diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 817203e4..9ec7b313 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -15,5 +15,9 @@ permissions: jobs: scan: + permissions: + contents: read + pull-requests: write + actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3f34549c03274ec7a74683068f03a492b0fa805f secrets: inherit diff --git a/_shared/assets/style.css b/_shared/assets/style.css new file mode 100644 index 00000000..3b4be31d --- /dev/null +++ b/_shared/assets/style.css @@ -0,0 +1,121 @@ +/* SPDX-License-Identifier: MPL-2.0 */ +/* Copyright (c) 2025-2026 Jonathan D.A. Jewell */ +/* + * a2ml.net / k9-svc.net site theme — built on the ddraig-ssg AAA base. + * WCAG 2.2 AAA: all text/UI colours contrast-verified >= 7:1 (light + dark), + * focus ring >= 3:1, reduced-motion, reflow, >= 44px targets. + */ + +:root { + --bg: #ffffff; + --bg-soft: #f4f5f9; + --bg-code: #eceef5; + --fg: #1a1b26; /* 17.09:1 on --bg */ + --fg-muted: #3a3d4d; /* 10.74:1 on --bg */ + --link: #3730a3; /* 9.93:1 on --bg */ + --link-hover: #1f1b6b; + --border: #5a5e73; + --focus: #3730a3; + --btn-fg: #ffffff; /* on --link (#3730a3) = 9.93:1 */ + --radius: 8px; + --maxw: 70rem; + --measure: 40rem; +} +@media (prefers-color-scheme: dark) { + :root { + --bg: #0e0f1a; + --bg-soft: #181a2a; + --bg-code: #1c1f33; + --fg: #e6e8f2; /* 15.60:1 */ + --fg-muted: #c2c6d8; /* lightened for >=7:1 on --bg-soft */ + --link: #b9c2ff; /* 11.09:1 */ + --link-hover: #dde2ff; + --border: #8c91ad; + --focus: #b9c2ff; + --btn-fg: #0e0f1a; /* dark text on light --link in dark mode */ + } +} + +*, *::before, *::after { box-sizing: border-box; } +html { font-size: 100%; -webkit-text-size-adjust: 100%; } +body { + margin: 0; + font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; + font-size: 1.0625rem; line-height: 1.6; + color: var(--fg); background: var(--bg); + overflow-wrap: break-word; +} +.container { width: 100%; max-width: var(--maxw); margin-inline: auto; padding-inline: 1.25rem; } + +/* Skip link (2.4.1) */ +.skip-link { position: absolute; left: -9999px; top: 0; background: var(--link); color: #fff; padding: .75rem 1.25rem; border-radius: 0 0 var(--radius) 0; font-weight: 600; z-index: 100; min-height: 44px; line-height: 1.4; } +.skip-link:focus { left: 0; } + +/* Focus (2.4.7/2.4.11/2.4.13) */ +:focus-visible { outline: 3px solid var(--focus); outline-offset: 2px; border-radius: 2px; } +a:focus, button:focus, [tabindex]:focus { outline: 3px solid var(--focus); outline-offset: 2px; } + +/* Header / nav */ +.site-header { border-bottom: 1px solid var(--border); } +.nav { display: flex; flex-wrap: wrap; align-items: center; gap: 1rem; padding-block: .75rem; } +.brand { font-weight: 700; font-size: 1.2rem; color: var(--fg); text-decoration: none; } +.nav-links { list-style: none; display: flex; flex-wrap: wrap; gap: .5rem 1.25rem; margin: 0; padding: 0; } +.nav-links a, .brand { display: inline-flex; align-items: center; min-height: 44px; } + +/* Links: underlined (1.4.1) */ +a { color: var(--link); text-decoration: underline; text-underline-offset: 2px; } +a:hover { color: var(--link-hover); } +.brand, .nav-links a, .btn { text-decoration: none; } +.nav-links a:hover, .nav-links a:focus { text-decoration: underline; } + +main { display: block; } +.prose { padding-block: 2rem; } +.prose h1 { font-size: 2.25rem; line-height: 1.2; margin: 0 0 1rem; } +.prose h2 { font-size: 1.6rem; line-height: 1.3; margin: 2.25rem 0 .75rem; } +.prose h3 { font-size: 1.25rem; margin: 1.5rem 0 .5rem; } +.prose :is(h1,h2,h3,h4), .prose p, .prose li { max-width: var(--measure); } + +/* Lede */ +.lede { font-size: 1.3rem; line-height: 1.5; color: var(--fg); max-width: var(--measure); margin: 0 0 1.5rem; } + +/* Badges */ +.badges { display: flex; flex-wrap: wrap; gap: .5rem; margin: 1rem 0; padding: 0; list-style: none; } +.badge { display: inline-flex; align-items: center; min-height: 1.9rem; padding: .25rem .7rem; border: 1px solid var(--border); border-radius: 999px; font-size: .85rem; color: var(--fg); background: var(--bg-soft); } + +/* Buttons (>=44px target, 2.5.5) */ +.btn-row { display: flex; flex-wrap: wrap; gap: .75rem; margin: 1.5rem 0; } +.btn { display: inline-flex; align-items: center; min-height: 44px; padding: .6rem 1.15rem; border-radius: var(--radius); font-weight: 600; border: 2px solid var(--link); } +.btn-primary { background: var(--link); color: var(--btn-fg); } +.btn-primary:hover { background: var(--link-hover); border-color: var(--link-hover); color: var(--btn-fg); } +.btn-ghost { background: transparent; color: var(--link); } +.btn-ghost:hover { background: var(--bg-soft); } + +/* Cards */ +.cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr)); gap: 1rem; margin: 1.5rem 0; } +.card { border: 1px solid var(--border); border-radius: var(--radius); padding: 1.25rem; background: var(--bg-soft); } +.card h3 { margin: 0 0 .5rem; font-size: 1.1rem; } +.card p { margin: 0; color: var(--fg); } + +/* Code */ +code { background: var(--bg-code); padding: .15em .35em; border-radius: 4px; font-size: .9em; } +pre { background: var(--bg-code); padding: 1rem; border-radius: var(--radius); overflow-x: auto; } +pre code { background: none; padding: 0; } + +/* Tables */ +.prose table { border-collapse: collapse; width: 100%; max-width: 100%; margin: 1rem 0; } +.prose caption { text-align: left; font-weight: 600; color: var(--fg-muted); padding: .5rem 0; } +.prose th, .prose td { border: 1px solid var(--border); padding: .5rem .75rem; text-align: left; } +.prose th { background: var(--bg-soft); } + +blockquote { margin: 1rem 0; padding: .5rem 1rem; border-left: 4px solid var(--link); color: var(--fg); background: var(--bg-soft); } +img { max-width: 100%; height: auto; } +hr { border: none; border-top: 1px solid var(--border); margin: 2rem 0; } +.muted { color: var(--fg-muted); } + +.site-footer { border-top: 1px solid var(--border); margin-top: 3rem; padding-block: 1.5rem; color: var(--fg-muted); font-size: .95rem; } +.site-footer a { color: var(--link); } + +@media (prefers-reduced-motion: reduce) { + *, *::before, *::after { animation-duration: .001ms !important; animation-iteration-count: 1 !important; transition-duration: .001ms !important; scroll-behavior: auto !important; } +} +@media (max-width: 30rem) { .nav { gap: .5rem; } body { font-size: 1rem; } } diff --git a/_shared/templates/site-default.html b/_shared/templates/site-default.html new file mode 100644 index 00000000..37cd59da --- /dev/null +++ b/_shared/templates/site-default.html @@ -0,0 +1,40 @@ + + + + + + + {{title}} + + + + + + + +
+ +
+
+
+ {{content}} +
+
+ + + diff --git a/a2ml/prototype/rescript/deno.json b/a2ml/prototype/affinescript/deno.json similarity index 100% rename from a2ml/prototype/rescript/deno.json rename to a2ml/prototype/affinescript/deno.json diff --git a/a2ml/prototype/rescript/package.json b/a2ml/prototype/affinescript/package.json similarity index 100% rename from a2ml/prototype/rescript/package.json rename to a2ml/prototype/affinescript/package.json diff --git a/a2ml/prototype/rescript/src/A2ml.affine b/a2ml/prototype/affinescript/src/A2ml.affine similarity index 100% rename from a2ml/prototype/rescript/src/A2ml.affine rename to a2ml/prototype/affinescript/src/A2ml.affine diff --git a/a2ml/prototype/rescript/src/Cli.affine b/a2ml/prototype/affinescript/src/Cli.affine similarity index 100% rename from a2ml/prototype/rescript/src/Cli.affine rename to a2ml/prototype/affinescript/src/Cli.affine diff --git a/a2ml/prototype/rescript/src/Compat.affine b/a2ml/prototype/affinescript/src/Compat.affine similarity index 100% rename from a2ml/prototype/rescript/src/Compat.affine rename to a2ml/prototype/affinescript/src/Compat.affine diff --git a/a2ml/prototype/rescript/src/Demo.affine b/a2ml/prototype/affinescript/src/Demo.affine similarity index 100% rename from a2ml/prototype/rescript/src/Demo.affine rename to a2ml/prototype/affinescript/src/Demo.affine diff --git a/a2ml/prototype/rescript/src/DumpAst.affine b/a2ml/prototype/affinescript/src/DumpAst.affine similarity index 100% rename from a2ml/prototype/rescript/src/DumpAst.affine rename to a2ml/prototype/affinescript/src/DumpAst.affine diff --git a/a2ml/prototype/rescript/src/Json.affine b/a2ml/prototype/affinescript/src/Json.affine similarity index 100% rename from a2ml/prototype/rescript/src/Json.affine rename to a2ml/prototype/affinescript/src/Json.affine diff --git a/a2ml/prototype/rescript/src/RunReport.affine b/a2ml/prototype/affinescript/src/RunReport.affine similarity index 100% rename from a2ml/prototype/rescript/src/RunReport.affine rename to a2ml/prototype/affinescript/src/RunReport.affine diff --git a/a2ml/prototype/rescript/src/RunVectors.affine b/a2ml/prototype/affinescript/src/RunVectors.affine similarity index 100% rename from a2ml/prototype/rescript/src/RunVectors.affine rename to a2ml/prototype/affinescript/src/RunVectors.affine diff --git a/a2ml/prototype/rescript/src/VectorReport.affine b/a2ml/prototype/affinescript/src/VectorReport.affine similarity index 100% rename from a2ml/prototype/rescript/src/VectorReport.affine rename to a2ml/prototype/affinescript/src/VectorReport.affine diff --git a/a2ml/prototype/rescript/src/VectorRunner.affine b/a2ml/prototype/affinescript/src/VectorRunner.affine similarity index 100% rename from a2ml/prototype/rescript/src/VectorRunner.affine rename to a2ml/prototype/affinescript/src/VectorRunner.affine diff --git a/a2ml/site/assets/style.css b/a2ml/site/assets/style.css new file mode 120000 index 00000000..a7c3bb8d --- /dev/null +++ b/a2ml/site/assets/style.css @@ -0,0 +1 @@ +../../../_shared/assets/style.css \ No newline at end of file diff --git a/a2ml/site/index.md b/a2ml/site/index.md new file mode 100644 index 00000000..4067f2e8 --- /dev/null +++ b/a2ml/site/index.md @@ -0,0 +1,79 @@ + +--- +title: A2ML +site: A2ML +description: Attested Markup Language — a lightweight, Djot-like markup that compiles into a typed, attested core +brand: A2ML +date: 2026-06-22 +--- + +# A2ML — Attested Markup Language + +

A lightweight, Djot-like markup that compiles into a typed, attested core. Authoring stays simple; structural guarantees switch on when you want them.

+ +
+Spec v1.1.0 +Typed core +Progressive strictness +Byte-for-byte payloads +MPL-2.0 / CC-BY-SA-4.0 +
+ +
+Get started +Read the spec +GitHub +
+ +## What it does + +
+
+

Readable surface

+

Write a clean, Djot-like format. No ceremony when you don't need it.

+
+
+

Typed, attested core

+

Required sections, resolved references and unique IDs — verified, not hoped for.

+
+
+

Faithful payloads

+

Opaque content is preserved byte-for-byte for reliable embedding.

+
+
+

Portable rendering

+

One source, many targets — HTML, Markdown and PDF pipelines.

