This tree contains first-party products and reusable project code. All tracked
content follows the repository’s public-source policy.
Each project owns its specifications and maintained changes in
<project>/openspec/. Use the pinned OpenSpec workflow
with that project selected. infra/src/ owns repository evolution.
Requirements
Bazel targets MAY use public visibility when their owner intends external
reuse.
Project artifacts MAY be published through an explicit release workflow.
Project targets MAY be used by production build targets.
Project sites
Each project has a landing page in the main website at
https://alwaldend.com/projects/<name>/. Sites are published with the main
site rather than as separate Pages repositories, and repository reference
documentation, including each project README, lives under /docs/.
Accessibility-based Android collector that sends browser URLs to ActivityWatch
ActivityWatch ingester Android
An Android collector that reads supported browser address-bar text through
Android accessibility and sends it to an ActivityWatch server. The app holds
full accessibility permission only to obtain the URL; it never uses that
permission for anything else.
How it works
Enabling accessibility for this app lets it read the focused address bar.
The accessibility service matches browser view IDs (url_bar and common
Chrome-derived variants), extracts the current URL, and sends an
ActivityWatch heartbeat for the web.tab.current bucket to a configurable
server.
web.tab.current heartbeats use pulsetime=1.0; consecutive URLs are sent
with the time spent on the previous tab as the duration field.
Data goes directly from this app to the ActivityWatch HTTP API; it is not
uploaded to any other service.
Configuration
Open the app to configure:
ActivityWatch server URL — the base URL of the ActivityWatch server.
The default is http://127.0.0.1:5600 for the ActivityWatch Android app on
the same device. Changes are saved immediately.
API key (optional) — bearer token sent as Authorization: Bearer ...
when the ActivityWatch server has API authentication enabled.
The INTERNET permission is required to reach the ActivityWatch HTTP API. The
default loopback URL is sent over cleartext HTTP only to 127.0.0.1 and
localhost, so no host data leaves the device.
Supported browsers
Chrome and Chromium-based browsers that expose the url_bar view ID
(including ordinary Chrome and many Chrome-based forks). Firefox, Samsung
Internet, Opera, and Edge do not use that view ID yet.
Build and install
Build the APK:
bazel build //projects/activitywatch_ingester_android/main/java:ingester_binary
Verify the APK starts on an already running device or emulator:
bazel run //projects/activitywatch_ingester_android/test:ingester_smoke_test
This manual smoke test installs the Bazel-built APK, launches the activity,
waits for the process, and confirms it stays alive. It is not a CI test.
Install the APK on the device from bazel-bin/projects/activitywatch_ingester_android/main/java/ingester_binary.apk.
Start the app and set the ActivityWatch server URL.
Enable accessibility for the app in Android settings; Android shows the
full-access warning, which is the mechanism this collector is built on.
Open a browser. The current URL is re-sent to ActivityWatch whenever the
address bar changes.
Compatibility
Minimum Android SDK 25 (Android 7.0).
Tested against the ActivityWatch v0.13 HTTP API (POST /api/0/buckets and
POST /api/0/buckets/web.tab.current/heartbeat).
Landing page
The landing page is published at
activitywatch-ingester-android.alwaldend.com,
built from this README by the shared Hugo landing template. The DNS record
lives in dnsconfig.json; the project Terraform stage describes
its configuration and ownership activation workflow.
1.1 -
Releases
Release packaging for the ActivityWatch ingester Android app.
1.1.1 - head
Release head
Move project landings into the main site
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Add a shared androidPlugins version catalog so both Android apps declare the
AGP, Kotlin, Compose, and protobuf plugin versions once, and derive their
versions from it instead of duplicating literals per root Gradle file.
Align the launcher and ingester app versions with the repository versioning
contract: development builds use 0.0.0-dev with versionCode 1 in both the
Gradle default config and the Bazel manifest_values.
Ignore the whole materialized .agents/skills directory in Prettier because
every entry is either a source-tree symlink or a byte-pinned external archive
copy.
Apply the ingester’s themed surface background to the main content surface so
the status bar area follows the system theme, not a default white surface.
Token: z-ai-glm-flash-latest
LLM-disclaimer: This commit was generated by an LLM.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
This project owns the reusable cross-repository agent skills. Maintained
improvement work lives in this project’s OpenSpec workspace. It
does not centralize component facts or runtime state: each fact remains
canonical at its natural owner.
openspec/ owns agent-system requirements, changes, and evidence;
the migration map locates historical records.
Other components own their specifications and changes under their own
openspec/ directory. infra/src/openspec/ describes repository evolution.
skills/ owns reusable cross-product, repository-wide agent procedures and
their development-time evaluations. A product-specific procedure belongs
with its product; a procedure that no narrower project genuinely owns lives
here rather than in a contrived local home.
Product-specific skills remain with their project at
projects/<project>/skills/<name>. Do not split one skill across owners.
Skill packaging and discovery
Every canonical skill is packaged as a skill_library in its owning
directory.
The repository discovery directory .agents/skills/ contains one relative
symlink per skill. Each link points directly to its canonical project-owned
directory. .agents/BUILD.bazel declares the complete discovery set and
generates those links with //.agents:write_skills; its generated
exact-state test verifies them. Bazel ignores the discovery directory and
builds only canonical targets, preventing duplicate packages while allowing
skills from more than one owning project. Each skill grants
//.agents:skill_discovery read access so the owning declaration can reach it.
Skill evaluation data is not part of the runtime skill_library unless a
skill explicitly declares otherwise. Every new or updated skill includes an
offline Promptfoo configuration-validation target. That target checks the eval
harness, not answer correctness. Live behavioral evaluations are manual,
networked tests and must not be included in ordinary wildcard test runs; they
may be omitted when representative coverage requires tool calls or external
state that cannot be provided safely and reproducibly, with the gap documented
beside the eval configuration.
3 - Al
Repository command runner and Bazel configuration rules
AL is a command runner that prepares credentials and environment variables
through plugins, runs your command, and cleans up afterward. Its Bazel rules
package commands with their configuration and required plugins.
al tool runs tools declared in AL configuration from a source-keyed executable
cache. With no --config, it uses the repository-root al.lua; explicit
--config paths replace that default. Cache misses build the tool’s configured
Bazel label and publish the selected executable under
$XDG_CACHE_HOME/al/tools. AL_TOOL_CACHE or tool --cache-root PATH selects
an alternate cache root.
Repository agent skills are written by bazel run //.agents:write_skills
and checked by //.agents:write_skills_test.
al run starts selected plugins, passes their environment to a command, and
keeps plugin resources available until that command exits. On cancellation it
asks the command to terminate and waits up to ten seconds before killing it.
Plugin shutdown then drains requests, releases resources in reverse registration
order, and waits for plugin exit. Startup failure cancels sibling starts and
rolls back partially initialized resources. Cleanup errors fail the invocation.
The injector creates secret files with owner-only permissions and removes them
after consumers stop. Vault stores revoke AppRole tokens they issue; failed
AppRole login attempts destroy their unused single-use SecretID. The role’s
bootstrap policy must permit secret-id-accessor/destroy, as declared by
projects/tf_modules/vault_approle. The user’s existing token-helper credential
is never erased or revoked. Secret inputs and remote response bodies are omitted
from diagnostic messages. OIDC authorization uses the configured Vault HTTPS
origin and TLS transport, rejecting alternate origins and redirects.
Explicit config dumps still contain the requested configuration; file outputs
use owner-only permissions and truncate previous contents.
no_auth prevents AL’s Vault client from loading credentials. For environment
injection it clears inherited VAULT_TOKEN; it does not sandbox the command or
prevent a command from independently reading the user’s token helper. Plugins
and invoked commands remain trusted programs with the user’s filesystem access.
Cleanup is observable best effort, not secure erasure. Memory copies are not
zeroized. Forced termination, host failure, unresponsive cleanup code, or an
unavailable service can prevent deletion or revocation. Subprocess signaling
targets direct children, not arbitrary descendants. Credential expiry remains
a fallback; service-specific logout requirements are documented with each plugin.
Center the project index on the documentation axis
The section index resolved layouts/projects/list.html inside the default
baseof, whose bare gave it no grid column and no
padding offset from the .td-main main rule, so it rendered full width at
48px with a 128px heading.
Give the section its own projects_index type with a baseof that keeps the
documentation row and column but omits both asides. The index now starts
at 88px and centers at 259px with a 771px column, matching /docs/ and
/blog/ exactly.
248c9e0bc2b857a4f0b390054a98e699fc571c70
simeonwarrenbot <simeonwarrenbot@alwaldend.com>
simeonwarrenbot <simeonwarrenbot@alwaldend.com>
Render the project index in the documentation column
The index rendered in the layout’s root wrapper, so its text spanned the full
page width instead of the column the documentation and blog pages use. That
made it read as a stray full-width list rather than a page of the site.
Lay the index out like a documentation list page: the documentation column
(col-12 col-md-9 col-xl-8 ps-md-5) inside a row, the section description as
a lead, and the theme’s section-index entries separated by a panel line. The
documentation sidebars are deliberately absent, so the list stays a plain
single-column page.
LLM-disclaimer: This commit was generated by an LLM.
Lay the project index out as a single-column section list
The card grid read as a separate component next to the rest of the site. The
/projects/ index now uses the same section list as the documentation index:
one entry per project under the Projects heading, separated by panel lines,
each entry carrying its description, status, and tags. The entries stay in
alphabetical order.
Wrap the list in a section so the theme’s first-section offset applies; without
it the Projects heading rendered underneath the fixed navbar.
LLM-disclaimer: This commit was generated by an LLM.
Add a staging publication and refine the project index
Verify the project landing replacement on its own hostname before the apex
changes and before any per-project resource is retired, and make the landing
index useful to a visitor.
www-staging.alwaldend.com gets a checked-in DNS declaration and a catalog
repository, and the apex site gains a staging build that renders the same
packaged source with the staging base URL plus a deployment command that
publishes it. The publication command now takes its repository and branch as
arguments, so staging and production share one publisher, and a repository
whose publication branch does not exist yet is created as an orphan instead of
failing on clone. A new repository receives a default branch at creation so the
managed ruleset can protect it while site content publishes to a separate
branch, and GitHub Pages configuration is deferred for a repository until its
publication branch exists.
The /projects/ index no longer opens with explanatory prose, lists landings
alphabetically, and shows each project’s status and tags as links to their
taxonomy term pages.
Deploy the staging site, verify the landing, documentation, and taxonomy
routes there, then deploy the accepted output to the apex and verify the same
routes. The per-project hostnames, DNS records, and landing repositories remain
in place until their retirement is requested.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Publish the DNS evolution article and update blog workflow
Publish the author’s account of moving DNS management from a central
DNSControl configuration to project-owned Terraform records, with examples
and directory layouts. Include the author’s clarifications and approved
wording corrections, and remove the draft flag for publication.
Tag both blog posts using existing site topics. Require relevant tags and
iterative reviews in the blog skill: report findings before validation and
delivery, repeat after changes, and finish delivery when the review is clear
or the author ends it. Cover both behaviors in the existing evaluation cases.
Validation: local and release Hugo builds, site_test, skill validation and
offline Promptfoo configuration test, skill discovery, Buildifier, repository
quality, and semantic lint for the affected blog and skill packages.
LLM-disclaimer: This commit was generated by an LLM.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Record the site hostname decision for alwaldend.com
Record the evaluated options for the apex site’s landing, documentation, and
blog sections: one hostname with one build (retained), separate hostnames
served from separate GitHub Pages repositories, and one hostname with
independently built and merged section outputs. The generated documentation
tree is a projection of the repository’s own directory structure across 471
packaged README files, and an earlier commit already combined the misc, docs,
and projects sites, so splitting the hostnames would move where the projection
is served without decoupling it from its source.
Separate the shared-build failure coupling from the hostname question: the
recorded fallback keeps one published tree while splitting the build graph, if
panicking on any packaged README warning starts blocking delivery.
Record the search-engine evidence from primary sources. Google’s
crawling-and-indexing FAQ states that from an indexing and ranking perspective
Google has no preference, and the office-hours answer recorded here addresses
the same question. The record explicitly does not claim that subdirectories
preserve link equity that a subdomain would forfeit, and it cites a third
vendor video by title only because its spoken content could not be retrieved.
This change adds no site behavior, build target, configuration, DNS record, or
Terraform resource.
Add a shared androidPlugins version catalog so both Android apps declare the
AGP, Kotlin, Compose, and protobuf plugin versions once, and derive their
versions from it instead of duplicating literals per root Gradle file.
Align the launcher and ingester app versions with the repository versioning
contract: development builds use 0.0.0-dev with versionCode 1 in both the
Gradle default config and the Bazel manifest_values.
Ignore the whole materialized .agents/skills directory in Prettier because
every entry is either a source-tree symlink or a byte-pinned external archive
copy.
Apply the ingester’s themed surface background to the main content surface so
the status bar area follows the system theme, not a default white surface.
Token: z-ai-glm-flash-latest
LLM-disclaimer: This commit was generated by an LLM.
Add a blog section, a shared site canvas, and standalone nested modules
Publish the Docsy blog section on the apex site with its content package,
navigation entry, RSS feed, and draft-safe release flags. The release build
excludes drafts so a post stays unpublished from its front matter alone.
Move the reusable project-site procedure to a generic repo-hugo skill that
also documents the Hugo theme layout, and add an alwaldend-blog skill that
publishes supplied content verbatim and reviews it afterward. Enforce one
implementation and one copy of each fact in the root policy, and refine the
skill locality rule to prefer local ownership only when it genuinely fits.
Share one black theme between the landing shell and the apex site from a
single SCSS source, and let docs_filegroup preserve source paths so packages
holding identically named files stop colliding.
Repair every nested Bazel workspace: rules_openspec declared six unused,
versionless sibling dependencies whose local_path_override entries never
applied outside the root module, which broke standalone resolution for all
nested modules. Drop those dependencies, ignore the two nested module
directories that lacked an ignore entry, add the missing build_test coverage,
and extend the full-repository check to all twelve nested workspaces.
Remove the goal component, the agent control tower, and the site link test
Delete projects/goal entirely: its CLI, API package, filesystem store, landing
site, disabled skill sources, documentation pages, diagrams, Bazel targets,
project-registry entry, and committed DNS record. The goal tool was deprecated
by the 2026-09-08 migration to the pinned OpenSpec CLI, which is in active use,
and the repository policy already told agents not to create goal records.
