refs/capp/crunch-carry/p7f-plugins, b3f4508a) onto main as one change: 43 commits not yet on main, merged over the 45 main commits since their base, keeping main's newer behaviour on conflict. Tickets: P7-AUTO-03 04 05 06 07 09 10 11 12 13 14 15 17 19 20 21 24 25, P7-CACHE-11 12 13 21, P7-CI-46 48 62 65 66, P7-HOST-15, P7-NODE-11 17 18 30, P7-PLUG-39, P7-SCHED-14 16 20, P7-TRUST-16, P7-TRUTH-10 37. Conflict resolution: - plan placement keeps main's trust class and run-scope values; the carry's placementRun global is gone (schedRevisionValues reads the same flags) and attachPlacement uses main's buildPlanned. - agent session handles upgrade (main) and digest/chunk restore frames (carry); the transport route keeps main's result fields and the carry's restore offsets and arm hook. - Trust-Security-and-Privacy.md keeps the carry's structure and adds main's production boundary, cert issuance, audit recovery, policy limit, node registry preparation and isolation availability sections. - Reference.md is owned by refgen; the pull-agent reference generator now writes Agent-Reference.md, linked from the sidebar. Fixes so the merged tree is green: - refgen resolves serve install/uninstall keys; unresolved keys name the file. - surface spec rows for nodes forget-project, serve admin cert, serve watch and the explain scheduling flags; plugin.json regenerated. - tests follow shipped behaviour: the pools.record publish gate slot, the auto preset, an abandoned fleet reader, and refgen's codes.go. - the ci surface ceiling skips the hidden internal netproxy helper. - removes the Transactional-Email wiki page; main stopped serving the plugin (D-1458) and the page was an orphan. - truth findings from main's two-line claim matching: blank lines split footer metadata, a port range label reworded, the rule's own example exempted with a reason. --- .github/ROADMAP.md | 4 +- .github/scripts/check-doc-commands.sh | 4 + .github/truth/repo.yaml | 18 + .github/wiki/Contributing.md | 2 +- .github/wiki/Home.md | 10 +- .github/wiki/Plugin-Development.md | 10 +- .github/wiki/Plugin-Marketplace.md | 4 +- .github/wiki/Preflight.md | 19 + .github/wiki/Standards.md | 2 +- .github/wiki/Truth-Rules.md | 1 + .github/wiki/_Sidebar.md | 20 +- .github/wiki/architecture/CI-Matrix.md | 4 +- .github/wiki/guides/Configuration.md | 4 +- .github/wiki/guides/ci/Agent-Reference.md | 51 + .../guides/ci/Auto-Placement-and-Pools.md | 95 + .github/wiki/guides/ci/Cache-and-Artifacts.md | 312 +++ .../guides/ci/Evidence-and-Machine-Output.md | 235 ++ .github/wiki/guides/ci/Hosted-Providers.md | 259 ++ .github/wiki/guides/ci/Nodes-and-Runners.md | 68 + .github/wiki/guides/ci/Reference.md | 729 ++++- .github/wiki/guides/ci/Scheduling-and-Cost.md | 180 +- .../guides/ci/Trust-Security-and-Privacy.md | 374 ++- .github/wiki/guides/ci/Watch-and-Services.md | 77 + .github/wiki/plugins/AI-CLI.md | 11 +- .github/wiki/plugins/AI-Studio.md | 11 +- .github/wiki/plugins/API.md | 11 +- .github/wiki/plugins/Access-Controls.md | 2 +- .github/wiki/plugins/Admin-Api.md | 2 +- .github/wiki/plugins/Alerts.md | 11 +- .github/wiki/plugins/Analytics.md | 2 +- .github/wiki/plugins/Audit-Analytics.md | 2 +- .github/wiki/plugins/Audit-Log.md | 2 +- .github/wiki/plugins/Audit.md | 11 +- .github/wiki/plugins/Auth-Enterprise.md | 2 +- .github/wiki/plugins/BYOK.md | 2 +- .github/wiki/plugins/Backup.md | 2 +- .github/wiki/plugins/CDC.md | 2 +- .github/wiki/plugins/CDN.md | 2 +- .github/wiki/plugins/CI.md | 93 +- .github/wiki/plugins/CRDT.md | 2 +- .github/wiki/plugins/Claw-CLI.md | 11 +- .github/wiki/plugins/Cloudflare.md | 2 +- .github/wiki/plugins/Compliance.md | 2 +- .github/wiki/plugins/Content-Acquisition.md | 2 +- .github/wiki/plugins/Content-Progress.md | 2 +- .github/wiki/plugins/Content-Safety.md | 2 +- .github/wiki/plugins/Costs.md | 11 +- .github/wiki/plugins/Cron.md | 2 +- .github/wiki/plugins/DDNS.md | 2 +- .github/wiki/plugins/DLQ.md | 11 +- .github/wiki/plugins/DR.md | 11 +- .github/wiki/plugins/Devices.md | 2 +- .github/wiki/plugins/Documents.md | 2 +- .github/wiki/plugins/Dogfood.md | 11 +- .github/wiki/plugins/Donorbox.md | 2 +- .github/wiki/plugins/E2EE.md | 2 +- .github/wiki/plugins/Email.md | 2 +- .github/wiki/plugins/Encryption.md | 11 +- .github/wiki/plugins/Entitlements.md | 2 +- .github/wiki/plugins/Event-Bus.md | 2 +- .github/wiki/plugins/Family-Ancestry.md | 2 +- .github/wiki/plugins/Family-FamilySearch.md | 2 +- .github/wiki/plugins/Family-GEDCOM.md | 2 +- .github/wiki/plugins/Family-MyHeritage.md | 2 +- .github/wiki/plugins/Family-WikiTree.md | 2 +- .github/wiki/plugins/Feature-Flags.md | 2 +- .github/wiki/plugins/Federation.md | 11 +- .github/wiki/plugins/File-Processing.md | 2 +- .github/wiki/plugins/Flags.md | 11 +- .github/wiki/plugins/Forgejo.md | 2 +- .github/wiki/plugins/Functions-V8.md | 2 +- .github/wiki/plugins/Functions.md | 15 +- .github/wiki/plugins/GDPR.md | 11 +- .github/wiki/plugins/Game-Metadata.md | 2 +- .github/wiki/plugins/Gateway.md | 11 +- .github/wiki/plugins/Gauth.md | 11 +- .github/wiki/plugins/Geocoding.md | 2 +- .github/wiki/plugins/GitHub-Runner.md | 2 +- .github/wiki/plugins/GitHub.md | 2 +- .github/wiki/plugins/HIPAA.md | 2 +- .github/wiki/plugins/Home.md | 2 +- .github/wiki/plugins/IDme.md | 3 +- .github/wiki/plugins/Infra.md | 18 +- .github/wiki/plugins/Invitations.md | 2 +- .github/wiki/plugins/Job-Queue.md | 2 +- .github/wiki/plugins/Jobs.md | 3 +- .github/wiki/plugins/K8s.md | 17 +- .github/wiki/plugins/Link-Preview.md | 2 +- .github/wiki/plugins/LinkedIn.md | 2 +- .github/wiki/plugins/MDNS.md | 2 +- .github/wiki/plugins/MLflow.md | 2 +- .github/wiki/plugins/Mail.md | 11 +- .github/wiki/plugins/Maintenance.md | 11 +- .github/wiki/plugins/Media-Processing.md | 2 +- .github/wiki/plugins/Meetings.md | 2 +- .github/wiki/plugins/Minio.md | 2 +- .github/wiki/plugins/Model.md | 11 +- .github/wiki/plugins/Moderation.md | 1 + .github/wiki/plugins/Monitor.md | 11 +- .github/wiki/plugins/Notifications.md | 3 +- .github/wiki/plugins/Notify.md | 2 +- .github/wiki/plugins/Object-Storage.md | 2 +- .github/wiki/plugins/Observability.md | 2 +- .github/wiki/plugins/Ollama.md | 2 +- .github/wiki/plugins/PayPal.md | 2 +- .github/wiki/plugins/Payments.md | 2 +- .github/wiki/plugins/Pentest-Kit.md | 11 +- .github/wiki/plugins/Pentest.md | 2 +- .github/wiki/plugins/Plugin-ClawDE.md | 2 +- .github/wiki/plugins/Plugin-Dev.md | 17 +- .github/wiki/plugins/Plugin-Gauth.md | 2 +- .github/wiki/plugins/Plugin-LLM-Gateway.md | 2 +- .github/wiki/plugins/Plugin-PTY.md | 2 +- .github/wiki/plugins/Plugin-Retrieval.md | 2 +- .github/wiki/plugins/Podcast.md | 2 +- .github/wiki/plugins/Post.md | 2 +- .github/wiki/plugins/Push.md | 2 +- .github/wiki/plugins/Queue.md | 11 +- .github/wiki/plugins/Region.md | 11 +- .github/wiki/plugins/Release.md | 11 +- .github/wiki/plugins/Retro-Gaming.md | 2 +- .github/wiki/plugins/Rom-Discovery.md | 2 +- .github/wiki/plugins/SIEM.md | 2 +- .github/wiki/plugins/SMS.md | 2 +- .github/wiki/plugins/Search.md | 2 +- .github/wiki/plugins/Sentry-CLI.md | 26 +- .github/wiki/plugins/Shared-Utils.md | 2 +- .github/wiki/plugins/Shopify.md | 2 +- .github/wiki/plugins/Soak.md | 11 +- .github/wiki/plugins/Sports.md | 2 +- .github/wiki/plugins/Storage.md | 2 +- .github/wiki/plugins/Stripe.md | 2 +- .github/wiki/plugins/Subtitle-Manager.md | 2 +- .github/wiki/plugins/TMDB.md | 2 +- .github/wiki/plugins/Tenant-Controller.md | 2 +- .github/wiki/plugins/Tenant.md | 11 +- .github/wiki/plugins/Tokens.md | 2 +- .github/wiki/plugins/Torrent-Manager.md | 2 +- .github/wiki/plugins/Traefik.md | 2 +- .github/wiki/plugins/Transactional-Email.md | 79 - .github/wiki/plugins/VPN.md | 2 +- .github/wiki/plugins/WAF.md | 11 +- .github/wiki/plugins/Watchdog.md | 11 +- .github/wiki/plugins/Web3.md | 2 +- .github/wiki/plugins/Webhooks.md | 11 +- .github/wiki/plugins/Workflows.md | 2 +- .github/wiki/plugins/nSelf-Cloud.md | 2 +- .github/wiki/plugins/nSelf-Eval-Gate.md | 11 +- .github/wiki/plugins/nSelf-Geo.md | 2 +- .github/wiki/plugins/nSelf-Image.md | 2 +- .github/wiki/plugins/nSelf-PDF.md | 2 +- .github/wiki/plugins/nSelf-Scan.md | 2 +- .github/wiki/plugins/nSelf-Sync.md | 2 +- .github/wiki/plugins/nSelf-Vault.md | 2 +- .github/workflows/ci-auto-conformance.yml | 65 + .github/workflows/ci-bench.yml | 59 + .github/workflows/nself-ci.yml | 6 +- .nself/ci.yaml | 28 +- README.md | 12 +- free/ci/bench/CI-46-status.md | 44 + free/ci/bench/cache/bench_test.go | 86 + free/ci/bench/cache/cmd/cachebench/main.go | 239 ++ free/ci/bench/cache/doc.go | 5 + free/ci/bench/cache/harness.go | 84 + free/ci/bench/cache/metrics.go | 56 + free/ci/bench/cache/perf-budget.json | 15 + free/ci/bench/sched/SCHED-14-status.md | 54 + free/ci/bench/sched/local_test.go | 118 + free/ci/bench/sched/overhead.go | 128 + free/ci/bench/sched/overhead_test.go | 109 + free/ci/bench/sched/relative.go | 38 + free/ci/cmd/agent/cache_hook.go | 5 +- free/ci/cmd/agent/cache_lifecycle.go | 17 + free/ci/cmd/codes_registry_test.go | 4 + free/ci/cmd/config_ignore.go | 176 ++ free/ci/cmd/config_ignore_test.go | 151 ++ free/ci/cmd/doctor_selftest.go | 130 + free/ci/cmd/nodes_label.go | 205 ++ free/ci/cmd/nodes_pools.go | 263 ++ free/ci/cmd/nodes_pools_record.go | 98 + free/ci/cmd/nodes_pools_test.go | 147 + free/ci/cmd/nodes_projects.go | 241 ++ free/ci/cmd/nodes_status.go | 180 ++ free/ci/cmd/nodes_status_fleet_test.go | 151 ++ free/ci/cmd/nodes_sync.go | 170 ++ free/ci/cmd/nodes_sync_test.go | 126 + free/ci/cmd/runs_rerun.go | 154 ++ free/ci/cmd/runs_rerun_test.go | 54 + free/ci/cmd/runs_stats.go | 131 + free/ci/cmd/runs_tidy.go | 152 ++ free/ci/cmd/serve_install.go | 116 + free/ci/cmd/serve_install_test.go | 102 + free/ci/cmd/serve_watch.go | 311 +++ free/ci/cmd/surface_test.go | 257 ++ free/ci/cmd/v15.go | 1 + free/ci/cmd/v15_json.go | 2 +- free/ci/cmd/v15_machine.go | 37 + free/ci/cmd/v15_machine_test.go | 47 + free/ci/cmd/v15_where.go | 177 ++ free/ci/cmd/v15_where_test.go | 90 + free/ci/internal/agent/session/control.go | 8 +- free/ci/internal/agent/session/inbound.go | 80 + .../ci/internal/agent/session/inbound_test.go | 100 + free/ci/internal/agent/session/lease.go | 16 +- free/ci/internal/cache/remote/coord.go | 3 + .../cache/remote/integration_agent_test.go | 3 +- .../cache/remote/integration_restore_test.go | 235 ++ .../cache/remote/integration_ssh_test.go | 2 +- .../internal/cache/remote/integration_test.go | 12 + free/ci/internal/cache/remote/node_restore.go | 164 ++ .../ci/internal/cache/remote/restore_coord.go | 147 + .../internal/cache/remote/restore_offsets.go | 126 + .../internal/cache/remote/restore_receiver.go | 217 ++ .../cache/remote/restore_receiver_test.go | 217 ++ free/ci/internal/cache/remote/restore_test.go | 223 ++ free/ci/internal/claims/claims.go | 237 ++ free/ci/internal/claims/claims_test.go | 207 ++ .../internal/coordclient/nodes_placement.go | 35 + .../coordclient/nodes_placement_test.go | 90 + free/ci/internal/coordclient/stats.go | 46 + free/ci/internal/coordclient/stats_test.go | 86 + .../internal/coordinator/agentapi/frames.go | 6 + free/ci/internal/coordinator/agentapi/push.go | 58 + .../coordinator/agentapi/push_test.go | 71 + .../clientapi/nodes_placement_routes.go | 193 ++ .../clientapi/nodes_placement_routes_test.go | 151 ++ .../coordinator/clientapi/stats_route.go | 114 + .../coordinator/clientapi/stats_route_test.go | 88 + free/ci/internal/demand/demand_test.go | 173 ++ free/ci/internal/demand/doc.go | 3 + free/ci/internal/demand/read.go | 49 + free/ci/internal/demand/types.go | 38 + free/ci/internal/demand/write.go | 74 + free/ci/internal/dispatch/bench_test.go | 73 + free/ci/internal/dispatch/tick.go | 13 +- free/ci/internal/doctor/cli.go | 18 +- free/ci/internal/doctor/sections.go | 35 +- .../internal/evidence/projection/markdown.go | 21 + .../evidence/projection/projection.go | 152 ++ .../evidence/projection/projection_test.go | 98 + .../evidence/testdata/Evidence-Projection.md | 37 + .../evidence/testdata/evidence.attempts.json | 133 + .../testdata/evidence.pre-auto21.json | 79 + .../evidence/testdata/projected.attempts.json | 161 ++ .../testdata/projected.pre-auto21.json | 59 + free/ci/internal/fleet/ask.go | 121 + free/ci/internal/fleet/doc.go | 8 + free/ci/internal/fleet/fleet_test.go | 213 ++ free/ci/internal/fleet/gather.go | 71 + free/ci/internal/fleet/render.go | 75 + free/ci/internal/fleet/row.go | 110 + free/ci/internal/fleet/types.go | 73 + free/ci/internal/gates/gitleaks_ignore.go | 251 ++ .../ci/internal/gates/gitleaks_ignore_test.go | 145 + free/ci/internal/hostedtier/config.go | 44 + free/ci/internal/hostedtier/decide.go | 124 + free/ci/internal/hostedtier/decide_test.go | 100 + free/ci/internal/hostedtier/fixture_test.go | 45 + free/ci/internal/hostedtier/health.go | 36 + free/ci/internal/hostedtier/types.go | 108 + free/ci/internal/model/evidence.go | 3 + free/ci/internal/model/evidence_attempts.go | 40 + .../internal/model/evidence_attempts_test.go | 37 + free/ci/internal/model/schema.go | 5 + .../invalid/evidence.attempt-kind.json | 133 + .../testdata/valid/evidence.attempts.json | 133 + free/ci/internal/nodes/inventory/candidate.go | 69 + free/ci/internal/nodes/inventory/codes.go | 53 + free/ci/internal/nodes/inventory/decode.go | 125 + .../internal/nodes/inventory/decode_test.go | 140 + free/ci/internal/nodes/inventory/read.go | 81 + .../internal/nodes/inventory/schema_test.go | 64 + free/ci/internal/nodes/inventory/sync.go | 257 ++ free/ci/internal/nodes/inventory/sync_test.go | 259 ++ free/ci/internal/nodes/inventory/want.go | 38 + free/ci/internal/nodes/labels/apply.go | 87 + free/ci/internal/nodes/labels/apply_test.go | 168 ++ free/ci/internal/nodes/labels/codes.go | 53 + free/ci/internal/nodes/labels/labels.go | 78 + free/ci/internal/nodes/labels/labels_test.go | 126 + free/ci/internal/nodes/labels/lazy.go | 65 + free/ci/internal/nodes/labels/lazy_test.go | 47 + free/ci/internal/nodes/labels/projects.go | 115 + free/ci/internal/nodes/labels/source.go | 35 + free/ci/internal/nodes/lifecycle/cli_cmds.go | 11 +- .../nodes/lifecycle/placement_view_test.go | 90 + free/ci/internal/nodes/lifecycle/view.go | 28 +- free/ci/internal/nodes/probe/demand_read.go | 116 + .../internal/nodes/probe/demand_read_test.go | 115 + free/ci/internal/offload/codes.go | 7 + free/ci/internal/offload/secrets.go | 33 + free/ci/internal/offload/snapshot.go | 157 ++ free/ci/internal/offload/snapshot_test.go | 157 ++ free/ci/internal/planview/human.go | 25 +- free/ci/internal/pools/contract.go | 73 + free/ci/internal/pools/contract_test.go | 105 + free/ci/internal/pools/explain.go | 47 + free/ci/internal/pools/ids.go | 49 + free/ci/internal/pools/keys.go | 119 + free/ci/internal/pools/provider.go | 106 + free/ci/internal/pools/record/provider.go | 34 + free/ci/internal/pools/record/record.go | 108 + free/ci/internal/pools/record/record_test.go | 98 + free/ci/internal/pools/resolve.go | 138 + free/ci/internal/pools/resolve_test.go | 175 ++ .../internal/pools/testdata/pools.golden.json | 81 + free/ci/internal/preflight/licensed.go | 106 + free/ci/internal/preflight/licensed_test.go | 76 + .../providers/github/reconcile/scan_export.go | 203 ++ free/ci/internal/race/attempts.go | 69 + free/ci/internal/race/hook.go | 105 + free/ci/internal/race/hook_test.go | 53 + free/ci/internal/race/policy.go | 97 + free/ci/internal/race/race.go | 157 ++ free/ci/internal/race/race_test.go | 201 ++ free/ci/internal/race/result.go | 76 + free/ci/internal/race/select.go | 136 + free/ci/internal/race/select_test.go | 129 + free/ci/internal/report/context_test.go | 36 + free/ci/internal/report/github.go | 2 +- free/ci/internal/report/ledger.go | 43 + free/ci/internal/report/ledger_gh.go | 107 + free/ci/internal/report/ledger_gh_test.go | 58 + free/ci/internal/report/ledger_test.go | 13 + free/ci/internal/report/outbox.go | 16 +- free/ci/internal/report/reporter.go | 15 + free/ci/internal/report/result_context.go | 110 + .../ci/internal/report/result_context_test.go | 43 + free/ci/internal/report/sender.go | 2 +- free/ci/internal/run/evidence.go | 38 + .../ci/internal/run/evidence_attempts_test.go | 54 + free/ci/internal/run/hooks_slots_test.go | 13 +- free/ci/internal/run/offload_hook.go | 62 + free/ci/internal/run/offload_hook_test.go | 59 + free/ci/internal/run/race_hook.go | 90 + free/ci/internal/run/race_hook_test.go | 44 + free/ci/internal/run/record_gate.go | 223 ++ free/ci/internal/run/record_gate_test.go | 176 ++ free/ci/internal/run/remote_cache_hook.go | 10 + free/ci/internal/sched/auto.go | 149 ++ free/ci/internal/sched/auto_test.go | 224 ++ free/ci/internal/sched/bench_test.go | 34 + free/ci/internal/sched/place.go | 7 +- free/ci/internal/sched/preset_test.go | 3 +- free/ci/internal/sched/presets.go | 3 + free/ci/internal/schedpolicy/placement.go | 3 + free/ci/internal/selftest/alert.go | 140 + free/ci/internal/selftest/checks.go | 125 + free/ci/internal/selftest/checks_state.go | 93 + free/ci/internal/selftest/disk_unix.go | 21 + free/ci/internal/selftest/disk_windows.go | 8 + free/ci/internal/selftest/facts.go | 121 + free/ci/internal/selftest/keys.go | 89 + free/ci/internal/selftest/local.go | 169 ++ free/ci/internal/selftest/orphans.go | 55 + free/ci/internal/selftest/tidy.go | 96 + free/ci/internal/selftest/tidy_history.go | 92 + free/ci/internal/selftest/tidy_steps.go | 43 + free/ci/internal/stats/blocks.go | 199 ++ free/ci/internal/stats/compute.go | 122 + free/ci/internal/stats/fixture_test.go | 159 ++ free/ci/internal/stats/golden_test.go | 130 + free/ci/internal/stats/health.go | 122 + free/ci/internal/stats/health_test.go | 83 + free/ci/internal/stats/pct.go | 25 + free/ci/internal/stats/plan_test.go | 72 + free/ci/internal/stats/race_off_test.go | 6 + free/ci/internal/stats/race_on_test.go | 6 + free/ci/internal/stats/runs.go | 93 + free/ci/internal/stats/space_other.go | 10 + free/ci/internal/stats/space_unix.go | 18 + .../internal/stats/testdata/all.golden.json | 139 + .../stats/testdata/project-a.golden.json | 128 + free/ci/internal/stats/text.go | 94 + free/ci/internal/stats/types.go | 125 + .../migrations/node-labels/0001_labels.sql | 12 + free/ci/internal/store/node_labels.go | 203 ++ free/ci/internal/store/node_labels_test.go | 93 + free/ci/internal/store/sched_stats.go | 183 ++ free/ci/internal/store/sched_stats_test.go | 66 + free/ci/internal/svc/config.go | 104 + free/ci/internal/svc/install.go | 240 ++ free/ci/internal/svc/install_test.go | 205 ++ free/ci/internal/svc/manager.go | 117 + free/ci/internal/svc/render.go | 116 + free/ci/internal/svc/render_test.go | 190 ++ free/ci/internal/svc/system.go | 116 + free/ci/internal/tiers/bias.go | 111 + free/ci/internal/tiers/plan_test.go | 141 + .../tiers/testdata/auto-explain.golden.txt | 30 + .../tiers/testdata/auto-plan.golden.json | 649 +++++ free/ci/internal/tiers/tiers.go | 122 + free/ci/internal/tiers/tiers_test.go | 129 + free/ci/internal/transport/agent/driver.go | 17 +- free/ci/internal/transport/agent/restore.go | 120 + free/ci/internal/transport/restore.go | 49 + free/ci/internal/transport/ssh/restore.go | 60 + free/ci/internal/transport/ssh/run.go | 3 +- free/ci/internal/transport/ssh/serve.go | 5 + free/ci/internal/watch/candidates.go | 67 + free/ci/internal/watch/codes.go | 26 + free/ci/internal/watch/commit.go | 204 ++ free/ci/internal/watch/drain_test.go | 123 + free/ci/internal/watch/fake_test.go | 186 ++ free/ci/internal/watch/keys.go | 201 ++ free/ci/internal/watch/logs.go | 129 + free/ci/internal/watch/logs_test.go | 63 + free/ci/internal/watch/loop.go | 63 + free/ci/internal/watch/run.go | 130 + free/ci/internal/watch/types.go | 169 ++ free/ci/internal/watch/watch_test.go | 196 ++ free/ci/internal/watch/watcher.go | 182 ++ free/ci/internal/where/where.go | 135 + free/ci/internal/where/where_test.go | 93 + free/ci/plugin.json | 2359 ++++++++++++++++- free/ci/schemas/ci-conformance.v1.schema.json | 53 + free/ci/schemas/ci-evidence.v1.schema.json | 107 + free/ci/schemas/demand.v1.schema.json | 81 + free/ci/schemas/inventory.v1.schema.json | 32 + free/ci/schemas/placement-plan.v1.schema.json | 1 + free/ci/schemas/pool.v1.schema.json | 139 + free/ci/scripts/ci-conformance.sh | 126 + free/ci/scripts/conformance/a01.sh | 19 + free/ci/scripts/conformance/a02.sh | 18 + free/ci/scripts/conformance/a03.sh | 16 + free/ci/scripts/conformance/a04.sh | 19 + free/ci/scripts/conformance/a05.sh | 16 + free/ci/scripts/conformance/a06.sh | 17 + free/ci/scripts/conformance/a07.sh | 15 + free/ci/scripts/conformance/a08.sh | 18 + free/ci/scripts/conformance/a09.sh | 14 + free/ci/scripts/conformance/a10.sh | 13 + free/ci/scripts/conformance/lib.sh | 88 + free/ci/surface/commands.yaml | 911 +++++++ free/ci/test/cachesec/artifact_test.go | 119 + free/ci/test/cachesec/cache_test.go | 139 + free/ci/test/cachesec/doc.go | 3 + free/ci/test/cachesec/matrix.yaml | 43 + free/ci/test/cachesec/matrix_test.go | 50 + free/ci/test/cachesec/release_test.go | 94 + free/ci/test/cachesec/rig_test.go | 158 ++ free/ci/test/cachesec/transfer_test.go | 109 + free/ci/test/reliability/carrier_test.go | 216 ++ .../reliability/coordinator_outage_test.go | 193 ++ free/ci/test/reliability/doc.go | 19 + free/ci/test/reliability/scenario9_test.go | 162 ++ free/ci/test/reliability/sim_agent_test.go | 144 + free/ci/test/reliability/sim_world_test.go | 219 ++ free/ci/test/sim/auto/a10_scope_test.go | 36 + free/ci/test/sim/auto/a3_watch_test.go | 160 ++ free/ci/test/sim/auto/a4_hosted_test.go | 74 + free/ci/test/sim/auto/a5_offload_test.go | 78 + free/ci/test/sim/auto/a6_refusal_test.go | 77 + free/ci/test/sim/auto/a7_race_test.go | 102 + free/ci/test/sim/auto/a9_deadnode_test.go | 49 + free/ci/test/sim/auto/doc.go | 8 + free/ci/test/sim/claims_test.go | 180 ++ free/ci/test/sim/multiproject_test.go | 248 ++ free/ci/test/sim/perf_test.go | 150 ++ free/ci/test/sim/race_test.go | 143 + free/ci/test/sim/scope_test.go | 174 ++ free/ci/test/sim/status_dead_node_test.go | 96 + free/ci/test/sim/watch_test.go | 237 ++ free/ci/test/sim/where_test.go | 151 ++ free/ci/tools/doccmds/check.go | 85 + free/ci/tools/doccmds/check_test.go | 177 ++ free/ci/tools/doccmds/extract.go | 83 + free/ci/tools/doccmds/extract_test.go | 87 + free/ci/tools/doccmds/main.go | 63 + free/ci/tools/doccmds/main_test.go | 63 + free/ci/tools/doccmds/runner.go | 73 + free/ci/tools/doccmds/testdata/expect-fail.md | 20 + free/ci/tools/doccmds/testdata/fail.md | 15 + free/ci/tools/doccmds/testdata/no-blocks.md | 7 + free/ci/tools/doccmds/testdata/pass.md | 15 + free/ci/tools/manifestgen/main.go | 62 + free/ci/tools/manifestgen/manifestgen_test.go | 108 + free/ci/tools/manifestgen/render.go | 69 + free/ci/tools/manifestgen/spec.go | 161 ++ free/ci/tools/refgen/codes.go | 191 ++ free/ci/tools/refgen/commands.go | 176 ++ free/ci/tools/refgen/evidence.go | 116 + free/ci/tools/refgen/flags.go | 126 + free/ci/tools/refgen/main.go | 145 + free/ci/tools/refgen/reference_test.go | 51 + free/ci/tools/refgen/render.go | 140 + free/ci/tools/refgen/scan.go | 229 ++ free/ci/tools/refgen/sched.go | 81 + free/ci/tools/refgen/sched_test.go | 35 + free/ci/tools/refgen/sidebar.go | 77 + free/ci/tools/refgen/trustreasons.go | 29 + free/ci/tools/refgen/trustreasons_test.go | 23 + free/ci/tools/refgen/walker.go | 175 ++ free/job-queue/README.md | 1 + scripts/ci/ci-conformance-check.py | 113 + scripts/ci/ci-machine-surface.sh | 142 + scripts/generate-ci-agent-reference.py | 9 +- scripts/generate-wiki-plugin-page.py | 117 +- scripts/preflight/licensed.sh | 141 + scripts/test_generate_wiki_plugin_page.py | 59 +- .../testdata/wiki-plugin-pages/catalog.json | 5 +- .../wiki-plugin-pages/surface-vectors.json | 21 + scripts/wiki-plugin-pages.yaml | 6 +- 503 files changed, 38977 insertions(+), 554 deletions(-) create mode 100755 .github/scripts/check-doc-commands.sh create mode 100644 .github/truth/repo.yaml create mode 100644 .github/wiki/guides/ci/Agent-Reference.md create mode 100644 .github/wiki/guides/ci/Auto-Placement-and-Pools.md create mode 100644 .github/wiki/guides/ci/Cache-and-Artifacts.md create mode 100644 .github/wiki/guides/ci/Evidence-and-Machine-Output.md create mode 100644 .github/wiki/guides/ci/Hosted-Providers.md create mode 100644 .github/wiki/guides/ci/Nodes-and-Runners.md create mode 100644 .github/wiki/guides/ci/Watch-and-Services.md delete mode 100644 .github/wiki/plugins/Transactional-Email.md create mode 100644 .github/workflows/ci-auto-conformance.yml create mode 100644 .github/workflows/ci-bench.yml create mode 100644 free/ci/bench/CI-46-status.md create mode 100644 free/ci/bench/cache/bench_test.go create mode 100644 free/ci/bench/cache/cmd/cachebench/main.go create mode 100644 free/ci/bench/cache/doc.go create mode 100644 free/ci/bench/cache/harness.go create mode 100644 free/ci/bench/cache/metrics.go create mode 100644 free/ci/bench/cache/perf-budget.json create mode 100644 free/ci/bench/sched/SCHED-14-status.md create mode 100644 free/ci/bench/sched/local_test.go create mode 100644 free/ci/bench/sched/overhead.go create mode 100644 free/ci/bench/sched/overhead_test.go create mode 100644 free/ci/bench/sched/relative.go create mode 100644 free/ci/cmd/config_ignore.go create mode 100644 free/ci/cmd/config_ignore_test.go create mode 100644 free/ci/cmd/doctor_selftest.go create mode 100644 free/ci/cmd/nodes_label.go create mode 100644 free/ci/cmd/nodes_pools.go create mode 100644 free/ci/cmd/nodes_pools_record.go create mode 100644 free/ci/cmd/nodes_pools_test.go create mode 100644 free/ci/cmd/nodes_projects.go create mode 100644 free/ci/cmd/nodes_status.go create mode 100644 free/ci/cmd/nodes_status_fleet_test.go create mode 100644 free/ci/cmd/nodes_sync.go create mode 100644 free/ci/cmd/nodes_sync_test.go create mode 100644 free/ci/cmd/runs_rerun.go create mode 100644 free/ci/cmd/runs_rerun_test.go create mode 100644 free/ci/cmd/runs_stats.go create mode 100644 free/ci/cmd/runs_tidy.go create mode 100644 free/ci/cmd/serve_install.go create mode 100644 free/ci/cmd/serve_install_test.go create mode 100644 free/ci/cmd/serve_watch.go create mode 100644 free/ci/cmd/surface_test.go create mode 100644 free/ci/cmd/v15_machine.go create mode 100644 free/ci/cmd/v15_machine_test.go create mode 100644 free/ci/cmd/v15_where.go create mode 100644 free/ci/cmd/v15_where_test.go create mode 100644 free/ci/internal/agent/session/inbound.go create mode 100644 free/ci/internal/agent/session/inbound_test.go create mode 100644 free/ci/internal/cache/remote/integration_restore_test.go create mode 100644 free/ci/internal/cache/remote/node_restore.go create mode 100644 free/ci/internal/cache/remote/restore_coord.go create mode 100644 free/ci/internal/cache/remote/restore_offsets.go create mode 100644 free/ci/internal/cache/remote/restore_receiver.go create mode 100644 free/ci/internal/cache/remote/restore_receiver_test.go create mode 100644 free/ci/internal/cache/remote/restore_test.go create mode 100644 free/ci/internal/claims/claims.go create mode 100644 free/ci/internal/claims/claims_test.go create mode 100644 free/ci/internal/coordclient/nodes_placement.go create mode 100644 free/ci/internal/coordclient/nodes_placement_test.go create mode 100644 free/ci/internal/coordclient/stats.go create mode 100644 free/ci/internal/coordclient/stats_test.go create mode 100644 free/ci/internal/coordinator/agentapi/push.go create mode 100644 free/ci/internal/coordinator/agentapi/push_test.go create mode 100644 free/ci/internal/coordinator/clientapi/nodes_placement_routes.go create mode 100644 free/ci/internal/coordinator/clientapi/nodes_placement_routes_test.go create mode 100644 free/ci/internal/coordinator/clientapi/stats_route.go create mode 100644 free/ci/internal/coordinator/clientapi/stats_route_test.go create mode 100644 free/ci/internal/demand/demand_test.go create mode 100644 free/ci/internal/demand/doc.go create mode 100644 free/ci/internal/demand/read.go create mode 100644 free/ci/internal/demand/types.go create mode 100644 free/ci/internal/demand/write.go create mode 100644 free/ci/internal/dispatch/bench_test.go create mode 100644 free/ci/internal/evidence/projection/markdown.go create mode 100644 free/ci/internal/evidence/projection/projection.go create mode 100644 free/ci/internal/evidence/projection/projection_test.go create mode 100644 free/ci/internal/evidence/testdata/Evidence-Projection.md create mode 100644 free/ci/internal/evidence/testdata/evidence.attempts.json create mode 100644 free/ci/internal/evidence/testdata/evidence.pre-auto21.json create mode 100644 free/ci/internal/evidence/testdata/projected.attempts.json create mode 100644 free/ci/internal/evidence/testdata/projected.pre-auto21.json create mode 100644 free/ci/internal/fleet/ask.go create mode 100644 free/ci/internal/fleet/doc.go create mode 100644 free/ci/internal/fleet/fleet_test.go create mode 100644 free/ci/internal/fleet/gather.go create mode 100644 free/ci/internal/fleet/render.go create mode 100644 free/ci/internal/fleet/row.go create mode 100644 free/ci/internal/fleet/types.go