feat: add Shiora, ZeroID, NoblePay dApps and protocol-wide updates

[ramtamilselvan]

Summary

Major release adding three new dApps to the Aethelred ecosystem alongside comprehensive protocol, SDK, and infrastructure updates.

New dApps

• NoblePay — Enterprise cross-border payment platform with TEE compliance, Prisma ORM, Go gateway service, and Rust compliance module
• Shiora — Women's health AI platform on Aethelred with ZK-enabled privacy features, clinical pathway contracts, and digital twin support
• ZeroID — Self-sovereign identity system with ZK proofs (age/residency/credit circuits via Circom), TEE verification, Foundry contracts, and Rust SDK

Cruzible Updates

• Stablecoin infrastructure pages
• SEO sitemap generation (next-sitemap)
• Security hardening (CONTRIBUTING.md, SECURITY.md)
• MetaMask SDK build warning suppression
• Lint gate alignment (zero warnings)

Protocol & Contracts

• InstitutionalStablecoinBridge.sol — enterprise stablecoin bridge contract
• MockTimelockController.sol — testing support
• Updated TypeChain bindings for all new contracts
• Foundry + Hardhat dual build pipeline for ZeroID

SDKs

• Updated Go, Python, Rust, and TypeScript SDKs with latest versions and docs
• Repo split playbook and standalone sync improvements

Infrastructure & CI/CD

• New dapps-ci.yml workflow for dApp validation
• Branch protection config and Dependabot improvements
• CODEOWNERS, CODE_OF_CONDUCT.md, SUPPORT.md
• GitHub org profile defaults, banner assets, and labels

Documentation & Governance

• Tokenomics v2.0 and Whitepaper v2.0 (PDF)
• AIP-0002, AIP-0003 updates
• Audit reports, dependency remediation tracking
• GitHub operating standards and repo authority updates
• Enterprise corridors, TEE, ZK proofs, and use-case pages for aethelred.io/org

Websites

• 30+ updated/new pages for aethelred.io
• Corporate pages for aethelred.org
• Pitch deck materials

Test plan

• Verify contracts-ci passes (Foundry + Hardhat compilation and tests)
• Verify dapps-ci passes for all four dApps
• Verify SDK tests pass (Go, Python, Rust, TypeScript)
• Verify repo-authority-guard and repo-security-baseline checks pass
• Verify no AI-attribution references exist in any pushed files
• Verify submodules (forge-std, openzeppelin-contracts) resolve correctly
• Verify website HTML pages render correctly

In general, fix this by explicitly declaring permissions: for the workflow (or each job) so that the GITHUB_TOKEN has only the scopes actually required. For this CI workflow, all jobs just check out code and run Node commands; they do not create releases, modify issues, or push code, so contents: read is sufficient.

The simplest, non‑behavior‑changing fix is to add a single root‑level permissions: block that applies to all jobs. This should be placed near the top of .github/workflows/dapps-ci.yml, after the name: and on: definitions, and before jobs:. Set it to:

permissions:
  contents: read

No additional methods, imports, or definitions are needed, and no job steps need to change. This explicitly documents and enforces read‑only repository access for all jobs using GITHUB_TOKEN.

In general, the fix is to add an explicit permissions block that grants only the minimal scopes required by the jobs, preferably at the workflow root so it applies to all jobs. For typical CI that just checks out code and runs tests/builds, contents: read is sufficient; no write permissions are needed.

The best fix here is to add a top-level permissions block after the on: section, setting contents: read. This will apply to all jobs (zeroid-backend, zeroid-frontend, cruzible, noblepay, and dapps-required-gate) because none of them currently define their own permissions. This change does not alter existing functionality since the jobs only read the repository. Concretely, in .github/workflows/dapps-ci.yml, insert:

permissions:
  contents: read

between the on: block (ending at line 15) and the jobs: key (line 16). No additional methods, imports, or definitions are needed.

In general, the fix is to add an explicit permissions: block that grants only the minimal required scopes to the GITHUB_TOKEN. Since all jobs in this workflow only need to read the repository contents (checkout, install, lint, test, build) and do not push, create releases, or modify issues/PRs, the least-privilege practical setting is contents: read.

The best way to fix this without changing functionality is to add a single permissions: block at the root of the workflow (top level, alongside name: and on:). This block will apply to all jobs (zeroid-backend, zeroid-frontend, cruzible, noblepay, and any others in the omitted section) that don’t declare their own permissions. We don’t need any imports or extra methods; this is a pure YAML configuration change.

Concretely:

• Edit .github/workflows/dapps-ci.yml.

• After the name: dApps CI line (line 1) and before the on: block (line 3), insert:

  permissions:
    contents: read

This explicitly restricts the GITHUB_TOKEN to read-only access to repository contents for all jobs, satisfying CodeQL’s recommendation and GitHub’s least-privilege guidance.

In general, fix this by adding an explicit permissions: block that requests only the minimal scopes required. Since this workflow just checks out code and runs Node commands, it only needs read access to repository contents (and possibly packages, which are covered by contents: read for the code itself). The cleanest way, without changing existing behavior, is to define a top-level permissions: block on the workflow so all jobs inherit restricted permissions by default.

Specifically, edit .github/workflows/dapps-ci.yml near the top of the file, after the name: dApps CI line and before the on: block, and add:

permissions:
  contents: read

This sets the default GITHUB_TOKEN permissions for all jobs (including noblepay) to read-only repository contents, which is sufficient for actions/checkout and any standard read-only operations. No additional imports, methods, or definitions are needed, and no per-job permissions are required given the current steps.

In general, the fix is to add an explicit permissions: block to the workflow (at the root level or per-job) that grants only the minimal required permissions. For this CI workflow, all jobs only check out code, install dependencies, run audits/lint/tests/builds, and perform a logical gate; they do not need to write to the repo or to pull requests. The standard minimal setting for such workflows is permissions: contents: read, which is equivalent to the read-only default.

The single best fix with no functional change is to add a root-level permissions: block (applies to all jobs) right after the name: dApps CI line. This will ensure every job’s GITHUB_TOKEN is limited to read-only repository contents (sufficient for actions/checkout@v4 if needed) while not enabling any write scopes. No other lines or behavior need to change, and no imports or extra methods are required since this is a YAML configuration change only.

Concretely: edit .github/workflows/dapps-ci.yml to insert:

permissions:
  contents: read

between line 1 (name: dApps CI) and line 3 (on:). This documents the intended permissions and prevents the workflow from accidentally gaining broader permissions if repository/organization defaults change in the future.

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[ramtamilselvan]

Closing as superseded by the current protocol-first and ecosystem de-duplication strategy plus later merged protocol and docs work. This branch no longer reflects the intended repository structure.