Delete tools/agents entirely. It carried repository-internal control contracts,
seven catalog compilers, an offline context capsule, and typed
admission/control/plan/evidence libraries. The goal tool was their only
consumer; no CI or AGENTS.md invocation read the catalogs. Relocate the generic
skill-discovery declaration to .agents/BUILD.bazel beside the directory it
generates, and repoint the 29 skill visibility labels from
//tools/agents:skill_discovery to //.agents:skill_discovery. Skill content,
link targets, and the 27 existing symlinks are unchanged. A BUILD.bazel inside
.agents/skills/ was rejected because the generated updater rejects a
non-symlink there.
Reduce projects/agents to its skills: delete the architecture, current-state,
and roadmap documents and the docs package they fed. Documentation describing
agent-system composition now belongs with the component that owns the behavior.
Remove //projects/alwaldend.com/test/site:site_test. It has never passed since
894494f4: it fails on unmodified HEAD with 330 missing-file findings because it
treats repository source paths and the published URL space as one namespace.
Repository-only targets such as BUILD.bazel and playbook YAML are deliberately
not packaged, so those links can never resolve in generated output.
Record the removals as three OpenSpec changes: remove-deprecated-goal-component
and remove-generated-site-link-test under infra/src and projects/alwaldend.com,
and remove-goal-tool-and-contract-tower under projects/agents.
The removed bytes remain retrievable from git history at the parent of this
commit; the changes neither copy nor restate them.
Address review feedback before publication:
Point the hugo_landing site example at the surviving //projects/agents:docs
target. The copied example referenced //projects/agents/docs:docs, which this
change deletes, so the snippet failed label resolution.
Point the new specification links at their real paths. The repository change
referenced migration.md one directory too shallow, and the Reimu continuation
requirement referenced the process contract from beneath the change directory
instead of the project root; neither path existed.
Rewrite projects/renders/assets/reimu_fumo/PROCESS.md so its required stage
gates no longer depend on the removed goal tool. That contract was the
authoritative process for the still-open Reimu work, and it required goal-tool
checkpoints, portable goal plans, and goal state to start, repair, reset, and
close attempts. Those mechanics now record into the project’s OpenSpec change
and its durable evidence, so every gate stays executable. Acceptance criteria
and the blocked continuation state are unchanged. The continuation requirement
is recorded in the change spec and its rationale in the change design.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Roll back partial plugin startup, drain requests before releasing resources,
and wait for plugin and command processes to exit. Stop independent plugins
concurrently while preserving dependency order inside each plugin.
Revoke invocation-owned credentials, remove temporary secret files, and verify
Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login.
Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict
config dumps to owner-only files. Add the AppRole SecretID cleanup permission.
Cover normal exit, cancellation, failed startup, credential revocation, and
transport cleanup with synthetic unit and real command/plugin regression tests.
Clarify that required formatting-only repairs need no separate approval, and
fix the existing blank-line formatting failure in the GitHub AL wrapper.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Improve the Hugo site and fix the persistent worker
Extract the Hugo build rules into a standalone nested module
projects/rules_hugo and add a Go-based persistent Hugo worker with a
Dart Sass toolchain, then fix the worker’s empty-destination defect,
polish the rules, add per-project landing pages and DNS declarations,
and improve the site deploy.
rules_hugo: standalone nested module with MODULE.bazel, main/bzl rules,
tests, and README; no root-workspace labels.
hugo_worker: persistent worker that resolves execroot-relative paths
through the work directory and probes DART_SASS_BINARY, so the site
destination is populated with HTML and Sass-compiled CSS.
sass: Dart Sass 1.103.1 toolchain wired into the site build.
alwaldend.com: Hugo 0.165.0, Docsy 0.17.0, Bootstrap 5.3.8, Font
Awesome 7.3.1, module mounts, and the site build switched to the worker.
Landing pages: content/projects/_index.md links every project to its
docs page; a Projects menu entry is added and the content filegroup is
wired.
DNS: projects/alwaldend.com/dnsconfig.json declares no records (no new
subdomains) and is wired into infra/dns/dnsconfig.js.
Deploy: the genrule clones the pages branch that GitHub Pages serves,
clears the previous checkout, writes .nojekyll, stages deletions, skips
no-op deploys, and pushes HEAD:pages without a force push; the README
deploy section is updated.
Content: rename the reserved sites taxonomy to websites so the
alwaldend.com term renders, and fix main/bzl docs prefix collisions
across nested modules.
Review fixes: document the extension-based toolchain registration in
the rules_hugo README, sync the full-repo-check eval rubric to nine
nested workspaces and twenty commands, and drop the worker’s unsupported
outs attribute.
Validation: site build produces 3051 HTML pages and Sass CSS; worker,
terraform, buildifier, and nested rules_hugo tests pass; git diff
–check is clean.
LLM-disclaimer: This commit was generated by an LLM.
Close the registered agent-reachable universe with owner-local operation
declarations, a report-only completeness checker, shared task-run contracts,
task/run-isolated Cordis scratch, explicit Terraform mutations, and bounded
Bazel diagnostics. Record numeric resource ceilings and accepted durable-goal
evidence for the exact candidate.
Integrate the non-render agent tooling and Blender toolchain changes from PR
24 while retaining the old Blender data package whose move destination is
excluded. Direct repository agents to prefer Cordis over shell for supported
inspection and to consider bounded Cordis handlers for recurring gaps.
Verification:
affected Bazel build: 74 targets passed
affected Bazel tests: 23 of 23 passed
Phase 1 registered-universe report: valid
goal validation: valid
git diff –check HEAD: passed
LLM-disclaimer: This commit was generated by an LLM.
Make the repository legible as one coherent agent-operated system while
preserving one mutation authority per fact.
add revision-bound current state, target architecture, and phased roadmap
route root and agent entry points to the canonical model and durable goal
normalize repository-tree policy and the public-information boundary
clarify task-private secret scratch and non-obvious tool narration
correct question and secret skill contracts and stale operator examples
render source-compatible Markdown links correctly in the documentation site
retain the complete audit, decision, validation, and acceptance record
Validated with focused skill and Buildifier tests, affected Bazel builds, the
full Hugo site, source and rendered link checks, exact label queries,
repository-pinned formatting, and goal-record validation.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Introduce a Bazel-built Go tool that calculates the repository’s global
SemVer-compatible ISO-week calendar versions, creates guarded nightly tags and
weekly release branches atomically, advances release patches by first-parent
commit, and emits deterministic Bazel workspace-status keys.
Route release stamping through the tool and add a packaged, discoverable
versioning skill with offline Promptfoo validation. Cover ISO week boundaries,
SemVer formatting, branch and dirty-tree guards, release patch calculation,
tag integrity, and stamping output with focused tests.
Provide a clean-checkout bootstrap that builds the Go tool before it launches
the stamped Bazel command. Bind ref transactions to the inspected commit,
neutralize Git replace/graft/routing inputs, make dry runs validate namespace
collisions, validate every published patch tag against its exact first-parent
position, reject ambiguous or inconsistent tag states, and require explicit
context for detached release calculations. Route detached release-tag
selection through those same history-integrity checks. Keep development status
cache-safe by emitting Git identity as volatile data while making immutable
nightly and release identities stable.
Add a repository-delivery integration regression proving that a failed
aggregate whitespace check identifies the offending path exactly once.
Verified with:
bazel_agent test //tools/versioning/… //tools/repo_delivery/main/go:go_test
//:write_skill_links_test //:buildifier_test
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Inline sources from eight layout-neutral pkg_files wrappers and migrate the remaining legacy Vial docs producer to docs_filegroup. Keep only mappings that perform required renames.\n\nThis commit was generated by an LLM.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Add the missing AL and Kustomization release targets and give release actions a declared bare Git snapshot instead of access to the workspace repository.\n\nThis commit was generated by an LLM.
Reduce the root AGENTS.md from 255 lines to 141 by keeping repository-wide
constraints visible and moving execution detail to the skill that owns it.
Make initial reads task-dependent, replace the absolute one-copy rule with one
authoritative source, simplify the retry rule to its principle, and fix the
generated-file delivery ambiguity. Add a single “When to load a skill” routing
table ordered by task phase.
Add the repo-workspace skill so worktree isolation and task-scratch placement
are established before the first write rather than when repo-delivery loads.
Transfer commit-subject and trailer conventions into a repo-delivery reference
and the Go and Bazel-native automation rules into repo-bazel. Reconcile the
git-rebase-remote and repo-delivery drift so a task-owned rewrite may change
ancestry while preserving every previously remote commit’s reachable progress.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Center the project index on the documentation axis
The section index resolved layouts/projects/list.html inside the default
baseof, whose bare gave it no grid column and no
padding offset from the .td-main main rule, so it rendered full width at
48px with a 128px heading.
Give the section its own projects_index type with a baseof that keeps the
documentation row and column but omits both asides. The index now starts
at 88px and centers at 259px with a 771px column, matching /docs/ and
/blog/ exactly.
248c9e0bc2b857a4f0b390054a98e699fc571c70
simeonwarrenbot <simeonwarrenbot@alwaldend.com>
simeonwarrenbot <simeonwarrenbot@alwaldend.com>
Render the project index in the documentation column
The index rendered in the layout’s root wrapper, so its text spanned the full
page width instead of the column the documentation and blog pages use. That
made it read as a stray full-width list rather than a page of the site.
Lay the index out like a documentation list page: the documentation column
(col-12 col-md-9 col-xl-8 ps-md-5) inside a row, the section description as
a lead, and the theme’s section-index entries separated by a panel line. The
documentation sidebars are deliberately absent, so the list stays a plain
single-column page.
LLM-disclaimer: This commit was generated by an LLM.
Lay the project index out as a single-column section list
The card grid read as a separate component next to the rest of the site. The
/projects/ index now uses the same section list as the documentation index:
one entry per project under the Projects heading, separated by panel lines,
each entry carrying its description, status, and tags. The entries stay in
alphabetical order.
Wrap the list in a section so the theme’s first-section offset applies; without
it the Projects heading rendered underneath the fixed navbar.
LLM-disclaimer: This commit was generated by an LLM.
Add a staging publication and refine the project index
Verify the project landing replacement on its own hostname before the apex
changes and before any per-project resource is retired, and make the landing
index useful to a visitor.
www-staging.alwaldend.com gets a checked-in DNS declaration and a catalog
repository, and the apex site gains a staging build that renders the same
packaged source with the staging base URL plus a deployment command that
publishes it. The publication command now takes its repository and branch as
arguments, so staging and production share one publisher, and a repository
whose publication branch does not exist yet is created as an orphan instead of
failing on clone. A new repository receives a default branch at creation so the
managed ruleset can protect it while site content publishes to a separate
branch, and GitHub Pages configuration is deferred for a repository until its
publication branch exists.
The /projects/ index no longer opens with explanatory prose, lists landings
alphabetically, and shows each project’s status and tags as links to their
taxonomy term pages.
Deploy the staging site, verify the landing, documentation, and taxonomy
routes there, then deploy the accepted output to the apex and verify the same
routes. The per-project hostnames, DNS records, and landing repositories remain
in place until their retirement is requested.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Publish the DNS evolution article and update blog workflow
Publish the author’s account of moving DNS management from a central
DNSControl configuration to project-owned Terraform records, with examples
and directory layouts. Include the author’s clarifications and approved
wording corrections, and remove the draft flag for publication.
Tag both blog posts using existing site topics. Require relevant tags and
iterative reviews in the blog skill: report findings before validation and
delivery, repeat after changes, and finish delivery when the review is clear
or the author ends it. Cover both behaviors in the existing evaluation cases.
Validation: local and release Hugo builds, site_test, skill validation and
offline Promptfoo configuration test, skill discovery, Buildifier, repository
quality, and semantic lint for the affected blog and skill packages.
LLM-disclaimer: This commit was generated by an LLM.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Record the site hostname decision for alwaldend.com
Record the evaluated options for the apex site’s landing, documentation, and
blog sections: one hostname with one build (retained), separate hostnames
served from separate GitHub Pages repositories, and one hostname with
independently built and merged section outputs. The generated documentation
tree is a projection of the repository’s own directory structure across 471
packaged README files, and an earlier commit already combined the misc, docs,
and projects sites, so splitting the hostnames would move where the projection
is served without decoupling it from its source.
Separate the shared-build failure coupling from the hostname question: the
recorded fallback keeps one published tree while splitting the build graph, if
panicking on any packaged README warning starts blocking delivery.
Record the search-engine evidence from primary sources. Google’s
crawling-and-indexing FAQ states that from an indexing and ranking perspective
Google has no preference, and the office-hours answer recorded here addresses
the same question. The record explicitly does not claim that subdirectories
preserve link equity that a subdomain would forfeit, and it cites a third
vendor video by title only because its spoken content could not be retrieved.
This change adds no site behavior, build target, configuration, DNS record, or
Terraform resource.
Add a shared androidPlugins version catalog so both Android apps declare the
AGP, Kotlin, Compose, and protobuf plugin versions once, and derive their
versions from it instead of duplicating literals per root Gradle file.
Align the launcher and ingester app versions with the repository versioning
contract: development builds use 0.0.0-dev with versionCode 1 in both the
Gradle default config and the Bazel manifest_values.
Ignore the whole materialized .agents/skills directory in Prettier because
every entry is either a source-tree symlink or a byte-pinned external archive
copy.
Apply the ingester’s themed surface background to the main content surface so
the status bar area follows the system theme, not a default white surface.
Token: z-ai-glm-flash-latest
LLM-disclaimer: This commit was generated by an LLM.
Add a blog section, a shared site canvas, and standalone nested modules
Publish the Docsy blog section on the apex site with its content package,
navigation entry, RSS feed, and draft-safe release flags. The release build
excludes drafts so a post stays unpublished from its front matter alone.
Move the reusable project-site procedure to a generic repo-hugo skill that
also documents the Hugo theme layout, and add an alwaldend-blog skill that
publishes supplied content verbatim and reviews it afterward. Enforce one
implementation and one copy of each fact in the root policy, and refine the
skill locality rule to prefer local ownership only when it genuinely fits.
Share one black theme between the landing shell and the apex site from a
single SCSS source, and let docs_filegroup preserve source paths so packages
holding identically named files stop colliding.
Repair every nested Bazel workspace: rules_openspec declared six unused,
versionless sibling dependencies whose local_path_override entries never
applied outside the root module, which broke standalone resolution for all
nested modules. Drop those dependencies, ignore the two nested module
directories that lacked an ignore entry, add the missing build_test coverage,
and extend the full-repository check to all twelve nested workspaces.
Remove the goal component, the agent control tower, and the site link test
Delete projects/goal entirely: its CLI, API package, filesystem store, landing
site, disabled skill sources, documentation pages, diagrams, Bazel targets,
project-registry entry, and committed DNS record. The goal tool was deprecated
by the 2026-09-08 migration to the pinned OpenSpec CLI, which is in active use,
and the repository policy already told agents not to create goal records.