create mode 100644 free/ci/internal/gates/gitleaks_ignore.go create mode 100644 free/ci/internal/gates/gitleaks_ignore_test.go create mode 100644 free/ci/internal/hostedtier/config.go create mode 100644 free/ci/internal/hostedtier/decide.go create mode 100644 free/ci/internal/hostedtier/decide_test.go create mode 100644 free/ci/internal/hostedtier/fixture_test.go create mode 100644 free/ci/internal/hostedtier/health.go create mode 100644 free/ci/internal/hostedtier/types.go create mode 100644 free/ci/internal/model/evidence_attempts.go create mode 100644 free/ci/internal/model/evidence_attempts_test.go create mode 100644 free/ci/internal/model/testdata/invalid/evidence.attempt-kind.json create mode 100644 free/ci/internal/model/testdata/valid/evidence.attempts.json create mode 100644 free/ci/internal/nodes/inventory/candidate.go create mode 100644 free/ci/internal/nodes/inventory/codes.go create mode 100644 free/ci/internal/nodes/inventory/decode.go create mode 100644 free/ci/internal/nodes/inventory/decode_test.go create mode 100644 free/ci/internal/nodes/inventory/read.go create mode 100644 free/ci/internal/nodes/inventory/schema_test.go create mode 100644 free/ci/internal/nodes/inventory/sync.go create mode 100644 free/ci/internal/nodes/inventory/sync_test.go create mode 100644 free/ci/internal/nodes/inventory/want.go create mode 100644 free/ci/internal/nodes/labels/apply.go create mode 100644 free/ci/internal/nodes/labels/apply_test.go create mode 100644 free/ci/internal/nodes/labels/codes.go create mode 100644 free/ci/internal/nodes/labels/labels.go create mode 100644 free/ci/internal/nodes/labels/labels_test.go create mode 100644 free/ci/internal/nodes/labels/lazy.go create mode 100644 free/ci/internal/nodes/labels/lazy_test.go create mode 100644 free/ci/internal/nodes/labels/projects.go create mode 100644 free/ci/internal/nodes/labels/source.go create mode 100644 free/ci/internal/nodes/lifecycle/placement_view_test.go create mode 100644 free/ci/internal/nodes/probe/demand_read.go create mode 100644 free/ci/internal/nodes/probe/demand_read_test.go create mode 100644 free/ci/internal/offload/codes.go create mode 100644 free/ci/internal/offload/secrets.go create mode 100644 free/ci/internal/offload/snapshot.go create mode 100644 free/ci/internal/offload/snapshot_test.go create mode 100644 free/ci/internal/pools/contract.go create mode 100644 free/ci/internal/pools/contract_test.go create mode 100644 free/ci/internal/pools/explain.go create mode 100644 free/ci/internal/pools/ids.go create mode 100644 free/ci/internal/pools/keys.go create mode 100644 free/ci/internal/pools/provider.go create mode 100644 free/ci/internal/pools/record/provider.go create mode 100644 free/ci/internal/pools/record/record.go create mode 100644 free/ci/internal/pools/record/record_test.go create mode 100644 free/ci/internal/pools/resolve.go create mode 100644 free/ci/internal/pools/resolve_test.go create mode 100644 free/ci/internal/pools/testdata/pools.golden.json create mode 100644 free/ci/internal/preflight/licensed.go create mode 100644 free/ci/internal/preflight/licensed_test.go create mode 100644 free/ci/internal/providers/github/reconcile/scan_export.go create mode 100644 free/ci/internal/race/attempts.go create mode 100644 free/ci/internal/race/hook.go create mode 100644 free/ci/internal/race/hook_test.go create mode 100644 free/ci/internal/race/policy.go create mode 100644 free/ci/internal/race/race.go create mode 100644 free/ci/internal/race/race_test.go create mode 100644 free/ci/internal/race/result.go create mode 100644 free/ci/internal/race/select.go create mode 100644 free/ci/internal/race/select_test.go create mode 100644 free/ci/internal/report/context_test.go create mode 100644 free/ci/internal/report/ledger.go create mode 100644 free/ci/internal/report/ledger_gh.go create mode 100644 free/ci/internal/report/ledger_gh_test.go create mode 100644 free/ci/internal/report/ledger_test.go create mode 100644 free/ci/internal/report/result_context.go create mode 100644 free/ci/internal/report/result_context_test.go create mode 100644 free/ci/internal/run/evidence_attempts_test.go create mode 100644 free/ci/internal/run/offload_hook.go create mode 100644 free/ci/internal/run/offload_hook_test.go create mode 100644 free/ci/internal/run/race_hook.go create mode 100644 free/ci/internal/run/race_hook_test.go create mode 100644 free/ci/internal/run/record_gate.go create mode 100644 free/ci/internal/run/record_gate_test.go create mode 100644 free/ci/internal/sched/auto.go create mode 100644 free/ci/internal/sched/auto_test.go create mode 100644 free/ci/internal/sched/bench_test.go create mode 100644 free/ci/internal/selftest/alert.go create mode 100644 free/ci/internal/selftest/checks.go create mode 100644 free/ci/internal/selftest/checks_state.go create mode 100644 free/ci/internal/selftest/disk_unix.go create mode 100644 free/ci/internal/selftest/disk_windows.go create mode 100644 free/ci/internal/selftest/facts.go create mode 100644 free/ci/internal/selftest/keys.go create mode 100644 free/ci/internal/selftest/local.go create mode 100644 free/ci/internal/selftest/orphans.go create mode 100644 free/ci/internal/selftest/tidy.go create mode 100644 free/ci/internal/selftest/tidy_history.go create mode 100644 free/ci/internal/selftest/tidy_steps.go create mode 100644 free/ci/internal/stats/blocks.go create mode 100644 free/ci/internal/stats/compute.go create mode 100644 free/ci/internal/stats/fixture_test.go create mode 100644 free/ci/internal/stats/golden_test.go create mode 100644 free/ci/internal/stats/health.go create mode 100644 free/ci/internal/stats/health_test.go create mode 100644 free/ci/internal/stats/pct.go create mode 100644 free/ci/internal/stats/plan_test.go create mode 100644 free/ci/internal/stats/race_off_test.go create mode 100644 free/ci/internal/stats/race_on_test.go create mode 100644 free/ci/internal/stats/runs.go create mode 100644 free/ci/internal/stats/space_other.go create mode 100644 free/ci/internal/stats/space_unix.go create mode 100644 free/ci/internal/stats/testdata/all.golden.json create mode 100644 free/ci/internal/stats/testdata/project-a.golden.json create mode 100644 free/ci/internal/stats/text.go create mode 100644 free/ci/internal/stats/types.go create mode 100644 free/ci/internal/store/migrations/node-labels/0001_labels.sql create mode 100644 free/ci/internal/store/node_labels.go create mode 100644 free/ci/internal/store/node_labels_test.go create mode 100644 free/ci/internal/store/sched_stats.go create mode 100644 free/ci/internal/store/sched_stats_test.go create mode 100644 free/ci/internal/svc/config.go create mode 100644 free/ci/internal/svc/install.go create mode 100644 free/ci/internal/svc/install_test.go create mode 100644 free/ci/internal/svc/manager.go create mode 100644 free/ci/internal/svc/render.go create mode 100644 free/ci/internal/svc/render_test.go create mode 100644 free/ci/internal/svc/system.go create mode 100644 free/ci/internal/tiers/bias.go create mode 100644 free/ci/internal/tiers/plan_test.go create mode 100644 free/ci/internal/tiers/testdata/auto-explain.golden.txt create mode 100644 free/ci/internal/tiers/testdata/auto-plan.golden.json create mode 100644 free/ci/internal/tiers/tiers.go