+
+
+ +## Progressive strictness + +A2ML lets you dial guarantees up as a document matures: + +| Mode | Guarantee | +|------|-----------| +| **lax** | Parse and render; no structural enforcement. | +| **checked** | Required sections exist, references resolve, IDs are unique. | +| **attested** | Checked, plus a verifiable attestation over the typed core. | + +## A taste + +```a2ml +# A2ML Overview + +@abstract: +A2ML is a typed, attested markup format. It verifies structure and references. +@end + +## Claims +- Required sections must exist. +- References must resolve. + +@refs: +[1] Attested Markup Language Spec (draft) +@end +``` + +## Part of the standards estate + +A2ML is a satellite of the [Hyperpolymath standards hub](https://github.com/hyperpolymath/standards). The normative specification, conformance vectors and profiles live there; this site is the front door. diff --git a/a2ml/site/public/.well-known/security.txt b/a2ml/site/public/.well-known/security.txt new file mode 100644 index 00000000..3b56600d --- /dev/null +++ b/a2ml/site/public/.well-known/security.txt @@ -0,0 +1,29 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +# Security contact for a2ml.net — RFC 9116 +# https://a2ml.net/.well-known/security.txt + +Contact: mailto:j.d.a.jewell@open.ac.uk +Encryption: openpgp4fpr:4A03639C1EB1F86C7F0C97A91835A14A2867091E +Expires: 2027-06-21T00:00:00Z +Preferred-Languages: en +Canonical: https://a2ml.net/.well-known/security.txt +Policy: https://github.com/hyperpolymath/a2ml-ecosystem/security/policy +Acknowledgments: https://github.com/hyperpolymath/a2ml-ecosystem/security/advisories +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEEljlFF1RJblHWtTfK0RkBfr9pWrEFAmo5ozcACgkQ0RkBfr9p +WrH2ORAAvgcBt6nmPx96PfNW6iwOKulGyx5suCH7+vfNZY5Y91U2ONOgiskpA3Oc +HLQ2j79cWv96C50SvWahHGu6xUCovMKPAJYpCeSV973mpsLGuxzOXghfTZw9re5F +E1W3BuuSYCGsb04maxSw8uWZ9H/ik3JJnrvOiXEcxUihJlfJSsxy6ZXZ8WwC+ajO +k90f2yaS/TN9JPgyXwH8WwaNeVh1ZnnWUSdfLVmCvu5aXp+J21EqlJBumO/HCTRe +hh8ojRwr8BGib4jbaAfPRfOZ3VIs1JUx1cJuRGsn3BkqLWuIyIeP9Xw3AVEt4pbv +9G/XYAz0MULTxqA7pJUtMwF91KOlZ24DtB0yxKjcXev8L/1vW7EU0pBsO140Kqhq +ULpPos0LpO/bGgeOBSQr164XTNFcWrEBmLjN1Qyi7ZqdMqTU2cNyM+3KFyPiPfnM +7cW7H7R8xhr/RTzN8zz0eJnOFmX3rVSy854CUW/kmTBU/5GhFFBP7YqB2QBACqqW +g+DpKobebYdL+B1jokzu4umhLd37hssojOcm0RuS13Fz3JSkvYpDKKHEjTTUO/lY +k8EuilmGKWFXNwwDhwLzrx307N+9gqoDwTKBkuOx8lj5IwjJXZvO1R6pWrIR8quF +7It/9vKqNo0O2xoebNsDM5DAn2zCtViftOieM2Tjk+gtLuxQ5yo= +=vBOZ +-----END PGP SIGNATURE----- diff --git a/a2ml/site/public/CNAME b/a2ml/site/public/CNAME new file mode 100644 index 00000000..5dca20ca --- /dev/null +++ b/a2ml/site/public/CNAME @@ -0,0 +1 @@ +a2ml.net diff --git a/a2ml/site/public/favicon.svg b/a2ml/site/public/favicon.svg new file mode 100644 index 00000000..0ed8a7a7 --- /dev/null +++ b/a2ml/site/public/favicon.svg @@ -0,0 +1,10 @@ + + + + + + + + + A2 + diff --git a/a2ml/site/public/robots.txt b/a2ml/site/public/robots.txt new file mode 100644 index 00000000..7718b822 --- /dev/null +++ b/a2ml/site/public/robots.txt @@ -0,0 +1,4 @@ +User-agent: * +Allow: / + +Sitemap: https://a2ml.net/sitemap.xml diff --git a/a2ml/site/spec.md b/a2ml/site/spec.md new file mode 100644 index 00000000..45664ca9 --- /dev/null +++ b/a2ml/site/spec.md @@ -0,0 +1,34 @@ + +--- +title: A2ML specification +site: A2ML +description: A2ML v1.1.0 normative specification — Surface Grammar + Typed Core + Profiles +brand: A2ML +date: 2026-06-22 +--- + +# Specification + +The current normative specification is **A2ML v1.1.0** — Surface Grammar + Typed Core + Profiles. + +## Documents + +- **Spec (normative, v1.1.0)** — surface grammar, typed core, profiles +- **Specification lineage** — versions and era +- **Module 0 quickstart + FAQ** +- **Syntax modules** (opt-in) +- **Grammar appendix** +- **Conformance + test vectors** +- **IANA media type draft** — `application/a2ml` +- **Comparison matrix** +- **Citation guide** + +All specification documents are maintained in the [standards](https://github.com/hyperpolymath/standards) repository under `a2ml/`. This page links the front door; the repository is the source of truth. + +## Profiles + +Profiles layer domain-specific validation on top of the base vocabulary. A2ML v1.1 introduced profiles, an expanded base vocabulary, citation support and content hashing. + +## Conformance + +Conformance is defined by published test vectors (positive and negative fixtures). Implementations validate against these to claim a given strictness level. diff --git a/a2ml/site/start.md b/a2ml/site/start.md new file mode 100644 index 00000000..78a977b7 --- /dev/null +++ b/a2ml/site/start.md @@ -0,0 +1,42 @@ + +--- +title: Get started with A2ML +site: A2ML +description: Learn how to write, validate, and render A2ML documents with progressive strictness modes +brand: A2ML +date: 2026-06-22 +--- + +# Get started + +A2ML is authored as plain text and validated in progressive modes. Start lax, tighten to checked, attest when ready. + +## 1. Write a document + +```a2ml +# Release Notes + +@abstract: +What changed in this release, in one paragraph. +@end + +## Changes +- Added profiles for domain validation. +- Resolved all cross-references. + +@refs: +[1] A2ML Spec v1.1.0 +@end +``` + +## 2. Validate + +Run the validator over your document. In **checked** mode it confirms that required sections exist, references resolve, and IDs are unique. In **attested** mode it additionally produces a verifiable attestation over the typed core. + +## 3. Render + +The typed core is renderer-portable: emit HTML, Markdown or feed a PDF pipeline from a single source, with opaque payloads preserved byte-for-byte. + +## Tooling + +Implementations, editor support and CI actions are coordinated in the [a2ml-ecosystem](https://github.com/hyperpolymath/a2ml-ecosystem) hub. The normative spec and conformance vectors live in [standards](https://github.com/hyperpolymath/standards). diff --git a/a2ml/site/templates/default.html b/a2ml/site/templates/default.html new file mode 120000 index 00000000..57f0c4f8 --- /dev/null +++ b/a2ml/site/templates/default.html @@ -0,0 +1 @@ +../../../_shared/templates/site-default.html \ No newline at end of file diff --git a/avow-protocol/.editorconfig b/avow-protocol/.editorconfig deleted file mode 100644 index fc6650ce..00000000 --- a/avow-protocol/.editorconfig +++ /dev/null @@ -1,68 +0,0 @@ -# RSR-template-repo - Editor Configuration -# https://editorconfig.org - -root = true - -[*] -charset = utf-8 -end_of_line = lf -indent_size = 2 -indent_style = space -insert_final_newline = true -trim_trailing_whitespace = true - -[*.md] -trim_trailing_whitespace = false - -[*.adoc] -trim_trailing_whitespace = false - -[*.rs] -indent_size = 4 - -[*.ex] -indent_size = 2 - -[*.exs] -indent_size = 2 - -[*.zig] -indent_size = 4 - -[*.ada] -indent_size = 3 - -[*.adb] -indent_size = 3 - -[*.ads] -indent_size = 3 - -[*.hs] -indent_size = 2 - -[*.res] -indent_size = 2 - -[*.resi] -indent_size = 2 - -[*.ncl] -indent_size = 2 - -[*.rkt] -indent_size = 2 - -[*.scm] -indent_size = 2 - -[*.nix] -indent_size = 2 - -[Justfile] -indent_style = space -indent_size = 4 - -[justfile] -indent_style = space -indent_size = 4 diff --git a/avow-protocol/.gitattributes b/avow-protocol/.gitattributes deleted file mode 100644 index e860a85c..00000000 --- a/avow-protocol/.gitattributes +++ /dev/null @@ -1,54 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitattributes - -* text=auto eol=lf - -# Source -*.rs text eol=lf diff=rust -*.ex text eol=lf diff=elixir -*.exs text eol=lf diff=elixir -*.jl text eol=lf -*.res text eol=lf -*.resi text eol=lf -*.ada text eol=lf diff=ada -*.adb text eol=lf diff=ada -*.ads text eol=lf diff=ada -*.hs text eol=lf -*.chpl text eol=lf -*.scm text eol=lf -*.ncl text eol=lf -*.nix text eol=lf - -# Docs -*.md text eol=lf diff=markdown -*.adoc text eol=lf -*.txt text eol=lf - -# Data -*.json text eol=lf -*.yaml text eol=lf -*.yml text eol=lf -*.toml text eol=lf - -# Config -.gitignore text eol=lf -.gitattributes text eol=lf -justfile text eol=lf -Makefile text eol=lf -Containerfile text eol=lf - -# Scripts -*.sh text eol=lf - -# Binary -*.png binary -*.jpg binary -*.gif binary -*.pdf binary -*.woff2 binary -*.zip binary -*.gz binary - -# Lock files -Cargo.lock text eol=lf -diff -flake.lock text eol=lf -diff diff --git a/avow-protocol/.github/ISSUE_TEMPLATE/bug_report.md b/avow-protocol/.github/ISSUE_TEMPLATE/bug_report.md deleted file mode 100644 index dd84ea78..00000000 --- a/avow-protocol/.github/ISSUE_TEMPLATE/bug_report.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -name: Bug report -about: Create a report to help us improve -title: '' -labels: '' -assignees: '' - ---- - -**Describe the bug** -A clear and concise description of what the bug is. - -**To Reproduce** -Steps to reproduce the behavior: -1. Go to '...' -2. Click on '....' -3. Scroll down to '....' -4. See error - -**Expected behavior** -A clear and concise description of what you expected to happen. - -**Screenshots** -If applicable, add screenshots to help explain your problem. - -**Desktop (please complete the following information):** - - OS: [e.g. iOS] - - Browser [e.g. chrome, safari] - - Version [e.g. 22] - -**Smartphone (please complete the following information):** - - Device: [e.g. iPhone6] - - OS: [e.g. iOS8.1] - - Browser [e.g. stock browser, safari] - - Version [e.g. 22] - -**Additional context** -Add any other context about the problem here. diff --git a/avow-protocol/.github/ISSUE_TEMPLATE/custom.md b/avow-protocol/.github/ISSUE_TEMPLATE/custom.md deleted file mode 100644 index 48d5f81f..00000000 --- a/avow-protocol/.github/ISSUE_TEMPLATE/custom.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -name: Custom issue template -about: Describe this issue template's purpose here. -title: '' -labels: '' -assignees: '' - ---- - - diff --git a/avow-protocol/.github/ISSUE_TEMPLATE/feature_request.md b/avow-protocol/.github/ISSUE_TEMPLATE/feature_request.md deleted file mode 100644 index bbcbbe7d..00000000 --- a/avow-protocol/.github/ISSUE_TEMPLATE/feature_request.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -name: Feature request -about: Suggest an idea for this project -title: '' -labels: '' -assignees: '' - ---- - -**Is your feature request related to a problem? Please describe.** -A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] - -**Describe the solution you'd like** -A clear and concise description of what you want to happen. - -**Describe alternatives you've considered** -A clear and concise description of any alternative solutions or features you've considered. - -**Additional context** -Add any other context or screenshots about the feature request here. diff --git a/avow-protocol/.github/workflows/6scm-sync.yml b/avow-protocol/.github/workflows/6scm-sync.yml deleted file mode 100644 index 387bbf9e..00000000 --- a/avow-protocol/.github/workflows/6scm-sync.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: 6SCM Mirror Check - -on: - push: - paths: - - '.machine_readable/**' - pull_request: - paths: - - '.machine_readable/**' - -jobs: - check: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Check 6scm mirrors - run: bash scripts/check-6scm.sh diff --git a/avow-protocol/.github/workflows/codeql.yml b/avow-protocol/.github/workflows/codeql.yml deleted file mode 100644 index 0aac734d..00000000 --- a/avow-protocol/.github/workflows/codeql.yml +++ /dev/null @@ -1,104 +0,0 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: "CodeQL Advanced" - -on: - push: - branches: [ "main" ] - pull_request: - branches: [ "main" ] - schedule: - - cron: '15 12 * * 3' - -permissions: read-all - -jobs: - analyze: - name: Analyze (${{ matrix.language }}) - # Runner size impacts CodeQL analysis time. To learn more, please see: - # - https://gh.io/recommended-hardware-resources-for-running-codeql - # - https://gh.io/supported-runners-and-hardware-resources - # - https://gh.io/using-larger-runners (GitHub.com only) - # Consider using larger runners or machines with greater resources for possible analysis time improvements. - runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} - timeout-minutes: 30 - permissions: - # required for all workflows - security-events: write - - # required to fetch internal or private CodeQL packs - packages: read - - # only required for workflows in private repositories - actions: read - contents: read - - strategy: - fail-fast: false - matrix: - include: - - language: actions - build-mode: none - - language: javascript-typescript - build-mode: none - # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' - # Use `c-cpp` to analyze code written in C, C++ or both - # Use 'java-kotlin' to analyze code written in Java, Kotlin or both - # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both - # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, - # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. - # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how - # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages - steps: - - name: Checkout repository - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - # Add any setup steps before running the `github/codeql-action/init` action. - # This includes steps like installing compilers or runtimes (`actions/setup-node` - # or others). This is typically only required for manual builds. - # - name: Setup runtime (example) - # uses: actions/setup-example@v1 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@b2f9ef845756500b97acbdaf5c1dd4e9c1d15734 # v3 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - - # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality - - # If the analyze step fails for one of the languages you are analyzing with - # "We were unable to automatically build your code", modify the matrix above - # to set the build mode to "manual" for that language. Then modify this step - # to build your code. - # ℹ️ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - name: Run manual build steps - if: matrix.build-mode == 'manual' - shell: bash - run: | - echo 'If you are using a "manual" build mode for one or more of the' \ - 'languages you are analyzing, replace this with the commands to build' \ - 'your code, for example:' - echo ' make bootstrap' - echo ' make release' - exit 1 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b2f9ef845756500b97acbdaf5c1dd4e9c1d15734 # v3 - with: - category: "/language:${{matrix.language}}" diff --git a/avow-protocol/.github/workflows/deploy-pages.yml b/avow-protocol/.github/workflows/deploy-pages.yml deleted file mode 100644 index 1204a976..00000000 --- a/avow-protocol/.github/workflows/deploy-pages.yml +++ /dev/null @@ -1,51 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Deploy STAMP Protocol - -on: - push: - branches: [main] - workflow_dispatch: - -permissions: - contents: read - pages: write - id-token: write - -concurrency: - group: "pages" - cancel-in-progress: false - -jobs: - deploy: - runs-on: ubuntu-latest - timeout-minutes: 30 - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - - steps: - - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - - name: Setup Deno - uses: denoland/setup-deno@v2 - with: - deno-version: v2.x - - - name: Build Site - run: | - deno task build - # Copy compiled output if it exists - [ -f src/StampApp.res.js ] && cp src/StampApp.res.js script.js || true - - - name: Setup Pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 - with: - path: '.' - - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/avow-protocol/.github/workflows/governance.yml b/avow-protocol/.github/workflows/governance.yml deleted file mode 100644 index b4062e02..00000000 --- a/avow-protocol/.github/workflows/governance.yml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - contents: read - -jobs: - governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/avow-protocol/.github/workflows/scorecard.yml b/avow-protocol/.github/workflows/scorecard.yml deleted file mode 100644 index 95378b76..00000000 --- a/avow-protocol/.github/workflows/scorecard.yml +++ /dev/null @@ -1,33 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard -on: - push: - branches: [main, master] - schedule: - - cron: '0 4 * * *' - workflow_dispatch: - -permissions: read-all - -jobs: - analysis: - runs-on: ubuntu-latest - timeout-minutes: 20 - permissions: - security-events: write - id-token: write - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - with: - persist-credentials: false - - - name: Run Scorecard - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 - with: - results_file: results.sarif - results_format: sarif - - - name: Upload results - uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.31.8 - with: - sarif_file: results.sarif diff --git a/avow-protocol/.gitignore b/avow-protocol/.gitignore deleted file mode 100644 index c661e974..00000000 --- a/avow-protocol/.gitignore +++ /dev/null @@ -1,22 +0,0 @@ -.DS_Store -node_modules/ -.env -*.log -.wrangler/ - -# ReScript build artifacts -lib/ -*.res.js - -# npm lock file -package-lock.json - -# Crash recovery artifacts -ai-cli-crash-capture/ - -# KDE directory metadata -.directory - -# Sync reports -sync_report*.txt -sync_repos_report*.txt diff --git a/avow-protocol/.machine_readable/6a2/ECOSYSTEM.a2ml b/avow-protocol/.machine_readable/6a2/ECOSYSTEM.a2ml deleted file mode 100644 index 8db3b597..00000000 --- a/avow-protocol/.machine_readable/6a2/ECOSYSTEM.a2ml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# ECOSYSTEM.a2ml — Avow Protocol ecosystem position -[metadata] -version = "1.0.0" -last-updated = "2026-04-11" - -[project] -name = "Avow Protocol" -purpose = "" -role = "demonstration-site" - -[position-in-ecosystem] -category = "" - -[related-projects] -projects = [ - # No related projects recorded -] diff --git a/avow-protocol/.machine_readable/6a2/META.a2ml b/avow-protocol/.machine_readable/6a2/META.a2ml deleted file mode 100644 index f6b8250f..00000000 --- a/avow-protocol/.machine_readable/6a2/META.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# META.a2ml — Avow Protocol meta-level information -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project-info] -license = "PMPL-1.0-or-later" -author = "Jonathan D.A. Jewell (hyperpolymath)" - -[architecture-decisions] -decisions = [ - # No ADRs recorded -] - -[development-practices] -versioning = "SemVer" -documentation = "AsciiDoc" -build-tool = "just" - -[maintenance-axes] -scoping-first = true -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" diff --git a/avow-protocol/.machine_readable/6a2/STATE.a2ml b/avow-protocol/.machine_readable/6a2/STATE.a2ml deleted file mode 100644 index cfbd7ab2..00000000 --- a/avow-protocol/.machine_readable/6a2/STATE.a2ml +++ /dev/null @@ -1,44 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# STATE.a2ml — Avow Protocol project state -[metadata] -project = "stamp-protocol" -version = "1.0.0" -last-updated = "2026-01-30" -status = "active" -session = "converted from scheme — 2026-04-11" - -[project-context] -name = "Stamp Protocol" -purpose = """Interactive demonstration of STAMP consent protocol""" -completion-percentage = 65 - -[position] -phase = "MVP Development" # design | implementation | testing | maintenance | archived -maturity = "experimental" # experimental | alpha | beta | production | lts - -[route-to-mvp] -milestones = [ - # No milestones recorded -] - -[blockers-and-issues] -issues = [ - "DOM mounting not yet implemented", - "StampApp.res has model/update/render but no DOM integration", -] - -[critical-next-actions] -actions = [ - "Wire StampApp to DOM via Tea.App.standardProgram", - "Test interactive URL validation in browser", - "Complete visual consent flow UI", - "Deploy to Cloudflare Pages staging", - "Launch public site at stamp-protocol.org", - "Add API integration for real consent tracking", -] - -[maintenance-status] -last-run-utc = "2026-01-30T00:00:00Z" -last-result = "unknown" # unknown | pass | warn | fail diff --git a/avow-protocol/.well-known/change-password b/avow-protocol/.well-known/change-password deleted file mode 100644 index 21ba2758..00000000 --- a/avow-protocol/.well-known/change-password +++ /dev/null @@ -1 +0,0 @@ -https://stamp-protocol.org/ diff --git a/avow-protocol/.well-known/security.txt b/avow-protocol/.well-known/security.txt deleted file mode 100644 index 9a9ae6c3..00000000 --- a/avow-protocol/.well-known/security.txt +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Security contact information for stamp-protocol.org -# RFC 9116: https://www.rfc-editor.org/rfc/rfc9116.html - -Contact: mailto:jonathan.jewell@open.ac.uk -Expires: 2027-01-30T00:00:00.000Z -Preferred-Languages: en -Canonical: https://stamp-protocol.org/.well-known/security.txt -Policy: https://github.com/hyperpolymath/stamp-website/blob/main/SECURITY.md -Acknowledgments: https://github.com/hyperpolymath/stamp-website/blob/main/SECURITY.md#acknowledgments diff --git a/avow-protocol/ABI-FFI-README.md b/avow-protocol/ABI-FFI-README.md deleted file mode 100644 index e6a32bbf..00000000 --- a/avow-protocol/ABI-FFI-README.md +++ /dev/null @@ -1,385 +0,0 @@ -{{~ Aditionally delete this line and fill out the template below ~}} - -# {{PROJECT}} ABI/FFI Documentation - -## Overview - -This library follows the **Hyperpolymath RSR Standard** for ABI and FFI design: - -- **ABI (Application Binary Interface)** defined in **Idris2** with formal proofs -- **FFI (Foreign Function Interface)** implemented in **Zig** for C compatibility -- **Generated C headers** bridge Idris2 ABI to Zig FFI -- **Any language** can call through standard C ABI - -## Architecture - -``` -┌─────────────────────────────────────────────┐ -│ ABI Definitions (Idris2) │ -│ src/abi/ │ -│ - Types.idr (Type definitions) │ -│ - Layout.idr (Memory layout proofs) │ -│ - Foreign.idr (FFI declarations) │ -└─────────────────┬───────────────────────────┘ - │ - │ generates (at compile time) - ▼ -┌─────────────────────────────────────────────┐ -│ C Headers (auto-generated) │ -│ generated/abi/{{project}}.h │ -└─────────────────┬───────────────────────────┘ - │ - │ imported by - ▼ -┌─────────────────────────────────────────────┐ -│ FFI Implementation (Zig) │ -│ ffi/zig/src/main.zig │ -│ - Implements C-compatible functions │ -│ - Zero-cost abstractions │ -│ - Memory-safe by default │ -└─────────────────┬───────────────────────────┘ - │ - │ compiled to lib{{project}}.so/.a - ▼ -┌─────────────────────────────────────────────┐ -│ Any Language via C ABI │ -│ - Rust, ReScript, Julia, Python, etc. │ -└─────────────────────────────────────────────┘ -``` - -## Directory Structure - -``` -{{project}}/ -├── src/ -│ ├── abi/ # ABI definitions (Idris2) -│ │ ├── Types.idr # Core type definitions with proofs -│ │ ├── Layout.idr # Memory layout verification -│ │ └── Foreign.idr # FFI function declarations -│ └── lib/ # Core library (any language) -│ -├── ffi/ -│ └── zig/ # FFI implementation (Zig) -│ ├── build.zig # Build configuration -│ ├── build.zig.zon # Dependencies -│ ├── src/ -│ │ └── main.zig # C-compatible FFI implementation -│ ├── test/ -│ │ └── integration_test.zig -│ └── include/ -│ └── {{project}}.h # C header (optional, can be generated) -│ -├── generated/ # Auto-generated files -│ └── abi/ -│ └── {{project}}.h # Generated from Idris2 ABI -│ -└── bindings/ # Language-specific wrappers (optional) - ├── rust/ - ├── rescript/ - └── julia/ -``` - -## Why Idris2 for ABI? - -### 1. **Formal Verification** - -Idris2's dependent types allow proving properties about the ABI at compile-time: - -```idris --- Prove struct size is correct -public export -exampleStructSize : HasSize ExampleStruct 16 - --- Prove field alignment is correct -public export -fieldAligned : Divides 8 (offsetOf ExampleStruct.field) - --- Prove ABI is platform-compatible -public export -abiCompatible : Compatible (ABI 1) (ABI 2) -``` - -### 2. **Type Safety** - -Encode invariants that C/Zig cannot express: - -```idris --- Non-null pointer guaranteed at type level -data Handle : Type where - MkHandle : (ptr : Bits64) -> {auto 0 nonNull : So (ptr /= 0)} -> Handle - --- Array with length proof -data Buffer : (n : Nat) -> Type where - MkBuffer : Vect n Byte -> Buffer n -``` - -### 3. **Platform Abstraction** - -Platform-specific types with compile-time selection: - -```idris -CInt : Platform -> Type -CInt Linux = Bits32 -CInt Windows = Bits32 - -CSize : Platform -> Type -CSize Linux = Bits64 -CSize Windows = Bits64 -``` - -### 4. **Safe Evolution** - -Prove that new ABI versions are backward-compatible: - -```idris --- Compiler enforces compatibility -abiUpgrade : ABI 1 -> ABI 2 -abiUpgrade old = MkABI2 { - -- Must preserve all v1 fields - v1_compat = old, - -- Can add new fields - new_features = defaults -} -``` - -## Why Zig for FFI? - -### 1. **C ABI Compatibility** - -Zig exports C-compatible functions naturally: - -```zig -export fn library_function(param: i32) i32 { - return param * 2; -} -``` - -### 2. **Memory Safety** - -Compile-time safety without runtime overhead: - -```zig -// Null check enforced at compile time -const handle = init() orelse return error.InitFailed; -defer free(handle); -``` - -### 3. **Cross-Compilation** - -Built-in cross-compilation to any platform: - -```bash -zig build -Dtarget=x86_64-linux -zig build -Dtarget=aarch64-macos -zig build -Dtarget=x86_64-windows -``` - -### 4. **Zero Dependencies** - -No runtime, no libc required (unless explicitly needed): - -```zig -// Minimal binary size -pub const lib = @import("std"); -// Only includes what you use -``` - -## Building - -### Build FFI Library - -```bash -cd ffi/zig -zig build # Build debug -zig build -Doptimize=ReleaseFast # Build optimized -zig build test # Run tests -``` - -### Generate C Header from Idris2 ABI - -```bash -cd src/abi -idris2 --cg c-header Types.idr -o ../../generated/abi/{{project}}.h -``` - -### Cross-Compile - -```bash -cd ffi/zig - -# Linux x86_64 -zig build -Dtarget=x86_64-linux - -# macOS ARM64 -zig build -Dtarget=aarch64-macos - -# Windows x86_64 -zig build -Dtarget=x86_64-windows -``` - -## Usage - -### From C - -```c -#include "{{project}}.h" - -int main() { - void* handle = {{project}}_init(); - if (!handle) return 1; - - int result = {{project}}_process(handle, 42); - if (result != 0) { - const char* err = {{project}}_last_error(); - fprintf(stderr, "Error: %s\n", err); - } - - {{project}}_free(handle); - return 0; -} -``` - -Compile with: -```bash -gcc -o example example.c -l{{project}} -L./zig-out/lib -``` - -### From Idris2 - -```idris -import {{PROJECT}}.ABI.Foreign - -main : IO () -main = do - Just handle <- init - | Nothing => putStrLn "Failed to initialize" - - Right result <- process handle 42 - | Left err => putStrLn $ "Error: " ++ errorDescription err - - free handle - putStrLn "Success" -``` - -### From Rust - -```rust -#[link(name = "{{project}}")] -extern "C" { - fn {{project}}_init() -> *mut std::ffi::c_void; - fn {{project}}_free(handle: *mut std::ffi::c_void); - fn {{project}}_process(handle: *mut std::ffi::c_void, input: u32) -> i32; -} - -fn main() { - unsafe { - let handle = {{project}}_init(); - assert!(!handle.is_null()); - - let result = {{project}}_process(handle, 42); - assert_eq!(result, 0); - - {{project}}_free(handle); - } -} -``` - -### From Julia - -```julia -const lib{{project}} = "lib{{project}}" - -function init() - handle = ccall((:{{project}}_init, lib{{project}}), Ptr{Cvoid}, ()) - handle == C_NULL && error("Failed to initialize") - handle -end - -function process(handle, input) - result = ccall((:{{project}}_process, lib{{project}}), Cint, (Ptr{Cvoid}, UInt32), handle, input) - result -end - -function cleanup(handle) - ccall((:{{project}}_free, lib{{project}}), Cvoid, (Ptr{Cvoid},), handle) -end - -# Usage -handle = init() -try - result = process(handle, 42) - println("Result: $result") -finally - cleanup(handle) -end -``` - -## Testing - -### Unit Tests (Zig) - -```bash -cd ffi/zig -zig build test -``` - -### Integration Tests - -```bash -cd ffi/zig -zig build test-integration -``` - -### ABI Verification (Idris2) - -```idris --- Compile-time verification -%runElab verifyABI - --- Runtime checks -main : IO () -main = do - verifyLayoutsCorrect - verifyAlignmentsCorrect - putStrLn "ABI verification passed" -``` - -## Contributing - -When modifying the ABI/FFI: - -1. **Update ABI first** (`src/abi/*.idr`) - - Modify type definitions - - Update proofs - - Ensure backward compatibility - -2. **Generate C header** - ```bash - idris2 --cg c-header src/abi/Types.idr -o generated/abi/{{project}}.h - ``` - -3. **Update FFI implementation** (`ffi/zig/src/main.zig`) - - Implement new functions - - Match ABI types exactly - -4. **Add tests** - - Unit tests in Zig - - Integration tests - - ABI verification tests - -5. **Update documentation** - - Function signatures - - Usage examples - - Migration guide (if breaking changes) - -## License - -PMPL-1.0-or-later - -## See Also - -- [Idris2 Documentation](https://idris2.readthedocs.io) -- [Zig Documentation](https://ziglang.org/documentation/master/) -- [Rhodium Standard Repositories](https://github.com/hyperpolymath/rhodium-standard-repositories) -- [FFI Migration Guide](../ffi-migration-guide.md) -- [ABI Migration Guide](../abi-migration-guide.md) diff --git a/avow-protocol/ARCHITECTURE-SETUP-COMPLETE.md b/avow-protocol/ARCHITECTURE-SETUP-COMPLETE.md deleted file mode 100644 index d3d289bb..00000000 --- a/avow-protocol/ARCHITECTURE-SETUP-COMPLETE.md +++ /dev/null @@ -1,294 +0,0 @@ -# SPDX-License-Identifier: CC-BY-SA-4.0 -# AVOW Protocol - Architecture Setup Complete - -**Date:** 2026-02-04 -**Author:** Jonathan D.A. Jewell - -## Summary - -Successfully renamed from STAMP Protocol to AVOW Protocol and set up the complete architecture stack: - -## What Was Done - -### 1. Rebranding: STAMP → AVOW - -✅ Updated all checkpoint files (STATE.scm, ECOSYSTEM.scm, META.scm) -✅ Changed license from AGPL-3.0 to PMPL-1.0-or-later -✅ Updated all documentation and references -✅ Changed @stamp_demo_bot to @avow_demo_bot -✅ Updated stamp-protocol.org to avow-protocol.org - -### 2. Architecture Stack Setup - -Created complete integration of: - -#### casket-ssg (Static Site Generator) -- Pure functional Haskell SSG with compile-time template validation -- Type-safe site structure -- Lazy evaluation for efficient builds -- Binary already present: `/casket-simple` - -#### cadre-tea-router (Routing) -- Created `src/AvowRouter.res` with complete route definitions -- Type-safe URL parsing and formatting -- Routes: Home, About, Docs, Demo, Verify(messageId) -- Built on cadre-router primitives - -#### rescript-tea (The Elm Architecture) -- Created `src/AvowTea.res` with full TEA implementation -- Model, Messages, Init, Update, View, Subscriptions -- Integrated with AvowRouter for URL-driven state -- Post-quantum crypto initialization support - -#### rescript-dom-mounter (Formally Verified DOM) -- Created `src/AvowSafeMount.res` for safe mounting -- Mathematical guarantees: no null pointers, valid selectors, well-formed HTML -- Batch mounting support -- Idris2-proven correctness - -#### Main Entry Point -- Created `src/Main.res` as application entry point -- Initializes with formal verification -- Logs crypto stack on startup - -### 3. Post-Quantum Cryptography Configuration - -Created `security-requirements.scm` with complete spec: - -- **Signatures:** Dilithium5-AES (ML-DSA-87, FIPS 204) -- **Key Exchange:** Kyber-1024 (ML-KEM-1024, FIPS 203) -- **Hashing:** SHAKE3-512 (FIPS 202) -- **Symmetric:** XChaCha20-Poly1305 (256-bit keys) -- **Hybrid:** Ed448 + Dilithium5 -- **Fallback:** SPHINCS+ for all PQ operations -- **Verification:** Idris2, Coq, Isabelle - -### 4. Cloudflare Integration - -Created comprehensive Cloudflare configuration: - -#### DNS Zone File (`cloudflare-dns-zone.txt`) -- Core records (A, AAAA, CNAME) with proxying -- Security records (CAA, TLSA, SSHFP) -- Mail security (DMARC, MTA-STS, TLS-RPT) -- OpenPGP and SFTP URIs -- Zero Trust/SDP tunnels for internal services -- WASM proxy endpoints - -#### Deployment Guide (`CLOUDFLARE-SETUP.md`) -- Complete 10-step setup guide -- DNS configuration with placeholders -- GitHub Pages / Cloudflare Pages integration -- Security headers configuration -- Zero Trust/SDP tunnel setup -- WAF rules and rate limiting -- WASM proxy deployment -- Post-quantum TLS verification -- Monitoring and testing procedures - -### 5. Updated Documentation - -✅ `README.md` - Complete architecture section with verification layers -✅ `index.html` - Updated with avow-root div and correct references -✅ `deno.json` - Added proper import paths for all dependencies -✅ `rescript.json` - Configured for avow-protocol -✅ `package.json` - Created with correct author and license - -## Architecture Diagram - -``` -┌─────────────────────────────────────────────────────────────┐ -│ User Browser │ -└──────────────────┬──────────────────────────────────────────┘ - │ - ▼ -┌─────────────────────────────────────────────────────────────┐ -│ Cloudflare Edge (WASM Proxy) │ -│ • Post-quantum TLS (Kyber-1024) │ -│ • DDoS protection │ -│ • WAF rules │ -│ • WASM request validation │ -└──────────────────┬──────────────────────────────────────────┘ - │ - ▼ -┌─────────────────────────────────────────────────────────────┐ -│ Cloudflare Pages / GitHub Pages │ -│ Static site served via CDN │ -└──────────────────┬──────────────────────────────────────────┘ - │ - ▼ -┌─────────────────────────────────────────────────────────────┐ -│ avow-protocol.org (Static Site) │ -│ │ -│ ┌──────────────────────────────────────────────────┐ │ -│ │ casket-ssg (Haskell) │ │ -│ │ • Compile-time template validation │ │ -│ │ • Type-safe site structure │ │ -│ └──────────────────────────────────────────────────┘ │ -│ │ │ -│ ▼ │ -│ ┌──────────────────────────────────────────────────┐ │ -│ │ ReScript Application (Main.res) │ │ -│ │ ┌────────────────────────────────────────────┐ │ │ -│ │ │ AvowSafeMount.res │ │ │ -│ │ │ • rescript-dom-mounter │ │ │ -│ │ │ • Formally verified mounting │ │ │ -│ │ │ • Idris2 proofs of correctness │ │ │ -│ │ └────────────┬───────────────────────────────┘ │ │ -│ │ ▼ │ │ -│ │ ┌────────────────────────────────────────────┐ │ │ -│ │ │ AvowTea.res (The Elm Architecture) │ │ │ -│ │ │ • Model, Msg, Init, Update, View │ │ │ -│ │ │ • Commands & Subscriptions │ │ │ -│ │ │ • Type-safe state management │ │ │ -│ │ └────────────┬───────────────────────────────┘ │ │ -│ │ ▼ │ │ -│ │ ┌────────────────────────────────────────────┐ │ │ -│ │ │ AvowRouter.res │ │ │ -│ │ │ • cadre-tea-router │ │ │ -│ │ │ • Type-safe URL parsing/formatting │ │ │ -│ │ │ • Route → Msg patterns │ │ │ -│ │ └────────────┬───────────────────────────────┘ │ │ -│ │ ▼ │ │ -│ │ ┌────────────────────────────────────────────┐ │ │ -│ │ │ proven (URL validation) │ │ │ -│ │ │ • Idris2 formal verification │ │ │ -│ │ │ • No XSS via URLs │ │ │ -│ │ │ • Compile-time safety │ │ │ -│ │ └────────────────────────────────────────────┘ │ │ -│ └──────────────────────────────────────────────────┘ │ -└─────────────────────────────────────────────────────────────┘ - │ - ▼ -┌─────────────────────────────────────────────────────────────┐ -│ libavow (Idris2 + Zig FFI) │ -│ • Dilithium5-AES signatures │ -│ • Kyber-1024 key exchange │ -│ • SHAKE3-512 hashing │ -│ • XChaCha20-Poly1305 encryption │ -│ • Dependent type proofs of protocol correctness │ -└─────────────────────────────────────────────────────────────┘ -``` - -## Formal Verification Layers - -1. **DNS Layer** - DNSSEC, CAA, TLSA records -2. **Network Layer** - Post-quantum TLS (Kyber-1024) -3. **Edge Layer** - WASM validation (to be implemented) -4. **Static Site** - casket-ssg compile-time checks -5. **DOM Mounting** - rescript-dom-mounter Idris2 proofs -6. **Routing** - cadre-tea-router type-safe patterns -7. **URL Parsing** - proven Idris2 verification -8. **Application State** - rescript-tea exhaustive pattern matching -9. **Protocol Layer** - libavow dependent type proofs -10. **Cryptography** - Coq/Isabelle verified primitives - -## Next Steps - -### Immediate (This Session) -1. ✅ Rename STAMP to AVOW throughout codebase -2. ✅ Set up casket-ssg integration -3. ✅ Create cadre-tea-router architecture -4. ✅ Build rescript-tea application -5. ✅ Configure Cloudflare DNS and security -6. ⏳ Build and test ReScript compilation -7. ⏳ Deploy to Cloudflare Pages - -### Short Term (This Week) -1. Integrate real libavow library (replace mocks) -2. Implement WASM proxy with AVOW verification -3. Set up Cloudflare Tunnel for internal services -4. Configure WAF rules and rate limiting -5. Test post-quantum crypto integration -6. Update documentation with deployment results - -### Medium Term (This Month) -1. Complete Idris2 ABI proofs for all protocol operations -2. Implement Zig FFI with full crypto primitives -3. Create integration examples for platforms -4. Write comprehensive test suite -5. Performance benchmarking -6. Security audit - -## Dependencies Setup - -Created proper dependency structure: - -- `deno.json` - Import maps for local repos -- `package.json` - npm dependencies (ReScript toolchain) -- `rescript.json` - ReScript configuration -- Repos available: - - `$REPOS_DIR/casket-ssg` - - `$REPOS_DIR/cadre-tea-router` - - `$REPOS_DIR/rescript-tea` - - `$REPOS_DIR/rescript-dom-mounter` - - `$REPOS_DIR/proven` - -## Files Created/Modified - -### Created -- `src/AvowRouter.res` - Routing definitions -- `src/AvowTea.res` - TEA application -- `src/AvowSafeMount.res` - Safe DOM mounting -- `src/Main.res` - Application entry point -- `cloudflare-dns-zone.txt` - Cloudflare DNS configuration -- `security-requirements.scm` - Post-quantum crypto specs -- `CLOUDFLARE-SETUP.md` - Deployment guide -- `ARCHITECTURE-SETUP-COMPLETE.md` - This document -- `package.json` - npm package configuration - -### Modified -- `STATE.scm` - Updated project state, tech stack, license -- `ECOSYSTEM.scm` - Updated related projects, license -- `META.scm` - Updated license -- `rescript.json` - Updated package name and configuration -- `deno.json` - Added import paths for dependencies -- `index.html` - Updated bot references, license, added avow-root div -- `README.md` - Complete architecture section rewrite - -## License Note - -All files now use **PMPL-1.0-or-later** (Palimpsest License) as specified in the development standards. - -AGPL-3.0 references have been replaced throughout the codebase. - -## Author Attribution - -All files correctly attribute: -- **Name:** Jonathan D.A. Jewell -- **Email:** j.d.a.jewell@open.ac.uk - -## Proven Library Integration - -The architecture uses `proven` library calls throughout for unbreakable code: - -- URL validation with Idris2 proofs -- No XSS via URL injection -- No runtime URL parsing errors -- Invalid URLs cannot compile -- Mathematical guarantees of correctness - -## Security Stance - -AVOW Protocol implements **belt-and-suspenders** security: - -- Hybrid classical+PQ signatures (Ed448 + Dilithium5) -- Conservative fallbacks (SPHINCS+) -- Formal verification at every layer -- Post-quantum crypto throughout -- Zero Trust architecture -- Defense in depth - -## Repository Status - -**Location:** `$REPOS_DIR/avow-protocol` -**Symlink:** `~/Documents/hyperpolymath-repos/avow-protocol` -**Git Status:** Modified, ready for commit -**Build Status:** Dependencies installed, ready for compilation - -## Contact - -For questions about this setup: -- Jonathan D.A. Jewell -- j.d.a.jewell@open.ac.uk -- GitHub: @hyperpolymath diff --git a/avow-protocol/ARCHITECTURE.md b/avow-protocol/ARCHITECTURE.md deleted file mode 100644 index d71904c9..00000000 --- a/avow-protocol/ARCHITECTURE.md +++ /dev/null @@ -1,135 +0,0 @@ -# AVOW Protocol Website Architecture - -## Multi-Layer Stack (All Layers Working Together) - -### Build-Time (Static Generation) -- **Casket-SSG (Haskell)** - Generates static HTML from Markdown -- Runs once during deployment -- Pure functional, predictable output - -### Run-Time (Client-Side) -- **ReScript** - Type-safe JavaScript compilation -- **ReScript-TEA** - The Elm Architecture for predictable state management -- **Cadre-TEA-Router** - Type-safe client-side routing - -### Verification Layers -- **k9-svc** - Self-Validating Components - - Validates form inputs - - Proves unsubscribe links work before sending - - Runtime invariant checking - -- **a2ml** - Attested Markup Language - - Typed, verifiable consent proofs - - Cryptographic timestamping - - Content with mathematical guarantees - -- **proven (Idris2)** - Formally Verified Operations - - SafeString - String operations that can't crash - - SafeUrl - URL parsing with proofs - - SafeHtml - Safe HTML generation - - All operations mathematically proven correct - -## Architecture Flow - -``` -User Request - ↓ -Casket (Haskell) → Static HTML - ↓ -Browser Loads Page - ↓ -ReScript-TEA Initializes - ↓ -User Interaction (click demo) - ↓ -TEA Update (pure state transition) - ↓ -k9-svc Validates (proves correctness) - ↓ -a2ml Generates Proof (cryptographic) - ↓ -proven Ensures Safety (Idris2 proofs) - ↓ -DOM Updated (ReScript) -``` - -## Why This Stack? - -### Casket-SSG (Haskell) -- ✅ Keeps Haskell for what it does best: pure transformations -- ✅ Perfect for static site generation -- ✅ Not destroyed or replaced - enhanced! - -### ReScript + TEA -- ✅ Type safety for client-side code -- ✅ Predictable state management -- ✅ Model-Update-View pattern -- ✅ Compile-time guarantees - -### k9-svc -- ✅ Components prove their own correctness -- ✅ Runtime validation with proofs -- ✅ Used where relevant (form validation, link checking) - -### a2ml -- ✅ Typed markup for consent proofs -- ✅ Verifiable content -- ✅ Used where relevant (cryptographic proofs) - -### proven (Idris2) -- ✅ Mathematical proofs of correctness -- ✅ Operations that cannot crash -- ✅ Used for super-robust critical paths -- ✅ SafeUrl, SafeString, SafeHtml modules - -## Integration Points - -### Current (Vanilla JS) -```javascript -// Can crash, no guarantees -document.querySelector('.stat-card').style.opacity = '1' -``` - -### With ReScript-TEA -```rescript -// Type-safe, compile-time checked -let update = (model, msg) => - switch msg { - | ShowStats => {...model, statsVisible: true} - } -``` - -### With k9-svc -```rescript -// Component proves it maintains invariants -(k9-svc-check unsubscribe-link - (response-code 200) - (response-time < 200ms) - (proof validated)) -``` - -### With a2ml -```rescript -// Typed, verifiable proof -(proof consent - (action subscribe) - (timestamp verified) - (type explicit)) -``` - -### With proven -```idris --- Operations that cannot crash (Idris2) -parseUrl : String -> Either ProofOfError (Url, ProofOfValid) -``` - -## No Layers Destroyed - -- ✅ **Haskell (Casket)** - Still generates static HTML -- ✅ **ReScript** - Adds type safety on top -- ✅ **TEA** - Adds state management on top -- ✅ **k9-svc** - Adds validation where relevant -- ✅ **a2ml** - Adds typed proofs where relevant -- ✅ **proven** - Adds formal verification for critical operations - -Each layer complements the others. Nothing is destroyed! diff --git a/avow-protocol/AVOW-THREAT-MODEL.adoc b/avow-protocol/AVOW-THREAT-MODEL.adoc deleted file mode 100644 index 1ecf49cf..00000000 --- a/avow-protocol/AVOW-THREAT-MODEL.adoc +++ /dev/null @@ -1,1209 +0,0 @@ -= STAMP Protocol: Comprehensive Threat Model -Jonathan D.A. Jewell -:toc: -:toclevels: 4 - -== Executive Summary - -*Comprehensive security analysis of STAMP Protocol covering attack vectors, defenses, residual risks, and mitigation strategies.* - -=== Threat Landscape - -[cols="2,1,1,2"] -|=== -|Threat Category |Likelihood |Impact |Primary Defense - -|Mass Bot Creation -|Very High -|Critical -|Time-locked reputation - -|Verification Bypass -|Medium -|Critical -|Multi-source requirements - -|Identity Theft -|Medium -|High -|Biometric + liveness - -|Coordination Attacks -|High -|High -|Statistical detection - -|Economic Attacks -|Medium -|Medium -|Cost asymmetry - -|Protocol Exploits -|Low -|Critical -|Formal verification - -|Supply Chain -|Low -|Critical -|Reproducible builds - -|Social Engineering -|Medium -|Medium -|Rate limiting -|=== - -== Threat Actor Analysis - -=== Actor Types - -==== 1. Individual Spammer - -*Motivation:* Financial gain (affiliate links, scams) - -*Capabilities:* - -* Limited budget ($100-1000) -* Basic technical skills -* Off-the-shelf tools - -*Attack Vectors:* - -* Buy aged accounts -* Simple automation scripts -* Manual verification gaming - -*Threat Level:* LOW (STAMP defenses effective) - -==== 2. Professional Spam Operations - -*Motivation:* Large-scale financial gain - -*Capabilities:* - -* Moderate budget ($10k-100k) -* Professional developers -* SIM farms, proxy networks -* Automated tooling - -*Attack Vectors:* - -* Mass account creation -* Verification source abuse -* Behavioral mimicry -* Account marketplace - -*Threat Level:* MEDIUM (STAMP raises costs significantly) - -==== 3. State-Sponsored Actors - -*Motivation:* Disinformation, election interference, espionage - -*Capabilities:* - -* Unlimited budget -* Advanced technical skills -* Access to real identities -* Custom malware/exploits - -*Attack Vectors:* - -* Stolen identity databases -* Compromised verification sources -* Zero-day exploits -* Social engineering at scale - -*Threat Level:* HIGH (Most sophisticated adversary) - -==== 4. Platform Competitors - -*Motivation:* Sabotage, reputation damage - -*Capabilities:* - -* Significant budget -* Inside knowledge -* Legal teams - -*Attack Vectors:* - -* Patent warfare -* FUD campaigns -* Regulatory complaints -* Technical sabotage - -*Threat Level:* MEDIUM (Non-technical threat) - -==== 5. Ideological Actors - -*Motivation:* Political agenda, activism - -*Capabilities:* - -* Variable budget -* Coordinated groups -* Technical volunteers - -*Attack Vectors:* - -* Coordinated campaigns -* Social engineering -* Reputation attacks -* Protest disruption - -*Threat Level:* MEDIUM - -== Attack Vectors & Defenses - -=== AV-1: Mass Account Creation - -==== Attack Description - -*Goal:* Create thousands of accounts quickly to spam/manipulate - -*Methods:* - -* Automated registration scripts -* CAPTCHA solving services -* Email/phone number farms -* Credential stuffing - -==== STAMP Defenses - -[cols="1,2,1"] -|=== -|Defense Layer |Mechanism |Effectiveness - -|Multi-Source Verification -|Require 2+ independent sources (email + phone + biometric) -|90% - -|Time-Locked Reputation -|New accounts have limited capabilities -|95% - -|Rate Limiting -|Per-IP, per-network registration limits -|85% - -|Behavioral Analysis -|Detect automated registration patterns -|80% - -|Cost Asymmetry -|Each verification costs attacker money -|90% -|=== - -==== Formal Verification - -[source,idris] ----- --- Account creation requires multiple proofs -record NewAccount where - email : VerifiedEmail - phone : VerifiedPhone - {auto 0 sourcesIndependent : Independent email phone} - {auto 0 notBanned : NotInBanList email phone} - {auto 0 rateLimitOK : CreationsFrom phone.network < DailyLimit} - --- Cannot create account without all proofs --- Type system enforces at compile time ----- - -==== Residual Risk - -*Attack Still Possible If:* - -* Attacker controls large SIM farm + email providers -* Cost: $1-5 per account -* Mitigation: Behavioral analysis, graduated trust - -*Risk Level:* LOW - -* *Likelihood:* Medium (possible but expensive) -* *Impact:* Low (new accounts have limited capabilities) -* *Detection Time:* Minutes-Hours -* *Recovery:* Automated account suspension - -=== AV-2: Verification Source Compromise - -==== Attack Description - -*Goal:* Compromise verification provider to create fake verifications - -*Targets:* - -* Email providers (Gmail, Outlook) -* SMS gateways -* Biometric databases -* Social verification networks - -==== Attack Scenarios - -*Scenario 1: Email Provider Breach* - -1. Attacker compromises email provider API -2. Creates fake "verified" email addresses -3. Uses them to verify STAMP accounts - -*Scenario 2: SMS Gateway Hack* - -1. Attacker compromises SMS gateway -2. Intercepts verification codes -3. Verifies fake phone numbers - -*Scenario 3: Inside Job* - -1. Attacker bribes/compromises employee -2. Issues fake verifications -3. Sells verified accounts - -==== STAMP Defenses - -[cols="1,2,1"] -|=== -|Defense Layer |Mechanism |Effectiveness - -|Multi-Source Requirement -|Compromise of one source insufficient -|99% - -|Source Independence Proof -|Verify sources are truly independent -|90% - -|Cryptographic Auditing -|All verifications logged immutably -|95% - -|Statistical Anomaly Detection -|Detect unusual verification patterns -|85% - -|Source Reputation Tracking -|Downrank compromised sources -|90% -|=== - -==== Formal Verification - -[source,idris] ----- --- Sources must be provably independent -data SourceIndependence : VerificationSource -> VerificationSource -> Type where - Independent : - (s1 : VerificationSource) -> - (s2 : VerificationSource) -> - {auto 0 diffProvider : s1.provider /= s2.provider} -> - {auto 0 diffNetwork : s1.network /= s2.network} -> - {auto 0 diffOwnership : s1.owner /= s2.owner} -> - SourceIndependence s1 s2 - --- Cannot use related sources ----- - -==== Residual Risk - -*Attack Still Possible If:* - -* Attacker compromises 2+ independent sources simultaneously -* Probability: 0.1% × 0.1% = 0.01% (with 99% per-source security) - -*Risk Level:* VERY LOW - -* *Likelihood:* Very Low (requires multiple breaches) -* *Impact:* Medium (limited by time-locks) -* *Detection Time:* Hours-Days -* *Recovery:* Revoke compromised source, re-verify users - -=== AV-3: Identity Theft - -==== Attack Description - -*Goal:* Use stolen real identities to create verified fake accounts - -*Data Sources:* - -* Data breaches (Equifax, LinkedIn, etc.) -* Dark web markets -* Phishing campaigns -* Social engineering - -==== Attack Scenarios - -*Scenario 1: Credential Stuffing* - -1. Attacker obtains leaked email/password database -2. Tries credentials on STAMP-integrated platforms -3. Takes over existing verified accounts - -*Scenario 2: Document Forgery* - -1. Attacker obtains stolen ID documents -2. Creates deepfake photos matching ID -3. Passes KYC verification - -*Scenario 3: SIM Swap* - -1. Attacker socially engineers mobile carrier -2. Transfers victim's phone number to attacker SIM -3. Receives verification codes, takes over account - -==== STAMP Defenses - -[cols="1,2,1"] -|=== -|Defense Layer |Mechanism |Effectiveness - -|Liveness Detection -|Biometric must prove live human (not photo/video) -|98% - -|Behavioral Continuity -|Detect ownership change via behavior analysis -|85% - -|Device Fingerprinting -|Track device changes, flag suspicious transfers -|80% - -|Velocity Checks -|Limit verification attempts per identity -|90% - -|Cross-Platform Correlation -|Check if identity used on multiple platforms -|75% -|=== - -==== Formal Verification - -[source,idris] ----- --- Biometric verification requires liveness proof -record BiometricVerification where - biometricData : BiometricHash - livenessProof : LivenessChallenge - timestamp : Timestamp - - {auto 0 livenessPassed : VerifyLiveness livenessProof = Passed} - {auto 0 matchesDocument : BiometricMatch biometricData documentPhoto > Threshold} - {auto 0 notReplayed : timestamp = Now} -- Cannot replay old verification - --- Deepfakes and photos cannot pass liveness ----- - -==== Residual Risk - -*Attack Still Possible If:* - -* Attacker has victim's phone, biometrics, and documents -* Sophisticated deepfake technology advances -* Social engineering at telecom level - -*Risk Level:* MEDIUM - -* *Likelihood:* Low (requires significant resources) -* *Impact:* High (fully verified account) -* *Detection Time:* Days-Weeks -* *Recovery:* Account suspension, victim notification, identity recovery - -=== AV-4: Coordination & Astroturfing - -==== Attack Description - -*Goal:* Coordinate multiple real accounts to amplify message/manipulate discourse - -*Methods:* - -* Pay real users to post/vote -* Create "organic" seeming campaigns -* Gradual account aging to avoid detection - -==== Attack Scenarios - -*Scenario 1: Paid Coordination* - -1. Attacker recruits real users (Fiverr, clickfarms) -2. Each user creates real verified account -3. Coordinate posts/votes via private channel -4. Appears organic but is coordinated - -*Scenario 2: Sleeper Accounts* - -1. Create verified accounts months in advance -2. Build reputation slowly and organically -3. Activate all at once for coordinated campaign -4. One-time use, disposable - -==== STAMP Defenses - -[cols="1,2,1"] -|=== -|Defense Layer |Mechanism |Effectiveness - -|Statistical Correlation -|Detect similar posting times, targets, content -|85% - -|Network Analysis -|Graph analysis of account relationships -|90% - -|Behavioral Diversity -|Flag accounts with identical patterns -|80% - -|Content Analysis -|Detect copy-paste, similar phrasing -|75% - -|Temporal Analysis -|Detect synchronized bursts of activity -|85% -|=== - -==== Formal Verification - -[source,idris] ----- --- Detect coordinated behavior -data CoordinationScore : List Account -> Type where - Independent : - (accounts : List Account) -> - {auto 0 temporalDiversity : VarianceOf (map postTimes accounts) > MinVariance} -> - {auto 0 contentDiversity : SimilarityOf (map content accounts) < MaxSimilarity} -> - {auto 0 networkIndependence : Clustering accounts < MaxClustering} -> - CoordinationScore accounts Low - - Coordinated : - (accounts : List Account) -> - {auto 0 highCorrelation : Correlation accounts > Threshold} -> - CoordinationScore accounts High - --- If coordination detected, flag for review ----- - -==== Residual Risk - -*Attack Still Possible If:* - -* Well-resourced attacker recruits many real users -* Users coordinate manually (no digital footprint) -* Slow, organic-seeming campaigns - -*Risk Level:* MEDIUM - -* *Likelihood:* Medium (feasible with resources) -* *Impact:* Medium (limited by detection) -* *Detection Time:* Hours-Days -* *Recovery:* Flag coordinated accounts, reduce visibility - -=== AV-5: Economic/Resource Attacks - -==== Attack Description - -*Goal:* Overwhelm STAMP infrastructure or make it economically unviable - -*Methods:* - -* DDoS attacks on verification endpoints -* Cost amplification (expensive verifications) -* Resource exhaustion - -==== Attack Scenarios - -*Scenario 1: Verification DoS* - -1. Flood verification endpoints with requests -2. Exhaust API quotas with third-party services -3. Cause service degradation/outages - -*Scenario 2: Cost Amplification* - -1. Trigger expensive verifications repeatedly -2. Force platform to pay verification costs -3. Make STAMP economically unsustainable - -==== STAMP Defenses - -[cols="1,2,1"] -|=== -|Defense Layer |Mechanism |Effectiveness - -|Rate Limiting -|Per-IP, per-network verification limits -|95% - -|Proof of Work -|Require computational puzzle before verification -|90% - -|Tiered Verification -|Cheap verifications first, expensive only if needed -|85% - -|CDN/DDoS Protection -|Cloudflare, AWS Shield -|99% - -|Cost Caps -|Limit verification costs per account/platform -|90% -|=== - -==== Formal Verification - -[source,idris] ----- --- Verification cost is bounded -record VerificationCost where - source : VerificationSource - cost : Currency - - {auto 0 costBounded : cost <= MaxCostPerVerification} - {auto 0 totalCap : SumOf (userVerifications user) <= MaxCostPerUser} - --- Cannot exceed cost limits ----- - -==== Residual Risk - -*Attack Still Possible If:* - -* Massive distributed attack from legitimate-looking IPs -* Cost: $10k-100k to cause temporary disruption - -*Risk Level:* LOW - -* *Likelihood:* Low (expensive, temporary) -* *Impact:* Low (temporary degradation, not data loss) -* *Detection Time:* Minutes -* *Recovery:* Automated traffic shaping, rate limiting - -=== AV-6: Protocol Implementation Bugs - -==== Attack Description - -*Goal:* Exploit bugs in STAMP implementation to bypass verification - -*Bug Types:* - -* Logic errors in verification checks -* Race conditions -* Integer overflows -* Type confusion - -==== Attack Scenarios - -*Scenario 1: Verification Bypass* - -1. Find bug in verification logic -2. Craft input that passes verification incorrectly -3. Create verified account without real verification - -*Scenario 2: Privilege Escalation* - -1. Find bug in reputation calculation -2. Exploit to gain high reputation instantly -3. Bypass time-lock restrictions - -==== STAMP Defenses - -[cols="1,2,1"] -|=== -|Defense Layer |Mechanism |Effectiveness - -|Formal Verification (Idris2) -|Mathematical proofs of correctness -|99.9% - -|Type Safety -|Dependent types prevent entire bug classes -|99% - -|Fuzzing -|Automated testing with random inputs -|90% - -|Code Audit -|Third-party security audits -|85% - -|Bug Bounty -|Community-driven vulnerability discovery -|80% -|=== - -==== Formal Verification - -[source,idris] ----- --- Impossible to construct verified account without proofs --- This is guaranteed by Idris2 type system -data VerifiedAccount : Type where - MkVerified : - (id : AccountId) -> - (sources : List VerificationSource) -> - {auto 0 multiSource : length sources >= 2} -> - {auto 0 sourcesValid : All VerifySource sources} -> - {auto 0 sourcesIndependent : Independent sources} -> - VerifiedAccount - --- Bug: Verification bypass --- Cannot happen: Type system prevents compilation ----- - -==== Why Formal Verification Matters - -*Traditional Code (Rust/Go):* - -[source,rust] ----- -struct VerifiedAccount { - sources: Vec, - is_verified: bool, // ❌ Can be set to true without checking sources! -} - -// Bug possible: -let fake = VerifiedAccount { - sources: vec![], - is_verified: true, // ← Oops, verified with no sources -}; ----- - -*STAMP (Idris2):* - -[source,idris] ----- --- Literally impossible to compile: -badAccount : VerifiedAccount -badAccount = MkVerified someId [] --- Error: Cannot satisfy proof: length [] >= 2 --- Code won't even compile! ----- - -==== Residual Risk - -*Attack Still Possible If:* - -* Bug in Idris2 compiler itself (extremely rare) -* Bug in FFI layer (Zig implementation) -* Misuse of STAMP library by platform - -*Risk Level:* VERY LOW - -* *Likelihood:* Very Low (formal verification is highly reliable) -* *Impact:* High if exploited -* *Detection Time:* Variable -* *Recovery:* Patch, re-verify affected accounts - -=== AV-7: Supply Chain Attacks - -==== Attack Description - -*Goal:* Compromise STAMP development/distribution to inject malicious code - -*Targets:* - -* STAMP repository (GitHub) -* Dependencies (Idris2, Zig, libraries) -* Distribution channels (npm, crates.io) -* Build infrastructure - -==== Attack Scenarios - -*Scenario 1: Dependency Poisoning* - -1. Compromise upstream dependency -2. Inject backdoor into STAMP builds -3. Backdoor deployed to all platforms using STAMP - -*Scenario 2: Repository Compromise* - -1. Compromise developer account -2. Push malicious commit to STAMP -3. Signed with trusted key, appears legitimate - -==== STAMP Defenses - -[cols="1,2,1"] -|=== -|Defense Layer |Mechanism |Effectiveness - -|Minimal Dependencies -|Few external dependencies to audit -|90% - -|Reproducible Builds -|Verify builds match source exactly -|95% - -|Signed Commits -|All commits GPG-signed by maintainers -|85% - -|Multi-Party Review -|Require 2+ maintainer approval -|90% - -|Security Scanning -|Automated CVE/malware scanning -|80% - -|Isolated Build Environment -|Builds in sandboxed containers -|85% -|=== - -==== Security Measures - -*Dependency Management* - -[source,yaml] ----- -# Only allow vetted, audited dependencies -dependencies: - idris2: "= 0.7.0" # Exact version pinning - zig: "= 0.13.0" - # No transitive dependencies allowed - # Everything manually vetted ----- - -*Build Verification* - -[source,bash] ----- -# Reproducible builds -# Anyone can verify: -git clone https://github.com/hyperpolymath/libstamp -cd libstamp -./build.sh --reproducible -sha256sum lib/libstamp.so -# Hash must match published hash ----- - -==== Residual Risk - -*Attack Still Possible If:* - -* Sophisticated state-sponsored attack -* Compromise of multiple maintainer accounts simultaneously -* Zero-day in build toolchain - -*Risk Level:* LOW - -* *Likelihood:* Very Low (requires sophisticated attack) -* *Impact:* Critical (if successful) -* *Detection Time:* Days-Weeks -* *Recovery:* Revoke compromised release, rebuild from source - -=== AV-8: Social Engineering - -==== Attack Description - -*Goal:* Manipulate humans to bypass technical controls - -*Targets:* - -* Platform administrators -* STAMP maintainers -* Verification source employees -* End users - -==== Attack Scenarios - -*Scenario 1: Admin Impersonation* - -1. Attacker impersonates platform admin -2. Contacts STAMP support requesting special access -3. Gains elevated privileges - -*Scenario 2: Phishing* - -1. Phish verification source employee -2. Gain access to verification system -3. Issue fake verifications - -*Scenario 3: User Deception* - -1. Convince user to "verify" attacker's account -2. Use social verification loophole -3. Gain trusted status - -==== STAMP Defenses - -[cols="1,2,1"] -|=== -|Defense Layer |Mechanism |Effectiveness - -|No Manual Overrides -|All verifications automated, no admin bypass -|95% - -|Rate Limits on Social Verification -|Limit vouching frequency per user -|85% - -|Audit Logging -|All administrative actions logged immutably -|90% - -|Multi-Factor Authentication -|Require MFA for all admin access -|90% - -|User Education -|Clear warnings about verification scams -|70% -|=== - -==== Formal Verification - -[source,idris] ----- --- No "god mode" or manual overrides --- All verifications must go through proofs -data AdminAction : Type where - -- Admins can only: - ViewLogs : AdminAction - SuspendAccount : AccountId -> Reason -> AdminAction - -- Cannot: - -- GrantVerification : AccountId -> AdminAction -- ❌ Doesn't exist! - --- Even admins cannot bypass verification proofs ----- - -==== Residual Risk - -*Attack Still Possible If:* - -* Sophisticated spearphishing campaign -* Insider threat (malicious employee) -* User gullibility at scale - -*Risk Level:* MEDIUM - -* *Likelihood:* Medium (humans are weakest link) -* *Impact:* Medium (limited by technical controls) -* *Detection Time:* Hours-Days -* *Recovery:* Revoke affected verifications, user notification - -== Cross-Cutting Concerns - -=== Privacy & GDPR Compliance - -==== Threats - -* Data breaches exposing verification data -* Surveillance via verification metadata -* Cross-platform tracking - -==== Defenses - -* Zero-knowledge proofs (prove property without revealing data) -* Encrypted storage of PII -* Data minimization (only store necessary data) -* Right to erasure (GDPR Article 17) -* Audit logs for compliance - -==== Implementation - -[source,idris] ----- --- Prove age without revealing birthdate -data AgeProof : Type where - OverThreshold : - (commitment : Commitment Birthdate) -> - (proof : ZKProof "age >= 18") -> - AgeProof - --- Platform receives: "User is over 18" --- Platform does NOT receive: Actual birthdate ----- - -=== Availability & Reliability - -==== Threats - -* Infrastructure outages -* Network partitions -* Database corruption - -==== Defenses - -* Multi-region deployment -* Read replicas for verification queries -* Offline verification mode (cached proofs) -* Graceful degradation - -=== Regulatory & Legal - -==== Threats - -* Regulatory capture by incumbents -* Patent trolls -* Liability for platform misconduct - -==== Defenses - -* Open source (AGPL-3.0) -* Defensive patent strategy -* Clear liability boundaries in ToS -* Regulatory compliance (DSA, GDPR, CAN-SPAM) - -== Risk Matrix - -[cols="1,1,1,1,2"] -|=== -|Threat |Likelihood |Impact |Risk Level |Mitigation Priority - -|Mass Bot Creation -|High -|Critical -|High -|✅ Mitigated (time-locks) - -|Verification Compromise -|Low -|Critical -|Medium -|✅ Mitigated (multi-source) - -|Identity Theft -|Medium -|High -|Medium -|🔶 Partially mitigated (liveness) - -|Coordination -|Medium -|Medium -|Medium -|🔶 Partially mitigated (detection) - -|Economic Attacks -|Low -|Low -|Low -|✅ Mitigated (rate limits) - -|Protocol Bugs -|Very Low -|High -|Low -|✅ Mitigated (formal verification) - -|Supply Chain -|Very Low -|Critical -|Medium -|🔶 Ongoing (reproducible builds) - -|Social Engineering -|Medium -|Medium -|Medium -|⚠️ Requires vigilance -|=== - -== Incident Response Plan - -=== Detection - -*Automated Monitoring:* - -* Anomaly detection on verification patterns -* Statistical correlation analysis -* Failed verification rate tracking -* Platform integration health checks - -*Alerting Thresholds:* - -* Failed verifications > 10% baseline -* Coordination score > 0.8 for account cluster -* Verification source error rate > 5% -* API error rate > 1% - -=== Response Procedures - -*Severity Levels:* - -[cols="1,2,2,1"] -|=== -|Level |Example |Response Time |Actions - -|P0 - Critical -|Verification bypass discovered -|< 1 hour -|Immediate patch, all-hands - -|P1 - High -|Verification source compromised -|< 4 hours -|Disable source, notify users - -|P2 - Medium -|Coordination campaign detected -|< 24 hours -|Flag accounts, investigate - -|P3 - Low -|Elevated bot activity -|< 1 week -|Monitor, adjust thresholds -|=== - -*Escalation Path:* - -1. On-call engineer notified -2. Incident commander assigned (P0/P1) -3. Stakeholders notified (platforms, users) -4. Post-mortem within 48 hours - -=== Recovery - -*Steps:* - -1. Contain the threat (disable compromised component) -2. Investigate root cause -3. Develop and test fix -4. Deploy fix with rollback plan -5. Notify affected parties -6. Post-mortem and lessons learned - -== Long-Term Threat Evolution - -=== Emerging Threats (2027-2030) - -==== AI-Generated Personas - -*Threat:* Advanced AI creates realistic human-like personas - -*Defense:* - -* Deeper behavioral analysis -* Multi-modal verification (video calls) -* Turing test 2.0 (human-only challenges) - -==== Quantum Computing - -*Threat:* Quantum computers break cryptographic proofs - -*Defense:* - -* Migrate to post-quantum cryptography -* Lattice-based signatures -* Hash-based proofs - -==== Deepfake Biometrics - -*Threat:* Perfect biometric spoofing - -*Defense:* - -* Advanced liveness detection -* Multi-factor biometrics -* Behavioral biometrics - -==== Decentralized Identity - -*Threat:* Users want self-sovereign identity, not platform-controlled - -*Defense:* - -* Integrate with W3C DIDs -* Blockchain-based verification -* User-controlled credentials - -== Conclusion - -=== Summary - -*STAMP Protocol has strong defenses against current threats:* - -* ✅ Mass bot creation: 95% effective -* ✅ Verification bypass: 99% effective -* 🔶 Identity theft: 85% effective -* 🔶 Coordination: 85% effective -* ✅ Protocol bugs: 99.9% effective - -*Key Strengths:* - -1. *Formal verification* eliminates entire bug classes -2. *Multi-source verification* prevents single point of failure -3. *Time-locked reputation* makes spam economically unviable -4. *Mathematical proofs* provide unprecedented assurance - -*Residual Risks:* - -1. Sophisticated identity theft (mitigated by liveness detection) -2. Well-resourced coordination attacks (detected statistically) -3. Social engineering (requires ongoing vigilance) - -*Overall Security Posture:* **STRONG** - -STAMP provides the most secure anti-spam/bot solution available, with mathematical guarantees impossible in traditional systems. - -=== Recommendations - -*For Platforms Adopting STAMP:* - -1. Implement all recommended verification sources -2. Monitor for coordination patterns -3. Regular security audits -4. User education on social engineering -5. Incident response plan in place - -*For STAMP Development:* - -1. Maintain formal verification rigor -2. Regular third-party audits -3. Active bug bounty program -4. Reproducible builds for all releases -5. Defensive patent strategy - -*For Regulators:* - -1. STAMP provides auditable compliance -2. Mathematical proofs enable verification -3. Consider STAMP for DSA compliance certification -4. Privacy-preserving design meets GDPR - -== Appendix: Threat Modeling Methodology - -*Framework Used:* STRIDE + Attack Trees - -*STRIDE Categories:* - -* **S**poofing (Identity theft, fake accounts) -* **T**ampering (Protocol exploits, data manipulation) -* **R**epudiation (Audit logging, non-repudiation) -* **I**nformation Disclosure (Privacy breaches) -* **D**enial of Service (Resource exhaustion) -* **E**levation of Privilege (Admin access, bypass) - -*Analysis Process:* - -1. Enumerate assets (verification data, user accounts, platform integration) -2. Identify threats per STRIDE category -3. Assess likelihood and impact -4. Design defenses -5. Formal verification of critical defenses -6. Residual risk analysis -7. Incident response planning - -*Review Cadence:* - -* Quarterly threat model review -* Annual comprehensive security audit -* Ad-hoc reviews for new features -* Post-incident updates - ---- - -*Document Version:* 1.0 -*Last Updated:* 2026-01-30 -*Next Review:* 2026-04-30 diff --git a/avow-protocol/BINDING.adoc b/avow-protocol/BINDING.adoc new file mode 100644 index 00000000..eb2aad6d --- /dev/null +++ b/avow-protocol/BINDING.adoc @@ -0,0 +1,47 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell += avow-protocol — thin binding +:toc: + +This directory is NOT a copy of the avow-protocol codebase. It is a +pointer. Do not add protocol text, source, docs, or templates here — +they belong in the canonical repo below. + +== Canonical repository + +https://github.com/hyperpolymath/avow-protocol[hyperpolymath/avow-protocol] +is the single source of truth for all avow-protocol content: protocol +spec, source, docs, tests, and governance. + +== Standards this component opts into + +* `LICENCE-POLICY.adoc` — canonical MPL-2.0 (code) / CC-BY-SA-4.0 (docs) pair +* Reusable CI workflows: Scorecard, Hypatia scan, Governance bundle +* `.machine_readable/contractiles/` obligation-typing convention + +== Known gaps (tracked, not fixed by this binding) + +* The real repo's `.machine_readable/6a2/` has not yet migrated to + `descriptiles` per the estate naming mandate (2026-06-30). Tracked + debt in the real repo, out of scope here. + +== History + +Prior to 2026-07-02 this directory held a full duplicate of the +avow-protocol codebase that had genuinely diverged from the real repo +(roughly a week apart in currency). The duplicate was removed as part +of the standards thin-binding pilot +(`dev-notes/handoffs/2026-07-02-standards-thin-binding-pilot-handoff.md`). + +Before removal, the nested copy was diffed against the real repo in +full. One piece of unique content had no home in the real repo: +`avow-lib/` (Idris2 formal-verification tests, ABI source, Zig FFI). +It was migrated to the real repo first, so it wasn't discarded: +https://github.com/hyperpolymath/avow-protocol/pull/24 + +Everything else unique to the old nested copy was confirmed superseded +by later work in the real repo (AffineScript `.affine` sources replaced +by ReScript `.res` equivalents, `README.adoc` converted to `README.md`, +local issue templates retired in favour of the org's `.github` canon) +or was unrendered RSR template scaffold with no real content +(`{{PROJECT}}` placeholders, never instantiated). diff --git a/avow-protocol/CLOUDFLARE-MANUAL-SETUP.md b/avow-protocol/CLOUDFLARE-MANUAL-SETUP.md deleted file mode 100644 index 1fc032c0..00000000 --- a/avow-protocol/CLOUDFLARE-MANUAL-SETUP.md +++ /dev/null @@ -1,500 +0,0 @@ -# SPDX-License-Identifier: CC-BY-SA-4.0 -# Cloudflare Manual Setup - Detailed Step-by-Step Instructions - -Complete visual guide for deploying AVOW Protocol to Cloudflare via dashboard. - -## Table of Contents - -1. [Prerequisites](#prerequisites) -2. [Part 1: Cloudflare Pages Setup](#part-1-cloudflare-pages-setup) -3. [Part 2: DNS Configuration](#part-2-dns-configuration) -4. [Part 3: Security Configuration](#part-3-security-configuration) -5. [Part 4: Zero Trust Setup](#part-4-zero-trust-setup) -6. [Part 5: Testing & Verification](#part-5-testing--verification) - ---- - -## Prerequisites - -- [ ] Cloudflare account (free or paid) -- [ ] Domain `avow-protocol.org` added to Cloudflare -- [ ] GitHub repository `hyperpolymath/avow-protocol` accessible -- [ ] Repository pushed to main branch - ---- - -## Part 1: Cloudflare Pages Setup - -### Step 1.1: Access Cloudflare Pages - -1. Log in to [Cloudflare Dashboard](https://dash.cloudflare.com) -2. Click on your account in the top left -3. In the left sidebar, click **"Workers & Pages"** -4. Click **"Create application"** button -5. Select **"Pages"** tab -6. Click **"Connect to Git"** - -### Step 1.2: Connect GitHub Repository - -1. Click **"Connect GitHub"** (or "Connect another repository" if already connected) -2. Authorize Cloudflare to access your repositories -3. In the repository list, find and select: **`hyperpolymath/avow-protocol`** -4. Click **"Begin setup"** - -### Step 1.3: Configure Build Settings - -On the "Set up builds and deployments" page: - -**Framework preset:** None (or Custom) - -**Build configuration:** -- Build command: `deno task build` -- Build output directory: `.` (just a dot) -- Root directory: `/` (leave as default) - -**Environment variables:** (click "Add variable" if needed) -- None required for initial deployment - -**Branch deployment:** -- Production branch: `main` -- Preview branch: Leave enabled for pull requests - -Click **"Save and Deploy"** - -### Step 1.4: Wait for Initial Build - -- Watch the build logs in real-time -- Initial build takes 2-5 minutes -- Look for: `✅ Success! Deployed to https://avow-protocol-xxx.pages.dev` -- Copy the `.pages.dev` URL for testing - -**If build fails:** -- Check that all dependencies are in `package.json` -- Verify `deno.json` has correct build task -- Check build logs for specific errors - -### Step 1.5: Verify Initial Deployment - -1. Click the `.pages.dev` URL from build logs -2. Verify the site loads correctly -3. Check browser console for any errors (F12 → Console) -4. Test navigation between pages - ---- - -## Part 2: DNS Configuration - -### Step 2.1: Access DNS Settings - -1. In Cloudflare Dashboard, click on **`avow-protocol.org`** domain -2. Click **"DNS"** in the left sidebar -3. You'll see the DNS records table - -### Step 2.2: Import DNS Zone (Recommended) - -**Option A: Bulk Import** - -1. Click **"Advanced"** at top right -2. Click **"Import and export"** -3. Click **"Import DNS records"** -4. Copy contents from `cloudflare-dns-zone.txt` -5. Paste into the text box -6. Click **"Preview records"** -7. Review the records to be imported -8. Click **"Import"** - -**Option B: Manual Entry** (if import fails) - -Add these critical records manually: - -#### Root Domain Records - -| Type | Name | Content | Proxy | TTL | -|------|------|---------|-------|-----| -| A | @ | 192.0.2.1 | ✅ Proxied | Auto | -| AAAA | @ | 2001:db8::1 | ✅ Proxied | Auto | -| A | www | 192.0.2.1 | ✅ Proxied | Auto | -| AAAA | www | 2001:db8::1 | ✅ Proxied | Auto | - -**⚠️ Update IPs:** Replace `192.0.2.1` and `2001:db8::1` with your actual IPs (or leave if using Cloudflare Pages) - -#### GitHub Pages CNAME (if using GitHub Pages) - -| Type | Name | Content | Proxy | TTL | -|------|------|---------|-------|-----| -| CNAME | gh-pages | hyperpolymath.github.io | ❌ DNS only | Auto | - -#### Security Records - -| Type | Name | Content | -|------|------|---------| -| CAA | @ | `0 issue "letsencrypt.org"` | -| CAA | @ | `0 issue "digicert.com"` | -| CAA | @ | `0 iodef "mailto:j.d.a.jewell@open.ac.uk"` | -| TXT | @ | `v=spf1 include:_spf.github.com ~all` | -| TXT | @ | `github-pages-challenge-hyperpolymath=avow-protocol-verification` | - -#### Mail Security (Optional) - -| Type | Name | Content | -|------|------|---------| -| TXT | _dmarc | `v=DMARC1; p=reject; rua=mailto:j.d.a.jewell@open.ac.uk` | -| MX | @ | `10 mail.avow-protocol.org` | - -### Step 2.3: Configure Custom Domain for Pages - -1. Go back to **Workers & Pages** → **avow-protocol** project -2. Click **"Custom domains"** tab -3. Click **"Set up a custom domain"** -4. Enter: `avow-protocol.org` -5. Click **"Continue"** -6. Cloudflare will automatically create DNS records -7. Wait for "Active" status (1-5 minutes) -8. Repeat for `www.avow-protocol.org` - -### Step 2.4: Enable DNSSEC - -1. In domain settings, click **"DNS"** -2. Scroll to **"DNSSEC"** section -3. Click **"Enable DNSSEC"** -4. Copy the DS record information -5. Add DS record to your domain registrar (if required) - ---- - -## Part 3: Security Configuration - -### Step 3.1: Configure Security Headers - -1. In domain overview, click **"Rules"** in left sidebar -2. Click **"Transform Rules"** -3. Click **"Create rule"** -4. Rule name: `AVOW Security Headers` - -**When incoming requests match:** -- Select: "All incoming requests" - -**Then:** -- Click "Set static" → "Response header" -- Add these headers one by one: - -| Header | Value | -|--------|-------| -| Strict-Transport-Security | `max-age=63072000; includeSubDomains; preload` | -| X-Content-Type-Options | `nosniff` | -| X-Frame-Options | `DENY` | -| X-XSS-Protection | `1; mode=block` | -| Content-Security-Policy | `default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'` | -| Referrer-Policy | `strict-origin-when-cross-origin` | -| Permissions-Policy | `geolocation=(), microphone=(), camera=()` | - -5. Click **"Deploy"** - -### Step 3.2: Configure WAF Rules - -1. In left sidebar, click **"Security"** → **"WAF"** -2. Click **"Create rule"** - -**Rate Limiting - API Endpoints:** -- Rule name: `API Rate Limit` -- If: `URI Path contains "/api/"` -- Then: Rate limit -- Requests: 100 per minute -- Action: Block -- Duration: 600 seconds - -**Rate Limiting - General:** -- Rule name: `General Rate Limit` -- If: `All incoming requests` -- Then: Rate limit -- Requests: 1000 per minute -- Action: Challenge (CAPTCHA) - -3. Click **"Deploy"** - -### Step 3.3: Enable SSL/TLS - -1. Click **"SSL/TLS"** in left sidebar -2. Set encryption mode to: **"Full (strict)"** -3. Click **"Edge Certificates"** -4. Enable: - - ✅ Always Use HTTPS - - ✅ HTTP Strict Transport Security (HSTS) - - ✅ Minimum TLS Version: TLS 1.3 - - ✅ TLS 1.3 (Post-Quantum) - - ✅ Automatic HTTPS Rewrites - -### Step 3.4: Configure Firewall Rules - -1. Go to **Security** → **WAF** -2. Click **"Custom rules"** tab -3. Add these rules: - -**Block Bad Bots:** -``` -(cf.client.bot) and not (cf.verified_bot_category in {"Search Engine Crawler" "Monitoring & Analytics"}) -Action: Block -``` - -**Require Valid Referer for POST:** -``` -(http.request.method eq "POST") and not (http.referer contains "avow-protocol.org") -Action: Block -``` - ---- - -## Part 4: Zero Trust Setup - -### Step 4.1: Create Cloudflare Tunnel - -1. In Cloudflare Dashboard, go to **Zero Trust** -2. Click **"Networks"** → **"Tunnels"** -3. Click **"Create a tunnel"** -4. Tunnel name: `avow-protocol-tunnel` -5. Click **"Save tunnel"** -6. Copy the tunnel token (you'll need this) - -### Step 4.2: Install cloudflared - -On your server: - -```bash -# Install cloudflared -curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 -o cloudflared -chmod +x cloudflared -sudo mv cloudflared /usr/local/bin/ - -# Authenticate -cloudflared tunnel login - -# Create tunnel -cloudflared tunnel create avow-protocol - -# Configure tunnel -cat > ~/.cloudflared/config.yml < -credentials-file: /path/to/credentials.json - -ingress: - - hostname: dashboard.internal.avow-protocol.org - service: http://localhost:3000 - - hostname: ci.internal.avow-protocol.org - service: http://localhost:8080 - - service: http_status:404 -EOF - -# Run tunnel -cloudflared tunnel run avow-protocol -``` - -### Step 4.3: Add DNS Records for Tunnel - -In Cloudflare DNS, add: - -| Type | Name | Content | -|------|------|---------| -| CNAME | dashboard.internal | `.cfargotunnel.com` | -| CNAME | ci.internal | `.cfargotunnel.com` | - -### Step 4.4: Configure Access Policies - -1. Go to **Zero Trust** → **Access** → **Applications** -2. Click **"Add an application"** -3. Select **"Self-hosted"** -4. Application name: `AVOW Internal Dashboard` -5. Session duration: 24 hours -6. Application domain: `dashboard.internal.avow-protocol.org` -7. Click **"Next"** - -**Add policy:** -- Policy name: `AVOW Team Access` -- Action: Allow -- Include: Emails: `j.d.a.jewell@open.ac.uk` -- Click **"Next"** → **"Add application"** - ---- - -## Part 5: Testing & Verification - -### Step 5.1: Test HTTPS and SSL - -```bash -# Test SSL certificate -curl -I https://avow-protocol.org - -# Check for HSTS header -curl -I https://avow-protocol.org | grep -i strict - -# Test HTTP → HTTPS redirect -curl -I http://avow-protocol.org - -# Test TLS 1.3 -openssl s_client -connect avow-protocol.org:443 -tls1_3 -``` - -### Step 5.2: Test Security Headers - -```bash -# Check all security headers -curl -I https://avow-protocol.org | grep -E "(X-|Content-Security|Strict-Transport)" -``` - -Expected headers: -- ✅ Strict-Transport-Security -- ✅ X-Content-Type-Options: nosniff -- ✅ X-Frame-Options: DENY -- ✅ Content-Security-Policy - -### Step 5.3: Test DNS Records - -```bash -# Test DNSSEC -dig +dnssec avow-protocol.org - -# Test CAA records -dig CAA avow-protocol.org - -# Test SPF -dig TXT avow-protocol.org | grep spf -``` - -### Step 5.4: Test Performance - -1. **Lighthouse Audit:** - - Open Chrome DevTools (F12) - - Click "Lighthouse" tab - - Click "Generate report" - - Target scores: 95+ for all categories - -2. **WebPageTest:** - - Go to https://www.webpagetest.org - - Enter: `https://avow-protocol.org` - - Run test - - Check CDN performance - -3. **SSL Labs:** - - Go to https://www.ssllabs.com/ssltest/ - - Enter: `avow-protocol.org` - - Target grade: A+ - -### Step 5.5: Functional Testing - -Manual testing checklist: - -- [ ] Home page loads correctly -- [ ] All navigation links work -- [ ] Interactive demo functions -- [ ] Forms submit properly -- [ ] No console errors (F12 → Console) -- [ ] Mobile responsive (F12 → Device toolbar) -- [ ] All assets load (images, CSS, JS) -- [ ] No mixed content warnings - ---- - -## Troubleshooting - -### DNS Not Propagating - -```bash -# Check current DNS -dig avow-protocol.org - -# Flush local DNS cache (Linux) -sudo systemctl restart systemd-resolved - -# Or (macOS) -sudo dscacheutil -flushcache -``` - -### SSL Certificate Issues - -1. Check Cloudflare SSL mode: must be "Full (strict)" -2. Verify origin certificate on server -3. Wait 5-10 minutes for certificate provisioning -4. Clear browser cache and cookies - -### Build Failures - -1. Check build logs in Pages dashboard -2. Verify `deno.json` build command -3. Test build locally: `deno task build` -4. Check for missing dependencies in `package.json` - -### Rate Limiting Too Aggressive - -1. Go to Security → WAF → Custom rules -2. Adjust rate limits: - - Increase requests per minute - - Change action to "Challenge" instead of "Block" - ---- - -## Post-Deployment Checklist - -- [ ] Custom domain configured and active -- [ ] DNS records imported and verified -- [ ] DNSSEC enabled -- [ ] SSL/TLS set to Full (strict) -- [ ] Security headers configured -- [ ] WAF rules deployed -- [ ] Rate limiting configured -- [ ] Zero Trust tunnel created (optional) -- [ ] Access policies configured (optional) -- [ ] All tests passing -- [ ] Lighthouse score 95+ -- [ ] SSL Labs grade A+ -- [ ] No console errors -- [ ] Mobile responsive verified - ---- - -## Monitoring & Maintenance - -### Daily - -- Check Cloudflare Analytics for traffic patterns -- Review Security Events for blocked requests -- Monitor error rates in Real-time logs - -### Weekly - -- Review WAF rule effectiveness -- Check certificate expiration dates (auto-renewed) -- Update DNS records if IPs changed - -### Monthly - -- Run Lighthouse audit -- Run SSL Labs test -- Update security headers if needed -- Review Zero Trust policies - ---- - -## Support - -**Documentation:** -- Cloudflare Pages: https://developers.cloudflare.com/pages/ -- Cloudflare DNS: https://developers.cloudflare.com/dns/ -- Cloudflare Tunnel: https://developers.cloudflare.com/cloudflare-one/ - -**Contact:** -- Jonathan D.A. Jewell: j.d.a.jewell@open.ac.uk -- GitHub Issues: https://github.com/hyperpolymath/avow-protocol/issues - ---- - -## Complete! 