Delete tools/agents entirely. It carried repository-internal control contracts,
seven catalog compilers, an offline context capsule, and typed
admission/control/plan/evidence libraries. The goal tool was their only
consumer; no CI or AGENTS.md invocation read the catalogs. Relocate the generic
skill-discovery declaration to .agents/BUILD.bazel beside the directory it
generates, and repoint the 29 skill visibility labels from
//tools/agents:skill_discovery to //.agents:skill_discovery. Skill content,
link targets, and the 27 existing symlinks are unchanged. A BUILD.bazel inside
.agents/skills/ was rejected because the generated updater rejects a
non-symlink there.
Reduce projects/agents to its skills: delete the architecture, current-state,
and roadmap documents and the docs package they fed. Documentation describing
agent-system composition now belongs with the component that owns the behavior.
Remove //projects/alwaldend.com/test/site:site_test. It has never passed since
894494f4: it fails on unmodified HEAD with 330 missing-file findings because it
treats repository source paths and the published URL space as one namespace.
Repository-only targets such as BUILD.bazel and playbook YAML are deliberately
not packaged, so those links can never resolve in generated output.
Record the removals as three OpenSpec changes: remove-deprecated-goal-component
and remove-generated-site-link-test under infra/src and projects/alwaldend.com,
and remove-goal-tool-and-contract-tower under projects/agents.
The removed bytes remain retrievable from git history at the parent of this
commit; the changes neither copy nor restate them.
Address review feedback before publication:
Point the hugo_landing site example at the surviving //projects/agents:docs
target. The copied example referenced //projects/agents/docs:docs, which this
change deletes, so the snippet failed label resolution.
Point the new specification links at their real paths. The repository change
referenced migration.md one directory too shallow, and the Reimu continuation
requirement referenced the process contract from beneath the change directory
instead of the project root; neither path existed.
Rewrite projects/renders/assets/reimu_fumo/PROCESS.md so its required stage
gates no longer depend on the removed goal tool. That contract was the
authoritative process for the still-open Reimu work, and it required goal-tool
checkpoints, portable goal plans, and goal state to start, repair, reset, and
close attempts. Those mechanics now record into the project’s OpenSpec change
and its durable evidence, so every gate stays executable. Acceptance criteria
and the blocked continuation state are unchanged. The continuation requirement
is recorded in the change spec and its rationale in the change design.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Roll back partial plugin startup, drain requests before releasing resources,
and wait for plugin and command processes to exit. Stop independent plugins
concurrently while preserving dependency order inside each plugin.
Revoke invocation-owned credentials, remove temporary secret files, and verify
Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login.
Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict
config dumps to owner-only files. Add the AppRole SecretID cleanup permission.
Cover normal exit, cancellation, failed startup, credential revocation, and
transport cleanup with synthetic unit and real command/plugin regression tests.
Clarify that required formatting-only repairs need no separate approval, and
fix the existing blank-line formatting failure in the GitHub AL wrapper.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Improve the Hugo site and fix the persistent worker
Extract the Hugo build rules into a standalone nested module
projects/rules_hugo and add a Go-based persistent Hugo worker with a
Dart Sass toolchain, then fix the worker’s empty-destination defect,
polish the rules, add per-project landing pages and DNS declarations,
and improve the site deploy.
rules_hugo: standalone nested module with MODULE.bazel, main/bzl rules,
tests, and README; no root-workspace labels.
hugo_worker: persistent worker that resolves execroot-relative paths
through the work directory and probes DART_SASS_BINARY, so the site
destination is populated with HTML and Sass-compiled CSS.
sass: Dart Sass 1.103.1 toolchain wired into the site build.
alwaldend.com: Hugo 0.165.0, Docsy 0.17.0, Bootstrap 5.3.8, Font
Awesome 7.3.1, module mounts, and the site build switched to the worker.
Landing pages: content/projects/_index.md links every project to its
docs page; a Projects menu entry is added and the content filegroup is
wired.
DNS: projects/alwaldend.com/dnsconfig.json declares no records (no new
subdomains) and is wired into infra/dns/dnsconfig.js.
Deploy: the genrule clones the pages branch that GitHub Pages serves,
clears the previous checkout, writes .nojekyll, stages deletions, skips
no-op deploys, and pushes HEAD:pages without a force push; the README
deploy section is updated.
Content: rename the reserved sites taxonomy to websites so the
alwaldend.com term renders, and fix main/bzl docs prefix collisions
across nested modules.
Review fixes: document the extension-based toolchain registration in
the rules_hugo README, sync the full-repo-check eval rubric to nine
nested workspaces and twenty commands, and drop the worker’s unsupported
outs attribute.
Validation: site build produces 3051 HTML pages and Sass CSS; worker,
terraform, buildifier, and nested rules_hugo tests pass; git diff
–check is clean.
LLM-disclaimer: This commit was generated by an LLM.
Close the registered agent-reachable universe with owner-local operation
declarations, a report-only completeness checker, shared task-run contracts,
task/run-isolated Cordis scratch, explicit Terraform mutations, and bounded
Bazel diagnostics. Record numeric resource ceilings and accepted durable-goal
evidence for the exact candidate.
Integrate the non-render agent tooling and Blender toolchain changes from PR
24 while retaining the old Blender data package whose move destination is
excluded. Direct repository agents to prefer Cordis over shell for supported
inspection and to consider bounded Cordis handlers for recurring gaps.
Verification:
affected Bazel build: 74 targets passed
affected Bazel tests: 23 of 23 passed
Phase 1 registered-universe report: valid
goal validation: valid
git diff –check HEAD: passed
LLM-disclaimer: This commit was generated by an LLM.
Make the repository legible as one coherent agent-operated system while
preserving one mutation authority per fact.
add revision-bound current state, target architecture, and phased roadmap
route root and agent entry points to the canonical model and durable goal
normalize repository-tree policy and the public-information boundary
clarify task-private secret scratch and non-obvious tool narration
correct question and secret skill contracts and stale operator examples
render source-compatible Markdown links correctly in the documentation site
retain the complete audit, decision, validation, and acceptance record
Validated with focused skill and Buildifier tests, affected Bazel builds, the
full Hugo site, source and rendered link checks, exact label queries,
repository-pinned formatting, and goal-record validation.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Introduce a Bazel-built Go tool that calculates the repository’s global
SemVer-compatible ISO-week calendar versions, creates guarded nightly tags and
weekly release branches atomically, advances release patches by first-parent
commit, and emits deterministic Bazel workspace-status keys.
Route release stamping through the tool and add a packaged, discoverable
versioning skill with offline Promptfoo validation. Cover ISO week boundaries,
SemVer formatting, branch and dirty-tree guards, release patch calculation,
tag integrity, and stamping output with focused tests.
Provide a clean-checkout bootstrap that builds the Go tool before it launches
the stamped Bazel command. Bind ref transactions to the inspected commit,
neutralize Git replace/graft/routing inputs, make dry runs validate namespace
collisions, validate every published patch tag against its exact first-parent
position, reject ambiguous or inconsistent tag states, and require explicit
context for detached release calculations. Route detached release-tag
selection through those same history-integrity checks. Keep development status
cache-safe by emitting Git identity as volatile data while making immutable
nightly and release identities stable.
Add a repository-delivery integration regression proving that a failed
aggregate whitespace check identifies the offending path exactly once.
Verified with:
bazel_agent test //tools/versioning/… //tools/repo_delivery/main/go:go_test
//:write_skill_links_test //:buildifier_test
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Inline sources from eight layout-neutral pkg_files wrappers and migrate the remaining legacy Vial docs producer to docs_filegroup. Keep only mappings that perform required renames.\n\nThis commit was generated by an LLM.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Add the missing AL and Kustomization release targets and give release actions a declared bare Git snapshot instead of access to the workspace repository.\n\nThis commit was generated by an LLM.
Reduce the root AGENTS.md from 255 lines to 141 by keeping repository-wide
constraints visible and moving execution detail to the skill that owns it.
Make initial reads task-dependent, replace the absolute one-copy rule with one
authoritative source, simplify the retry rule to its principle, and fix the
generated-file delivery ambiguity. Add a single “When to load a skill” routing
table ordered by task phase.
Add the repo-workspace skill so worktree isolation and task-scratch placement
are established before the first write rather than when repo-delivery loads.
Transfer commit-subject and trailer conventions into a repo-delivery reference
and the Go and Bazel-native automation rules into repo-bazel. Reconcile the
git-rebase-remote and repo-delivery drift so a task-owned rewrite may change
ancestry while preserving every previously remote commit’s reachable progress.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
bazel_agent bazel build //projects/alwaldend.com:site
bazel_agent bazel test //projects/alwaldend.com:site_test
bazel_agent bazel run //projects/alwaldend.com:site_serve
The preview serves the local build at http://127.0.0.1:1313.
Blog
The site publishes dated articles from content/blog. Each post is its own
Bazel package with an index.md and a BUILD.bazel declaring its
docs_filegroup; the section package aggregates them. The section publishes
HTML, an RSS feed, and a print edition, and appears in the main navigation.
The section index and its posts carry a github_subdir cascade so the
per-page GitHub links point at the content sources.
A post stays unpublished while its front matter declares draft: true. Local
builds render drafts for review and the release build excludes them, so the
draft state alone withholds a post from the deployed site.
The site publishes each registered project’s visitor-facing landing page at
/projects/<name>/, with the section index at /projects/. Each project owns
its landing content in projects/<name>/site/content/; this site packages
those directories into content/projects/<name>/ from the registry in
projects/projects.bzl. Landing content carries no layouts,
styles, or build rules, and participates in the shared statuses,
languages, and tags taxonomies.
Repository reference documentation, including each project README, stays under
/docs/projects/<name>/. Because every landing is part of this one build, a
content error in any landing fails the whole site build and the blog
deployment.
Documentation links
Markdown links and images resolve relative to their source directory.
README.md and _index.md links resolve to generated pages; packaged resources
use their published URLs, including when embedded in print pages. Link files
that exist only in the repository with explicit GitHub URLs. Unknown internal
destinations remain unchanged rather than being silently redirected to GitHub.
Print pages scope IDs and their fragment and control references to each source
document, keeping anchors distinct when documents are combined.
This project’s DNS declaration
owns the shared pages address. Project landing pages are published by this
site under /projects/<name>/, so no project owns a CNAME or a dedicated
hostname. The project directory links to every landing page.
The apex and www records stay managed centrally.
Deploy to the Github Pages repo (the pages branch of
alwaldend/alwaldend.github.io, which GitHub Pages serves):
tools/versioning/cmd/versioning/versioning.sh bazel -- \
run --config=release //projects/alwaldend.com:deploy
The deploy script clones the pages branch, replaces its contents with the
built site, writes .nojekyll, and pushes only when the output changed.
Update PVE VMs
bazel run //projects/alwaldend.com/tf # Apply tfbazel run //projects/alwaldend.com/tf:update_pve_disk # Update the disk
Taxonomy
Taxonomy
Meaning
Categories
General category
Languages
Programming language
Sites
Sites
Statuses
Project status
Tags
Generic tags
Shortcodes
alwaldend/alert
{{< alwaldend/alert >}}
Alert body
{{< /alwaldend/alert >}}
alwaldend/label_link
Create a link using a bazel label
Usage:
{{% alwaldend/label_link "//tools/qt" %}}
alwaldend/links
Render common links
Usage:
{{% alwaldend/links %}}
alwaldend/svg_file
Render a packaged SVG using its published URL. Set alt to describe the image;
the page title is the fallback.
Center the project index on the documentation axis
The section index resolved layouts/projects/list.html inside the default
baseof, whose bare gave it no grid column and no
padding offset from the .td-main main rule, so it rendered full width at
48px with a 128px heading.
Give the section its own projects_index type with a baseof that keeps the
documentation row and column but omits both asides. The index now starts
at 88px and centers at 259px with a 771px column, matching /docs/ and
/blog/ exactly.
248c9e0bc2b857a4f0b390054a98e699fc571c70
simeonwarrenbot <simeonwarrenbot@alwaldend.com>
simeonwarrenbot <simeonwarrenbot@alwaldend.com>
Render the project index in the documentation column
The index rendered in the layout’s root wrapper, so its text spanned the full
page width instead of the column the documentation and blog pages use. That
made it read as a stray full-width list rather than a page of the site.
Lay the index out like a documentation list page: the documentation column
(col-12 col-md-9 col-xl-8 ps-md-5) inside a row, the section description as
a lead, and the theme’s section-index entries separated by a panel line. The
documentation sidebars are deliberately absent, so the list stays a plain
single-column page.
LLM-disclaimer: This commit was generated by an LLM.
Lay the project index out as a single-column section list
The card grid read as a separate component next to the rest of the site. The
/projects/ index now uses the same section list as the documentation index:
one entry per project under the Projects heading, separated by panel lines,
each entry carrying its description, status, and tags. The entries stay in
alphabetical order.
Wrap the list in a section so the theme’s first-section offset applies; without
it the Projects heading rendered underneath the fixed navbar.
LLM-disclaimer: This commit was generated by an LLM.
Add a staging publication and refine the project index
Verify the project landing replacement on its own hostname before the apex
changes and before any per-project resource is retired, and make the landing
index useful to a visitor.
www-staging.alwaldend.com gets a checked-in DNS declaration and a catalog
repository, and the apex site gains a staging build that renders the same
packaged source with the staging base URL plus a deployment command that
publishes it. The publication command now takes its repository and branch as
arguments, so staging and production share one publisher, and a repository
whose publication branch does not exist yet is created as an orphan instead of
failing on clone. A new repository receives a default branch at creation so the
managed ruleset can protect it while site content publishes to a separate
branch, and GitHub Pages configuration is deferred for a repository until its
publication branch exists.
The /projects/ index no longer opens with explanatory prose, lists landings
alphabetically, and shows each project’s status and tags as links to their
taxonomy term pages.
Deploy the staging site, verify the landing, documentation, and taxonomy
routes there, then deploy the accepted output to the apex and verify the same
routes. The per-project hostnames, DNS records, and landing repositories remain
in place until their retirement is requested.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Publish the DNS evolution article and update blog workflow
Publish the author’s account of moving DNS management from a central
DNSControl configuration to project-owned Terraform records, with examples
and directory layouts. Include the author’s clarifications and approved
wording corrections, and remove the draft flag for publication.
Tag both blog posts using existing site topics. Require relevant tags and
iterative reviews in the blog skill: report findings before validation and
delivery, repeat after changes, and finish delivery when the review is clear
or the author ends it. Cover both behaviors in the existing evaluation cases.