create mode 100644 free/ci/internal/tiers/tiers_test.go create mode 100644 free/ci/internal/transport/agent/restore.go create mode 100644 free/ci/internal/transport/restore.go create mode 100644 free/ci/internal/transport/ssh/restore.go create mode 100644 free/ci/internal/watch/candidates.go create mode 100644 free/ci/internal/watch/codes.go create mode 100644 free/ci/internal/watch/commit.go create mode 100644 free/ci/internal/watch/drain_test.go create mode 100644 free/ci/internal/watch/fake_test.go create mode 100644 free/ci/internal/watch/keys.go create mode 100644 free/ci/internal/watch/logs.go create mode 100644 free/ci/internal/watch/logs_test.go create mode 100644 free/ci/internal/watch/loop.go create mode 100644 free/ci/internal/watch/run.go create mode 100644 free/ci/internal/watch/types.go create mode 100644 free/ci/internal/watch/watch_test.go create mode 100644 free/ci/internal/watch/watcher.go create mode 100644 free/ci/internal/where/where.go create mode 100644 free/ci/internal/where/where_test.go create mode 100644 free/ci/schemas/ci-conformance.v1.schema.json create mode 100644 free/ci/schemas/demand.v1.schema.json create mode 100644 free/ci/schemas/inventory.v1.schema.json create mode 100644 free/ci/schemas/pool.v1.schema.json create mode 100755 free/ci/scripts/ci-conformance.sh create mode 100755 free/ci/scripts/conformance/a01.sh create mode 100755 free/ci/scripts/conformance/a02.sh create mode 100755 free/ci/scripts/conformance/a03.sh create mode 100755 free/ci/scripts/conformance/a04.sh create mode 100755 free/ci/scripts/conformance/a05.sh create mode 100755 free/ci/scripts/conformance/a06.sh create mode 100755 free/ci/scripts/conformance/a07.sh create mode 100755 free/ci/scripts/conformance/a08.sh create mode 100755 free/ci/scripts/conformance/a09.sh create mode 100755 free/ci/scripts/conformance/a10.sh create mode 100644 free/ci/scripts/conformance/lib.sh create mode 100644 free/ci/surface/commands.yaml create mode 100644 free/ci/test/cachesec/artifact_test.go create mode 100644 free/ci/test/cachesec/cache_test.go create mode 100644 free/ci/test/cachesec/doc.go create mode 100644 free/ci/test/cachesec/matrix.yaml create mode 100644 free/ci/test/cachesec/matrix_test.go create mode 100644 free/ci/test/cachesec/release_test.go create mode 100644 free/ci/test/cachesec/rig_test.go create mode 100644 free/ci/test/cachesec/transfer_test.go create mode 100644 free/ci/test/reliability/carrier_test.go create mode 100644 free/ci/test/reliability/coordinator_outage_test.go create mode 100644 free/ci/test/reliability/doc.go create mode 100644 free/ci/test/reliability/scenario9_test.go create mode 100644 free/ci/test/reliability/sim_agent_test.go create mode 100644 free/ci/test/reliability/sim_world_test.go create mode 100644 free/ci/test/sim/auto/a10_scope_test.go create mode 100644 free/ci/test/sim/auto/a3_watch_test.go create mode 100644 free/ci/test/sim/auto/a4_hosted_test.go create mode 100644 free/ci/test/sim/auto/a5_offload_test.go create mode 100644 free/ci/test/sim/auto/a6_refusal_test.go create mode 100644 free/ci/test/sim/auto/a7_race_test.go create mode 100644 free/ci/test/sim/auto/a9_deadnode_test.go create mode 100644 free/ci/test/sim/auto/doc.go create mode 100644 free/ci/test/sim/claims_test.go create mode 100644 free/ci/test/sim/multiproject_test.go create mode 100644 free/ci/test/sim/perf_test.go create mode 100644 free/ci/test/sim/race_test.go create mode 100644 free/ci/test/sim/scope_test.go create mode 100644 free/ci/test/sim/status_dead_node_test.go create mode 100644 free/ci/test/sim/watch_test.go create mode 100644 free/ci/test/sim/where_test.go create mode 100644 free/ci/tools/doccmds/check.go create mode 100644 free/ci/tools/doccmds/check_test.go create mode 100644 free/ci/tools/doccmds/extract.go create mode 100644 free/ci/tools/doccmds/extract_test.go create mode 100644 free/ci/tools/doccmds/main.go create mode 100644 free/ci/tools/doccmds/main_test.go create mode 100644 free/ci/tools/doccmds/runner.go create mode 100644 free/ci/tools/doccmds/testdata/expect-fail.md create mode 100644 free/ci/tools/doccmds/testdata/fail.md create mode 100644 free/ci/tools/doccmds/testdata/no-blocks.md create mode 100644 free/ci/tools/doccmds/testdata/pass.md create mode 100644 free/ci/tools/manifestgen/main.go create mode 100644 free/ci/tools/manifestgen/manifestgen_test.go create mode 100644 free/ci/tools/manifestgen/render.go create mode 100644 free/ci/tools/manifestgen/spec.go create mode 100644 free/ci/tools/refgen/codes.go create mode 100644 free/ci/tools/refgen/commands.go create mode 100644 free/ci/tools/refgen/evidence.go create mode 100644 free/ci/tools/refgen/flags.go create mode 100644 free/ci/tools/refgen/main.go create mode 100644 free/ci/tools/refgen/reference_test.go create mode 100644 free/ci/tools/refgen/render.go create mode 100644 free/ci/tools/refgen/scan.go create mode 100644 free/ci/tools/refgen/sched.go create mode 100644 free/ci/tools/refgen/sched_test.go create mode 100644 free/ci/tools/refgen/sidebar.go create mode 100644 free/ci/tools/refgen/trustreasons.go create mode 100644 free/ci/tools/refgen/trustreasons_test.go create mode 100644 free/ci/tools/refgen/walker.go create mode 100644 scripts/ci/ci-conformance-check.py create mode 100755 scripts/ci/ci-machine-surface.sh create mode 100755 scripts/preflight/licensed.sh create mode 100644 scripts/testdata/wiki-plugin-pages/surface-vectors.json diff --git a/.github/ROADMAP.md b/.github/ROADMAP.md index ef2a984e5..1e0b3612e 100644 --- a/.github/ROADMAP.md +++ b/.github/ROADMAP.md @@ -2,7 +2,7 @@ This document tracks planned features and upcoming releases across the nSelf ecosystem. It is updated after each sprint cycle. -**Current version:** v1.0.11 LTS +**Current version:** see the latest release on GitHub. **Legend:** โœ… Done | ๐Ÿšง In Progress | ๐Ÿ”ฒ Planned | ๐Ÿšซ Deferred --- @@ -14,8 +14,6 @@ Target: Q2 2026 | Feature | Repo | Status | Notes | |---------|------|--------|-------| | nFamily social app | nfamily | ๐Ÿ”ฒ Planned | Family social media, private; bundle $0.99/mo | -| ClawDE bundle launch | clawde | ๐Ÿ”ฒ Planned | cloud sync, mobile twin, team features at $0.99/mo | -| nTV full media server | ntv | ๐Ÿ”ฒ Planned | Full media server + multi-platform (Roku, Apple TV, Android TV) | | Admin multi-user support | admin | ๐Ÿ”ฒ Planned | Multi-operator via `NSELF_ADMIN_MULTIUSER`. Single-operator in v1.x | | nCloud managed hosting | web/cloud | ๐Ÿ”ฒ Planned | Dedicated Hetzner VPS, $2/mo margin + at-cost infra | | Plugin SDK public release | cli/sdk | ๐Ÿ”ฒ Planned | plugin-sdk-go + plugin-sdk-ts as standalone packages | diff --git a/.github/scripts/check-doc-commands.sh b/.github/scripts/check-doc-commands.sh new file mode 100755 index 000000000..7b89103cc --- /dev/null +++ b/.github/scripts/check-doc-commands.sh @@ -0,0 +1,4 @@ +#!