🎉 - -Your AVOW Protocol site is now deployed with: -- ✅ Global CDN (Cloudflare) -- ✅ Post-quantum TLS 1.3 -- ✅ DNSSEC enabled -- ✅ Security headers configured -- ✅ WAF protection active -- ✅ Rate limiting enabled -- ✅ Zero Trust ready (optional) - -Visit: https://avow-protocol.org diff --git a/avow-protocol/CLOUDFLARE-SETUP.md b/avow-protocol/CLOUDFLARE-SETUP.md deleted file mode 100644 index 3b3622f3..00000000 --- a/avow-protocol/CLOUDFLARE-SETUP.md +++ /dev/null @@ -1,208 +0,0 @@ -# SPDX-License-Identifier: CC-BY-SA-4.0 -# Cloudflare Setup Guide for avow-protocol.org - -## Prerequisites - -- Cloudflare account with avow-protocol.org domain -- GitHub repository: hyperpolymath/avow-protocol -- Cloudflare API credentials - -## Step 1: DNS Configuration - -1. Import DNS zone file: - ```bash - # Review the zone file - cat cloudflare-dns-zone.txt - - # Apply via Cloudflare Dashboard or API - ``` - -2. Update placeholder values: - - Replace `192.0.2.1` with actual origin IP - - Replace `2001:db8::1` with actual IPv6 - - Update `tunnel-id` with your Cloudflare Tunnel ID - - Update SSHFP fingerprints with actual SSH keys - - Update TLSA records with actual certificate hashes - -## Step 2: GitHub Pages Setup - -1. In GitHub repository settings: - - Enable GitHub Pages from `main` branch - - Set custom domain: `avow-protocol.org` - - Wait for GitHub verification - -2. Add GitHub verification TXT record: - ``` - github-pages-challenge-hyperpolymath=avow-protocol-verification - ``` - -## Step 3: Cloudflare Pages Setup - -Alternative to GitHub Pages for better integration: - -1. Connect repository to Cloudflare Pages: - - Build command: `deno task build` - - Output directory: `.` (root) - - Environment variables: None required - -2. Configure custom domain: - - Add `avow-protocol.org` as custom domain - - Enable automatic HTTPS - -## Step 4: Security Headers - -Add security headers via Cloudflare Transform Rules: - -```http -Strict-Transport-Security: max-age=63072000; includeSubDomains; preload -X-Content-Type-Options: nosniff -X-Frame-Options: DENY -X-XSS-Protection: 1; mode=block -Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' -Referrer-Policy: strict-origin-when-cross-origin -Permissions-Policy: geolocation=(), microphone=(), camera=() -``` - -## Step 5: Zero Trust/SDP Configuration - -For internal services (dashboard.internal, ci.internal, db.internal): - -1. Create Cloudflare Tunnel: - ```bash - cloudflared tunnel create avow-protocol - ``` - -2. Configure tunnel routes: - ```yaml - # config.yml - tunnel: - credentials-file: /path/to/credentials.json - - ingress: - - hostname: dashboard.internal.avow-protocol.org - service: http://localhost:3000 - - hostname: ci.internal.avow-protocol.org - service: http://localhost:8080 - - hostname: db.internal.avow-protocol.org - service: tcp://localhost:5432 - - service: http_status:404 - ``` - -3. Set up Cloudflare Access: - - Create Access policy for internal subdomains - - Configure authentication (SAML, GitHub OAuth, etc.) - - Enforce MFA - -## Step 6: WAF Rules - -Configure Web Application Firewall rules: - -1. Rate limiting: - - API endpoints: 100 requests/minute per IP - - General pages: 1000 requests/minute per IP - -2. Custom rules: - - Block known bad user agents - - Require valid Referer for POST requests - - Block requests with suspicious patterns - -## Step 7: WASM Proxy - -Deploy WASM-based request filtering: - -1. Create Workers script: - ```javascript - // wasm-proxy.js - export default { - async fetch(request, env) { - // Load AVOW verification WASM module - const wasmModule = await WebAssembly.instantiate(env.AVOW_WASM); - - // Validate request using WASM - const isValid = await wasmModule.exports.validateRequest(request); - - if (!isValid) { - return new Response('Invalid request', { status: 403 }); - } - - return await fetch(request); - } - }; - ``` - -2. Deploy Worker: - ```bash - wrangler deploy - ``` - -3. Configure route: - - Route: `wasm.avow-protocol.org/*` - - Worker: `avow-wasm-proxy` - -## Step 8: Post-Quantum TLS - -Cloudflare automatically supports post-quantum key exchange (Kyber) for TLS 1.3. - -Verify configuration: -```bash -curl -I --tlsv1.3 https://avow-protocol.org -``` - -Look for: `CF-QUIC` and `Alt-Svc: h3=":443"` headers - -## Step 9: Monitoring and Alerts - -1. Enable Cloudflare Analytics -2. Set up alerts for: - - High error rates (4xx, 5xx) - - DDoS attacks - - Certificate expiration - - DNS changes - -## Step 10: Testing - -Test all security configurations: - -```bash -# Test HTTPS redirect -curl -I http://avow-protocol.org - -# Test security headers -curl -I https://avow-protocol.org - -# Test DNSSEC -dig +dnssec avow-protocol.org - -# Test CAA records -dig CAA avow-protocol.org - -# Test TLSA records -dig TLSA _443._tcp.avow-protocol.org - -# Test MTA-STS -dig TXT _mta-sts.avow-protocol.org -``` - -## Maintenance - -- Update DNS zone serial on changes: `YYYYMMDDNN` format -- Rotate TLSA records 30 days before certificate renewal -- Review WAF rules quarterly -- Update security requirements as standards evolve - -## References - -- [Cloudflare DNS](https://developers.cloudflare.com/dns/) -- [Cloudflare Pages](https://developers.cloudflare.com/pages/) -- [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/) -- [Cloudflare Workers](https://developers.cloudflare.com/workers/) -- [Post-Quantum Cryptography](https://blog.cloudflare.com/post-quantum-tls/) - -## Security Requirements - -See `security-requirements.scm` for detailed cryptographic requirements including: -- Dilithium5-AES signatures -- Kyber-1024 key exchange -- SHAKE3-512 hashing -- XChaCha20-Poly1305 encryption -- Idris2 formal verification diff --git a/avow-protocol/CNAME b/avow-protocol/CNAME deleted file mode 100644 index dc26d7d6..00000000 --- a/avow-protocol/CNAME +++ /dev/null @@ -1 +0,0 @@ -stamp-protocol.org diff --git a/avow-protocol/CODE_OF_CONDUCT.md b/avow-protocol/CODE_OF_CONDUCT.md deleted file mode 100644 index 98dab488..00000000 --- a/avow-protocol/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,32 +0,0 @@ -# Stamp Protocol Code of Conduct - -Like the technical community as a whole, the Stamp Protocol team and community is made up of a mixture of professionals and volunteers from all over the world, working on every aspect of the mission - including mentorship, teaching, and connecting people. - -Diversity is one of our huge strengths, but it can also lead to communication issues and unhappiness. To that end, we have a few ground rules that we ask people to adhere to. This code applies equally to founders, mentors and those seeking help and guidance. - -This isn’t an exhaustive list of things that you can’t do. Rather, take it in the spirit in which it’s intended - a guide to make it easier to enrich all of us and the technical communities in which we participate. - -This code of conduct applies to all spaces managed by the Stamp Protocol project or . This includes IRC, the mailing lists, the issue tracker, DSF events, and any other forums created by the project team which the community uses for communication. In addition, violations of this code outside these spaces may affect a person's ability to participate within them. - -If you believe someone is violating the code of conduct, we ask that you report it by emailing [](mailto:). For more details please see our - -- **Be friendly and patient.** -- **Be welcoming.** We strive to be a community that welcomes and supports people of all backgrounds and identities. This includes, but is not limited to members of any race, ethnicity, culture, national origin, colour, immigration status, social and economic class, educational level, sex, sexual orientation, gender identity and expression, age, size, family status, political belief, religion, and mental and physical ability. -- **Be considerate.** Your work will be used by other people, and you in turn will depend on the work of others. Any decision you take will affect users and colleagues, and you should take those consequences into account when making decisions. Remember that we're a world-wide community, so you might not be communicating in someone else's primary language. -- **Be respectful.** Not all of us will agree all the time, but disagreement is no excuse for poor behavior and poor manners. We might all experience some frustration now and then, but we cannot allow that frustration to turn into a personal attack. It’s important to remember that a community where people feel uncomfortable or threatened is not a productive one. Members of the Stamp Protocol community should be respectful when dealing with other members as well as with people outside the Stamp Protocol community. -- **Be careful in the words that you choose.** We are a community of professionals, and we conduct ourselves professionally. Be kind to others. Do not insult or put down other participants. Harassment and other exclusionary behavior aren't acceptable. This includes, but is not limited to: - - Violent threats or language directed against another person. - - Discriminatory jokes and language. - - Posting sexually explicit or violent material. - - Posting (or threatening to post) other people's personally identifying information ("doxing"). - - Personal insults, especially those using racist or sexist terms. - - Unwelcome sexual attention. - - Advocating for, or encouraging, any of the above behavior. - - Repeated harassment of others. In general, if someone asks you to stop, then stop. -- **When we disagree, try to understand why.** Disagreements, both social and technical, happen all the time and Stamp Protocol is no exception. It is important that we resolve disagreements and differing views constructively. Remember that we’re different. The strength of Stamp Protocol comes from its varied community, people from a wide range of backgrounds. Different people have different perspectives on issues. Being unable to understand why someone holds a viewpoint doesn’t mean that they’re wrong. Don’t forget that it is human to err and blaming each other doesn’t get us anywhere. Instead, focus on helping to resolve issues and learning from mistakes. - -Original text courtesy of the [Speak Up! project](http://web.archive.org/web/20141109123859/http://speakup.io/coc.html). - -## Questions? - -If you have questions, please see . If that doesn't answer your questions, feel free to [contact us](mailto:). diff --git a/avow-protocol/CONTRIBUTING.md b/avow-protocol/CONTRIBUTING.md deleted file mode 100644 index 8c9d97b7..00000000 --- a/avow-protocol/CONTRIBUTING.md +++ /dev/null @@ -1,116 +0,0 @@ -# Clone the repository -git clone https://github.com/hyperpolymath/standards.git -cd standards - -# Using Nix (recommended for reproducibility) -nix develop - -# Or using toolbox/distrobox -toolbox create standards-dev -toolbox enter standards-dev -# Install dependencies manually - -# Verify setup -just check # or: cargo check / mix compile / etc. -just test # Run test suite -``` - -### Repository Structure -``` -standards/ -├── src/ # Source code (Perimeter 1-2) -├── lib/ # Library code (Perimeter 1-2) -├── extensions/ # Extensions (Perimeter 2) -├── plugins/ # Plugins (Perimeter 2) -├── tools/ # Tooling (Perimeter 2) -├── docs/ # Documentation (Perimeter 3) -│ ├── architecture/ # ADRs, specs (Perimeter 2) -│ └── proposals/ # RFCs (Perimeter 3) -├── examples/ # Examples (Perimeter 3) -├── spec/ # Spec tests (Perimeter 3) -├── tests/ # Test suite (Perimeter 2-3) -├── .well-known/ # Protocol files (Perimeter 1-3) -├── .github/ # GitHub config (Perimeter 1) -│ ├── ISSUE_TEMPLATE/ -│ └── workflows/ -├── CHANGELOG.md -├── CODE_OF_CONDUCT.md -├── CONTRIBUTING.md # This file -├── GOVERNANCE.md -├── LICENSE -├── MAINTAINERS.md -├── README.adoc -├── SECURITY.md -├── flake.nix # Nix flake (Perimeter 1) -└── Justfile # Task runner (Perimeter 1) -``` - ---- - -## How to Contribute - -### Reporting Bugs - -**Before reporting**: -1. Search existing issues -2. Check if it's already fixed in `main` -3. Determine which perimeter the bug affects - -**When reporting**: - -Use the [bug report template](.github/ISSUE_TEMPLATE/bug_report.md) and include: - -- Clear, descriptive title -- Environment details (OS, versions, toolchain) -- Steps to reproduce -- Expected vs actual behaviour -- Logs, screenshots, or minimal reproduction - -### Suggesting Features - -**Before suggesting**: -1. Check the [roadmap](ROADMAP.md) if available -2. Search existing issues and discussions -3. Consider which perimeter the feature belongs to - -**When suggesting**: - -Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) and include: - -- Problem statement (what pain point does this solve?) -- Proposed solution -- Alternatives considered -- Which perimeter this affects - -### Your First Contribution - -Look for issues labelled: - -- [`good first issue`](https://github.com/hyperpolymath/standards/labels/good%20first%20issue) — Simple Perimeter 3 tasks -- [`help wanted`](https://github.com/hyperpolymath/standards/labels/help%20wanted) — Community help needed -- [`documentation`](https://github.com/hyperpolymath/standards/labels/documentation) — Docs improvements -- [`perimeter-3`](https://github.com/hyperpolymath/standards/labels/perimeter-3) — Community sandbox scope - ---- - -## Development Workflow - -### Branch Naming -``` -docs/short-description # Documentation (P3) -test/what-added # Test additions (P3) -feat/short-description # New features (P2) -fix/issue-number-description # Bug fixes (P2) -refactor/what-changed # Code improvements (P2) -security/what-fixed # Security fixes (P1-2) -``` - -### Commit Messages - -We follow [Conventional Commits](https://www.conventionalcommits.org/): -``` -(): - -[optional body] - -[optional footer] diff --git a/avow-protocol/DEPLOY.md b/avow-protocol/DEPLOY.md deleted file mode 100644 index 195ad5d5..00000000 --- a/avow-protocol/DEPLOY.md +++ /dev/null @@ -1,123 +0,0 @@ -# Deploy STAMP Protocol Website to Cloudflare Pages - -## ✅ What's Ready - -- Professional landing page -- Mobile responsive -- SEO optimized -- Links to your Telegram bot (@stamp_demo_bot) -- Ready to deploy - -## 🚀 Deploy Now (5 Minutes) - -### Option 1: GitHub + Cloudflare Pages (Recommended) - -**1. Push to GitHub:** -```bash -cd ~/Documents/hyperpolymath-repos/stamp-protocol - -# Create GitHub repo -gh repo create stamp-protocol --public --source=. --remote=origin --push - -# Or manually: -git remote add origin https://github.com/hyperpolymath/stamp-protocol.git -git push -u origin main -``` - -**2. Connect to Cloudflare Pages:** - -1. Go to https://dash.cloudflare.com/ -2. Click **Pages** in the sidebar -3. Click **Create a project** -4. Click **Connect to Git** -5. Authorize GitHub -6. Select **stamp-protocol** repository -7. Configure build settings: - - **Project name:** stamp-protocol - - **Production branch:** main - - **Framework preset:** None - - **Build command:** (leave empty) - - **Build output directory:** `/` -8. Click **Save and Deploy** - -**3. Configure Custom Domain:** - -1. After deploy, go to **Custom domains** -2. Click **Set up a custom domain** -3. Enter: `stamp-protocol.org` -4. Cloudflare will auto-configure DNS -5. SSL certificate issued automatically - -**Done!** Your site will be live at https://stamp-protocol.org in ~2 minutes. - -### Option 2: Direct Upload (Faster for Testing) - -```bash -# Install Wrangler -npm install -g wrangler - -# Login -wrangler login - -# Deploy -cd ~/Documents/hyperpolymath-repos/stamp-protocol -wrangler pages deploy . --project-name=stamp-protocol -``` - -Then configure domain in Cloudflare dashboard. - -## 🔄 Updates - -After first deploy, just push to GitHub: -```bash -git add . -git commit -m "Update content" -git push -``` - -Cloudflare automatically rebuilds and deploys in ~30 seconds. - -## 🌐 Custom Domain Setup - -If you need to manually configure DNS: - -1. Go to **DNS** in Cloudflare dashboard -2. Add CNAME record: - - **Name:** `@` - - **Target:** `stamp-protocol.pages.dev` - - **Proxy status:** Proxied (orange cloud) -3. Save - -SSL certificate will be issued automatically. - -## ✅ Verify Deployment - -Visit: https://stamp-protocol.org - -Check: -- [ ] Homepage loads -- [ ] Mobile responsive -- [ ] Telegram bot link works -- [ ] All sections present -- [ ] SSL certificate valid - -## 📊 Add Analytics (Optional) - -1. Go to Cloudflare Pages dashboard -2. Click **Web Analytics** -3. Copy the beacon code -4. Add to `index.html` before `` -5. Push update - -## 🎯 What's on the Site - -- **Hero:** Value proposition + CTA to Telegram bot -- **Problem:** Email spam, social bots, platform costs -- **Solution:** Dependent types + formal verification -- **How it works:** Technical comparison -- **Demo:** Telegram bot walkthrough -- **Use cases:** Email, dating, social media, business -- **Stats:** Impact metrics -- **Footer:** Links and contact - -Ready to show investors and users! diff --git a/avow-protocol/DEPLOYMENT-STATUS-ALL-PROJECTS.md b/avow-protocol/DEPLOYMENT-STATUS-ALL-PROJECTS.md deleted file mode 100644 index 504f9764..00000000 --- a/avow-protocol/DEPLOYMENT-STATUS-ALL-PROJECTS.md +++ /dev/null @@ -1,184 +0,0 @@ -# SPDX-License-Identifier: CC-BY-SA-4.0 -# Multi-Project Cloudflare Pages Deployment Status - -**Date:** 2026-02-04 -**Total Projects:** 10 -**Method:** Deno + Wrangler CLI + Direct API - ---- - -## ✅ Successfully Deployed Projects - -All 10 projects have been deployed to Cloudflare Pages: - -| Project | Production URL | Custom Domain | Status | Files | -|---------|----------------|---------------|--------|-------| -| oblibeny | https://oblibeny.pages.dev | oblibeny.net | Pending DNS | 307 | -| affinescript | https://affinescript.pages.dev | affinescript.dev | Pending DNS | 1,066 | -| error-lang | https://error-lang.pages.dev | error-lang.org | Pending DNS | 129 | -| reposystem | https://reposystem.pages.dev | reposystem.dev | Pending DNS | 135 | -| my-lang | https://my-lang.pages.dev | my-lang.net | Pending DNS | 1,874 | -| betlang | https://betlang.pages.dev | betlang.org | Pending DNS | 4 | -| verisimdb | https://verisimdb.pages.dev | verisimdb.org | Pending DNS | 30 | -| anvomidav | https://anvomidav.pages.dev | anvomidav.org | Pending DNS | 18 | -| ephapax | https://ephapax.pages.dev | ephapax.org | Pending DNS | 31 | -| eclexia | https://eclexia.pages.dev | eclexia.org | Pending DNS | 12 | - ---- - -## 🚀 Deployment Details - -### Projects with Homepage - -- **betlang**: Deployed from `homepage/` directory (has index.html) - -### Projects with Documentation - -Deployed from `docs/` directory: -- verisimdb -- anvomidav -- ephapax -- eclexia - -### Full Repository Deploys - -Deployed entire repository (excluding build artifacts): -- oblibeny (307 files) -- affinescript (1,066 files) -- error-lang (129 files) -- reposystem (135 files) -- my-lang (1,874 files) - ---- - -## ⚠️ Issues Resolved - -### Large File Size Errors - -Several projects initially failed due to Rust build artifacts exceeding Cloudflare Pages' 25MB file size limit: -- verisimdb (103MB .rlib file) -- betlang (57.4MB LSP binary) -- anvomidav (33.9MB LSP binary) -- ephapax (28.5MB binary) -- eclexia (69.3MB LSP binary) - -**Solution:** Deployed from web-specific directories (`homepage/` or `docs/`) instead of entire repository. - ---- - -## 📋 Custom Domain Status - -All custom domains are configured but **pending DNS verification**. - -### DNS Configuration Needed - -None of these domains have DNS zones in Cloudflare. Two options: - -#### Option 1: Add to Cloudflare DNS (Recommended) - -For each domain, add a DNS zone in Cloudflare and set nameservers at your registrar. - -#### Option 2: Configure at Current Registrar - -Add CNAME records at your current DNS provider: - -``` -# For each domain: -@ (root) CNAME .pages.dev -www CNAME .pages.dev -``` - -**Examples:** -- `affinescript.dev` → `affinescript.pages.dev` -- `anvomidav.org` → `anvomidav.pages.dev` -- `betlang.org` → `betlang.pages.dev` -- etc. - ---- - -## ✅ What's Working Now - -### .pages.dev URLs - -All projects are accessible via their .pages.dev URLs: -- ✅ https://oblibeny.pages.dev -- ✅ https://affinescript.pages.dev -- ✅ https://error-lang.pages.dev -- ✅ https://reposystem.pages.dev -- ✅ https://my-lang.pages.dev -- ✅ https://betlang.pages.dev -- ✅ https://verisimdb.pages.dev -- ✅ https://anvomidav.pages.dev -- ✅ https://ephapax.pages.dev -- ✅ https://eclexia.pages.dev - -**Note:** Some may show 404 if they lack an `index.html` in the root. Deployment-specific URLs (with hashes) should work. - -### Features Enabled - -All projects have: -- ✅ Global CDN (Cloudflare's 300+ data centers) -- ✅ Auto SSL/TLS with TLS 1.3 -- ✅ Post-Quantum TLS (Kyber-1024) -- ✅ DDoS Protection -- ✅ Unlimited bandwidth -- ✅ Auto-deploy capability - ---- - -## 📊 Next Steps - -### Immediate Actions - -1. **Configure DNS** for custom domains (see options above) -2. **Wait 1-5 minutes** for DNS propagation -3. **Verify** custom domains are accessible - -### For Projects Without index.html - -Several projects (docs-only deployments) may need: -- Create `index.html` in the deployed directory -- Or configure redirect rules in Pages - -### Build Configuration (Optional) - -Projects can be configured with: -- Build commands -- Environment variables -- Build notifications -- Branch previews - ---- - -## 🎯 Summary - -**Status:** All 10 projects successfully deployed to Cloudflare Pages -**Blocker:** DNS configuration needed for custom domains -**ETA:** 1-5 minutes after DNS is configured - -**Total files deployed:** 3,614 files across 10 projects -**Total time:** ~15 minutes - ---- - -## Verification Commands - -```bash -# Check custom domain status -for domain in affinescript.dev anvomidav.org betlang.org eclexia.org ephapax.org error-lang.org my-lang.net oblibeny.net reposystem.dev verisimdb.org; do - curl -I "https://$domain" 2>&1 | grep -E "HTTP|curl:" -done - -# Check .pages.dev URLs -for project in oblibeny affinescript error-lang reposystem my-lang betlang verisimdb anvomidav ephapax eclexia; do - curl -I "https://${project}.pages.dev" 2>&1 | grep "HTTP" -done -``` - ---- - -## Support - -- **Cloudflare Dashboard:** https://dash.cloudflare.com/pages -- **DNS Management:** https://dash.cloudflare.com/dns -- **Wrangler Docs:** https://developers.cloudflare.com/workers/wrangler/ diff --git a/avow-protocol/DEPLOYMENT-SUCCESS.md b/avow-protocol/DEPLOYMENT-SUCCESS.md deleted file mode 100644 index 9a8f1b84..00000000 --- a/avow-protocol/DEPLOYMENT-SUCCESS.md +++ /dev/null @@ -1,199 +0,0 @@ -# SPDX-License-Identifier: CC-BY-SA-4.0 -# Cloudflare Pages Deployment - Success Report - -**Date:** 2026-02-04 -**Deployed by:** Claude Sonnet 4.5 -**Method:** Deno + Wrangler CLI - ---- - -## Deployed Sites - -### 1. AVOW Protocol -- **Project:** avow-protocol -- **URL:** https://ca8ba13d.avow-protocol.pages.dev -- **Production URL:** https://avow-protocol.pages.dev -- **Custom Domain:** avow-protocol.org (pending DNS) -- **Files:** 141 uploaded -- **Status:** ✅ Live - -### 2. A2ML -- **Project:** a2ml -- **URL:** https://8f8410aa.a2ml.pages.dev -- **Production URL:** https://a2ml.pages.dev -- **Files:** 441 uploaded -- **Status:** ✅ Live - -### 3. K9-SVC -- **Project:** k9-svc -- **URL:** https://295504e4.k9-svc.pages.dev -- **Production URL:** https://k9-svc.pages.dev -- **Files:** 1280 uploaded -- **Status:** ✅ Live - ---- - -## Deployment Details - -### Configuration Used - -**API Authentication:** -- Cloudflare API Token (with Pages Edit permissions) -- Account ID: (private — see ~/.config/hyperpolymath/cloudflare.env) - -**Deployment Method:** -```bash -deno run -A npm:wrangler pages deploy . --project-name= --branch=main -``` - -### Auto-Deploy Setup - -Each project is now configured for automatic deployment: -1. Push to `main` branch triggers build -2. Cloudflare builds and deploys automatically -3. New URL generated for each deployment -4. Production URL remains stable - ---- - -## Features Enabled - -✅ **Global CDN** - Cloudflare's 300+ data centers -✅ **Auto SSL/TLS** - Automatic HTTPS with TLS 1.3 -✅ **Post-Quantum TLS** - Kyber-1024 key exchange -✅ **DDoS Protection** - Cloudflare's network protection -✅ **Auto-Deploy** - Push to deploy workflow -✅ **Build Cache** - Faster subsequent builds -✅ **Unlimited Bandwidth** - Free tier includes unlimited - ---- - -## Next Steps - -### For Each Site: - -1. **Add Custom Domains** - - Go to project → Custom domains - - Add domain (e.g., avow-protocol.org) - - Cloudflare auto-configures DNS - -2. **Configure Security Headers** - - Use Transform Rules - - Add HSTS, CSP, X-Frame-Options, etc. - - See: CLOUDFLARE-MANUAL-SETUP.md - -3. **Set up WAF Rules** - - Rate limiting - - Bot protection - - Geo-blocking if needed - -4. **Enable Analytics** - - Web Analytics (privacy-friendly) - - Real-time logs - - Performance monitoring - -5. **Configure Build Settings** - - Build command (if needed) - - Environment variables - - Build notifications - ---- - -## Verification - -Test each deployment: - -```bash -# AVOW Protocol -curl -I https://ca8ba13d.avow-protocol.pages.dev - -# A2ML -curl -I https://8f8410aa.a2ml.pages.dev - -# K9-SVC -curl -I https://295504e4.k9-svc.pages.dev -``` - -All should return: -- Status: 200 OK -- Server: cloudflare -- CF-Ray: [unique ID] - ---- - -## Architecture Stack - -### AVOW Protocol -- **Frontend:** ReScript → JavaScript (ES6) -- **Build:** Deno + ReScript compiler -- **SSG:** casket-ssg (Haskell) -- **Router:** cadre-tea-router -- **State:** rescript-tea (The Elm Architecture) -- **Verification:** Idris2 + Zig FFI -- **Crypto:** Dilithium5, Kyber-1024, SHAKE3-512 - -### A2ML -- **Format:** A2ML markup language -- **Compiler:** ReScript-based -- **Output:** Static HTML/CSS/JS - -### K9-SVC -- **Type:** Service validation framework -- **Language:** Nickel configuration -- **Documentation:** AsciiDoc/Markdown - ---- - -## Costs - -**Current Plan:** Free Tier - -**Includes:** -- Unlimited requests -- Unlimited bandwidth -- Unlimited sites -- 500 builds/month -- 1 concurrent build - -**No charges for:** -- Static hosting -- SSL certificates -- DDoS protection -- CDN bandwidth - ---- - -## Monitoring - -**Cloudflare Dashboard:** -- https://dash.cloudflare.com/pages - -**Key Metrics:** -- Requests per second -- Bandwidth usage -- Error rates (4xx, 5xx) -- Cache hit ratio -- Build success/failure rate - ---- - -## Support & Documentation - -- **Cloudflare Pages Docs:** https://developers.cloudflare.com/pages/ -- **Wrangler CLI Docs:** https://developers.cloudflare.com/workers/wrangler/ -- **Status Page:** https://www.cloudflarestatus.com/ - ---- - -## Success! 🎉 - -All three sites are now live on Cloudflare's global network with: -- Post-quantum TLS encryption -- DDoS protection -- Auto-deploy from Git -- Unlimited bandwidth -- 100% uptime SLA - -**Total deployment time:** ~5 minutes -**Files deployed:** 1,862 total -**Global availability:** Immediate diff --git a/avow-protocol/LICENSE b/avow-protocol/LICENSE deleted file mode 100644 index ec540b34..00000000 --- a/avow-protocol/LICENSE +++ /dev/null @@ -1,153 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council - -================================================================================ -PALIMPSEST-MPL LICENSE VERSION 1.0 -================================================================================ - -File-level copyleft with ethical use and quantum-safe provenance - -Based on Mozilla Public License 2.0 - --------------------------------------------------------------------------------- -PREAMBLE --------------------------------------------------------------------------------- - -This License extends the Mozilla Public License 2.0 (MPL-2.0) with provisions -for ethical use, post-quantum cryptographic provenance, and emotional lineage -protection. The base MPL-2.0 terms apply except where explicitly modified by -the Exhibits below. - -Like a palimpsest manuscript where each layer builds upon what came before, -this license recognizes that creative works carry history, context, and meaning -that transcend mere code or text. - --------------------------------------------------------------------------------- -SECTION 1: BASE LICENSE --------------------------------------------------------------------------------- - -This License incorporates the full text of Mozilla Public License 2.0 by -reference. The complete MPL-2.0 text is available at: -https://www.mozilla.org/en-US/MPL/2.0/ - -All terms, conditions, and definitions from MPL-2.0 apply except where -explicitly modified by the Exhibits in this License. - --------------------------------------------------------------------------------- -SECTION 2: ADDITIONAL DEFINITIONS --------------------------------------------------------------------------------- - -2.1. "Emotional Lineage" - means the narrative, cultural, symbolic, and contextual meaning embedded - in Covered Software, including but not limited to: protest traditions, - cultural heritage, trauma narratives, and community stories. - -2.2. "Provenance Metadata" - means cryptographically signed attribution information attached to or - associated with Covered Software, including author identities, timestamps, - modification history, and lineage references. - -2.3. "Non-Interpretive System" - means any automated system that processes Covered Software without - preserving or considering its Emotional Lineage, including but not - limited to: AI training pipelines, content aggregators, and automated - summarization tools. - -2.4. "Quantum-Safe Signature" - means a cryptographic signature using algorithms resistant to attacks - by quantum computers, as specified in Exhibit B. - --------------------------------------------------------------------------------- -SECTION 3: ETHICAL USE REQUIREMENTS --------------------------------------------------------------------------------- - -In addition to the rights and obligations under MPL-2.0: - -3.1. Emotional Lineage Preservation - You must make reasonable efforts to preserve and communicate the - Emotional Lineage of Covered Software when distributing or creating - derivative works. This includes maintaining narrative context, cultural - attributions, and symbolic meaning where documented. - -3.2. Non-Interpretive System Notice - If You use Covered Software as input to a Non-Interpretive System, You - must: - (a) document such use in a publicly accessible manner; and - (b) not claim that outputs of such systems carry the Emotional Lineage - of the original work without explicit permission from Contributors. - -3.3. Ethical Use Declaration - Commercial use of Covered Software requires acknowledgment that You have - read and understood Exhibit A (Ethical Use Guidelines) and agree to act - in good faith accordance with its principles. - -See Exhibit A for complete Ethical Use Guidelines. - --------------------------------------------------------------------------------- -SECTION 4: PROVENANCE REQUIREMENTS --------------------------------------------------------------------------------- - -4.1. Metadata Preservation - You must not strip, alter, or obscure Provenance Metadata from Covered - Software except where technically necessary and with clear documentation - of any changes. - -4.2. Quantum-Safe Provenance (Optional) - Contributors may sign their Contributions using Quantum-Safe Signatures. - If Quantum-Safe Signatures are present, You must preserve them in all - distributions. - -4.3. Lineage Chain - When creating derivative works, You should extend the provenance chain - to include Your own contributions, maintaining cryptographic linkage to - prior Contributors where feasible. - -See Exhibit B for Quantum-Safe Provenance specifications. - --------------------------------------------------------------------------------- -SECTION 5: GOVERNANCE --------------------------------------------------------------------------------- - -5.1. Stewardship Council - This License is maintained by the Palimpsest Stewardship Council, which - may issue clarifications, interpretive guidance, and future versions. - -5.2. Version Selection - You may use Covered Software under this version of the License or any - later version published by the Palimpsest Stewardship Council. - -5.3. Dispute Resolution - Disputes regarding interpretation of Ethical Use Requirements (Section 3) - should first be submitted to the Palimpsest Stewardship Council for - non-binding guidance before pursuing legal remedies. - --------------------------------------------------------------------------------- -SECTION 6: COMPATIBILITY --------------------------------------------------------------------------------- - -6.1. MPL-2.0 Compatibility - Covered Software under this License may be combined with software under - MPL-2.0. The combined work must comply with both licenses. - -6.2. Secondary Licenses - The Secondary License provisions of MPL-2.0 Section 3.3 apply to this - License. - --------------------------------------------------------------------------------- -EXHIBITS --------------------------------------------------------------------------------- - -Exhibit A - Ethical Use Guidelines -Exhibit B - Quantum-Safe Provenance Specification - -See separate files: -- EXHIBIT-A-ETHICAL-USE.txt -- EXHIBIT-B-QUANTUM-SAFE.txt - --------------------------------------------------------------------------------- -END OF PALIMPSEST-MPL LICENSE VERSION 1.0 --------------------------------------------------------------------------------- - -For questions about this License: -- Repository: https://github.com/hyperpolymath/palimpsest-license -- Council: contact via repository Issues diff --git a/avow-protocol/MAINTAINERS.adoc b/avow-protocol/MAINTAINERS.adoc deleted file mode 100644 index 48d97817..00000000 --- a/avow-protocol/MAINTAINERS.adoc +++ /dev/null @@ -1,47 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Maintainers -:toc: preamble - -This document lists the maintainers of this project and their responsibilities. - -== Current Maintainers - -[cols="2,3,2",options="header"] -|=== -| Name | Role | Contact - -| Jonathan D.A. Jewell -| Lead Maintainer -| https://github.com/hyperpolymath[@hyperpolymath] -|=== - -== Responsibilities - -Maintainers are responsible for: - -* Reviewing and merging pull requests -* Triaging issues and feature requests -* Ensuring code quality and security standards -* Managing releases and versioning -* Upholding the project's code of conduct - -== Becoming a Maintainer - -Contributors who demonstrate: - -* Consistent, high-quality contributions -* Understanding of the project's goals and standards -* Constructive participation in discussions -* Commitment to the project's long-term health - -May be invited to become maintainers at the discretion of existing maintainers. - -== Decision Making - -* Routine decisions (bug fixes, minor improvements) can be made by any maintainer -* Significant changes require discussion and consensus among maintainers -* Breaking changes or major features should be discussed in issues before implementation - -== Contact - -For questions about project governance, open an issue or contact the maintainers listed above. diff --git a/avow-protocol/QUICK-DEPLOY.md b/avow-protocol/QUICK-DEPLOY.md deleted file mode 100644 index 84c86965..00000000 --- a/avow-protocol/QUICK-DEPLOY.md +++ /dev/null @@ -1,59 +0,0 @@ -# Quick Cloudflare Deployment (5 Minutes) - -## Step 1: Connect Repository (2 minutes) - -1. Go to: https://dash.cloudflare.com/pages -2. Click **"Create a project"** -3. Click **"Connect to Git"** -4. Select **"GitHub"** -5. Find and select: **`hyperpolymath/avow-protocol`** -6. Click **"Begin setup"** - -## Step 2: Configure Build (1 minute) - -**Build settings:** -- Framework preset: **None** -- Build command: **`deno task build`** -- Build output directory: **`.`** (just a dot) -- Root directory: **`/`** (leave as default) - -Click **"Save and Deploy"** - -## Step 3: Watch Build (2 minutes) - -- Build starts automatically -- Takes 2-3 minutes -- Shows real-time logs -- Look for: ✅ Success! - -## Step 4: Get Your URL - -Your site will be live at: -- **`https://avow-protocol.pages.dev`** - -## Step 5: Add Custom Domain (Optional) - -1. In your project, click **"Custom domains"** -2. Click **"Set up a custom domain"** -3. Enter: **`avow-protocol.org`** -4. Cloudflare auto-configures DNS -5. Wait 1-5 minutes for activation - -## That's It! 🎉 - -Your AVOW Protocol site is now live with: -- ✅ Global CDN -- ✅ Auto SSL/TLS -- ✅ Auto-deploy on git push -- ✅ Post-quantum TLS 1.3 -- ✅ DDoS protection - -Visit your site and verify it works! - -## Next: Complete Security Setup - -Follow **CLOUDFLARE-MANUAL-SETUP.md** for: -- Security headers -- WAF rules -- Zero Trust -- Monitoring diff --git a/avow-protocol/README.adoc b/avow-protocol/README.adoc deleted file mode 100644 index 1a16a8e2..00000000 --- a/avow-protocol/README.adoc +++ /dev/null @@ -1,510 +0,0 @@ -AVOW Protocol: Attributed Verification of Origin Willingness - -Idris Inside Protocol Draft - -Reference site and interactive demo for the AVOW Protocol—a high-assurance standard for secure subscriber attribution and spam prevention. -Table of Contents - - Introduction - Core Concepts - 1. Attributed Origin - 2. Origin Willingness - 3. The Spam-Ham Determinant - Formal Logic (The AVOW Proof) - Technical Stack - Project Structure - Implementation Status - License - -Introduction - -The AVOW Protocol (Attributed Verification of Origin Willingness) is designed to solve the "Spam vs. Ham" problem at the architectural level. Unlike traditional opt-in systems that rely on easily spoofed headers, AVOW uses formal mathematical proofs to ensure that every message is both attributed to a known source and willed by the recipient. -Core Concepts - -The protocol moves beyond simple "Opt-in" logic by verifying the relationship between the message source and the receiver’s intent. -1. Attributed Origin - -Every message or subscription event must carry a cryptographic proof of its source. This eliminates "ghost" subscriptions and sender spoofing. -2. Origin Willingness - -Willingness is not a static state but a verified property of the communication channel. A message is classified as Ham only if the recipient has an active, proven "willingness token" for that specific Origin. -3. The Spam-Ham Determinant - -A communication is rejected as Spam if: * The Origin cannot be cryptographically attributed. * The Willingness proof has expired or was never issued. * The state transition violates the formally verified workflow. -Formal Logic (The AVOW Proof) - -Using the proven library (Idris2), we define the validity of a communication state through the following theorem: -\[V(m) \iff A(o) \land W(r, o)\] - -Where: * V ( m ) is the validity of the message. * A ( o ) is the successful Attribution of the Origin o . * W ( r , o ) is the Willingness of the recipient r to accept o . -Technical Stack - - Logic Engine: ReScript 12 + TEA (The Elm Architecture) - - Verification: proven (Idris2) for structural integrity of state and URLs. - - Security: Enforced HTTPS and Content Security Policies (CSP) via .well-known/ standards. - -Project Structure - -avow-protocol/ -├── src/ -│ ├── AvowApp.res # Core Logic & State Machine -│ ├── OriginProof.res # Attribution logic -│ └── ProvenSafeUrl.res # Idris2-backed URL proofs -├── docs/ -│ └── PROTOCOL.adoc # Full mathematical specification -└── .well-known/ # RFC 9116 & Protocol discovery - -Implementation Status - - ✓ Origin Attribution: Cryptographic binding of senders. - - ✓ Formal URL Validation: Zero-runtime-error URL parsing. - - ❏ Willingness State Machine: Full TEA implementation of consent lifecycles. - - ❏ Spam/Ham Heuristics: Proof-based filtering demo. - -License - -PMPL-1.0-or-later - -I’m going to pressure-test this against what already exists and where the idea breaks against reality. I’m assuming you mean email/newsletter/subscription flows first, because “spam vs ham” gets slippery fast outside that; if you meant SMS/telephony instead, say so and I’ll retarget it. - -This is already clarifying itself: origin-attestation is real and standardized territory; recipient-willingness is the part that’s novel, but also the part most likely to bite you. I’m pulling the current mail standards and bulk-sender rules so I can tell you whether AVOW is a real gap or just a fancy wrapper around DKIM/DMARC + unsubscribe. - -You’re not a fool. This is a real instinct hitting a real gap. But in its current form, AVOW is trying to prove something the mail ecosystem usually can’t prove cleanly. - -Email already has a pretty mature stack for origin-side claims: SPF authorizes sending hosts, DKIM signs mail at the domain level, DMARC aligns authenticated identities with the visible From domain, and ARC exists because forwarding, mailing lists, and other intermediaries routinely break simpler authentication models. Mailing-list UX also already has standardized List-Subscribe and List-Unsubscribe headers, with RFC 8058 defining one-click unsubscribe. Large receivers like Gmail now explicitly require bulk senders to use SPF, DKIM, DMARC alignment, TLS, and one-click unsubscribe for marketing/subscribed mail. - -So AVOW is not solving a fake problem. The real gap is this: origin authentication is standardized; recipient willingness is mostly handled as policy, reputation, UX, and local receiver judgment, not as a portable cryptographic fact. Even Google’s current guidance leans on opt-in, confirmation, unsubscribes, and spam complaint rates, and explicitly notes that the line between promotional and transactional mail depends partly on recipient context. The email architecture docs also make clear that user-level behavior and mailing-list behavior are messy and partly subjective, not something you can reduce to one timeless global truth. - -That’s the core problem in your theorem: -V(m)  ⟺  A(o)∧W(r,o) -V(m)⟺A(o)∧W(r,o) - -A(o) is plausible. W(r,o) is the dangerous bit. A protocol can prove a token exists. It cannot really prove, in the human sense, that a recipient is still “willing” right now, in this context, for this exact message class, through this route, after forwarding, delegation, mailing-list remailing, account compromise, or changing preferences. - -The spots where AVOW currently overreaches are these: - - It treats ham/spam as if it were fully derivable from origin + consent, when receivers also care about reputation, abuse, complaints, compromise, and message class. - - It assumes a neat sender→recipient path, but SMTP has relays, gateways, mediators, and mailing lists that can re-post or modify messages while preserving some original authorship cues. ARC exists precisely because intermediaries break simpler authentication stories. - - It puts a lot of emphasis on HTTPS/CSP/.well-known, but transport security and discovery territory is already occupied by things like MTA-STS and current sender requirements. That’s useful plumbing, just not your differentiator. - - It wants a binary proof where the real world probably needs graded attestation. Telephony’s STIR/PASSporT/SHAKEN stack is a good precedent here: it uses cryptographic origin identity plus levels of attestation, not a magical absolute truth bit. - -Here’s the salvage, and I think it’s actually pretty good: - -AVOW should stop pretending to be a universal “spam killer protocol” and become a consent-attested messaging framework for subscribed/bulk/managed communication. - -That means: -V(m,t)  ⟺  Attest(o,s,m) ∧ ConsentCap(r,o,purpose,channel,t) ∧ Fresh(cap,t) ∧ NotRevoked(cap,t) ∧ ReplaySafe(m,cap) ∧ WorkflowOK -V(m,t)⟺Attest(o,s,m) ∧ ConsentCap(r,o,purpose,channel,t) ∧ Fresh(cap,t) ∧ NotRevoked(cap,t) ∧ ReplaySafe(m,cap) ∧ WorkflowOK - -That is much stronger. It says: - - the origin is attested, - - the sender is authorized to act for that origin, - - the recipient previously granted a scoped capability, - - the capability is fresh and not revoked, - - the message can’t replay an old proof, - - and the state machine is valid. - -That is no longer “is this ham in the philosophical sense?” It is “does this message satisfy a formally checkable acceptance policy?” That’s actually implementable. - -My honest verdict: - -As a universal internet protocol: probably too ambitious, and a bit category-confused. -As a domain-scoped or provider-scoped protocol for consent-attested bulk mail / subscriptions / list traffic: genuinely interesting. - -The practical version of AVOW would look like this: - - Origin attestation token - Signed by the sender domain, or by a delegated ESP with explicit delegation. - - Recipient willingness token - Really this should be a consent capability, not “willingness” in the philosophical sense. It should be scoped to: - - recipient pseudonym or mailbox handle - - origin - - list or purpose - - allowed message class - - expiry - - revocation reference - - nonce / anti-replay binding - - Receiver policy engine - Receiver verifies both tokens and then still applies local policy. - - Graceful coexistence with mail today - AVOW should ride alongside SPF/DKIM/DMARC/ARC, not replace them. - -The other big recommendation: keep Idris inside the verifier, not inside the wire protocol identity. Formal methods are excellent for proving your parser, state machine, and token-validation rules are sound. They do not prove that remote parties are honest, or that human consent semantics are complete. - -So the sharp version is: - - Good idea: consent as a cryptographically scoped capability. - - Weak idea: “spam vs ham solved architecturally.” - - Best framing: “AVOW is a formally specified, consent-attested extension for subscribed messaging, not a universal theorem of wantedness.” - -If I were steering the repo, I’d rewrite the pitch to: - - AVOW is a consent-attested messaging framework that combines authenticated origin, delegated sender authority, and recipient-scoped acceptance capabilities for high-assurance subscription and bulk-mail workflows. - -That pitch is strong. The current one is a little too “I have abolished spam by theorem,” which is catnip for reviewers in the wrong way. - -Next thing I’d write is the threat model before any more code: attacker goals, trust anchors, token issuer, delegation model, replay model, revocation model, mailing-list/forwarder behavior, and downgrade story. - -could you write me a replacement README.adoc - -Absolutely — here’s a replacement README.adoc that pitches AVOW in a sharper, more credible way, without sounding like it’s trying to mathematically abolish spam from the universe. - -= AVOW Protocol -:toc: -:toclevels: 3 -:sectnums: - -AVOW — *Attributed Verification of Origin & Willingness* — is a high-assurance protocol draft for consent-attested messaging. - -Rather than attempting to "solve spam" in the abstract, AVOW defines a verifiable acceptance model for messages that should only be delivered when two conditions hold: - -. the sender's origin can be cryptographically attributed; and -. the recipient has a valid, scoped, non-revoked willingness token for that origin and message purpose. - -AVOW is aimed at subscription, notification, and managed messaging workflows where consent, attribution, and policy enforcement need to be explicit, inspectable, and machine-verifiable. - -== Status - -[IMPORTANT] -==== -AVOW is currently a protocol exploration and reference implementation draft. - -It is *not* a replacement for SMTP, SPF, DKIM, DMARC, ARC, or existing unsubscribe standards. -It is best understood as a complementary consent-attestation layer for high-assurance messaging environments. -==== - -Current state: - -* ✅ Origin attribution model drafted -* ✅ Formal validation experiments with Idris2 / `proven` -* ✅ Initial ReScript architecture for stateful protocol demos -* ❏ Willingness capability model in progress -* ❏ Revocation / expiry lifecycle design in progress -* ❏ End-to-end protocol demo not yet complete - -== Why AVOW? - -Existing messaging systems are reasonably good at proving aspects of *sender identity*, but much weaker at proving whether a recipient has actually granted ongoing, scoped permission for a class of messages. - -That creates a familiar mess: - -* spoofed or weakly-attributed origins -* stale or unverifiable consent records -* ambiguous subscription state -* poor replay / revocation semantics -* "opt-in" claims that are hard to independently verify -* overloading of local spam filtering with consent questions it cannot cleanly prove - -AVOW explores a stricter model: - -[stem] -++++ -V(m, t) iff A(o) and C(r, o, p, t) and F(c, t) and R(m, c) and S -++++ - -Where: - -* `V(m, t)` = message `m` is valid for acceptance at time `t` -* `A(o)` = origin `o` is cryptographically attributed -* `C(r, o, p, t)` = recipient `r` has a valid consent capability for origin `o` and purpose `p` -* `F(c, t)` = the capability is fresh / unexpired at time `t` -* `R(m, c)` = the message and capability are replay-safe -* `S` = the state transition satisfies the verified workflow - -This is intentionally narrower than "all ham/spam classification". -AVOW is about *provable acceptance conditions*, not universal philosophical certainty about wantedness. - -== Core Concepts - -=== 1. Attributed Origin - -Every accepted communication must be bound to a cryptographically attributable origin. - -This means: - -* the sender identity is not merely asserted in a mutable header -* the sending authority can be tied to a recognized origin -* delegated senders can be modeled explicitly rather than hand-waved - -AVOW treats unattributed or ambiguously attributed origin as a first-class failure. - -=== 2. Willingness as a Capability - -AVOW does not treat willingness as a vague boolean preference. -Instead, it models willingness as a scoped capability with explicit properties such as: - -* recipient -* origin -* purpose or message class -* channel -* issuance time -* expiry time -* revocation reference -* anti-replay binding - -A message is not accepted merely because a sender once claimed "the user opted in". -It must correspond to a currently valid willingness capability. - -=== 3. Verified State Transitions - -Consent is not static. -It changes over time through a lifecycle such as: - -* requested -* challenged -* granted -* renewed -* narrowed -* revoked -* expired - -AVOW models these transitions explicitly so that invalid state jumps can be rejected. - -=== 4. Spam/Ham as Policy Outcome - -AVOW deliberately avoids claiming that all spam detection can be reduced to one theorem. - -Instead: - -* AVOW can prove whether a message satisfies a strict consent-attested acceptance policy -* receivers may still apply local reputation, abuse, content, and operational policy - -That distinction matters. -AVOW is a high-assurance protocol component, not a magic replacement for receiver judgment. - -== Protocol Model - -At a high level, AVOW introduces two linked proofs: - -. *Origin Proof* — this message originates from an attributable sender or authorized delegate -. *Willingness Proof* — this recipient has granted a valid, scoped capability for this class of communication - -A receiver evaluates both before deciding whether a message qualifies for AVOW acceptance. - -[source,text] ----- -Sender/Delegate - | - | 1. emits attributed message + origin proof - | 2. binds message to willingness capability reference - v -Receiver - | - |-- verify origin attribution - |-- verify willingness capability - |-- check expiry / revocation / replay safety - |-- validate workflow state transition - v -Accept / Quarantine / Reject ----- - -== Design Principles - -=== Explicit over implicit - -No hidden "trust me, the user signed up somewhere" semantics. - -=== Scoped consent over blanket consent - -Permission should be narrow, inspectable, and purpose-bound. - -=== Formal workflow integrity - -State transitions should be specified precisely enough to verify. - -=== Coexistence over replacement - -AVOW should layer alongside existing mail and messaging infrastructure, not pretend the last 20 years never happened. - -=== High assurance where it matters - -The goal is not maximal complexity everywhere. -The goal is to make strong guarantees possible in systems that actually need them. - -== Non-Goals - -AVOW is *not* trying to be: - -* a universal replacement for SMTP -* a replacement for SPF, DKIM, DMARC, or ARC -* a complete spam-filtering engine -* a proof of human intent in the philosophical sense -* a guarantee that a message is good, useful, or non-abusive in all contexts - -AVOW is specifically about cryptographically and structurally verifiable acceptance criteria. - -== Technical Stack - -The current reference site / demo stack uses: - -* *ReScript 12 + TEA* for the protocol demo and state machine UI -* *Idris2* with `proven` for high-assurance validation experiments -* *AsciiDoc* for protocol documentation -* *.well-known/* conventions for discovery and policy surfacing -* *HTTPS + CSP* for secure reference-site delivery - -The formal methods work is intended to strengthen the protocol model and verifier logic. -It is *not* a claim that formal proofs alone eliminate operational abuse. - -== Repository Structure - -[source,text] ----- -avow-protocol/ -├── src/ -│ ├── AvowApp.res # Core application and protocol state machine -│ ├── OriginProof.res # Origin attribution logic -│ ├── Willingness.res # Consent capability lifecycle (planned/in progress) -│ └── ProvenSafeUrl.res # Idris2-backed safe URL integration -├── docs/ -│ ├── PROTOCOL.adoc # Full protocol draft -│ ├── THREAT-MODEL.adoc # Adversaries, trust boundaries, and failure modes -│ └── STATE-MACHINE.adoc # Consent lifecycle and transition rules -└── .well-known/ - ├── security.txt - └── avow # Discovery / policy experiments ----- - -== Implementation Priorities - -Near-term priorities: - -. define the willingness capability schema -. specify revocation and renewal semantics -. model replay resistance -. document delegation rules for third-party senders -. write the threat model before over-building the demo -. produce a minimal end-to-end verifier - -Suggested milestone sequence: - -* *M1* — Formalize origin attribution structure -* *M2* — Define willingness capability format -* *M3* — Specify state transitions and invalid transitions -* *M4* — Implement verifier prototype -* *M5* — Build demo showing accept / reject / revoke paths -* *M6* — Evaluate interoperability with real-world mail flows - -== Threat Model - -AVOW is only meaningful if it states what it is defending against. - -Key threat categories include: - -* forged or weakly attributed sender identity -* stale or fabricated consent claims -* replay of previously valid capabilities -* revoked-but-still-used willingness proofs -* confused deputy problems with delegated senders -* state-machine bypasses -* downgrade to non-AVOW delivery semantics - -A dedicated threat model document is strongly recommended and should be treated as a core protocol artifact, not an afterthought. - -== Example Acceptance Rule - -An AVOW-aware receiver might evaluate a message using logic like: - -[source,text] ----- -accept(message) if - verifyOrigin(message.originProof) && - verifyCapability(message.willingnessProof) && - capabilityMatches(message.origin, message.recipient, message.purpose) && - !isExpired(message.willingnessProof) && - !isRevoked(message.willingnessProof) && - !isReplay(message) -else reject_or_quarantine(message) ----- - -This is intentionally stricter than common marketing-email workflows. -That is the point. - -== Project Philosophy - -AVOW assumes that secure messaging should not depend entirely on: - -* sender self-description -* vague claims of prior opt-in -* reputation systems alone -* after-the-fact unsubscribe flows - -Instead, it explores whether *origin* and *recipient willingness* can be made explicit enough to verify. - -That makes AVOW especially relevant to systems that value: - -* strong consent guarantees -* auditable subscription workflows -* formally specified transitions -* abuse-resistant notification channels -* research into high-assurance messaging infrastructure - -== Development - -[source,bash] ----- -deno task build -deno task watch ----- - -As the protocol matures, this repository is expected to contain: - -* a reference site -* an interactive protocol demo -* a verifier prototype -* formal notes and proofs -* threat-model documentation -* example issuer / receiver flows - -== Contributing - -Contributions are welcome, especially in these areas: - -* protocol design review -* threat modeling -* formal specification -* ReScript implementation -* Idris2 proof support -* interoperability critique -* naming and scope refinement - -The most useful feedback is the brutal kind: -tell us where the model breaks, where the assumptions leak, and where the protocol is pretending to know more than it really can. - -== License - -This project is licensed under: - -*PMPL-1.0-or-later* - -See the license file for full terms. - -I can also do a tighter second pass that sounds more like one of your repo READMEs — more manifesto-ish, more formal-methods-heavy, or more “Rhodium standard / protocol-draft” in tone. - - diff --git a/avow-protocol/ROADMAP.adoc b/avow-protocol/ROADMAP.adoc deleted file mode 100644 index 45a5ac98..00000000 --- a/avow-protocol/ROADMAP.adoc +++ /dev/null @@ -1,22 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Avow Protocol Roadmap - -== Current Status - -Initial development phase. - -== Milestones - -=== v0.1.0 - Foundation -* [ ] Core functionality -* [ ] Basic documentation -* [ ] CI/CD pipeline - -=== v1.0.0 - Stable Release -* [ ] Full feature set -* [ ] Comprehensive tests -* [ ] Production ready - -== Future Directions - -_To be determined based on community feedback._ diff --git a/avow-protocol/RSR_OUTLINE.adoc b/avow-protocol/RSR_OUTLINE.adoc deleted file mode 100644 index 94a49d83..00000000 --- a/avow-protocol/RSR_OUTLINE.adoc +++ /dev/null @@ -1,218 +0,0 @@ -= RSR Template Repository - -image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] -:toc: -:sectnums: - -// Badges -image:https://img.shields.io/badge/RSR-Infrastructure-cd7f32[RSR Infrastructure] -image:https://img.shields.io/badge/Phase-Maintenance-brightgreen[Phase] -image:https://img.shields.io/badge/Guix-Primary-purple?logo=gnu[Guix] - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This repository provides the standardized structure, configuration, and tooling for all 139 repos in the hyperpolymath ecosystem. Use it to: - -* Bootstrap new projects with RSR compliance -* Reference the standard directory structure -* Copy configuration templates (Justfile, STATE.scm, etc.) - -== Quick Start - -[source,bash] ----- -# Clone the template -git clone https://github.com/hyperpolymath/RSR-template-repo my-project -cd my-project - -# Remove template git history -rm -rf .git -git init - -# Customize -sed -i 's/RSR-template-repo/my-project/g' Justfile guix.scm README.adoc - -# Enter development environment -guix shell -D -f guix.scm - -# Validate compliance -just validate-rsr ----- - -== What's Included - -[cols="1,3"] -|=== -|File/Directory |Purpose - -|`.editorconfig` -|Editor configuration (indent, charset) - -|`.gitignore` -|Standard ignore patterns - -|`.guix-channel` -|Guix channel definition - -|`.well-known/` -|RFC-compliant metadata (security.txt, ai.txt, humans.txt) - -|`docs/` -|Documentation directory - -|`guix.scm` -|Guix package definition - -|`justfile` -|Task runner with 50+ recipes - -|`LICENSE.txt` -|AGPL + Palimpsest dual license - -|`README.adoc` -|This file - -|`RSR_COMPLIANCE.adoc` -|Compliance tracking - -|`STATE.scm` -|Project state checkpoint -|=== - -== Justfile Features - -The template Justfile provides: - -* **~10 billion recipe combinations** via matrix recipes -* **Cookbook generation**: `just cookbook` → `docs/just-cookbook.adoc` -* **Man page generation**: `just man` → `docs/man/project.1` -* **RSR validation**: `just validate-rsr` -* **STATE.scm management**: `just state-touch`, `just state-phase` -* **Container support**: `just container-build`, `just container-push` -* **CI matrix**: `just ci-matrix [stage] [depth]` - -=== Key Recipes - -[source,bash] ----- -just # Show all recipes -just help # Detailed help -just info # Project info -just combinations # Show matrix options - -just build # Build (debug) -just test # Run tests -just quality # Format + lint + test -just ci # Full CI pipeline - -just validate # RSR + STATE validation -just docs # Generate all docs -just cookbook # Generate Justfile docs - -just guix-shell # Guix dev environment -just container-build # Build container ----- - -== Directory Structure - -[source] ----- -project/ -├── .editorconfig # Editor settings -├── .gitignore # Git ignore -├── .guix-channel # Guix channel -├── .well-known/ # RFC metadata -│ ├── ai.txt -│ ├── humans.txt -│ └── security.txt -├── config/ # Nickel configs (optional) -├── docs/ # Documentation -│ ├── generated/ -│ ├── man/ -│ └── just-cookbook.adoc -├── guix.scm # Guix package -├── Justfile # Task runner -├── LICENSE.txt # Dual license -├── README.adoc # Overview -├── RSR_COMPLIANCE.adoc # Compliance -├── src/ # Source code -├── STATE.scm # State checkpoint -└── tests/ # Tests ----- - -== RSR Compliance - -=== Language Tiers - -* **Tier 1** (Gold): Rust, Elixir, Zig, Ada, Haskell, ReScript -* **Tier 2** (Silver): Nickel, Racket, Guile Scheme, Nix -* **Infrastructure**: Guix channels, derivations - -=== Required Files - -* `.editorconfig` -* `.gitignore` -* `justfile` -* `README.adoc` -* `RSR_COMPLIANCE.adoc` -* `LICENSE.txt` (AGPL + Palimpsest) -* `.well-known/security.txt` -* `.well-known/ai.txt` -* `.well-known/humans.txt` -* `guix.scm` OR `flake.nix` - -=== Prohibited - -* Python outside `salt/` directory -* TypeScript/JavaScript (use ReScript) -* CUE (use Guile/Nickel) -* `Dockerfile` (use `Containerfile`) - -== STATE.scm - -The STATE.scm file tracks project state: - -[source,scheme] ----- -(define state - `((metadata - (project . "my-project") - (updated . "2025-12-10")) - (position - (phase . implementation) ; design|implementation|testing|maintenance|archived - (maturity . beta)) ; experimental|alpha|beta|production|lts - (ecosystem - (part-of . ("RSR Framework")) - (depends-on . ())))) ----- - -== Badge Schema - -Generate badges from STATE.scm: - -[source,bash] ----- -just badges standard ----- - -See `docs/BADGE_SCHEMA.adoc` for the full badge taxonomy. - -== Ecosystem Integration - -This template is part of: - -* **STATE.scm Ecosystem**: Conversation checkpoints -* **RSR Framework**: Repository standards -* **Consent-Aware-HTTP**: .well-known compliance - -== License - -SPDX-License-Identifier: MPL-2.0 - -== Links - -* https://github.com/hyperpolymath/elegant-STATE[elegant-STATE] - STATE.scm tooling -* https://github.com/hyperpolymath/conative-gating[conative-gating] - Policy enforcement -* https://rhodium.sh[Rhodium Standard] - RSR documentation diff --git a/avow-protocol/SECURITY.md b/avow-protocol/SECURITY.md deleted file mode 100644 index 034e8480..00000000 --- a/avow-protocol/SECURITY.md +++ /dev/null @@ -1,21 +0,0 @@ -# Security Policy - -## Supported Versions - -Use this section to tell people about which versions of your project are -currently being supported with security updates. - -| Version | Supported | -| ------- | ------------------ | -| 5.1.x | :white_check_mark: | -| 5.0.x | :x: | -| 4.0.x | :white_check_mark: | -| < 4.0 | :x: | - -## Reporting a Vulnerability - -Use this section to tell people how to report a vulnerability. - -Tell them where to go, how often they can expect to get an update on a -reported vulnerability, what to expect if the vulnerability is accepted or -declined, etc. diff --git a/avow-protocol/WEEK-1-COMPLETE.md b/avow-protocol/WEEK-1-COMPLETE.md deleted file mode 100644 index 6024c500..00000000 --- a/avow-protocol/WEEK-1-COMPLETE.md +++ /dev/null @@ -1,280 +0,0 @@ -# STAMP Protocol - Week 1 Complete ✅ - -**Date:** 2026-01-30 -**Status:** MVP Deployed and Ready - -## 🎉 What We Built - -### 1. Core Protocol Design -- **libstamp** - Idris2 ABI with formal verification - - Dependent types prove message compliance - - Zig FFI for C compatibility - - Transport-agnostic architecture -- **Location:** `~/Documents/hyperpolymath-repos/libstamp/` - -### 2. Working Telegram Bot -- **@stamp_demo_bot** - Live demo on Telegram - - `/start` - Subscribe with consent proof - - `/verify` - See cryptographic verification - - `/status` - Check subscription details - - `/unsubscribe` - One-click proven unsubscribe -- **Database:** SQLite persistence -- **Status:** Deployed and running -- **Location:** `~/Documents/hyperpolymath-repos/stamp-telegram-bot/` - -### 3. Professional Website -- **https://stamp-protocol.org** - Live on Cloudflare Pages - - Hero section with clear value prop - - Problem/solution framework - - Interactive browser demo (ReScript) - - Technical comparison - - Live bot link -- **Features:** - - Mobile responsive - - SEO optimized - - Fast loading - - Auto-deploys from GitHub -- **Location:** `~/Documents/hyperpolymath-repos/stamp-website/` - -### 4. Interactive Demo -- **Browser-based verification** - No install required - - Test unsubscribe link verification - - Test consent chain verification - - See mathematical proofs live -- **Tech:** ReScript (type-safe JavaScript) -- **Embedded:** stamp-protocol.org - -### 5. Strategic Planning -- **52-week execution roadmap** - - Phase 0: Foundation (Weeks 1-8) - - Phase 1: Dating app pilot (Weeks 9-20) - - Phase 2: Scale + FOMO (Weeks 21-36) - - Phase 3: Major platform (Weeks 37-52) -- **Go-to-market:** "Inception approach" -- **First customer:** Dating apps (Bumble, Hinge, Feeld) -- **Funding:** Bootstrap → Angels (£250-500k) → Series A - -### 6. Testing & Documentation -- **Testing guide** - How to get user feedback -- **Demo video script** - 2-minute pitch recording -- **Deploy guides** - Step-by-step for all platforms -- **Technical docs** - Complete API documentation - -## 📁 Repository Structure - -``` -hyperpolymath-repos/ -├── libstamp/ # Core verification library -│ ├── src/abi/*.idr # Idris2 ABI with proofs -│ └── ffi/zig/ # Zig FFI implementation -│ -├── stamp-telegram-bot/ # Working demo bot -│ ├── src/bot.ts # Telegram bot (400+ lines) -│ ├── src/database.ts # SQLite persistence -│ ├── src/stamp-mock.ts # Mock verification -│ ├── TESTING-GUIDE.md # User testing guide -│ └── DEMO-VIDEO-SCRIPT.md # Recording instructions -│ -└── stamp-website/ # Public website - ├── index.html # Landing page - ├── style.css # Responsive design - └── src/StampDemo.res # Interactive demo -``` - -## 🔗 Live Links - -| Resource | URL | -|----------|-----| -| **Website** | https://stamp-protocol.org | -| **Telegram Bot** | https://t.me/stamp_demo_bot | -| **GitHub Org** | https://github.com/hyperpolymath | -| **Bot Repo** | https://github.com/hyperpolymath/stamp-telegram-bot | -| **Website Repo** | https://github.com/hyperpolymath/stamp-website | - -## 📊 Metrics & Goals - -### Week 1 Targets (Achieved) -- [x] Working prototype deployed -- [x] Domain purchased and configured -- [x] Professional website live -- [x] Interactive demo functional -- [x] Bot responding to users -- [x] Testing materials prepared -- [x] Demo video script ready - -### Week 2 Goals -- [ ] Get 3-5 user feedback responses -- [ ] Record 2-minute demo video -- [ ] Integrate real libstamp (replace mocks) -- [ ] Performance benchmarks -- [ ] Dating app one-pager -- [ ] Reach out to first potential customer - -## 🎯 Key Innovations - -1. **Dependent Types for Messaging** - - First protocol to use formal verification - - Mathematically proven compliance - - Code won't compile if invalid - -2. **Transport-Agnostic Architecture** - - Works for email, SMS, social media - - Platform integrates, not replaces - -3. **Inception Go-to-Market** - - Present narrow (email) - - Architecture broad (everything) - - Let customers discover value - -## 💡 Market Positioning - -### Primary Markets -1. **Social Media** ($1.2B+) - - Dating apps: Fake profiles - - Twitter: Bot accounts - - Reddit: Astroturfing - -2. **Messaging** ($200M+) - - Email newsletters - - RCS business messaging - - SMS marketing - -### Value Proposition -- **For platforms:** 80-90% bot reduction, save $100M+/year -- **For users:** Proven consent, working unsubscribe, transparency -- **For regulators:** Cryptographic compliance proof - -## 🛠️ Technology Stack - -| Layer | Technology | Purpose | -|-------|------------|---------| -| **ABI** | Idris2 | Formal verification, dependent types | -| **FFI** | Zig | C-compatible, cross-platform | -| **Bot** | TypeScript + Deno | Telegram integration | -| **Website** | ReScript + HTML/CSS | Type-safe frontend | -| **Database** | SQLite | Persistence (for now) | -| **Deploy** | Cloudflare Pages | Website hosting | -| **Runtime** | Deno | Bot runtime | - -## 📚 Documentation Created - -1. **SESSION-SUMMARY-2026-01-30.md** - Complete session notes -2. **stamp-execution-roadmap.adoc** - 52-week plan -3. **stamp-week-1-checklist.md** - Week 1 tasks -4. **DEPLOY-NOW.md** - Bot deployment guide -5. **TESTING-GUIDE.md** - User testing instructions -6. **DEMO-VIDEO-SCRIPT.md** - Video recording guide -7. **README.md** - Project documentation (all repos) - -## 🚀 How to Use This Week's Work - -### Show to Investors -1. Visit stamp-protocol.org -2. Show interactive demo -3. Test Telegram bot -4. Walk through 52-week roadmap -5. Explain market size ($1.2B+) - -### Get User Feedback -1. Share @stamp_demo_bot with 3-5 people -2. Use TESTING-GUIDE.md -3. Collect feedback -4. Iterate on UX - -### Record Demo Video -1. Follow DEMO-VIDEO-SCRIPT.md -2. Install SimpleScreenRecorder -3. Practice script -4. Record 2-minute demo -5. Upload to YouTube - -### Deploy Your Own -1. Clone repos from GitHub -2. Follow DEPLOY-NOW.md -3. Get Telegram bot token -4. Deploy to Cloudflare Pages -5. Customize for your use case - -## 🎯 Next Steps (Week 2) - -### Must Do -- [ ] Test bot with 3-5 people (use TESTING-GUIDE.md) -- [ ] Record demo video (use DEMO-VIDEO-SCRIPT.md) -- [ ] Replace mocks with real libstamp -- [ ] Performance testing - -### Should Do -- [ ] Write dating app one-pager -- [ ] Research potential customers -- [ ] Improve bot UX based on feedback -- [ ] Add analytics to website - -### Could Do -- [ ] YC application (if interested) -- [ ] Reach out to angels -- [ ] Blog post explaining STAMP -- [ ] Twitter/LinkedIn presence - -## 💼 Business Readiness - -**Investment Ready:** -- ✓ Working prototype -- ✓ Clear value proposition -- ✓ Market sizing ($1.4B+) -- ✓ 52-week roadmap -- ✓ Go-to-market strategy -- ✓ Technical differentiation -- ✓ Regulatory angle (GDPR, CAN-SPAM) - -**Customer Ready:** -- ✓ Live demo (bot + website) -- ✓ Technical documentation -- ✓ Proof of concept -- ⏳ Customer testimonials (Week 2) -- ⏳ Case study (dating app pilot, Week 9-20) - -## 🏆 What Makes This Special - -1. **Speed:** Idea → Working demo in 1 day -2. **Completeness:** Bot + Website + Docs + Strategy -3. **Technical Innovation:** First use of dependent types for messaging -4. **Market Fit:** $1.4B+ market, clear problem -5. **Execution Plan:** 52-week roadmap with milestones - -## 📞 Contact & Support - -**Project:** STAMP Protocol -**Maintainer:** Jonathan D.A. Jewell -**Email:** j.d.a.jewell@open.ac.uk -**Website:** https://stamp-protocol.org -**Telegram:** @stamp_demo_bot - -**Bot Status Check:** -```bash -cd ~/Documents/hyperpolymath-repos/stamp-telegram-bot -pgrep -f bot.ts && echo "✓ Running" || echo "✗ Stopped" -tail -20 bot.log -``` - -**Website Status:** -- Live: https://stamp-protocol.org -- Auto-deploys from GitHub on push -- Cloudflare CDN (global) - -## 🎉 Congratulations! - -You went from "I have an idea about spam" to: -- ✓ Working code (1000+ lines) -- ✓ Live demo (bot + website) -- ✓ Strategic roadmap -- ✓ Market validation -- ✓ Investor-ready materials - -**That's exceptional progress for Week 1.** - -Now execute Week 2, get feedback, and iterate. You're building something that could legitimately change how the internet handles messaging. - ---- - -**Last Updated:** 2026-01-30 -**Next Review:** Week 2 completion (2026-02-06) diff --git a/avow-protocol/_headers b/avow-protocol/_headers deleted file mode 100644 index 3b1ca7e2..00000000 --- a/avow-protocol/_headers +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Security headers for stamp-protocol.org (Cloudflare Pages format) - -/* - # HSTS - Force HTTPS for 2 years, include subdomains, preload - Strict-Transport-Security: max-age=63072000; includeSubDomains; preload - - # CSP - Content Security Policy (strict) - Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' https://img.shields.io data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' - - # Prevent clickjacking - X-Frame-Options: DENY - - # Prevent MIME sniffing - X-Content-Type-Options: nosniff - - # XSS Protection - X-XSS-Protection: 1; mode=block - - # Referrer Policy - Referrer-Policy: strict-origin-when-cross-origin - - # Permissions Policy (disable unnecessary features) - Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=() - - # Cross-Origin policies - Cross-Origin-Embedder-Policy: require-corp - Cross-Origin-Opener-Policy: same-origin - Cross-Origin-Resource-Policy: same-origin diff --git a/avow-protocol/assets/favicon.svg b/avow-protocol/assets/favicon.svg deleted file mode 100644 index bf6bd3fe..00000000 --- a/avow-protocol/assets/favicon.svg +++ /dev/null @@ -1,19 +0,0 @@ - - - - - - - - - - - - - - diff --git a/avow-protocol/assets/script.js b/avow-protocol/assets/script.js deleted file mode 100644 index 2240694c..00000000 --- a/avow-protocol/assets/script.js +++ /dev/null @@ -1,68 +0,0 @@ -// STAMP Protocol Website - Interactive Elements - -// Smooth scrolling for anchor links -document.querySelectorAll('a[href^="#"]').forEach(anchor => { - anchor.addEventListener('click', function (e) { - e.preventDefault(); - const target = document.querySelector(this.getAttribute('href')); - if (target) { - target.scrollIntoView({ - behavior: 'smooth', - block: 'start' - }); - } - }); -}); - -// Add scroll animation for stats -const observerOptions = { - threshold: 0.5, - rootMargin: '0px 0px -100px 0px' -}; - -const statsObserver = new IntersectionObserver((entries) => { - entries.forEach(entry => { - if (entry.isIntersecting) { - entry.target.style.opacity = '1'; - entry.target.style.transform = 'translateY(0)'; - } - }); -}, observerOptions); - -// Animate stats when they come into view -document.addEventListener('DOMContentLoaded', () => { - const statCards = document.querySelectorAll('.stat-card'); - statCards.forEach(card => { - card.style.opacity = '0'; - card.style.transform = 'translateY(30px)'; - card.style.transition = 'all 0.6s ease-out'; - statsObserver.observe(card); - }); - - // Animate features - const features = document.querySelectorAll('.feature'); - features.forEach((feature, index) => { - feature.style.opacity = '0'; - feature.style.transform = 'translateY(30px)'; - feature.style.transition = `all 0.6s ease-out ${index * 0.1}s`; - - const featureObserver = new IntersectionObserver((entries) => { - entries.forEach(entry => { - if (entry.isIntersecting) { - entry.target.style.opacity = '1'; - entry.target.style.transform = 'translateY(0)'; - } - }); - }, observerOptions); - - featureObserver.observe(feature); - }); -}); - -// Track demo bot clicks -document.querySelectorAll('a[href*="t.me/stamp_demo_bot"]').forEach(link => { - link.addEventListener('click', () => { - console.log('Demo bot link clicked'); - // Could add analytics here - }); -}); diff --git a/avow-protocol/assets/style.css b/avow-protocol/assets/style.css deleted file mode 100644 index afce2a90..00000000 --- a/avow-protocol/assets/style.css +++ /dev/null @@ -1,412 +0,0 @@ -/* STAMP Protocol Website Styles */ - -:root { - --primary: #2563eb; - --primary-dark: #1e40af; - --secondary: #64748b; - --success: #10b981; - --background: #ffffff; - --surface: #f8fafc; - --text: #0f172a; - --text-muted: #64748b; - --border: #e2e8f0; - --code-bg: #1e293b; - --code-text: #e2e8f0; -} - -* { - margin: 0; - padding: 0; - box-sizing: border-box; -} - -body { - font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; - line-height: 1.6; - color: var(--text); - background: var(--background); -} - -.container { - max-width: 1200px; - margin: 0 auto; - padding: 0 2rem; -} - -/* Hero Section */ -.hero { - background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); - color: white; - padding: 6rem 0 8rem; - text-align: center; -} - -.hero h1 { - font-size: 4rem; - font-weight: 800; - margin-bottom: 1rem; - letter-spacing: -0.02em; -} - -.hero .tagline { - font-size: 1.5rem; - opacity: 0.95; - margin-bottom: 1rem; - font-weight: 500; -} - -.hero .subtitle { - font-size: 1.25rem; - opacity: 0.9; - max-width: 800px; - margin: 0 auto 3rem; - line-height: 1.8; -} - -.hero strong { - color: #fbbf24; - font-weight: 700; -} - -.cta-buttons { - display: flex; - gap: 1rem; - justify-content: center; - flex-wrap: wrap; -} - -.btn { - display: inline-block; - padding: 1rem 2rem; - border-radius: 0.5rem; - text-decoration: none; - font-weight: 600; - font-size: 1.1rem; - transition: all 0.2s; -} - -.btn-primary { - background: white; - color: var(--primary); -} - -.btn-primary:hover { - transform: translateY(-2px); - box-shadow: 0 10px 25px rgba(0,0,0,0.2); -} - -.btn-secondary { - background: rgba(255,255,255,0.2); - color: white; - border: 2px solid white; -} - -.btn-secondary:hover { - background: rgba(255,255,255,0.3); -} - -/* Problem Section */ -.problem { - padding: 6rem 0; - background: var(--surface); -} - -.problem h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 3rem; -} - -.problem-grid { - display: grid; - grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); - gap: 2rem; -} - -.problem-card { - background: white; - padding: 2rem; - border-radius: 1rem; - box-shadow: 0 4px 6px rgba(0,0,0,0.05); -} - -.problem-card h3 { - font-size: 1.5rem; - margin-bottom: 1rem; -} - -.problem-card .stat { - color: var(--primary); - font-weight: 700; - font-size: 1.25rem; - margin-top: 1rem; -} - -/* Solution Section */ -.solution { - padding: 6rem 0; -} - -.solution h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 1rem; -} - -.solution .intro { - text-align: center; - font-size: 1.25rem; - color: var(--text-muted); - margin-bottom: 4rem; -} - -.features { - display: grid; - grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); - gap: 3rem; -} - -.feature { - text-align: center; -} - -.feature-icon { - width: 4rem; - height: 4rem; - background: var(--success); - color: white; - border-radius: 50%; - display: flex; - align-items: center; - justify-content: center; - font-size: 2rem; - margin: 0 auto 1.5rem; -} - -.feature h3 { - font-size: 1.5rem; - margin-bottom: 1rem; -} - -.feature code { - background: var(--code-bg); - color: var(--code-text); - padding: 0.5rem 1rem; - border-radius: 0.5rem; - display: inline-block; - margin-top: 1rem; - font-size: 0.9rem; - font-family: 'Monaco', 'Courier New', monospace; -} - -/* Technical Section */ -.technical { - padding: 6rem 0; - background: var(--surface); -} - -.technical h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 4rem; -} - -.tech-comparison { - display: grid; - grid-template-columns: repeat(auto-fit, minmax(400px, 1fr)); - gap: 3rem; -} - -.tech-col h3 { - font-size: 1.5rem; - margin-bottom: 1.5rem; -} - -.tech-col pre { - background: var(--code-bg); - color: var(--code-text); - padding: 1.5rem; - border-radius: 0.75rem; - overflow-x: auto; - margin-bottom: 1rem; - font-size: 0.95rem; - line-height: 1.6; -} - -.tech-col .explanation { - font-size: 1.1rem; - color: var(--text-muted); -} - -/* Demo Section */ -.demo { - padding: 6rem 0; -} - -.demo h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 3rem; -} - -.demo-box { - max-width: 700px; - margin: 0 auto; - background: var(--surface); - padding: 3rem; - border-radius: 1rem; - border: 2px solid var(--border); -} - -.demo-box h3 { - font-size: 1.75rem; - margin-bottom: 1rem; -} - -.demo-box ol { - margin: 2rem 0; - padding-left: 1.5rem; -} - -.demo-box li { - margin-bottom: 1rem; - font-size: 1.1rem; -} - -.demo-box code { - background: var(--code-bg); - color: var(--code-text); - padding: 0.25rem 0.5rem; - border-radius: 0.25rem; - font-family: 'Monaco', 'Courier New', monospace; -} - -.demo-box .btn { - margin-top: 2rem; -} - -/* Use Cases */ -.use-cases { - padding: 6rem 0; - background: var(--surface); -} - -.use-cases h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 3rem; -} - -.use-case-grid { - display: grid; - grid-template-columns: repeat(auto-fit, minmax(250px, 1fr)); - gap: 2rem; -} - -.use-case { - background: white; - padding: 2rem; - border-radius: 0.75rem; - box-shadow: 0 2px 4px rgba(0,0,0,0.05); -} - -.use-case h3 { - font-size: 1.25rem; - margin-bottom: 0.75rem; - color: var(--primary); -} - -/* Stats */ -.stats { - padding: 6rem 0; - background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); - color: white; -} - -.stats h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 3rem; -} - -.stats-grid { - display: grid; - grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); - gap: 3rem; -} - -.stat-card { - text-align: center; -} - -.stat-number { - font-size: 3.5rem; - font-weight: 800; - margin-bottom: 0.5rem; -} - -.stat-label { - font-size: 1.25rem; - opacity: 0.9; -} - -/* Footer */ -.footer { - padding: 4rem 0 2rem; - text-align: center; - background: var(--text); - color: white; -} - -.footer h2 { - font-size: 2rem; - margin-bottom: 1rem; -} - -.footer-links { - margin: 2rem 0; - display: flex; - gap: 2rem; - justify-content: center; - flex-wrap: wrap; -} - -.footer-links a { - color: white; - text-decoration: none; - font-size: 1.1rem; - transition: opacity 0.2s; -} - -.footer-links a:hover { - opacity: 0.7; -} - -.copyright { - margin-top: 2rem; - opacity: 0.7; - font-size: 0.9rem; -} - -/* Responsive */ -@media (max-width: 768px) { - .hero h1 { - font-size: 2.5rem; - } - - .hero .tagline { - font-size: 1.25rem; - } - - .hero .subtitle { - font-size: 1.1rem; - } - - .tech-comparison { - grid-template-columns: 1fr; - } - - .container { - padding: 0 1rem; - } -} diff --git a/avow-protocol/avow-lib/.machine_readable/6a2/ECOSYSTEM.a2ml b/avow-protocol/avow-lib/.machine_readable/6a2/ECOSYSTEM.a2ml deleted file mode 100644 index b165e584..00000000 --- a/avow-protocol/avow-lib/.machine_readable/6a2/ECOSYSTEM.a2ml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# ECOSYSTEM.a2ml — Avow Lib ecosystem position -[metadata] -version = "1.0" -last-updated = "2026-04-11" - -[project] -name = "Avow Lib" -purpose = "TODO: Brief purpose statement" -role = "TODO: library|application|tool|framework" - -[position-in-ecosystem] -category = "" - -[related-projects] -projects = [ - # No related projects recorded -] diff --git a/avow-protocol/avow-lib/.machine_readable/6a2/META.a2ml b/avow-protocol/avow-lib/.machine_readable/6a2/META.a2ml deleted file mode 100644 index c741d789..00000000 --- a/avow-protocol/avow-lib/.machine_readable/6a2/META.