Validation: local and release Hugo builds, site_test, skill validation and
offline Promptfoo configuration test, skill discovery, Buildifier, repository
quality, and semantic lint for the affected blog and skill packages.
LLM-disclaimer: This commit was generated by an LLM.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Record the site hostname decision for alwaldend.com
Record the evaluated options for the apex site’s landing, documentation, and
blog sections: one hostname with one build (retained), separate hostnames
served from separate GitHub Pages repositories, and one hostname with
independently built and merged section outputs. The generated documentation
tree is a projection of the repository’s own directory structure across 471
packaged README files, and an earlier commit already combined the misc, docs,
and projects sites, so splitting the hostnames would move where the projection
is served without decoupling it from its source.
Separate the shared-build failure coupling from the hostname question: the
recorded fallback keeps one published tree while splitting the build graph, if
panicking on any packaged README warning starts blocking delivery.
Record the search-engine evidence from primary sources. Google’s
crawling-and-indexing FAQ states that from an indexing and ranking perspective
Google has no preference, and the office-hours answer recorded here addresses
the same question. The record explicitly does not claim that subdirectories
preserve link equity that a subdomain would forfeit, and it cites a third
vendor video by title only because its spoken content could not be retrieved.
This change adds no site behavior, build target, configuration, DNS record, or
Terraform resource.
Add a shared androidPlugins version catalog so both Android apps declare the
AGP, Kotlin, Compose, and protobuf plugin versions once, and derive their
versions from it instead of duplicating literals per root Gradle file.
Align the launcher and ingester app versions with the repository versioning
contract: development builds use 0.0.0-dev with versionCode 1 in both the
Gradle default config and the Bazel manifest_values.
Ignore the whole materialized .agents/skills directory in Prettier because
every entry is either a source-tree symlink or a byte-pinned external archive
copy.
Apply the ingester’s themed surface background to the main content surface so
the status bar area follows the system theme, not a default white surface.
Token: z-ai-glm-flash-latest
LLM-disclaimer: This commit was generated by an LLM.
Add a blog section, a shared site canvas, and standalone nested modules
Publish the Docsy blog section on the apex site with its content package,
navigation entry, RSS feed, and draft-safe release flags. The release build
excludes drafts so a post stays unpublished from its front matter alone.
Move the reusable project-site procedure to a generic repo-hugo skill that
also documents the Hugo theme layout, and add an alwaldend-blog skill that
publishes supplied content verbatim and reviews it afterward. Enforce one
implementation and one copy of each fact in the root policy, and refine the
skill locality rule to prefer local ownership only when it genuinely fits.
Share one black theme between the landing shell and the apex site from a
single SCSS source, and let docs_filegroup preserve source paths so packages
holding identically named files stop colliding.
Repair every nested Bazel workspace: rules_openspec declared six unused,
versionless sibling dependencies whose local_path_override entries never
applied outside the root module, which broke standalone resolution for all
nested modules. Drop those dependencies, ignore the two nested module
directories that lacked an ignore entry, add the missing build_test coverage,
and extend the full-repository check to all twelve nested workspaces.
Remove the goal component, the agent control tower, and the site link test
Delete projects/goal entirely: its CLI, API package, filesystem store, landing
site, disabled skill sources, documentation pages, diagrams, Bazel targets,
project-registry entry, and committed DNS record. The goal tool was deprecated
by the 2026-09-08 migration to the pinned OpenSpec CLI, which is in active use,
and the repository policy already told agents not to create goal records.
Delete tools/agents entirely. It carried repository-internal control contracts,
seven catalog compilers, an offline context capsule, and typed
admission/control/plan/evidence libraries. The goal tool was their only
consumer; no CI or AGENTS.md invocation read the catalogs. Relocate the generic
skill-discovery declaration to .agents/BUILD.bazel beside the directory it
generates, and repoint the 29 skill visibility labels from
//tools/agents:skill_discovery to //.agents:skill_discovery. Skill content,
link targets, and the 27 existing symlinks are unchanged. A BUILD.bazel inside
.agents/skills/ was rejected because the generated updater rejects a
non-symlink there.
Reduce projects/agents to its skills: delete the architecture, current-state,
and roadmap documents and the docs package they fed. Documentation describing
agent-system composition now belongs with the component that owns the behavior.
Remove //projects/alwaldend.com/test/site:site_test. It has never passed since
894494f4: it fails on unmodified HEAD with 330 missing-file findings because it
treats repository source paths and the published URL space as one namespace.
Repository-only targets such as BUILD.bazel and playbook YAML are deliberately
not packaged, so those links can never resolve in generated output.
Record the removals as three OpenSpec changes: remove-deprecated-goal-component
and remove-generated-site-link-test under infra/src and projects/alwaldend.com,
and remove-goal-tool-and-contract-tower under projects/agents.
The removed bytes remain retrievable from git history at the parent of this
commit; the changes neither copy nor restate them.
Address review feedback before publication:
Point the hugo_landing site example at the surviving //projects/agents:docs
target. The copied example referenced //projects/agents/docs:docs, which this
change deletes, so the snippet failed label resolution.
Point the new specification links at their real paths. The repository change
referenced migration.md one directory too shallow, and the Reimu continuation
requirement referenced the process contract from beneath the change directory
instead of the project root; neither path existed.
Rewrite projects/renders/assets/reimu_fumo/PROCESS.md so its required stage
gates no longer depend on the removed goal tool. That contract was the
authoritative process for the still-open Reimu work, and it required goal-tool
checkpoints, portable goal plans, and goal state to start, repair, reset, and
close attempts. Those mechanics now record into the project’s OpenSpec change
and its durable evidence, so every gate stays executable. Acceptance criteria
and the blocked continuation state are unchanged. The continuation requirement
is recorded in the change spec and its rationale in the change design.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Improve the Hugo site and fix the persistent worker
Extract the Hugo build rules into a standalone nested module
projects/rules_hugo and add a Go-based persistent Hugo worker with a
Dart Sass toolchain, then fix the worker’s empty-destination defect,
polish the rules, add per-project landing pages and DNS declarations,
and improve the site deploy.
rules_hugo: standalone nested module with MODULE.bazel, main/bzl rules,
tests, and README; no root-workspace labels.
hugo_worker: persistent worker that resolves execroot-relative paths
through the work directory and probes DART_SASS_BINARY, so the site
destination is populated with HTML and Sass-compiled CSS.
sass: Dart Sass 1.103.1 toolchain wired into the site build.
alwaldend.com: Hugo 0.165.0, Docsy 0.17.0, Bootstrap 5.3.8, Font
Awesome 7.3.1, module mounts, and the site build switched to the worker.
Landing pages: content/projects/_index.md links every project to its
docs page; a Projects menu entry is added and the content filegroup is
wired.
DNS: projects/alwaldend.com/dnsconfig.json declares no records (no new
subdomains) and is wired into infra/dns/dnsconfig.js.
Deploy: the genrule clones the pages branch that GitHub Pages serves,
clears the previous checkout, writes .nojekyll, stages deletions, skips
no-op deploys, and pushes HEAD:pages without a force push; the README
deploy section is updated.
Content: rename the reserved sites taxonomy to websites so the
alwaldend.com term renders, and fix main/bzl docs prefix collisions
across nested modules.
Review fixes: document the extension-based toolchain registration in
the rules_hugo README, sync the full-repo-check eval rubric to nine
nested workspaces and twenty commands, and drop the worker’s unsupported
outs attribute.
Validation: site build produces 3051 HTML pages and Sass CSS; worker,
terraform, buildifier, and nested rules_hugo tests pass; git diff
–check is clean.
LLM-disclaimer: This commit was generated by an LLM.
Make the repository legible as one coherent agent-operated system while
preserving one mutation authority per fact.
add revision-bound current state, target architecture, and phased roadmap
route root and agent entry points to the canonical model and durable goal
normalize repository-tree policy and the public-information boundary
clarify task-private secret scratch and non-obvious tool narration
correct question and secret skill contracts and stale operator examples
render source-compatible Markdown links correctly in the documentation site
retain the complete audit, decision, validation, and acceptance record
Validated with focused skill and Buildifier tests, affected Bazel builds, the
full Hugo site, source and rendered link checks, exact label queries,
repository-pinned formatting, and goal-record validation.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Introduce a Bazel-built Go tool that calculates the repository’s global
SemVer-compatible ISO-week calendar versions, creates guarded nightly tags and
weekly release branches atomically, advances release patches by first-parent
commit, and emits deterministic Bazel workspace-status keys.
Route release stamping through the tool and add a packaged, discoverable
versioning skill with offline Promptfoo validation. Cover ISO week boundaries,
SemVer formatting, branch and dirty-tree guards, release patch calculation,
tag integrity, and stamping output with focused tests.
Provide a clean-checkout bootstrap that builds the Go tool before it launches
the stamped Bazel command. Bind ref transactions to the inspected commit,
neutralize Git replace/graft/routing inputs, make dry runs validate namespace
collisions, validate every published patch tag against its exact first-parent
position, reject ambiguous or inconsistent tag states, and require explicit
context for detached release calculations. Route detached release-tag
selection through those same history-integrity checks. Keep development status
cache-safe by emitting Git identity as volatile data while making immutable
nightly and release identities stable.
Add a repository-delivery integration regression proving that a failed
aggregate whitespace check identifies the offending path exactly once.
Verified with:
bazel_agent test //tools/versioning/… //tools/repo_delivery/main/go:go_test
//:write_skill_links_test //:buildifier_test
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Inline sources from eight layout-neutral pkg_files wrappers and migrate the remaining legacy Vial docs producer to docs_filegroup. Keep only mappings that perform required renames.\n\nThis commit was generated by an LLM.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Reduce the root AGENTS.md from 255 lines to 141 by keeping repository-wide
constraints visible and moving execution detail to the skill that owns it.
Make initial reads task-dependent, replace the absolute one-copy rule with one
authoritative source, simplify the retry rule to its principle, and fix the
generated-file delivery ambiguity. Add a single “When to load a skill” routing
table ordered by task phase.
Add the repo-workspace skill so worktree isolation and task-scratch placement
are established before the first write rather than when repo-delivery loads.
Transfer commit-subject and trailer conventions into a repo-delivery reference
and the Go and Bazel-native automation rules into repo-bazel. Reconcile the
git-rebase-remote and repo-delivery drift so a task-owned rewrite may change
ancestry while preserving every previously remote commit’s reachable progress.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Center the project index on the documentation axis
The section index resolved layouts/projects/list.html inside the default
baseof, whose bare gave it no grid column and no
padding offset from the .td-main main rule, so it rendered full width at
48px with a 128px heading.
Give the section its own projects_index type with a baseof that keeps the
documentation row and column but omits both asides. The index now starts
at 88px and centers at 259px with a 771px column, matching /docs/ and
/blog/ exactly.
248c9e0bc2b857a4f0b390054a98e699fc571c70
simeonwarrenbot <simeonwarrenbot@alwaldend.com>
simeonwarrenbot <simeonwarrenbot@alwaldend.com>
Render the project index in the documentation column
The index rendered in the layout’s root wrapper, so its text spanned the full
page width instead of the column the documentation and blog pages use. That
made it read as a stray full-width list rather than a page of the site.
Lay the index out like a documentation list page: the documentation column
(col-12 col-md-9 col-xl-8 ps-md-5) inside a row, the section description as
a lead, and the theme’s section-index entries separated by a panel line. The
documentation sidebars are deliberately absent, so the list stays a plain
single-column page.
LLM-disclaimer: This commit was generated by an LLM.
Lay the project index out as a single-column section list
The card grid read as a separate component next to the rest of the site. The
/projects/ index now uses the same section list as the documentation index:
one entry per project under the Projects heading, separated by panel lines,
each entry carrying its description, status, and tags. The entries stay in
alphabetical order.
Wrap the list in a section so the theme’s first-section offset applies; without
it the Projects heading rendered underneath the fixed navbar.
LLM-disclaimer: This commit was generated by an LLM.
Add a staging publication and refine the project index
Verify the project landing replacement on its own hostname before the apex
changes and before any per-project resource is retired, and make the landing
index useful to a visitor.
www-staging.alwaldend.com gets a checked-in DNS declaration and a catalog
repository, and the apex site gains a staging build that renders the same
packaged source with the staging base URL plus a deployment command that
publishes it. The publication command now takes its repository and branch as
arguments, so staging and production share one publisher, and a repository
whose publication branch does not exist yet is created as an orphan instead of
failing on clone. A new repository receives a default branch at creation so the
managed ruleset can protect it while site content publishes to a separate
branch, and GitHub Pages configuration is deferred for a repository until its
publication branch exists.
The /projects/ index no longer opens with explanatory prose, lists landings
alphabetically, and shows each project’s status and tags as links to their
taxonomy term pages.
Deploy the staging site, verify the landing, documentation, and taxonomy
routes there, then deploy the accepted output to the apex and verify the same
routes. The per-project hostnames, DNS records, and landing repositories remain
in place until their retirement is requested.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Publish the DNS evolution article and update blog workflow
Publish the author’s account of moving DNS management from a central
DNSControl configuration to project-owned Terraform records, with examples
and directory layouts. Include the author’s clarifications and approved
wording corrections, and remove the draft flag for publication.
Tag both blog posts using existing site topics. Require relevant tags and
iterative reviews in the blog skill: report findings before validation and
delivery, repeat after changes, and finish delivery when the review is clear
or the author ends it. Cover both behaviors in the existing evaluation cases.
Validation: local and release Hugo builds, site_test, skill validation and
offline Promptfoo configuration test, skill discovery, Buildifier, repository
quality, and semantic lint for the affected blog and skill packages.
LLM-disclaimer: This commit was generated by an LLM.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Record the site hostname decision for alwaldend.com
Record the evaluated options for the apex site’s landing, documentation, and
blog sections: one hostname with one build (retained), separate hostnames
served from separate GitHub Pages repositories, and one hostname with
independently built and merged section outputs. The generated documentation
tree is a projection of the repository’s own directory structure across 471
packaged README files, and an earlier commit already combined the misc, docs,
and projects sites, so splitting the hostnames would move where the projection
is served without decoupling it from its source.
Separate the shared-build failure coupling from the hostname question: the
recorded fallback keeps one published tree while splitting the build graph, if
panicking on any packaged README warning starts blocking delivery.
Record the search-engine evidence from primary sources. Google’s
crawling-and-indexing FAQ states that from an indexing and ranking perspective
Google has no preference, and the office-hours answer recorded here addresses
the same question. The record explicitly does not claim that subdirectories
preserve link equity that a subdomain would forfeit, and it cites a third
vendor video by title only because its spoken content could not be retrieved.
This change adds no site behavior, build target, configuration, DNS record, or
Terraform resource.
