mirror of
https://github.com/DeBrosOfficial/orama.git
synced 2026-06-16 21:54:14 +00:00
3676b000a6
Standardization batch — no application code changes. Pulls in the
DeBros DAO baseline rules (v0.1.0, sha 51ce3f8) for supply-chain
defense and toolchain pinning.
Files added:
- DEBROS.md + debros.json — adopted-rules manifest
- .debros/compliance/{go,javascript-typescript,zig}.md — per-language
compliance docs
- .github/workflows/security.yml — auto-detecting security CI
(npm audit + go vulncheck), runs on main + weekly cron
- renovate.json — 30-day dependency cooldown, no auto-merge,
vulnerability alerts bypass cooldown
- .nvmrc — pin Node 20.18.0
- vault/.zigversion — pin Zig 0.14.0
- sdk/.npmrc, website/.npmrc — supply-chain hardening
(ignore-scripts, strict-peer-dependencies, save-exact, etc.)
Files modified:
- core/go.mod, os/agent/go.mod, website/invest-api/go.mod —
add `toolchain go1.24.6` directive for reproducible builds
- VERSION + sdk/package.json — bump to 0.122.11
46 lines
2.0 KiB
JSON
46 lines
2.0 KiB
JSON
{
|
|
"$schema": "https://raw.githubusercontent.com/DeBrosDAO/rules/main/templates/debros.schema.json",
|
|
"schema_version": 1,
|
|
|
|
"rules": {
|
|
"version": "v0.1.0",
|
|
"sha": "51ce3f8529f9269a80b22b384fa98de6431c04e8",
|
|
"synced_at": "2026-05-12T10:55:00Z"
|
|
},
|
|
|
|
"project": {
|
|
"name": "orama",
|
|
"type": "infrastructure",
|
|
"languages": ["go", "typescript", "zig"],
|
|
"critical_paths": [
|
|
"core/pkg/gateway/auth/**",
|
|
"core/pkg/secrets/**",
|
|
"core/pkg/serverless/hostfunctions/**",
|
|
"core/migrations/**",
|
|
"core/cmd/**",
|
|
"sdk/src/auth/**",
|
|
"sdk/src/vault/**",
|
|
"vault/src/**"
|
|
],
|
|
"deploy_targets": ["devnet", "testnet"],
|
|
"owner": ""
|
|
},
|
|
|
|
"compliance": {
|
|
"last_audit": "2026-05-12",
|
|
"exceptions": [],
|
|
"dismissed": [],
|
|
"tier3_overrides": []
|
|
},
|
|
|
|
"ai_agent_notes": [
|
|
"Orama is a decentralized API gateway + reverse proxy with serverless WASM execution, distributed caching (Olric), distributed SQL (RQLite), IPFS storage, and pubsub. See .claude/rules/network.md for the high-level architecture.",
|
|
"Deploys require explicit human approval. Never run `make rollout-devnet`, `orama node install`, `systemctl restart`, or any other deploy/restart command without an explicit go-ahead in the chat.",
|
|
"Rolling restarts only — never stop multiple nodes simultaneously. RQLite Raft consensus needs quorum.",
|
|
"Use the `orama node` CLI for service management on VPS nodes (`orama node restart`, `orama node stop`, etc.), never raw `systemctl`. The CLI handles dependency ordering, quorum checks, and health verification.",
|
|
"Use `orama ssh <ip>` to reach devnet/testnet hosts — the wrapper resolves SSH keys from rootwallet via vault:ssh capability.",
|
|
"Per-tenant operational context (anchat-test, etc.) lives in chat history and bugboard tickets, not in this repo.",
|
|
"Never leak credentials from scripts/remote-nodes.conf or any keys_backup/ files in commits, docs, or chat output."
|
|
]
|
|
}
|