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# META.a2ml — Avow Lib meta-level information -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project-info] -license = "PMPL-1.0-or-later" -author = "Jonathan D.A. Jewell (hyperpolymath)" - -[architecture-decisions] -decisions = [ - # No ADRs recorded -] - -[development-practices] -versioning = "SemVer" -documentation = "AsciiDoc" -build-tool = "just" - -[maintenance-axes] -scoping-first = true -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" diff --git a/avow-protocol/avow-lib/.machine_readable/6a2/STATE.a2ml b/avow-protocol/avow-lib/.machine_readable/6a2/STATE.a2ml deleted file mode 100644 index 5a9440a0..00000000 --- a/avow-protocol/avow-lib/.machine_readable/6a2/STATE.a2ml +++ /dev/null @@ -1,38 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# STATE.a2ml — Avow Lib project state -[metadata] -project = "libstamp" -version = "1.0" -last-updated = "2026-02-04" -status = "active" -session = "converted from scheme — 2026-04-11" - -[project-context] -name = "Libstamp" -purpose = """TODO: Add project description""" -completion-percentage = 0 - -[position] -phase = "development" # design | implementation | testing | maintenance | archived -maturity = "experimental" # experimental | alpha | beta | production | lts - -[route-to-mvp] -milestones = [ - # No milestones recorded -] - -[blockers-and-issues] -issues = [ - # No blockers recorded -] - -[critical-next-actions] -actions = [ - "Update STATE.scm with project details", -] - -[maintenance-status] -last-run-utc = "2026-02-04T00:00:00Z" -last-result = "unknown" # unknown | pass | warn | fail diff --git a/avow-protocol/avow-lib/BUILDING.md b/avow-protocol/avow-lib/BUILDING.md deleted file mode 100644 index 145e30a0..00000000 --- a/avow-protocol/avow-lib/BUILDING.md +++ /dev/null @@ -1,115 +0,0 @@ -# Building libstamp - -## Current Status - -**Core Idris2 types**: ✓ Complete (`src/abi/`) -**Zig FFI implementation**: ✓ Complete (`ffi/zig/`) -**Build system**: ⚠️ Zig version compatibility issue - -## The Zig Version Issue - -The FFI code is written for **Zig 0.13.0**, but your system has **Zig 0.15.2** installed. - -Zig 0.15 is a development version with breaking API changes. The build system API is completely different. - -## Option 1: Downgrade to Zig 0.13.0 (Recommended) - -```bash -# You have asdf installed, so: -asdf install zig 0.13.0 -cd ~/Documents/hyperpolymath-repos/libstamp -asdf local zig 0.13.0 - -# Now build works: -cd ffi/zig -zig build # Build library -zig build test # Run tests -zig build example # Run example -``` - -## Option 2: Skip FFI for MVP - -For the **Telegram bot demo** (your Week 1 goal), you don't actually need the full FFI yet. - -**What you can do instead:** - -1. **Mock the verification functions** in TypeScript/ReScript -2. Build the Telegram bot with mocked verification -3. Prove the UX works -4. Come back and integrate real FFI later - -This gets you to a working demo **faster**. - -### Mock Implementation (TypeScript for Deno) - -```typescript -// mock-stamp.ts - Temporary until Zig FFI is built - -export interface UnsubscribeParams { - url: string; - tested_at: number; - response_code: number; - response_time: number; - token: string; - signature: string; -} - -export function verifyUnsubscribe(params: UnsubscribeParams): boolean { - // Mock implementation - checks basic properties - if (!params.url.startsWith('https://')) return false; - if (params.response_code !== 200) return false; - if (params.response_time >= 200) return false; - - const now = Date.now(); - const age = now - params.tested_at; - if (age > 60000) return false; // > 60 seconds old - - return true; -} - -export function generateProof(params: UnsubscribeParams): string { - return JSON.stringify({ - type: "unsubscribe_verification", - url: params.url, - tested_at: params.tested_at, - response_code: params.response_code, - response_time_ms: params.response_time, - verified: true, - timestamp: Date.now(), - }, null, 2); -} -``` - -This lets you: -- ✓ Build Telegram bot **now** -- ✓ Demo the UX **this week** -- ✓ Show investors/users -- → Add real FFI later (Week 2-3) - -## Option 3: Update build.zig for Zig 0.15 - -If you want to use Zig 0.15, I can research the new API and update `build.zig`. But this will take time. - -## My Recommendation - -**For Week 1 (this week):** -- Use **Option 2** (mock implementation) -- Build Telegram bot with mocked verification -- Get feedback from users - -**For Week 2:** -- Install Zig 0.13.0 (Option 1) -- Build real FFI -- Replace mocks with real verification - -**Why:** Gets you to a demo **faster**. The UX is more important than the implementation for early feedback. - -## Next Steps - -Tell me which option you want: - -1. **"Help me downgrade Zig"** → I'll guide you through asdf setup -2. **"Let's use mocks for now"** → I'll help you build the Telegram bot immediately -3. **"Fix build.zig for 0.15"** → I'll research and update (takes longer) - -What's your priority? diff --git a/avow-protocol/avow-lib/LICENSE b/avow-protocol/avow-lib/LICENSE deleted file mode 100644 index 4d9b782e..00000000 --- a/avow-protocol/avow-lib/LICENSE +++ /dev/null @@ -1,27 +0,0 @@ -POLYMATHEMATICAL META-PUBLIC LICENSE (PMPL) -Version 1.0, or (at your option) any later version - -Copyright (c) 2026 Jonathan D.A. Jewell - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - ---- - -This license is also known as the Palimpsest License. -SPDX-License-Identifier: MPL-2.0 diff --git a/avow-protocol/avow-lib/README.adoc b/avow-protocol/avow-lib/README.adoc deleted file mode 100644 index 2d1e41d8..00000000 --- a/avow-protocol/avow-lib/README.adoc +++ /dev/null @@ -1,221 +0,0 @@ -= avow-lib: Formal Verification Library for Avow Protocol -Jonathan D.A. Jewell -:toc: -:idris2-version: 0.7.0 -:zig-version: 0.13.0 - -== Overview - -*avow-lib* is the core verification library for the Avow protocol (formerly STAMP). It uses *dependent types* to provide *mathematical proofs* of compliance properties that are impossible with traditional type systems. - -== The Core Innovation - -=== What Makes Avow Different? - -[cols="1,1,1,1"] -|=== -|Approach |Type Safety |Memory Safety |*Provable Properties* - -|JSON/CSV -|✗ -|✗ -|✗ - -|Rust/Go -|✓ -|✓ -|✗ - -|Haskell/OCaml -|✓ -|~ -|✗ - -|*Idris2* (Avow) -|✓ -|✓ -|*✓* -|=== - -=== Example: Unsubscribe Link Verification - -*Without dependent types (Rust):* -[source,rust] ----- -struct UnsubscribeLink { - url: String, - tested: bool, // ✗ Can be set to true without testing -} ----- - -*With dependent types (Idris2):* -[source,idris] ----- -record UnsubscribeLink where - url : URL - testedAt : Timestamp - response : HTTPResponse - {auto 0 recentTest : TimeDiff testedAt Now 60000} - {auto 0 success : response.code = OK} - {auto 0 fastResponse : response.responseTime < 200} ----- - -*Result:* You literally cannot compile code that creates an invalid unsubscribe link. - -== Architecture - -Following the hyperpolymath ABI/FFI universal standard: - ----- -avow-lib/ -├── src/ -│ ├── abi/ # Idris2 ABI definitions (CORE) -│ │ ├── Types.idr # Foundational types -│ │ ├── Unsubscribe.idr # Unsubscribe verification -│ │ ├── Consent.idr # Consent chain proofs -│ │ └── RateLimit.idr # Rate limiting proofs -│ └── lib/ # Additional library code -│ -├── ffi/ -│ └── zig/ # Zig FFI implementation -│ ├── build.zig -│ └── src/ -│ └── main.zig # C ABI wrapper -│ -├── generated/ -│ └── abi/ -│ └── *.h # C headers (for compatibility) -│ -└── examples/ - └── basic_verification.idr ----- - -== What Gets Proven - -=== 1. Unsubscribe Verification - -* ✓ URL was tested (not just claimed) -* ✓ Test was recent (< 60 seconds old) -* ✓ Server responded with 200 OK -* ✓ Response was fast (< 200ms) -* ✓ Cryptographically signed - -=== 2. Consent Chain Verification - -* ✓ User actually opted in (double opt-in) -* ✓ Confirmation happened AFTER request -* ✓ Confirmation was timely (< 24 hours) -* ✓ Token is cryptographically valid - -=== 3. Rate Limiting - -* ✓ Sender hasn't exceeded daily limit -* ✓ Limit appropriate for trust level -* ✓ Cannot bypass at runtime - -=== 4. Content Safety - -* ✓ No malware detected -* ✓ No dark patterns -* ✓ Policy compliance verified - -== Why Not Other Languages? - -[cols="1,3"] -|=== -|Language |Limitation - -|Haskell -|Strong types, but cannot prove URL actually works - -|Rust -|Memory safe, but cannot prove algorithmic properties - -|Go -|Simple, but weak type system, no proofs - -|OCaml -|Good types, but not dependent types - -|Coq/Agda -|Theorem provers, not practical for systems programming - -|Idris2 -|*Dependent types + practical systems programming* -|=== - -== Building - -*Requirements:* - -* Idris2 {idris2-version}+ -* Zig {zig-version}+ - -*Build:* -[source,bash] ----- -# Build Idris2 ABI -cd src/abi -idris2 --build - -# Build Zig FFI -cd ../../ffi/zig -zig build ----- - -== Usage Example - -*Rust/Go/Python code using avow-lib via FFI:* - -[source,rust] ----- -// Rust code calling Idris2 verification via Zig FFI -extern "C" { - fn stamp_verify_unsubscribe( - url: *const c_char, - tested_at: u64, - response_code: u16, - response_time: u32, - token: *const c_char, - signature: *const c_char, - ) -> bool; -} - -// This returns false if proofs don't hold -let valid = unsafe { - stamp_verify_unsubscribe( - c_str("https://example.com/unsub"), - 1706630400000, - 200, // OK - 87, // 87ms - c_str("token..."), - c_str("signature..."), - ) -}; - -if valid { - // Proofs checked, message can be delivered - deliver_message(msg); -} ----- - -== Status - -*Current:* Proof of concept - -* [x] Core types defined -* [x] Unsubscribe verification -* [x] Consent chain verification -* [ ] Rate limiting verification -* [ ] Content safety verification -* [ ] Zig FFI implementation -* [ ] C header generation -* [ ] Integration tests - -== License - -PMPL-1.0-or-later - -== Author - -Jonathan D.A. Jewell diff --git a/avow-protocol/avow-lib/examples/deno/stamp_example.js b/avow-protocol/avow-lib/examples/deno/stamp_example.js deleted file mode 100644 index 2c5a8f25..00000000 --- a/avow-protocol/avow-lib/examples/deno/stamp_example.js +++ /dev/null @@ -1,300 +0,0 @@ -#!/usr/bin/env -S deno run --allow-read --allow-ffi -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// -// Deno example using libstamp via Deno FFI (port of the former Python -// ctypes example; Python is banned estate-wide). - -import { dirname, fromFileUrl, join } from "jsr:@std/path@^1"; - -// ============================================================================ -// Load Library -// ============================================================================ - -function loadLibstamp() { - let libName; - if (Deno.build.os === "darwin") libName = "libstamp.dylib"; - else if (Deno.build.os === "windows") libName = "stamp.dll"; - else libName = "libstamp.so"; - - const here = dirname(fromFileUrl(import.meta.url)); - const searchPaths = [ - join(here, "..", "..", "ffi", "zig", "zig-out", "lib", libName), - join("/usr/local/lib", libName), - join("/usr/lib", libName), - ]; - - for (const path of searchPaths) { - try { - Deno.statSync(path); - return Deno.dlopen(path, SYMBOLS); - } catch { - // try next - } - } - throw new Error( - `Could not find ${libName}. Build with: cd ffi/zig && zig build`, - ); -} - -const SYMBOLS = { - stamp_verify_unsubscribe: { parameters: ["pointer"], result: "i32" }, - stamp_verify_consent: { parameters: ["pointer"], result: "i32" }, - stamp_verify_rate_limit: { parameters: ["pointer"], result: "i32" }, - stamp_generate_proof: { parameters: ["pointer"], result: "pointer" }, - stamp_free_proof: { parameters: ["pointer"], result: "void" }, - stamp_version: { parameters: [], result: "pointer" }, -}; - -const libstamp = loadLibstamp(); - -// ============================================================================ -// Result codes -// ============================================================================ - -const StampResult = { - SUCCESS: 0, - ERROR_INVALID_URL: -1, - ERROR_TIMEOUT: -2, - ERROR_INVALID_RESPONSE: -3, - ERROR_INVALID_SIGNATURE: -4, - ERROR_RATE_LIMIT_EXCEEDED: -5, - ERROR_CONSENT_INVALID: -6, - ERROR_NULL_POINTER: -7, - ERROR_INTERNAL: -99, - toString(code) { - return ({ - 0: "✓ SUCCESS", - [-1]: "✗ INVALID_URL", - [-2]: "✗ TIMEOUT", - [-3]: "✗ INVALID_RESPONSE", - [-4]: "✗ INVALID_SIGNATURE", - [-5]: "✗ RATE_LIMIT_EXCEEDED", - [-6]: "✗ CONSENT_INVALID", - [-7]: "✗ NULL_POINTER", - [-99]: "✗ INTERNAL_ERROR", - })[code] ?? "✗ UNKNOWN_ERROR"; - }, -}; - -// ============================================================================ -// C struct marshalling (x86-64 SysV natural alignment) -// ============================================================================ - -const enc = new TextEncoder(); - -function cstring(s) { - const bytes = enc.encode(s); - const buf = new Uint8Array(bytes.length + 1); - buf.set(bytes); - return buf; // NUL-terminated; keep a reference so it isn't GC'd -} - -function ptrBig(buf) { - return BigInt(Deno.UnsafePointer.value(Deno.UnsafePointer.of(buf))); -} - -// StampUnsubscribeParams { char* url; u64 tested_at; u16 response_code; -// u32 response_time; char* token; char* signature; } size 40 -function unsubscribeParams({ url, testedAt, responseCode, responseTime, token, signature }) { - const urlB = cstring(url), tokB = cstring(token), sigB = cstring(signature); - const buf = new ArrayBuffer(40); - const dv = new DataView(buf); - dv.setBigUint64(0, ptrBig(urlB), true); - dv.setBigUint64(8, BigInt(testedAt), true); - dv.setUint16(16, responseCode, true); - dv.setUint32(20, responseTime, true); - dv.setBigUint64(24, ptrBig(tokB), true); - dv.setBigUint64(32, ptrBig(sigB), true); - return { buf: new Uint8Array(buf), keep: [urlB, tokB, sigB] }; -} - -// StampConsentParams { u64 initial_request; u64 confirmation; -// char* ip_address; char* token; } size 32 -function consentParams({ initialRequest, confirmation, ipAddress, token }) { - const ipB = cstring(ipAddress), tokB = cstring(token); - const buf = new ArrayBuffer(32); - const dv = new DataView(buf); - dv.setBigUint64(0, BigInt(initialRequest), true); - dv.setBigUint64(8, BigInt(confirmation), true); - dv.setBigUint64(16, ptrBig(ipB), true); - dv.setBigUint64(24, ptrBig(tokB), true); - return { buf: new Uint8Array(buf), keep: [ipB, tokB] }; -} - -// StampRateLimitParams { char* sender_id; u64 account_created; -// u32 messages_today; u32 daily_limit; } size 24 -function rateLimitParams({ senderId, accountCreated, messagesToday, dailyLimit }) { - const idB = cstring(senderId); - const buf = new ArrayBuffer(24); - const dv = new DataView(buf); - dv.setBigUint64(0, ptrBig(idB), true); - dv.setBigUint64(8, BigInt(accountCreated), true); - dv.setUint32(16, messagesToday, true); - dv.setUint32(20, dailyLimit, true); - return { buf: new Uint8Array(buf), keep: [idB] }; -} - -// StampProof { char* data; size_t length; char* signature; } size 24 -function readProof(ptr) { - if (ptr === null) return null; - const view = new Deno.UnsafePointerView(ptr); - const dataPtrVal = view.getBigUint64(0); - const dataPtr = Deno.UnsafePointer.create(dataPtrVal); - return new Deno.UnsafePointerView(dataPtr).getCString(); -} - -// ============================================================================ -// Wrappers -// ============================================================================ - -function getCurrentTimestamp() { - return Date.now(); -} - -function verifyUnsubscribe(args) { - const p = unsubscribeParams(args); - return libstamp.symbols.stamp_verify_unsubscribe(Deno.UnsafePointer.of(p.buf)); -} - -function verifyConsent(args) { - const p = consentParams(args); - return libstamp.symbols.stamp_verify_consent(Deno.UnsafePointer.of(p.buf)); -} - -function verifyRateLimit(args) { - const p = rateLimitParams(args); - return libstamp.symbols.stamp_verify_rate_limit(Deno.UnsafePointer.of(p.buf)); -} - -function generateProof(args) { - const p = unsubscribeParams(args); - const proofPtr = libstamp.symbols.stamp_generate_proof(Deno.UnsafePointer.of(p.buf)); - if (proofPtr === null) return null; - const data = readProof(proofPtr); - libstamp.symbols.stamp_free_proof(proofPtr); - return data; -} - -function getVersion() { - const ptr = libstamp.symbols.stamp_version(); - return new Deno.UnsafePointerView(ptr).getCString(); -} - -// ============================================================================ -// Examples -// ============================================================================ - -function assert(cond, msg) { - if (!cond) throw new Error(`Assertion failed: ${msg}`); -} - -function main() { - console.log("=== STAMP Deno Example ===\n"); - console.log(`Version: ${getVersion()}\n`); - - const now = getCurrentTimestamp(); - - console.log("Example 1: Valid Unsubscribe Link"); - console.log("=================================="); - let result = verifyUnsubscribe({ - url: "https://example.com/unsubscribe", - testedAt: now - 5000, - responseCode: 200, - responseTime: 87, - token: "EXAMPLE-UNSUBSCRIBE-TOKEN", - signature: "EXAMPLE-SIGNATURE", - }); - console.log(`Result: ${StampResult.toString(result)}`); - assert(result === StampResult.SUCCESS, "example 1"); - console.log(); - - const proof = generateProof({ - url: "https://example.com/unsubscribe", - testedAt: now - 5000, - responseCode: 200, - responseTime: 87, - token: "EXAMPLE-UNSUBSCRIBE-TOKEN", - signature: "EXAMPLE-SIGNATURE", - }); - if (proof) { - console.log("Proof generated:"); - console.log(proof); - console.log(); - } - - console.log("Example 2: Invalid URL"); - console.log("======================"); - result = verifyUnsubscribe({ - url: "not_a_url", - testedAt: now, - responseCode: 200, - responseTime: 87, - token: "EXAMPLE-TOKEN", - signature: "EXAMPLE-SIG", - }); - console.log(`Result: ${StampResult.toString(result)}`); - assert(result === StampResult.ERROR_INVALID_URL, "example 2"); - console.log(); - - console.log("Example 3: Valid Consent Chain"); - console.log("==============================="); - const initial = 1706630400000; - const confirmation = initial + 100000; - result = verifyConsent({ - initialRequest: initial, - confirmation, - ipAddress: "192.168.1.100", - token: "EXAMPLE-CONSENT-TOKEN", - }); - console.log(`Initial: ${initial}`); - console.log(`Confirmation: ${confirmation} (+${Math.floor((confirmation - initial) / 1000)} seconds)`); - console.log(`Result: ${StampResult.toString(result)}`); - assert(result === StampResult.SUCCESS, "example 3"); - console.log(); - - console.log("Example 4: Invalid Consent Order"); - console.log("================================="); - result = verifyConsent({ - initialRequest: confirmation, - confirmation: initial, - ipAddress: "192.168.1.100", - token: "EXAMPLE-CONSENT-TOKEN", - }); - console.log(`Result: ${StampResult.toString(result)}`); - assert(result === StampResult.ERROR_CONSENT_INVALID, "example 4"); - console.log(); - - console.log("Example 5: Rate Limit Check"); - console.log("============================"); - const accountAge = now - (45 * 24 * 60 * 60 * 1000); - result = verifyRateLimit({ - senderId: "user_12345", - accountCreated: accountAge, - messagesToday: 150, - dailyLimit: 10000, - }); - const ageDays = Math.floor((now - accountAge) / (24 * 60 * 60 * 1000)); - console.log(`Account age: ${ageDays} days`); - console.log("Messages: 150/10000"); - console.log(`Result: ${StampResult.toString(result)}`); - assert(result === StampResult.SUCCESS, "example 5"); - console.log(); - - console.log("Example 6: Rate Limit Exceeded"); - console.log("==============================="); - result = verifyRateLimit({ - senderId: "spammer", - accountCreated: accountAge, - messagesToday: 10000, - dailyLimit: 10000, - }); - console.log("Messages: 10000/10000"); - console.log(`Result: ${StampResult.toString(result)}`); - assert(result === StampResult.ERROR_RATE_LIMIT_EXCEEDED, "example 6"); - console.log(); - - console.log("All examples passed! ✓"); -} - -main(); diff --git a/avow-protocol/avow-lib/examples/rust/Cargo.lock b/avow-protocol/avow-lib/examples/rust/Cargo.lock deleted file mode 100644 index e5bde4be..00000000 --- a/avow-protocol/avow-lib/examples/rust/Cargo.lock +++ /dev/null @@ -1,16 +0,0 @@ -# This file is automatically @generated by Cargo. -# It is not intended for manual editing. -version = 4 - -[[package]] -name = "libc" -version = "0.2.184" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af" - -[[package]] -name = "stamp-rust-example" -version = "1.0.0" -dependencies = [ - "libc", -] diff --git a/avow-protocol/avow-lib/examples/rust/Cargo.toml b/avow-protocol/avow-lib/examples/rust/Cargo.toml deleted file mode 100644 index 863614af..00000000 --- a/avow-protocol/avow-lib/examples/rust/Cargo.toml +++ /dev/null @@ -1,9 +0,0 @@ -[package] -name = "stamp-rust-example" -version = "1.0.0" -edition = "2021" -authors = ["Jonathan D.A. Jewell "] -license = "PMPL-1.0-or-later" - -[dependencies] -libc = "0.2" diff --git a/avow-protocol/avow-lib/examples/rust/src/main.rs b/avow-protocol/avow-lib/examples/rust/src/main.rs deleted file mode 100644 index 02deb5ae..00000000 --- a/avow-protocol/avow-lib/examples/rust/src/main.rs +++ /dev/null @@ -1,331 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell - -//! Rust example using libstamp via FFI - -use std::ffi::{CStr, CString}; -use std::os::raw::{c_char, c_int}; -use std::time::{SystemTime, UNIX_EPOCH}; - -// ============================================================================ -// FFI Bindings -// ============================================================================ - -#[repr(C)] -#[derive(Debug, Copy, Clone, PartialEq)] -#[allow(dead_code)] -enum StampResult { - Success = 0, - ErrorInvalidUrl = -1, - ErrorTimeout = -2, - ErrorInvalidResponse = -3, - ErrorInvalidSignature = -4, - ErrorRateLimitExceeded = -5, - ErrorConsentInvalid = -6, - ErrorNullPointer = -7, - ErrorInternal = -99, -} - -impl From for StampResult { - fn from(value: c_int) -> Self { - match value { - 0 => StampResult::Success, - -1 => StampResult::ErrorInvalidUrl, - -2 => StampResult::ErrorTimeout, - -3 => StampResult::ErrorInvalidResponse, - -4 => StampResult::ErrorInvalidSignature, - -5 => StampResult::ErrorRateLimitExceeded, - -6 => StampResult::ErrorConsentInvalid, - -7 => StampResult::ErrorNullPointer, - _ => StampResult::ErrorInternal, - } - } -} - -#[repr(C)] -struct StampUnsubscribeParams { - url: *const c_char, - tested_at: u64, - response_code: u16, - response_time: u32, - token: *const c_char, - signature: *const c_char, -} - -#[repr(C)] -struct StampConsentParams { - initial_request: u64, - confirmation: u64, - ip_address: *const c_char, - token: *const c_char, -} - -#[repr(C)] -struct StampRateLimitParams { - sender_id: *const c_char, - account_created: u64, - messages_today: u32, - daily_limit: u32, -} - -#[repr(C)] -struct StampProof { - data: *mut c_char, - length: usize, - signature: *mut c_char, -} - -extern "C" { - fn stamp_verify_unsubscribe(params: *const StampUnsubscribeParams) -> c_int; - fn stamp_verify_consent(params: *const StampConsentParams) -> c_int; - fn stamp_verify_rate_limit(params: *const StampRateLimitParams) -> c_int; - fn stamp_generate_proof(params: *const StampUnsubscribeParams) -> *mut StampProof; - fn stamp_free_proof(proof: *mut StampProof); - fn stamp_version() -> *const c_char; -} - -// ============================================================================ -// Safe Rust Wrappers -// ============================================================================ - -fn get_current_timestamp() -> u64 { - SystemTime::now() - .duration_since(UNIX_EPOCH) - .unwrap() - .as_millis() as u64 -} - -fn verify_unsubscribe( - url: &str, - tested_at: u64, - response_code: u16, - response_time: u32, - token: &str, - signature: &str, -) -> StampResult { - let url_c = CString::new(url).unwrap(); - let token_c = CString::new(token).unwrap(); - let signature_c = CString::new(signature).unwrap(); - - let params = StampUnsubscribeParams { - url: url_c.as_ptr(), - tested_at, - response_code, - response_time, - token: token_c.as_ptr(), - signature: signature_c.as_ptr(), - }; - - let result = unsafe { stamp_verify_unsubscribe(¶ms) }; - StampResult::from(result) -} - -fn verify_consent( - initial_request: u64, - confirmation: u64, - ip_address: &str, - token: &str, -) -> StampResult { - let ip_c = CString::new(ip_address).unwrap(); - let token_c = CString::new(token).unwrap(); - - let params = StampConsentParams { - initial_request, - confirmation, - ip_address: ip_c.as_ptr(), - token: token_c.as_ptr(), - }; - - let result = unsafe { stamp_verify_consent(¶ms) }; - StampResult::from(result) -} - -fn verify_rate_limit( - sender_id: &str, - account_created: u64, - messages_today: u32, - daily_limit: u32, -) -> StampResult { - let sender_c = CString::new(sender_id).unwrap(); - - let params = StampRateLimitParams { - sender_id: sender_c.as_ptr(), - account_created, - messages_today, - daily_limit, - }; - - let result = unsafe { stamp_verify_rate_limit(¶ms) }; - StampResult::from(result) -} - -fn generate_proof( - url: &str, - tested_at: u64, - response_code: u16, - response_time: u32, - token: &str, - signature: &str, -) -> Option { - let url_c = CString::new(url).unwrap(); - let token_c = CString::new(token).unwrap(); - let signature_c = CString::new(signature).unwrap(); - - let params = StampUnsubscribeParams { - url: url_c.as_ptr(), - tested_at, - response_code, - response_time, - token: token_c.as_ptr(), - signature: signature_c.as_ptr(), - }; - - let proof_ptr = unsafe { stamp_generate_proof(¶ms) }; - if proof_ptr.is_null() { - return None; - } - - unsafe { - let proof = &*proof_ptr; - let proof_str = CStr::from_ptr(proof.data).to_string_lossy().into_owned(); - stamp_free_proof(proof_ptr); - Some(proof_str) - } -} - -fn get_version() -> String { - unsafe { - CStr::from_ptr(stamp_version()) - .to_string_lossy() - .into_owned() - } -} - -// ============================================================================ -// Examples -// ============================================================================ - -fn main() { - println!("=== STAMP Rust Example ===\n"); - println!("Version: {}\n", get_version()); - - // Example 1: Valid unsubscribe link - println!("Example 1: Valid Unsubscribe Link"); - println!("=================================="); - - let now = get_current_timestamp(); - let result = verify_unsubscribe( - "https://example.com/unsubscribe", - now - 5000, // 5 seconds ago - 200, - 87, - "abc123def456", - "valid_signature", - ); - - println!("Result: {:?}", result); - assert_eq!(result, StampResult::Success); - println!("✓ Verification passed\n"); - - // Generate and display proof - if let Some(proof) = generate_proof( - "https://example.com/unsubscribe", - now - 5000, - 200, - 87, - "abc123def456", - "valid_signature", - ) { - println!("Proof generated:"); - println!("{}\n", proof); - } - - // Example 2: Invalid URL - println!("Example 2: Invalid URL"); - println!("======================"); - - let result = verify_unsubscribe( - "not_a_url", - now, - 200, - 87, - "token", - "sig", - ); - - println!("Result: {:?}", result); - assert_eq!(result, StampResult::ErrorInvalidUrl); - println!("✓ Correctly rejected invalid URL\n"); - - // Example 3: Valid consent chain - println!("Example 3: Valid Consent Chain"); - println!("==============================="); - - let initial = 1706630400000u64; - let confirmation = initial + 100000; // 100 seconds later - - let result = verify_consent( - initial, - confirmation, - "192.168.1.100", - "consent_token", - ); - - println!("Initial: {}", initial); - println!("Confirmation: {} (+{} seconds)", confirmation, (confirmation - initial) / 1000); - println!("Result: {:?}", result); - assert_eq!(result, StampResult::Success); - println!("✓ Consent verified\n"); - - // Example 4: Invalid consent (confirmation before request) - println!("Example 4: Invalid Consent Order"); - println!("================================="); - - let result = verify_consent( - confirmation, // Swapped! - initial, - "192.168.1.100", - "consent_token", - ); - - println!("Result: {:?}", result); - assert_eq!(result, StampResult::ErrorConsentInvalid); - println!("✓ Correctly rejected invalid consent order\n"); - - // Example 5: Rate limit check - println!("Example 5: Rate Limit Check"); - println!("============================"); - - let account_age = now - (45 * 24 * 60 * 60 * 1000); // 45 days ago - - let result = verify_rate_limit( - "user_12345", - account_age, - 150, // messages today - 10000, // daily limit - ); - - println!("Account age: {} days", (now - account_age) / (24 * 60 * 60 * 1000)); - println!("Messages: 150/10000"); - println!("Result: {:?}", result); - assert_eq!(result, StampResult::Success); - println!("✓ Within rate limits\n"); - - // Example 6: Rate limit exceeded - println!("Example 6: Rate Limit Exceeded"); - println!("==============================="); - - let result = verify_rate_limit( - "spammer", - account_age, - 10000, // At limit - 10000, - ); - - println!("Messages: 10000/10000"); - println!("Result: {:?}", result); - assert_eq!(result, StampResult::ErrorRateLimitExceeded); - println!("✓ Correctly detected rate limit violation\n"); - - println!("All examples passed! ✓"); -} diff --git a/avow-protocol/avow-lib/ffi/zig/README.adoc b/avow-protocol/avow-lib/ffi/zig/README.adoc deleted file mode 100644 index a3de982f..00000000 --- a/avow-protocol/avow-lib/ffi/zig/README.adoc +++ /dev/null @@ -1,397 +0,0 @@ -= libstamp Zig FFI -Jonathan D.A. Jewell -:toc: -:zig-version: 0.13.0 - -== Overview - -This directory contains the Zig FFI implementation for libstamp, providing a stable C ABI that can be called from any language. - -== Building - -=== Prerequisites - -* Zig {zig-version}+ (https://ziglang.org/download/) -* Basic understanding of C FFI - -=== Build Commands - -[source,bash] ----- -# Build library -zig build - -# Run tests -zig build test - -# Run example -zig build example - -# Install system-wide (optional) -zig build --prefix /usr/local ----- - -**Output:** -``` -zig-out/ -├── lib/ -│ ├── libstamp.so # Linux -│ ├── libstamp.dylib # macOS -│ └── stamp.dll # Windows -└── include/ - └── stamp.h # C header -``` - -== Usage - -=== From C/C++ - -[source,c] ----- -#include -#include - -int main() { - StampUnsubscribeParams params = { - .url = "https://example.com/unsub", - .tested_at = 1706630400000, - .response_code = 200, - .response_time = 87, - .token = "abc123...", - .signature = "sig...", - }; - - StampResult result = stamp_verify_unsubscribe(¶ms); - if (result == STAMP_SUCCESS) { - printf("Valid unsubscribe link!\n"); - } else { - printf("Verification failed: %d\n", result); - } - - return 0; -} ----- - -**Compile:** -[source,bash] ----- -gcc -o myapp myapp.c -L./zig-out/lib -lstamp -I./zig-out/include -export LD_LIBRARY_PATH=./zig-out/lib # Linux -export DYLD_LIBRARY_PATH=./zig-out/lib # macOS -./myapp ----- - -=== From Rust - -See `examples/rust/` for complete example. - -[source,rust] ----- -use std::ffi::CString; - -#[link(name = "stamp")] -extern "C" { - fn stamp_verify_unsubscribe(params: *const StampUnsubscribeParams) -> c_int; -} - -fn main() { - let url = CString::new("https://example.com/unsub").unwrap(); - let token = CString::new("abc123...").unwrap(); - let sig = CString::new("signature...").unwrap(); - - let params = StampUnsubscribeParams { - url: url.as_ptr(), - tested_at: 1706630400000, - response_code: 200, - response_time: 87, - token: token.as_ptr(), - signature: sig.as_ptr(), - }; - - let result = unsafe { stamp_verify_unsubscribe(¶ms) }; - println!("Result: {}", result); -} ----- - -**Build:** -[source,bash] ----- -cd examples/rust -cargo build -cargo run ----- - -=== From JavaScript/Deno - -See `examples/deno/` for the complete, runnable example. - -[source,javascript] ----- -// Deno FFI -const libstamp = Deno.dlopen("./zig-out/lib/libstamp.so", { - stamp_verify_unsubscribe: { - parameters: ["pointer"], - result: "i32", - }, -}); - -const params = new Uint8Array(64); // Serialize params -const result = libstamp.symbols.stamp_verify_unsubscribe(params); -console.log(`Result: ${result}`); ----- - -**Run:** -[source,bash] ----- -deno run --allow-read --allow-ffi examples/deno/stamp_example.js ----- - -== API Reference - -=== Result Codes - -[cols="1,1,3"] -|=== -|Code |Name |Description - -|0 -|STAMP_SUCCESS -|Verification passed - -|-1 -|STAMP_ERROR_INVALID_URL -|URL format is invalid (not HTTPS) - -|-2 -|STAMP_ERROR_TIMEOUT -|Test was not recent OR response was too slow - -|-3 -|STAMP_ERROR_INVALID_RESPONSE -|HTTP response code was not 200 OK - -|-4 -|STAMP_ERROR_INVALID_SIGNATURE -|Cryptographic signature is invalid - -|-5 -|STAMP_ERROR_RATE_LIMIT_EXCEEDED -|Sender has exceeded daily message limit - -|-6 -|STAMP_ERROR_CONSENT_INVALID -|Consent chain is invalid (timing or token) - -|-7 -|STAMP_ERROR_NULL_POINTER -|NULL pointer passed to function - -|-99 -|STAMP_ERROR_INTERNAL -|Internal error -|=== - -=== Functions - -==== stamp_verify_unsubscribe() - -Verifies an unsubscribe link is valid. - -**Checks:** -* URL format is valid (HTTPS) -* Test was recent (< 60 seconds ago) -* HTTP response was 200 OK -* Response time was fast (< 200ms) -* Signature is valid - -[source,c] ----- -StampResult stamp_verify_unsubscribe(const StampUnsubscribeParams* params); ----- - -==== stamp_verify_consent() - -Verifies a consent chain (double opt-in). - -**Checks:** -* Confirmation happened AFTER initial request -* Confirmation was timely (< 24 hours) -* Token is cryptographically valid - -[source,c] ----- -StampResult stamp_verify_consent(const StampConsentParams* params); ----- - -==== stamp_verify_rate_limit() - -Verifies sender is within rate limits. - -**Checks:** -* Messages today < daily limit -* Daily limit appropriate for account age: - - < 30 days: max 1,000/day - - 30-90 days: max 10,000/day - - 90+ days: max 100,000/day - -[source,c] ----- -StampResult stamp_verify_rate_limit(const StampRateLimitParams* params); ----- - -==== stamp_generate_proof() - -Generates a JSON proof of verification. - -**Returns:** Pointer to `StampProof` (must be freed with `stamp_free_proof()`) - -[source,c] ----- -StampProof* stamp_generate_proof(const StampUnsubscribeParams* params); ----- - -==== stamp_free_proof() - -Frees a proof returned by `stamp_generate_proof()`. - -[source,c] ----- -void stamp_free_proof(StampProof* proof); ----- - -==== stamp_version() - -Returns library version string. - -[source,c] ----- -const char* stamp_version(void); ----- - -== Testing - -Run the test suite: - -[source,bash] ----- -zig build test ----- - -Tests include: -* Valid unsubscribe verification -* Invalid URL detection -* Slow response detection -* Valid consent chain -* Invalid consent order detection -* Rate limit compliance -* Rate limit exceeded detection -* Proof generation and freeing - -== Architecture - -[source] ----- -Application (Rust/Python/JS) - ↓ - C FFI (stamp.h) - ↓ - Zig FFI (main.zig) - ↓ - Idris2 ABI (../../../src/abi/*.idr) - ↓ - Dependent Type Proofs ----- - -The Zig layer: -1. Provides stable C ABI -2. Handles memory management -3. Wraps Idris2 verification functions -4. Exports to all languages - -## Performance - -**Benchmarks** (Release build, Intel i7): -* Unsubscribe verification: ~500 ns -* Consent verification: ~300 ns -* Rate limit verification: ~200 ns -* Proof generation: ~50 µs - -**Memory:** -* Zero allocations per verification (stack-only) -* Proof generation allocates once (freed by caller) - -== Troubleshooting - -=== Library not found - -**Linux:** -[source,bash] ----- -export LD_LIBRARY_PATH=/path/to/zig-out/lib:$LD_LIBRARY_PATH ----- - -**macOS:** -[source,bash] ----- -export DYLD_LIBRARY_PATH=/path/to/zig-out/lib:$DYLD_LIBRARY_PATH ----- - -**Or install system-wide:** -[source,bash] ----- -zig build --prefix /usr/local -sudo ldconfig # Linux only ----- - -=== Build errors - -1. **Check Zig version:** - ```bash - zig version # Should be 0.13.0+ - ``` - -2. **Clean and rebuild:** - ```bash - rm -rf zig-cache zig-out - zig build - ``` - -3. **Check for compiler errors:** - ```bash - zig build 2>&1 | less - ``` - -=== Runtime errors - -1. **Enable debug logging:** - ```bash - zig build -Doptimize=Debug - ``` - -2. **Run with valgrind** (memory leaks): - ```bash - valgrind --leak-check=full ./zig-out/bin/example - ``` - -3. **Check ABI compatibility:** - ```bash - nm zig-out/lib/libstamp.so | grep stamp_ - ``` - -== Contributing - -See `../../CONTRIBUTING.md` for contribution guidelines. - -**Code style:** -* Follow Zig standard library style -* Run `zig fmt` before committing -* Add tests for new features -* Document public API - -== License - -PMPL-1.0-or-later - -== Author - -Jonathan D.A. Jewell diff --git a/avow-protocol/avow-lib/ffi/zig/build.zig b/avow-protocol/avow-lib/ffi/zig/build.zig deleted file mode 100644 index 7c4cfd4c..00000000 --- a/avow-protocol/avow-lib/ffi/zig/build.zig +++ /dev/null @@ -1,63 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell - -const std = @import("std"); - -pub fn build(b: *std.Build) void { - const target = b.standardTargetOptions(.{}); - const optimize = b.standardOptimizeOption(.{}); - - // For Zig 0.15, we compile to object files and link separately - // This creates libstamp.a (static) which can be used by other programs - - const stamp_mod = b.addModule("stamp", .{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Build as static library for now (shared libs need different approach in 0.15) - const lib = b.addStaticLibrary(.{ - .name = "stamp", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - lib.linkLibC(); - b.installArtifact(lib); - - // Install C header file - const install_header = b.addInstallFile( - b.path("src/stamp.h"), - "include/stamp.h", - ); - b.getInstallStep().dependOn(&install_header.step); - - // Unit tests - const tests = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - const run_tests = b.addRunArtifact(tests); - const test_step = b.step("test", "Run unit tests"); - test_step.dependOn(&run_tests.step); - - // Example program - const example = b.addExecutable(.{ - .name = "example", - .root_source_file = b.path("src/example.zig"), - .target = target, - .optimize = optimize, - }); - - example.root_module.addImport("main", stamp_mod); - example.linkLibrary(lib); - example.linkLibC(); - b.installArtifact(example); - - const run_example = b.addRunArtifact(example); - const example_step = b.step("example", "Run example program"); - example_step.dependOn(&run_example.step); -} diff --git a/avow-protocol/avow-lib/ffi/zig/src/example.zig b/avow-protocol/avow-lib/ffi/zig/src/example.zig deleted file mode 100644 index a2b74cfe..00000000 --- a/avow-protocol/avow-lib/ffi/zig/src/example.zig +++ /dev/null @@ -1,144 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell - -//! Example program demonstrating libstamp usage - -const std = @import("std"); -const stamp = @import("main.zig"); - -pub fn main() !void { - const stdout = std.io.getStdOut().writer(); - - try stdout.print("=== STAMP Verification Library Example ===\n\n", .{}); - try stdout.print("Version: {s}\n\n", .{stamp.stamp_version()}); - - // Example 1: Verify unsubscribe link - try stdout.print("Example 1: Unsubscribe Verification\n", .{}); - try stdout.print("====================================\n", .{}); - - const unsub_params = stamp.StampUnsubscribeParams{ - .url = "https://example.com/unsubscribe", - .tested_at = getCurrentTimestamp() - 5000, // 5 seconds ago - .response_code = 200, - .response_time = 87, - .token = "abc123def456...", // Would be real token - .signature = "valid_signature_here", // Would be real signature - }; - - const unsub_result = stamp.stamp_verify_unsubscribe(&unsub_params); - try stdout.print("URL: {s}\n", .{unsub_params.url}); - try stdout.print("Response: {d} (in {d}ms)\n", .{ - unsub_params.response_code, - unsub_params.response_time, - }); - try stdout.print("Result: {s}\n\n", .{resultToString(unsub_result)}); - - // Generate proof - if (unsub_result == .success) { - const proof = stamp.stamp_generate_proof(&unsub_params); - if (proof) |p| { - try stdout.print("Proof generated:\n{s}\n\n", .{p.data}); - stamp.stamp_free_proof(proof); - } - } - - // Example 2: Verify consent chain - try stdout.print("Example 2: Consent Chain Verification\n", .{}); - try stdout.print("======================================\n", .{}); - - const consent_params = stamp.StampConsentParams{ - .initial_request = 1706630400000, - .confirmation = 1706630500000, // 100 seconds later - .ip_address = "192.168.1.100", - .token = "consent_token_123", - }; - - const consent_result = stamp.stamp_verify_consent(&consent_params); - try stdout.print("Initial request: {d}\n", .{consent_params.initial_request}); - try stdout.print("Confirmation: {d}\n", .{consent_params.confirmation}); - try stdout.print("Time diff: {d} seconds\n", .{ - (consent_params.confirmation - consent_params.initial_request) / 1000, - }); - try stdout.print("Result: {s}\n\n", .{resultToString(consent_result)}); - - // Example 3: Verify rate limits - try stdout.print("Example 3: Rate Limit Verification\n", .{}); - try stdout.print("===================================\n", .{}); - - const now = getCurrentTimestamp(); - const rate_params = stamp.StampRateLimitParams{ - .sender_id = "user_12345", - .account_created = now - (45 * 24 * 60 * 60 * 1000), // 45 days ago - .messages_today = 150, - .daily_limit = 10000, - }; - - const rate_result = stamp.stamp_verify_rate_limit(&rate_params); - const account_age_days = (now - rate_params.account_created) / (24 * 60 * 60 * 1000); - try stdout.print("Sender: {s}\n", .{rate_params.sender_id}); - try stdout.print("Account age: {d} days\n", .{account_age_days}); - try stdout.print("Messages today: {d}/{d}\n", .{ - rate_params.messages_today, - rate_params.daily_limit, - }); - try stdout.print("Result: {s}\n\n", .{resultToString(rate_result)}); - - // Example 4: Error cases - try stdout.print("Example 4: Error Cases\n", .{}); - try stdout.print("======================\n", .{}); - - // Invalid URL - const bad_url_params = stamp.StampUnsubscribeParams{ - .url = "not_a_valid_url", - .tested_at = now, - .response_code = 200, - .response_time = 87, - .token = "token", - .signature = "sig", - }; - const bad_url_result = stamp.stamp_verify_unsubscribe(&bad_url_params); - try stdout.print("Invalid URL: {s}\n", .{resultToString(bad_url_result)}); - - // Slow response - const slow_params = stamp.StampUnsubscribeParams{ - .url = "https://example.com/unsub", - .tested_at = now, - .response_code = 200, - .response_time = 5000, // 5 seconds! - .token = "token", - .signature = "sig", - }; - const slow_result = stamp.stamp_verify_unsubscribe(&slow_params); - try stdout.print("Slow response: {s}\n", .{resultToString(slow_result)}); - - // Rate limit exceeded - const exceeded_params = stamp.StampRateLimitParams{ - .sender_id = "spammer", - .account_created = now - (10 * 24 * 60 * 60 * 1000), // 10 days old - .messages_today = 1000, // At limit - .daily_limit = 1000, - }; - const exceeded_result = stamp.stamp_verify_rate_limit(&exceeded_params); - try stdout.print("Rate limit exceeded: {s}\n", .{resultToString(exceeded_result)}); - - try stdout.print("\nAll examples completed!\n", .{}); -} - -fn getCurrentTimestamp() u64 { - const ns = std.time.nanoTimestamp(); - return @intCast(@divFloor(ns, std.time.ns_per_ms)); -} - -fn resultToString(result: stamp.StampResult) []const u8 { - return switch (result) { - .success => "✓ SUCCESS", - .error_invalid_url => "✗ INVALID_URL", - .error_timeout => "✗ TIMEOUT", - .error_invalid_response => "✗ INVALID_RESPONSE", - .error_invalid_signature => "✗ INVALID_SIGNATURE", - .error_rate_limit_exceeded => "✗ RATE_LIMIT_EXCEEDED", - .error_consent_invalid => "✗ CONSENT_INVALID", - .error_null_pointer => "✗ NULL_POINTER", - .error_internal => "✗ INTERNAL_ERROR", - }; -} diff --git a/avow-protocol/avow-lib/ffi/zig/src/main.zig b/avow-protocol/avow-lib/ffi/zig/src/main.zig deleted file mode 100644 index 5f235525..00000000 --- a/avow-protocol/avow-lib/ffi/zig/src/main.zig +++ /dev/null @@ -1,478 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell - -//! STAMP FFI Implementation -//! -//! This module provides C-compatible FFI bindings for the STAMP verification library. -//! It wraps Idris2 verification functions and provides a stable ABI. - -const std = @import("std"); - -// ============================================================================ -// Types -// ============================================================================ - -/// Result codes for verification functions -pub const StampResult = enum(c_int) { - success = 0, - error_invalid_url = -1, - error_timeout = -2, - error_invalid_response = -3, - error_invalid_signature = -4, - error_rate_limit_exceeded = -5, - error_consent_invalid = -6, - error_null_pointer = -7, - error_internal = -99, -}; - -/// Unsubscribe link verification parameters -pub const StampUnsubscribeParams = extern struct { - /// URL to verify (null-terminated C string) - url: [*:0]const u8, - - /// When the URL was tested (Unix timestamp in milliseconds) - tested_at: u64, - - /// HTTP response code (200, 404, etc.) - response_code: u16, - - /// Response time in milliseconds - response_time: u32, - - /// Cryptographic token (null-terminated C string, 64 chars) - token: [*:0]const u8, - - /// Signature (null-terminated C string) - signature: [*:0]const u8, -}; - -/// Consent chain verification parameters -pub const StampConsentParams = extern struct { - /// Initial opt-in request timestamp (Unix milliseconds) - initial_request: u64, - - /// Confirmation timestamp (Unix milliseconds) - confirmation: u64, - - /// IP address (null-terminated C string) - ip_address: [*:0]const u8, - - /// Confirmation token (null-terminated C string) - token: [*:0]const u8, -}; - -/// Rate limit verification parameters -pub const StampRateLimitParams = extern struct { - /// Sender identifier (null-terminated C string) - sender_id: [*:0]const u8, - - /// Account creation timestamp (Unix milliseconds) - account_created: u64, - - /// Number of messages sent today - messages_today: u32, - - /// Daily limit for this account - daily_limit: u32, -}; - -/// Verification proof (returned to caller, must be freed) -pub const StampProof = extern struct { - /// Proof data (JSON format) - data: [*:0]u8, - - /// Length of proof data - length: usize, - - /// Signature over proof data - signature: [*:0]u8, -}; - -// ============================================================================ -// Internal Helpers -// ============================================================================ - -/// Current timestamp (milliseconds since Unix epoch) -fn getCurrentTimestamp() u64 { - const ns = std.time.nanoTimestamp(); - return @intCast(@divFloor(ns, std.time.ns_per_ms)); -} - -/// Validate URL format (basic check) -fn isValidUrl(url: [*:0]const u8) bool { - const url_slice = std.mem.span(url); - if (url_slice.len < 10) return false; // Minimum: "https://x" - if (!std.mem.startsWith(u8, url_slice, "https://")) return false; - return true; -} - -/// Validate timestamp is recent (within last 60 seconds) -fn isRecentTimestamp(timestamp: u64) bool { - const now = getCurrentTimestamp(); - const diff = if (now > timestamp) now - timestamp else timestamp - now; - return diff < 60000; // 60 seconds -} - -// ============================================================================ -// FFI Functions (C ABI) -// ============================================================================ - -/// Verify an unsubscribe link -/// -/// Returns: -/// - 0 (success) if the unsubscribe link is valid -/// - Negative error code otherwise -/// -/// Example: -/// ```c -/// StampUnsubscribeParams params = { -/// .url = "https://example.com/unsub", -/// .tested_at = 1706630400000, -/// .response_code = 200, -/// .response_time = 87, -/// .token = "abc123...", -/// .signature = "sig...", -/// }; -/// int result = stamp_verify_unsubscribe(¶ms); -/// if (result == 0) { -/// printf("Valid unsubscribe link\n"); -/// } -/// ``` -export fn stamp_verify_unsubscribe(params: ?*const StampUnsubscribeParams) callconv(.C) StampResult { - // Null pointer check - const p = params orelse return .error_null_pointer; - - // Validate URL format - if (!isValidUrl(p.url)) { - return .error_invalid_url; - } - - // Verify test was recent (within last 60 seconds) - if (!isRecentTimestamp(p.tested_at)) { - return .error_timeout; - } - - // Verify HTTP response code is 200 OK - if (p.response_code != 200) { - return .error_invalid_response; - } - - // Verify response time is fast (< 200ms) - if (p.response_time >= 200) { - return .error_timeout; - } - - // TODO: Verify cryptographic signature - // For now, just check signature is not empty - const sig_slice = std.mem.span(p.signature); - if (sig_slice.len == 0) { - return .error_invalid_signature; - } - - // All checks passed - return .success; -} - -/// Verify a consent chain (double opt-in) -/// -/// Returns: -/// - 0 (success) if consent is valid -/// - Negative error code otherwise -/// -/// Example: -/// ```c -/// StampConsentParams params = { -/// .initial_request = 1706630400000, -/// .confirmation = 1706630500000, // 100 seconds later -/// .ip_address = "192.168.1.100", -/// .token = "token...", -/// }; -/// int result = stamp_verify_consent(¶ms); -/// ``` -export fn stamp_verify_consent(params: ?*const StampConsentParams) callconv(.C) StampResult { - const p = params orelse return .error_null_pointer; - - // Verify confirmation happened AFTER initial request - if (p.confirmation <= p.initial_request) { - return .error_consent_invalid; - } - - // Verify confirmation was timely (within 24 hours) - const time_diff = p.confirmation - p.initial_request; - if (time_diff > 86400000) { // 24 hours in milliseconds - return .error_consent_invalid; - } - - // TODO: Verify token is cryptographically valid for this IP - const token_slice = std.mem.span(p.token); - if (token_slice.len == 0) { - return .error_invalid_signature; - } - - return .success; -} - -/// Verify rate limit compliance -/// -/// Returns: -/// - 0 (success) if within rate limits -/// - Negative error code otherwise -/// -/// Example: -/// ```c -/// StampRateLimitParams params = { -/// .sender_id = "user123", -/// .account_created = 1704067200000, // 30 days ago -/// .messages_today = 50, -/// .daily_limit = 1000, -/// }; -/// int result = stamp_verify_rate_limit(¶ms); -/// ``` -export fn stamp_verify_rate_limit(params: ?*const StampRateLimitParams) callconv(.C) StampResult { - const p = params orelse return .error_null_pointer; - - // Verify sender ID is not empty - const sender_slice = std.mem.span(p.sender_id); - if (sender_slice.len == 0) { - return .error_null_pointer; - } - - // Verify messages today doesn't exceed daily limit - if (p.messages_today >= p.daily_limit) { - return .error_rate_limit_exceeded; - } - - // Calculate account age in days - const now = getCurrentTimestamp(); - const age_ms = now - p.account_created; - const age_days = age_ms / (24 * 60 * 60 * 1000); - - // Verify daily limit is appropriate for account age - // New accounts (< 30 days): max 1000/day - // Established (30-90 days): max 10000/day - // Veteran (90+ days): max 100000/day - const max_allowed_limit: u32 = if (age_days < 30) - 1000 - else if (age_days < 90) - 10000 - else - 100000; - - if (p.daily_limit > max_allowed_limit) { - return .error_rate_limit_exceeded; - } - - return .success; -} - -/// Generate a verification proof (for display to users) -/// -/// The proof includes all verification details in JSON format. -/// Caller must free the returned proof with stamp_free_proof(). -/// -/// Returns: -/// - Non-null pointer to StampProof on success -/// - NULL on error -/// -/// Example: -/// ```c -/// StampProof* proof = stamp_generate_proof(¶ms); -/// if (proof != NULL) { -/// printf("Proof: %s\n", proof->data); -/// stamp_free_proof(proof); -/// } -/// ``` -export fn stamp_generate_proof(params: ?*const StampUnsubscribeParams) callconv(.C) ?*StampProof { - const p = params orelse return null; - - // Allocate proof structure - var allocator = std.heap.c_allocator; - const proof = allocator.create(StampProof) catch return null; - - // Generate JSON proof (simplified for now) - const json_template = - \\{{ - \\ "type": "unsubscribe_verification", - \\ "url": "{s}", - \\ "tested_at": {d}, - \\ "response_code": {d}, - \\ "response_time_ms": {d}, - \\ "verified": true - \\}} - ; - - const url_slice = std.mem.span(p.url); - const json = std.fmt.allocPrintZ(allocator, json_template, .{ - url_slice, - p.tested_at, - p.response_code, - p.response_time, - }) catch return null; - - // Generate signature (simplified - would use real crypto) - const sig = std.fmt.allocPrintZ(allocator, "sig_{d}", .{ - getCurrentTimestamp(), - }) catch { - allocator.free(json); - return null; - }; - - proof.* = .{ - .data = json.ptr, - .length = json.len, - .signature = sig.ptr, - }; - - return proof; -} - -/// Free a proof returned by stamp_generate_proof() -/// -/// Example: -/// ```c -/// StampProof* proof = stamp_generate_proof(¶ms); -/// stamp_free_proof(proof); -/// ``` -export fn stamp_free_proof(proof: ?*StampProof) callconv(.C) void { - const p = proof orelse return; - - var allocator = std.heap.c_allocator; - - // Free data - if (p.data != null) { - const data_slice = std.mem.span(p.data); - allocator.free(data_slice); - } - - // Free signature - if (p.signature != null) { - const sig_slice = std.mem.span(p.signature); - allocator.free(sig_slice); - } - - // Free proof structure itself - allocator.destroy(p); -} - -/// Get version string -/// -/// Returns: "libstamp v1.0.0" -export fn stamp_version() callconv(.C) [*:0]const u8 { - return "libstamp v1.0.0"; -} - -// ============================================================================ -// Tests -// ============================================================================ - -test "verify unsubscribe - valid" { - const params = StampUnsubscribeParams{ - .url = "https://example.com/unsubscribe", - .tested_at = getCurrentTimestamp() - 5000, // 5 seconds ago - .response_code = 200, - .response_time = 87, - .token = "abc123...", - .signature = "valid_signature", - }; - - const result = stamp_verify_unsubscribe(¶ms); - try std.testing.expectEqual(StampResult.success, result); -} - -test "verify unsubscribe - invalid URL" { - const params = StampUnsubscribeParams{ - .url = "not_a_url", - .tested_at = getCurrentTimestamp(), - .response_code = 200, - .response_time = 87, - .token = "abc123...", - .signature = "valid_signature", - }; - - const result = stamp_verify_unsubscribe(¶ms); - try std.testing.expectEqual(StampResult.error_invalid_url, result); -} - -test "verify unsubscribe - slow response" { - const params = StampUnsubscribeParams{ - .url = "https://example.com/unsubscribe", - .tested_at = getCurrentTimestamp(), - .response_code = 200, - .response_time = 5000, // 5 seconds - too slow - .token = "abc123...", - .signature = "valid_signature", - }; - - const result = stamp_verify_unsubscribe(¶ms); - try std.testing.expectEqual(StampResult.error_timeout, result); -} - -test "verify consent - valid" { - const params = StampConsentParams{ - .initial_request = 1706630400000, - .confirmation = 1706630500000, // 100 seconds later - .ip_address = "192.168.1.100", - .token = "valid_token", - }; - - const result = stamp_verify_consent(¶ms); - try std.testing.expectEqual(StampResult.success, result); -} - -test "verify consent - confirmation before request" { - const params = StampConsentParams{ - .initial_request = 1706630500000, - .confirmation = 1706630400000, // Before request! - .ip_address = "192.168.1.100", - .token = "valid_token", - }; - - const result = stamp_verify_consent(¶ms); - try std.testing.expectEqual(StampResult.error_consent_invalid, result); -} - -test "verify rate limit - within limits" { - const params = StampRateLimitParams{ - .sender_id = "user123", - .account_created = getCurrentTimestamp() - (30 * 24 * 60 * 60 * 1000), // 30 days ago - .messages_today = 50, - .daily_limit = 1000, - }; - - const result = stamp_verify_rate_limit(¶ms); - try std.testing.expectEqual(StampResult.success, result); -} - -test "verify rate limit - exceeded" { - const params = StampRateLimitParams{ - .sender_id = "user123", - .account_created = getCurrentTimestamp() - (30 * 24 * 60 * 60 * 1000), - .messages_today = 1000, - .daily_limit = 1000, // Exactly at limit = exceeded - }; - - const result = stamp_verify_rate_limit(¶ms); - try std.testing.expectEqual(StampResult.error_rate_limit_exceeded, result); -} - -test "generate and free proof" { - const params = StampUnsubscribeParams{ - .url = "https://example.com/unsubscribe", - .tested_at = getCurrentTimestamp(), - .response_code = 200, - .response_time = 87, - .token = "abc123...", - .signature = "valid_signature", - }; - - const proof = stamp_generate_proof(¶ms); - try std.testing.expect(proof != null); - - if (proof) |p| { - try std.testing.expect(p.length > 0); - try std.testing.expect(p.data != null); - try std.testing.expect(p.signature != null); - - stamp_free_proof(proof); - } -} diff --git a/avow-protocol/avow-lib/ffi/zig/src/stamp.h b/avow-protocol/avow-lib/ffi/zig/src/stamp.h deleted file mode 100644 index 0561112d..00000000 --- a/avow-protocol/avow-lib/ffi/zig/src/stamp.h +++ /dev/null @@ -1,241 +0,0 @@ -/* SPDX-License-Identifier: MPL-2.0 */ -/* Copyright (c) 2026 Jonathan D.A. Jewell */ - -/** - * @file stamp.h - * @brief STAMP Protocol FFI Header - * - * C-compatible header for the STAMP verification library. - * Use this header to integrate STAMP with C, C++, Rust, Python, or any - * language with C FFI support. - */ - -#ifndef STAMP_H -#define STAMP_H - -#include -#include - -#ifdef __cplusplus -extern "C" { -#endif - -/** - * @brief Result codes for STAMP verification functions - */ -typedef enum { - STAMP_SUCCESS = 0, - STAMP_ERROR_INVALID_URL = -1, - STAMP_ERROR_TIMEOUT = -2, - STAMP_ERROR_INVALID_RESPONSE = -3, - STAMP_ERROR_INVALID_SIGNATURE = -4, - STAMP_ERROR_RATE_LIMIT_EXCEEDED = -5, - STAMP_ERROR_CONSENT_INVALID = -6, - STAMP_ERROR_NULL_POINTER = -7, - STAMP_ERROR_INTERNAL = -99, -} StampResult; - -/** - * @brief Parameters for unsubscribe link verification - */ -typedef struct { - /** URL to verify (null-terminated) */ - const char* url; - - /** When the URL was tested (Unix timestamp in milliseconds) */ - uint64_t tested_at; - - /** HTTP response code (200, 404, etc.) */ - uint16_t response_code; - - /** Response time in milliseconds */ - uint32_t response_time; - - /** Cryptographic token (null-terminated, 64 chars) */ - const char* token; - - /** Signature (null-terminated) */ - const char* signature; -} StampUnsubscribeParams; - -/** - * @brief Parameters for consent chain verification - */ -typedef struct { - /** Initial opt-in request timestamp (Unix milliseconds) */ - uint64_t initial_request; - - /** Confirmation timestamp (Unix milliseconds) */ - uint64_t confirmation; - - /** IP address (null-terminated) */ - const char* ip_address; - - /** Confirmation token (null-terminated) */ - const char* token; -} StampConsentParams; - -/** - * @brief Parameters for rate limit verification - */ -typedef struct { - /** Sender identifier (null-terminated) */ - const char* sender_id; - - /** Account creation timestamp (Unix milliseconds) */ - uint64_t account_created; - - /** Number of messages sent today */ - uint32_t messages_today; - - /** Daily limit for this account */ - uint32_t daily_limit; -} StampRateLimitParams; - -/** - * @brief Verification proof (JSON format) - * - * Must be freed with stamp_free_proof() after use. - */ -typedef struct { - /** Proof data (JSON format, null-terminated) */ - char* data; - - /** Length of proof data */ - size_t length; - - /** Signature over proof data (null-terminated) */ - char* signature; -} StampProof; - -/** - * @brief Verify an unsubscribe link - * - * Checks that: - * - URL format is valid (HTTPS) - * - Test was recent (within last 60 seconds) - * - HTTP response was 200 OK - * - Response time was fast (< 200ms) - * - Signature is valid - * - * @param params Verification parameters - * @return STAMP_SUCCESS if valid, error code otherwise - * - * @example - * ```c - * StampUnsubscribeParams params = { - * .url = "https://example.com/unsub", - * .tested_at = 1706630400000, - * .response_code = 200, - * .response_time = 87, - * .token = "abc123...", - * .signature = "sig...", - * }; - * int result = stamp_verify_unsubscribe(¶ms); - * if (result == STAMP_SUCCESS) { - * printf("Valid unsubscribe link\n"); - * } - * ``` - */ -StampResult stamp_verify_unsubscribe(const StampUnsubscribeParams* params); - -/** - * @brief Verify a consent chain (double opt-in) - * - * Checks that: - * - Confirmation happened AFTER initial request - * - Confirmation was timely (within 24 hours) - * - Token is cryptographically valid - * - * @param params Consent verification parameters - * @return STAMP_SUCCESS if valid, error code otherwise - * - * @example - * ```c - * StampConsentParams params = { - * .initial_request = 1706630400000, - * .confirmation = 1706630500000, // 100 seconds later - * .ip_address = "192.168.1.100", - * .token = "token...", - * }; - * int result = stamp_verify_consent(¶ms); - * ``` - */ -StampResult stamp_verify_consent(const StampConsentParams* params); - -/** - * @brief Verify rate limit compliance - * - * Checks that: - * - Messages today doesn't exceed daily limit - * - Daily limit is appropriate for account age - * - * Account age determines max daily limit: - * - < 30 days: max 1,000/day - * - 30-90 days: max 10,000/day - * - 90+ days: max 100,000/day - * - * @param params Rate limit parameters - * @return STAMP_SUCCESS if within limits, error code otherwise - * - * @example - * ```c - * StampRateLimitParams params = { - * .sender_id = "user123", - * .account_created = 1704067200000, // 30 days ago - * .messages_today = 50, - * .daily_limit = 1000, - * }; - * int result = stamp_verify_rate_limit(¶ms); - * ``` - */ -StampResult stamp_verify_rate_limit(const StampRateLimitParams* params); - -/** - * @brief Generate a verification proof - * - * Creates a JSON proof that can be displayed to users or stored. - * The proof includes all verification details and a cryptographic signature. - * - * @param params Verification parameters - * @return Pointer to StampProof on success, NULL on error - * - * @warning Caller must free the returned proof with stamp_free_proof() - * - * @example - * ```c - * StampProof* proof = stamp_generate_proof(¶ms); - * if (proof != NULL) { - * printf("Proof: %s\n", proof->data); - * stamp_free_proof(proof); - * } - * ``` - */ -StampProof* stamp_generate_proof(const StampUnsubscribeParams* params); - -/** - * @brief Free a proof returned by stamp_generate_proof() - * - * @param proof Proof to free (can be NULL) - * - * @example - * ```c - * StampProof* proof = stamp_generate_proof(¶ms); - * // ... use proof ... - * stamp_free_proof(proof); - * ``` - */ -void stamp_free_proof(StampProof* proof); - -/** - * @brief Get library version string - * - * @return Version string (e.g., "libstamp v1.0.0") - */ -const char* stamp_version(void); - -#ifdef __cplusplus -} -#endif - -#endif /* STAMP_H */ diff --git a/avow-protocol/avow-lib/src/abi/Consent.idr b/avow-protocol/avow-lib/src/abi/Consent.idr deleted file mode 100644 index c14dc311..00000000 --- a/avow-protocol/avow-lib/src/abi/Consent.idr +++ /dev/null @@ -1,111 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell - -||| Consent chain verification with proofs -||| Demonstrates proving the user actually opted in (not from a bought list) -module STAMP.ABI.Consent - -import STAMP.ABI.Types - -%default total - --------------------------------------------------------------------------------- --- Consent Chain with Cryptographic Proof --------------------------------------------------------------------------------- - -||| A consent chain that PROVES the user actually opted in -||| -||| Current problem: Spammers claim "user consented" with no proof -||| - Bought email lists -||| - Scraped from websites -||| - "Pre-checked" boxes -||| - Fake double-opt-in -||| -||| STAMP solution: Cryptographically provable consent chain -public export -data ConsentChain : Type where - ||| Double opt-in: User requested + confirmed - DoubleOptIn : - (initialRequest : Timestamp) -> - (confirmationClick : Timestamp) -> - (ipAddress : IPAddress) -> - (confirmationToken : CryptoToken) -> - - ||| Proof 1: Confirmation happened AFTER initial request - {auto 0 ordered : confirmationClick > initialRequest} -> - - ||| Proof 2: Confirmation was timely (within 24 hours) - {auto 0 timely : TimeDiff initialRequest confirmationClick 86400000} -> - - ||| Proof 3: Token is cryptographically valid for this IP - {auto 0 tokenValid : VerifyToken confirmationToken ipAddress} -> - - ConsentChain - - ||| Single opt-in: User explicitly requested (lower trust) - SingleOptIn : - (requestTime : Timestamp) -> - (ipAddress : IPAddress) -> - (requestToken : CryptoToken) -> - - ||| Proof: Recent request (within last hour) - {auto 0 recent : TimeDiff requestTime Now 3600000} -> - - ConsentChain - -||| Placeholder: Token verification for IP -public export -VerifyToken : CryptoToken -> IPAddress -> Type -VerifyToken token ip = () -- Would verify HMAC(ip, secret) == token - --------------------------------------------------------------------------------- --- What You CANNOT Do (Spammer Tactics Blocked) --------------------------------------------------------------------------------- - -{- -Spammer tactic 1: Claim double opt-in without proof - ✗ Cannot construct DoubleOptIn without valid token - ✗ Cannot fake timestamps (must be ordered) - ✗ Cannot bypass timely check - -Spammer tactic 2: Use bought email list - ✗ No consent chain exists for bought emails - ✗ Cannot construct ConsentChain without actual opt-in event - -Spammer tactic 3: Pre-checked box "consent" - ✗ No cryptographic token from actual user click - ✗ Cannot fake token (would need to know secret key) - -Spammer tactic 4: Scrape emails from websites - ✗ Website display ≠ opt-in consent - ✗ No ConsentChain provable - -THIS IS IMPOSSIBLE WITHOUT DEPENDENT TYPES. -Other languages can store timestamps, but can't PROVE the ordering. --} - --------------------------------------------------------------------------------- --- Example: Valid Consent Chain --------------------------------------------------------------------------------- - -||| Valid double opt-in flow -exampleValidConsent : ConsentChain -exampleValidConsent = - DoubleOptIn - 1706630400000 -- User filled form - 1706630500000 -- User clicked email link 100s later - (IPv4 192 168 1 100) - (MkToken "abc123...token...xyz789") - -||| Invalid: Confirmation before request (DOES NOT COMPILE) --- exampleInvalidConsent : ConsentChain --- exampleInvalidConsent = --- DoubleOptIn --- 1706630500000 -- Request at T+100 --- 1706630400000 -- Confirmation at T+0 --- (IPv4 192 168 1 100) --- (MkToken "token...") --- --- Compilation error: --- Cannot satisfy constraint: 1706630400000 > 1706630500000 --- (Confirmation must be AFTER request) diff --git a/avow-protocol/avow-lib/src/abi/Types.idr b/avow-protocol/avow-lib/src/abi/Types.idr deleted file mode 100644 index 2189fa2a..00000000 --- a/avow-protocol/avow-lib/src/abi/Types.idr +++ /dev/null @@ -1,168 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell - -||| Core types for STAMP protocol verification -||| This module defines the foundational types with dependent type proofs -module STAMP.ABI.Types - -import Data.Nat -import Data.String -import Data.List - -%default total - --------------------------------------------------------------------------------- --- Primitive Types --------------------------------------------------------------------------------- - -||| A URL with proven format validity -public export -data URL : Type where - MkURL : (urlString : String) -> - {auto 0 validFormat : IsValidURLFormat urlString} -> - URL - -||| An IP address -public export -data IPAddress : Type where - IPv4 : (a : Nat) -> (b : Nat) -> (c : Nat) -> (d : Nat) -> - {auto 0 valid : (a < 256, b < 256, c < 256, d < 256)} -> - IPAddress - IPv6 : String -> IPAddress -- Simplified for now - -||| Timestamp in milliseconds since Unix epoch -public export -Timestamp : Type -Timestamp = Nat - -||| Cryptographic token (simplified - would use proper crypto in production) -public export -data CryptoToken : Type where - MkToken : (value : String) -> - {auto 0 validLength : LengthIs value 64} -> - CryptoToken - -||| Cryptographic signature -public export -data CryptoSignature : Type where - MkSignature : (value : String) -> - {auto 0 validFormat : IsValidSignature value} -> - CryptoSignature - -||| HTTP response code -public export -data HTTPResponseCode : Type where - OK : HTTPResponseCode -- 200 - BadRequest : HTTPResponseCode -- 400 - NotFound : HTTPResponseCode -- 404 - InternalServerError : HTTPResponseCode -- 500 - -||| HTTP response with timing -public export -record HTTPResponse where - constructor MkHTTPResponse - code : HTTPResponseCode - responseTime : Nat -- in milliseconds - --------------------------------------------------------------------------------- --- Proof Predicates (would be implemented in separate modules) --------------------------------------------------------------------------------- - -||| Placeholder: URL format validation -public export -IsValidURLFormat : String -> Type -IsValidURLFormat s = () -- Simplified: would check https://, valid domain, etc. - -||| Placeholder: String length check -public export -LengthIs : String -> Nat -> Type -LengthIs s n = () -- Would verify length(s) == n - -||| Placeholder: Signature format validation -public export -IsValidSignature : String -> Type -IsValidSignature s = () -- Would verify hex format, length, etc. - -||| Placeholder: Cryptographic signature verification -public export -VerifySignature : CryptoSignature -> CryptoToken -> Type -VerifySignature sig token = () -- Would perform actual crypto verification - -||| Time difference predicate -public export -data TimeDiff : Timestamp -> Timestamp -> Nat -> Type where - MkTimeDiff : (t1 : Timestamp) -> (t2 : Timestamp) -> (diff : Nat) -> - {auto 0 correctDiff : (t2 - t1 = diff) || (t1 - t2 = diff)} -> - TimeDiff t1 t2 diff - --------------------------------------------------------------------------------- --- Sender Identity Types --------------------------------------------------------------------------------- - -||| Unique sender identifier -public export -data SenderID : Type where - MkSenderID : String -> SenderID - -||| Trust level based on account age -public export -data TrustLevel : Type where - Untrusted : TrustLevel -- < 30 days - Apprentice : TrustLevel -- 30-90 days - Trusted : TrustLevel -- 90-365 days - Veteran : TrustLevel -- 365+ days - -||| Sender identity with time-based reputation -public export -record SenderIdentity where - constructor MkSender - id : SenderID - registeredAt : Timestamp - trustLevel : TrustLevel - dailyLimit : Nat - publicKey : CryptoToken - - ||| Proof that trust level matches account age - {auto 0 trustLevelValid : TrustLevelMatchesAge trustLevel registeredAt} - -||| Placeholder: Trust level validation -public export -TrustLevelMatchesAge : TrustLevel -> Timestamp -> Type -TrustLevelMatchesAge level regTime = () -- Would check age constraints - --------------------------------------------------------------------------------- --- Message Types --------------------------------------------------------------------------------- - -||| Email address -public export -data EmailAddress : Type where - MkEmail : String -> EmailAddress - -||| Message content (simplified) -public export -record MessageContent where - constructor MkContent - subject : String - body : String - from : EmailAddress - to : EmailAddress - -||| Current timestamp (would be IO action in real implementation) -public export -Now : Timestamp -Now = 1706630400000 -- Placeholder: 2026-01-30 - --------------------------------------------------------------------------------- --- Export all types --------------------------------------------------------------------------------- - -public export -%inline -getURLString : URL -> String -getURLString (MkURL s) = s - -public export -%inline -getTokenValue : CryptoToken -> String -getTokenValue (MkToken v) = v diff --git a/avow-protocol/avow-lib/src/abi/Unsubscribe.idr b/avow-protocol/avow-lib/src/abi/Unsubscribe.idr deleted file mode 100644 index 80382096..00000000 --- a/avow-protocol/avow-lib/src/abi/Unsubscribe.idr +++ /dev/null @@ -1,192 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell - -||| Unsubscribe link with formal verification -||| This module demonstrates the CORE VALUE of dependent types: -||| We don't just store an unsubscribe URL - we PROVE it works -module STAMP.ABI.Unsubscribe - -import STAMP.ABI.Types - -%default total - --------------------------------------------------------------------------------- --- Unsubscribe Link with Proofs --------------------------------------------------------------------------------- - -||| An unsubscribe link that is PROVEN to work -||| -||| This is the key innovation: Without dependent types, you can only SAY -||| "this unsubscribe link works." With dependent types, you PROVE it. -||| -||| Compare to other approaches: -||| - JSON: {"unsubscribe": "https://..."} -- Just a string, no verification -||| - Haskell: data Unsub = Unsub URL -- Type-safe, but doesn't prove it works -||| - Idris2: See below -- PROVES the URL was tested and works -public export -record UnsubscribeLink where - constructor MkUnsubscribeLink - - ||| The URL to click - url : URL - - ||| When it was tested - testedAt : Timestamp - - ||| The HTTP response we got when testing - testResponse : HTTPResponse - - ||| Cryptographic token for verification - token : CryptoToken - - ||| Signature proving this test actually happened - signature : CryptoSignature - - -- Here's the magic: These proofs are REQUIRED to construct an UnsubscribeLink - -- You CANNOT create one without providing evidence that these hold - - ||| Proof 1: The test was recent (within last 60 seconds) - {auto 0 recentTest : TimeDiff testedAt Now 60000} - - ||| Proof 2: The server responded with 200 OK - {auto 0 success : testResponse.code = OK} - - ||| Proof 3: The response was fast (< 200ms) - {auto 0 fastResponse : testResponse.responseTime < 200} - - ||| Proof 4: The signature is cryptographically valid - {auto 0 validSignature : VerifySignature signature token} - -||| What this means in practice: -||| -||| WITHOUT dependent types (Rust, Haskell, Go): -||| struct UnsubscribeLink { url: String } -||| // Anyone can create this with ANY URL -||| let fake = UnsubscribeLink { url: "https://doesnt-exist.com" }; -||| // ✗ No verification that it works -||| -||| WITH dependent types (Idris2): -||| let fake = MkUnsubscribeLink -||| (MkURL "https://doesnt-exist.com") -||| Now -||| (MkHTTPResponse NotFound 5000) -- Took 5 seconds, returned 404 -||| token -||| sig -||| // ✗ COMPILATION ERROR: Cannot prove fastResponse (5000 < 200 is false) -||| // ✗ COMPILATION ERROR: Cannot prove success (NotFound ≠ OK) -||| -||| YOU LITERALLY CANNOT COMPILE CODE THAT CREATES AN INVALID UNSUBSCRIBE LINK - --------------------------------------------------------------------------------- --- Unsubscribe Test Result --------------------------------------------------------------------------------- - -||| Result of testing an unsubscribe URL -||| This is what you get BEFORE creating an UnsubscribeLink -public export -data UnsubscribeTestResult : Type where - ||| Test succeeded - can construct UnsubscribeLink - TestSuccess : (url : URL) -> - (testedAt : Timestamp) -> - (response : HTTPResponse) -> - (token : CryptoToken) -> - (signature : CryptoSignature) -> - {auto 0 recent : TimeDiff testedAt Now 60000} -> - {auto 0 ok : response.code = OK} -> - {auto 0 fast : response.responseTime < 200} -> - {auto 0 valid : VerifySignature signature token} -> - UnsubscribeTestResult - - ||| Test failed - cannot construct UnsubscribeLink - TestFailure : (url : URL) -> - (reason : String) -> -- "timeout", "404", "500", etc. - UnsubscribeTestResult - -||| Convert successful test to UnsubscribeLink -||| This is safe because TestSuccess already has the proofs -public export -toUnsubscribeLink : UnsubscribeTestResult -> Maybe UnsubscribeLink -toUnsubscribeLink (TestSuccess url time resp tok sig) = - Just (MkUnsubscribeLink url time resp tok sig) -toUnsubscribeLink (TestFailure _ _) = Nothing - --------------------------------------------------------------------------------- --- Example Usage (would be in examples/) --------------------------------------------------------------------------------- - -||| Example: This COMPILES (all proofs satisfied) -exampleValidUnsubscribe : UnsubscribeLink -exampleValidUnsubscribe = - MkUnsubscribeLink - (MkURL "https://example.com/unsubscribe") - 1706630400000 -- Now - (MkHTTPResponse OK 87) -- 87ms response time - (MkToken "abc123...64chars...xyz789") - (MkSignature "signature...") - -||| Example: This DOES NOT COMPILE (proof obligation violated) --- exampleInvalidUnsubscribe : UnsubscribeLink --- exampleInvalidUnsubscribe = --- MkUnsubscribeLink --- (MkURL "https://fake.com/unsub") --- 1706630400000 --- (MkHTTPResponse NotFound 5000) -- ✗ NotFound ≠ OK --- (MkToken "abc...") --- (MkSignature "sig...") --- --- Compilation error: --- Cannot satisfy constraint: NotFound = OK --- Cannot satisfy constraint: 5000 < 200 - --------------------------------------------------------------------------------- --- Comparison: What Other Languages Can't Do --------------------------------------------------------------------------------- - -{- -JSON (no types): - { - "unsubscribe": "https://example.com/unsub", - "tested": true - } - ✗ Can fake "tested": true - ✗ No proof it actually works - ✗ No timestamp validation - -Haskell (strong types, not dependent): - data UnsubscribeLink = UnsubscribeLink { - url :: URL, - tested :: Bool - } - ✓ Type-safe - ✗ Can set tested = True without actually testing - ✗ No proof the URL works - ✗ No timestamp validation - -Rust (memory safe, not proof): - struct UnsubscribeLink { - url: Url, - tested_at: u64, - response_code: u16, - } - ✓ Memory safe - ✗ Can set response_code = 200 without testing - ✗ No proof the timestamp is recent - ✗ No cryptographic verification - -Idris2 (dependent types = proofs): - record UnsubscribeLink where - url : URL - testedAt : Timestamp - response : HTTPResponse - {auto 0 recent : ...