Add a shared androidPlugins version catalog so both Android apps declare the
AGP, Kotlin, Compose, and protobuf plugin versions once, and derive their
versions from it instead of duplicating literals per root Gradle file.
Align the launcher and ingester app versions with the repository versioning
contract: development builds use 0.0.0-dev with versionCode 1 in both the
Gradle default config and the Bazel manifest_values.
Ignore the whole materialized .agents/skills directory in Prettier because
every entry is either a source-tree symlink or a byte-pinned external archive
copy.
Apply the ingester’s themed surface background to the main content surface so
the status bar area follows the system theme, not a default white surface.
Token: z-ai-glm-flash-latest
LLM-disclaimer: This commit was generated by an LLM.
Add a blog section, a shared site canvas, and standalone nested modules
Publish the Docsy blog section on the apex site with its content package,
navigation entry, RSS feed, and draft-safe release flags. The release build
excludes drafts so a post stays unpublished from its front matter alone.
Move the reusable project-site procedure to a generic repo-hugo skill that
also documents the Hugo theme layout, and add an alwaldend-blog skill that
publishes supplied content verbatim and reviews it afterward. Enforce one
implementation and one copy of each fact in the root policy, and refine the
skill locality rule to prefer local ownership only when it genuinely fits.
Share one black theme between the landing shell and the apex site from a
single SCSS source, and let docs_filegroup preserve source paths so packages
holding identically named files stop colliding.
Repair every nested Bazel workspace: rules_openspec declared six unused,
versionless sibling dependencies whose local_path_override entries never
applied outside the root module, which broke standalone resolution for all
nested modules. Drop those dependencies, ignore the two nested module
directories that lacked an ignore entry, add the missing build_test coverage,
and extend the full-repository check to all twelve nested workspaces.
Remove the goal component, the agent control tower, and the site link test
Delete projects/goal entirely: its CLI, API package, filesystem store, landing
site, disabled skill sources, documentation pages, diagrams, Bazel targets,
project-registry entry, and committed DNS record. The goal tool was deprecated
by the 2026-09-08 migration to the pinned OpenSpec CLI, which is in active use,
and the repository policy already told agents not to create goal records.
Delete tools/agents entirely. It carried repository-internal control contracts,
seven catalog compilers, an offline context capsule, and typed
admission/control/plan/evidence libraries. The goal tool was their only
consumer; no CI or AGENTS.md invocation read the catalogs. Relocate the generic
skill-discovery declaration to .agents/BUILD.bazel beside the directory it
generates, and repoint the 29 skill visibility labels from
//tools/agents:skill_discovery to //.agents:skill_discovery. Skill content,
link targets, and the 27 existing symlinks are unchanged. A BUILD.bazel inside
.agents/skills/ was rejected because the generated updater rejects a
non-symlink there.
Reduce projects/agents to its skills: delete the architecture, current-state,
and roadmap documents and the docs package they fed. Documentation describing
agent-system composition now belongs with the component that owns the behavior.
Remove //projects/alwaldend.com/test/site:site_test. It has never passed since
894494f4: it fails on unmodified HEAD with 330 missing-file findings because it
treats repository source paths and the published URL space as one namespace.
Repository-only targets such as BUILD.bazel and playbook YAML are deliberately
not packaged, so those links can never resolve in generated output.
Record the removals as three OpenSpec changes: remove-deprecated-goal-component
and remove-generated-site-link-test under infra/src and projects/alwaldend.com,
and remove-goal-tool-and-contract-tower under projects/agents.
The removed bytes remain retrievable from git history at the parent of this
commit; the changes neither copy nor restate them.
Address review feedback before publication:
Point the hugo_landing site example at the surviving //projects/agents:docs
target. The copied example referenced //projects/agents/docs:docs, which this
change deletes, so the snippet failed label resolution.
Point the new specification links at their real paths. The repository change
referenced migration.md one directory too shallow, and the Reimu continuation
requirement referenced the process contract from beneath the change directory
instead of the project root; neither path existed.
Rewrite projects/renders/assets/reimu_fumo/PROCESS.md so its required stage
gates no longer depend on the removed goal tool. That contract was the
authoritative process for the still-open Reimu work, and it required goal-tool
checkpoints, portable goal plans, and goal state to start, repair, reset, and
close attempts. Those mechanics now record into the project’s OpenSpec change
and its durable evidence, so every gate stays executable. Acceptance criteria
and the blocked continuation state are unchanged. The continuation requirement
is recorded in the change spec and its rationale in the change design.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Improve the Hugo site and fix the persistent worker
Extract the Hugo build rules into a standalone nested module
projects/rules_hugo and add a Go-based persistent Hugo worker with a
Dart Sass toolchain, then fix the worker’s empty-destination defect,
polish the rules, add per-project landing pages and DNS declarations,
and improve the site deploy.
rules_hugo: standalone nested module with MODULE.bazel, main/bzl rules,
tests, and README; no root-workspace labels.
hugo_worker: persistent worker that resolves execroot-relative paths
through the work directory and probes DART_SASS_BINARY, so the site
destination is populated with HTML and Sass-compiled CSS.
sass: Dart Sass 1.103.1 toolchain wired into the site build.
alwaldend.com: Hugo 0.165.0, Docsy 0.17.0, Bootstrap 5.3.8, Font
Awesome 7.3.1, module mounts, and the site build switched to the worker.
Landing pages: content/projects/_index.md links every project to its
docs page; a Projects menu entry is added and the content filegroup is
wired.
DNS: projects/alwaldend.com/dnsconfig.json declares no records (no new
subdomains) and is wired into infra/dns/dnsconfig.js.
Deploy: the genrule clones the pages branch that GitHub Pages serves,
clears the previous checkout, writes .nojekyll, stages deletions, skips
no-op deploys, and pushes HEAD:pages without a force push; the README
deploy section is updated.
Content: rename the reserved sites taxonomy to websites so the
alwaldend.com term renders, and fix main/bzl docs prefix collisions
across nested modules.
Review fixes: document the extension-based toolchain registration in
the rules_hugo README, sync the full-repo-check eval rubric to nine
nested workspaces and twenty commands, and drop the worker’s unsupported
outs attribute.
Validation: site build produces 3051 HTML pages and Sass CSS; worker,
terraform, buildifier, and nested rules_hugo tests pass; git diff
–check is clean.
LLM-disclaimer: This commit was generated by an LLM.
Make the repository legible as one coherent agent-operated system while
preserving one mutation authority per fact.
add revision-bound current state, target architecture, and phased roadmap
route root and agent entry points to the canonical model and durable goal
normalize repository-tree policy and the public-information boundary
clarify task-private secret scratch and non-obvious tool narration
correct question and secret skill contracts and stale operator examples
render source-compatible Markdown links correctly in the documentation site
retain the complete audit, decision, validation, and acceptance record
Validated with focused skill and Buildifier tests, affected Bazel builds, the
full Hugo site, source and rendered link checks, exact label queries,
repository-pinned formatting, and goal-record validation.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Introduce a Bazel-built Go tool that calculates the repository’s global
SemVer-compatible ISO-week calendar versions, creates guarded nightly tags and
weekly release branches atomically, advances release patches by first-parent
commit, and emits deterministic Bazel workspace-status keys.
Route release stamping through the tool and add a packaged, discoverable
versioning skill with offline Promptfoo validation. Cover ISO week boundaries,
SemVer formatting, branch and dirty-tree guards, release patch calculation,
tag integrity, and stamping output with focused tests.
Provide a clean-checkout bootstrap that builds the Go tool before it launches
the stamped Bazel command. Bind ref transactions to the inspected commit,
neutralize Git replace/graft/routing inputs, make dry runs validate namespace
collisions, validate every published patch tag against its exact first-parent
position, reject ambiguous or inconsistent tag states, and require explicit
context for detached release calculations. Route detached release-tag
selection through those same history-integrity checks. Keep development status
cache-safe by emitting Git identity as volatile data while making immutable
nightly and release identities stable.
Add a repository-delivery integration regression proving that a failed
aggregate whitespace check identifies the offending path exactly once.
Verified with:
bazel_agent test //tools/versioning/… //tools/repo_delivery/main/go:go_test
//:write_skill_links_test //:buildifier_test
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Inline sources from eight layout-neutral pkg_files wrappers and migrate the remaining legacy Vial docs producer to docs_filegroup. Keep only mappings that perform required renames.\n\nThis commit was generated by an LLM.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Reduce the root AGENTS.md from 255 lines to 141 by keeping repository-wide
constraints visible and moving execution detail to the skill that owns it.
Make initial reads task-dependent, replace the absolute one-copy rule with one
authoritative source, simplify the retry rule to its principle, and fix the
generated-file delivery ambiguity. Add a single “When to load a skill” routing
table ordered by task phase.
Add the repo-workspace skill so worktree isolation and task-scratch placement
are established before the first write rather than when repo-delivery loads.
Transfer commit-subject and trailer conventions into a repo-delivery reference
and the Go and Bazel-native automation rules into repo-bazel. Reconcile the
git-rebase-remote and repo-delivery drift so a task-owned rewrite may change
ancestry while preserving every previously remote commit’s reachable progress.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
This service stage consumes the project DNS declaration
through the shared global DNS module.
The DNS workflow uses the project’s AppRole, HTTP state backend, and Cloudflare
credentials. This public-only module does not require RouterOS. Ordinary
service commands retain their tf=main authentication, including PVE login.
Operational commands require the project AppRole and Vault provider fields in
the migration prerequisites.
dns_enabled defaults to true after verified adoption. Keep it enabled to
retain existing records; disabling it would propose deletion. The zone input
remains optional.
The dns.plan, dns.show, and dns.apply targets select only the DNS
workflow in this same root and backend. They use dns=1 to load DNS credentials
without starting PVE login. Apply requires a reviewed saved plan file. Targeted
DNS planning does not establish PVE or other service health.
Follow the DNS migration workflow for continued
reconciliation and recovery. The
adoption record
contains the earlier blocked attempt and completed scoped DNS verification.
Offline formatting is available through
//projects/alwaldend.com/tf:tf_tests.fmt_test.
5 - Android launcher
Text-only Android launcher built with Kotlin and Jetpack Compose
A text-only Android launcher built with Kotlin and Jetpack Compose. It lets
you hide apps and runs without ads, tracking, or internet access.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Add a shared androidPlugins version catalog so both Android apps declare the
AGP, Kotlin, Compose, and protobuf plugin versions once, and derive their
versions from it instead of duplicating literals per root Gradle file.
Align the launcher and ingester app versions with the repository versioning
contract: development builds use 0.0.0-dev with versionCode 1 in both the
Gradle default config and the Bazel manifest_values.
Ignore the whole materialized .agents/skills directory in Prettier because
every entry is either a source-tree symlink or a byte-pinned external archive
copy.
Apply the ingester’s themed surface background to the main content surface so
the status bar area follows the system theme, not a default white surface.
Token: z-ai-glm-flash-latest
LLM-disclaimer: This commit was generated by an LLM.
Reorganize Gradle, fdroid, and android skill layout
Collapse the maven_install_gradle_converter and tools/gradle Starlark
layers into flat defs.bzl files per the project-layout skill. Replace
the fdroid shell wrapper with a Go binary. Rewrite the Android smoke
test as a Go test. Move the android skill from the launcher project to
tools/android and register it in the skill discovery map.
Token: claude-opus-4-6
LLM-Disclaimer: Generated with Claude, reviewed by Simeon Warren
The android_binary rule produces both a signed and unsigned APK; the
smoke test script picked whichever find returned first, which could be
the unsigned one and fail installation. Explicitly skip unsigned APKs.
Token: claude-opus-4-6
LLM-Disclaimer: Generated with Claude, reviewed by Simeon Warren
Replace the curl-based Gradle wrapper with a Bazel-pinned Gradle archive
and the existing rules_java remote JDK, exposed through a Starlark wrapper
rule. Add a manual Android launcher instrumentation smoke test for runtime
APK verification, and document the test and pinned JDK usage. Exclude
Gradle-generated verification metadata from Prettier by filename glob and
remove the unnecessary third_party ignore entry.
LLM-disclaimer: This commit was generated by an LLM.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Add a shared androidPlugins version catalog so both Android apps declare the
AGP, Kotlin, Compose, and protobuf plugin versions once, and derive their
versions from it instead of duplicating literals per root Gradle file.
Align the launcher and ingester app versions with the repository versioning
contract: development builds use 0.0.0-dev with versionCode 1 in both the
Gradle default config and the Bazel manifest_values.
Ignore the whole materialized .agents/skills directory in Prettier because
every entry is either a source-tree symlink or a byte-pinned external archive
copy.
Apply the ingester’s themed surface background to the main content surface so
the status bar area follows the system theme, not a default white surface.
Token: z-ai-glm-flash-latest
LLM-disclaimer: This commit was generated by an LLM.
Reorganize Gradle, fdroid, and android skill layout
Collapse the maven_install_gradle_converter and tools/gradle Starlark
layers into flat defs.bzl files per the project-layout skill. Replace
the fdroid shell wrapper with a Go binary. Rewrite the Android smoke
test as a Go test. Move the android skill from the launcher project to
tools/android and register it in the skill discovery map.
Token: claude-opus-4-6
LLM-Disclaimer: Generated with Claude, reviewed by Simeon Warren
The android_binary rule produces both a signed and unsigned APK; the
smoke test script picked whichever find returned first, which could be
the unsigned one and fail installation. Explicitly skip unsigned APKs.
Token: claude-opus-4-6
LLM-Disclaimer: Generated with Claude, reviewed by Simeon Warren
Replace the curl-based Gradle wrapper with a Bazel-pinned Gradle archive
and the existing rules_java remote JDK, exposed through a Starlark wrapper
rule. Add a manual Android launcher instrumentation smoke test for runtime
APK verification, and document the test and pinned JDK usage. Exclude
Gradle-generated verification metadata from Prettier by filename glob and
remove the unnecessary third_party ignore entry.
LLM-disclaimer: This commit was generated by an LLM.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Set up repositories and packages for a development VM
The default task entry point configures package repositories and development
packages. It uses the same dev_vm_packages list with either the ordinary
package manager or RPM-OSTree layering. dev_vm_package_backend accepts
auto, package, or rpm_ostree; auto selects RPM-OSTree when
/run/ostree-booted exists. Set dev_vm_install_packages to false to skip
repository and package management entirely.
RPM-OSTree changes are staged for the next boot by default. The role reports a
pending deployment but does not reboot the host. Set
dev_vm_rpm_ostree_apply_live to true only when live application is known to
be safe for the selected packages.