/bin/sh +# Usage: bash .github/scripts/check-doc-commands.sh ... +exec env CGO_ENABLED=0 GOFLAGS=-mod=vendor DOCCMDS_CALLER_DIR="$PWD" \ + go -C "$(dirname "$0")/../../free/ci" run ./tools/doccmds "$@" diff --git a/.github/truth/repo.yaml b/.github/truth/repo.yaml new file mode 100644 index 000000000..e60ca8728 --- /dev/null +++ b/.github/truth/repo.yaml @@ -0,0 +1,18 @@ +# plugins truth rules (planned configuration, Epic TRUTH D17; draft by P7-TRUTH-04, copied by the sweep Ticket P7-TRUTH-10, P7-TRUTH-32). +# Includes the vendored org and claim rules (scripts/truth/vendor-rules.sh) and exempts, with a reason, +# every path the sweep Tickets do not own. The sweep Tickets delete an exemption as they fix its file. +version: 1 +include: [.github/truth/org.yaml, .github/truth/claims.yaml] +allow: + - rule: "*" + paths: [".github/RELEASE-v*.md", "**/CHANGELOG*", "**/Changelog*"] + reason: "release notes keep the names and counts that were true when they shipped" + - rule: "*" + paths: [".workers/**/evidence/**"] + reason: "worker evidence files record what was true when the worker ran" + - rule: "claims.*" + paths: [".github/ISSUE_TEMPLATE/v1-1-1-api-changes.md", ".github/wiki/CI-Scope.md", ".github/wiki/Installation.md", ".github/wiki/Plugin-Conformance.md", ".github/wiki/Security.md", ".github/wiki/architecture/Plugin-System.md", ".github/wiki/getting-started/Quick-Start.md", ".github/wiki/plugins/AI-CLI.md", ".github/wiki/plugins/AI-Studio.md", ".github/wiki/plugins/API.md", ".github/wiki/plugins/Alerts.md", ".github/wiki/plugins/Audit-Analytics.md", ".github/wiki/plugins/Audit.md", ".github/wiki/plugins/Auth-Enterprise.md", ".github/wiki/plugins/BYOK.md", ".github/wiki/plugins/CDC.md", ".github/wiki/plugins/CI.md", ".github/wiki/plugins/CRDT.md", ".github/wiki/plugins/Claw-CLI.md", ".github/wiki/plugins/Compliance.md", ".github/wiki/plugins/Content-Safety.md", ".github/wiki/plugins/Costs.md", ".github/wiki/plugins/Cron.md", ".github/wiki/plugins/DLQ.md", ".github/wiki/plugins/DR.md", ".github/wiki/plugins/Dogfood.md", ".github/wiki/plugins/Donorbox.md", ".github/wiki/plugins/E2EE.md", ".github/wiki/plugins/Email.md", ".github/wiki/plugins/Encryption.md", ".github/wiki/plugins/Event-Bus.md", ".github/wiki/plugins/Family-Ancestry.md", ".github/wiki/plugins/Family-FamilySearch.md", ".github/wiki/plugins/Family-GEDCOM.md", ".github/wiki/plugins/Family-MyHeritage.md", ".github/wiki/plugins/Family-WikiTree.md", ".github/wiki/plugins/Federation.md", ".github/wiki/plugins/Flags.md", ".github/wiki/plugins/Forgejo.md", ".github/wiki/plugins/Functions-V8.md", ".github/wiki/plugins/Functions.md", ".github/wiki/plugins/GDPR.md", ".github/wiki/plugins/Gateway.md", ".github/wiki/plugins/Gauth.md", ".github/wiki/plugins/GitHub-Runner.md", ".github/wiki/plugins/HIPAA.md", ".github/wiki/plugins/Home.md", ".github/wiki/plugins/Infra.md", ".github/wiki/plugins/Job-Queue.md", ".github/wiki/plugins/K8s.md", ".github/wiki/plugins/LinkedIn.md", ".github/wiki/plugins/MLflow.md", ".github/wiki/plugins/Mail.md", ".github/wiki/plugins/Maintenance.md", ".github/wiki/plugins/Model.md", ".github/wiki/plugins/Monitor.md", ".github/wiki/plugins/Monitoring.md", ".github/wiki/plugins/Notify.md", ".github/wiki/plugins/Ollama.md", ".github/wiki/plugins/PayPal.md", ".github/wiki/plugins/Payments.md", ".github/wiki/plugins/Pentest-Kit.md", ".github/wiki/plugins/Pentest.md", ".github/wiki/plugins/Plugin-ClawDE.md", ".github/wiki/plugins/Plugin-Gauth.md", ".github/wiki/plugins/Plugin-LLM-Gateway.md", ".github/wiki/plugins/Plugin-PTY.md", ".github/wiki/plugins/Plugin-Retrieval.md", ".github/wiki/plugins/Post.md", ".github/wiki/plugins/Push.md", ".github/wiki/plugins/Queue.md", ".github/wiki/plugins/Region.md", ".github/wiki/plugins/Release.md", ".github/wiki/plugins/SIEM.md", ".github/wiki/plugins/SMS.md", ".github/wiki/plugins/Sentry-CLI.md", ".github/wiki/plugins/Shared-Utils.md", ".github/wiki/plugins/Soak.md", ".github/wiki/plugins/Sports.md", ".github/wiki/plugins/Storage.md", ".github/wiki/plugins/Stripe.md", ".github/wiki/plugins/Tenant-Controller.md", ".github/wiki/plugins/Tenant.md", ".github/wiki/plugins/Transactional-Email.md", ".github/wiki/plugins/WAF.md", ".github/wiki/plugins/Watchdog.md", ".github/wiki/plugins/Web3.md", ".github/wiki/plugins/nSelf-Cloud.md", ".github/wiki/plugins/nSelf-Eval-Gate.md", ".github/wiki/plugins/nSelf-Geo.md", ".github/wiki/plugins/nSelf-Image.md", ".github/wiki/plugins/nSelf-PDF.md", ".github/wiki/plugins/nSelf-Scan.md", ".github/wiki/plugins/nSelf-Sync.md", ".github/wiki/plugins/nSelf-Vault.md", "free/access-controls/MANIFEST.md", "free/access-controls/VERIFICATION.md", "free/analytics/IMPLEMENTATION_SUMMARY.md", "free/backup/third_party/sdk/README.md", "free/content-acquisition/third_party/sdk/README.md", "free/content-progress/third_party/sdk/README.md", "free/cron/third_party/sdk/README.md", "free/donorbox/third_party/sdk/README.md", "free/github-runner/README.md", "free/github-runner/third_party/sdk/README.md", "free/idme/QUICKSTART.md", "free/invitations/third_party/sdk/README.md", "free/link-preview/third_party/sdk/README.md", "free/mdns/third_party/sdk/README.md", "free/mlflow/third_party/sdk/README.md", "free/notify/third_party/sdk/README.md", "free/paypal/third_party/sdk/README.md", "free/push/third_party/sdk/README.md", "free/shopify/third_party/sdk/README.md", "free/subtitle-manager/third_party/sdk/README.md", "free/torrent-manager/third_party/sdk/README.md", "free/vpn/third_party/sdk/README.md"] + reason: "prose outside every sweep write scope of P7-TRUTH-10, P7-TRUTH-32; a real finding the lead can fold into a sweep Ticket, then delete this entry" + - rule: "vocab.*" + paths: ["free/backup/third_party/sdk/COMPATIBILITY.md", "free/content-acquisition/third_party/sdk/COMPATIBILITY.md", "free/content-progress/third_party/sdk/COMPATIBILITY.md", "free/cron/third_party/sdk/COMPATIBILITY.md", "free/donorbox/third_party/sdk/COMPATIBILITY.md", "free/github-runner/third_party/sdk/COMPATIBILITY.md", "free/invitations/third_party/sdk/COMPATIBILITY.md", "free/link-preview/third_party/sdk/COMPATIBILITY.md", "free/mdns/third_party/sdk/COMPATIBILITY.md", "free/mlflow/third_party/sdk/COMPATIBILITY.md", "free/notify/third_party/sdk/COMPATIBILITY.md", "free/paypal/third_party/sdk/COMPATIBILITY.md", "free/plugin-dev/internal/surface/help/init.txt", "free/plugin-dev/internal/surface/help/new.txt", "free/push/third_party/sdk/COMPATIBILITY.md", "free/shopify/third_party/sdk/COMPATIBILITY.md", "free/subtitle-manager/third_party/sdk/COMPATIBILITY.md", "free/torrent-manager/third_party/sdk/COMPATIBILITY.md", "free/vpn/third_party/sdk/COMPATIBILITY.md"] + reason: "prose outside every sweep write scope of P7-TRUTH-10, P7-TRUTH-32; a real finding the lead can fold into a sweep Ticket, then delete this entry" diff --git a/.github/wiki/Contributing.md b/.github/wiki/Contributing.md index 575584078..b6c4d9ce4 100644 --- a/.github/wiki/Contributing.md +++ b/.github/wiki/Contributing.md @@ -4,7 +4,7 @@ Thanks for your interest in contributing to the nSelf plugin ecosystem. ## What This Is -Free MIT plugins for the nSelf CLI. There are 25 free plugins available to everyone. +Free MIT plugins for the nSelf CLI. The free plugins are available to everyone; the live list is in `registry.json`. ## Prerequisites diff --git a/.github/wiki/Home.md b/.github/wiki/Home.md index 86aa65615..3576a32e3 100644 --- a/.github/wiki/Home.md +++ b/.github/wiki/Home.md @@ -35,8 +35,8 @@ Command pages include action/subcommand syntax, argument shapes, and option flag ### Plugin Documentation - -See [[All Plugins|#plugin-directory-64-of-129-shown]] below for a sample; the full catalog is 129 free plugins across 14 categories (see `_Sidebar.md` ยง All Free Plugins for the complete alphabetical list, or `registry.json`). + +See [[All Plugins|#plugin-directory-sample]] below for a sample; the full catalog is in `_Sidebar.md` ยง All Free Plugins and in `registry.json`. **Popular Plugins:** - [[Stripe|plugins/Stripe]] - Payment processing and subscription management @@ -101,10 +101,10 @@ Legacy `docs/` is retired. Public docs belong in `.github/wiki/` only. 2. Commands in `Commands.md` and `commands/*.md` must match action/CLI source files. 