} - {auto 0 success : response.code = OK} - {auto 0 fast : ...} - ✓ Type-safe - ✓ Memory safe - ✓ PROVEN to work (mathematically) - ✓ Cannot fake proofs - ✓ Verified at compile time - ✓ Cryptographically signed - -THIS IS WHY STAMP NEEDS DEPENDENT TYPES. --} diff --git a/avow-protocol/avow-lib/tests/ConsentTests.idr b/avow-protocol/avow-lib/tests/ConsentTests.idr deleted file mode 100644 index aad3c731..00000000 --- a/avow-protocol/avow-lib/tests/ConsentTests.idr +++ /dev/null @@ -1,92 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell - -||| Tests for STAMP.ABI.Consent -||| Positive tests construct valid ConsentChain values. Negative tests -||| are commented out with the compile-error they produce — each one -||| documents a spammer tactic blocked at the type level. -module STAMP.ABI.ConsentTests - -import STAMP.ABI.Types -import STAMP.ABI.Consent - -%default total - --------------------------------------------------------------------------------- --- Positive tests — must typecheck --------------------------------------------------------------------------------- - -||| A valid double opt-in with proper timing -testValidDoubleOptIn : ConsentChain -testValidDoubleOptIn = - DoubleOptIn - 1706630400000 -- initial request - 1706630500000 -- confirmation 100s later - (IPv4 10 0 0 1) - (MkToken "valid-token-abc-123") - -||| A double opt-in at the boundary (just under 24h) -testBoundary24h : ConsentChain -testBoundary24h = - DoubleOptIn - 1706630400000 - 1706716799000 -- 86399 seconds later (< 24h) - (IPv4 10 0 0 2) - (MkToken "boundary-token") - -||| Single opt-in (lower-trust variant) -testSingleOptIn : ConsentChain -testSingleOptIn = - SingleOptIn - 1706630400000 - (IPv4 10 0 0 3) - (MkToken "single-opt-token") - -||| Imported example should still be constructible -testReusesExample : ConsentChain -testReusesExample = exampleValidConsent - --------------------------------------------------------------------------------- --- Negative tests — documented by commented-out code --------------------------------------------------------------------------------- - -{- --- Test N1: confirmation BEFORE request — must NOT typecheck. -testBadOrder : ConsentChain -testBadOrder = - DoubleOptIn - 1706630500000 -- request at T+100 - 1706630400000 -- "confirmation" at T+0 - (IPv4 10 0 0 4) - (MkToken "bad-order") --- Expected compile error: --- Cannot satisfy constraint: 1706630400000 > 1706630500000 --} - -{- --- Test N2: confirmation 48h after request — must NOT typecheck. -testTooSlow : ConsentChain -testTooSlow = - DoubleOptIn - 1706630400000 - 1706803200000 -- 48h later, > 86400000ms window - (IPv4 10 0 0 5) - (MkToken "too-slow") --- Expected compile error: --- Cannot satisfy constraint: TimeDiff 1706630400000 1706803200000 86400000 --} - --------------------------------------------------------------------------------- --- Run marker (for "just test") --------------------------------------------------------------------------------- - -||| Anchor function — if this compiles, all positive tests above typecheck. -export -runConsentTests : IO () -runConsentTests = do - putStrLn "ConsentTests: 4 positive cases compiled" - putStrLn " testValidDoubleOptIn" - putStrLn " testBoundary24h" - putStrLn " testSingleOptIn" - putStrLn " testReusesExample" - putStrLn "ConsentTests: 2 negative cases documented (see comments)" diff --git a/avow-protocol/avow-lib/tests/Main.idr b/avow-protocol/avow-lib/tests/Main.idr deleted file mode 100644 index 33ec2736..00000000 --- a/avow-protocol/avow-lib/tests/Main.idr +++ /dev/null @@ -1,12 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 -||| Test runner for avow-lib -module Main - -import STAMP.ABI.ConsentTests -import STAMP.ABI.UnsubscribeTests - -main : IO () -main = do - runConsentTests - runUnsubscribeTests - putStrLn "avow-lib tests: OK" diff --git a/avow-protocol/avow-lib/tests/UnsubscribeTests.idr b/avow-protocol/avow-lib/tests/UnsubscribeTests.idr deleted file mode 100644 index a0f2ce75..00000000 --- a/avow-protocol/avow-lib/tests/UnsubscribeTests.idr +++ /dev/null @@ -1,43 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell - -||| Tests for STAMP.ABI.Unsubscribe — GDPR-critical unsubscribe-link checks -module STAMP.ABI.UnsubscribeTests - -import STAMP.ABI.Types -import STAMP.ABI.Unsubscribe - -%default total - --------------------------------------------------------------------------------- --- Positive tests --------------------------------------------------------------------------------- - -||| Imported library example should construct -testReusesExample : UnsubscribeLink -testReusesExample = exampleValidUnsubscribe - -||| After a successful test, the link is extractable -testToLinkSome : Maybe UnsubscribeLink -> Bool -testToLinkSome (Just _) = True -testToLinkSome Nothing = False - --------------------------------------------------------------------------------- --- Negative tests — documented --------------------------------------------------------------------------------- - -{- --- Test N1: link without one-click support — should fail GDPR compliance. --- (Concrete error depends on Unsubscribe.idr's invariants; fill in once --- the module's public API stabilises.) --} - --------------------------------------------------------------------------------- --- Run marker --------------------------------------------------------------------------------- - -export -runUnsubscribeTests : IO () -runUnsubscribeTests = do - putStrLn "UnsubscribeTests: imported exampleValidUnsubscribe" - putStrLn "UnsubscribeTests: negative cases pending API finalisation" diff --git a/avow-protocol/avow-social-media-design.adoc b/avow-protocol/avow-social-media-design.adoc deleted file mode 100644 index 420343e5..00000000 --- a/avow-protocol/avow-social-media-design.adoc +++ /dev/null @@ -1,723 +0,0 @@ -= STAMP for Social Media Platforms -Jonathan D.A. Jewell -:toc: -:toclevels: 3 - -== Executive Summary - -*STAMP Protocol adapted for social media platforms to combat fake profiles, bot accounts, and astroturfing through formal verification of account properties.* - -=== Key Innovation - -Use dependent types to prove account authenticity properties: - -* *Time-locked reputation* - Accounts cannot instantly gain high reputation -* *Verified human signals* - Multiple independent verification sources -* *Rate limit compliance* - Posting frequency mathematically bounded -* *Content provenance* - Chain of trust for content origins - -=== Target Platforms - -[cols="1,2,2,1"] -|=== -|Platform |Problem |STAMP Solution |Market - -|Dating Apps -|90% fake profiles, safety risk -|Proven human verification chains -|$3B+ market - -|Twitter/X -|Bot armies, election interference -|Time-locked reputation proofs -|$5B+ ad market - -|Reddit -|Astroturfing, coordinated manipulation -|Proven independent accounts -|$800M+ market - -|TikTok/YouTube -|Fake engagement, view bots -|Verified engagement chains -|$100B+ market -|=== - -== Technical Architecture - -=== Core Types (Idris2) - -[source,idris] ----- --- Account with provable properties -record VerifiedAccount where - constructor MkAccount - accountId : AccountId - createdAt : Timestamp - verificationSources : List VerificationSource - reputationScore : Nat - postingHistory : List Post - - -- Dependent type proofs - {auto 0 ageProof : TimeSince createdAt >= MinAccountAge} - {auto 0 multiSource : length verificationSources >= 2} - {auto 0 rateLimit : PostRate postingHistory <= MaxRate (TimeSince createdAt)} - {auto 0 reputationProof : reputationScore = ComputeReputation postingHistory} - --- Cannot create account without satisfying all proofs --- Literally impossible at type level ----- - -=== Verification Sources - -Multiple independent sources prove humanness: - -[cols="1,2,1,2"] -|=== -|Source |What It Proves |Trust Level |Example - -|Email Verification -|Control of email address -|Low (bots can get emails) -|Gmail, Outlook - -|Phone Verification -|Control of phone number -|Medium (SIM farms exist) -|SMS code - -|Biometric Verification -|Unique human attributes -|High (hard to fake) -|FaceID, fingerprint - -|Social Verification -|Vouched by real humans -|High (web of trust) -|3+ verified users vouch - -|Document Verification -|Government-issued ID -|Very High (KYC-level) -|Passport, driver's license - -|Behavioral Analysis -|Human-like patterns -|Medium (ML-based) -|Typing patterns, mouse movements - -|Financial Verification -|Control of bank account -|High (costly for bots) -|Small deposit verification - -|Domain Verification -|Control of domain -|Medium (orgs only) -|DNS TXT record -|=== - -=== Time-Locked Reputation - -*Key Innovation:* Reputation cannot be instantly purchased or faked. - -[source,idris] ----- --- Reputation is a function of time and verified actions -data Reputation : Timestamp -> Nat -> Type where - NewAccount : (created : Timestamp) - -> Reputation created 0 - - EarnedReputation : - (prev : Reputation t1 n1) -> - (action : VerifiedAction) -> - (time : Timestamp) -> - {auto 0 timeElapsed : time >= t1 + MinActionInterval} -> - {auto 0 actionValid : VerifyAction action = Valid} -> - Reputation time (n1 + ActionValue action) - --- Result: Cannot compile code that grants instant reputation --- Bots must wait minimum time intervals between actions ----- - -=== Example: Dating App Integration - -==== Current Problem - -* 90% of profiles on some platforms are fake -* Scammers, catfish, bots -* Safety risk (romance scams, blackmail) -* Users lose trust → platform dies - -==== STAMP Solution - -[source,idris] ----- -record DatingProfile where - account : VerifiedAccount - photos : List (Photo, ProofOfConsent) - bio : String - - -- Dating-specific proofs - {auto 0 photoVerification : All photos HasFaceMatch account.biometric} - {auto 0 ageVerification : account.age >= LegalAge} - {auto 0 locationProof : account.location = VerifiedLocation} - {auto 0 notBanned : account.accountId `notElem` BannedAccounts} - --- Fake profiles literally cannot be created --- Type system prevents compilation ----- - -==== Implementation Path - -*Phase 1: Pilot (Weeks 9-20)* - -1. Partner with mid-size dating app (Hinge, Bumble, Feeld) -2. Implement STAMP verification as opt-in "Verified Human" badge -3. Measure: - - Fake profile reduction (target: 80-90%) - - User trust increase - - Match quality improvement - - Safety incidents decrease - -*Phase 2: Expansion (Weeks 21-36)* - -1. Press coverage ("Dating app reduces fakes by 90%") -2. Competitors adopt (FOMO effect) -3. Become industry standard - -==== Revenue Model - -[cols="1,1,2"] -|=== -|Tier |Price |Features - -|Free -|$0 -|Basic verification (email + phone) - -|Standard -|$0.01/user/month -|Multi-source verification + reputation - -|Premium -|$0.05/user/month -|Custom verification rules + white-label - -|Enterprise -|Custom -|On-premise deployment + SLA -|=== - -=== Example: Twitter/X Bot Defense - -==== Current Problem - -* Bot armies manipulate trending topics -* Coordinated inauthentic behavior -* Election interference -* Advertisers lose trust - -==== STAMP Solution - -[source,idris] ----- --- Account with time-locked posting capability -record TwitterAccount where - account : VerifiedAccount - followers : List AccountId - following : List AccountId - tweets : List Tweet - - -- Anti-bot proofs - {auto 0 followRatio : FollowRatio following followers < MaxRatio} - {auto 0 tweetRate : TweetRate tweets account.createdAt <= RateLimit account.age} - {auto 0 diverseEngagement : UniqueEngagements tweets >= MinDiversity} - {auto 0 noCoordination : NotCoordinated tweets AllTweets} - --- Coordinated bot behavior provably impossible ----- - -==== Key Features - -*Graduated Trust Levels* - -[cols="1,1,2,1"] -|=== -|Account Age |Posts/Day |Followers/Day |Verification Required - -|0-30 days -|10 -|50 -|Email + Phone - -|30-90 days -|50 -|200 -|+ Social verification - -|90-180 days -|100 -|500 -|+ Behavioral analysis - -|180+ days -|500 -|2000 -|Proven track record -|=== - -*Benefits for Twitter* - -* 80-90% bot reduction -* Advertisers trust metrics -* Regulatory compliance (EU DSA) -* Revenue increase (real users more valuable) -* Reduced moderation costs - -=== Example: Reddit Anti-Astroturfing - -==== Current Problem - -* Coordinated voting brigades -* Fake grassroots movements -* Corporate/political manipulation -* Community trust eroded - -==== STAMP Solution - -[source,idris] ----- -record RedditAccount where - account : VerifiedAccount - karma : Nat - posts : List Post - votes : List Vote - - -- Anti-astroturfing proofs - {auto 0 karmaEarned : karma = EarnedKarma posts votes account.createdAt} - {auto 0 votePatterns : NotCoordinated votes AllVotes} - {auto 0 accountIndependence : ProveIndependent account AllAccounts} - {auto 0 timeDistribution : VoteTimeDistribution votes = HumanLike} - --- Astroturfing campaigns provably detectable ----- - -==== Detection Mechanisms - -*Coordination Detection* - -[source,idris] ----- --- Detect coordinated voting -data CoordinationProof : List Vote -> Type where - Independent : - (votes : List Vote) -> - {auto 0 timingDiverse : VoteTimeVariance votes > MinVariance} -> - {auto 0 accountsDiverse : UniqueAccounts votes >= threshold} -> - {auto 0 contentDiverse : TargetDiversity votes >= minDiversity} -> - CoordinationProof votes NotCoordinated - --- If proof doesn't compile, coordination detected ----- - -== Platform Integration Patterns - -=== Integration Models - -*Model 1: Badge System* - -* Platform keeps existing accounts -* STAMP verification = optional "Verified Human" badge -* Users opt-in to verification -* Gradually increase verified-only features - -*Model 2: Requirement Tier* - -* Free tier: Anyone can join -* Premium features: Require STAMP verification -* High-value features: Require higher trust levels - -*Model 3: Full Integration* - -* All accounts must verify -* Graduated rollout (new accounts first) -* Existing accounts grandfathered or verified over time - -=== API Integration - -[source,typescript] ----- -// Platform calls STAMP verification service -const stamp = new STAMPClient({ - platformId: "twitter", - apiKey: process.env.STAMP_API_KEY -}); - -// Verify account creation -const result = await stamp.verifyAccountCreation({ - userId: "12345", - email: "user@example.com", - phone: "+1234567890", - biometric: faceData, - behavioralSignals: { /* ... */ } -}); - -if (result.verified) { - // Create account with verified badge - createAccount({ - ...userData, - stampVerified: true, - stampTrustLevel: result.trustLevel, - stampProof: result.proof - }); -} ----- - -=== Privacy-Preserving Verification - -*Zero-Knowledge Proofs* - -Users can prove properties without revealing identity: - -[source,idris] ----- --- Prove "I am over 18" without revealing exact age -data AgeProof : Type where - OverAge : - (birthdate : Date) -> - (commitment : Commitment birthdate) -> - {auto 0 ageCheck : YearsSince birthdate >= 18} -> - AgeProof - --- Platform receives: "Verified over 18" --- Platform does NOT receive: Actual birthdate ----- - -== Threat Resistance - -=== Attack Vectors & Defenses - -[cols="2,3,1"] -|=== -|Attack |Defense |Effectiveness - -|Mass Account Creation -|Time-locked reputation + multi-source verification -|99% - -|SIM Farm (phone verification) -|Require 2+ independent sources, behavioral analysis -|95% - -|Stolen Identities -|Biometric + liveness detection -|98% - -|Purchased Accounts -|Behavioral analysis detects ownership change -|85% - -|Coordination/Brigading -|Statistical correlation detection -|90% - -|Reputation Farming -|Time-locks on reputation gain -|95% - -|Social Engineering -|Rate limits on verification vouching -|80% -|=== - -=== Economic Attack Analysis - -*Cost to Create Fake Account* - -[cols="1,1,3"] -|=== -|Tier |Cost |Requirements - -|Basic Fake -|$0.10 -|Email + phone from SIM farm - -|Medium Fake -|$5-10 -|+ Behavioral farming time (30 days) - -|High-Quality Fake -|$50-100 -|+ Stolen identity + biometric spoofing - -|Verified Human Fake -|$500+ -|All above + web of trust penetration -|=== - -*Platform Economics* - -Fake account worth to platform: $0-2 (no ads, no engagement) - -STAMP verification cost: $0.01-0.05/user - -*Result:* Spam becomes economically unviable - -== Adoption Strategy - -=== Phase 1: Dating Apps (Weeks 9-20) - -*Why Start Here* - -* Safety-critical (fake profiles = existential threat) -* Fast decision-making (startups, not Big Tech) -* Clear metrics (fake profile %) -* Willing to pay -* PR-friendly ("We care about safety") - -*Target Customers* - -1. Bumble (safety-focused brand) -2. Hinge (owned by Match, but innovative) -3. Feeld (niche, willing to experiment) -4. Her (LGBTQ+ safety critical) -5. Thursday (new, innovative) - -*Pitch* - -> "Reduce fake profiles by 90% in 90 days. -> -> Proven with formal verification, not promises. -> -> First customer gets case study + 3 months free." - -=== Phase 2: Reddit/Discord (Weeks 21-36) - -*Why Next* - -* Community-driven (not algorithm-driven) -* Moderation pain point -* API-friendly -* Open to innovation - -*Value Prop* - -* Reduce astroturfing -* Protect communities -* Verified human badge -* Reduced mod workload - -=== Phase 3: Twitter/Meta (Weeks 37-52) - -*Why Last* - -* Largest impact -* Most complex integration -* Need proof of concept first -* Regulatory pressure helps - -*Approach* - -* Don't pitch directly initially -* Dating app success → Press coverage -* Twitter sees competitor advantage -* Regulatory pressure (EU DSA) -* Then approach: "Industry standard emerging" - -== Revenue Model - -=== Pricing Tiers - -[cols="1,1,2,2"] -|=== -|Tier |Price/User/Month |Features |Target - -|Community -|Free -|Open source library, self-host -|Small platforms, communities - -|Startup -|$0.01 -|Hosted API, basic verification -|<1M users - -|Growth -|$0.05 -|Multi-source verification, analytics -|1M-10M users - -|Enterprise -|Custom -|On-premise, custom rules, SLA -|10M+ users -|=== - -=== Market Size - -[cols="2,1,2"] -|=== -|Segment |Annual Value |Notes - -|Dating Apps -|$90M+ -|30M users × $3/user/year - -|Social Media (Twitter, Reddit) -|$500M+ -|1B users × $0.50/user/year - -|Total Addressable Market -|$1.4B+ -|Growing 20% YoY -|=== - -== Technical Roadmap - -=== Q1 2026 (Weeks 1-12) - -* [x] Core STAMP library (Idris2 + Zig) -* [x] Telegram bot demo -* [x] Website + interactive demo -* [ ] Dating app one-pager -* [ ] First customer pilot contract - -=== Q2 2026 (Weeks 13-24) - -* [ ] Dating app integration -* [ ] Measure fake profile reduction -* [ ] Case study + press release -* [ ] API v1.0 release -* [ ] 2-3 additional dating app customers - -=== Q3 2026 (Weeks 25-36) - -* [ ] Reddit/Discord integrations -* [ ] Community features -* [ ] Analytics dashboard -* [ ] Series A fundraise ($2-5M) - -=== Q4 2026 (Weeks 37-48) - -* [ ] Twitter/Meta pilots -* [ ] Scale to 10M+ users -* [ ] Become industry standard -* [ ] EU DSA compliance certification - -== Competitive Analysis - -=== Existing Solutions - -[cols="2,2,2,2"] -|=== -|Solution |Approach |Limitation |STAMP Advantage - -|CAPTCHA -|Turing test -|Bots solve CAPTCHAs now -|Formal proof, not heuristic - -|Phone Verification -|SMS code -|SIM farms -|Multi-source required - -|ID Verification (KYC) -|Check government ID -|Privacy concerns, expensive -|Zero-knowledge proofs - -|Behavioral Analysis -|ML detection -|Cat-and-mouse game -|Mathematical guarantee - -|Blue Checkmark -|Manual review -|Doesn't scale, biased -|Automated + provable -|=== - -=== Why STAMP Wins - -1. *Mathematical Guarantee* - Not a heuristic, a proof -2. *Economics* - Makes spam unprofitable -3. *Privacy-Preserving* - Zero-knowledge proofs -4. *Platform-Agnostic* - Works for any social platform -5. *Open Source* - Community trust + contributions - -== Regulatory Compliance - -=== EU Digital Services Act (DSA) - -*Requirements STAMP Satisfies* - -* Known trader verification (Article 24) -* Transparency of recommender systems (Article 27) -* Protection of minors (Article 28) -* Risk assessment obligations (Article 34) - -*Compliance Value* - -Platforms using STAMP can demonstrate: - -* Proactive bot reduction (80-90%) -* Verifiable age gates -* Transparent trust mechanisms -* Auditable verification logs - -=== Other Regulations - -* *GDPR* - Privacy-preserving verification -* *CAN-SPAM* - Proven consent chains -* *COPPA* - Verifiable age checks -* *Online Safety Bill* (UK) - Duty of care compliance - -== Open Questions & Future Work - -=== Technical - -* [ ] Sybil attack resistance at scale (1B+ users) -* [ ] Zero-knowledge proof performance optimization -* [ ] Blockchain integration for decentralized verification? -* [ ] WASM compilation for in-browser verification - -=== Business - -* [ ] Pricing model validation with customers -* [ ] Partner vs build decision for verification sources -* [ ] International expansion challenges -* [ ] Patent strategy (or open source everything?) - -=== Research - -* [ ] Formal verification of coordination detection -* [ ] Machine learning + formal proofs integration -* [ ] Cross-platform reputation portability -* [ ] Decentralized identity integration - -== Conclusion - -*STAMP Protocol provides the first mathematically proven solution to social media's fake account problem.* - -*Key Advantages:* - -* 80-90% bot reduction (proven, not promised) -* Privacy-preserving (zero-knowledge proofs) -* Platform-agnostic (works everywhere) -* Economically sustainable (makes spam unprofitable) -* Regulatory compliance (DSA, GDPR, etc.) - -*Market Opportunity:* $1.4B+ TAM, growing 20% YoY - -*Competitive Moat:* Mathematical proofs (competitors cannot copy without dependent types) - -*Next Steps:* - -1. Dating app pilot (Week 9) -2. Measure 90% reduction (Week 20) -3. Press coverage (Week 24) -4. Scale to Twitter/Meta (Week 40) - -*STAMP is not just a better bot detector. It's a fundamental shift in how we prove humanness online.* diff --git a/avow-protocol/casket-simple b/avow-protocol/casket-simple deleted file mode 100755 index 18b4147c..00000000 Binary files a/avow-protocol/casket-simple and /dev/null differ diff --git a/avow-protocol/cloudflare-dns-zone.txt b/avow-protocol/cloudflare-dns-zone.txt deleted file mode 100644 index 75c1fde5..00000000 --- a/avow-protocol/cloudflare-dns-zone.txt +++ /dev/null @@ -1,85 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; Cloudflare DNS Zone File for avow-protocol.org (Jonathan D.A. Jewell) -; Security-hardened, GitHub Pages + Cloudflare + Zero Trust/SDP -; All records active and optimized for security/dependability - -@ IN SOA ns1.cloudflare.com. j.d.a.jewell@open.ac.uk. ( - 2026020401 ; Serial (YYYYMMDDNN) - 10800 ; Refresh - 3600 ; Retry - 604800 ; Expire - 3600 ; Minimum TTL - ) - -; --- Core Records (Proxied) --- -@ IN A 192.0.2.1 ; Root domain (proxied via Cloudflare) -@ IN AAAA 2001:db8::1 ; IPv6 for root (proxied) -www IN A 192.0.2.1 ; www (proxied) -www IN AAAA 2001:db8::1 ; IPv6 for www (proxied) -static IN CNAME avow-protocol.org. ; Static assets (proxied) -assets IN CNAME avow-protocol.org. ; Dedicated assets subdomain (proxied) -cdn IN CNAME avow-protocol.org. ; CDN subdomain (proxied) - -; --- GitHub Pages (Required) --- -gh-pages IN CNAME hyperpolymath.github.io. ; GitHub Pages source (NOT proxied) - -; --- Security & Compliance --- -@ IN TXT "v=spf1 include:_spf.github.com ~all" ; SPF for GitHub Pages -@ IN TXT "github-pages-challenge-hyperpolymath=avow-protocol-verification" ; GitHub verification -@ IN TXT "v=DMARC1; p=reject; rua=mailto:j.d.a.jewell@open.ac.uk" ; DMARC -_dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:j.d.a.jewell@open.ac.uk" -@ IN CAA 0 issue "letsencrypt.org" ; CAA for Let's Encrypt -@ IN CAA 0 issue "digicert.com" ; Fallback CA -@ IN CAA 0 iodef "mailto:j.d.a.jewell@open.ac.uk" ; Incident reporting - -; --- HTTPS Enforcement --- -@ IN TXT "https-only-standard=max-age=63072000; includeSubDomains; preload" ; Force HTTPS - -; --- Mail (MX + Security) --- -@ IN MX 10 mail.avow-protocol.org. ; Primary mail server -@ IN MX 20 fallback-mail.avow-protocol.org. ; Fallback mail server -_smtp._tls IN TLSA 3 1 1 d2abde240d7cd3ee6b4b28c54df034b97983a1d16e8a410e4561cb106618e971 ; TLSA for SMTP (SHA256) -_mta-sts IN TXT "v=STSv1; id=2026020401; mode=enforce" ; MTA-STS policy -_smtp._tls IN TXT "v=TLSRPTv1; rua=mailto:tls-rpt@avow-protocol.org" ; TLS-RPT -_smimea IN TXT "v=SMIMEA1; cert=base64-encoded-cert; alg=sha256; usage=email" ; SMIMEA - -; --- SSHFP (Root Access + Git Cloning) --- -@ IN SSHFP 1 1 123456789abcdef67890123456789abcdef67890 ; SHA1 (legacy support) -@ IN SSHFP 1 2 123456789abcdef67890123456789abcdef67890123456789abcdef67890 ; SHA256 -@ IN SSHFP 2 1 123456789abcdef67890123456789abcdef67890 ; Backup key (SHA1) -@ IN SSHFP 2 2 123456789abcdef67890123456789abcdef67890123456789abcdef67890 ; Backup key (SHA256) - -; --- OpenPGP (Keybase/GitHub) --- -openpgp IN TXT "url=https://avow-protocol.org/openpgp.asc" ; OpenPGP key URL -openpgp IN URI 10 1 "https://github.com/hyperpolymath.gpg" ; URI for GitHub-hosted PGP - -; --- SFTP/URI (GitHub Files) --- -sftp IN URI 10 1 "sftp://hyperpolymath@github.com/hyperpolymath/avow-protocol" ; SFTP access URI - -; --- Zero Trust/SDP (Cloudflare Tunnel) --- -dashboard.internal IN CNAME tunnel-id.cfargotunnel.com. ; Internal dashboard -ci.internal IN CNAME tunnel-id.cfargotunnel.com. ; CI/CD access -db.internal IN CNAME tunnel-id.cfargotunnel.com. ; Private DB access - -; --- Communication (Discourse/Zulip) --- -discourse IN CNAME avow-protocol.org. ; Discourse forum (proxied) -zulip IN CNAME avow-protocol.org. ; Zulip chat (proxied) -members IN CNAME avow-protocol.org. ; Members subdomain (proxied) - -; --- Automation & Monitoring --- -ci IN CNAME avow-protocol.org. ; CI/CD status (proxied) -status IN CNAME avow-protocol.org. ; Public status page (proxied) -logs IN CNAME avow-protocol.org. ; Log aggregation (proxied) - -; --- Advanced Security (WASM/Proxy) --- -api IN CNAME avow-protocol.org. ; API gateway (proxied, WASM fronted) -auth IN CNAME avow-protocol.org. ; Auth service (proxied) -wasm IN CNAME avow-protocol.org. ; WASM proxy endpoint (proxied) - -; --- Fallback/Redundancy --- -fallback IN CNAME backup-hosting.com. ; Fallback hosting (NOT proxied) -secondary IN CNAME secondary-dns-provider.com. ; Secondary DNS (NOT proxied) - -; --- External Integrations --- -linkedin IN CNAME avow-protocol.org. ; LinkedIn showcase (proxied) -rss IN CNAME avow-protocol.org. ; RSS feed aggregator (proxied) diff --git a/avow-protocol/config.yaml b/avow-protocol/config.yaml deleted file mode 100644 index f2d3ca4f..00000000 --- a/avow-protocol/config.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# Casket-SSG Configuration for AVOW Protocol -# Site metadata -title: AVOW Protocol -url: https://avow-protocol.org -author: Jonathan D.A. Jewell - -# Build settings -input: content -output: _site - -# Language & i18n -language: en - -# Features -spell_check: false # Technical content with acronyms diff --git a/avow-protocol/config/ci.k9.ncl b/avow-protocol/config/ci.k9.ncl deleted file mode 100644 index b1172b0d..00000000 --- a/avow-protocol/config/ci.k9.ncl +++ /dev/null @@ -1,90 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# K9 Contractile: Yard Level (Validated Config) -# CI/CD configuration with Nickel contracts - -let Port = std.contract.from_predicate (fun port => - std.is_number port && port >= 1 && port <= 65535 -) in - -let NonEmptyString = std.contract.from_predicate (fun s => - std.is_string s && std.string.length s > 0 -) in - -{ - leash = 'Yard, - - ci = { - provider = "GitHub Actions" | NonEmptyString, - - triggers = { - push = { - branches | Array NonEmptyString = ["main", "develop"], - }, - pull_request = { - branches | Array NonEmptyString = ["main"], - }, - }, - - build = { - command | NonEmptyString = "deno task build", - output_dir | NonEmptyString = "/", - node_version = null, # Not using Node.js - deno_version | NonEmptyString = "2.0+", - }, - - test = { - command | NonEmptyString = "deno task test", - coverage = false, # TODO: Add coverage - }, - - security = { - hypatia_scan = true, - codeql = true, - scorecard = true, - secret_scanning = true, - dependency_review = true, - }, - - deployment = { - platform | NonEmptyString = "Cloudflare Pages", - production_branch | NonEmptyString = "main", - preview_branches | Array NonEmptyString = ["develop", "staging"], - - environment = { - NODE_ENV = "production", - DENO_ENV = "production", - }, - }, - }, - - local_dev = { - server_command | NonEmptyString = "deno run -A jsr:@std/http/file-server .", - port | Port = 8000, - watch_command | NonEmptyString = "deno task watch", - hot_reload = false, - }, - - quality = { - linting = { - enabled = true, - command | NonEmptyString = "deno lint", - }, - - formatting = { - enabled = true, - command | NonEmptyString = "deno fmt", - }, - - editorconfig = { - enabled = true, - check_command | NonEmptyString = "editorconfig-checker", - }, - }, - - validation = { - proven_validation = true, - dom_safety_checks = true, - url_validation = "ProvenSafeUrl", - html_validation = "balanced-tags", - }, -} diff --git a/avow-protocol/config/metadata.k9.ncl b/avow-protocol/config/metadata.k9.ncl deleted file mode 100644 index 6f3c3dcc..00000000 --- a/avow-protocol/config/metadata.k9.ncl +++ /dev/null @@ -1,65 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# K9 Contractile: Kennel Level (Pure Data) -# Project metadata for stamp-protocol - -{ - leash = 'Kennel, - - project = { - name = "stamp-protocol", - version = "1.0.0", - description = "Interactive demonstration of STAMP Protocol consent architecture", - homepage = "https://stamp-protocol.org", - repository = "https://github.com/hyperpolymath/stamp-protocol", - - license = "PMPL-1.0-or-later", - author = { - name = "Jonathan D.A. Jewell", - email = "j.d.a.jewell@open.ac.uk", - }, - - keywords = [ - "stamp-protocol", - "consent", - "formal-verification", - "rescript", - "proven", - "idris2", - ], - }, - - tech_stack = { - languages = ["ReScript", "JavaScript", "HTML", "CSS"], - runtime = "Deno", - libraries = [ - "rescript-tea", - "rescript-dom-mounter", - "proven", - "cadre-tea-router", - ], - - build_tools = ["ReScript", "Deno"], - package_manager = "Deno", - }, - - deployment = { - platform = "Cloudflare Pages", - domain = "stamp-protocol.org", - build_command = "deno task build", - output_directory = "/", - }, - - features = { - proven_validation = true, - formal_verification = true, - security_hardening = true, - tea_architecture = true, - dom_mounting = "rescript-dom-mounter", - }, - - status = { - phase = "MVP Development", - completion_percentage = 65, - production_ready = false, - }, -} diff --git a/avow-protocol/content/about.a2ml b/avow-protocol/content/about.a2ml deleted file mode 100644 index d8cb6321..00000000 --- a/avow-protocol/content/about.a2ml +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: About STAMP Protocol -description: Understanding the Subscriber Tracking with Attribution and Mathematically Proven consent protocol -author: Jonathan D.A. Jewell -date: 2026-01-30 ---- - -# About STAMP Protocol - -**STAMP** stands for **S**ubscriber **T**racking with **A**ttribution and **M**athematically **P**roven consent. - -## The Problem - -Email marketing systems often fail to provide: - -- **Verifiable consent** - Subscribers can't prove they consented -- **Unbreakable unsubscribe** - Links can break or be malicious -- **Transparent tracking** - Users don't know what's being tracked -- **Verifiable proof** - No strong guarantees of consent state - -## The Solution - -STAMP provides a **verifiable** consent management system design: - -### Key Features - -1. **Proven URL Validation** - - Uses `ProvenSafeUrl` from the proven library - - URLs can be validated before sending - - Compile-time verification via Idris2 (where bindings are used) - -2. **Consent Proofs (Planned)** - - Define a proof format for consent events - - Timestamped and signed proofs (target) - - Subscriber can verify their consent state - - Marketer can prove compliance - -3. **Verified Unsubscribe** - - Links validated before generation - - HTTPS-only where enforced by validation - - Rate-limiting and abuse protection (planned) - -4. **Full Transparency** - - Subscribers see all tracked data - - Consent history available on-demand - - Deletion requests cryptographically logged - - GDPR/CCPA compliance by design - -## Architecture - -STAMP uses **The Elm Architecture** (TEA) for predictable state management: - -``` -User Action → Message → Update → New Model → View -``` - -All state transitions are **pure functions** with **no side effects**. - -## Formal Verification - -The core URL validation is **formally verified** using Idris2 dependent types: - -- **No runtime URL parsing errors** - Proven impossible -- **Type safety** - Guaranteed correct operations - -See the [proven library](https://github.com/hyperpolymath/proven) for details. - -## Try It Out - -1. Visit the homepage demo -2. See URL validation in action -3. Explore the consent flow -4. Review planned proof flow - -## Learn More - -- [STAMP Protocol Draft](https://github.com/hyperpolymath/stamp-protocol/blob/main/docs/PROTOCOL.md) -- [ReScript TEA](https://github.com/hyperpolymath/rescript-tea) -- [Proven Library](https://github.com/hyperpolymath/proven) -- [SafeDOM Mounter](https://github.com/hyperpolymath/rescript-dom-mounter) - ---- - -*STAMP Protocol - Consent you can prove.* diff --git a/avow-protocol/content/index.md b/avow-protocol/content/index.md deleted file mode 100644 index 990dc518..00000000 --- a/avow-protocol/content/index.md +++ /dev/null @@ -1,143 +0,0 @@ ---- -title: STAMP Protocol - Verifiable Consent and Compliance -description: A protocol design for verifiable consent, working unsubscribe links, and enforceable rate limits. This site demonstrates the concepts. -date: 2026-01-30 ---- - -# STAMP Protocol - -**Secure Typed Announcement Messaging Protocol** - -Protocol design that aims to make consent, unsubscribe, and rate-limit compliance verifiable. - -[Try Live Demo on Telegram →](https://t.me/stamp_demo_bot) -[Learn How It Works](#how-it-works) -[Read the protocol draft →](docs/PROTOCOL.md) - -## The Problem - -### 📧 Email Spam - -Unsubscribe links often don't work. No proof consent was given. - -**$200M+ market** - -### 🤖 Social Media Bots - -Fake profiles, astroturfing, election interference. Current solutions don't scale. - -**$1.2B+ market** - -### 💸 Platform Costs - -Companies spend $100M+/year fighting spam and bots. Still losing. - -**Bots remain a persistent problem** - -## The STAMP Solution {#how-it-works} - -Use **dependent types** (Idris2) to make message properties verifiable at compile-time. - -### ✓ Proven Consent - -Cryptographically provable consent chains. Can't fake timestamps or skip verification. - -``` -proof : confirmation > initial_request -``` - -### ✓ Working Unsubscribe - -Unsubscribe links validated before sending to avoid broken links. - -``` -proof : response.code = OK ∧ response.time < 200ms -``` - -### ✓ Rate Limiting - -Protocol-level rate limits based on account age. Cannot be bypassed. - -``` -proof : messages_today < daily_limit -``` - -## How It Works - -### ❌ Without Dependent Types - -```rust -struct UnsubscribeLink { - url: String, - tested: bool, // Can lie -} -``` - -No guarantees. Developers can lie about testing. - -### ✅ With STAMP (Idris2) - -```idris -record UnsubscribeLink where - url : URL - tested_at : Timestamp - response : HTTPResponse - {auto proof : response.code = OK} - {auto proof : response.time < 200ms} -``` - -Designed to be verifiable. The protocol aims to reject invalid links before send. - -## Try It Now - -### Telegram Bot Demo - -See STAMP in action with our live Telegram bot (demo flow): - -1. Open Telegram and search for **@stamp_demo_bot** -2. Send `/start` to subscribe -3. See consent flow steps in action -4. Send `/verify` to see full verification -5. Send `/unsubscribe` to test the demo flow - -[Open @stamp_demo_bot →](https://t.me/stamp_demo_bot) - -### Demo Notes - -The browser demo uses build-time proof data for URL checks and simulates the consent proof flow. Full proofs are part of the protocol draft. - -## Use Cases - -### Email Marketing - -Design for compliance with CAN-SPAM, GDPR. Verified unsubscribe links. - -### Dating Apps - -Reduce fake profiles with verified identity chains. - -### Social Media - -Combat astroturfing and election interference with verified accounts. - -### Business Messaging - -RCS, SMS marketing with verifiable compliance. - -## Impact - -- **TBD** Bot Reduction -- **TBD** Platform Savings -- **TBD** Compliance Proof - -## Ready to Prove Compliance? - -Contact us to integrate STAMP into your platform. - -- [GitHub](https://github.com/hyperpolymath/libstamp) -- [Demo Bot](https://t.me/stamp_demo_bot) -- [Contact](mailto:j.d.a.jewell@open.ac.uk) - ---- - -© 2026 STAMP Protocol. Licensed under AGPL-3.0. diff --git a/avow-protocol/contractiles/README.adoc b/avow-protocol/contractiles/README.adoc deleted file mode 100644 index d19a3877..00000000 --- a/avow-protocol/contractiles/README.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Contractiles Template Set -:toc: -:sectnums: - -This directory contains the generalized contractiles templates. Copy the `contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework. - -== Fill-In Instructions - -1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports). -2. Replace Trustfile.hs placeholders with your actual key paths and verification commands. -3. Adjust Dustfile handlers to match your rollback and recovery tooling. -4. Update Intentfile to mirror the roadmap you want the system to evolve toward. - -== Contents - -* `must/Mustfile` - required invariants and validations. -* `trust/Trustfile.hs` - cryptographic verification steps. -* `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. diff --git a/avow-protocol/contractiles/dust/Dustfile b/avow-protocol/contractiles/dust/Dustfile deleted file mode 100644 index 314903cc..00000000 --- a/avow-protocol/contractiles/dust/Dustfile +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile template - recovery and rollback semantics - -version: 1 - -recovery: - logs: - - name: decision-log - path: logs/decisions.json - reversible: true - handler: "log-replay --reverse logs/decisions.json" - - policy: - - name: policy-rollback - path: policy/policy.ncl - rollback: "git checkout HEAD~1 -- policy/policy.ncl" - notes: "Rollback policy to the previous known-good revision." - - gateway: - - name: bad-deployment - event: "deploy.failure" - undo: "kubectl rollout undo deployment/gateway" - notes: "Undo a failed deployment while preserving audit logs." - - dust-events: - - name: decision-log-to-dust - source: logs/decisions.json - transform: "dustify --input logs/decisions.json --output logs/dust-events.json" - notes: "Map gateway decision logs into reversible dust events." diff --git a/avow-protocol/contractiles/must/Mustfile b/avow-protocol/contractiles/must/Mustfile deleted file mode 100644 index dc7b3be5..00000000 --- a/avow-protocol/contractiles/must/Mustfile +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile - declarative state contract (template) -# See: https://github.com/hyperpolymath/mustfile - -version: 1 - -metadata: - name: project-state-contract - spec: v0.0.1 - description: "Invariant checks for config, policy, gateway, logs, and schema." - -parameters: - gateway_port: "8080" - schema_version: "v0.0.1" - -checks: - - name: config-valid - description: "config/service.yaml must be valid." - run: "yq -e '.' config/service.yaml >/dev/null" - - - name: policy-compiles - description: "policy/policy.ncl must compile." - run: "nickel check policy/policy.ncl" - - - name: gateway-exposes-port - description: "Service must expose the configured port." - run: "bash -uc 'ss -lnt | rg \":${GATEWAY_PORT:-8080}\"'" - - - name: logs-are-json - description: "Logs must be JSON." - run: "bash -uc 'rg --files -g \"*.json\" logs | xargs -r jq -e .'" - - - name: schema-version-matches - description: "Schema must match version spec." - run: "bash -uc 'rg -n \"${SCHEMA_VERSION:-v0.0.1}\" schema'" diff --git a/avow-protocol/deno.json b/avow-protocol/deno.json deleted file mode 100644 index 95f77818..00000000 --- a/avow-protocol/deno.json +++ /dev/null @@ -1,32 +0,0 @@ -{ - "tasks": { - "test": "deno run -A npm:rescript && deno test --allow-read src/*_test.bs.js", - "build": "deno run -A npm:rescript", - "clean": "deno run -A npm:rescript clean", - "watch": "deno run -A npm:rescript -w", - "build:all": "deno task k9:validate && deno task a2ml:render && deno task proofs:generate && deno task build", - "k9:validate": "nickel typecheck config/metadata.k9.ncl && nickel typecheck config/ci.k9.ncl", - "k9:export": "nickel export config/metadata.k9.ncl > metadata.json", - "a2ml:render": "deno run -A --config ../a2ml/prototype/rescript/deno.json ../a2ml/prototype/rescript/src/Cli.bs.js render content/about.a2ml --out public/about.html", - "a2ml:validate": "cd ../a2ml && just cli validate ../avow-protocol/content/*.a2ml", - "proofs:generate": "deno run -A scripts/GenerateProof.res.js", - "sync:6scm": "bash scripts/sync-6scm.sh", - "check:6scm": "bash scripts/check-6scm.sh", - "serve": "deno run -A jsr:@std/http/file-server ." - }, - "imports": { - "rescript": "^12.0.0", - "@rescript/core": "npm:@rescript/core@^1.6.0", - "@rescript/react": "npm:@rescript/react@^0.12.0", - "react": "npm:react@^18.3.0", - "react-dom": "npm:react-dom@^18.3.0", - "rescript-tea/": "../rescript-tea/src/", - "cadre-router/": "../cadre-router/src/", - "cadre-tea-router/": "../cadre-tea-router/src/", - "rescript-dom-mounter/": "../rescript-dom-mounter/src/", - "proven/": "../proven/bindings/rescript/src/" - }, - "compilerOptions": { - "checkJs": false - } -} \ No newline at end of file diff --git a/avow-protocol/deno.lock b/avow-protocol/deno.lock deleted file mode 100644 index 417e8ca2..00000000 --- a/avow-protocol/deno.lock +++ /dev/null @@ -1,199 +0,0 @@ -{ - "version": "5", - "specifiers": { - "npm:@rescript/core@^1.6.0": "1.6.1_rescript@12.1.0", - "npm:@rescript/react@0.12": "0.12.2_react@18.3.1_react-dom@18.3.1__react@18.3.1", - "npm:react-dom@^18.3.0": "18.3.1_react@18.3.1", - "npm:react@^18.3.0": "18.3.1", - "npm:rescript@*": "12.1.0", - "npm:rescript@^12.1.0": "12.1.0" - }, - "npm": { - "@rescript/core@1.6.1_rescript@12.1.0": { - "integrity": "sha512-vyb5k90ck+65Fgui+5vCja/mUfzKaK3kOPT4Z6aAJdHLH1eljEi1zKhXroCiCtpNLSWp8k4ulh1bdB5WS0hvqA==", - "dependencies": [ - "rescript" - ] - }, - "@rescript/darwin-arm64@12.1.0": { - "integrity": "sha512-OuJMT+2h2Lp60n8ONFx1oBAAePSVkM9zl7E/EX4VD2xkQoVTPklz0BpHYOICnFJSCOOdbOhbsTBXdLpo3yvllg==", - "os": ["darwin"], - "cpu": ["arm64"] - }, - "@rescript/darwin-x64@12.1.0": { - "integrity": "sha512-r5Iv4ga+LaNq+6g9LODwZG4bwydd9UDXACP/HKxOfrP9XQCITlF/XqB1ZDJWyJOgJLZSJCd7erlG38YtB0VZKA==", - "os": ["darwin"], - "cpu": ["x64"] - }, - "@rescript/linux-arm64@12.1.0": { - "integrity": "sha512-UTZv4GTjbyQ/T5LQDfQiGcumK3SzE1K7+ug6gWpDcGZ7ALc7hCS6BVEFL/LDs8iWVwAwkK/6r456s2zRnvS7wQ==", - "os": ["linux"], - "cpu": ["arm64"] - }, - "@rescript/linux-x64@12.1.0": { - "integrity": "sha512-c0PXuBL09JRSA4nQusYbR4mW5QJrBPqxDrqvIX+M79fk3d6jQmj5x4NsBwk5BavxvmbR/JU1JjYBlSAa3h22Vg==", - "os": ["linux"], - "cpu": ["x64"] - }, - "@rescript/react@0.12.2_react@18.3.1_react-dom@18.3.1__react@18.3.1": { - "integrity": "sha512-EOF19dLTG4Y9K59JqMjG5yfvIsrMZqfxGC2J/oe9gGgrMiUrzZh3KH9khTcR1Z3Ih0lRViSh0/iYnJz20gGoag==", - "dependencies": [ - "react", - "react-dom" - ] - }, - "@rescript/runtime@12.1.0": { - "integrity": "sha512-bvr9RfvBD+JS/6foWCA4l2fLXmUXN0KGqylXQPHt09QxUghqgoCiaWVHaHSx5dOIk/jAPlGQ7zB5yVeMas/EFQ==" - }, - "@rescript/win32-x64@12.1.0": { - "integrity": "sha512-nQC42QByyAbryfkbyK67iskipUqXVwTPCFrqissY4jJoP0128gg0yG6DydJnV1stXphtFdMFHtmyYE1ffG7UBg==", - "os": ["win32"], - "cpu": ["x64"] - }, - "js-tokens@4.0.0": { - "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==" - }, - "loose-envify@1.4.0": { - "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==", - "dependencies": [ - "js-tokens" - ], - "bin": true - }, - "react-dom@18.3.1_react@18.3.1": { - "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==", - "dependencies": [ - "loose-envify", - "react", - "scheduler" - ] - }, - "react@18.3.1": { - "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==", - "dependencies": [ - "loose-envify" - ] - }, - "rescript@12.1.0": { - "integrity": "sha512-n/B43wzIEKV4OmlrWbrlQOL4zZaz0RM/Cc8PG2YvhQvQDW7nscHJliDq1AGeVwHoMX68MeaKKzLDOMOMU9Z6FA==", - "dependencies": [ - "@rescript/runtime" - ], - "optionalDependencies": [ - "@rescript/darwin-arm64", - "@rescript/darwin-x64", - "@rescript/linux-arm64", - "@rescript/linux-x64", - "@rescript/win32-x64" - ], - "bin": true - }, - "scheduler@0.23.2": { - "integrity": "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==", - "dependencies": [ - "loose-envify" - ] - } - }, - "remote": { - "https://deno.land/std@0.208.0/assert/assert.ts": "9a97dad6d98c238938e7540736b826440ad8c1c1e54430ca4c4e623e585607ee", - "https://deno.land/std@0.208.0/assert/assertion_error.ts": "4d0bde9b374dfbcbe8ac23f54f567b77024fb67dbb1906a852d67fe050d42f56", - "https://deno.land/std@0.208.0/fs/_util.ts": "fbf57dcdc9f7bc8128d60301eece608246971a7836a3bb1e78da75314f08b978", - "https://deno.land/std@0.208.0/fs/walk.ts": "c1e6b43f72a46e89b630140308bd51a4795d416a416b4cfb7cd4bd1e25946723", - "https://deno.land/std@0.208.0/path/_common/assert_path.ts": "061e4d093d4ba5aebceb2c4da3318bfe3289e868570e9d3a8e327d91c2958946", - "https://deno.land/std@0.208.0/path/_common/basename.ts": "0d978ff818f339cd3b1d09dc914881f4d15617432ae519c1b8fdc09ff8d3789a", - "https://deno.land/std@0.208.0/path/_common/common.ts": "9e4233b2eeb50f8b2ae10ecc2108f58583aea6fd3e8907827020282dc2b76143", - "https://deno.land/std@0.208.0/path/_common/constants.ts": "e49961f6f4f48039c0dfed3c3f93e963ca3d92791c9d478ac5b43183413136e0", - "https://deno.land/std@0.208.0/path/_common/dirname.ts": "2ba7fb4cc9fafb0f38028f434179579ce61d4d9e51296fad22b701c3d3cd7397", - "https://deno.land/std@0.208.0/path/_common/format.ts": "11aa62e316dfbf22c126917f5e03ea5fe2ee707386555a8f513d27ad5756cf96", - "https://deno.land/std@0.208.0/path/_common/from_file_url.ts": "ef1bf3197d2efbf0297a2bdbf3a61d804b18f2bcce45548ae112313ec5be3c22", - "https://deno.land/std@0.208.0/path/_common/glob_to_reg_exp.ts": "5c3c2b79fc2294ec803d102bd9855c451c150021f452046312819fbb6d4dc156", - "https://deno.land/std@0.208.0/path/_common/normalize.ts": "2ba7fb4cc9fafb0f38028f434179579ce61d4d9e51296fad22b701c3d3cd7397", - "https://deno.land/std@0.208.0/path/_common/normalize_string.ts": "88c472f28ae49525f9fe82de8c8816d93442d46a30d6bb5063b07ff8a89ff589", - "https://deno.land/std@0.208.0/path/_common/relative.ts": "1af19d787a2a84b8c534cc487424fe101f614982ae4851382c978ab2216186b4", - "https://deno.land/std@0.208.0/path/_common/strip_trailing_separators.ts": "7ffc7c287e97bdeeee31b155828686967f222cd73f9e5780bfe7dfb1b58c6c65", - "https://deno.land/std@0.208.0/path/_common/to_file_url.ts": "a8cdd1633bc9175b7eebd3613266d7c0b6ae0fb0cff24120b6092ac31662f9ae", - "https://deno.land/std@0.208.0/path/_interface.ts": "6471159dfbbc357e03882c2266d21ef9afdb1e4aa771b0545e90db58a0ba314b", - "https://deno.land/std@0.208.0/path/_os.ts": "30b0c2875f360c9296dbe6b7f2d528f0f9c741cecad2e97f803f5219e91b40a2", - "https://deno.land/std@0.208.0/path/basename.ts": "04bb5ef3e86bba8a35603b8f3b69537112cdd19ce64b77f2522006da2977a5f3", - "https://deno.land/std@0.208.0/path/common.ts": "f4d061c7d0b95a65c2a1a52439edec393e906b40f1caf4604c389fae7caa80f5", - "https://deno.land/std@0.208.0/path/dirname.ts": "88a0a71c21debafc4da7a4cd44fd32e899462df458fbca152390887d41c40361", - "https://deno.land/std@0.208.0/path/extname.ts": "2da4e2490f3b48b7121d19fb4c91681a5e11bd6bd99df4f6f47d7a71bb6ecdf2", - "https://deno.land/std@0.208.0/path/format.ts": "3457530cc85d1b4bab175f9ae73998b34fd456c830d01883169af0681b8894fb", - "https://deno.land/std@0.208.0/path/from_file_url.ts": "e7fa233ea1dff9641e8d566153a24d95010110185a6f418dd2e32320926043f8", - "https://deno.land/std@0.208.0/path/glob_to_regexp.ts": "74d7448c471e293d03f05ccb968df4365fed6aaa508506b6325a8efdc01d8271", - "https://deno.land/std@0.208.0/path/is_absolute.ts": "67232b41b860571c5b7537f4954c88d86ae2ba45e883ee37d3dec27b74909d13", - "https://deno.land/std@0.208.0/path/is_glob.ts": "567dce5c6656bdedfc6b3ee6c0833e1e4db2b8dff6e62148e94a917f289c06ad", - "https://deno.land/std@0.208.0/path/join.ts": "98d3d76c819af4a11a81d5ba2dbb319f1ce9d63fc2b615597d4bcfddd4a89a09", - "https://deno.land/std@0.208.0/path/join_globs.ts": "9b84d5103b63d3dbed4b2cf8b12477b2ad415c7d343f1488505162dc0e5f4db8", - "https://deno.land/std@0.208.0/path/mod.ts": "3defabebc98279e62b392fee7a6937adc932a8f4dcd2471441e36c15b97b00e0", - "https://deno.land/std@0.208.0/path/normalize.ts": "aa95be9a92c7bd4f9dc0ba51e942a1973e2b93d266cd74f5ca751c136d520b66", - "https://deno.land/std@0.208.0/path/normalize_glob.ts": "674baa82e1c00b6cb153bbca36e06f8e0337cb8062db6d905ab5de16076ca46b", - "https://deno.land/std@0.208.0/path/parse.ts": "d87ff0deef3fb495bc0d862278ff96da5a06acf0625ca27769fc52ac0d3d6ece", - "https://deno.land/std@0.208.0/path/posix/_util.ts": "ecf49560fedd7dd376c6156cc5565cad97c1abe9824f4417adebc7acc36c93e5", - "https://deno.land/std@0.208.0/path/posix/basename.ts": "a630aeb8fd8e27356b1823b9dedd505e30085015407caa3396332752f6b8406a", - "https://deno.land/std@0.208.0/path/posix/common.ts": "e781d395dc76f6282e3f7dd8de13194abb8b04a82d109593141abc6e95755c8b", - "https://deno.land/std@0.208.0/path/posix/dirname.ts": "f48c9c42cc670803b505478b7ef162c7cfa9d8e751b59d278b2ec59470531472", - "https://deno.land/std@0.208.0/path/posix/extname.ts": "ee7f6571a9c0a37f9218fbf510c440d1685a7c13082c348d701396cc795e0be0", - "https://deno.land/std@0.208.0/path/posix/format.ts": "b94876f77e61bfe1f147d5ccb46a920636cd3cef8be43df330f0052b03875968", - "https://deno.land/std@0.208.0/path/posix/from_file_url.ts": "b97287a83e6407ac27bdf3ab621db3fccbf1c27df0a1b1f20e1e1b5acf38a379", - "https://deno.land/std@0.208.0/path/posix/glob_to_regexp.ts": "6ed00c71fbfe0ccc35977c35444f94e82200b721905a60bd1278b1b768d68b1a", - "https://deno.land/std@0.208.0/path/posix/is_absolute.ts": "159900a3422d11069d48395568217eb7fc105ceda2683d03d9b7c0f0769e01b8", - "https://deno.land/std@0.208.0/path/posix/is_glob.ts": "ec4fbc604b9db8487f7b56ab0e759b24a971ab6a45f7b0b698bc39b8b9f9680f", - "https://deno.land/std@0.208.0/path/posix/join.ts": "0c0d84bdc344876930126640011ec1b888e6facf74153ffad9ef26813aa2a076", - "https://deno.land/std@0.208.0/path/posix/join_globs.ts": "f4838d54b1f60a34a40625a3293f6e583135348be1b2974341ac04743cb26121", - "https://deno.land/std@0.208.0/path/posix/mod.ts": "f1b08a7f64294b7de87fc37190d63b6ce5b02889af9290c9703afe01951360ae", - "https://deno.land/std@0.208.0/path/posix/normalize.ts": "11de90a94ab7148cc46e5a288f7d732aade1d616bc8c862f5560fa18ff987b4b", - "https://deno.land/std@0.208.0/path/posix/normalize_glob.ts": "10a1840c628ebbab679254d5fa1c20e59106102354fb648a1765aed72eb9f3f9", - "https://deno.land/std@0.208.0/path/posix/parse.ts": "199208f373dd93a792e9c585352bfc73a6293411bed6da6d3bc4f4ef90b04c8e", - "https://deno.land/std@0.208.0/path/posix/relative.ts": "e2f230608b0f083e6deaa06e063943e5accb3320c28aef8d87528fbb7fe6504c", - "https://deno.land/std@0.208.0/path/posix/resolve.ts": "51579d83159d5c719518c9ae50812a63959bbcb7561d79acbdb2c3682236e285", - "https://deno.land/std@0.208.0/path/posix/separator.ts": "0b6573b5f3269a3164d8edc9cefc33a02dd51003731c561008c8bb60220ebac1", - "https://deno.land/std@0.208.0/path/posix/to_file_url.ts": "08d43ea839ee75e9b8b1538376cfe95911070a655cd312bc9a00f88ef14967b6", - "https://deno.land/std@0.208.0/path/posix/to_namespaced_path.ts": "c9228a0e74fd37e76622cd7b142b8416663a9b87db643302fa0926b5a5c83bdc", - "https://deno.land/std@0.208.0/path/relative.ts": "23d45ede8b7ac464a8299663a43488aad6b561414e7cbbe4790775590db6349c", - "https://deno.land/std@0.208.0/path/resolve.ts": "5b184efc87155a0af9fa305ff68a109e28de9aee81fc3e77cd01380f19daf867", - "https://deno.land/std@0.208.0/path/separator.ts": "40a3e9a4ad10bef23bc2cd6c610291b6c502a06237c2c4cd034a15ca78dedc1f", - "https://deno.land/std@0.208.0/path/to_file_url.ts": "edaafa089e0bce386e1b2d47afe7c72e379ff93b28a5829a5885e4b6c626d864", - "https://deno.land/std@0.208.0/path/to_namespaced_path.ts": "cf8734848aac3c7527d1689d2adf82132b1618eff3cc523a775068847416b22a", - "https://deno.land/std@0.208.0/path/windows/_util.ts": "f32b9444554c8863b9b4814025c700492a2b57ff2369d015360970a1b1099d54", - "https://deno.land/std@0.208.0/path/windows/basename.ts": "8a9dbf7353d50afbc5b221af36c02a72c2d1b2b5b9f7c65bf6a5a2a0baf88ad3", - "https://deno.land/std@0.208.0/path/windows/common.ts": "e781d395dc76f6282e3f7dd8de13194abb8b04a82d109593141abc6e95755c8b", - "https://deno.land/std@0.208.0/path/windows/dirname.ts": "5c2aa541384bf0bd9aca821275d2a8690e8238fa846198ef5c7515ce31a01a94", - "https://deno.land/std@0.208.0/path/windows/extname.ts": "07f4fa1b40d06a827446b3e3bcc8d619c5546b079b8ed0c77040bbef716c7614", - "https://deno.land/std@0.208.0/path/windows/format.ts": "343019130d78f172a5c49fdc7e64686a7faf41553268961e7b6c92a6d6548edf", - "https://deno.land/std@0.208.0/path/windows/from_file_url.ts": "d53335c12b0725893d768be3ac6bf0112cc5b639d2deb0171b35988493b46199", - "https://deno.land/std@0.208.0/path/windows/glob_to_regexp.ts": "290755e18ec6c1a4f4d711c3390537358e8e3179581e66261a0cf348b1a13395", - "https://deno.land/std@0.208.0/path/windows/is_absolute.ts": "245b56b5f355ede8664bd7f080c910a97e2169972d23075554ae14d73722c53c", - "https://deno.land/std@0.208.0/path/windows/is_glob.ts": "ec4fbc604b9db8487f7b56ab0e759b24a971ab6a45f7b0b698bc39b8b9f9680f", - "https://deno.land/std@0.208.0/path/windows/join.ts": "e6600bf88edeeef4e2276e155b8de1d5dec0435fd526ba2dc4d37986b2882f16", - "https://deno.land/std@0.208.0/path/windows/join_globs.ts": "f4838d54b1f60a34a40625a3293f6e583135348be1b2974341ac04743cb26121", - "https://deno.land/std@0.208.0/path/windows/mod.ts": "d7040f461465c2c21c1c68fc988ef0bdddd499912138cde3abf6ad60c7fb3814", - "https://deno.land/std@0.208.0/path/windows/normalize.ts": "9deebbf40c81ef540b7b945d4ccd7a6a2c5a5992f791e6d3377043031e164e69", - "https://deno.land/std@0.208.0/path/windows/normalize_glob.ts": "344ff5ed45430495b9a3d695567291e50e00b1b3b04ea56712a2acf07ab5c128", - "https://deno.land/std@0.208.0/path/windows/parse.ts": "120faf778fe1f22056f33ded069b68e12447668fcfa19540c0129561428d3ae5", - "https://deno.land/std@0.208.0/path/windows/relative.ts": "026855cd2c36c8f28f1df3c6fbd8f2449a2aa21f48797a74700c5d872b86d649", - "https://deno.land/std@0.208.0/path/windows/resolve.ts": "5ff441ab18a2346abadf778121128ee71bda4d0898513d4639a6ca04edca366b", - "https://deno.land/std@0.208.0/path/windows/separator.ts": "ae21f27015f10510ed1ac4a0ba9c4c9c967cbdd9d9e776a3e4967553c397bd5d", - "https://deno.land/std@0.208.0/path/windows/to_file_url.ts": "8e9ea9e1ff364aa06fa72999204229952d0a279dbb876b7b838b2b2fea55cce3", - "https://deno.land/std@0.208.0/path/windows/to_namespaced_path.ts": "e0f4d4a5e77f28a5708c1a33ff24360f35637ba6d8f103d19661255ef7bfd50d" - }, - "workspace": { - "dependencies": [ - "npm:@rescript/core@^1.6.0", - "npm:@rescript/react@0.12", - "npm:react-dom@^18.3.0", - "npm:react@^18.3.0", - "npm:rescript@^12.1.0" - ], - "packageJson": { - "dependencies": [ - "npm:@rescript/core@^1.6.0", - "npm:@rescript/react@0.12", - "npm:react-dom@^18.3.0", - "npm:react@^18.3.0", - "npm:rescript@^12.1.0" - ] - } - } -} diff --git a/avow-protocol/deploy-cloudflare.sh b/avow-protocol/deploy-cloudflare.sh deleted file mode 100755 index fae22144..00000000 --- a/avow-protocol/deploy-cloudflare.sh +++ /dev/null @@ -1,223 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -# -# Automated Cloudflare deployment script for AVOW Protocol - -set -euo pipefail - -# Colors for output -RED='\033[0;31m' -GREEN='\033[0;32m' -YELLOW='\033[1;33m' -BLUE='\033[0;34m' -NC='\033[0m' # No Color - -# Configuration -PROJECT_NAME="avow-protocol" -DOMAIN="avow-protocol.org" -BUILD_COMMAND="deno task build" -OUTPUT_DIR="." - -# Functions -log_info() { - echo -e "${BLUE}[INFO]${NC} $1" -} - -log_success() { - echo -e "${GREEN}[SUCCESS]${NC} $1" -} - -log_warning() { - echo -e "${YELLOW}[WARNING]${NC} $1" -} - -log_error() { - echo -e "${RED}[ERROR]${NC} $1" -} - -check_prerequisites() { - log_info "Checking prerequisites..." - - # Check for wrangler - if ! command -v wrangler &> /dev/null; then - log_error "wrangler CLI not found. Installing..." - npm install -g wrangler - fi - - # Check for deno - if ! command -v deno &> /dev/null; then - log_error "Deno not found. Please install Deno first." - exit 1 - fi - - log_success "All prerequisites satisfied" -} - -check_authentication() { - log_info "Checking Cloudflare authentication..." - - if [ -n "${CLOUDFLARE_API_TOKEN:-}" ]; then - log_success "Using CLOUDFLARE_API_TOKEN environment variable" - return 0 - fi - - if [ -n "${CLOUDFLARE_ACCOUNT_ID:-}" ]; then - log_success "Using CLOUDFLARE_ACCOUNT_ID environment variable" - return 0 - fi - - log_warning "No Cloudflare credentials found in environment" - log_info "Running wrangler login..." - wrangler login -} - -build_project() { - log_info "Building project..." - - # Clean previous build - if [ -d "lib" ]; then - rm -rf lib - fi - - # Build ReScript - if ! $BUILD_COMMAND; then - log_error "Build failed" - exit 1 - fi - - log_success "Build completed" -} - -create_pages_project() { - log_info "Creating Cloudflare Pages project..." - - # Check if project exists - if wrangler pages project list 2>/dev/null | grep -q "$PROJECT_NAME"; then - log_warning "Project '$PROJECT_NAME' already exists, skipping creation" - else - if wrangler pages project create "$PROJECT_NAME" --production-branch=main; then - log_success "Project created" - else - log_error "Failed to create project" - exit 1 - fi - fi -} - -deploy_to_pages() { - log_info "Deploying to Cloudflare Pages..." - - if wrangler pages deploy "$OUTPUT_DIR" \ - --project-name="$PROJECT_NAME" \ - --branch=main \ - --commit-dirty=true; then - log_success "Deployment successful!" - else - log_error "Deployment failed" - exit 1 - fi -} - -configure_custom_domain() { - log_info "Configuring custom domain..." - - log_warning "Custom domain setup requires manual configuration in Cloudflare Dashboard:" - echo " 1. Go to Pages → $PROJECT_NAME → Custom domains" - echo " 2. Add domain: $DOMAIN" - echo " 3. Add domain: www.$DOMAIN" - echo " 4. Wait for DNS propagation" -} - -configure_dns() { - log_info "DNS configuration steps:" - - cat <&1 | grep -E "✨|Deployment complete|View your site" - - if [ ${PIPESTATUS[0]} -eq 0 ]; then - echo " ✅ Deployed successfully" - else - echo " ⚠️ Deployment completed (check output)" - fi -done - -echo "" -echo "═══════════════════════════════════════════════════════════════════" -echo "✅ Deployment batch complete!" -echo "" -echo "📋 Next: Check deployment status at https://dash.cloudflare.com/pages" -echo "═══════════════════════════════════════════════════════════════════" diff --git a/avow-protocol/docs/CITATIONS.adoc b/avow-protocol/docs/CITATIONS.adoc deleted file mode 100644 index 6f167bdf..00000000 --- a/avow-protocol/docs/CITATIONS.adoc +++ /dev/null @@ -1,36 +0,0 @@ -= RSR-template-repo - Citation Guide -:toc: - -== BibTeX - -[source,bibtex] ----- -@software{rsr-template-repo_2025, - author = {Polymath, Hyper}, - title = {RSR-template-repo}, - year = {2025}, - url = {https://github.com/hyperpolymath/RSR-template-repo}, - license = {PMPL-1.0-or-later} -} ----- - -== Harvard Style - -Polymath, H. (2025) _RSR-template-repo_ [Computer software]. Available at: https://github.com/hyperpolymath/RSR-template-repo - -== OSCOLA - -Hyper Polymath, 'RSR-template-repo' (2025) - -== MLA - -Polymath, Hyper. "RSR-template-repo." 2025, github.com/hyperpolymath/RSR-template-repo. - -== APA 7 - -Polymath, H. (2025). _RSR-template-repo_ [Computer software]. GitHub. https://github.com/hyperpolymath/RSR-template-repo - -== See Also - -* link:../CITATION.cff[CITATION.cff] -* link:../codemeta.json[codemeta.json] diff --git a/avow-protocol/docs/PROTOCOL-OUTLINE.md b/avow-protocol/docs/PROTOCOL-OUTLINE.md deleted file mode 100644 index d324e7ad..00000000 --- a/avow-protocol/docs/PROTOCOL-OUTLINE.md +++ /dev/null @@ -1,52 +0,0 @@ -# STAMP Protocol Specification Outline - -## 1. Overview -- Scope and goals -- Non-goals -- Terminology - -## 2. Actors and Roles -- Sender -- Subscriber -- Platform -- Auditor - -## 3. Consent Model -- Consent event types -- Consent chain invariants -- Revocation and expiry - -## 4. Proof Artifacts -- Proof envelope structure (draft) -- Signature requirements -- Replay and tamper resistance - -## 5. Unsubscribe Requirements -- URL validation requirements -- Response requirements -- Failure handling - -## 6. Rate Limits -- Policy inputs -- Enforcement rules -- Auditable evidence - -## 7. Interoperability -- Canonical JSON schemas -- Transport considerations -- Versioning - -## 8. Security Considerations -- Threat model (draft) -- Abuse scenarios -- Privacy constraints - -## 9. Test Vectors (Planned) -- Valid/invalid consent chains -- Valid/invalid unsubscribe links -- Rate-limit edge cases - -## 10. Implementation Notes -- Build-time validation -- Runtime enforcement hooks -- Suggested library APIs diff --git a/avow-protocol/docs/PROTOCOL.md b/avow-protocol/docs/PROTOCOL.md deleted file mode 100644 index 69fcef81..00000000 --- a/avow-protocol/docs/PROTOCOL.md +++ /dev/null @@ -1,107 +0,0 @@ -# AVOW Protocol (Draft) - -AVOW (Authenticated Verifiable Open Web) Protocol is a protocol design for verifiable consent and compliant messaging. - -This repository is the **demo site** and reference implementation for key concepts. The protocol definition is a living draft and is intentionally short until the core invariants are finalized. - -## 1. Overview - -AVOW aims to make consent, unsubscribe, and rate‑limit compliance **verifiable** instead of implied. It focuses on evidence that a platform enforced policy, without exposing private subscriber data. - -### Goals - -- Make consent state **verifiable**, not just asserted. -- Ensure unsubscribe links are **valid and testable** before send. -- Enforce rate limits at the protocol boundary. -- Provide auditability without exposing private subscriber data. - -### Non‑Goals - -- Replacing full CRM/marketing platforms. -- Defining a transport‑layer messaging protocol. -- Handling subscriber identity verification (out of scope for v1). - -## 2. Actors and Roles - -- **Sender**: The entity initiating a message. -- **Subscriber**: The recipient whose consent is tracked. -- **Platform**: The system enforcing consent, unsubscribe, and rate‑limit rules. -- **Auditor**: A party verifying evidence of compliance. - -## 3. Consent Model - -### Consent Event Types (Draft) - -- `request` -- `confirm` -- `revoke` -- `expire` - -### Consent Chain Invariants - -- Confirmation must occur **after** request. -- Revocation must occur **after** confirmation. -- Expiry must occur **after** confirmation. - -## 4. Proof Artifacts - -### Proof Envelope (Draft) - -- `event_id` -- `event_type` -- `timestamp` -- `subject` -- `policy_version` -- `signature` - -### Signature Requirements - -- Proofs should be signed by the platform. -- Signatures must be verifiable without private subscriber data. - -## 5. Unsubscribe Requirements - -- URLs must parse cleanly. -- HTTPS is required for unsubscribe links. -- A failed unsubscribe request must be recorded as an event. - -## 6. Rate Limits - -- Rate limits are policy‑defined per sender class. -- Enforcement should produce an auditable decision record. - -## 7. Interoperability - -- Canonical JSON schemas for events and proofs (planned). -- Versioned policy documents. -- Clear downgrade paths for older clients. - -## 8. Security Considerations - -- Tamper‑evident proof storage. -- Replay protection for consent events. -- Privacy constraints on stored evidence. - -## 9. Test Vectors (Planned) - -- Valid/invalid consent chains. -- Valid/invalid unsubscribe links. -- Rate‑limit edge cases. - -## 10. Implementation Notes - -- Build‑time validation for links. -- Runtime enforcement hooks for consent and rate limits. -- Suggested library APIs for proof verification. - -## What Is Verifiable Today - -- URL validation is backed by the `proven` library and can be enforced at build time. -- The demo site uses build‑time proof data for URL checks and a fixed consent proof example. - -## What Is Still In Draft - -- Cryptographic proof format and signature flow. -- Canonical consent event schema. -- Protocol interoperability requirements. -- Threat model and formal verification plan for non‑URL components. diff --git a/avow-protocol/docs/RELEASE-NOTES-v1.0.4.adoc b/avow-protocol/docs/RELEASE-NOTES-v1.0.4.adoc deleted file mode 100644 index 9f6b8a9d..00000000 --- a/avow-protocol/docs/RELEASE-NOTES-v1.0.4.adoc +++ /dev/null @@ -1,27 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= STAMP Protocol v1.0.4 (Summary) -:toc: - -== Summary - -This release consolidates the v1.x cleanup and protocol-first reset: - -* Renamed and aligned the repo as `stamp-protocol`. -* Reframed the site to match the protocol draft (no overclaims). -* Added a protocol draft + spec outline. -* Switched demo checks to deterministic, build-time proof data. -* Added consent proof vectors and source labeling in the demo. -* Cleaned Deno config and build warnings. - -== Highlights - -* `docs/PROTOCOL.md` - Expanded protocol draft. -* `docs/PROTOCOL-OUTLINE.md` - Spec structure for full v1. -* `scripts/generate_proof.ts` - Build-time proof data generator. -* `public/proof-data.json` - Deterministic proof vectors. -* `public/demo.js` - Demo now shows proof source (build-time vs runtime). - -== Notes - -This is a demo-first site with protocol-first messaging. Full cryptographic -proofs remain in draft and are tracked in the protocol docs. diff --git a/avow-protocol/examples/web-project-deno.json b/avow-protocol/examples/web-project-deno.json deleted file mode 100644 index 5ddd3bd7..00000000 --- a/avow-protocol/examples/web-project-deno.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "// NOTE": "Example deno.json for ReScript web projects", - "tasks": { - "build": "deno run -A npm:rescript", - "clean": "deno run -A npm:rescript clean", - "watch": "deno run -A npm:rescript -w", - "serve": "deno run -A jsr:@std/http/file-server .", - "test": "deno test --allow-all" - }, - "imports": { - "rescript": "^12.0.0", - "@rescript/core": "npm:@rescript/core@^1.6.0", - "safe-dom/": "https://raw.githubusercontent.com/hyperpolymath/rescript-dom-mounter/main/src/", - "proven/": "../proven/bindings/rescript/src/" - }, - "compilerOptions": { - "allowJs": true, - "checkJs": false - } -} diff --git a/avow-protocol/favicon.svg b/avow-protocol/favicon.svg deleted file mode 100644 index bf6bd3fe..00000000 --- a/avow-protocol/favicon.svg +++ /dev/null @@ -1,19 +0,0 @@ - - - - - - - - - - - - - - diff --git a/avow-protocol/ffi/zig/build.zig b/avow-protocol/ffi/zig/build.zig deleted file mode 100644 index 4a2e049a..00000000 --- a/avow-protocol/ffi/zig/build.zig +++ /dev/null @@ -1,94 +0,0 @@ -// {{PROJECT}} FFI Build Configuration -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -pub fn build(b: *std.Build) void { - const target = b.standardTargetOptions(.{}); - const optimize = b.standardOptimizeOption(.{}); - - // Shared library (.so, .dylib, .dll) - const lib = b.addSharedLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Set version - lib.version = .{ .major = 0, .minor = 1, .patch = 0 }; - - // Static library (.a) - const lib_static = b.addStaticLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Install artifacts - b.installArtifact(lib); - b.installArtifact(lib_static); - - // Generate header file for C compatibility - const header = b.addInstallHeader( - b.path("include/{{project}}.h"), - "{{project}}.h", - ); - b.getInstallStep().dependOn(&header.step); - - // Unit tests - const lib_tests = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - const run_lib_tests = b.addRunArtifact(lib_tests); - - const test_step = b.step("test", "Run library tests"); - test_step.dependOn(&run_lib_tests.step); - - // Integration tests - const integration_tests = b.addTest(.{ - .root_source_file = b.path("test/integration_test.zig"), - .target = target, - .optimize = optimize, - }); - - integration_tests.linkLibrary(lib); - - const run_integration_tests = b.addRunArtifact(integration_tests); - - const integration_test_step = b.step("test-integration", "Run integration tests"); - integration_test_step.dependOn(&run_integration_tests.step); - - // Documentation - const docs = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = .Debug, - }); - - const docs_step = b.step("docs", "Generate documentation"); - docs_step.dependOn(&b.addInstallDirectory(.{ - .source_dir = docs.getEmittedDocs(), - .install_dir = .prefix, - .install_subdir = "docs", - }).step); - - // Benchmark (if needed) - const bench = b.addExecutable(.{ - .name = "{{project}}-bench", - .root_source_file = b.path("bench/bench.zig"), - .target = target, - .optimize = .ReleaseFast, - }); - - bench.linkLibrary(lib); - - const run_bench = b.addRunArtifact(bench); - - const bench_step = b.step("bench", "Run benchmarks"); - bench_step.dependOn(&run_bench.step); -} diff --git a/avow-protocol/ffi/zig/src/main.zig b/avow-protocol/ffi/zig/src/main.zig deleted file mode 100644 index 6b233bc7..00000000 --- a/avow-protocol/ffi/zig/src/main.zig +++ /dev/null @@ -1,274 +0,0 @@ -// {{PROJECT}} FFI Implementation -// -// This module implements the C-compatible FFI declared in src/abi/Foreign.idr -// All types and layouts must match the Idris2 ABI definitions. -// -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -// Version information (keep in sync with project) -const VERSION = "0.1.0"; -const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string; - -/// Thread-local error storage -threadlocal var last_error: ?[]const u8 = null; - -/// Set the last error message -fn setError(msg: []const u8) void { - last_error = msg; -} - -/// Clear the last error -fn clearError() void { - last_error = null; -} - -//============================================================================== -// Core Types (must match src/abi/Types.idr) -//============================================================================== - -/// Result codes (must match Idris2 Result type) -pub const Result = enum(c_int) { - ok = 0, - @"error" = 1, - invalid_param = 2, - out_of_memory = 3, - null_pointer = 4, -}; - -/// Library handle (opaque to prevent direct access) -pub const Handle = opaque { - // Internal state hidden from C - allocator: std.mem.Allocator, - initialized: bool, - // Add your fields here -}; - -//============================================================================== -// Library Lifecycle -//============================================================================== - -/// Initialize the library -/// Returns a handle, or null on failure -export fn {{project}}_init() ?*Handle { - const allocator = std.heap.c_allocator; - - const handle = allocator.create(Handle) catch { - setError("Failed to allocate handle"); - return null; - }; - - // Initialize handle - handle.* = .{ - .allocator = allocator, - .initialized = true, - }; - - clearError(); - return handle; -} - -/// Free the library handle -export fn {{project}}_free(handle: ?*Handle) void { - const h = handle orelse return; - const allocator = h.allocator; - - // Clean up resources - h.initialized = false; - - allocator.destroy(h); - clearError(); -} - -//============================================================================== -// Core Operations -//============================================================================== - -/// Process data (example operation) -export fn {{project}}_process(handle: ?*Handle, input: u32) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Example processing logic - _ = input; - - clearError(); - return .ok; -} - -//============================================================================== -// String Operations -//============================================================================== - -/// Get a string result (example) -/// Caller must free the returned string -export fn {{project}}_get_string(handle: ?*Handle) ?[*:0]const u8 { - const h = handle orelse { - setError("Null handle"); - return null; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return null; - } - - // Example: allocate and return a string - const result = h.allocator.dupeZ(u8, "Example result") catch { - setError("Failed to allocate string"); - return null; - }; - - clearError(); - return result.ptr; -} - -/// Free a string allocated by the library -export fn {{project}}_free_string(str: ?[*:0]const u8) void { - const s = str orelse return; - const allocator = std.heap.c_allocator; - - const slice = std.mem.span(s); - allocator.free(slice); -} - -//============================================================================== -// Array/Buffer Operations -//============================================================================== - -/// Process an array of data -export fn {{project}}_process_array( - handle: ?*Handle, - buffer: ?[*]const u8, - len: u32, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const buf = buffer orelse { - setError("Null buffer"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Access the buffer - const data = buf[0..len]; - _ = data; - - // Process data here - - clearError(); - return .ok; -} - -//============================================================================== -// Error Handling -//============================================================================== - -/// Get the last error message -/// Returns null if no error -export fn {{project}}_last_error() ?[*:0]const u8 { - const err = last_error orelse return null; - - // Return C string (static storage, no need to free) - const allocator = std.heap.c_allocator; - const c_str = allocator.dupeZ(u8, err) catch return null; - return c_str.ptr; -} - -//============================================================================== -// Version Information -//============================================================================== - -/// Get the library version -export fn {{project}}_version() [*:0]const u8 { - return VERSION.ptr; -} - -/// Get build information -export fn {{project}}_build_info() [*:0]const u8 { - return BUILD_INFO.ptr; -} - -//============================================================================== -// Callback Support -//============================================================================== - -/// Callback function type (C ABI) -pub const Callback = *const fn (u64, u32) callconv(.C) u32; - -/// Register a callback -export fn {{project}}_register_callback( - handle: ?*Handle, - callback: ?Callback, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const cb = callback orelse { - setError("Null callback"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Store callback for later use - _ = cb; - - clearError(); - return .ok; -} - -//============================================================================== -// Utility Functions -//============================================================================== - -/// Check if handle is initialized -export fn {{project}}_is_initialized(handle: ?*Handle) u32 { - const h = handle orelse return 0; - return if (h.initialized) 1 else 0; -} - -//============================================================================== -// Tests -//============================================================================== - -test "lifecycle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try std.testing.expect({{project}}_is_initialized(handle) == 1); -} - -test "error handling" { - const result = {{project}}_process(null, 0); - try std.testing.expectEqual(Result.null_pointer, result); - - const err = {{project}}_last_error(); - try std.testing.expect(err != null); -} - -test "version" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - try std.testing.expectEqualStrings(VERSION, ver_str); -} diff --git a/avow-protocol/ffi/zig/test/integration_test.zig b/avow-protocol/ffi/zig/test/integration_test.zig deleted file mode 100644 index 03419949..00000000 --- a/avow-protocol/ffi/zig/test/integration_test.zig +++ /dev/null @@ -1,182 +0,0 @@ -// {{PROJECT}} Integration Tests -// SPDX-License-Identifier: MPL-2.0 -// -// These tests verify that the Zig FFI correctly implements the Idris2 ABI - -const std = @import("std"); -const testing = std.testing; - -// Import FFI functions -extern fn {{project}}_init() ?*opaque {}; -extern fn {{project}}_free(?*opaque {}) void; -extern fn {{project}}_process(?*opaque {}, u32) c_int; -extern fn {{project}}_get_string(?*opaque {}) ?[*:0]const u8; -extern fn {{project}}_free_string(?[*:0]const u8) void; -extern fn {{project}}_last_error() ?[*:0]const u8; -extern fn {{project}}_version() [*:0]const u8; -extern fn {{project}}_is_initialized(?*opaque {}) u32; - -//============================================================================== -// Lifecycle Tests -//============================================================================== - -test "create and destroy handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try testing.expect(handle != null); -} - -test "handle is initialized" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const initialized = {{project}}_is_initialized(handle); - try testing.expectEqual(@as(u32, 1), initialized); -} - -test "null handle is not initialized" { - const initialized = {{project}}_is_initialized(null); - try testing.expectEqual(@as(u32, 0), initialized); -} - -//============================================================================== -// Operation Tests -//============================================================================== - -test "process with valid handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const result = {{project}}_process(handle, 42); - try testing.expectEqual(@as(c_int, 0), result); // 0 = ok -} - -test "process with null handle returns error" { - const result = {{project}}_process(null, 42); - try testing.expectEqual(@as(c_int, 4), result); // 4 = null_pointer -} - -//============================================================================== -// String Tests -//============================================================================== - -test "get string result" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const str = {{project}}_get_string(handle); - defer if (str) |s| {{project}}_free_string(s); - - try testing.expect(str != null); -} - -test "get string with null handle" { - const str = {{project}}_get_string(null); - try testing.expect(str == null); -} - -//============================================================================== -// Error Handling Tests -//============================================================================== - -test "last error after null handle operation" { - _ = {{project}}_process(null, 0); - - const err = {{project}}_last_error(); - try testing.expect(err != null); - - if (err) |e| { - const err_str = std.mem.span(e); - try testing.expect(err_str.len > 0); - } -} - -test "no error after successful operation" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - _ = {{project}}_process(handle, 0); - - // Error should be cleared after successful operation - // (This depends on implementation) -} - -//============================================================================== -// Version Tests -//============================================================================== - -test "version string is not empty" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - try testing.expect(ver_str.len > 0); -} - -test "version string is semantic version format" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - // Should be in format X.Y.Z - try testing.expect(std.mem.count(u8, ver_str, ".") >= 1); -} - -//============================================================================== -// Memory Safety Tests -//============================================================================== - -test "multiple handles are independent" { - const h1 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h1); - - const h2 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h2); - - try testing.expect(h1 != h2); - - // Operations on h1 should not affect h2 - _ = {{project}}_process(h1, 1); - _ = {{project}}_process(h2, 2); -} - -test "double free is safe" { - const handle = {{project}}_init() orelse return error.InitFailed; - - {{project}}_free(handle); - {{project}}_free(handle); // Should not crash -} - -test "free null is safe" { - {{project}}_free(null); // Should not crash -} - -//============================================================================== -// Thread Safety Tests (if applicable) -//============================================================================== - -test "concurrent operations" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const ThreadContext = struct { - h: *opaque {}, - id: u32, - }; - - const thread_fn = struct { - fn run(ctx: ThreadContext) void { - _ = {{project}}_process(ctx.h, ctx.id); - } - }.run; - - var threads: [4]std.Thread = undefined; - for (&threads, 0..) |*thread, i| { - thread.* = try std.Thread.spawn(.{}, thread_fn, .{ - ThreadContext{ .h = handle, .id = @intCast(i) }, - }); - } - - for (threads) |thread| { - thread.join(); - } -} diff --git a/avow-protocol/index.html b/avow-protocol/index.html deleted file mode 100644 index b8a5107e..00000000 --- a/avow-protocol/index.html +++ /dev/null @@ -1,257 +0,0 @@ - - - - - - AVOW Protocol — Proven Consent, Unsubscribe, and Rate Limits - - - - - - - - - - - - - - - - - - - - - - - -
-
-

