Skip to content

Commit f771172

Browse files
CoderDeltaLANCoderDeltaLAN
authored
audit: add external audit package manifest
Co-authored-by: CoderDeltaLAN <CoderDeltaLAN@users.noreply.github.com>
1 parent 378bf5a commit f771172

1 file changed

Lines changed: 163 additions & 0 deletions

File tree

‎docs/EXTERNAL-AUDIT-PACKAGE-CURRENT-MAIN.md‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
# External audit package for current main
2+
3+
Status: required external audit package manifest before v0.4.0.
4+
Published package line: v0.3.0.
5+
Next intended public release line: v0.4.0, only after external audit, release preparation, GitHub Release publication, PyPI publication, and post-release verification.
6+
Release authorization: none. This document must not be treated as permission to publish a GitHub Release or PyPI package.
7+
8+
## Purpose
9+
10+
This document closes the evidence gap described by RB-03: the final external audit package must include core files, workflow files, current documentation, relevant tests, exact SHA evidence, CI evidence, and the current action-plan state.
11+
12+
A previous audit marked an evidence package incomplete because it did not include enough source, test, workflow, and documentation material for a serious review. This document defines the minimum complete package. An external audit based only on summaries, screenshots, selected snippets, or a high-level repo description is not acceptable.
13+
14+
## Audit target rule
15+
16+
The external audit target must be current main after this manifest is merged.
17+
18+
The final package must capture, outside this document if necessary:
19+
20+
- exact main SHA under audit;
21+
- origin/main SHA;
22+
- PR number that introduced this manifest;
23+
- GitHub Actions CI run for that exact SHA;
24+
- GitHub Actions CodeQL run for that exact SHA;
25+
- local check output for that exact SHA;
26+
- post-release audit output for that exact SHA;
27+
- confirmation that no release, tag, PyPI publication, dependency update, workflow permission change, or branch-protection change was made by this manifest phase.
28+
29+
The exact SHA in this document's creation branch is not enough after merge. The final audit packet must refresh the SHA and CI evidence from main.
30+
31+
## Baseline evidence at manifest creation
32+
33+
This manifest was created from:
34+
35+
- branch: audit/provide-complete-core-files;
36+
- base main SHA before this manifest commit: 378bf5a41dd355e3e219a0a3b54408c039bdeca8;
37+
- CI push run for that base SHA: 27885987180, success;
38+
- CodeQL push run for that base SHA: 27885987214, success;
39+
- required file existence check: 45 required files, 0 missing;
40+
- command surface observed from source tree: check, init, doctor, budget, dedupe, conflicts, explain.
41+
42+
This baseline is evidence of the state before adding this manifest. The final external audit must still use the post-merge main SHA for the actual audit target.
43+
44+
## Package completeness rule
45+
46+
The audit package must include the full contents of every file listed below.
47+
48+
A file-name list alone is not enough. A summary is not enough. A partial excerpt is not enough. The auditor must be able to inspect the actual source, tests, workflows, release boundaries, security boundaries, and documentation truth from the files.
49+
50+
Ignored or generated runtime artifacts must not be included as evidence, including .git, .venv, .ruff_cache, __pycache__, build outputs, dist outputs, coverage outputs, local editor state, or temporary files.
51+
52+
## Core package source files
53+
54+
Include full contents of:
55+
56+
- src/agent_rules_kit/__init__.py
57+
- src/agent_rules_kit/cli.py
58+
- src/agent_rules_kit/findings.py
59+
- src/agent_rules_kit/init_plan.py