The packaged Fedora mirror and Bazelisk tool currently make this role specific
to Linux x86-64 development hosts.
The packages task entry point exposes package management separately from
other role tasks. The bazel task entry point installs a caller-provided Bazel
rc, Bazelisk, and the repository’s bazel_agent runner for one developer
account.
Import the Bazel entry point with tasks_from: bazel and set:
dev_vm_bazel_user: owner of the installed files.
dev_vm_bazel_group: group of the installed files; defaults to the user.
dev_vm_bazel_home: absolute home directory for the developer account.
dev_vm_bazelrc_src: controller-side Bazel rc source; defaults to bazelrc.
dev_vm_bazelisk_src: controller-side Bazelisk source; defaults to
bazelisk.
dev_vm_bazel_agent_src: controller-side bazel_agent source; defaults to
bazel_agent.
The role packages its default Linux x86-64 Bazelisk and bazel_agent sources.
The calling playbook must package the Bazel rc, plus any overridden binary
sources, in an Ansible file search path. Cache storage and machine-specific
Bazel settings remain the caller’s responsibility.
lvg_volume_groups describes the complete desired physical-volume list for
each volume group. Extra physical volumes are not removed unless a caller sets
remove_extra_pvs: true.
Creating a volume group initializes every listed device as an LVM physical
volume. Callers must resolve stable device paths and verify that each device is
the intended, unused disk before applying this role; pvcreate may overwrite
an existing disk signature.
6.2.27.1 - Defaults
Defaults for lvg
lvg_volume_groups: []
6.2.28 - lvol
Setup LVM logical volumes
Each lvol_volumes entry can constrain allocation with pvs, pass creation
arguments with opts, and disable shrinking with shrink: false.
6.2.28.1 - Defaults
Defaults for lvol
lvol_volumes: []
6.2.29 - Mount
Setup posix mounts
Mount entries can set opts, dump, and passno; state: mounted keeps the
mount active and writes its persistent /etc/fstab entry.
Runs the OpenHands automation server natively from a uv-managed virtual
environment. It stores schedules and event triggers, tracks run lifecycle, and
dispatches conversations to the agent server.
The automation server is not a sandbox. It records which agent server should
run a dispatched conversation and hands that work to
AUTOMATION_AGENT_SERVER_URL; setting that variable selects the agent
server’s local mode, which uses a persistent local agent server instead of
managed OpenHands Cloud sandboxes.
openhands_automation_agent_server_api_key must equal the agent server’s
session API key because both services authenticate the same
X-Session-API-Key value. openhands_automation_local_api_key is the key
browsers present to this service.
The service stores state in SQLite via AUTOMATION_DB_URL by default, which
local mode supports without a separate database role. Set
openhands_automation_database_url to a PostgreSQL URL to use one instead.
openhands_automation_kv_secret enables the automation key-value store and is
required for automations that persist state between runs.
openhands_automation_base_url is the externally reachable origin the service
appends /api/automation to when it builds callback URLs, so it must be the
origin the browser and the dispatched agent server side both use.
Runs the OpenHands Agent Canvas browser client from the published npm package.
The service listens on loopback port openhands_canvas_port; TLS, the public
hostname, and routing to the agent server and automation API belong to the
deployment’s Traefik role.
The service runs the package’s scripts/static-server.mjs directly with Node,
an explicit loopback host, and the package’s build/ directory. It serves the
browser client without starting an agent server, an automation server, or the
npm launcher’s additional ingress process. Agent Canvas owns no conversation
or automation state and executes no tools.
The browser starts with no configured backend. The operator adds one with the
canvas origin as the host and the agent server’s session key as the credential.
The static server receives no session key and injects none into served assets.
This configuration does not advertise an embedded VSCode editor.
The npm prefix is installed inside openhands_canvas_dir.
openhands_canvas_package_dir identifies the installed package containing the
static server and browser assets.
Runs the OpenHands agent server natively from a uv-managed virtual
environment. It hosts conversations, executes tools, and streams events for
Agent Canvas. The service binds loopback only; TLS and external reachability
belong to the calling deployment.
Set openhands_server_secure to true to require a session API key. The
unsecured mode omits the session key and is only appropriate where the loopback
boundary is trusted.
The caller can set openhands_server_install_packages to false and install
openhands_server_packages through its host-specific package workflow.
OSTree hosts use the shared dev_vm package entry point and must boot into a
deployment containing those dependencies before installing the service. They
also set openhands_server_service_path under /etc/systemd/system.
Mouse-driven autoscroll CLI with reloadable configuration
Autoscroll is a Python and PyQt6 command-line application that turns mouse
movement into horizontal and vertical scrolling. It supports configurable
buttons, scroll speed, and configuration changes without restarting.
By default, the icon is disabled, to enable it pass --icon-enable
You can pass file contents as command line arguments using @path/to/the/file syntax.
Arguments in that case can be placed wherever - on one line, on several lines
If you want to dynamically pass runtime arguments (without restarting the process), you can use --config options for it
Once you press --buttons-start, you can scroll vertically or horizontally just by moving your mouse untill you press --buttons-end
If --buttons-hold is set, the srolling ends once you release --buttons-start
Once --buttons-start is pressed, the scroll thread starts looping
Every loop consists of sleeping for an interval, then scrolling for either 0, 1, or -1 pixels on both axis towards the starting point
Starting point is the point where --buttons-start was pressed
Sleep interval is recalculated on every mouse move as such:
If --scrolling-acceleration is not 0, the speed of scrolling will be faster
the farther away you are from the starting point
If --scrolling-acceleration is 0, the speed of scrolling will be constant
If config.txt is defined like this, its contents will be used as command line arguments - they will be loaded only once
Arguments can be placed wherever - on one line, on several lines
For example,
If config.txt is defined like this, the process will listen for changes in that
file and update itself
Arguments can be placed wherever - on one line, on several lines
The file is checked for changess every --config-interval
For example:
--buttons-start 1 --buttons-hold
--debug_click
--help output
usage: autoscroll [-h] [-ss SCROLLING_SPEED] [-sd SCROLLING_DEAD_AREA]
[-sa SCROLLING_ACCELERATION] [-bh] [-bs BUTTONS_START] [-be BUTTONS_END]
[-ce] [-cp CONFIG_PATH] [-ci CONFIG_INTERVAL] [-ie] [-ip ICON_PATH]
[-is ICON_SIZE] [-df] [-dc] [-ds] [-di]
...
options:
-h, --help show this help message and exit
scrolling:
-ss, --scrolling-speed int
constant part of the scrolling speed
[default: 300]
-sd, --scrolling-dead-area int
size of the square area aroung the starting point where scrolling will stop, in
pixels
[default: 50]
-sa, --scrolling-acceleration int
dynamic part of the scrolling speed, depends on the distance from the point
where the scrolling started, can be set to 0
[default: 10]
buttons:
-bh, --buttons-hold if set, the scrolling will end once you release --buttons-start
-bs, --buttons-start int
button that starts the scrolling
[default: 2]
-be, --buttons-end int
button that ends the scrolling
[default: --buttons-start]
config:
-ce, --config-enable if set, arguments from the configuration file on --config-path will be loaded
every --config-interval
-cp, --config-path str
path to the configuration file
[default: ~/.config/autoscroll/config.txt]
-ci, --config-interval int
how often the config file should be checked for changes, in seconds
[default: 5]
icon:
-ie, --icon-enable if set, the icon will be enabled
-ip, --icon-path str path to the icon
[default: resources/img/icon.svg]
-is, --icon-size int size of the icon, in pixels
[default: 30]
debug:
-df, --debug-file if set, every time the config file is parsed, information will be printed to
stdout
-dc, --debug-click if set, click info will be printed to stdout
-ds, --debug-scroll if set, scroll info will be printed to stdout
-di, --debug-initial if set, startup configuration will be printed to stdout
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
bazel_agent is the repository Bazel entry point for agents. It keeps the
Bazel invocation behind a validated subcommand while consistently applying the
agent configuration:
bazel_agent bazel test //path/to/package:all
->
bazel test --config=agent //path/to/package:all
bazel is the only Bazel entry point, and it is a validated subcommand. The
runner accepts a known Bazel command after the bazel keyword, rejects
arbitrary leading arguments, and places --config=agent after the command.
Targets, command options, and arguments after the -- separator of a
bazel run invocation pass through unchanged. Later options therefore retain
Bazel’s normal precedence and can override settings supplied by the agent
configuration. The runner resolves bazel from PATH and replaces itself
with that process, so signals and the final exit status are not mediated by
another wrapper process. Uses of the persistent Bazel server follow the host
Codex network policy; the host-bot profile allows loopback so the
client-server connection is not blocked.
The runner does not create or inject a host temporary directory. Bazel actions
use declared outputs and Bazel-managed temporary storage, and tests use their
test temporary-directory contract. Repository-updating host tools that need
scratch must accept or derive an explicit task/run path under out/<task>/
instead of relying on ambient TMPDIR, TMP, or TEMP values propagated to
the whole build.
bazel_agent doctor --workspace-root PATH --task-scratch out/<task>/<run> is
a read-only, bounded JSON diagnostic. It reports runner and built-source
identity, Bazelisk pins, platform, rc/profile composition, task scratch
classification, and stale host-install state without dumping the environment.
Installation
Bootstrap the host installation with the underlying Bazel command:
bazel run --config=agent //projects/bazel_agent:install
Once installed, update it with:
bazel_agent bazel run //projects/bazel_agent:install
The install target atomically replaces ~/.local/bin/bazel_agent. After every
code update to this project, rerun the install target; the installed binary is
not updated automatically.
9 - Ci platform
Abandoned CI platform with a Go backend and Vue frontend
An abandoned continuous integration platform with a Go backend and a Vue
single-page frontend. The source retains its job, pipeline, and project
management components.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Personal configuration files with installation and comparison commands
This project packages personal configuration files into an installable
archive. Make and Bazel entry points compare the packaged files with the
local system and install selected configurations.
Archive with dotfiles that can be installed using make
Bazel usage
bazel run //projects/dotfiles:help # Show helpbazel run //projects/dotfiles:diff # Show diffbazel run //projects/dotfiles:install # Install files
Archive usage
oras pull --output "${PWD}" docker.io/alwaldend/src:projects_dotfiles_dotfiles_tar_head
cd releases/projects/dotfiles/head/files
tar -xf dotfiles.tar
cd dotfiles
make help # Show helpmake diff # Check diff between system files and those from the archivemake diff/nvim # Check diff for all nvim filesmake diff/nvim/.config/nvim/lazy-lock.json # Diff specific filemake install # Install all files from the archivemake install/nvim # Install nvim filesmake install/nvim/.config/nvim/lazy-lock.json # Install a specific file
Help
help: Show help
install: Install files from the archive
diff: Show diff between archive files and system files
install/bin: Install bin files
diff/bin: Diff bin files
install/home: Install home files
diff/home: Diff home files
install/nvim: Install nvim files
diff/nvim: Diff nvim files
make: Nothing to be done for 'help'.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
The root workspace declares the pinned firmware with use_repo_rule in
include.MODULE.bazel, preserving recursive Git submodules and the CMake
toolchain patch. Firmware source is fetched when referenced, rather than
during module resolution. Its Python/npm lockfiles and SDK archives retain
the upstream pins; Python and Node runtimes use the root workspace toolchains.
The project re-exports pip and npm with separate extension identities so
unrelated Python/npm targets do not fetch firmware to read those lockfiles.
The isolated pip extension declares the Linux x86_64 host platform used by
the pinned ARM compiler archive.
bazel mod deps deliberately evaluates all extensions and can still fetch it.
Validate the firmware with bazel test //projects/infinitime:build_test.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule,
retain recursive firmware submodules, and use the official contrib_rules_jvm
0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility
labels, visibility, manual tags, Python paths, Terraform working directories,
pnpm dependency pins, and documentation archive layout. Guard the load-free root
BUILD with a parser-based quality test. Generate root MODULE.bazel directly from
owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only
lint outputs in lint mode. Allow normal agent lockfile updates while retaining
strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs,
with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes,
and credential-file wiring through existing Vault environment injection. Add an
offline config test. Correct the Git wrapper shebang for direct execution and
refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator
freshness, DNS configuration, and a live DNS preview without applying changes.
The repository-wide audit also identifies pre-existing test and coverage gaps.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Record the retirement of this project’s landing DNS infrastructure while
preserving its repository documentation and builds.
Requirements
Requirement: Keep landing infrastructure retired
The project SHALL have no dedicated landing DNS declaration, Terraform root, or
operational source export. Its landing page SHALL be published by the main site
under /projects/kustomization/ instead of a dedicated hostname.
Scenario: Inspect the project after landing retirement
WHEN the project tree is consumed
THEN it contains no landing DNS declaration, Terraform DNS stage, or
landing build target, and the main site owns its landing page.
12.2 -
Kustomization Specification
Purpose
Provide in-progress Kubernetes resource definitions for Flux, Traefik, and
cert-manager. This baseline records declared resources at revision
550d7e79b1f5fdbc2b6017b75178471d6914082f, observed on 2026-09-08. It does not
assert successful rendering, reconciliation, or a deployed cluster state.
The Flux GitRepository declaration SHALL select the repository’s master
branch, refer to the flux-git-src credential secret, and include only infra
and projects/kustomization from the repository through its ignore rules.
Scenario: Inspect repository source scope
WHEN the checked-in Flux GitRepository is inspected
THEN its branch, secret reference, and inclusion paths SHALL match the
declared source scope.
Requirement: Traefik Gateway API configuration
The Traefik definitions SHALL declare an OCI chart source and HelmRelease that
enable the Kubernetes Gateway provider, disable the Kubernetes Ingress provider,
and configure HTTP redirection to HTTPS with a named TLS certificate secret.
Scenario: Inspect gateway configuration
WHEN the Traefik HelmRelease values are inspected
THEN they SHALL enable HTTP and HTTPS gateway listeners and reference
traefik-gateway-websecure-tls for HTTPS termination.
The cert-manager definitions SHALL declare an OCI chart source and HelmRelease
with Gateway API support, CRD installation, Helm tests, and drift detection
enabled.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Provision XCP-ng with isolated AppRole access and deploy Forgejo
Create one Xen Orchestra resource set and OIDC user per Vault AppRole.
Bind access by trusted issuer and immutable Vault entity ID. Forgejo uses
its own short-lived login and has access only to its resource set and VM.
Resolve pools, templates, storage, networks and existing VMs by name.
Manage pool and VM ACLs natively in Terraform; retain the XO API helper
only for unsupported OIDC configuration, identity discovery and bootstrap.