AVOW Protocol

-

Authenticated Verifiable Open Web Protocol

-

A protocol design that aims to make consent, unsubscribe, and rate-limit compliance verifiable.

- -
- - Try Live Demo on Telegram → - - - Learn How It Works - -
-

Read the protocol draft →

-
-
- - -
-
-

The Problem

-
-
-

📧 Email Spam

-

Unsubscribe links often don't work. No proof consent was given.

-

$200M+ market

-
-
-

🤖 Social Media Bots

-

Fake profiles, astroturfing, election interference. Current solutions don't scale.

-

$1.2B+ market

-
-
-

💸 Platform Costs

-

Companies spend $100M+/year fighting spam and bots. Still losing.

-

Bots remain a persistent problem

-
-
-
-
- - -
-
-

The AVOW Solution

-

Use dependent types (Idris2) to make message properties verifiable at compile-time.

- -
-
-
✓
-

Proven Consent

-

Cryptographically provable consent chains. Can't fake timestamps or skip verification.

- proof : confirmation > initial_request -
- -
-
✓
-

Working Unsubscribe

-

Unsubscribe links validated before sending to avoid broken links.

- proof : response.code = OK ∧ response.time < 200ms -
- -
-
✓
-

Rate Limiting

-

Protocol-level rate limits based on account age. Cannot be bypassed.

- proof : messages_today < daily_limit -
-
-
-
- - -
-
-

How It Works

- -
-
-

❌ Without Dependent Types

- 
struct UnsubscribeLink {
-    url: String,
-    tested: bool,  // Can lie
-}
-

No guarantees. Developers can lie about testing.

-
- -
-

✅ With AVOW (Idris2)

- 
record UnsubscribeLink where
-    url : URL
-    tested_at : Timestamp
-    response : HTTPResponse
-    {auto proof : response.code = OK}
-    {auto proof : response.time < 200ms}
-

Designed to be verifiable. The protocol aims to reject invalid links before send.

-
-
-
-
- - -
-
-

Try It Now

- - -
-

🔬 Live Verification Demo

-

Test AVOW verification right in your browser (build-time proofs + demo rules):

- -
-
-

Test Unsubscribe Link

- - -
- -
-

Test Consent Chain

-

Verify that confirmation happened AFTER initial request (time-ordering proof)

- -
-
- -
-

👆 Click a button above to see verification in action

-
-

Note: URL checks use build-time proofs from proven. Consent checks are demo rules.

-
- - -
-

📱 Telegram Bot Demo

-

See AVOW in action with our live Telegram bot:

-
    -
  1. Open Telegram and search for @avow_demo_bot
    2. -
  2. Send /start to subscribe
    3. -
  3. See consent flow steps in action
    4. -
  4. Send /verify to see full verification
    5. -
  5. Send /unsubscribe to test the demo flow
    6. -
- - Open @avow_demo_bot → - -
-
-
- - -
-
-

Use Cases

-
-
-

Email Marketing

-

Design for compliance with CAN-SPAM, GDPR. Verified unsubscribe links.

-
-
-

Dating Apps

-

Reduce fake profiles with verified identity chains.

-
-
-

Social Media

-

Combat astroturfing and election interference with verified accounts.

-
-
-

Business Messaging

-

RCS, SMS marketing with verifiable compliance.

-
-
-
-
- - -
-
-

Impact

-
-
-
—
-
Bot Reduction (TBD)
-
-
-
—
-
Platform Savings (TBD)
-
-
-
—
-
Compliance Proof (TBD)
-
-
-
-
- - -
-
-

Ready to Prove Compliance?

-

Contact us to integrate AVOW into your platform.

-
- GitHub - Demo Bot - Contact -
-

© 2026 Jonathan D.A. Jewell. Licensed under PMPL-1.0-or-later.

-
-
- - -
- - - - - - diff --git a/avow-protocol/package.json b/avow-protocol/package.json deleted file mode 100644 index 244d99c7..00000000 --- a/avow-protocol/package.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "name": "avow-protocol", - "version": "1.0.0", - "description": "AVOW Protocol - Authenticated Verifiable Open Web Communication", - "author": "Jonathan D.A. Jewell ", - "license": "AGPL-3.0-or-later", - "type": "module", - "scripts": { - "build": "deno task build", - "clean": "deno task clean", - "watch": "deno task watch" - }, - "dependencies": { - "rescript": "^12.0.0", - "@rescript/core": "^1.6.0", - "@rescript/react": "^0.12.0", - "react": "^18.3.0", - "react-dom": "^18.3.0" - }, - "devDependencies": {} -} diff --git a/avow-protocol/public/about.html b/avow-protocol/public/about.html deleted file mode 100644 index 08044806..00000000 --- a/avow-protocol/public/about.html +++ /dev/null @@ -1,33 +0,0 @@ -
  • --
-

title: About STAMP Protocol description: Understanding the Subscriber Tracking with Attribution and Mathematically Proven consent protocol author: Jonathan D.A. Jewell date: 2026-01-30

-
  • --
-

About STAMP Protocol

-

STAMP stands for Subscriber Tracking with Attribution and Mathematically Proven consent.

-

The Problem

-

Email marketing systems often fail to provide:

-
  • Verifiable consent - Subscribers can't prove they consented
  • Unbreakable unsubscribe - Links can break or be malicious
  • Transparent tracking - Users don't know what's being tracked
  • Cryptographic proof - No mathematical guarantees of consent state
-

The Solution

-

STAMP provides a formally verified consent management system:

-

Key Features

-

1. Proven URL Validation

-
  • Uses `ProvenSafeUrl` from the proven library
  • Mathematical guarantee URLs are well-formed
  • No null pointer crashes possible
  • Compile-time verification via Idris2
-

2. Cryptographic Consent Proofs

-
  • Every consent action generates a proof
  • Timestamped and cryptographically signed
  • Subscriber can verify their consent state
  • Marketer can prove compliance
-

3. Unbreakable Unsubscribe

-
  • Links validated before generation
  • No malformed URLs possible
  • Always HTTPS (proven at type level)
  • Rate-limiting and abuse protection
-

4. Full Transparency

-
  • Subscribers see all tracked data
  • Consent history available on-demand
  • Deletion requests cryptographically logged
  • GDPR/CCPA compliance by design
-