60+
- src/agent_rules_kit/init_write.py
61+
- src/agent_rules_kit/discovery.py
62+
- src/agent_rules_kit/governance.py
63+
- src/agent_rules_kit/redaction.py
64+
- src/agent_rules_kit/budget.py
65+
- src/agent_rules_kit/explain.py
66+
- src/agent_rules_kit/dedupe.py
67+
- src/agent_rules_kit/conflicts.py
68+
69+
## Core test files
70+
71+
Include full contents of:
72+
73+
- tests/test_cli.py
74+
- tests/test_golden_outputs.py
75+
- tests/test_governance.py
76+
- tests/test_findings.py
77+
- tests/test_discovery.py
78+
- tests/test_diagnostic_fixtures.py
79+
- tests/test_init_plan.py
80+
- tests/test_init_write.py
81+
- tests/test_path_boundaries.py
82+
- tests/test_redaction.py
83+
- tests/test_dedupe.py
84+
- tests/test_conflicts.py
85+
86+
## Project metadata and public-truth files
87+
88+
Include full contents of:
89+
90+
- README.md
91+
- CHANGELOG.md
92+
- pyproject.toml
93+
- AGENTS.md
94+
- SECURITY.md
95+
- SUPPORT.md
96+
- CONTRIBUTING.md
97+
- LICENSE
98+
99+
## GitHub, CI, release, and supply-chain files
100+
101+
Include full contents of:
102+
103+
- .github/workflows/ci.yml
104+
- .github/workflows/codeql.yml
105+
- .github/workflows/publish-pypi.yml
106+
- .github/dependabot.yml
107+
- scripts/check.sh
108+
- scripts/post-release-audit.sh
109+
110+
## Security, output-contract, and audit documentation
111+
112+
Include full contents of:
113+
114+
- docs/THREAT-MODEL.md
115+
- docs/RULES.md
116+
- docs/OUTPUTS.md
117+
- docs/EXIT-CODES.md
118+
- docs/SECURITY-SUPPLY-CHAIN-EVALUATION.md
119+
- docs/PRIVATE-VULNERABILITY-REPORTING.md
120+
- docs/OPENSSF-SCORECARD-EVALUATION.md
121+
- docs/POST-AUDIT-ACTION-PLAN-CURRENT-MAIN.md
122+
- docs/PRE-V0.4.0-INTERNAL-READINESS-AUDIT.md
123+
- docs/POST-V0.3.0-FUNCTIONAL-CONTRACT-EVIDENCE.md
124+
- docs/POST-V0.3.0-INTERNAL-READINESS-AUDIT.md
125+
- docs/V0.3.0-POST-RELEASE-AUDIT.md
126+
- docs/V0.3.0-RELEASE-NOTES.md
127+
- docs/V0.3-ARCHITECTURE-ROADMAP.md
128+
- docs/PRODUCT-STRATEGY.md
129+
130+
## Minimum command evidence to include with the package
131+
132+
The final external audit package must include terminal output for:
133+
134+
- git status --short --branch
135+
- git rev-parse HEAD
136+
- git rev-parse origin/main
137+
- git log --oneline --decorate -8
138+
- gh pr view for the PR that merged this manifest
139+
- gh run list for CI and CodeQL on the exact main SHA
140+
- ./scripts/check.sh
141+
- ./scripts/post-release-audit.sh
142+
- python -m agent_rules_kit.cli --help
143+
- python -m agent_rules_kit.cli --version
144+
145+
The package should also include a short statement that the audit target is source-tree behavior on current main before v0.4.0, not the already published v0.3.0 PyPI package.
146+
147+
## Boundaries for the auditor
148+
149+
The auditor should treat the project as:
150+
151+
- a local-first Python CLI;
152+
- read-only by default;
153+
- no network calls during repository analysis;
154+
- no LLM calls during runtime;
155+
- no execution of commands found in analyzed repositories;
156+
- no stable support promise yet;
157+
- no claim that dedupe or conflicts are already published on PyPI before v0.4.0 is actually released and verified.
158+
159+
The auditor should reject or flag any package that omits core files, hides workflows, omits tests, omits release workflow details, omits the current action plan, omits exact SHA evidence, or presents v0.4.0 as already published before release verification exists.
160+
161+
## Release gate
162+
163+
Do not start release/prepare-v040 until this external audit package is assembled from current main, externally reviewed, and any resulting findings are either fixed through separate Always-Green phases or explicitly deferred with written rationale.

0 commit comments

Comments
 (0)