Deploy Forgejo at git.alwaldend.com through Ansible. Install the official
XO OIDC plugin and Vault ACME certificates on XO and XCP-ng with managed
renewal. Move PVE cloud-init into infra/cloud_init and derive Xen settings
from that foundation using a repository Go template. Move XCP-ng Terraform
to tf and retain one labeled AL configuration for administration.
Discover Forgejo accounts and team access from Vault groups, adopting
existing OIDC accounts without replacement. Reuse PVE’s group/entity lookup
policies and remove the bespoke user_entities policy.
Require checked-in IaC for infrastructure and approval for exceptions.
Include all configured formatter changes as requested.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Add the missing AL and Kustomization release targets and give release actions a declared bare Git snapshot instead of access to the workspace repository.\n\nThis commit was generated by an LLM.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Provision XCP-ng with isolated AppRole access and deploy Forgejo
Create one Xen Orchestra resource set and OIDC user per Vault AppRole.
Bind access by trusted issuer and immutable Vault entity ID. Forgejo uses
its own short-lived login and has access only to its resource set and VM.
Resolve pools, templates, storage, networks and existing VMs by name.
Manage pool and VM ACLs natively in Terraform; retain the XO API helper
only for unsupported OIDC configuration, identity discovery and bootstrap.
Deploy Forgejo at git.alwaldend.com through Ansible. Install the official
XO OIDC plugin and Vault ACME certificates on XO and XCP-ng with managed
renewal. Move PVE cloud-init into infra/cloud_init and derive Xen settings
from that foundation using a repository Go template. Move XCP-ng Terraform
to tf and retain one labeled AL configuration for administration.
Discover Forgejo accounts and team access from Vault groups, adopting
existing OIDC accounts without replacement. Reuse PVE’s group/entity lookup
policies and remove the bespoke user_entities policy.
Require checked-in IaC for infrastructure and approval for exceptions.
Include all configured formatter changes as requested.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Add the missing AL and Kustomization release targets and give release actions a declared bare Git snapshot instead of access to the workspace repository.\n\nThis commit was generated by an LLM.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
LeetCode submission export and documentation tools
This project exports LeetCode submissions and generates documentation from
submission files using a CLI and Bazel rules. A Tampermonkey script provides
a browser-based download path; direct CLI downloads are currently blocked by
LeetCode bot protection.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Make Harbor-backed OCI targets opt-in through –config=harbor while retaining default documentation and non-image tests. Regenerate the Python Gazelle manifest and Bazelrc preset.\n\nThis commit was generated by an LLM.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Make Harbor-backed OCI targets opt-in through –config=harbor while retaining default documentation and non-image tests. Regenerate the Python Gazelle manifest and Bazelrc preset.\n\nThis commit was generated by an LLM.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Workspace-local runtime packages behind a stable MCP server
mcp_cordis is a standalone stdio MCP server that mounts runtime JavaScript
packages through Cordis.
It is intentionally an MCP server, not a Codex plugin bundle.
Reusable definitions are ordinary ESM files in
projects/mcp_cordis/plugins, listed by projects/mcp_cordis/cordis.yaml.
Disposable definitions use the same layout under
out/<task>/mcp_cordis/runs/<run>/. Each run writes a bounded manifest with
explicit task, run, worker, information, budget, retention, lock, and cleanup
fields. AGENT_TASK_ID, AGENT_RUN_ID, and AGENT_WORKER_ID may provide
stable identities; the launcher otherwise creates process-scoped identities.
Every
package is addressed by both scope and name, so a scratch package never
silently shadows a reusable package.
Run
The repository’s .codex/config.toml registers mcp_cordis as a
project-scoped stdio server. Codex loads that file for a trusted workspace and
finds the active Git worktree before starting the server. Separate clones and
worktrees therefore use their own source, projects/mcp_cordis packages, and
task/run-namespaced scratch packages. Trusting the repository’s root checkout
also covers its linked worktrees; a glob trust entry is neither needed nor
supported. A new Codex session is needed after the MCP registration itself is
first added; package changes after that do not require another session.
The registration calls cmd/mcp_cordis/launch.sh. With a current installed
bazel_agent, the launcher selects a content-addressed runtime from the
per-user tool cache and executes it directly. The first exact source version
is built and atomically installed under a per-key lock; subsequent worktrees
with the same inputs do not start Bazel or load a configured graph. An older
runner falls back to asking Bazel for a launch script under the task’s ignored
out directory. Either path releases Bazel’s output-base lock before the
long-lived stdio server starts, so builds and tests can run normally while
Codex remains connected.
The cached artifact contains the stable server runtime and pinned JavaScript
dependencies, but not cordis.yaml or reusable plugins. It always reads those
from the explicit active workspace, so editing a package changes live behavior
without repackaging the runtime or selecting a new cache key.
The same project configuration starts an optional asynchronous SessionStart
hook that starts the worktree’s Bazel server and warms repo_delivery. It
produces no session context, ignores failure, and never queries the whole
workspace graph. Cordis itself is already warmed by its MCP launch path, so the
hook does not start a duplicate Cordis build.
To build and run the server directly from the repository root:
The workspace root is mandatory unless BUILD_WORKSPACE_DIRECTORY is
present. The checked-in launcher resolves the current Git worktree explicitly
and supplies that path to the server.
The fixed cordis_* tools define, start, inspect, invoke, update, stop,
remove, and promote packages without reconnecting the MCP client. Package
handlers are called through cordis_invoke; this remains reliable even when
an MCP client caches its initial tool list.
Cordis configuration and plugin format
cordis.yaml uses the standard Cordis Include entry-list format:
- id: helloname: ./plugins/hello.mjs
The referenced file is a normal ESM Cordis plugin:
Cordis normalizes an object plugin to its apply callback. Attaching the
optional package description to that callback exposes it through
cordis_list and cordis_inspect; tool descriptions remain part of each
ctx.tool() definition.
The server mounts the official Cordis Loader, Include, and HMR services.
cordis_define syntax-checks and atomically persists the ordinary module.
Creating or enabling an entry refreshes any cached module through Cordis HMR,
then uses the public Include refresh API and waits for activation. Updating an
already-running entry returns activation: "pending"; poll cordis_invoke or
cordis_list_tools until the new behavior is visible.
The reproducibly pinned HMR package carries a focused pnpm patch that
serializes module reloads and drains source changes arriving during an
in-flight reload, so the latest persisted source is not lost.
Syntax errors are rejected before the file changes. Evaluation and apply()
failures follow native Cordis HMR behavior; the wrapper does not add a second
activation transaction around them. It also does not inject source markers,
inspect Loader caches, correlate watcher events, or maintain its own source
rollback/version store. Reusable history is normal Git history. Manual edits
to watched plugin files are also picked up by Cordis HMR.
Runtime modules use normal Cordis semantics, including static imports,
top-level await, and asynchronous apply(ctx, config). Package code is
trusted: a never-settling module evaluation or activation can therefore stall
Cordis lifecycle work. The stdio launcher reserves its protocol stream and
redirects package stdout to stderr, keeping accidental console.log() calls
off the JSON-RPC wire.
The package context exposes ctx.workspaceRoot, ctx.resolveWorkspace(),
ctx.readText(), and structured ctx.exec() in addition to ctx.tool().
ctx.exec() returns code, signal, stdout, stderr, truncated, and
outputLimitExceeded; maxBytes is a combined stdout/stderr budget. By
default, exceeding that budget or producing invalid UTF-8 rejects with
EXEC_OUTPUT_LIMIT or EXEC_INVALID_UTF8. Packages that explicitly set
allowTruncatedOutput: true instead receive the valid retained prefix with
truncated set; outputLimitExceeded distinguishes the byte cap from UTF-8
loss. A Fiber-owned supervisor admits each launch atomically, and results
settle only after the direct child and every live member of its original Linux
process group have stopped. Limits, timeouts, and plugin disposal use the same
cleanup path. A process that deliberately creates a new session escapes that
group and is outside this trusted-package contract. ctx.exec() therefore
fails closed with EXEC_UNSUPPORTED_PLATFORM away from Linux. Package code
also has normal Node built-ins; this host is a reliability boundary, not a
security sandbox.
cordis_invoke.timeout_ms bounds how long the gateway waits for a result; it
does not cancel an already admitted JavaScript handler. The handler keeps its
Fiber lease until it finishes, so stop, remove, and shutdown wait for it.
Cordis HMR waits for a retired Fiber to finish draining before it activates
and publishes the replacement, so a live invocation can delay a reload. Any
ctx.exec() launched by a timed-out invocation is cancelled and its process
group is confirmed stopped before the timeout response settles.
Included packages
repo_context: bounded repository reads and searches.
git_worktree: read-only branch, status, log, and comparison snapshots.
network_probe: DNS, TCP/TLS, and HTTP diagnostics.
These were selected from aggregate recurring task categories in recent local
sessions. No transcript content, credentials, or private outputs are included.
Maintained change history
The completed runtime extensions change
preserves acceptance criteria, decisions, failed attempts and supporting
evidence. New work uses the project OpenSpec workspace
and a new change; the archived acceptance remains historical.
Dependency notices
The runtime directly uses @deepseek-ai/cordis, its official Loader, Include,
HMR, and Timer plugins, and the Model Context Protocol TypeScript SDK. Their
license texts are retained in the resolved package artifacts by the pinned
pnpm/Bazel dependency graph.
15 - Nexus security plugin
Security plugin for Sonatype Nexus 3
This plugin allows you to perform a check every time an artifact is requested from a repository
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Show one homepage panel with vertically stacked GitHub and Docs rows using
the name: URL format, hiding the protocol and trailing slash in the link text.
Center the panel and cap its width at 40rem while allowing it to shrink on mobile.
Move it slightly lower on desktop and brighten the footer link.
Restore the project assets mount so custom styles load.
Reduce the footer to its content height with compact padding. Size the homepage
against the visible viewport so mobile browser controls do not hide its footer.
Remove the separate Projects page and its header link, while keeping project
documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package
missing documentation and book covers, correct source links, and scope
anchors and release controls in combined print pages. Restore the archive-root
CNAME explicitly during deployment so replacing the site preserves the
custom domain.
Validate generated HTML for missing internal files and fragments, duplicate
IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram
regressions. Check the production build, repository quality, affected-target
semantic lint, desktop and mobile homepage rendering, and deployment output.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Repository-owned render assets and their acceptance evidence
This project owns reusable Blender assets, their controlling references, and
acceptance evidence bound to exact candidate bytes. Maintained work uses the
project OpenSpec workspace.
The Reimu Fumo work lives under assets/reimu_fumo/. Its
reusable asset target will be added only after a candidate passes the visual,
structural, animation, and exact-byte delivery gates in
Reimu Fumo change. That change
preserves the open outcome, blocked execution and original goal history.
Working candidates and intermediate renders belong under the repository-root
out/reimu_fumo_finish/ directory. They are not accepted or durable merely
because they exist there. A historical packet may move into the source tree
only when exact bytes and provenance are verified and it is labeled with its
actual rejected or accepted state.
17 - Sri
Command-line Subresource Integrity calculator using OpenSSL
sri calculates Subresource Integrity hashes for files using OpenSSL. Its
command-line interface accepts an input file and a digest algorithm, such as
SHA-256.
Usage: sri [OPTION...]
Generate sri of a file
Example:
bazel run //projects/sri -- --digest sha256 --file ${PWD}/README.md
-d, --digest=String Digest type (sha256, for example)
-f, --file=Path Path to the file to parse
-?, --help Give this help list
--usage Give a short usage message
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source
and configuration file types through Bazel, and add Buildifier, Ruff, and
ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin
cache/runfiles adapters where required, expose format and check targets, and
wire the checks into the pre-commit workflow. Format the existing tree and fix
the correctness defects uncovered by the new checks. Preserve generated
sources and exact-content fixtures that are not safely rewritable, and clarify
that ordinary
infrastructure build output is safe to display.
Validation:
all 21 repository quality and compatibility formatter tests pass
Buildifier test passes
lint aspects analyze all 4,629 ordinary root targets without findings
the complete 18-command root and nested full-repository audit was exercised;
remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Reusable Terraform modules for Vault, virtual machines, and storage
This project contains reusable Terraform modules for Vault configuration,
Proxmox virtual machines, backup storage, and related infrastructure. The
module collection is still in progress.
Provide one canonical DNS transformation for project-local Terraform resources
and offline inspection, preserving declared names, values, and view ownership.
Requirements
Requirement: Normalize canonical declarations without providers
The module SHALL accept decoded owner DNS documents and a zone, flatten every
supported type member, expand and deduplicate destinations, and expose one
normalized map without provider configuration. It SHALL reject unsupported
types, destinations, malformed members, and absolute names outside the zone.
Scenario: One logical declaration has several types and destinations
WHEN an entry contains A and AAAA with destinations all and global
THEN normalization produces exactly four records, one per type and view
Requirement: Preserve record multiplicity and stable identities
Normalized and provider resource keys SHALL use logical declaration key, type,
and view without mutable record values. Separate logical keys SHALL preserve
multiple records at the same name and type, including MX priority and TXT values.
Explicit TTLs SHALL override the type-specific compatibility defaults.
Scenario: A record changes address
WHEN an A member changes its address without changing its logical key
THEN its normalized and provider resource keys remain unchanged
Requirement: Keep provider ownership explicit
The module SHALL accept provider instances from its caller and create individual
Cloudflare global and RouterOS dc1 records only when explicitly enabled. It SHALL
default to disabled provider ownership while preserving normalized outputs.
Cloudflare records SHALL remain unproxied.
Disabled ownership SHALL NOT imply that operational provider initialization
or credential prerequisites are suppressed.
Scenario: A root prepares a future migration
WHEN a root calls the module without enabling ownership
THEN it declares no provider record resources and still exposes every normalized declaration
18.2 -
project-dns Specification
Purpose
Record the retirement of this project’s landing DNS infrastructure while
preserving its repository documentation and builds.
Requirements
Requirement: Keep landing infrastructure retired
The project SHALL have no dedicated landing DNS declaration, Terraform root, or
operational source export. Its landing page SHALL be published by the main site
under /projects/tf_modules/ instead of a dedicated hostname.
Scenario: Inspect the project after landing retirement
WHEN the project tree is consumed
THEN it contains no landing DNS declaration, Terraform DNS stage, or
landing build target, and the main site owns its landing page.
18.3 -
Reusable Terraform modules
Purpose
Provide reusable infrastructure declarations for Vault, virtual machines,
storage, and related services. This baseline was observed at repository
revision 550d7e79 on 2026-09-08. The collection remains in progress according
to its README. Sources for the
representative module contracts below are the
AppRole module,
transit-key module,
backup-bucket module, and
module packaging.
These are declarative source contracts; no live provisioning is asserted.