Architecture

-

STAMP uses The Elm Architecture (TEA) for predictable state management:

-

``` User Action → Message → Update → New Model → View ```

-

All state transitions are pure functions with no side effects.

-

Formal Verification

-

The core URL validation is formally verified using Idris2 dependent types:

-
  • No runtime URL parsing errors - Proven impossible
  • Balanced HTML tags - Checked at compile time
  • Memory safety - No buffer overflows possible
  • Type safety - Guaranteed correct operations
-

See the proven library for details.

-

Try It Out

-

1. Visit the interactive demo 2. See URL validation in action 3. Explore the consent flow 4. View cryptographic proofs

-

Learn More

- -
  • --
-

STAMP Protocol - Consent you can prove.

\ No newline at end of file diff --git a/avow-protocol/public/demo.js b/avow-protocol/public/demo.js deleted file mode 100644 index e30a6601..00000000 --- a/avow-protocol/public/demo.js +++ /dev/null @@ -1,167 +0,0 @@ -let proofData = null; - -async function loadProofData() { - try { - const res = await fetch("public/proof-data.json"); - if (!res.ok) { - return null; - } - return await res.json(); - } catch (_err) { - return null; - } -} - -function resultToString(result) { - switch (result) { - case "Success": - return "✓ Verified"; - case "ErrorInvalidUrl": - return "✗ Invalid URL"; - case "ErrorNotHttps": - return "✗ Not HTTPS"; - case "ErrorInvalidConsent": - return "✗ Invalid Consent"; - default: - return "✗ Verification Failed"; - } -} - -function resultToClass(result) { - return result === "Success" ? "success" : "error"; -} - -function lookupProof(url) { - if (!proofData || !proofData.urls) { - return null; - } - return proofData.urls.find((entry) => entry.input === url) || null; -} - -function lookupConsentProof() { - if (!proofData || !proofData.consent || proofData.consent.length === 0) { - return null; - } - return proofData.consent[0]; -} - -function verifyUnsubscribeLink(url) { - const proof = lookupProof(url); - if (proof) { - if (!proof.parse_ok) { - return { result: "ErrorInvalidUrl", source: "proven (build-time)" }; - } - if (!proof.https) { - return { result: "ErrorNotHttps", source: "proven (build-time)" }; - } - return { result: "Success", source: "proven (build-time)" }; - } - - try { - const parsed = new URL(url); - if (parsed.protocol !== "https:") { - return { result: "ErrorNotHttps", source: "runtime" }; - } - return { result: "Success", source: "runtime" }; - } catch (_err) { - return { result: "ErrorInvalidUrl", source: "runtime" }; - } -} - -function verifyConsentChain(consent) { - if (consent.confirmation <= consent.initialRequest || consent.token.length < 10) { - return "ErrorInvalidConsent"; - } - return "Success"; -} - -function testUnsubscribeLink(url) { - const outputEl = document.getElementById("demo-output"); - outputEl.innerHTML = "
🔍 Validating link structure...
"; - setTimeout(() => { - const now = Date.now(); - const verification = verifyUnsubscribeLink(url); - const resultClass = resultToClass(verification.result); - const resultText = resultToString(verification.result); - const html = ` -
-

${resultText}

-
-

URL: ${url}

-

Checked At: ${new Date(now).toISOString()}

-

Check: URL parses and is HTTPS

-

Source: ${verification.source}

-
-
- `; - outputEl.innerHTML = html; - }, 300); -} - -function testConsentChain() { - const outputEl = document.getElementById("demo-output"); - outputEl.innerHTML = "
🔍 Verifying consent ordering...
"; - setTimeout(() => { - const proof = lookupConsentProof(); - if (proof) { - const result = proof.valid ? "Success" : "ErrorInvalidConsent"; - const resultClass = resultToClass(result); - const resultText = resultToString(result); - const html = ` -
-

${resultText}

-
-

Initial Request: ${proof.initial_request}

-

Confirmation: ${proof.confirmation}

-

Token: ${proof.token}

-

Check: confirmation > initialRequest

-

Source: proven (build-time)

-
-
- `; - outputEl.innerHTML = html; - return; - } - - const now = Date.now(); - const initialRequest = now - 5000; - const consent = { - initialRequest, - confirmation: now, - token: "user_123_consent_token_abc", - }; - const result = verifyConsentChain(consent); - const resultClass = resultToClass(result); - const resultText = resultToString(result); - const html = ` -
-

${resultText}

-
-

Initial Request: ${new Date(initialRequest).toISOString()}

-

Confirmation: ${new Date(now).toISOString()}

-

Token: ${consent.token}

-

Check: confirmation > initialRequest

-

Source: demo rules

-
-
- `; - outputEl.innerHTML = html; - }, 300); -} - -function initDemo() { - const testUnsubBtn = document.getElementById("test-unsub-btn"); - const unsubUrlInput = document.getElementById("unsub-url"); - if (testUnsubBtn && unsubUrlInput) { - testUnsubBtn.addEventListener("click", () => testUnsubscribeLink(unsubUrlInput.value)); - } - const testConsentBtn = document.getElementById("test-consent-btn"); - if (testConsentBtn) { - testConsentBtn.addEventListener("click", () => testConsentChain()); - } -} - -document.addEventListener("DOMContentLoaded", async () => { - proofData = await loadProofData(); - initDemo(); -}); diff --git a/avow-protocol/public/proof-data.json b/avow-protocol/public/proof-data.json deleted file mode 100644 index 18e9cddd..00000000 --- a/avow-protocol/public/proof-data.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "generated_at": "2026-02-01T18:57:12.282Z", - "urls": [ - { - "input": "https://example.com/unsubscribe?token=abc123", - "parse_ok": true, - "https": true - }, - { - "input": "http://example.com/unsubscribe?token=abc123", - "parse_ok": true, - "https": false - }, - { - "input": "not-a-url", - "parse_ok": false, - "https": false, - "error": "Invalid URL: Invalid URL: 'not-a-url'" - } - ], - "consent": [ - { - "id": "consent-ok", - "initial_request": "2026-02-01T12:00:00Z", - "confirmation": "2026-02-01T12:00:30Z", - "token": "user_123_consent_token_abc", - "valid": true, - "reason": "confirmation after request, token length >= 10" - }, - { - "id": "consent-invalid", - "initial_request": "2026-02-01T12:00:30Z", - "confirmation": "2026-02-01T12:00:10Z", - "token": "short", - "valid": false, - "reason": "confirmation before request or token too short" - } - ] -} diff --git a/avow-protocol/rescript.json b/avow-protocol/rescript.json deleted file mode 100644 index 8fda0827..00000000 --- a/avow-protocol/rescript.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "name": "avow-protocol", - "version": "1.0.0", - "sources": [ - {"dir": "src", "subdirs": true}, - {"dir": "scripts", "subdirs": true, "type": "dev"} - ], - "package-specs": [{"module": "es6", "in-source": true}], - "suffix": ".res.js", - "dependencies": ["@rescript/core"], - "warnings": {"error": "+101"} -} diff --git a/avow-protocol/scripts/CreatePagesProjects.affine b/avow-protocol/scripts/CreatePagesProjects.affine deleted file mode 100644 index d3a24ed7..00000000 --- a/avow-protocol/scripts/CreatePagesProjects.affine +++ /dev/null @@ -1,100 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// Create Cloudflare Pages projects via API. -// AffineScript port of CreatePagesProjects.res. - -module CreatePagesProjects; - -use Deno_Api; -use Fetch_Api; - -extern fn console_log(msg: String) -> Unit = "console" "log"; -extern fn console_error(msg: String) -> Unit = "console" "error"; -extern fn str_repeat(s: String, count: Int) -> String = "string" "repeat"; -extern fn json_stringify(value: a) -> Option = "JSON" "stringifyAny"; -extern fn json_get_bool(j: Json, key: String) -> Bool = "json" "getBool"; - -let cloudflare_api_token = Deno_Api.Env.get("CLOUDFLARE_API_TOKEN"); -let cloudflare_account_id = Deno_Api.Env.get("CLOUDFLARE_ACCOUNT_ID"); - -pub type Project = { name: String, domain: String } - -let projects = [ - Project { name: "affinescript", domain: "affinescript.dev" }, - Project { name: "anvomidav", domain: "anvomidav.org" }, - Project { name: "betlang", domain: "betlang.org" }, - Project { name: "eclexia", domain: "eclexia.org" }, - Project { name: "ephapax", domain: "ephapax.org" }, - Project { name: "error-lang", domain: "error-lang.org" }, - Project { name: "my-lang", domain: "my-lang.net" }, - Project { name: "oblibeny", domain: "oblibeny.net" }, - Project { name: "reposystem", domain: "reposystem.dev" }, - Project { name: "verisimdb", domain: "verisimdb.org" }, -]; - -fn auth_headers() -> Fetch_Api.Headers { - let token = match cloudflare_api_token { Some(t) => t, None => "" }; - Fetch_Api.Headers { authorization: "Bearer " ++ token, content_type: "application/json" } -} - -pub fn main() -> Effect[Async] Unit { - match (cloudflare_api_token, cloudflare_account_id) { - (None, _) => { console_error("Missing credentials"); Deno_Api.exit(1); } - (_, None) => { console_error("Missing credentials"); Deno_Api.exit(1); } - _ => {} - } - - let account_id = match cloudflare_account_id { Some(a) => a, None => "" }; - let bar = str_repeat("=", 70); - - console_log("Creating Cloudflare Pages projects"); - console_log(bar); - - let i = 0; - while i < len(projects) { - let project = projects[i]; - console_log("\n" ++ project.name); - - let create_body = match json_stringify(json_object([ - ("name", json_string(project.name)), - ("production_branch", json_string("main")), - ])) { Some(s) => s, None => "" }; - - let create_response = await Fetch_Api.fetch( - "https://api.cloudflare.com/client/v4/accounts/" ++ account_id ++ "/pages/projects", - Fetch_Api.RequestInit { method: Some("POST"), headers: auth_headers(), body: Some(create_body) }, - ); - let create_result = await Fetch_Api.json(create_response); - if json_get_bool(create_result, "success") { - console_log(" Project created"); - console_log(" URL: https://" ++ project.name ++ ".pages.dev"); - } else { - console_log(" Project already exists or failed"); - } - - console_log(" Adding domain: " ++ project.domain); - let domain_body = match json_stringify(json_object([("name", json_string(project.domain))])) { - Some(s) => s, None => "", - }; - let domain_response = await Fetch_Api.fetch( - "https://api.cloudflare.com/client/v4/accounts/" ++ account_id - ++ "/pages/projects/" ++ project.name ++ "/domains", - Fetch_Api.RequestInit { method: Some("POST"), headers: auth_headers(), body: Some(domain_body) }, - ); - let domain_result = await Fetch_Api.json(domain_response); - if json_get_bool(domain_result, "success") { - console_log(" Domain added"); - } else { - console_log(" Domain already added or failed"); - } - i = i + 1; - } - - console_log("\n" ++ bar); - console_log("Projects created!"); - console_log("\nNow run:"); - console_log(" ./deploy-repos.sh"); - console_log(bar) -} - -main() diff --git a/avow-protocol/scripts/DeployAllProjects.affine b/avow-protocol/scripts/DeployAllProjects.affine deleted file mode 100644 index c6d1a4ce..00000000 --- a/avow-protocol/scripts/DeployAllProjects.affine +++ /dev/null @@ -1,156 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// Deploy all hyperpolymath projects to Cloudflare Pages. -// AffineScript port of DeployAllProjects.res. - -module DeployAllProjects; - -use Deno_Api; -use Fetch_Api; - -extern fn console_log(msg: String) -> Unit = "console" "log"; -extern fn console_error(msg: String) -> Unit = "console" "error"; -extern fn str_repeat(s: String, count: Int) -> String = "string" "repeat"; -extern fn json_stringify(value: a) -> Option = "JSON" "stringifyAny"; -extern fn json_get_bool(j: Json, key: String) -> Bool = "json" "getBool"; - -let cloudflare_api_token = Deno_Api.Env.get("CLOUDFLARE_API_TOKEN"); -let cloudflare_account_id = Deno_Api.Env.get("CLOUDFLARE_ACCOUNT_ID"); - -pub type Project = { name: String, domain: String, path: String } -pub type DeployResult = { name: String, domain: String, status: String, url: Option } - -let projects = [ - Project { name: "affinescript", domain: "affinescript.dev", path: "affinescript" }, - Project { name: "anvomidav", domain: "anvomidav.org", path: "anvomidav" }, - Project { name: "betlang", domain: "betlang.org", path: "betlang" }, - Project { name: "eclexia", domain: "eclexia.org", path: "eclexia" }, - Project { name: "ephapax", domain: "ephapax.org", path: "ephapax" }, - Project { name: "error-lang", domain: "error-lang.org", path: "error-lang" }, - Project { name: "my-lang", domain: "my-lang.net", path: "my-lang" }, - Project { name: "oblibeny", domain: "oblibeny.net", path: "oblibeny" }, - Project { name: "reposystem", domain: "reposystem.dev", path: "reposystem" }, - Project { name: "verisimdb", domain: "verisimdb.org", path: "verisimdb" }, -]; - -fn auth_headers() -> Fetch_Api.Headers { - let token = match cloudflare_api_token { Some(t) => t, None => "" }; - Fetch_Api.Headers { authorization: "Bearer " ++ token, content_type: "application/json" } -} - -pub fn main() -> Effect[Async] Unit { - match (cloudflare_api_token, cloudflare_account_id) { - (None, _) => { console_error("Missing credentials"); Deno_Api.exit(1); } - (_, None) => { console_error("Missing credentials"); Deno_Api.exit(1); } - _ => {} - } - - let account_id = match cloudflare_account_id { Some(a) => a, None => "" }; - let home = match Deno_Api.Env.get("HOME") { Some(h) => h, None => "" }; - let bar = str_repeat("=", 70); - - console_log("Deploying all projects to Cloudflare Pages"); - console_log(bar); - - let results = []; - - let i = 0; - while i < len(projects) { - let project = projects[i]; - console_log("\nProject: " ++ project.name); - console_log(" Domain: " ++ project.domain); - - let repo_path = home ++ "/Documents/hyperpolymath-repos/" ++ project.path; - - try { - let _ = await Deno_Api.stat(repo_path); - } catch _e { - console_log(" Repo not found at " ++ repo_path); - results = results ++ [DeployResult { name: project.name, domain: project.domain, status: "repo_not_found", url: None }]; - } - - console_log(" Deploying..."); - let deploy_cmd = Deno_Api.make_command("deno", Deno_Api.CommandOptions { - args: ["run", "-A", "npm:wrangler", "pages", "deploy", ".", - "--project-name=" ++ project.name, "--branch=main"], - stdout: "piped", stderr: "piped", cwd: Some(repo_path), - }); - - try { - let deploy_output = await Deno_Api.output(deploy_cmd); - if deploy_output.code == 0 { - let deploy_url = "https://" ++ project.name ++ ".pages.dev"; - console_log(" Deployed: " ++ deploy_url); - - console_log(" Adding custom domain: " ++ project.domain); - let domain_body = match json_stringify(json_object([("name", json_string(project.domain))])) { - Some(s) => s, None => "", - }; - let domain_response = await Fetch_Api.fetch( - "https://api.cloudflare.com/client/v4/accounts/" ++ account_id - ++ "/pages/projects/" ++ project.name ++ "/domains", - Fetch_Api.RequestInit { method: Some("POST"), headers: auth_headers(), body: Some(domain_body) }, - ); - let domain_result = await Fetch_Api.json(domain_response); - if json_get_bool(domain_result, "success") { - console_log(" Custom domain added"); - } else { - console_log(" Domain add failed or already exists"); - } - results = results ++ [DeployResult { name: project.name, domain: project.domain, status: "success", url: Some(deploy_url) }]; - } else { - console_log(" Deployment failed"); - results = results ++ [DeployResult { name: project.name, domain: project.domain, status: "deploy_failed", url: None }]; - } - } catch e { - console_log(" Error: " ++ exn_message(e)); - results = results ++ [DeployResult { name: project.name, domain: project.domain, status: "error", url: None }]; - } - i = i + 1; - } - - // Summary - console_log("\n" ++ bar); - console_log("Deployment Summary\n"); - - let successful = []; - let failed = []; - let r = 0; - while r < len(results) { - let item = results[r]; - if item.status == "success" { - successful = successful ++ [item]; - } else { - failed = failed ++ [item]; - } - r = r + 1; - } - - console_log("Successfully deployed: " ++ show(len(successful))); - let s = 0; - while s < len(successful) { - let item = successful[s]; - let url = match item.url { Some(u) => u, None => "unknown" }; - console_log(" - " ++ item.name ++ ": " ++ url); - console_log(" Custom domain: https://" ++ item.domain); - s = s + 1; - } - - if len(failed) > 0 { - console_log("\nFailed/Issues: " ++ show(len(failed))); - let f = 0; - while f < len(failed) { - console_log(" - " ++ failed[f].name ++ ": " ++ failed[f].status); - f = f + 1; - } - } - - console_log("\nNext Steps:"); - console_log("1. Set up DNS zones for domains not in Cloudflare"); - console_log("2. Add CNAME records pointing to .pages.dev"); - console_log("3. Wait 1-5 minutes for DNS propagation"); - console_log("4. Verify domains are accessible"); - console_log(bar) -} - -main() diff --git a/avow-protocol/scripts/DeployDeno.affine b/avow-protocol/scripts/DeployDeno.affine deleted file mode 100644 index da577c5d..00000000 --- a/avow-protocol/scripts/DeployDeno.affine +++ /dev/null @@ -1,116 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// Deno-native Cloudflare Pages deployment script. -// AffineScript port of DeployDeno.res. - -module DeployDeno; - -use Deno_Api; -use Fetch_Api; - -extern fn console_log(msg: String) -> Unit = "console" "log"; -extern fn console_error(msg: String) -> Unit = "console" "error"; -extern fn console_error2(msg: String, value: a) -> Unit = "console" "error"; -extern fn str_repeat(s: String, count: Int) -> String = "string" "repeat"; -extern fn json_stringify(value: a) -> Option = "JSON" "stringifyAny"; -extern fn json_get_bool(j: Json, key: String) -> Bool = "json" "getBool"; -extern fn json_get(j: Json, key: String) -> Json = "json" "get"; - -let cloudflare_api_token = Deno_Api.Env.get("CLOUDFLARE_API_TOKEN"); -let cloudflare_account_id = Deno_Api.Env.get("CLOUDFLARE_ACCOUNT_ID"); - -fn auth_headers() -> Fetch_Api.Headers { - let token = match cloudflare_api_token { Some(t) => t, None => "" }; - Fetch_Api.Headers { authorization: "Bearer " ++ token, content_type: "application/json" } -} - -pub fn main() -> Effect[Async] Unit { - match cloudflare_api_token { - None => { console_error("CLOUDFLARE_API_TOKEN environment variable required"); Deno_Api.exit(1); } - Some(_) => {} - } - match cloudflare_account_id { - None => { - console_error("CLOUDFLARE_ACCOUNT_ID environment variable required"); - console_log("\nGet your account ID from: https://dash.cloudflare.com/ (right sidebar)"); - Deno_Api.exit(1); - } - Some(_) => {} - } - - let account_id = match cloudflare_account_id { Some(a) => a, None => "" }; - let bar = str_repeat("=", 50); - - console_log("AVOW Protocol - Deno Cloudflare Deployment"); - console_log(bar); - - // Step 1: Build project - console_log("\nBuilding project..."); - let build_cmd = Deno_Api.make_command("deno", - Deno_Api.CommandOptions { args: ["task", "build"], stdout: "inherit", stderr: "inherit", cwd: None }); - let build_result = await Deno_Api.output(build_cmd); - if !build_result.success { - console_error("Build failed"); - Deno_Api.exit(1); - } - console_log("Build successful"); - - // Step 2: Check/create project - console_log("\nChecking Cloudflare Pages project..."); - let check_response = await Fetch_Api.fetch( - "https://api.cloudflare.com/client/v4/accounts/" ++ account_id - ++ "/pages/projects/avow-protocol", - Fetch_Api.RequestInit { method: None, headers: auth_headers(), body: None }, - ); - - if !check_response.ok { - console_log("Creating new Pages project..."); - let create_body = match json_stringify(json_object([ - ("name", json_string("avow-protocol")), - ("production_branch", json_string("main")), - ("build_config", json_object([ - ("build_command", json_string("deno task build")), - ("destination_dir", json_string(".")), - ("root_dir", json_string("/")), - ])), - ])) { Some(s) => s, None => "" }; - - let create_response = await Fetch_Api.fetch( - "https://api.cloudflare.com/client/v4/accounts/" ++ account_id ++ "/pages/projects", - Fetch_Api.RequestInit { method: Some("POST"), headers: auth_headers(), body: Some(create_body) }, - ); - let result = await Fetch_Api.json(create_response); - if json_get_bool(result, "success") { - console_log("Project created"); - } else { - console_error2("Failed to create project:", json_get(result, "errors")); - Deno_Api.exit(1); - } - } else { - console_log("Project exists"); - } - - // Step 3: Instructions - console_log("\n" ++ bar); - console_log("Project configured on Cloudflare!"); - console_log("\nNext steps to complete deployment:\n"); - console_log("Option 1: Deploy via GitHub Integration (Recommended)"); - console_log(" 1. Go to: https://dash.cloudflare.com/pages"); - console_log(" 2. Find 'avow-protocol' project"); - console_log(" 3. Click 'Connect to Git'"); - console_log(" 4. Select: hyperpolymath/avow-protocol"); - console_log(" 5. Cloudflare will auto-deploy on push to main\n"); - console_log("Option 2: Deploy via Wrangler CLI"); - console_log(" 1. Install: npm install -g wrangler"); - console_log(" 2. Deploy: wrangler pages deploy .\n"); - console_log("Option 3: Manual Upload"); - console_log(" 1. Go to: https://dash.cloudflare.com/pages"); - console_log(" 2. Upload files directly via dashboard\n"); - console_log("Your site will be available at:"); - console_log(" https://avow-protocol.pages.dev"); - console_log(" https://avow-protocol.org (after DNS setup)"); - console_log("\nComplete setup guide: CLOUDFLARE-MANUAL-SETUP.md"); - console_log(bar) -} - -main() diff --git a/avow-protocol/scripts/DeployDirect.affine b/avow-protocol/scripts/DeployDirect.affine deleted file mode 100644 index 8c796b00..00000000 --- a/avow-protocol/scripts/DeployDirect.affine +++ /dev/null @@ -1,92 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// Direct file upload deployment to Cloudflare Pages. -// AffineScript port of DeployDirect.res. - -module DeployDirect; - -use Deno_Api; -use Fetch_Api; - -extern fn console_log(msg: String) -> Unit = "console" "log"; -extern fn console_error(msg: String) -> Unit = "console" "error"; -extern fn str_repeat(s: String, count: Int) -> String = "string" "repeat"; -extern fn json_stringify(value: a) -> Option = "JSON" "stringifyAny"; -extern fn json_get_bool(j: Json, key: String) -> Bool = "json" "getBool"; -extern fn json_get_path(j: Json, a: String, b: String) -> String = "json" "getPath2"; - -let cloudflare_api_token = Deno_Api.Env.get("CLOUDFLARE_API_TOKEN"); -let cloudflare_account_id = Deno_Api.Env.get("CLOUDFLARE_ACCOUNT_ID"); -let project_name = "avow-protocol"; - -fn auth_headers() -> Fetch_Api.Headers { - let token = match cloudflare_api_token { Some(t) => t, None => "" }; - Fetch_Api.Headers { authorization: "Bearer " ++ token, content_type: "application/json" } -} - -pub fn main() -> Effect[Async] Unit { - match (cloudflare_api_token, cloudflare_account_id) { - (None, _) => { console_error("Missing credentials"); Deno_Api.exit(1); } - (_, None) => { console_error("Missing credentials"); Deno_Api.exit(1); } - _ => {} - } - - let account_id = match cloudflare_account_id { Some(a) => a, None => "" }; - let bar = str_repeat("=", 50); - - console_log("Direct Deployment to Cloudflare Pages"); - console_log(bar); - - // Step 1: Build - console_log("\nBuilding project..."); - let build_cmd = Deno_Api.make_command("deno", - Deno_Api.CommandOptions { args: ["task", "build"], stdout: "piped", stderr: "piped", cwd: None }); - let build_result = await Deno_Api.output(build_cmd); - if !build_result.success { - console_error("Build failed"); - Deno_Api.exit(1); - } - console_log("Build successful"); - - // Step 2: Package files - console_log("\nPackaging files..."); - let files = dict_empty(); - let files_to_include = ["index.html", "style.css", "favicon.svg", "_headers", "cloudflare-dns-zone.txt"]; - let i = 0; - while i < len(files_to_include) { - // Synchronous read not available; would need async in real use. - let _ = files_to_include[i]; - i = i + 1; - } - console_log("Packaged " ++ show(len(dict_keys(files))) ++ " files"); - - // Step 3: Create deployment - console_log("\nCreating deployment..."); - let body = match json_stringify(json_object([ - ("branch", json_string("main")), - ("files", json_of(files)), - ])) { Some(s) => s, None => "" }; - - let deploy_response = await Fetch_Api.fetch( - "https://api.cloudflare.com/client/v4/accounts/" ++ account_id - ++ "/pages/projects/" ++ project_name ++ "/deployments", - Fetch_Api.RequestInit { method: Some("POST"), headers: auth_headers(), body: Some(body) }, - ); - - let result = await Fetch_Api.json(deploy_response); - if json_get_bool(result, "success") { - console_log("\n" ++ bar); - console_log("DEPLOYMENT SUCCESSFUL!"); - console_log(bar); - console_log("\nYour site is live at:"); - console_log(" " ++ json_get_path(result, "result", "url")); - console_log("\nProduction URL:"); - console_log(" https://" ++ project_name ++ ".pages.dev"); - console_log("\n" ++ bar); - } else { - console_error("Deployment failed"); - Deno_Api.exit(1); - } -} - -main() diff --git a/avow-protocol/scripts/GenerateProof.affine b/avow-protocol/scripts/GenerateProof.affine deleted file mode 100644 index 3a9724ce..00000000 --- a/avow-protocol/scripts/GenerateProof.affine +++ /dev/null @@ -1,84 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// Generate proof data using proven library bindings. -// AffineScript port of GenerateProof.res. - -module GenerateProof; - -use ProvenSafeUrl; -use Deno_Api; - -extern fn console_log(msg: String) -> Unit = "console" "log"; -extern fn date_now_iso() -> String = "Date" "toISOString"; -extern fn json_stringify_indent(value: a, indent: Int) -> Option = "JSON" "stringifyAnyWithIndent"; - -let urls = [ - "https://example.com/unsubscribe?token=abc123", - "http://example.com/unsubscribe?token=abc123", - "not-a-url", -]; - -pub type UrlProof = { - input: String, - parse_ok: Bool, - https: Bool, - error: Option, -} - -pub type ConsentProof = { - id: String, - initial_request: String, - confirmation: String, - token: String, - valid: Bool, - reason: String, -} - -fn build_url_proofs() -> [UrlProof] { - let out = []; - let i = 0; - while i < len(urls) { - let input = urls[i]; - let proof = match ProvenSafeUrl.parse(input, None) { - Ok(_) => UrlProof { input: input, parse_ok: true, https: ProvenSafeUrl.is_https(input), error: None }, - Err(e) => UrlProof { input: input, parse_ok: false, https: false, error: Some(e) }, - }; - out = out ++ [proof]; - i = i + 1; - } - out -} - -let consent_proofs = [ - ConsentProof { - id: "consent-ok", - initial_request: "2026-02-01T12:00:00Z", - confirmation: "2026-02-01T12:00:30Z", - token: "user_123_consent_token_abc", - valid: true, - reason: "confirmation after request, token length >= 10", - }, - ConsentProof { - id: "consent-invalid", - initial_request: "2026-02-01T12:00:30Z", - confirmation: "2026-02-01T12:00:10Z", - token: "short", - valid: false, - reason: "confirmation before request or token too short", - }, -]; - -pub fn main() -> Effect[Async] Unit { - let data = json_object([ - ("generated_at", json_string(date_now_iso())), - ("urls", json_of(build_url_proofs())), - ("consent", json_of(consent_proofs)), - ]); - - let serialised = match json_stringify_indent(data, 2) { Some(s) => s, None => "{}" }; - await Deno_Api.write_text_file("public/proof-data.json", serialised ++ "\n"); - - console_log("Wrote public/proof-data.json") -} - -main() diff --git a/avow-protocol/scripts/SetupDomains.affine b/avow-protocol/scripts/SetupDomains.affine deleted file mode 100644 index d7e9d0b3..00000000 --- a/avow-protocol/scripts/SetupDomains.affine +++ /dev/null @@ -1,95 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// Configure custom domains for Cloudflare Pages projects. -// AffineScript port of SetupDomains.res. - -module SetupDomains; - -use Deno_Api; -use Fetch_Api; - -extern fn console_log(msg: String) -> Unit = "console" "log"; -extern fn console_error(msg: String) -> Unit = "console" "error"; -extern fn str_repeat(s: String, count: Int) -> String = "string" "repeat"; -extern fn json_stringify(value: a) -> Option = "JSON" "stringifyAny"; -extern fn json_get_bool(j: Json, key: String) -> Bool = "json" "getBool"; -extern fn json_get_path(j: Json, a: String, b: String) -> String = "json" "getPath2"; - -let cloudflare_api_token = Deno_Api.Env.get("CLOUDFLARE_API_TOKEN"); -let cloudflare_account_id = Deno_Api.Env.get("CLOUDFLARE_ACCOUNT_ID"); - -pub type Project = { name: String, domains: [String] } - -let projects = [ - Project { name: "avow-protocol", domains: ["avow-protocol.org", "www.avow-protocol.org"] }, - Project { name: "a2ml", domains: ["a2ml.org", "www.a2ml.org"] }, - Project { name: "k9-svc", domains: ["k9-svc.org", "www.k9-svc.org"] }, -]; - -fn auth_headers() -> Fetch_Api.Headers { - let token = match cloudflare_api_token { Some(t) => t, None => "" }; - Fetch_Api.Headers { authorization: "Bearer " ++ token, content_type: "application/json" } -} - -pub fn main() -> Effect[Async] Unit { - match (cloudflare_api_token, cloudflare_account_id) { - (None, _) => { console_error("Missing credentials"); Deno_Api.exit(1); } - (_, None) => { console_error("Missing credentials"); Deno_Api.exit(1); } - _ => {} - } - - let account_id = match cloudflare_account_id { Some(a) => a, None => "" }; - let bar = str_repeat("=", 60); - - console_log("Setting up custom domains for Cloudflare Pages"); - console_log(bar); - - let i = 0; - while i < len(projects) { - let project = projects[i]; - console_log("\nProject: " ++ project.name); - - let j = 0; - while j < len(project.domains) { - let domain = project.domains[j]; - console_log("\n Adding domain: " ++ domain); - - let body = match json_stringify(json_object([("name", json_string(domain))])) { - Some(s) => s, None => "", - }; - let response = await Fetch_Api.fetch( - "https://api.cloudflare.com/client/v4/accounts/" ++ account_id - ++ "/pages/projects/" ++ project.name ++ "/domains", - Fetch_Api.RequestInit { method: Some("POST"), headers: auth_headers(), body: Some(body) }, - ); - - let result = await Fetch_Api.json(response); - if json_get_bool(result, "success") { - console_log(" Domain added: " ++ domain); - console_log(" Status: " ++ json_get_path(result, "result", "status")); - } else { - console_log(" Domain already added or failed: " ++ domain); - } - j = j + 1; - } - i = i + 1; - } - - console_log("\n" ++ bar); - console_log("Domain setup complete!"); - console_log("\nNext steps:"); - console_log("1. DNS records will be auto-configured by Cloudflare"); - console_log("2. Wait 1-5 minutes for activation"); - console_log("3. Verify at: https://dash.cloudflare.com/pages"); - console_log("\nYour sites will be available at:"); - let k = 0; - while k < len(projects) { - if len(projects[k].domains) > 0 { - console_log(" https://" ++ projects[k].domains[0]); - } - k = k + 1; - } - console_log(bar) -} - -main() diff --git a/avow-protocol/scripts/check-6scm.sh b/avow-protocol/scripts/check-6scm.sh deleted file mode 100755 index ee6b1e69..00000000 --- a/avow-protocol/scripts/check-6scm.sh +++ /dev/null @@ -1,22 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -missing=0 -for f in AGENTIC.scm ECOSYSTEM.scm META.scm NEUROSYM.scm PLAYBOOK.scm STATE.scm; do - src=".machine_readable/$f" - dst=".machine_readable/6scm/$f" - if [ ! -f "$src" ]; then - continue - fi - if [ ! -f "$dst" ]; then - echo "Missing mirror: $dst" >&2 - missing=1 - continue - fi - if ! diff -u "$src" "$dst" >/dev/null; then - echo "Out of sync: $src -> $dst" >&2 - missing=1 - fi -done - -exit $missing diff --git a/avow-protocol/scripts/sync-6scm.sh b/avow-protocol/scripts/sync-6scm.sh deleted file mode 100755 index fc881165..00000000 --- a/avow-protocol/scripts/sync-6scm.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -mkdir -p .machine_readable/6scm -for f in AGENTIC.scm ECOSYSTEM.scm META.scm NEUROSYM.scm PLAYBOOK.scm STATE.scm; do - if [ -f ".machine_readable/$f" ]; then - cp -f ".machine_readable/$f" ".machine_readable/6scm/$f" - fi -done diff --git a/avow-protocol/security-requirements.scm b/avow-protocol/security-requirements.scm deleted file mode 100644 index e5cbbd7d..00000000 --- a/avow-protocol/security-requirements.scm +++ /dev/null @@ -1,104 +0,0 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -;; -;; AVOW Protocol - Security Requirements -;; Post-quantum cryptography and formal verification standards - -(define user-security-requirements - '( - ;; Category, Algorithm/Standard, NIST/FIPS Standard, Notes - (PasswordHashing "Argon2id (512 MiB, 8 iter, 4 lanes)" "—" "Max memory/iterations for GPU/ASIC resistance; aligns with proactive security stance.") - (GeneralHashing "SHAKE3-512 (512-bit output)" "FIPS 202" "Post-quantum; use for provenance, key derivation, and long-term storage.") - (PQSignatures "Dilithium5-AES (hybrid)" "ML-DSA-87 (FIPS 204)" "Hybrid with AES-256 for belt-and-suspenders security. SPHINCS+ as conservative backup.") - (PQKeyExchange "Kyber-1024 + SHAKE256-KDF" "ML-KEM-1024 (FIPS 203)" "Kyber-1024 for KEM, SHAKE256 for key derivation. SPHINCS+ as backup.") - (ClassicalSigs "Ed448 + Dilithium5 (hybrid)" "—" "Ed448 for classical compatibility; Dilithium5 for PQ. SPHINCS+ as backup. Terminate Ed25519/SHA-1 immediately.") - (Symmetric "XChaCha20-Poly1305 (256-bit key)" "—" "Larger nonce space; 256-bit keys for quantum margin.") - (KeyDerivation "HKDF-SHAKE512" "FIPS 202" "Post-quantum KDF; use with all secret key material.") - (RNG "ChaCha20-DRBG (512-bit seed)" "SP 800-90Ar1" "CSPRNG for deterministic, high-entropy needs.") - (UserFriendlyHashNames "Base32(SHAKE256(hash)) → Wordlist" "—" "Memorable, deterministic mapping (e.g., \"Gigantic-Giraffe-7\" for drivers).") - (DatabaseHashing "BLAKE3 (512-bit) + SHAKE3-512" "—" "BLAKE3 for speed, SHAKE3-512 for long-term storage (semantic XML/ARIA tags).") - (SemanticXMLGraphQL "Virtuoso (VOS) + SPARQL 1.2" "—" "Supports WCAG 2.3 AAA, ARIA, and formal verification for accessibility/compliance.") - (VMExecution "GraalVM (with formal verification)" "—" "Aligns with preference for introspective, reversible design.") - (ProtocolStack "QUIC + HTTP/3 + IPv6 (IPv4 disabled)" "—" "Terminate HTTP/1.1, IPv4, and SHA-1 per \"danger zone\" policy.") - (Accessibility "WCAG 2.3 AAA + ARIA + Semantic XML" "—" "CSS-first, HTML-second; full compliance with accessibility requirements.") - (Fallback "SPHINCS+" "—" "Conservative PQ backup for all hybrid classical+PQ systems; use if primary PQ algorithm is ever compromised.") - (FormalVerification "Coq/Isabelle (for crypto primitives)" "—" "Proactive attestation and transparent logic per system design principles.") - (IdrisVerification "Idris2 (for ABI/protocol proofs)" "—" "Dependent types prove message compliance and verification correctness at compile-time.") - ) -) - -;; Implementation Requirements for libavow -(define libavow-crypto-requirements - '( - ;; Core cryptographic primitives required for AVOW Protocol - (SignatureScheme - (primary "Dilithium5-AES") - (classical "Ed448") - (fallback "SPHINCS+") - (mode "hybrid") - (purpose "Sign messages and verification proofs")) - - (KeyExchange - (primary "Kyber-1024") - (kdf "SHAKE256") - (purpose "Establish secure channels for message transmission")) - - (Hashing - (primary "SHAKE3-512") - (secondary "BLAKE3") - (purpose "Content hashing, merkle trees, proof generation")) - - (SymmetricEncryption - (algorithm "XChaCha20-Poly1305") - (key-size 256) - (purpose "Encrypt message content and metadata")) - - (ProofSystem - (language "Idris2") - (properties ["consent-chain-ordering" "rate-limit-compliance" "unsubscribe-validity"]) - (purpose "Compile-time verification of protocol properties")) - - (FormalVerification - (tools ["Idris2" "Coq" "Isabelle"]) - (verified-properties ["no-null-dereference" "no-buffer-overflow" "crypto-primitive-correctness"]) - (purpose "Mathematical proofs of implementation correctness")) - ) -) - -;; Cloudflare Configuration Requirements -(define cloudflare-security-requirements - '( - (ZeroTrust - (enabled #t) - (services ["dashboard.internal" "ci.internal" "db.internal"]) - (authentication "Cloudflare Access + SAML")) - - (WASM-Proxy - (enabled #t) - (endpoint "wasm.avow-protocol.org") - (purpose "WASM-based request filtering and validation")) - - (DDoS-Protection - (enabled #t) - (mode "automatic") - (custom-rules ["rate-limit-api" "block-known-bad-actors"])) - - (TLS - (minimum-version "TLS 1.3") - (cipher-suites ["TLS_AES_256_GCM_SHA384" "TLS_CHACHA20_POLY1305_SHA256"]) - (http3 #t) - (quic #t)) - - (DNS-Security - (dnssec #t) - (caa-records #t) - (tlsa-records #t) - (mta-sts #t)) - - (Page-Rules - (force-https #t) - (hsts-max-age 63072000) - (include-subdomains #t) - (preload #t)) - ) -) diff --git a/avow-protocol/src/Mod.affine b/avow-protocol/src/Mod.affine deleted file mode 100644 index 424bf720..00000000 --- a/avow-protocol/src/Mod.affine +++ /dev/null @@ -1,7 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// AffineScript port of Mod.res. - -module Mod; - -pub fn add(a: Float, b: Float) -> Float { a +. b } diff --git a/avow-protocol/src/Mod_test.affine b/avow-protocol/src/Mod_test.affine deleted file mode 100644 index e0de97fa..00000000 --- a/avow-protocol/src/Mod_test.affine +++ /dev/null @@ -1,14 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// AffineScript port of Mod_test.res. - -module Mod_test; - -use Mod; - -extern fn assert_equals(a: a, b: a) -> Unit = "@std/assert" "assertEquals"; -extern fn deno_test(name: String, body: fn() -> Unit) -> Unit = "Deno" "test"; - -deno_test("addTest", fn() { - assert_equals(Mod.add(2.0, 3.0), 5.0) -}) diff --git a/avow-protocol/src/ProvenResult.affine b/avow-protocol/src/ProvenResult.affine deleted file mode 100644 index ef37e716..00000000 --- a/avow-protocol/src/ProvenResult.affine +++ /dev/null @@ -1,37 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// -// Result type for proven bindings. AffineScript port of ProvenResult.res. -// Matches the JS { ok: boolean, value?: T, error?: string } pattern. - -module ProvenResult; - -pub type JsResult = { - ok: Bool, - value: Option, - error: Option, -} - -extern fn ok_js(value: v) -> JsResult = "proven/result" "ok"; -extern fn err_js(error: String) -> JsResult = "proven/result" "err"; - -pub fn from_js(js: JsResult) -> Result { - if js.ok { - match js.value { - Some(v) => Ok(v), - None => Err("Ok result missing value"), - } - } else { - match js.error { - Some(e) => Err(e), - None => Err("Unknown error"), - } - } -} - -pub fn to_js(r: Result) -> JsResult { - match r { - Ok(value) => JsResult { ok: true, value: Some(value), error: None }, - Err(error) => JsResult { ok: false, value: None, error: Some(error) }, - } -} diff --git a/avow-protocol/src/ProvenResult_test.affine b/avow-protocol/src/ProvenResult_test.affine deleted file mode 100644 index 11c1e325..00000000 --- a/avow-protocol/src/ProvenResult_test.affine +++ /dev/null @@ -1,61 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// AffineScript port of ProvenResult_test.res. - -module ProvenResult_test; - -use ProvenResult; - -extern fn assert_equals(a: a, b: a) -> Unit = "@std/assert" "assertEquals"; -extern fn assert_not_equals(a: a, b: a) -> Unit = "@std/assert" "assertNotEquals"; -extern fn deno_test(name: String, body: fn() -> Unit) -> Unit = "Deno" "test"; - -// __ from_js tests _______________________________________________________ - -deno_test("fromJs: ok result with value converts to Ok", fn() { - let js = ProvenResult.JsResult { ok: true, value: Some("hello"), error: None }; - assert_equals(ProvenResult.from_js(js), Ok("hello")) -}) - -deno_test("fromJs: ok result missing value converts to Error", fn() { - let js = ProvenResult.JsResult { ok: true, value: None, error: None }; - assert_equals(ProvenResult.from_js(js), Err("Ok result missing value")) -}) - -deno_test("fromJs: error result with message converts to Error", fn() { - let js = ProvenResult.JsResult { ok: false, value: None, error: Some("parse failed") }; - assert_equals(ProvenResult.from_js(js), Err("parse failed")) -}) - -deno_test("fromJs: error result without message converts to Unknown error", fn() { - let js = ProvenResult.JsResult { ok: false, value: None, error: None }; - assert_equals(ProvenResult.from_js(js), Err("Unknown error")) -}) - -// __ to_js tests _________________________________________________________ - -deno_test("toJs: Ok value converts to jsResult with ok=true", fn() { - let js = ProvenResult.to_js(Ok("world")); - assert_equals(js.ok, true); - assert_equals(js.value, Some("world")); - assert_equals(js.error, None) -}) - -deno_test("toJs: Error value converts to jsResult with ok=false", fn() { - let js = ProvenResult.to_js(Err("bad input")); - assert_equals(js.ok, false); - assert_equals(js.value, None); - assert_equals(js.error, Some("bad input")) -}) - -// __ round-trip tests ____________________________________________________ - -deno_test("round-trip: Ok -> toJs -> fromJs preserves value", fn() { - let original = Ok(42); - assert_equals(ProvenResult.from_js(ProvenResult.to_js(original)), original) -}) - -deno_test("round-trip: Error -> toJs -> fromJs preserves error", fn() { - let original = Err("not found"); - assert_equals(ProvenResult.from_js(ProvenResult.to_js(original)), original) -}) diff --git a/avow-protocol/src/ProvenSafeUrl.affine b/avow-protocol/src/ProvenSafeUrl.affine deleted file mode 100644 index 3545bd18..00000000 --- a/avow-protocol/src/ProvenSafeUrl.affine +++ /dev/null @@ -1,72 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// -// SafeUrl - URL parsing that cannot crash. AffineScript port of -// ProvenSafeUrl.res. Bindings to proven's formally verified URL module. - -module ProvenSafeUrl; - -use ProvenResult; - -pub type ParsedUrl = { - protocol: String, - host: String, - hostname: String, - port: String, - pathname: String, - search: String, - hash: String, - origin: String, - href: String, -} - -extern fn su_parse(url: String, base: Option) -> JsResult = "proven/safe_url" "SafeUrl.parse"; -extern fn su_is_valid(url: String) -> Bool = "proven/safe_url" "SafeUrl.isValid"; -extern fn su_get_query_param(url: String, param: String) -> JsResult> = "proven/safe_url" "SafeUrl.getQueryParam"; -extern fn su_get_query_params(url: String) -> JsResult> = "proven/safe_url" "SafeUrl.getQueryParams"; -extern fn su_set_query_param(url: String, param: String, value: String) -> JsResult = "proven/safe_url" "SafeUrl.setQueryParam"; -extern fn su_remove_query_param(url: String, param: String) -> JsResult = "proven/safe_url" "SafeUrl.removeQueryParam"; -extern fn su_join(base: String, paths: [String]) -> JsResult = "proven/safe_url" "SafeUrl.join"; -extern fn su_get_domain(url: String) -> JsResult = "proven/safe_url" "SafeUrl.getDomain"; -extern fn su_is_https(url: String) -> Bool = "proven/safe_url" "SafeUrl.isHttps"; -extern fn su_encode(s: String) -> String = "proven/safe_url" "SafeUrl.encode"; -extern fn su_decode(s: String) -> JsResult = "proven/safe_url" "SafeUrl.decode"; -extern fn su_normalize(url: String) -> JsResult = "proven/safe_url" "SafeUrl.normalize"; - -pub fn parse(url: String, base: Option) -> Result { - from_js(su_parse(url, base)) -} - -pub fn is_valid(url: String) -> Bool { su_is_valid(url) } - -pub fn get_query_param(url: String, param: String) -> Result, String> { - from_js(su_get_query_param(url, param)) -} - -pub fn get_query_params(url: String) -> Result, String> { - from_js(su_get_query_params(url)) -} - -pub fn set_query_param(url: String, param: String, value: String) -> Result { - from_js(su_set_query_param(url, param, value)) -} - -pub fn remove_query_param(url: String, param: String) -> Result { - from_js(su_remove_query_param(url, param)) -} - -pub fn join(base: String, paths: [String]) -> Result { - from_js(su_join(base, paths)) -} - -pub fn get_domain(url: String) -> Result { - from_js(su_get_domain(url)) -} - -pub fn is_https(url: String) -> Bool { su_is_https(url) } - -pub fn encode(s: String) -> String { su_encode(s) } - -pub fn decode(s: String) -> Result { from_js(su_decode(s)) } - -pub fn normalize(url: String) -> Result { from_js(su_normalize(url)) } diff --git a/avow-protocol/src/bindings/Deno_Api.affine b/avow-protocol/src/bindings/Deno_Api.affine deleted file mode 100644 index 03a9e426..00000000 --- a/avow-protocol/src/bindings/Deno_Api.affine +++ /dev/null @@ -1,34 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// FFI bindings for Deno runtime APIs. AffineScript port of Deno_Api.res. - -module Deno_Api; - -module Env { - extern fn get(name: String) -> Option = "Deno.env" "get"; -} - -extern fn exit(code: Int) -> Unit = "Deno" "exit"; -extern fn read_text_file(path: String) -> Promise = "Deno" "readTextFile"; -extern fn write_text_file(path: String, contents: String) -> Promise = "Deno" "writeTextFile"; - -pub type FileInfo = { is_file: Bool, is_directory: Bool, is_symlink: Bool } -extern fn stat(path: String) -> Promise = "Deno" "stat"; - -pub type CommandOptions = { - args: [String], - stdout: String, - stderr: String, - cwd: Option, -} - -pub type CommandOutput = { - success: Bool, - code: Int, - stdout: Bytes, - stderr: Bytes, -} - -extern type Command; -extern fn make_command(cmd: String, options: CommandOptions) -> Command = "Deno" "Command"; -extern fn output(c: Command) -> Promise = "Deno" "output"; diff --git a/avow-protocol/src/bindings/Deno_Std_Fs.affine b/avow-protocol/src/bindings/Deno_Std_Fs.affine deleted file mode 100644 index baf32563..00000000 --- a/avow-protocol/src/bindings/Deno_Std_Fs.affine +++ /dev/null @@ -1,18 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// FFI bindings for @std/fs. AffineScript port of Deno_Std_Fs.res. - -module Deno_Std_Fs; - -pub type WalkEntry = { - path: String, - name: String, - is_file: Bool, - is_directory: Bool, - is_symlink: Bool, -} - -pub type WalkOptions = { exts: Option<[String]> } - -// walk returns an async iterable; collect into array via for-await glue. -extern fn walk(root: String, options: WalkOptions) -> AsyncIterable = "@std/fs" "walk"; diff --git a/avow-protocol/src/bindings/Deno_Std_Path.affine b/avow-protocol/src/bindings/Deno_Std_Path.affine deleted file mode 100644 index e723ddc5..00000000 --- a/avow-protocol/src/bindings/Deno_Std_Path.affine +++ /dev/null @@ -1,10 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// FFI bindings for @std/path. AffineScript port of Deno_Std_Path.res. - -module Deno_Std_Path; - -extern fn relative(from: String, to: String) -> String = "@std/path" "relative"; -extern fn basename(path: String) -> String = "@std/path" "basename"; -extern fn join(a: String, b: String) -> String = "@std/path" "join"; -extern fn dirname(path: String) -> String = "@std/path" "dirname"; diff --git a/avow-protocol/src/bindings/Fetch_Api.affine b/avow-protocol/src/bindings/Fetch_Api.affine deleted file mode 100644 index 07608da0..00000000 --- a/avow-protocol/src/bindings/Fetch_Api.affine +++ /dev/null @@ -1,25 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// FFI bindings for the Fetch API. AffineScript port of Fetch_Api.res. - -module Fetch_Api; - -pub type Headers = { - authorization: String, // serialised as "Authorization" - content_type: String, // serialised as "Content-Type" -} - -pub type RequestInit = { - method: Option, - headers: Headers, - body: Option, -} - -pub type Response = { - ok: Bool, - status: Int, -} - -extern fn json(r: Response) -> Promise = "fetch" "json"; -extern fn fetch(url: String, init: RequestInit) -> Promise = "global" "fetch"; -extern fn fetch_get(url: String) -> Promise = "global" "fetch"; diff --git a/avow-protocol/stamp-protocol.org.zone b/avow-protocol/stamp-protocol.org.zone deleted file mode 100644 index 8b7b9930..00000000 --- a/avow-protocol/stamp-protocol.org.zone +++ /dev/null @@ -1,40 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; stamp-protocol.org DNS Zone File -; For use with Cloudflare DNS - -$ORIGIN stamp-protocol.org. -$TTL 3600 - -; GitHub Pages A records (apex domain) -@ IN A 185.199.108.153 -@ IN A 185.199.109.153 -@ IN A 185.199.110.153 -@ IN A 185.199.111.153 - -; GitHub Pages AAAA records (IPv6) -@ IN AAAA 2606:50c0:8000::153 -@ IN AAAA 2606:50c0:8001::153 -@ IN AAAA 2606:50c0:8002::153 -@ IN AAAA 2606:50c0:8003::153 - -; WWW subdomain (CNAME to apex) -www IN CNAME stamp-protocol.org. - -; Email routing (Cloudflare) -@ IN MX 10 route1.mx.cloudflare.net. -@ IN MX 25 route2.mx.cloudflare.net. -@ IN MX 83 route3.mx.cloudflare.net. - -; SPF record for email (allow Cloudflare) -@ IN TXT "v=spf1 include:_spf.mx.cloudflare.net ~all" - -; DMARC policy -_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:j.d.a.jewell@open.ac.uk" - -; CAA records (allow Let's Encrypt, GitHub) -@ IN CAA 0 issue "letsencrypt.org" -@ IN CAA 0 issue "pki.goog" -@ IN CAA 0 iodef "mailto:j.d.a.jewell@open.ac.uk" - -; GitHub domain verification (add token from GitHub settings if needed) -; _github-pages-challenge-hyperpolymath IN TXT "verification-token" diff --git a/avow-protocol/style.css b/avow-protocol/style.css deleted file mode 100644 index f6e1a103..00000000 --- a/avow-protocol/style.css +++ /dev/null @@ -1,542 +0,0 @@ -/* STAMP Protocol Website Styles */ - -:root { - --primary: #2563eb; - --primary-dark: #1e40af; - --secondary: #64748b; - --success: #10b981; - --background: #ffffff; - --surface: #f8fafc; - --text: #0f172a; - --text-muted: #64748b; - --border: #e2e8f0; - --code-bg: #1e293b; - --code-text: #e2e8f0; -} - -* { - margin: 0; - padding: 0; - box-sizing: border-box; -} - -body { - font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; - line-height: 1.6; - color: var(--text); - background: var(--background); -} - -.container { - max-width: 1200px; - margin: 0 auto; - padding: 0 2rem; -} - -/* Hero Section */ -.hero { - background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); - color: white; - padding: 6rem 0 8rem; - text-align: center; -} - -.hero h1 { - font-size: 4rem; - font-weight: 800; - margin-bottom: 1rem; - letter-spacing: -0.02em; -} - -.hero .tagline { - font-size: 1.5rem; - opacity: 0.95; - margin-bottom: 1rem; - font-weight: 500; -} - -.hero .subtitle { - font-size: 1.25rem; - opacity: 0.9; - max-width: 800px; - margin: 0 auto 3rem; - line-height: 1.8; -} - -.hero strong { - color: #fbbf24; - font-weight: 700; -} - -.cta-buttons { - display: flex; - gap: 1rem; - justify-content: center; - flex-wrap: wrap; -} - -.btn { - display: inline-block; - padding: 1rem 2rem; - border-radius: 0.5rem; - text-decoration: none; - font-weight: 600; - font-size: 1.1rem; - transition: all 0.2s; -} - -.btn-primary { - background: white; - color: var(--primary); -} - -.btn-primary:hover { - transform: translateY(-2px); - box-shadow: 0 10px 25px rgba(0,0,0,0.2); -} - -.btn-secondary { - background: rgba(255,255,255,0.2); - color: white; - border: 2px solid white; -} - -.btn-secondary:hover { - background: rgba(255,255,255,0.3); -} - -/* Problem Section */ -.problem { - padding: 6rem 0; - background: var(--surface); -} - -.problem h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 3rem; -} - -.problem-grid { - display: grid; - grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); - gap: 2rem; -} - -.problem-card { - background: white; - padding: 2rem; - border-radius: 1rem; - box-shadow: 0 4px 6px rgba(0,0,0,0.05); -} - -.problem-card h3 { - font-size: 1.5rem; - margin-bottom: 1rem; -} - -.problem-card .stat { - color: var(--primary); - font-weight: 700; - font-size: 1.25rem; - margin-top: 1rem; -} - -/* Solution Section */ -.solution { - padding: 6rem 0; -} - -.solution h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 1rem; -} - -.solution .intro { - text-align: center; - font-size: 1.25rem; - color: var(--text-muted); - margin-bottom: 4rem; -} - -.features { - display: grid; - grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); - gap: 3rem; -} - -.feature { - text-align: center; -} - -.feature-icon { - width: 4rem; - height: 4rem; - background: var(--success); - color: white; - border-radius: 50%; - display: flex; - align-items: center; - justify-content: center; - font-size: 2rem; - margin: 0 auto 1.5rem; -} - -.feature h3 { - font-size: 1.5rem; - margin-bottom: 1rem; -} - -.feature code { - background: var(--code-bg); - color: var(--code-text); - padding: 0.5rem 1rem; - border-radius: 0.5rem; - display: inline-block; - margin-top: 1rem; - font-size: 0.9rem; - font-family: 'Monaco', 'Courier New', monospace; -} - -/* Technical Section */ -.technical { - padding: 6rem 0; - background: var(--surface); -} - -.technical h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 4rem; -} - -.tech-comparison { - display: grid; - grid-template-columns: repeat(auto-fit, minmax(400px, 1fr)); - gap: 3rem; -} - -.tech-col h3 { - font-size: 1.5rem; - margin-bottom: 1.5rem; -} - -.tech-col pre { - background: var(--code-bg); - color: var(--code-text); - padding: 1.5rem; - border-radius: 0.75rem; - overflow-x: auto; - margin-bottom: 1rem; - font-size: 0.95rem; - line-height: 1.6; -} - -.tech-col .explanation { - font-size: 1.1rem; - color: var(--text-muted); -} - -/* Demo Section */ -.demo { - padding: 6rem 0; -} - -.demo h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 3rem; -} - -.demo-box { - max-width: 800px; - margin: 0 auto 3rem; - background: var(--surface); - padding: 3rem; - border-radius: 1rem; - border: 2px solid var(--border); -} - -.demo-box h3 { - font-size: 1.75rem; - margin-bottom: 1rem; -} - -.demo-box ol { - margin: 2rem 0; - padding-left: 1.5rem; -} - -.demo-box li { - margin-bottom: 1rem; - font-size: 1.1rem; -} - -.demo-box code { - background: var(--code-bg); - color: var(--code-text); - padding: 0.25rem 0.5rem; - border-radius: 0.25rem; - font-family: 'Monaco', 'Courier New', monospace; -} - -.demo-box .btn { - margin-top: 2rem; -} - -/* Interactive Demo */ -.interactive-demo { - max-width: 900px; -} - -.demo-controls { - display: grid; - gap: 2rem; - margin: 2rem 0; -} - -.demo-control-group h4 { - font-size: 1.25rem; - margin-bottom: 1rem; - color: var(--primary); -} - -.demo-description { - font-size: 0.95rem; - color: var(--text-muted); - margin-bottom: 1rem; -} - -.demo-input { - width: 100%; - padding: 0.75rem 1rem; - border: 2px solid var(--border); - border-radius: 0.5rem; - font-size: 1rem; - font-family: 'Monaco', 'Courier New', monospace; - margin-bottom: 1rem; -} - -.demo-input:focus { - outline: none; - border-color: var(--primary); -} - -.demo-output { - min-height: 200px; - background: white; - padding: 2rem; - border-radius: 0.75rem; - border: 2px solid var(--border); - margin-top: 2rem; -} - -.demo-placeholder { - text-align: center; - color: var(--text-muted); - font-size: 1.1rem; -} - -.demo-loading { - text-align: center; - font-size: 1.25rem; - padding: 2rem; - animation: pulse 1.5s ease-in-out infinite; -} - -@keyframes pulse { - 0%, 100% { opacity: 1; } - 50% { opacity: 0.5; } -} - -.demo-result { - animation: slideIn 0.3s ease-out; -} - -@keyframes slideIn { - from { - opacity: 0; - transform: translateY(10px); - } - to { - opacity: 1; - transform: translateY(0); - } -} - -.demo-result h4 { - font-size: 1.5rem; - margin-bottom: 1.5rem; -} - -.demo-result.success h4 { - color: var(--success); -} - -.demo-result.error h4 { - color: #ef4444; -} - -.demo-details { - background: var(--surface); - padding: 1.5rem; - border-radius: 0.5rem; - margin-bottom: 1.5rem; -} - -.demo-details p { - margin-bottom: 0.75rem; - font-size: 1rem; -} - -.demo-details strong { - color: var(--text); -} - -.demo-proof { - background: var(--code-bg); - color: var(--code-text); - padding: 1.5rem; - border-radius: 0.5rem; -} - -.demo-proof strong { - display: block; - margin-bottom: 0.75rem; - color: #fbbf24; -} - -.demo-proof code { - background: transparent; - padding: 0; - display: block; - line-height: 1.8; - font-size: 0.95rem; -} - -/* Use Cases */ -.use-cases { - padding: 6rem 0; - background: var(--surface); -} - -.use-cases h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 3rem; -} - -.use-case-grid { - display: grid; - grid-template-columns: repeat(auto-fit, minmax(250px, 1fr)); - gap: 2rem; -} - -.use-case { - background: white; - padding: 2rem; - border-radius: 0.75rem; - box-shadow: 0 2px 4px rgba(0,0,0,0.05); -} - -.use-case h3 { - font-size: 1.25rem; - margin-bottom: 0.75rem; - color: var(--primary); -} - -/* Stats */ -.stats { - padding: 6rem 0; - background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); - color: white; -} - -.stats h2 { - text-align: center; - font-size: 2.5rem; - margin-bottom: 3rem; -} - -.stats-grid { - display: grid; - grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); - gap: 3rem; -} - -.stat-card { - text-align: center; -} - -.stat-number { - font-size: 3.5rem; - font-weight: 800; - margin-bottom: 0.5rem; -} - -.stat-label { - font-size: 1.25rem; - opacity: 0.9; -} - -/* Footer */ -.footer { - padding: 4rem 0 2rem; - text-align: center; - background: var(--text); - color: white; -} - -.footer h2 { - font-size: 2rem; - margin-bottom: 1rem; -} - -.footer-links { - margin: 2rem 0; - display: flex; - gap: 2rem; - justify-content: center; - flex-wrap: wrap; -} - -.footer-links a { - color: white; - text-decoration: none; - font-size: 1.1rem; - transition: opacity 0.2s; -} - -.footer-links a:hover { - opacity: 0.7; -} - -.copyright { - margin-top: 2rem; - opacity: 0.7; - font-size: 0.9rem; -} - -/* Responsive */ -@media (max-width: 768px) { - .hero h1 { - font-size: 2.5rem; - } - - .hero .tagline { - font-size: 1.25rem; - } - - .hero .subtitle { - font-size: 1.1rem; - } - - .tech-comparison { - grid-template-columns: 1fr; - } - - .container { - padding: 0 1rem; - } -} diff --git a/avow-protocol/telegram-bot/.gitignore b/avow-protocol/telegram-bot/.gitignore deleted file mode 100644 index ab6ad6a3..00000000 --- a/avow-protocol/telegram-bot/.gitignore +++ /dev/null @@ -1,24 +0,0 @@ -# Environment -.env - -# Database -db/*.db -db/*.db-shm -db/*.db-wal - -# Deno -.deno/ - -# Logs -*.log - -# OS -.DS_Store -Thumbs.db - -# IDE -.vscode/ -.idea/ -*.swp -*.swo -*~ diff --git a/avow-protocol/telegram-bot/ABI-FFI-README.md b/avow-protocol/telegram-bot/ABI-FFI-README.md deleted file mode 100644 index e6a32bbf..00000000 --- a/avow-protocol/telegram-bot/ABI-FFI-README.md +++ /dev/null @@ -1,385 +0,0 @@ -{{~ Aditionally delete this line and fill out the template below ~}} - -# {{PROJECT}} ABI/FFI Documentation - -## Overview - -This library follows the **Hyperpolymath RSR Standard** for ABI and FFI design: - -- **ABI (Application Binary Interface)** defined in **Idris2** with formal proofs -- **FFI (Foreign Function Interface)** implemented in **Zig** for C compatibility -- **Generated C headers** bridge Idris2 ABI to Zig FFI -- **Any language** can call through standard C ABI - -## Architecture - -``` -┌─────────────────────────────────────────────┐ -│ ABI Definitions (Idris2) │ -│ src/abi/ │ -│ - Types.idr (Type definitions) │ -│ - Layout.idr (Memory layout proofs) │ -│ - Foreign.idr (FFI declarations) │ -└─────────────────┬───────────────────────────┘ - │ - │ generates (at compile time) - ▼ -┌─────────────────────────────────────────────┐ -│ C Headers (auto-generated) │ -│ generated/abi/{{project}}.h │ -└─────────────────┬───────────────────────────┘ - │ - │ imported by - ▼ -┌─────────────────────────────────────────────┐ -│ FFI Implementation (Zig) │ -│ ffi/zig/src/main.zig │ -│ - Implements C-compatible functions │ -│ - Zero-cost abstractions │ -│ - Memory-safe by default │ -└─────────────────┬───────────────────────────┘ - │ - │ compiled to lib{{project}}.so/.a - ▼ -┌─────────────────────────────────────────────┐ -│ Any Language via C ABI │ -│ - Rust, ReScript, Julia, Python, etc. │ -└─────────────────────────────────────────────┘ -``` - -## Directory Structure - -``` -{{project}}/ -├── src/ -│ ├── abi/ # ABI definitions (Idris2) -│ │ ├── Types.idr # Core type definitions with proofs -│ │ ├── Layout.idr # Memory layout verification -│ │ └── Foreign.idr # FFI function declarations -│ └── lib/ # Core library (any language) -│ -├── ffi/ -│ └── zig/ # FFI implementation (Zig) -│ ├── build.zig # Build configuration -│ ├── build.zig.zon # Dependencies -│ ├── src/ -│ │ └── main.zig # C-compatible FFI implementation -│ ├── test/ -│ │ └── integration_test.zig -│ └── include/ -│ └── {{project}}.h # C header (optional, can be generated) -│ -├── generated/ # Auto-generated files -│ └── abi/ -│ └── {{project}}.h # Generated from Idris2 ABI -│ -└── bindings/ # Language-specific wrappers (optional) - ├── rust/ - ├── rescript/ - └── julia/ -``` - -## Why Idris2 for ABI? - -### 1. **Formal Verification** - -Idris2's dependent types allow proving properties about the ABI at compile-time: - -```idris --- Prove struct size is correct -public export -exampleStructSize : HasSize ExampleStruct 16 - --- Prove field alignment is correct -public export -fieldAligned : Divides 8 (offsetOf ExampleStruct.field) - --- Prove ABI is platform-compatible -public export -abiCompatible : Compatible (ABI 1) (ABI 2) -``` - -### 2. **Type Safety** - -Encode invariants that C/Zig cannot express: - -```idris --- Non-null pointer guaranteed at type level -data Handle : Type where - MkHandle : (ptr : Bits64) -> {auto 0 nonNull : So (ptr /= 0)} -> Handle - --- Array with length proof -data Buffer : (n : Nat) -> Type where - MkBuffer : Vect n Byte -> Buffer n -``` - -### 3. **Platform Abstraction** - -Platform-specific types with compile-time selection: - -```idris -CInt : Platform -> Type -CInt Linux = Bits32 -CInt Windows = Bits32 - -CSize : Platform -> Type -CSize Linux = Bits64 -CSize Windows = Bits64 -``` - -### 4. **Safe Evolution** - -Prove that new ABI versions are backward-compatible: - -```idris --- Compiler enforces compatibility -abiUpgrade : ABI 1 -> ABI 2 -abiUpgrade old = MkABI2 { - -- Must preserve all v1 fields - v1_compat = old, - -- Can add new fields - new_features = defaults -} -``` - -## Why Zig for FFI? - -### 1. **C ABI Compatibility** - -Zig exports C-compatible functions naturally: - -```zig -export fn library_function(param: i32) i32 { - return param * 2; -} -``` - -### 2. **Memory Safety** - -Compile-time safety without runtime overhead: - -```zig -// Null check enforced at compile time -const handle = init() orelse return error.InitFailed; -defer free(handle); -``` - -### 3. **Cross-Compilation** - -Built-in cross-compilation to any platform: - -```bash -zig build -Dtarget=x86_64-linux -zig build -Dtarget=aarch64-macos -zig build -Dtarget=x86_64-windows -``` - -### 4. **Zero Dependencies** - -No runtime, no libc required (unless explicitly needed): - -```zig -// Minimal binary size -pub const lib = @import("std"); -// Only includes what you use -``` - -## Building - -### Build FFI Library - -```bash -cd ffi/zig -zig build # Build debug -zig build -Doptimize=ReleaseFast # Build optimized -zig build test # Run tests -``` - -### Generate C Header from Idris2 ABI - -```bash -cd src/abi -idris2 --cg c-header Types.idr -o ../../generated/abi/{{project}}.h -``` - -### Cross-Compile - -```bash -cd ffi/zig - -# Linux x86_64 -zig build -Dtarget=x86_64-linux - -# macOS ARM64 -zig build -Dtarget=aarch64-macos - -# Windows x86_64 -zig build -Dtarget=x86_64-windows -``` - -## Usage - -### From C - -```c -#include "{{project}}.h" - -int main() { - void* handle = {{project}}_init(); - if (!handle) return 1; - - int result = {{project}}_process(handle, 42); - if (result != 0) { - const char* err = {{project}}_last_error(); - fprintf(stderr, "Error: %s\n", err); - } - - {{project}}_free(handle); - return 0; -} -``` - -Compile with: -```bash -gcc -o example example.c -l{{project}} -L./zig-out/lib -``` - -### From Idris2 - -```idris -import {{PROJECT}}.ABI.Foreign - -main : IO () -main = do - Just handle <- init - | Nothing => putStrLn "Failed to initialize" - - Right result <- process handle 42 - | Left err => putStrLn $ "Error: " ++ errorDescription err - - free handle - putStrLn "Success" -``` - -### From Rust - -```rust -#[link(name = "{{project}}")] -extern "C" { - fn {{project}}_init() -> *mut std::ffi::c_void; - fn {{project}}_free(handle: *mut std::ffi::c_void); - fn {{project}}_process(handle: *mut std::ffi::c_void, input: u32) -> i32; -} - -fn main() { - unsafe { - let handle = {{project}}_init(); - assert!(!handle.is_null()); - - let result = {{project}}_process(handle, 42); - assert_eq!(result, 0); - - {{project}}_free(handle); - } -} -``` - -### From Julia - -```julia -const lib{{project}} = "lib{{project}}" - -function init() - handle = ccall((:{{project}}_init, lib{{project}}), Ptr{Cvoid}, ()) - handle == C_NULL && error("Failed to initialize") - handle -end - -function process(handle, input) - result = ccall((:{{project}}_process, lib{{project}}), Cint, (Ptr{Cvoid}, UInt32), handle, input) - result -end - -function cleanup(handle) - ccall((:{{project}}_free, lib{{project}}), Cvoid, (Ptr{Cvoid},), handle) -end - -# Usage -handle = init() -try - result = process(handle, 42) - println("Result: $result") -finally - cleanup(handle) -end -``` - -## Testing - -### Unit Tests (Zig) - -```bash -cd ffi/zig -zig build test -``` - -### Integration Tests - -```bash -cd ffi/zig -zig build test-integration -``` - -### ABI Verification (Idris2) - -```idris --- Compile-time verification -%runElab verifyABI - --- Runtime checks -main : IO () -main = do - verifyLayoutsCorrect - verifyAlignmentsCorrect - putStrLn "ABI verification passed" -``` - -## Contributing - -When modifying the ABI/FFI: - -1. **Update ABI first** (`src/abi/*.idr`) - - Modify type definitions - - Update proofs - - Ensure backward compatibility - -2. **Generate C header** - ```bash - idris2 --cg c-header src/abi/Types.idr -o generated/abi/{{project}}.h - ``` - -3. **Update FFI implementation** (`ffi/zig/src/main.zig`) - - Implement new functions - - Match ABI types exactly - -4. **Add tests** - - Unit tests in Zig - - Integration tests - - ABI verification tests - -5. **Update documentation** - - Function signatures - - Usage examples - - Migration guide (if breaking changes) - -## License - -PMPL-1.0-or-later - -## See Also - -- [Idris2 Documentation](https://idris2.readthedocs.io) -- [Zig Documentation](https://ziglang.org/documentation/master/) -- [Rhodium Standard Repositories](https://github.com/hyperpolymath/rhodium-standard-repositories) -- [FFI Migration Guide](../ffi-migration-guide.md) -- [ABI Migration Guide](../abi-migration-guide.md) diff --git a/avow-protocol/telegram-bot/CODE_OF_CONDUCT.md b/avow-protocol/telegram-bot/CODE_OF_CONDUCT.md deleted file mode 100644 index f9af5d2e..00000000 --- a/avow-protocol/telegram-bot/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,327 +0,0 @@ -# Code of Conduct - - - -## Our Pledge - -We as members, contributors, and leaders pledge to make participation in Standards a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation. - -We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. - -We recognise that a thriving open source community requires **psychological safety** — an environment where people can contribute, ask questions, make mistakes, and learn without fear of ridicule or retaliation. - ---- - -## Our Standards - -### Expected Behaviour - -The following behaviours contribute to a positive environment: - -**Communication** -- Using welcoming and inclusive language -- Being respectful of differing viewpoints and experiences -- Giving and gracefully accepting constructive feedback -- Assuming good intent while addressing impact -- Communicating clearly and patiently, especially with newcomers - -**Collaboration** -- Focusing on what is best for the community -- Showing empathy and kindness toward other community members -- Being collaborative rather than competitive -- Mentoring and supporting less experienced contributors -- Celebrating others' contributions and successes - -**Professionalism** -- Accepting responsibility and apologising to those affected by our mistakes -- Learning from the experience and avoiding repetition -- Respecting others' time and attention -- Staying on topic in project spaces -- Following project guidelines and conventions - -**Accessibility** -- Using plain language and avoiding unnecessary jargon -- Providing alt text for images and transcripts for audio/video -- Being patient with those using assistive technologies -- Accommodating different communication styles and needs -- Recognising that not everyone communicates the same way - -### Unacceptable Behaviour - -The following behaviours are considered harassment and are unacceptable: - -**Harassment** -- The use of sexualised language or imagery, and sexual attention or advances of any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Deliberate intimidation, stalking, or following (online or in-person) -- Unwelcome physical contact or simulated physical contact (e.g., emoji) -- Sustained disruption of talks, events, or online discussions - -**Discrimination** -- Discriminatory jokes and language -- Posting or threatening to post others' personally identifying information ("doxing") -- Advocating for, or encouraging, any of the above behaviour -- Microaggressions — subtle, often unintentional, discriminatory comments or actions - -**Professional Misconduct** -- Publishing others' private information without explicit permission -- Misrepresenting affiliation or contributions -- Plagiarism or claiming credit for others' work -- Retaliating against anyone who reports a Code of Conduct violation -- Other conduct which could reasonably be considered inappropriate in a professional setting - -### Grey Areas - -Some situations require judgement. When uncertain: - -- **Intent vs Impact**: Good intentions do not excuse harmful impact. Focus on making things right. -- **Power Dynamics**: Those with more power (maintainers, employers, experienced contributors) must be especially mindful of their impact. -- **Cultural Differences**: What's acceptable varies by culture. When in doubt, err on the side of caution and ask. -- **Humour**: Jokes at others' expense are rarely funny to everyone. Punch up, not down. - ---- - -## Scope - -This Code of Conduct applies within all community spaces, including: - -**Online Spaces** -- Repository discussions, issues, and pull/merge requests -- Project chat channels (Matrix, Discord, Slack, IRC) -- Mailing lists and forums -- Social media when representing the project -- Video calls and virtual meetings - -**In-Person Spaces** -- Conferences, meetups, and events -- Workshops and training sessions -- Any gathering where you represent the project - -**Representation** -This Code of Conduct also applies when an individual is officially representing the community in public spaces. Examples include: - -- Using an official project email address -- Posting via an official social media account -- Acting as an appointed representative at an event -- Speaking on behalf of the project - ---- - -## Enforcement - -### Reporting - -If you experience or witness unacceptable behaviour, or have any other concerns, please report it as soon as possible. - -**How to Report** - -| Method | Details | Best For | -|--------|---------|----------| -| **Email** | {{CONDUCT_EMAIL}} | Detailed reports, sensitive matters | -| **Private Message** | Contact any maintainer directly | Quick questions, minor issues | -| **Anonymous Form** | [Link to form if available] | When you need anonymity | - -**What to Include** - -- Your contact information (unless anonymous) -- Names/usernames of those involved -- Description of what happened -- When and where it occurred -- Any witnesses -- Any supporting evidence (screenshots, links) -- How you would like us to respond (if you have a preference) - -**What Happens Next** - -1. You will receive acknowledgment within **{{RESPONSE_TIME}}** -2. The {{CONDUCT_TEAM}} will review the report -3. We may ask for additional information -4. We will determine appropriate action -5. We will inform you of the outcome (respecting others' privacy) - -### Confidentiality - -All reports will be handled with discretion: - -- Reporter identity is protected by default -- Details are shared only with those who need to know -- We will ask before naming you in any communication -- Anonymous reports are accepted and investigated - -### Conflicts of Interest - -If a {{CONDUCT_TEAM}} member is involved in an incident: - -- They will recuse themselves from the process -- Another maintainer or external party will handle the report -- We will disclose any potential conflicts - ---- - -## Enforcement Guidelines - -The {{CONDUCT_TEAM}} will follow these guidelines in determining consequences: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behaviour deemed unprofessional or unwelcome. - -**Consequence**: A private, written warning providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate. A public apology may be requested. - -**Duration**: Immediate - -### 2. Warning - -**Community Impact**: A violation through a single incident or series of actions. - -**Consequence**: A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. - -**Duration**: 1-4 weeks - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including sustained inappropriate behaviour. - -**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. - -**Duration**: 1-6 months - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behaviour, harassment of an individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within the community. - -**Duration**: Permanent (with appeal rights after 12 months) - -### Enforcement Across Perimeters - -For contributors with elevated access (Perimeter 2 or 1): - -| Level | Additional Consequence | -|-------|----------------------| -| Correction | Noted in contributor record | -| Warning | Access privileges may be temporarily reduced | -| Temporary Ban | Access reduced to Perimeter 3 for ban duration | -| Permanent Ban | All access revoked | - ---- - -## Appeals - -If you believe an enforcement decision was made in error: - -1. **Wait 7 days** after the decision (cooling-off period) -2. **Email** {{CONDUCT_EMAIL}} with subject line "Appeal: [Original Report ID]" -3. **Explain** why you believe the decision should be reconsidered -4. **Provide** any new information not previously available - -**Appeals Process** - -- Appeals are reviewed by a different {{CONDUCT_TEAM}} member than the original -- You will receive a response within 14 days -- The appeals decision is final -- You may only appeal once per incident - -**Grounds for Appeal** - -- Procedural errors in the original investigation -- New evidence not previously available -- Disproportionate response to the violation -- Misunderstanding of facts - ---- - -## Supporting Those Who Report - -We are committed to supporting those who report violations: - -**We Will** -- Believe and take all reports seriously -- Respect your privacy and confidentiality preferences -- Keep you informed of progress (if you wish) -- Take steps to protect you from retaliation -- Provide resources if you need support - -**We Will Not** -- Require you to confront the person directly -- Dismiss reports without investigation -- Reveal your identity without consent -- Tolerate retaliation against reporters -- Rush you to make decisions - ---- - -## Prevention - -Beyond enforcement, we actively work to prevent issues: - -**Onboarding** -- All contributors are expected to read this Code of Conduct -- Perimeter 2 applicants must confirm they've read and understood it -- Maintainers receive additional training on enforcement - -**Culture** -- We model the behaviour we expect -- We intervene early when we see potential issues -- We thank people for positive contributions -- We create opportunities for diverse voices - -**Review** -- This Code of Conduct is reviewed annually -- Community feedback is welcomed -- Changes are communicated clearly - ---- - -## Acknowledgments - -This Code of Conduct is adapted from: - -- [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1 -- [Django Code of Conduct](https://www.djangoproject.com/conduct/) -- [Rust Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct) -- [Python Community Code of Conduct](https://www.python.org/psf/conduct/) - -We thank these communities for their leadership in creating welcoming spaces. - ---- - -## Questions? - -If you have questions about this Code of Conduct: - -- Open a [Discussion](https://github.com/hyperpolymath/standards/discussions) (for general questions) -- Email {{CONDUCT_EMAIL}} (for private questions) -- Contact any maintainer directly - ---- - -## Summary - -**Be kind. Be respectful. Be collaborative.** - -We're all here because we care about this project. Let's make it a place where everyone can do their best work. - ---- - -Last updated: 2026 · Based on Contributor Covenant 2.1 diff --git a/avow-protocol/telegram-bot/CONTRIBUTING.md b/avow-protocol/telegram-bot/CONTRIBUTING.md deleted file mode 100644 index 8c9d97b7..00000000 --- a/avow-protocol/telegram-bot/CONTRIBUTING.md +++ /dev/null @@ -1,116 +0,0 @@ -# Clone the repository -git clone https://github.com/hyperpolymath/standards.git -cd standards - -# Using Nix (recommended for reproducibility) -nix develop - -# Or using toolbox/distrobox -toolbox create standards-dev -toolbox enter standards-dev -# Install dependencies manually - -# Verify setup -just check # or: cargo check / mix compile / etc. -just test # Run test suite -``` - -### Repository Structure -``` -standards/ -├── src/ # Source code (Perimeter 1-2) -├── lib/ # Library code (Perimeter 1-2) -├── extensions/ # Extensions (Perimeter 2) -├── plugins/ # Plugins (Perimeter 2) -├── tools/ # Tooling (Perimeter 2) -├── docs/ # Documentation (Perimeter 3) -│ ├── architecture/ # ADRs, specs (Perimeter 2) -│ └── proposals/ # RFCs (Perimeter 3) -├── examples/ # Examples (Perimeter 3) -├── spec/ # Spec tests (Perimeter 3) -├── tests/ # Test suite (Perimeter 2-3) -├── .well-known/ # Protocol files (Perimeter 1-3) -├── .github/ # GitHub config (Perimeter 1) -│ ├── ISSUE_TEMPLATE/ -│ └── workflows/ -├── CHANGELOG.md -├── CODE_OF_CONDUCT.md -├── CONTRIBUTING.md # This file -├── GOVERNANCE.md -├── LICENSE -├── MAINTAINERS.md -├── README.adoc -├── SECURITY.md -├── flake.nix # Nix flake (Perimeter 1) -└── Justfile # Task runner (Perimeter 1) -``` - ---- - -## How to Contribute - -### Reporting Bugs - -**Before reporting**: -1. Search existing issues -2. Check if it's already fixed in `main` -3. Determine which perimeter the bug affects - -**When reporting**: - -Use the [bug report template](.github/ISSUE_TEMPLATE/bug_report.md) and include: - -- Clear, descriptive title -- Environment details (OS, versions, toolchain) -- Steps to reproduce -- Expected vs actual behaviour -- Logs, screenshots, or minimal reproduction - -### Suggesting Features - -**Before suggesting**: -1. Check the [roadmap](ROADMAP.md) if available -2. Search existing issues and discussions -3. Consider which perimeter the feature belongs to - -**When suggesting**: - -Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) and include: - -- Problem statement (what pain point does this solve?) -- Proposed solution -- Alternatives considered -- Which perimeter this affects - -### Your First Contribution - -Look for issues labelled: - -- [`good first issue`](https://github.com/hyperpolymath/standards/labels/good%20first%20issue) — Simple Perimeter 3 tasks -- [`help wanted`](https://github.com/hyperpolymath/standards/labels/help%20wanted) — Community help needed -- [`documentation`](https://github.com/hyperpolymath/standards/labels/documentation) — Docs improvements -- [`perimeter-3`](https://github.com/hyperpolymath/standards/labels/perimeter-3) — Community sandbox scope - ---- - -## Development Workflow - -### Branch Naming -``` -docs/short-description # Documentation (P3) -test/what-added # Test additions (P3) -feat/short-description # New features (P2) -fix/issue-number-description # Bug fixes (P2) -refactor/what-changed # Code improvements (P2) -security/what-fixed # Security fixes (P1-2) -``` - -### Commit Messages - -We follow [Conventional Commits](https://www.conventionalcommits.org/): -``` -(): - -[optional body] - -[optional footer] diff --git a/avow-protocol/telegram-bot/DEMO-VIDEO-SCRIPT.md b/avow-protocol/telegram-bot/DEMO-VIDEO-SCRIPT.md deleted file mode 100644 index 9d3f8939..00000000 --- a/avow-protocol/telegram-bot/DEMO-VIDEO-SCRIPT.md +++ /dev/null @@ -1,272 +0,0 @@ -# STAMP Protocol Demo Video Script - -**Duration:** 2 minutes -**Goal:** Show investors/users what STAMP does and why it matters - -## 🎬 Recording Setup - -### Software Options - -**Linux (Fedora):** -```bash -# Option 1: SimpleScreenRecorder (best quality) -sudo dnf install simplescreenrecorder -simplescreenrecorder - -# Option 2: OBS Studio (professional) -flatpak install flathub com.obsproject.Studio -flatpak run com.obsproject.Studio - -# Option 3: FFmpeg (command line) -ffmpeg -video_size 1920x1080 -framerate 30 -f x11grab -i :0.0 \ - -c:v libx264 -preset ultrafast -crf 23 stamp-demo.mp4 -``` - -**Settings:** -- Resolution: 1920x1080 (1080p) -- Frame rate: 30fps -- Audio: Optional (voiceover or silent) -- Format: MP4 (H.264) - -### What to Show - -1. **Website** (stamp-protocol.org) -2. **Telegram bot** (@stamp_demo_bot) -3. **Interactive demo** (verification in browser) - -## 📝 Script - -### Scene 1: Hook (0:00-0:15) - -**Visual:** stamp-protocol.org homepage - -**Narration:** -> "Email spam. Fake social media accounts. Broken unsubscribe links. -> -> What if you could **mathematically prove** your messages comply with -> consent, working unsubscribe, and rate limits? -> -> That's STAMP Protocol." - -**On-screen text:** -- "80-90% bot reduction" -- "Mathematically proven compliance" - ---- - -### Scene 2: The Problem (0:15-0:35) - -**Visual:** Scroll to "Problem" section - -**Narration:** -> "Current solutions rely on promises. Developers can lie about testing -> unsubscribe links. Spammers bypass rate limits. -> -> Platforms spend over $100 million per year fighting bots—and still lose." - -**On-screen text:** -- "$200M+ email spam market" -- "$1.2B+ social media bot market" - ---- - -### Scene 3: The Solution (0:35-1:00) - -**Visual:** "How It Works" section, show code comparison - -**Narration:** -> "STAMP uses dependent types in Idris2 to prove message properties -> at compile-time. -> -> Without STAMP, developers can lie. With STAMP, the code literally -> won't compile if your unsubscribe link doesn't work. -> -> It's not testing. It's proof." - -**On-screen text:** -- "Dependent Types = Mathematical Proof" -- "Code won't compile if invalid" - ---- - -### Scene 4: Live Demo (1:00-1:40) - -**Visual:** Switch to Telegram, show bot interaction - -**Narration:** -> "Here's STAMP in action. I'll subscribe to the demo bot. -> -> [Type /start] -> -> Immediately, I get a cryptographic proof of my consent—with -> timestamps that can't be faked. -> -> [Type /verify] -> -> The bot shows the unsubscribe link was tested and proven to work -> in under 200 milliseconds. -> -> [Type /unsubscribe] -> -> One click. Proven removal. No dark patterns." - -**Key moments to capture:** -- `/start` response (consent proof) -- `/verify` output (cryptographic proof) -- `/unsubscribe` confirmation - ---- - -### Scene 5: Call to Action (1:40-2:00) - -**Visual:** Back to website, hero section - -**Narration:** -> "STAMP works for email, social media, business messaging—any -> protocol that needs verified consent. -> -> Reduce bots by 80-90%. Save millions on moderation. Prove -> regulatory compliance. -> -> Try the live demo at stamp-protocol.org or test the Telegram bot. -> -> STAMP Protocol: Spam is over." - -**On-screen text:** -- "stamp-protocol.org" -- "@stamp_demo_bot" -- "Open source. AGPL-3.0" - ---- - -## 🎥 Recording Checklist - -**Before recording:** -- [ ] Close unnecessary tabs/apps -- [ ] Set browser zoom to 100% -- [ ] Hide bookmarks bar -- [ ] Clear Telegram chat (or use test account) -- [ ] Test bot commands work -- [ ] Restart bot if needed -- [ ] Practice script 2-3 times - -**Recording settings:** -- [ ] 1920x1080 resolution -- [ ] 30fps framerate -- [ ] Clean desktop (no clutter) -- [ ] Good lighting (if showing webcam) -- [ ] Clear audio (if narrating) - -**Post-recording:** -- [ ] Trim beginning/end -- [ ] Add title card (optional) -- [ ] Add captions (accessibility) -- [ ] Export as MP4 -- [ ] Test playback -- [ ] Upload to YouTube/Vimeo - -## 📤 Where to Share - -1. **YouTube** (unlisted or public) -2. **Vimeo** (good for business) -3. **Twitter/X** (2-min native video) -4. **LinkedIn** (for B2B) -5. **Embed on website** - -## 🎬 Quick Recording Commands - -### Using SimpleScreenRecorder - -1. Open SimpleScreenRecorder -2. Select area: "Record entire screen" -3. Audio: Optional -4. Output file: `~/Videos/stamp-demo.mp4` -5. Click "Record" -6. Do your demo -7. Click "Stop" - -### Using OBS - -1. Open OBS Studio -2. Scene: "Screen Capture" -3. Start Recording -4. Do your demo -5. Stop Recording -6. File saved in `~/Videos/` - -### Quick FFmpeg (Command Line) - -```bash -# Start recording -ffmpeg -video_size 1920x1080 -framerate 30 -f x11grab -i :0.0+0,0 \ - -c:v libx264 -preset ultrafast -crf 18 \ - ~/Videos/stamp-demo-$(date +%Y%m%d).mp4 - -# Stop with Ctrl+C - -# Add voiceover later (optional) -ffmpeg -i stamp-demo.mp4 -i audio.mp3 -c:v copy -c:a aac \ - stamp-demo-final.mp4 -``` - -## ✂️ Editing (Optional) - -**Quick edits with FFmpeg:** - -```bash -# Trim first 5 seconds -ffmpeg -ss 00:00:05 -i input.mp4 -c copy output.mp4 - -# Trim last 3 seconds -ffmpeg -i input.mp4 -t $(echo "$(ffprobe -v error -show_entries \ - format=duration -of default=noprint_wrappers=1:nokey=1 input.mp4) - 3" | bc) \ - -c copy output.mp4 - -# Add fade in/out -ffmpeg -i input.mp4 -vf "fade=in:0:30,fade=out:3570:30" output.mp4 - -# Speed up 1.25x (if too slow) -ffmpeg -i input.mp4 -filter:v "setpts=0.8*PTS" output.mp4 -``` - -**Or use:** -- Kdenlive (open source, powerful) -- Shotcut (simpler) -- DaVinci Resolve (professional, free) - -## 📊 Success Metrics - -**Good demo video:** -- Under 2 minutes ✓ -- Shows problem → solution → demo -- Clear audio/visual -- Sharable link - -**Great demo video:** -- Professional editing -- Captions/subtitles -- Engaging narration -- Call to action - -## 🚀 Ready to Record? - -1. Install screen recorder -2. Practice script -3. Record (multiple takes OK) -4. Pick best take -5. Upload and share! - -**Quick start:** -```bash -# Install SimpleScreenRecorder -sudo dnf install simplescreenrecorder - -# Launch -simplescreenrecorder & - -# OR use OBS -flatpak run com.obsproject.Studio & -``` - -Remember: **Done is better than perfect.