3. Any drift between code and docs is treated as a defect. -## Plugin Directory (64 of 129 Shown) +## Plugin Directory (Sample) - -This is a partial sample (64 of 129 free plugins). Registry categories (14, from `registry.json`): **authentication**, **automation**, **commerce**, **communication**, **compliance**, **content**, **data**, **development**, **infrastructure**, **integrations**, **media**, **social**, **sports**, **streaming**. + +This is a partial sample of the free plugins. Registry categories, from `registry.json`: **authentication**, **automation**, **commerce**, **communication**, **compliance**, **content**, **data**, **development**, **infrastructure**, **integrations**, **media**, **social**, **sports**, **streaming**. | Plugin | Port | Category | Description | |--------|------|----------|-------------| diff --git a/.github/wiki/Plugin-Development.md b/.github/wiki/Plugin-Development.md index 7539ac976..f6c1139de 100644 --- a/.github/wiki/Plugin-Development.md +++ b/.github/wiki/Plugin-Development.md @@ -1,6 +1,6 @@ # Plugin Development -This page walks through building a new nSelf plugin from empty directory to shipped service. It targets free + pro plugins written in Go against [`plugin-sdk-go`](https://github.com/nself-org/plugin-sdk-go). +This page walks through building a new nSelf plugin from empty directory to shipped service. It targets free and licensed plugins written in Go against [`plugin-sdk-go`](https://github.com/nself-org/plugin-sdk-go). See also: - [[Home]] @@ -219,11 +219,11 @@ log.Error("upstream 5xx", "err", err, "retry", 2) --- -## 6. License (Pro Plugins Only) +## 6. License (Licensed Plugins Only) Free plugins: skip this section. -Pro plugins rely on the CLI loader to gate install. At runtime, use `sdk/license` only if you need to re-check a long-running entitlement (e.g. a daily cron): +Licensed plugins rely on the CLI loader to gate install. At runtime, use `sdk/license` only if you need to re-check a long-running entitlement (e.g. a daily cron): ```go import "github.com/nself-org/plugin-sdk-go/license" @@ -300,7 +300,7 @@ Minimum fields: } ``` -Pro plugins additionally set: +Licensed plugins additionally set: ```json { @@ -329,7 +329,7 @@ nself plugin verify my-notifier # Package it nself plugin package my-notifier -# Submit (free plugins โ†’ plugins repo PR; pro plugins โ†’ plugins-pro via invite) +# Submit (free plugins โ†’ plugins repo PR; licensed plugins โ†’ the Bundles repo via invite) nself plugin submit my-notifier ``` diff --git a/.github/wiki/Plugin-Marketplace.md b/.github/wiki/Plugin-Marketplace.md index e8c63e509..2183f5e23 100644 --- a/.github/wiki/Plugin-Marketplace.md +++ b/.github/wiki/Plugin-Marketplace.md @@ -1,6 +1,6 @@ # Plugin Marketplace -The nSelf plugin marketplace is the catalog of free and pro plugins that extend a nSelf backend. It is served by the Cloudflare Worker at `plugins.nself.org` and consumed by three surfaces: +The nSelf plugin marketplace is the catalog of free and licensed plugins that extend a nSelf backend. It is served by the Cloudflare Worker at `plugins.nself.org` and consumed by three surfaces: - **Admin UI** โ€” `ษณSelf Admin` runs locally at `http://localhost:3021/plugins/marketplace` - **CLI** โ€” `nself plugin marketplace {list,search,info}` @@ -16,7 +16,7 @@ Base URL: `https://plugins.nself.org` |--------|------|---------| | GET | `/marketplace` | Categorized plugin list with ratings, bundles, and filters | | GET | `/marketplace?tier=free` | Only free plugins | -| GET | `/marketplace?tier=pro` | Only pro plugins | +| GET | `/marketplace?tier=pro` | Only licensed plugins | | GET | `/marketplace?category=media` | Filter by category | | GET | `/marketplace?bundle=nclaw` | Filter by bundle slug | | GET | `/marketplace?q=stripe` | Full-text search over name, description, display name, tags | diff --git a/.github/wiki/Preflight.md b/.github/wiki/Preflight.md index d4f1ea04f..430d018d5 100644 --- a/.github/wiki/Preflight.md +++ b/.github/wiki/Preflight.md @@ -65,3 +65,22 @@ Details: `scripts/preflight/README.md`. The licensed tier is measured separately (P7-PLUG-39). The latest evidence is kept in the hq plan evidence folder (`PLUG-02-preflight.md`). + +## Licensed tier + +`scripts/preflight/licensed.sh` measures the licensed entries of +`$NSELF/plugins-pro/registry.json` against what `ping.nself.org` serves, using +the scoped, expiring, revocable CI licence from the environment variable +`NSELF_CI_LICENSE_KEY`. It runs on the owner's machine only; the registry data +and tarballs are never committed. + +```bash +bash scripts/preflight/licensed.sh --out "$TMPDIR/licensed.json" --strict +``` + +Same stages and classes as the free tier, plus `entitlement`: the download +answered 401 or 403 for an entry the CI licence should cover (reported, never +skipped). The key is sent only on the first hop, never to a redirect target, +and is never printed. `--no-build` records skips, and a skip is not a pass. +The offline test is `free/ci/internal/preflight/licensed_test.go`; the live +run is P7-PLUG-88. diff --git a/.github/wiki/Standards.md b/.github/wiki/Standards.md index 3762e4ea8..97c4f3733 100644 --- a/.github/wiki/Standards.md +++ b/.github/wiki/Standards.md @@ -280,7 +280,7 @@ GOOGLE_KEY=... - Media: 3700-3799 - Streaming: 3800-3899 - Development: 3900-3999 -- Integrations: 4000-4099 +- Integration services: 4000-4099 **Note**: Port ranges are guidelines only. Existing ports should not be changed without coordination. diff --git a/.github/wiki/Truth-Rules.md b/.github/wiki/Truth-Rules.md index 5aafc5114..70527a53f 100644 --- a/.github/wiki/Truth-Rules.md +++ b/.github/wiki/Truth-Rules.md @@ -67,6 +67,7 @@ generated_regions: Unknown region ids exempt nothing. A header saying `GENERATED BY` also exempts nothing; use declared region markers or a reasoned path exemption instead. + Binary, UTF-16 and files over 4 MiB still run through dead-host matching up to a bounded 16 MiB read. Unscannable prose in a claim rule's scope produces `truth.unscanned-file`; a file above the host limit produces the same finding when any rule applies. NUL bytes anywhere in a file trigger this handling. Only explicitly excluded paths bypass it. Finding paths and matches that contain a dead host are redacted. Zero-width spaces, joiners, word joiners and BOMs cannot hide matches. Claims can span two adjacent lines, and the shipped count rule also catches labelled counts such as `Plugins: 62`. Known limits: claims split over more than two lines, full-width digits, `all 62 free and paid plugins` and `62 plugins` are outside the count pattern. Astro `