Requirements
Requirement: Package reusable module source
The AppRole, transit-key, backup-bucket, and Proxmox VM module packages SHALL
each expose their main.tf through a same-named Bazel filegroup available to
repository subpackages.
Scenario: A repository target consumes a module
WHEN a target depends on //projects/tf_modules/vault_approle:vault_approle
THEN its declared source input includes the AppRole module’s main.tf
Requirement: Associate AppRoles with Vault identities and policies
The AppRole module SHALL declare an identity entity, backend alias, internal
group, and named AppRole with configurable token and secret-ID limits. Its
role policies SHALL combine the shared and AppRole-secret policies with caller
policies and the Yandex-folder policy unless that policy is disabled for the role.
Scenario: Caller disables the Yandex-folder role policy
WHENdisable_yc_folder_policy is true
THEN the role’s policy list excludes the module’s Yandex-folder policy while preserving shared, AppRole-secret, and caller policies
Requirement: Separate transit encryption and decryption membership
The transit-key module SHALL declare a named Vault transit key, an encryption
policy and group, and a decryption policy and group. Decryptor member groups
SHALL also be included in the encryption group.
Scenario: A group is listed as a decryptor
WHEN a caller adds a group ID to decryptors_member_group_ids
THEN the module includes that group in both transit permission groups
The backup-bucket module SHALL declare a versioned Yandex storage bucket with
default KMS encryption, grant read and write permissions to the supplied
service accounts, and store bucket identifiers in the caller-selected Vault
KV v2 location.
Scenario: Backup storage is configured
WHEN the caller supplies the bucket name components, folder, service accounts, and Vault destination
THEN the declarations bind bucket encryption to the module’s KMS key and publish the bucket ID, folder ID, and bucket name to that Vault destination
18.4 - Backup bucket
S3 bucket for backups
18.5 - DNS records
Canonical DNS declarations for Cloudflare and RouterOS
This reusable module translates an owner’s decoded dnsconfig.json through
its provider-free normalizer, then manages individual
global Cloudflare and dc1 RouterOS records with caller-provided providers.
Owners with only global records use the global entrypoint,
which needs only Cloudflare. The combined entrypoint delegates Cloudflare
resources to that same module and consumes its normalization for RouterOS.
Repository infrastructure roots may consume its Bazel source filegroups;
the child normalizer also supports provider-free inspection.
zone defaults to alwaldend.com. An explicit cloudflare_zone_id is optional;
when it is null or empty, enabled global records resolve exactly one Cloudflare
zone matching zone. The token must permit zone listing and reading. Disabled
ownership and declarations without global records skip this lookup.
enabled defaults to false so a prepared root owns
no provider records. Keep it true after adoption: setting it false in a state
that already owns records plans deletion and is not a rollback procedure.
Disabling ownership does not suppress provider initialization. Operational
Terraform commands still require the caller’s real provider configuration
and the owning Vault/AppRole prerequisites. In particular, the pinned
RouterOS provider probes its configured API even when no DNS records are
enabled. Use the provider-free normalizer for offline inspection.
The migration runbook
owns cutover, import, and rollback ordering. This module supplies no provider
credentials or state backend.
The input contains exactly one records object. Each stable logical key
contains one or more scalar type members and a nonempty dsp list. Supported
destinations are global, dc1, and all; repeated destinations are deduplicated.
Type
Required member fields
Default TTL
A
name, address
300
AAAA
name, address
600
CNAME
name, target
600
NS
name, address
300
MX
name, target, priority
300
TXT
name, content
300
Every member accepts an integer ttl from 60 through 86400 seconds. MX
priorities range from 0 through 65535. Multiple scalar values at the same
name and type use distinct logical keys; changing values never changes
resource identity. Unsupported fields and malformed members are rejected.
Names accept @, relative names, or zone-qualified names. Absolute owner
names ending with a dot must be inside the zone. CNAME, MX, and NS targets
accept @, relative names, zone-qualified names, or absolute external names
ending with a dot. Normalization lowercases domain names and omits final dots;
address and TXT bytes are preserved. relative_name is @ at the apex.
normalized_records maps logical_key/type/view to key, name,
relative_name, type, value, priority (null except MX), ttl, view,
and proxied (always false). This output remains available while disabled.
The same keys index module.global.cloudflare_dns_record.records and
module.dc1[0].routeros_ip_dns_record.records in the combined entrypoint; the global-only
entrypoint uses cloudflare_dns_record.records. import_addresses exposes
these addresses relative to the selected module, including while staged.
The pinned providers import Cloudflare
records by zone_id/record_id and RouterOS records by static IDs such as *1A.
Terraform tests use mocked providers and pinned local provider packages.
The global-only test root has no RouterOS provider dependency. Normalization
tests require no providers. Both run without network access;
they establish declaration and resource mapping behavior, not live adoption.
18.5.1 - DNS normalization
Provider-free canonical DNS declaration transformation
This child module owns the canonical transformation described by the
DNS module. Its document and zone inputs produce
normalized_records without a provider, backend, or managed resources.
Terraform writers and provider-free inspection consume this output.
18.5.2 - DNS test providers
Pinned provider packages for offline Terraform tests
The test target uses the public
rules_terraform wrapper with
the same Cloudflare, RouterOS, and Proxmox provider labels as infrastructure
targets. The shared extension owns provider versions, release URLs, and
checksums. Bazel fetches the declared archives before tests execute; Terraform
uses the wrapper’s packaged filesystem mirror without a registry fallback.
Each regression runs Terraform in a caller-owned temporary module directory.
Tests retain an explicit environment without inherited provider credentials;
provider installation and mocked lifecycles require no network access.
The targeted import regression matches the owning Proxmox provider block by
omitting pm_api_url. It checks both empty state and existing Proxmox resource
state with no credentials. Without PM_API_URL, provider validation fails
before target pruning; supplying only a loopback endpoint permits the DNS
operation. The endpoint must receive zero requests.
The test imports a built-in Terraform resource through a root map into
module.dns, checks the exact no-op import, applies that saved plan, and verifies
the next targeted plan has no changes. Existing Proxmox resource attributes
remain unchanged. An untargeted control must fail authentication before
contacting the endpoint. These checks cover provider selection and state
preservation; live DNS adoption retains its separate inventory and plan checks.
18.5.3 - Global DNS records
Cloudflare-only entrypoint for canonical DNS declarations
Global-only owners use this entrypoint with the shared module API
to avoid requiring RouterOS configuration. The combined module also delegates
its Cloudflare resources here, so both entrypoints share one implementation.
Normalization returns all declared views, but this entrypoint owns only global
records. Mixed-view owners use the parent module to manage dc1 as well.
Enabled global records use the explicit cloudflare_zone_id when supplied.
Otherwise, the pinned cloudflare_zone data source resolves the configured
zone name and rejects missing or ambiguous matches. This requires zone-list
and zone-read access in addition to record permissions. Disabled ownership and
declarations without global records perform no zone lookup.
The optional zone ID must be known during planning so Terraform can select
whether discovery is needed. The repository’s AL injection supplies a known
value or an empty string before Terraform starts. Zone-name discovery uses the
normalizer’s canonical name, including case and final-dot handling.
import_addresses contains global addresses relative to this entrypoint.
record_ids exposes bound Cloudflare IDs for adoption and identity checks.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Roll back partial plugin startup, drain requests before releasing resources,
and wait for plugin and command processes to exit. Stop independent plugins
concurrently while preserving dependency order inside each plugin.
Revoke invocation-owned credentials, remove temporary secret files, and verify
Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login.
Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict
config dumps to owner-only files. Add the AppRole SecretID cleanup permission.
Cover normal exit, cancellation, failed startup, credential revocation, and
transport cleanup with synthetic unit and real command/plugin regression tests.
Clarify that required formatting-only repairs need no separate approval, and
fix the existing blank-line formatting failure in the GitHub AL wrapper.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Publish every registered project’s visitor-facing landing page at
/projects// from the main site instead of a dedicated subdomain, and
retire the per-project Pages repository, CNAME, and Terraform DNS stage that
existed only to serve one page derived from the project README.
Each project owns its landing content in projects//site/content/ as pure
content: no layouts, styles, or build rules. The main site packages those
directories into content/projects// from the registry in
projects/projects.bzl, so membership is declared once. The landing is a short
hand-written page for visitors while the README keeps its /docs/projects//
URL for repository reference documentation, and landing front matter now feeds
the statuses, languages, and tags taxonomies.
Merge the reusable hugo_landing project into the main site: its shared canvas
and accent styles and its landing page rules move into the apex tree, and its
landing macro, generated configuration, standalone publisher, and
repository-relative rewrite layouts are removed. The theme keeps owning the
taxonomy and term layouts, which are richer than the heading-only versions the
reusable project carried. Remove the now-unused apex deploy_project.sh and
deploy_all.sh landing publishers with it.
Retire the per-project publication and DNS ownership: the project landing
targets and the landing deployment command, each landing project’s
dnsconfig.json and Terraform root, the build plumbing that served only those
stages, and the landing repository and Pages membership in the repository
catalog. The apex Terraform root is retained because it also declares VM
resources, and no Vault configuration is changed.
Replace the provider-snapshot zone files with generated declaration pages, one
per destination view, that project the checked-in declarations and are verified
for freshness by the DNS offline check. The DNS linter, both destination pages,
the apex site, the skills projection, and the repository quality suite pass, and
the whole repository builds.
Manage forge resources with hermetic Terraform rules
Centralize organization, repository, and named access configuration in
infra/repos. Adopt existing GitHub resources, protect master defaults while
retaining Pages publication on pages, and preserve existing repository
identities. Manage GitLab one-time imports, the F-Droid metadata fork, and
default-branch protections through Vault-backed authentication. Forgejo
consumes the same catalog. Ongoing repository synchronization is deferred.
Retire the eleven Bazel rule landing sites through their owning Terraform
workflows, removing their DNS records, Pages repositories, and landing
configuration. Move all twelve existing standalone rule modules into tools/
and retain their public interfaces and documentation on the main site.
Add tools/rules_terraform with verified provider downloads, packed mirrors
in runfiles, and reusable Terraform execution rules. Enforce one version per
provider source at an extensible resolution boundary. Migrate every Terraform
consumer to thirteen shared provider pins in third_party/terraform. Execution
and command maps belong to rules_terraform; consumers explicitly select generic
AL wrappers for authentication and Vault injection. Remove tools/terraform
and all 43 checked-in Terraform provider locks.
Validate installed providers against the declared archives before execution.
Validation covers all fourteen workspace builds, all thirteen standalone
test suites, Terraform consumers, offline real-provider regressions, rendered
documentation, formatting, and semantic lint. The full root test run has
295 passing tests and one skip; its only failure is the historical secret
scan, reduced to four pre-existing synthetic fixture matches. Earlier live
imports and the exact landing retirement scope have verified postconditions;
the Terraform rules migration uses only offline implementation checks.
Move DNS ownership into each project’s Terraform state using shared modules.
Load dnsconfig.json files at runtime, reject conflicting domain ownership,
and render their records as a table. Add missing project AppRoles and scoped
DNS policies, and document grouping related Terraform resources in modules.
Deploy all 45 owners sequentially: adopt 155 existing records and create 13
missing OpenHands records. Preserve every pre-existing provider record and
verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply
wrappers with a saved-plan guard for roots that also manage services.
Allow bounded aggregate path inventories large enough to deliver this migration
while retaining truncation refusal in the delivery tool.
Validate runtime ownership, provider imports and preservation with isolated
fixtures, Terraform formatting, wrapper builds, repository quality checks,
semantic lint, and project documentation/specification builds.
Collapse OpenSpec source globs to specs and changes, drop redundant
package visibility blocks already covered by REPO.bazel, and regenerate
the affected catalogs.
LLM-disclaimer: This commit was generated by an LLM.
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy
header, project descriptions and a linked documentation directory. Omit the
repeated page title and generated language heading. Remove
the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct
GitHub Pages DNS records. Preserve repeated publication when pages is the
remote default branch, and include Rules ISO in the main documentation.
Document site onboarding in a registered, validated skill. Keep AL
introduction short with useful links and preserve its lifecycle details in
a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and
Chrome inputs, sandboxed export actions, an update target and freshness
checks, and include the maintained diagrams in infra/arch documentation.
Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests,
diagram repeatability and freshness, DNS configuration, Terraform formatting,
semantic lint and repository quality.
Roll back partial plugin startup, drain requests before releasing resources,
and wait for plugin and command processes to exit. Stop independent plugins
concurrently while preserving dependency order inside each plugin.
Revoke invocation-owned credentials, remove temporary secret files, and verify
Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login.
Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict
config dumps to owner-only files. Add the AppRole SecretID cleanup permission.
Cover normal exit, cancellation, failed startup, credential revocation, and
transport cleanup with synthetic unit and real command/plugin regression tests.
Clarify that required formatting-only repairs need no separate approval, and
fix the existing blank-line formatting failure in the GitHub AL wrapper.
Extract the DNSControl setup into rules_dnscontrol, generate its Bazel
dependency bundle from project-owned record files, and update the DNS
guidance. Move Hugo rules and the worker to role-based package paths, and
give each non-nested project a locally owned Hugo landing target that reuses
the shared README-to-landing macro.
Clean all landing and Pages DNS records so GitHub Pages serves each project
subdomain directly without Cloudflare proxying. Improve the main site with
a three-panel home layout, complete project links, documentation explore
links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with
the nested rules_hugo tests, Buildifier, and repository quality checks.
LLM-disclaimer: This commit was generated by an LLM.
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
Restore light and dark site canvases and set the shared accent
The shared Docsy canvas set the same Bootstrap dark palette and the same
black page background on :root, [data-bs-theme="light"], and
[data-bs-theme="dark"], so the light/dark toggle changed nothing. The site
also rendered Bootstrap’s stock blue instead of its intended accent.
Split the shared palette so light mode uses a pure white canvas with the
light-mode palette and dark mode uses a pure black canvas with the dark-mode
palette, and keep the pre-stylesheet paint and footer on the active mode.
Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons,
badges, focus rings, and the dark-mode link tint all derive from one value
rather than from a site-local copy.
Both files stay in the reusable shell; the apex site consumes them through
the existing declared exports and no longer carries the footer’s own blue.
Useless QT GUI is a desktop application built with C++ and Qt. Its Bazel build
uses a pinned Qt distribution without requiring a system Qt installation.
The Bazel build downloads a SHA-256-pinned Qt 6.8.3 distribution through
rules_qt; a system Qt installation is not required. The project previously
targeted Qt 6.9.0. Using 6.8.3 is a deliberate downgrade to the LTS version
supported and tested by the pinned rules_qt release.