** Even a simple screen recording -with no audio is valuable for showing the demo to people. diff --git a/avow-protocol/telegram-bot/DEPLOY-NOW.md b/avow-protocol/telegram-bot/DEPLOY-NOW.md deleted file mode 100644 index a72b0b58..00000000 --- a/avow-protocol/telegram-bot/DEPLOY-NOW.md +++ /dev/null @@ -1,156 +0,0 @@ -# Deploy Your STAMP Bot RIGHT NOW - -## ✅ Everything is ready! Follow these steps: - -### Step 1: Get Your Bot Token (2 minutes) - -1. Open Telegram -2. Search for: `@BotFather` -3. Send: `/newbot` -4. When asked for name, reply: `STAMP Demo Bot` -5. When asked for username, reply: `stamp_demo_YOUR_NAME_bot` (must be unique and end in "bot") -6. Copy the token (looks like: `1234567890:ABCdef-GHIjklMNOpqrs`) - -### Step 2: Configure (30 seconds) - -```bash -cd ~/Documents/hyperpolymath-repos/stamp-telegram-bot - -# Create config file with your token -echo "BOT_TOKEN=YOUR_TOKEN_HERE" > .env - -# Example: -# echo "BOT_TOKEN=1234567890:ABCdef-GHIjklMNOpqrs" > .env -``` - -### Step 3: Run (10 seconds) - -```bash -deno task start -``` - -You should see: -``` -🤖 STAMP Telegram Bot starting... -✓ Bot initialized -✓ Database connected -✓ Demo messages scheduled (every hour) - -🚀 Bot is now running! -``` - -### Step 4: Test (1 minute) - -1. Open Telegram -2. Search for your bot username (e.g., `@stamp_demo_YOUR_NAME_bot`) -3. Send: `/start` - -You should get: -``` -✓ Subscription Confirmed - -Consent Chain Verified: -└─ Requested: 2026-01-30... -└─ Confirmed: /start command (explicit) -└─ Token: ... -└─ Proof: Cryptographically signed ✓ -``` - -**Try these commands:** -- `/verify` - See cryptographic proof -- `/status` - Show subscription details -- `/unsubscribe` - Unsubscribe (one-click) - -### Step 5: Keep It Running (Optional) - -**Option A: Leave terminal open** -Just don't close the terminal window - -**Option B: Use `screen` (recommended)** -```bash -# Start screen session -screen -S stamp-bot - -# Run bot -deno task start - -# Detach: Press Ctrl+A, then D -# Bot keeps running in background - -# Later: Reattach with -screen -r stamp-bot -``` - ---- - -## ✅ Success Checklist - -- [ ] Bot responds to `/start` -- [ ] Bot shows consent proof -- [ ] `/verify` command works -- [ ] `/unsubscribe` command works -- [ ] Bot stays running - ---- - -## 🎉 Once Working: - -1. **Test with friends** - Share bot link with 3-5 people -2. **Record demo video** - Screen record the `/start`, `/verify`, `/unsubscribe` flow (2 min) -3. **Take screenshots** - For pitch deck - ---- - -## ⚠️ If Something Goes Wrong: - -**Bot doesn't start:** -```bash -# Check Deno is installed -deno --version - -# If not installed: -curl -fsSL https://deno.land/install.sh | sh -``` - -**Bot doesn't respond:** -- Check BOT_TOKEN in `.env` is correct -- Check bot username matches what you set -- Try stopping (Ctrl+C) and restarting - -**Permission errors:** -```bash -# Give write permissions -chmod +x ~/Documents/hyperpolymath-repos/stamp-telegram-bot/db -``` - ---- - -## 📝 What to Tell People When Demoing: - -> "This is a demo of the STAMP protocol - it uses formal verification to prove: -> -> 1. You actually consented to receive messages -> 2. The unsubscribe link works (tested and proven) -> 3. The sender is rate-limited -> -> Try it: /start to subscribe, /verify to see the proof, /unsubscribe to leave" - ---- - -## Next: Buy Domain - -While bot is running, buy: **`stamp-protocol.org`** (£10/year) - -Go to: https://www.cloudflare.com/products/registrar/ - ---- - -**Ready? Run these commands now:** - -```bash -cd ~/Documents/hyperpolymath-repos/stamp-telegram-bot -echo "BOT_TOKEN=YOUR_TOKEN_HERE" > .env -deno task start -``` - -**Then message me when it's working!** 🚀 diff --git a/avow-protocol/telegram-bot/LICENSE b/avow-protocol/telegram-bot/LICENSE deleted file mode 100644 index ec540b34..00000000 --- a/avow-protocol/telegram-bot/LICENSE +++ /dev/null @@ -1,153 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council - -================================================================================ -PALIMPSEST-MPL LICENSE VERSION 1.0 -================================================================================ - -File-level copyleft with ethical use and quantum-safe provenance - -Based on Mozilla Public License 2.0 - --------------------------------------------------------------------------------- -PREAMBLE --------------------------------------------------------------------------------- - -This License extends the Mozilla Public License 2.0 (MPL-2.0) with provisions -for ethical use, post-quantum cryptographic provenance, and emotional lineage -protection. The base MPL-2.0 terms apply except where explicitly modified by -the Exhibits below. - -Like a palimpsest manuscript where each layer builds upon what came before, -this license recognizes that creative works carry history, context, and meaning -that transcend mere code or text. - --------------------------------------------------------------------------------- -SECTION 1: BASE LICENSE --------------------------------------------------------------------------------- - -This License incorporates the full text of Mozilla Public License 2.0 by -reference. The complete MPL-2.0 text is available at: -https://www.mozilla.org/en-US/MPL/2.0/ - -All terms, conditions, and definitions from MPL-2.0 apply except where -explicitly modified by the Exhibits in this License. - --------------------------------------------------------------------------------- -SECTION 2: ADDITIONAL DEFINITIONS --------------------------------------------------------------------------------- - -2.1. "Emotional Lineage" - means the narrative, cultural, symbolic, and contextual meaning embedded - in Covered Software, including but not limited to: protest traditions, - cultural heritage, trauma narratives, and community stories. - -2.2. "Provenance Metadata" - means cryptographically signed attribution information attached to or - associated with Covered Software, including author identities, timestamps, - modification history, and lineage references. - -2.3. "Non-Interpretive System" - means any automated system that processes Covered Software without - preserving or considering its Emotional Lineage, including but not - limited to: AI training pipelines, content aggregators, and automated - summarization tools. - -2.4. "Quantum-Safe Signature" - means a cryptographic signature using algorithms resistant to attacks - by quantum computers, as specified in Exhibit B. - --------------------------------------------------------------------------------- -SECTION 3: ETHICAL USE REQUIREMENTS --------------------------------------------------------------------------------- - -In addition to the rights and obligations under MPL-2.0: - -3.1. Emotional Lineage Preservation - You must make reasonable efforts to preserve and communicate the - Emotional Lineage of Covered Software when distributing or creating - derivative works. This includes maintaining narrative context, cultural - attributions, and symbolic meaning where documented. - -3.2. Non-Interpretive System Notice - If You use Covered Software as input to a Non-Interpretive System, You - must: - (a) document such use in a publicly accessible manner; and - (b) not claim that outputs of such systems carry the Emotional Lineage - of the original work without explicit permission from Contributors. - -3.3. Ethical Use Declaration - Commercial use of Covered Software requires acknowledgment that You have - read and understood Exhibit A (Ethical Use Guidelines) and agree to act - in good faith accordance with its principles. - -See Exhibit A for complete Ethical Use Guidelines. - --------------------------------------------------------------------------------- -SECTION 4: PROVENANCE REQUIREMENTS --------------------------------------------------------------------------------- - -4.1. Metadata Preservation - You must not strip, alter, or obscure Provenance Metadata from Covered - Software except where technically necessary and with clear documentation - of any changes. - -4.2. Quantum-Safe Provenance (Optional) - Contributors may sign their Contributions using Quantum-Safe Signatures. - If Quantum-Safe Signatures are present, You must preserve them in all - distributions. - -4.3. Lineage Chain - When creating derivative works, You should extend the provenance chain - to include Your own contributions, maintaining cryptographic linkage to - prior Contributors where feasible. - -See Exhibit B for Quantum-Safe Provenance specifications. - --------------------------------------------------------------------------------- -SECTION 5: GOVERNANCE --------------------------------------------------------------------------------- - -5.1. Stewardship Council - This License is maintained by the Palimpsest Stewardship Council, which - may issue clarifications, interpretive guidance, and future versions. - -5.2. Version Selection - You may use Covered Software under this version of the License or any - later version published by the Palimpsest Stewardship Council. - -5.3. Dispute Resolution - Disputes regarding interpretation of Ethical Use Requirements (Section 3) - should first be submitted to the Palimpsest Stewardship Council for - non-binding guidance before pursuing legal remedies. - --------------------------------------------------------------------------------- -SECTION 6: COMPATIBILITY --------------------------------------------------------------------------------- - -6.1. MPL-2.0 Compatibility - Covered Software under this License may be combined with software under - MPL-2.0. The combined work must comply with both licenses. - -6.2. Secondary Licenses - The Secondary License provisions of MPL-2.0 Section 3.3 apply to this - License. - --------------------------------------------------------------------------------- -EXHIBITS --------------------------------------------------------------------------------- - -Exhibit A - Ethical Use Guidelines -Exhibit B - Quantum-Safe Provenance Specification - -See separate files: -- EXHIBIT-A-ETHICAL-USE.txt -- EXHIBIT-B-QUANTUM-SAFE.txt - --------------------------------------------------------------------------------- -END OF PALIMPSEST-MPL LICENSE VERSION 1.0 --------------------------------------------------------------------------------- - -For questions about this License: -- Repository: https://github.com/hyperpolymath/palimpsest-license -- Council: contact via repository Issues diff --git a/avow-protocol/telegram-bot/MAINTAINERS.adoc b/avow-protocol/telegram-bot/MAINTAINERS.adoc deleted file mode 100644 index 48d97817..00000000 --- a/avow-protocol/telegram-bot/MAINTAINERS.adoc +++ /dev/null @@ -1,47 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Maintainers -:toc: preamble - -This document lists the maintainers of this project and their responsibilities. - -== Current Maintainers - -[cols="2,3,2",options="header"] -|=== -| Name | Role | Contact - -| Jonathan D.A. Jewell -| Lead Maintainer -| https://github.com/hyperpolymath[@hyperpolymath] -|=== - -== Responsibilities - -Maintainers are responsible for: - -* Reviewing and merging pull requests -* Triaging issues and feature requests -* Ensuring code quality and security standards -* Managing releases and versioning -* Upholding the project's code of conduct - -== Becoming a Maintainer - -Contributors who demonstrate: - -* Consistent, high-quality contributions -* Understanding of the project's goals and standards -* Constructive participation in discussions -* Commitment to the project's long-term health - -May be invited to become maintainers at the discretion of existing maintainers. - -== Decision Making - -* Routine decisions (bug fixes, minor improvements) can be made by any maintainer -* Significant changes require discussion and consensus among maintainers -* Breaking changes or major features should be discussed in issues before implementation - -== Contact - -For questions about project governance, open an issue or contact the maintainers listed above. diff --git a/avow-protocol/telegram-bot/NEXT-STEPS.md b/avow-protocol/telegram-bot/NEXT-STEPS.md deleted file mode 100644 index bfe28cfe..00000000 --- a/avow-protocol/telegram-bot/NEXT-STEPS.md +++ /dev/null @@ -1,307 +0,0 @@ -# Next Steps: Deploy Your STAMP Bot - -## ✅ What You Have Now - -``` -stamp-telegram-bot/ -├── src/ -│ ├── bot.ts ✓ # Complete Telegram bot (400+ lines) -│ ├── database.ts ✓ # SQLite persistence -│ └── stamp-mock.ts ✓ # Mock verification library -├── test-mock.ts ✓ # Unit tests (all passing) -├── deno.json ✓ # Deno configuration -├── .env.example ✓ # Environment template -├── .gitignore ✓ # Git ignore rules -└── README.md ✓ # Complete documentation -``` - -**Status:** 100% functional, ready to deploy! - -## Quick Start (5 Minutes) - -### 1. Get Bot Token - -Open Telegram, search for `@BotFather`: - -``` -You: /newbot -BotFather: Alright, a new bot. How are we going to call it? - -You: STAMP Demo Bot -BotFather: Good. Now let's choose a username for your bot. - -You: stamp_demo_123_bot -BotFather: Done! Your token is: 1234567890:ABCdefGHIjklMNOpqrsTUVwxyz -``` - -### 2. Configure - -```bash -cd ~/Documents/hyperpolymath-repos/stamp-telegram-bot - -# Create config file -cp .env.example .env - -# Add your token -echo "BOT_TOKEN=1234567890:ABCdefGHIjklMNOpqrsTUVwxyz" > .env -``` - -### 3. Run - -```bash -deno task start -``` - -You'll see: -``` -🤖 STAMP Telegram Bot starting... -✓ Bot initialized -✓ Database connected -✓ Demo messages scheduled (every hour) - -🚀 Bot is now running! -``` - -### 4. Test - -Open Telegram, find your bot, send: -``` -/start -``` - -You should get: -``` -✓ Subscription Confirmed - -Consent Chain Verified: -└─ Requested: 2026-01-30T10:00:00.000Z -└─ Confirmed: /start command (explicit) -└─ Token: 1234567890_abc123... -└─ Proof: Cryptographically signed ✓ -``` - -**Try:** -- `/verify` - See cryptographic proof -- `/status` - Show subscription details -- `/unsubscribe` - Unsubscribe (one-click, proven) - -## What the Bot Demonstrates - -### For Users: -- ✓ **Easy subscribe** - One command -- ✓ **See proofs** - Cryptographic verification visible -- ✓ **Easy unsubscribe** - One command, mathematically proven to work -- ✓ **Transparency** - All actions include proofs - -### For Investors/Partners: -- ✓ **Working prototype** - Not just slides -- ✓ **Novel tech** - Formal verification in messaging -- ✓ **Clear value prop** - Solves real pain (spam, unsubscribe) -- ✓ **Generalizable** - Works for email, social media, etc. - -## Demo Script (For Meetings) - -**Setup** (before meeting): -1. Deploy bot -2. Subscribe with your account -3. Take screenshots of `/verify` output - -**During meeting** (5 minutes): - -1. **Show the problem** (1 min) - - "Email unsubscribe often doesn't work" - - "No proof consent was given" - - Pull up examples of dark patterns - -2. **Live demo** (3 min) - - Open Telegram - - `/start` - Show consent chain with proof - - Receive demo message - - `/verify` - Show cryptographic proof - - `/unsubscribe` - Show proof of removal - -3. **Explain the tech** (1 min) - - "Uses dependent types for formal verification" - - "Idris2 proves properties at compile time" - - "Cannot create invalid messages - mathematically impossible" - - "This works for any messaging: email, social media, etc." - -4. **Show traction path** - - Week 1: ✓ Telegram bot (done!) - - Week 2-3: Dating app pilot - - Month 3-4: Reddit integration - - Month 6: Apple/Google approach - -## Deployment Options - -### Option 1: Local (For Testing - Now) - -```bash -# Run in terminal -deno task start - -# Or: Run in background with screen -screen -S stamp-bot -deno task start -# Ctrl+A, D to detach - -# Later: Reattach -screen -r stamp-bot -``` - -### Option 2: fly.io (For Production - 10 minutes) - -```bash -# Install flyctl -curl -L https://fly.io/install.sh | sh - -# Login -fly auth login - -# Deploy -cd ~/Documents/hyperpolymath-repos/stamp-telegram-bot -fly launch --name stamp-bot - -# Set bot token -fly secrets set BOT_TOKEN=your_token_here - -# Deploy -fly deploy - -# Check logs -fly logs -``` - -**Cost:** Free tier (good for demo) - -### Option 3: VPS (DigitalOcean, Linode, etc.) - -```bash -# SSH to VPS -ssh user@your-server.com - -# Install Deno -curl -fsSL https://deno.land/install.sh | sh - -# Clone repo (or scp files) -git clone https://github.com/yourusername/stamp-telegram-bot -cd stamp-telegram-bot - -# Configure -echo "BOT_TOKEN=your_token_here" > .env - -# Run with systemd (stays running) -sudo nano /etc/systemd/system/stamp-bot.service -``` - -`/etc/systemd/system/stamp-bot.service`: -```ini -[Unit] -Description=STAMP Telegram Bot -After=network.target - -[Service] -Type=simple -User=youruser -WorkingDirectory=/home/youruser/stamp-telegram-bot -ExecStart=/home/youruser/.deno/bin/deno task start -Restart=always - -[Install] -WantedBy=multi-user.target -``` - -```bash -# Start service -sudo systemctl enable stamp-bot -sudo systemctl start stamp-bot - -# Check status -sudo systemctl status stamp-bot -``` - -## Week 1 Checklist - -- [x] Mock STAMP library ✓ -- [x] Telegram bot with all commands ✓ -- [x] Database persistence ✓ -- [x] Unit tests ✓ -- [x] Documentation ✓ -- [ ] Deploy bot (DO THIS TODAY!) -- [ ] Get 5-10 people to test -- [ ] Collect feedback -- [ ] Record demo video (2 minutes) - -## Week 2 Goals - -- [ ] Integrate real libstamp (Idris2 + Zig FFI) -- [ ] Replace mocks with real verification -- [ ] Add real cryptographic signatures -- [ ] Performance benchmarks -- [ ] Write dating app one-pager - -## Common Issues - -### Bot doesn't respond - -**Check:** -```bash -# Is bot running? -ps aux | grep deno - -# Any errors? -tail -f logs.txt # If you redirected output - -# Network connectivity? -ping api.telegram.org -``` - -**Solution:** -- Verify BOT_TOKEN in .env -- Check bot username matches what you set -- Restart bot - -### Database permission errors - -```bash -# Fix permissions -chmod 755 db/ -chmod 644 db/*.db -``` - -### Rate limiting from Telegram - -Bot can send: -- 30 messages/second to different users -- 1 message/second to same user - -If you hit limits: -- Add delays between messages -- Reduce demo message frequency - -## Getting Help - -**If stuck:** -1. Check README.md -2. Run tests: `deno run test-mock.ts` -3. Check logs for errors -4. Ask me for help! - -## Success Criteria - -You know it's working when: -- ✓ Bot responds to /start -- ✓ You receive demo message -- ✓ /verify shows proof -- ✓ /unsubscribe works -- ✓ No more messages after unsubscribe - -**Then:** Show 5 people, get feedback, iterate! - ---- - -**Ready to deploy?** Run the Quick Start above, then message me if you hit any issues. - -**Want to show someone?** Use the demo script above. - -**Ready for Week 2?** We'll integrate real libstamp with Zig FFI. diff --git a/avow-protocol/telegram-bot/README.adoc b/avow-protocol/telegram-bot/README.adoc deleted file mode 100644 index 47a9ef24..00000000 --- a/avow-protocol/telegram-bot/README.adoc +++ /dev/null @@ -1,101 +0,0 @@ -= RSR template repo - see RSR_OUTLINE.adoc in root for general background and specification - -== This is your repo - don't forget to rename me! - -== ABI/FFI Standards (Hyperpolymath Universal Standard) - -**All repos with foreign function interfaces MUST follow this standard:** - -* **ABI (Application Binary Interface)** → **Idris2** (`src/abi/*.idr`) -** Type definitions with dependent type proofs -** Memory layout verification -** Platform-specific ABIs with compile-time selection -** Formal verification of interface correctness - -* **FFI (Foreign Function Interface)** → **Zig** (`ffi/zig/src/*.zig`) -** C-compatible function implementations -** Zero-cost abstractions -** Memory-safe by default -** Cross-compilation support - -* **Generated C Headers** → Auto-generated from Idris2 ABI (`generated/abi/*.h`) -** Bridge between Idris2 and Zig -** Consumed by any language via C ABI - -**Directory Structure:** ----- -project/ -├── src/abi/ # Idris2 ABI definitions (REQUIRED) -├── ffi/zig/ # Zig FFI implementation (REQUIRED) -├── generated/abi/ # Auto-generated C headers -└── bindings/ # Language-specific wrappers (optional) ----- - -**See:** `ABI-FFI-README.md` for complete documentation - -== AI CLI standards - -- Include `ai-cli-crash-capture/` and `contractiles/` from this template in new repos. -- Mirror 6SCM files into `.machine_readable/` (NOT `.machine_readable/6scm/`). -- Before any code generation, check `$REPOS_DIR/proven` for the current Idris "unbreakable" library status. -- If a project uses that Idris library, add an *Idris Inside* badge to the repo. -- If new bindings are required, add them in `$REPOS_DIR/proven` as `idris2-zig-` during the work. -- If new code suggests additional "unbreakable" Idris modules, add them under `$REPOS_DIR/proven` and update binders across all supported languages. - -== Standard Dependencies - -=== Web Projects - -ReScript web projects in the hyperpolymath ecosystem **MUST** use these formally verified components: - -[cols="1,2,1"] -|=== -|Library |Purpose |Status - -|link:https://github.com/hyperpolymath/rescript-dom-mounter[rescript-dom-mounter] -|Formally verified DOM mounting -|**REQUIRED** - -|link:https://github.com/hyperpolymath/rescript-tea[rescript-tea] -|TEA architecture framework -|Recommended - -|link:https://github.com/hyperpolymath/cadre-tea-router[cadre-tea-router] -|Proven-safe URL routing -|Recommended - -|link:https://github.com/hyperpolymath/proven[proven] -|Idris2 formally verified library -|Core Dependency -|=== - -==== Why SafeDOM is Required - -Traditional DOM mounting can fail: - -[source,javascript] ----- -// ❌ UNSAFE: Can crash with null pointer -const el = document.getElementById('app') -el.innerHTML = html // 💥 ----- - -SafeDOM provides **compile-time proofs** that DOM operations cannot fail: - -[source,rescript] ----- -// ✅ PROVEN SAFE: Mathematically guaranteed -SafeDOM.mountSafe("#app", html, - ~onSuccess=el => Console.log("Success"), - ~onError=err => Console.error(err)) ----- - -**Mathematical Guarantees:** - -✓ No null pointer dereferences (Idris2 proof) -✓ No invalid CSS selectors (dependent types) -✓ No malformed HTML (balanced tag checking) -✓ Type-safe operations (ReScript + Idris2) -✓ Zero runtime overhead (proofs erased) - -See link:https://github.com/hyperpolymath/rescript-dom-mounter[rescript-dom-mounter documentation] for full details. diff --git a/avow-protocol/telegram-bot/ROADMAP.adoc b/avow-protocol/telegram-bot/ROADMAP.adoc deleted file mode 100644 index d482e0f8..00000000 --- a/avow-protocol/telegram-bot/ROADMAP.adoc +++ /dev/null @@ -1,22 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Telegram Bot Roadmap - -== Current Status - -Initial development phase. - -== Milestones - -=== v0.1.0 - Foundation -* [ ] Core functionality -* [ ] Basic documentation -* [ ] CI/CD pipeline - -=== v1.0.0 - Stable Release -* [ ] Full feature set -* [ ] Comprehensive tests -* [ ] Production ready - -== Future Directions - -_To be determined based on community feedback._ diff --git a/avow-protocol/telegram-bot/RSR_OUTLINE.adoc b/avow-protocol/telegram-bot/RSR_OUTLINE.adoc deleted file mode 100644 index 94a49d83..00000000 --- a/avow-protocol/telegram-bot/RSR_OUTLINE.adoc +++ /dev/null @@ -1,218 +0,0 @@ -= RSR Template Repository - -image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] -:toc: -:sectnums: - -// Badges -image:https://img.shields.io/badge/RSR-Infrastructure-cd7f32[RSR Infrastructure] -image:https://img.shields.io/badge/Phase-Maintenance-brightgreen[Phase] -image:https://img.shields.io/badge/Guix-Primary-purple?logo=gnu[Guix] - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This repository provides the standardized structure, configuration, and tooling for all 139 repos in the hyperpolymath ecosystem. Use it to: - -* Bootstrap new projects with RSR compliance -* Reference the standard directory structure -* Copy configuration templates (Justfile, STATE.scm, etc.) - -== Quick Start - -[source,bash] ----- -# Clone the template -git clone https://github.com/hyperpolymath/RSR-template-repo my-project -cd my-project - -# Remove template git history -rm -rf .git -git init - -# Customize -sed -i 's/RSR-template-repo/my-project/g' Justfile guix.scm README.adoc - -# Enter development environment -guix shell -D -f guix.scm - -# Validate compliance -just validate-rsr ----- - -== What's Included - -[cols="1,3"] -|=== -|File/Directory |Purpose - -|`.editorconfig` -|Editor configuration (indent, charset) - -|`.gitignore` -|Standard ignore patterns - -|`.guix-channel` -|Guix channel definition - -|`.well-known/` -|RFC-compliant metadata (security.txt, ai.txt, humans.txt) - -|`docs/` -|Documentation directory - -|`guix.scm` -|Guix package definition - -|`justfile` -|Task runner with 50+ recipes - -|`LICENSE.txt` -|AGPL + Palimpsest dual license - -|`README.adoc` -|This file - -|`RSR_COMPLIANCE.adoc` -|Compliance tracking - -|`STATE.scm` -|Project state checkpoint -|=== - -== Justfile Features - -The template Justfile provides: - -* **~10 billion recipe combinations** via matrix recipes -* **Cookbook generation**: `just cookbook` → `docs/just-cookbook.adoc` -* **Man page generation**: `just man` → `docs/man/project.1` -* **RSR validation**: `just validate-rsr` -* **STATE.scm management**: `just state-touch`, `just state-phase` -* **Container support**: `just container-build`, `just container-push` -* **CI matrix**: `just ci-matrix [stage] [depth]` - -=== Key Recipes - -[source,bash] ----- -just # Show all recipes -just help # Detailed help -just info # Project info -just combinations # Show matrix options - -just build # Build (debug) -just test # Run tests -just quality # Format + lint + test -just ci # Full CI pipeline - -just validate # RSR + STATE validation -just docs # Generate all docs -just cookbook # Generate Justfile docs - -just guix-shell # Guix dev environment -just container-build # Build container ----- - -== Directory Structure - -[source] ----- -project/ -├── .editorconfig # Editor settings -├── .gitignore # Git ignore -├── .guix-channel # Guix channel -├── .well-known/ # RFC metadata -│ ├── ai.txt -│ ├── humans.txt -│ └── security.txt -├── config/ # Nickel configs (optional) -├── docs/ # Documentation -│ ├── generated/ -│ ├── man/ -│ └── just-cookbook.adoc -├── guix.scm # Guix package -├── Justfile # Task runner -├── LICENSE.txt # Dual license -├── README.adoc # Overview -├── RSR_COMPLIANCE.adoc # Compliance -├── src/ # Source code -├── STATE.scm # State checkpoint -└── tests/ # Tests ----- - -== RSR Compliance - -=== Language Tiers - -* **Tier 1** (Gold): Rust, Elixir, Zig, Ada, Haskell, ReScript -* **Tier 2** (Silver): Nickel, Racket, Guile Scheme, Nix -* **Infrastructure**: Guix channels, derivations - -=== Required Files - -* `.editorconfig` -* `.gitignore` -* `justfile` -* `README.adoc` -* `RSR_COMPLIANCE.adoc` -* `LICENSE.txt` (AGPL + Palimpsest) -* `.well-known/security.txt` -* `.well-known/ai.txt` -* `.well-known/humans.txt` -* `guix.scm` OR `flake.nix` - -=== Prohibited - -* Python outside `salt/` directory -* TypeScript/JavaScript (use ReScript) -* CUE (use Guile/Nickel) -* `Dockerfile` (use `Containerfile`) - -== STATE.scm - -The STATE.scm file tracks project state: - -[source,scheme] ----- -(define state - `((metadata - (project . "my-project") - (updated . "2025-12-10")) - (position - (phase . implementation) ; design|implementation|testing|maintenance|archived - (maturity . beta)) ; experimental|alpha|beta|production|lts - (ecosystem - (part-of . ("RSR Framework")) - (depends-on . ())))) ----- - -== Badge Schema - -Generate badges from STATE.scm: - -[source,bash] ----- -just badges standard ----- - -See `docs/BADGE_SCHEMA.adoc` for the full badge taxonomy. - -== Ecosystem Integration - -This template is part of: - -* **STATE.scm Ecosystem**: Conversation checkpoints -* **RSR Framework**: Repository standards -* **Consent-Aware-HTTP**: .well-known compliance - -== License - -SPDX-License-Identifier: MPL-2.0 - -== Links - -* https://github.com/hyperpolymath/elegant-STATE[elegant-STATE] - STATE.scm tooling -* https://github.com/hyperpolymath/conative-gating[conative-gating] - Policy enforcement -* https://rhodium.sh[Rhodium Standard] - RSR documentation diff --git a/avow-protocol/telegram-bot/SECURITY.md b/avow-protocol/telegram-bot/SECURITY.md deleted file mode 100644 index 7e0cf11f..00000000 --- a/avow-protocol/telegram-bot/SECURITY.md +++ /dev/null @@ -1,406 +0,0 @@ -# Security Policy - - - -We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. - -## Table of Contents - -- [Reporting a Vulnerability](#reporting-a-vulnerability) -- [What to Include](#what-to-include) -- [Response Timeline](#response-timeline) -- [Disclosure Policy](#disclosure-policy) -- [Scope](#scope) -- [Safe Harbour](#safe-harbour) -- [Recognition](#recognition) -- [Security Updates](#security-updates) -- [Security Best Practices](#security-best-practices) - ---- - -## Reporting a Vulnerability - -### Preferred Method: GitHub Security Advisories - -The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature: - -1. Navigate to [Report a Vulnerability](https://github.com/hyperpolymath/standards/security/advisories/new) -2. Click **"Report a vulnerability"** -3. Complete the form with as much detail as possible -4. Submit — we'll receive a private notification - -This method ensures: - -- End-to-end encryption of your report -- Private discussion space for collaboration -- Coordinated disclosure tooling -- Automatic credit when the advisory is published - -### Alternative: Encrypted Email - -If you cannot use GitHub Security Advisories, you may email us directly: - -| | | -|---|---| -| **Email** | 6759885+hyperpolymath@users.noreply.github.com | -| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) | -| **Fingerprint** | `[PGP fingerprint not set]` | - -```bash -# Import our PGP key -curl -sSL {{PGP_KEY_URL}} | gpg --import - -# Verify fingerprint -gpg --fingerprint 6759885+hyperpolymath@users.noreply.github.com - -# Encrypt your report -gpg --armor --encrypt --recipient 6759885+hyperpolymath@users.noreply.github.com report.txt -``` - -> **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. - ---- - -## What to Include - -A good vulnerability report helps us understand and reproduce the issue quickly. - -### Required Information - -- **Description**: Clear explanation of the vulnerability -- **Impact**: What an attacker could achieve (confidentiality, integrity, availability) -- **Affected versions**: Which versions/commits are affected -- **Reproduction steps**: Detailed steps to reproduce the issue - -### Helpful Additional Information - -- **Proof of concept**: Code, scripts, or screenshots demonstrating the vulnerability -- **Attack scenario**: Realistic attack scenario showing exploitability -- **CVSS score**: Your assessment of severity (use [CVSS 3.1 Calculator](https://www.first.org/cvss/calculator/3.1)) -- **CWE ID**: Common Weakness Enumeration identifier if known -- **Suggested fix**: If you have ideas for remediation -- **References**: Links to related vulnerabilities, research, or advisories - -### Example Report Structure - -```markdown -## Summary -[One-sentence description of the vulnerability] - -## Vulnerability Type -[e.g., SQL Injection, XSS, SSRF, Path Traversal, etc.] - -## Affected Component -[File path, function name, API endpoint, etc.] - -## Affected Versions -[Version range or specific commits] - -## Severity Assessment -- CVSS 3.1 Score: [X.X] -- CVSS Vector: [CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X] - -## Description -[Detailed technical description] - -## Steps to Reproduce -1. [First step] -2. [Second step] -3. [...] - -## Proof of Concept -[Code, curl commands, screenshots, etc.] - -## Impact -[What can an attacker achieve?] - -## Suggested Remediation -[Optional: your ideas for fixing] - -## References -[Links to related issues, CVEs, research] -``` - ---- - -## Response Timeline - -We commit to the following response times: - -| Stage | Timeframe | Description | -|-------|-----------|-------------| -| **Initial Response** | 48 hours | We acknowledge receipt and confirm we're investigating | -| **Triage** | 7 days | We assess severity, confirm the vulnerability, and estimate timeline | -| **Status Update** | Every 7 days | Regular updates on remediation progress | -| **Resolution** | 90 days | Target for fix development and release (complex issues may take longer) | -| **Disclosure** | 90 days | Public disclosure after fix is available (coordinated with you) | - -> **Note:** These are targets, not guarantees. Complex vulnerabilities may require more time. We'll communicate openly about any delays. - ---- - -## Disclosure Policy - -We follow **coordinated disclosure** (also known as responsible disclosure): - -1. **You report** the vulnerability privately -2. **We acknowledge** and begin investigation -3. **We develop** a fix and prepare a release -4. **We coordinate** disclosure timing with you -5. **We publish** security advisory and fix simultaneously -6. **You may publish** your research after disclosure - -### Our Commitments - -- We will not take legal action against researchers who follow this policy -- We will work with you to understand and resolve the issue -- We will credit you in the security advisory (unless you prefer anonymity) -- We will notify you before public disclosure -- We will publish advisories with sufficient detail for users to assess risk - -### Your Commitments - -- Report vulnerabilities promptly after discovery -- Give us reasonable time to address the issue before disclosure -- Do not access, modify, or delete data beyond what's necessary to demonstrate the vulnerability -- Do not degrade service availability (no DoS testing on production) -- Do not share vulnerability details with others until coordinated disclosure - -### Disclosure Timeline - -``` -Day 0 You report vulnerability -Day 1-2 We acknowledge receipt -Day 7 We confirm vulnerability and share initial assessment -Day 7-90 We develop and test fix -Day 90 Coordinated public disclosure - (earlier if fix is ready; later by mutual agreement) -``` - -If we cannot reach agreement on disclosure timing, we default to 90 days from your initial report. - ---- - -## Scope - -### In Scope ✅ - -The following are within scope for security research: - -- This repository (`hyperpolymath/standards`) and all its code -- Official releases and packages published from this repository -- Documentation that could lead to security issues -- Build and deployment configurations in this repository -- Dependencies (report here, we'll coordinate with upstream) - -### Out of Scope ❌ - -The following are **not** in scope: - -- Third-party services we integrate with (report directly to them) -- Social engineering attacks against maintainers -- Physical security -- Denial of service attacks against production infrastructure -- Spam, phishing, or other non-technical attacks -- Issues already reported or publicly known -- Theoretical vulnerabilities without proof of concept - -### Qualifying Vulnerabilities - -We're particularly interested in: - -- Remote code execution -- SQL injection, command injection, code injection -- Authentication/authorisation bypass -- Cross-site scripting (XSS) and cross-site request forgery (CSRF) -- Server-side request forgery (SSRF) -- Path traversal / local file inclusion -- Information disclosure (credentials, PII, secrets) -- Cryptographic weaknesses -- Deserialisation vulnerabilities -- Memory safety issues (buffer overflows, use-after-free, etc.) -- Supply chain vulnerabilities (dependency confusion, etc.) -- Significant logic flaws - -### Non-Qualifying Issues - -The following generally do not qualify as security vulnerabilities: - -- Missing security headers on non-sensitive pages -- Clickjacking on pages without sensitive actions -- Self-XSS (requires victim to paste code) -- Missing rate limiting (unless it enables a specific attack) -- Username/email enumeration (unless high-risk context) -- Missing cookie flags on non-sensitive cookies -- Software version disclosure -- Verbose error messages (unless exposing secrets) -- Best practice deviations without demonstrable impact - ---- - -## Safe Harbour - -We support security research conducted in good faith. - -### Our Promise - -If you conduct security research in accordance with this policy: - -- ✅ We will not initiate legal action against you -- ✅ We will not report your activity to law enforcement -- ✅ We will work with you in good faith to resolve issues -- ✅ We consider your research authorised under the Computer Fraud and Abuse Act (CFAA), UK Computer Misuse Act, and similar laws -- ✅ We waive any potential claim against you for circumvention of security controls - -### Good Faith Requirements - -To qualify for safe harbour, you must: - -- Comply with this security policy -- Report vulnerabilities promptly -- Avoid privacy violations (do not access others' data) -- Avoid service degradation (no destructive testing) -- Not exploit vulnerabilities beyond proof-of-concept -- Not use vulnerabilities for profit (beyond bug bounties where offered) - -> **⚠️ Important:** This safe harbour does not extend to third-party systems. Always check their policies before testing. - ---- - -## Recognition - -We believe in recognising security researchers who help us improve. - -### Hall of Fame - -Researchers who report valid vulnerabilities will be acknowledged in our [Security Acknowledgments](SECURITY-ACKNOWLEDGMENTS.md) (unless they prefer anonymity). - -Recognition includes: - -- Your name (or chosen alias) -- Link to your website/profile (optional) -- Brief description of the vulnerability class -- Date of report - -### What We Offer - -- ✅ Public credit in security advisories -- ✅ Acknowledgment in release notes -- ✅ Entry in our Hall of Fame -- ✅ Reference/recommendation letter upon request (for significant findings) - -### What We Don't Currently Offer - -- ❌ Monetary bug bounties -- ❌ Hardware or swag -- ❌ Paid security research contracts - -> **Note:** We're a community project with limited resources. Your contributions help everyone who uses this software. - ---- - -## Security Updates - -### Receiving Updates - -To stay informed about security updates: - -- **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts" -- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/standards/security/advisories) -- **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md) - -### Update Policy - -| Severity | Response | -|----------|----------| -| **Critical/High** | Patch release as soon as fix is ready | -| **Medium** | Included in next scheduled release (or earlier) | -| **Low** | Included in next scheduled release | - -### Supported Versions - - - -| Version | Supported | Notes | -|---------|-----------|-------| -| `main` branch | ✅ Yes | Latest development | -| Latest release | ✅ Yes | Current stable | -| Previous minor release | ✅ Yes | Security fixes backported | -| Older versions | ❌ No | Please upgrade | - ---- - -## Security Best Practices - -When using Standards, we recommend: - -### General - -- Keep dependencies up to date -- Use the latest stable release -- Subscribe to security notifications -- Review configuration against security documentation -- Follow principle of least privilege - -### For Contributors - -- Never commit secrets, credentials, or API keys -- Use signed commits (`git config commit.gpgsign true`) -- Review dependencies before adding them -- Run security linters locally before pushing -- Report any concerns about existing code - ---- - -## Additional Resources - -- [Our PGP Public Key]({{PGP_KEY_URL}}) -- [Security Advisories](https://github.com/hyperpolymath/standards/security/advisories) -- [Changelog](CHANGELOG.md) -- [Contributing Guidelines](CONTRIBUTING.md) -- [CVE Database](https://cve.mitre.org/) -- [CVSS Calculator](https://www.first.org/cvss/calculator/3.1) - ---- - -## Contact - -| Purpose | Contact | -|---------|---------| -| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/standards/security/advisories/new) or 6759885+hyperpolymath@users.noreply.github.com | -| **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/standards/discussions) | -| **Other enquiries** | See [README](README.adoc) for contact information | - ---- - -## Policy Changes - -This security policy may be updated from time to time. Significant changes will be: - -- Committed to this repository with a clear commit message -- Noted in the changelog -- Announced via GitHub Discussions (for major changes) - ---- - -*Thank you for helping keep Standards and its users safe.* 🛡️ - ---- - -Last updated: 2026 · Policy version: 1.0.0 diff --git a/avow-protocol/telegram-bot/TESTING-GUIDE.md b/avow-protocol/telegram-bot/TESTING-GUIDE.md deleted file mode 100644 index 2ad3c3d9..00000000 --- a/avow-protocol/telegram-bot/TESTING-GUIDE.md +++ /dev/null @@ -1,151 +0,0 @@ -# STAMP Bot Testing Guide - -## 🎯 Goal -Get 3-5 people to test @stamp_demo_bot and provide feedback on: -- Ease of use -- Clarity of proofs -- Understanding of STAMP value proposition -- Any bugs or confusion - -## 👥 Who to Ask - -**Best testers:** -- Tech-savvy friends (understand proofs) -- Non-technical family (test clarity) -- Marketing/business contacts (value prop feedback) -- Security-minded people (appreciate verification) - -## 📧 Message Template - -``` -Hey! I just launched a demo of STAMP Protocol - a new approach to -fighting spam using formal verification (mathematical proofs). - -Could you test it? Takes 2 minutes: - -1. Open Telegram -2. Search: @stamp_demo_bot -3. Send: /start -4. Try: /verify, /status, /unsubscribe - -Would love your feedback: -- Was it clear what's happening? -- Did the "proof" make sense? -- Would you trust this more than regular email? - -Thanks! 🙏 - -Live site: https://stamp-protocol.org -``` - -## 📋 Feedback Form - -Send testers this form to fill out: - -``` -STAMP Bot Feedback - -Name: ___________ -Date: ___________ - -1. First impressions (1-5): ☐☐☐☐☐ - -2. Did the consent proof make sense? - ☐ Yes, totally clear - ☐ Sort of understood it - ☐ Confusing - -3. Most valuable feature: - ☐ Proven consent - ☐ Working unsubscribe - ☐ Rate limiting - ☐ Transparency - -4. Would you use this for: - ☐ Email newsletters - ☐ Social media - ☐ Business messaging - ☐ Other: ___________ - -5. What's confusing or broken? - _________________________________ - _________________________________ - -6. What would make this better? - _________________________________ - _________________________________ - -7. Would you recommend this? ☐ Yes ☐ Maybe ☐ No - -8. Additional comments: - _________________________________ - _________________________________ -``` - -## 📊 Success Metrics - -**Minimum viable feedback:** -- 3 people tested successfully -- At least 2 understood the value prop -- 0 critical bugs found -- Average rating: 3+/5 - -**Ideal feedback:** -- 5+ people tested -- All understood value prop -- Feature requests noted -- Average rating: 4+/5 - -## 🐛 Known Issues to Watch For - -- Slow response times (bot lag) -- Unclear proof formatting -- Confusing terminology ("dependent types", "formal verification") -- Missing help text - -## 📝 How to Collect Feedback - -**Option 1: Direct messages** -- Send them the form above -- Ask follow-up questions -- Take notes - -**Option 2: Video call** -- Watch them use it (screen share) -- Note where they get confused -- Ask questions as they go - -**Option 3: Survey tool** -- Use Google Forms / Typeform -- Send link after they test -- Analyze responses - -## 🔄 After Testing - -1. **Compile feedback** → `~/stamp-bot-feedback.md` -2. **Identify patterns** (most common confusion) -3. **Prioritize fixes** (critical vs nice-to-have) -4. **Update bot** based on feedback -5. **Thank testers** (offer early access, credit them) - -## 🎁 Tester Incentives - -- Early access to production version -- Credit on website ("Thanks to our beta testers") -- Free tier when we monetize -- Swag (if/when available) - -## ✅ Ready to Test - -1. Make sure bot is running: `pgrep -f bot.ts` -2. Test it yourself first (all commands work) -3. Send message to 3-5 people -4. Collect feedback over next 2-3 days -5. Compile results - -**Bot status check:** -```bash -cd ~/Documents/hyperpolymath-repos/stamp-telegram-bot -pgrep -f bot.ts && echo "✓ Bot running" || echo "✗ Start bot" -tail -20 bot.log # Check for errors -``` diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/.github/workflows/codeql.yml b/avow-protocol/telegram-bot/avow-telegram-bot/.github/workflows/codeql.yml deleted file mode 100644 index bfe47206..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/.github/workflows/codeql.yml +++ /dev/null @@ -1,42 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: CodeQL Security Analysis - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 6 * * 1' - - -permissions: read-all - -jobs: - analyze: - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - security-events: write - strategy: - fail-fast: false - matrix: - include: - - language: javascript-typescript - build-mode: none - - steps: - - name: Checkout - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - - name: Initialize CodeQL - uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 - with: - category: "/language:${{ matrix.language }}" diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/.github/workflows/governance.yml b/avow-protocol/telegram-bot/avow-telegram-bot/.github/workflows/governance.yml deleted file mode 100644 index b4062e02..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/.github/workflows/governance.yml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - contents: read - -jobs: - governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/.github/workflows/scorecard.yml b/avow-protocol/telegram-bot/avow-telegram-bot/.github/workflows/scorecard.yml deleted file mode 100644 index 95378b76..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/.github/workflows/scorecard.yml +++ /dev/null @@ -1,33 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard -on: - push: - branches: [main, master] - schedule: - - cron: '0 4 * * *' - workflow_dispatch: - -permissions: read-all - -jobs: - analysis: - runs-on: ubuntu-latest - timeout-minutes: 20 - permissions: - security-events: write - id-token: write - steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - with: - persist-credentials: false - - - name: Run Scorecard - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 - with: - results_file: results.sarif - results_format: sarif - - - name: Upload results - uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.31.8 - with: - sarif_file: results.sarif diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/.gitignore b/avow-protocol/telegram-bot/avow-telegram-bot/.gitignore deleted file mode 100644 index ab6ad6a3..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/.gitignore +++ /dev/null @@ -1,24 +0,0 @@ -# Environment -.env - -# Database -db/*.db -db/*.db-shm -db/*.db-wal - -# Deno -.deno/ - -# Logs -*.log - -# OS -.DS_Store -Thumbs.db - -# IDE -.vscode/ -.idea/ -*.swp -*.swo -*~ diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/ABI-FFI-README.md b/avow-protocol/telegram-bot/avow-telegram-bot/ABI-FFI-README.md deleted file mode 100644 index e6a32bbf..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/ABI-FFI-README.md +++ /dev/null @@ -1,385 +0,0 @@ -{{~ Aditionally delete this line and fill out the template below ~}} - -# {{PROJECT}} ABI/FFI Documentation - -## Overview - -This library follows the **Hyperpolymath RSR Standard** for ABI and FFI design: - -- **ABI (Application Binary Interface)** defined in **Idris2** with formal proofs -- **FFI (Foreign Function Interface)** implemented in **Zig** for C compatibility -- **Generated C headers** bridge Idris2 ABI to Zig FFI -- **Any language** can call through standard C ABI - -## Architecture - -``` -┌─────────────────────────────────────────────┐ -│ ABI Definitions (Idris2) │ -│ src/abi/ │ -│ - Types.idr (Type definitions) │ -│ - Layout.idr (Memory layout proofs) │ -│ - Foreign.idr (FFI declarations) │ -└─────────────────┬───────────────────────────┘ - │ - │ generates (at compile time) - ▼ -┌─────────────────────────────────────────────┐ -│ C Headers (auto-generated) │ -│ generated/abi/{{project}}.h │ -└─────────────────┬───────────────────────────┘ - │ - │ imported by - ▼ -┌─────────────────────────────────────────────┐ -│ FFI Implementation (Zig) │ -│ ffi/zig/src/main.zig │ -│ - Implements C-compatible functions │ -│ - Zero-cost abstractions │ -│ - Memory-safe by default │ -└─────────────────┬───────────────────────────┘ - │ - │ compiled to lib{{project}}.so/.a - ▼ -┌─────────────────────────────────────────────┐ -│ Any Language via C ABI │ -│ - Rust, ReScript, Julia, Python, etc. │ -└─────────────────────────────────────────────┘ -``` - -## Directory Structure - -``` -{{project}}/ -├── src/ -│ ├── abi/ # ABI definitions (Idris2) -│ │ ├── Types.idr # Core type definitions with proofs -│ │ ├── Layout.idr # Memory layout verification -│ │ └── Foreign.idr # FFI function declarations -│ └── lib/ # Core library (any language) -│ -├── ffi/ -│ └── zig/ # FFI implementation (Zig) -│ ├── build.zig # Build configuration -│ ├── build.zig.zon # Dependencies -│ ├── src/ -│ │ └── main.zig # C-compatible FFI implementation -│ ├── test/ -│ │ └── integration_test.zig -│ └── include/ -│ └── {{project}}.h # C header (optional, can be generated) -│ -├── generated/ # Auto-generated files -│ └── abi/ -│ └── {{project}}.h # Generated from Idris2 ABI -│ -└── bindings/ # Language-specific wrappers (optional) - ├── rust/ - ├── rescript/ - └── julia/ -``` - -## Why Idris2 for ABI? - -### 1. **Formal Verification** - -Idris2's dependent types allow proving properties about the ABI at compile-time: - -```idris --- Prove struct size is correct -public export -exampleStructSize : HasSize ExampleStruct 16 - --- Prove field alignment is correct -public export -fieldAligned : Divides 8 (offsetOf ExampleStruct.field) - --- Prove ABI is platform-compatible -public export -abiCompatible : Compatible (ABI 1) (ABI 2) -``` - -### 2. **Type Safety** - -Encode invariants that C/Zig cannot express: - -```idris --- Non-null pointer guaranteed at type level -data Handle : Type where - MkHandle : (ptr : Bits64) -> {auto 0 nonNull : So (ptr /= 0)} -> Handle - --- Array with length proof -data Buffer : (n : Nat) -> Type where - MkBuffer : Vect n Byte -> Buffer n -``` - -### 3. **Platform Abstraction** - -Platform-specific types with compile-time selection: - -```idris -CInt : Platform -> Type -CInt Linux = Bits32 -CInt Windows = Bits32 - -CSize : Platform -> Type -CSize Linux = Bits64 -CSize Windows = Bits64 -``` - -### 4. **Safe Evolution** - -Prove that new ABI versions are backward-compatible: - -```idris --- Compiler enforces compatibility -abiUpgrade : ABI 1 -> ABI 2 -abiUpgrade old = MkABI2 { - -- Must preserve all v1 fields - v1_compat = old, - -- Can add new fields - new_features = defaults -} -``` - -## Why Zig for FFI? - -### 1. **C ABI Compatibility** - -Zig exports C-compatible functions naturally: - -```zig -export fn library_function(param: i32) i32 { - return param * 2; -} -``` - -### 2. **Memory Safety** - -Compile-time safety without runtime overhead: - -```zig -// Null check enforced at compile time -const handle = init() orelse return error.InitFailed; -defer free(handle); -``` - -### 3. **Cross-Compilation** - -Built-in cross-compilation to any platform: - -```bash -zig build -Dtarget=x86_64-linux -zig build -Dtarget=aarch64-macos -zig build -Dtarget=x86_64-windows -``` - -### 4. **Zero Dependencies** - -No runtime, no libc required (unless explicitly needed): - -```zig -// Minimal binary size -pub const lib = @import("std"); -// Only includes what you use -``` - -## Building - -### Build FFI Library - -```bash -cd ffi/zig -zig build # Build debug -zig build -Doptimize=ReleaseFast # Build optimized -zig build test # Run tests -``` - -### Generate C Header from Idris2 ABI - -```bash -cd src/abi -idris2 --cg c-header Types.idr -o ../../generated/abi/{{project}}.h -``` - -### Cross-Compile - -```bash -cd ffi/zig - -# Linux x86_64 -zig build -Dtarget=x86_64-linux - -# macOS ARM64 -zig build -Dtarget=aarch64-macos - -# Windows x86_64 -zig build -Dtarget=x86_64-windows -``` - -## Usage - -### From C - -```c -#include "{{project}}.h" - -int main() { - void* handle = {{project}}_init(); - if (!handle) return 1; - - int result = {{project}}_process(handle, 42); - if (result != 0) { - const char* err = {{project}}_last_error(); - fprintf(stderr, "Error: %s\n", err); - } - - {{project}}_free(handle); - return 0; -} -``` - -Compile with: -```bash -gcc -o example example.c -l{{project}} -L./zig-out/lib -``` - -### From Idris2 - -```idris -import {{PROJECT}}.ABI.Foreign - -main : IO () -main = do - Just handle <- init - | Nothing => putStrLn "Failed to initialize" - - Right result <- process handle 42 - | Left err => putStrLn $ "Error: " ++ errorDescription err - - free handle - putStrLn "Success" -``` - -### From Rust - -```rust -#[link(name = "{{project}}")] -extern "C" { - fn {{project}}_init() -> *mut std::ffi::c_void; - fn {{project}}_free(handle: *mut std::ffi::c_void); - fn {{project}}_process(handle: *mut std::ffi::c_void, input: u32) -> i32; -} - -fn main() { - unsafe { - let handle = {{project}}_init(); - assert!(!handle.is_null()); - - let result = {{project}}_process(handle, 42); - assert_eq!(result, 0); - - {{project}}_free(handle); - } -} -``` - -### From Julia - -```julia -const lib{{project}} = "lib{{project}}" - -function init() - handle = ccall((:{{project}}_init, lib{{project}}), Ptr{Cvoid}, ()) - handle == C_NULL && error("Failed to initialize") - handle -end - -function process(handle, input) - result = ccall((:{{project}}_process, lib{{project}}), Cint, (Ptr{Cvoid}, UInt32), handle, input) - result -end - -function cleanup(handle) - ccall((:{{project}}_free, lib{{project}}), Cvoid, (Ptr{Cvoid},), handle) -end - -# Usage -handle = init() -try - result = process(handle, 42) - println("Result: $result") -finally - cleanup(handle) -end -``` - -## Testing - -### Unit Tests (Zig) - -```bash -cd ffi/zig -zig build test -``` - -### Integration Tests - -```bash -cd ffi/zig -zig build test-integration -``` - -### ABI Verification (Idris2) - -```idris --- Compile-time verification -%runElab verifyABI - --- Runtime checks -main : IO () -main = do - verifyLayoutsCorrect - verifyAlignmentsCorrect - putStrLn "ABI verification passed" -``` - -## Contributing - -When modifying the ABI/FFI: - -1. **Update ABI first** (`src/abi/*.idr`) - - Modify type definitions - - Update proofs - - Ensure backward compatibility - -2. **Generate C header** - ```bash - idris2 --cg c-header src/abi/Types.idr -o generated/abi/{{project}}.h - ``` - -3. **Update FFI implementation** (`ffi/zig/src/main.zig`) - - Implement new functions - - Match ABI types exactly - -4. **Add tests** - - Unit tests in Zig - - Integration tests - - ABI verification tests - -5. **Update documentation** - - Function signatures - - Usage examples - - Migration guide (if breaking changes) - -## License - -PMPL-1.0-or-later - -## See Also - -- [Idris2 Documentation](https://idris2.readthedocs.io) -- [Zig Documentation](https://ziglang.org/documentation/master/) -- [Rhodium Standard Repositories](https://github.com/hyperpolymath/rhodium-standard-repositories) -- [FFI Migration Guide](../ffi-migration-guide.md) -- [ABI Migration Guide](../abi-migration-guide.md) diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/CODE_OF_CONDUCT.md b/avow-protocol/telegram-bot/avow-telegram-bot/CODE_OF_CONDUCT.md deleted file mode 100644 index f9af5d2e..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,327 +0,0 @@ -# Code of Conduct - - - -## Our Pledge - -We as members, contributors, and leaders pledge to make participation in Standards a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation. - -We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. - -We recognise that a thriving open source community requires **psychological safety** — an environment where people can contribute, ask questions, make mistakes, and learn without fear of ridicule or retaliation. - ---- - -## Our Standards - -### Expected Behaviour - -The following behaviours contribute to a positive environment: - -**Communication** -- Using welcoming and inclusive language -- Being respectful of differing viewpoints and experiences -- Giving and gracefully accepting constructive feedback -- Assuming good intent while addressing impact -- Communicating clearly and patiently, especially with newcomers - -**Collaboration** -- Focusing on what is best for the community -- Showing empathy and kindness toward other community members -- Being collaborative rather than competitive -- Mentoring and supporting less experienced contributors -- Celebrating others' contributions and successes - -**Professionalism** -- Accepting responsibility and apologising to those affected by our mistakes -- Learning from the experience and avoiding repetition -- Respecting others' time and attention -- Staying on topic in project spaces -- Following project guidelines and conventions - -**Accessibility** -- Using plain language and avoiding unnecessary jargon -- Providing alt text for images and transcripts for audio/video -- Being patient with those using assistive technologies -- Accommodating different communication styles and needs -- Recognising that not everyone communicates the same way - -### Unacceptable Behaviour - -The following behaviours are considered harassment and are unacceptable: - -**Harassment** -- The use of sexualised language or imagery, and sexual attention or advances of any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Deliberate intimidation, stalking, or following (online or in-person) -- Unwelcome physical contact or simulated physical contact (e.g., emoji) -- Sustained disruption of talks, events, or online discussions - -**Discrimination** -- Discriminatory jokes and language -- Posting or threatening to post others' personally identifying information ("doxing") -- Advocating for, or encouraging, any of the above behaviour -- Microaggressions — subtle, often unintentional, discriminatory comments or actions - -**Professional Misconduct** -- Publishing others' private information without explicit permission -- Misrepresenting affiliation or contributions -- Plagiarism or claiming credit for others' work -- Retaliating against anyone who reports a Code of Conduct violation -- Other conduct which could reasonably be considered inappropriate in a professional setting - -### Grey Areas - -Some situations require judgement. When uncertain: - -- **Intent vs Impact**: Good intentions do not excuse harmful impact. Focus on making things right. -- **Power Dynamics**: Those with more power (maintainers, employers, experienced contributors) must be especially mindful of their impact. -- **Cultural Differences**: What's acceptable varies by culture. When in doubt, err on the side of caution and ask. -- **Humour**: Jokes at others' expense are rarely funny to everyone. Punch up, not down. - ---- - -## Scope - -This Code of Conduct applies within all community spaces, including: - -**Online Spaces** -- Repository discussions, issues, and pull/merge requests -- Project chat channels (Matrix, Discord, Slack, IRC) -- Mailing lists and forums -- Social media when representing the project -- Video calls and virtual meetings - -**In-Person Spaces** -- Conferences, meetups, and events -- Workshops and training sessions -- Any gathering where you represent the project - -**Representation** -This Code of Conduct also applies when an individual is officially representing the community in public spaces. Examples include: - -- Using an official project email address -- Posting via an official social media account -- Acting as an appointed representative at an event -- Speaking on behalf of the project - ---- - -## Enforcement - -### Reporting - -If you experience or witness unacceptable behaviour, or have any other concerns, please report it as soon as possible. - -**How to Report** - -| Method | Details | Best For | -|--------|---------|----------| -| **Email** | {{CONDUCT_EMAIL}} | Detailed reports, sensitive matters | -| **Private Message** | Contact any maintainer directly | Quick questions, minor issues | -| **Anonymous Form** | [Link to form if available] | When you need anonymity | - -**What to Include** - -- Your contact information (unless anonymous) -- Names/usernames of those involved -- Description of what happened -- When and where it occurred -- Any witnesses -- Any supporting evidence (screenshots, links) -- How you would like us to respond (if you have a preference) - -**What Happens Next** - -1. You will receive acknowledgment within **{{RESPONSE_TIME}}** -2. The {{CONDUCT_TEAM}} will review the report -3. We may ask for additional information -4. We will determine appropriate action -5. We will inform you of the outcome (respecting others' privacy) - -### Confidentiality - -All reports will be handled with discretion: - -- Reporter identity is protected by default -- Details are shared only with those who need to know -- We will ask before naming you in any communication -- Anonymous reports are accepted and investigated - -### Conflicts of Interest - -If a {{CONDUCT_TEAM}} member is involved in an incident: - -- They will recuse themselves from the process -- Another maintainer or external party will handle the report -- We will disclose any potential conflicts - ---- - -## Enforcement Guidelines - -The {{CONDUCT_TEAM}} will follow these guidelines in determining consequences: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behaviour deemed unprofessional or unwelcome. - -**Consequence**: A private, written warning providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate. A public apology may be requested. - -**Duration**: Immediate - -### 2. Warning - -**Community Impact**: A violation through a single incident or series of actions. - -**Consequence**: A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. - -**Duration**: 1-4 weeks - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including sustained inappropriate behaviour. - -**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. - -**Duration**: 1-6 months - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behaviour, harassment of an individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within the community. - -**Duration**: Permanent (with appeal rights after 12 months) - -### Enforcement Across Perimeters - -For contributors with elevated access (Perimeter 2 or 1): - -| Level | Additional Consequence | -|-------|----------------------| -| Correction | Noted in contributor record | -| Warning | Access privileges may be temporarily reduced | -| Temporary Ban | Access reduced to Perimeter 3 for ban duration | -| Permanent Ban | All access revoked | - ---- - -## Appeals - -If you believe an enforcement decision was made in error: - -1. **Wait 7 days** after the decision (cooling-off period) -2. **Email** {{CONDUCT_EMAIL}} with subject line "Appeal: [Original Report ID]" -3. **Explain** why you believe the decision should be reconsidered -4. **Provide** any new information not previously available - -**Appeals Process** - -- Appeals are reviewed by a different {{CONDUCT_TEAM}} member than the original -- You will receive a response within 14 days -- The appeals decision is final -- You may only appeal once per incident - -**Grounds for Appeal** - -- Procedural errors in the original investigation -- New evidence not previously available -- Disproportionate response to the violation -- Misunderstanding of facts - ---- - -## Supporting Those Who Report - -We are committed to supporting those who report violations: - -**We Will** -- Believe and take all reports seriously -- Respect your privacy and confidentiality preferences -- Keep you informed of progress (if you wish) -- Take steps to protect you from retaliation -- Provide resources if you need support - -**We Will Not** -- Require you to confront the person directly -- Dismiss reports without investigation -- Reveal your identity without consent -- Tolerate retaliation against reporters -- Rush you to make decisions - ---- - -## Prevention - -Beyond enforcement, we actively work to prevent issues: - -**Onboarding** -- All contributors are expected to read this Code of Conduct -- Perimeter 2 applicants must confirm they've read and understood it -- Maintainers receive additional training on enforcement - -**Culture** -- We model the behaviour we expect -- We intervene early when we see potential issues -- We thank people for positive contributions -- We create opportunities for diverse voices - -**Review** -- This Code of Conduct is reviewed annually -- Community feedback is welcomed -- Changes are communicated clearly - ---- - -## Acknowledgments - -This Code of Conduct is adapted from: - -- [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1 -- [Django Code of Conduct](https://www.djangoproject.com/conduct/) -- [Rust Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct) -- [Python Community Code of Conduct](https://www.python.org/psf/conduct/) - -We thank these communities for their leadership in creating welcoming spaces. - ---- - -## Questions? - -If you have questions about this Code of Conduct: - -- Open a [Discussion](https://github.com/hyperpolymath/standards/discussions) (for general questions) -- Email {{CONDUCT_EMAIL}} (for private questions) -- Contact any maintainer directly - ---- - -## Summary - -**Be kind. Be respectful. Be collaborative.** - -We're all here because we care about this project. Let's make it a place where everyone can do their best work. - ---- - -Last updated: 2026 · Based on Contributor Covenant 2.1 diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/CONTRIBUTING.md b/avow-protocol/telegram-bot/avow-telegram-bot/CONTRIBUTING.md deleted file mode 100644 index 8c9d97b7..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/CONTRIBUTING.md +++ /dev/null @@ -1,116 +0,0 @@ -# Clone the repository -git clone https://github.com/hyperpolymath/standards.git -cd standards - -# Using Nix (recommended for reproducibility) -nix develop - -# Or using toolbox/distrobox -toolbox create standards-dev -toolbox enter standards-dev -# Install dependencies manually - -# Verify setup -just check # or: cargo check / mix compile / etc. -just test # Run test suite -``` - -### Repository Structure -``` -standards/ -├── src/ # Source code (Perimeter 1-2) -├── lib/ # Library code (Perimeter 1-2) -├── extensions/ # Extensions (Perimeter 2) -├── plugins/ # Plugins (Perimeter 2) -├── tools/ # Tooling (Perimeter 2) -├── docs/ # Documentation (Perimeter 3) -│ ├── architecture/ # ADRs, specs (Perimeter 2) -│ └── proposals/ # RFCs (Perimeter 3) -├── examples/ # Examples (Perimeter 3) -├── spec/ # Spec tests (Perimeter 3) -├── tests/ # Test suite (Perimeter 2-3) -├── .well-known/ # Protocol files (Perimeter 1-3) -├── .github/ # GitHub config (Perimeter 1) -│ ├── ISSUE_TEMPLATE/ -│ └── workflows/ -├── CHANGELOG.md -├── CODE_OF_CONDUCT.md -├── CONTRIBUTING.md # This file -├── GOVERNANCE.md -├── LICENSE -├── MAINTAINERS.md -├── README.adoc -├── SECURITY.md -├── flake.nix # Nix flake (Perimeter 1) -└── Justfile # Task runner (Perimeter 1) -``` - ---- - -## How to Contribute - -### Reporting Bugs - -**Before reporting**: -1. Search existing issues -2. Check if it's already fixed in `main` -3. Determine which perimeter the bug affects - -**When reporting**: - -Use the [bug report template](.github/ISSUE_TEMPLATE/bug_report.md) and include: - -- Clear, descriptive title -- Environment details (OS, versions, toolchain) -- Steps to reproduce -- Expected vs actual behaviour -- Logs, screenshots, or minimal reproduction - -### Suggesting Features - -**Before suggesting**: -1. Check the [roadmap](ROADMAP.md) if available -2. Search existing issues and discussions -3. Consider which perimeter the feature belongs to - -**When suggesting**: - -Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) and include: - -- Problem statement (what pain point does this solve?) -- Proposed solution -- Alternatives considered -- Which perimeter this affects - -### Your First Contribution - -Look for issues labelled: - -- [`good first issue`](https://github.com/hyperpolymath/standards/labels/good%20first%20issue) — Simple Perimeter 3 tasks -- [`help wanted`](https://github.com/hyperpolymath/standards/labels/help%20wanted) — Community help needed -- [`documentation`](https://github.com/hyperpolymath/standards/labels/documentation) — Docs improvements -- [`perimeter-3`](https://github.com/hyperpolymath/standards/labels/perimeter-3) — Community sandbox scope - ---- - -## Development Workflow - -### Branch Naming -``` -docs/short-description # Documentation (P3) -test/what-added # Test additions (P3) -feat/short-description # New features (P2) -fix/issue-number-description # Bug fixes (P2) -refactor/what-changed # Code improvements (P2) -security/what-fixed # Security fixes (P1-2) -``` - -### Commit Messages - -We follow [Conventional Commits](https://www.conventionalcommits.org/): -``` -(): - -[optional body] - -[optional footer] diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/DEMO-VIDEO-SCRIPT.md b/avow-protocol/telegram-bot/avow-telegram-bot/DEMO-VIDEO-SCRIPT.md deleted file mode 100644 index 9d3f8939..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/DEMO-VIDEO-SCRIPT.md +++ /dev/null @@ -1,272 +0,0 @@ -# STAMP Protocol Demo Video Script - -**Duration:** 2 minutes -**Goal:** Show investors/users what STAMP does and why it matters - -## 🎬 Recording Setup - -### Software Options - -**Linux (Fedora):** -```bash -# Option 1: SimpleScreenRecorder (best quality) -sudo dnf install simplescreenrecorder -simplescreenrecorder - -# Option 2: OBS Studio (professional) -flatpak install flathub com.obsproject.Studio -flatpak run com.obsproject.Studio - -# Option 3: FFmpeg (command line) -ffmpeg -video_size 1920x1080 -framerate 30 -f x11grab -i :0.0 \ - -c:v libx264 -preset ultrafast -crf 23 stamp-demo.mp4 -``` - -**Settings:** -- Resolution: 1920x1080 (1080p) -- Frame rate: 30fps -- Audio: Optional (voiceover or silent) -- Format: MP4 (H.264) - -### What to Show - -1. **Website** (stamp-protocol.org) -2. **Telegram bot** (@stamp_demo_bot) -3. **Interactive demo** (verification in browser) - -## 📝 Script - -### Scene 1: Hook (0:00-0:15) - -**Visual:** stamp-protocol.org homepage - -**Narration:** -> "Email spam. Fake social media accounts. Broken unsubscribe links. -> -> What if you could **mathematically prove** your messages comply with -> consent, working unsubscribe, and rate limits? -> -> That's STAMP Protocol." - -**On-screen text:** -- "80-90% bot reduction" -- "Mathematically proven compliance" - ---- - -### Scene 2: The Problem (0:15-0:35) - -**Visual:** Scroll to "Problem" section - -**Narration:** -> "Current solutions rely on promises. Developers can lie about testing -> unsubscribe links. Spammers bypass rate limits. -> -> Platforms spend over $100 million per year fighting bots—and still lose." - -**On-screen text:** -- "$200M+ email spam market" -- "$1.2B+ social media bot market" - ---- - -### Scene 3: The Solution (0:35-1:00) - -**Visual:** "How It Works" section, show code comparison - -**Narration:** -> "STAMP uses dependent types in Idris2 to prove message properties -> at compile-time. -> -> Without STAMP, developers can lie. With STAMP, the code literally -> won't compile if your unsubscribe link doesn't work. -> -> It's not testing. It's proof." - -**On-screen text:** -- "Dependent Types = Mathematical Proof" -- "Code won't compile if invalid" - ---- - -### Scene 4: Live Demo (1:00-1:40) - -**Visual:** Switch to Telegram, show bot interaction - -**Narration:** -> "Here's STAMP in action. I'll subscribe to the demo bot. -> -> [Type /start] -> -> Immediately, I get a cryptographic proof of my consent—with -> timestamps that can't be faked. -> -> [Type /verify] -> -> The bot shows the unsubscribe link was tested and proven to work -> in under 200 milliseconds. -> -> [Type /unsubscribe] -> -> One click. Proven removal. No dark patterns." - -**Key moments to capture:** -- `/start` response (consent proof) -- `/verify` output (cryptographic proof) -- `/unsubscribe` confirmation - ---- - -### Scene 5: Call to Action (1:40-2:00) - -**Visual:** Back to website, hero section - -**Narration:** -> "STAMP works for email, social media, business messaging—any -> protocol that needs verified consent. -> -> Reduce bots by 80-90%. Save millions on moderation. Prove -> regulatory compliance. -> -> Try the live demo at stamp-protocol.org or test the Telegram bot. -> -> STAMP Protocol: Spam is over." - -**On-screen text:** -- "stamp-protocol.org" -- "@stamp_demo_bot" -- "Open source. AGPL-3.0" - ---- - -## 🎥 Recording Checklist - -**Before recording:** -- [ ] Close unnecessary tabs/apps -- [ ] Set browser zoom to 100% -- [ ] Hide bookmarks bar -- [ ] Clear Telegram chat (or use test account) -- [ ] Test bot commands work -- [ ] Restart bot if needed -- [ ] Practice script 2-3 times - -**Recording settings:** -- [ ] 1920x1080 resolution -- [ ] 30fps framerate -- [ ] Clean desktop (no clutter) -- [ ] Good lighting (if showing webcam) -- [ ] Clear audio (if narrating) - -**Post-recording:** -- [ ] Trim beginning/end -- [ ] Add title card (optional) -- [ ] Add captions (accessibility) -- [ ] Export as MP4 -- [ ] Test playback -- [ ] Upload to YouTube/Vimeo - -## 📤 Where to Share - -1. **YouTube** (unlisted or public) -2. **Vimeo** (good for business) -3. **Twitter/X** (2-min native video) -4. **LinkedIn** (for B2B) -5. **Embed on website** - -## 🎬 Quick Recording Commands - -### Using SimpleScreenRecorder - -1. Open SimpleScreenRecorder -2. Select area: "Record entire screen" -3. Audio: Optional -4. Output file: `~/Videos/stamp-demo.mp4` -5. Click "Record" -6. Do your demo -7. Click "Stop" - -### Using OBS - -1. Open OBS Studio -2. Scene: "Screen Capture" -3. Start Recording -4. Do your demo -5. Stop Recording -6. File saved in `~/Videos/` - -### Quick FFmpeg (Command Line) - -```bash -# Start recording -ffmpeg -video_size 1920x1080 -framerate 30 -f x11grab -i :0.0+0,0 \ - -c:v libx264 -preset ultrafast -crf 18 \ - ~/Videos/stamp-demo-$(date +%Y%m%d).mp4 - -# Stop with Ctrl+C - -# Add voiceover later (optional) -ffmpeg -i stamp-demo.mp4 -i audio.mp3 -c:v copy -c:a aac \ - stamp-demo-final.mp4 -``` - -## ✂️ Editing (Optional) - -**Quick edits with FFmpeg:** - -```bash -# Trim first 5 seconds -ffmpeg -ss 00:00:05 -i input.mp4 -c copy output.mp4 - -# Trim last 3 seconds -ffmpeg -i input.mp4 -t $(echo "$(ffprobe -v error -show_entries \ - format=duration -of default=noprint_wrappers=1:nokey=1 input.mp4) - 3" | bc) \ - -c copy output.mp4 - -# Add fade in/out -ffmpeg -i input.mp4 -vf "fade=in:0:30,fade=out:3570:30" output.mp4 - -# Speed up 1.25x (if too slow) -ffmpeg -i input.mp4 -filter:v "setpts=0.8*PTS" output.mp4 -``` - -**Or use:** -- Kdenlive (open source, powerful) -- Shotcut (simpler) -- DaVinci Resolve (professional, free) - -## 📊 Success Metrics - -**Good demo video:** -- Under 2 minutes ✓ -- Shows problem → solution → demo -- Clear audio/visual -- Sharable link - -**Great demo video:** -- Professional editing -- Captions/subtitles -- Engaging narration -- Call to action - -## 🚀 Ready to Record? - -1. Install screen recorder -2. Practice script -3. Record (multiple takes OK) -4. Pick best take -5. Upload and share! - -**Quick start:** -```bash -# Install SimpleScreenRecorder -sudo dnf install simplescreenrecorder - -# Launch -simplescreenrecorder & - -# OR use OBS -flatpak run com.obsproject.Studio & -``` - -Remember: **Done is better than perfect.** Even a simple screen recording -with no audio is valuable for showing the demo to people. diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/DEPLOY-NOW.md b/avow-protocol/telegram-bot/avow-telegram-bot/DEPLOY-NOW.md deleted file mode 100644 index a72b0b58..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/DEPLOY-NOW.md +++ /dev/null @@ -1,156 +0,0 @@ -# Deploy Your STAMP Bot RIGHT NOW - -## ✅ Everything is ready! Follow these steps: - -### Step 1: Get Your Bot Token (2 minutes) - -1. Open Telegram -2. Search for: `@BotFather` -3. Send: `/newbot` -4. When asked for name, reply: `STAMP Demo Bot` -5. When asked for username, reply: `stamp_demo_YOUR_NAME_bot` (must be unique and end in "bot") -6. Copy the token (looks like: `1234567890:ABCdef-GHIjklMNOpqrs`) - -### Step 2: Configure (30 seconds) - -```bash -cd ~/Documents/hyperpolymath-repos/stamp-telegram-bot - -# Create config file with your token -echo "BOT_TOKEN=YOUR_TOKEN_HERE" > .env - -# Example: -# echo "BOT_TOKEN=1234567890:ABCdef-GHIjklMNOpqrs" > .env -``` - -### Step 3: Run (10 seconds) - -```bash -deno task start -``` - -You should see: -``` -🤖 STAMP Telegram Bot starting... -✓ Bot initialized -✓ Database connected -✓ Demo messages scheduled (every hour) - -🚀 Bot is now running! -``` - -### Step 4: Test (1 minute) - -1. Open Telegram -2. Search for your bot username (e.g., `@stamp_demo_YOUR_NAME_bot`) -3. Send: `/start` - -You should get: -``` -✓ Subscription Confirmed - -Consent Chain Verified: -└─ Requested: 2026-01-30... -└─ Confirmed: /start command (explicit) -└─ Token: ... -└─ Proof: Cryptographically signed ✓ -``` - -**Try these commands:** -- `/verify` - See cryptographic proof -- `/status` - Show subscription details -- `/unsubscribe` - Unsubscribe (one-click) - -### Step 5: Keep It Running (Optional) - -**Option A: Leave terminal open** -Just don't close the terminal window - -**Option B: Use `screen` (recommended)** -```bash -# Start screen session -screen -S stamp-bot - -# Run bot -deno task start - -# Detach: Press Ctrl+A, then D -# Bot keeps running in background - -# Later: Reattach with -screen -r stamp-bot -``` - ---- - -## ✅ Success Checklist - -- [ ] Bot responds to `/start` -- [ ] Bot shows consent proof -- [ ] `/verify` command works -- [ ] `/unsubscribe` command works -- [ ] Bot stays running - ---- - -## 🎉 Once Working: - -1. **Test with friends** - Share bot link with 3-5 people -2. **Record demo video** - Screen record the `/start`, `/verify`, `/unsubscribe` flow (2 min) -3. **Take screenshots** - For pitch deck - ---- - -## ⚠️ If Something Goes Wrong: - -**Bot doesn't start:** -```bash -# Check Deno is installed -deno --version - -# If not installed: -curl -fsSL https://deno.land/install.sh | sh -``` - -**Bot doesn't respond:** -- Check BOT_TOKEN in `.env` is correct -- Check bot username matches what you set -- Try stopping (Ctrl+C) and restarting - -**Permission errors:** -```bash -# Give write permissions -chmod +x ~/Documents/hyperpolymath-repos/stamp-telegram-bot/db -``` - ---- - -## 📝 What to Tell People When Demoing: - -> "This is a demo of the STAMP protocol - it uses formal verification to prove: -> -> 1. You actually consented to receive messages -> 2. The unsubscribe link works (tested and proven) -> 3. The sender is rate-limited -> -> Try it: /start to subscribe, /verify to see the proof, /unsubscribe to leave" - ---- - -## Next: Buy Domain - -While bot is running, buy: **`stamp-protocol.org`** (£10/year) - -Go to: https://www.cloudflare.com/products/registrar/ - ---- - -**Ready? Run these commands now:** - -```bash -cd ~/Documents/hyperpolymath-repos/stamp-telegram-bot -echo "BOT_TOKEN=YOUR_TOKEN_HERE" > .env -deno task start -``` - -**Then message me when it's working!** 🚀 diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/LICENSE b/avow-protocol/telegram-bot/avow-telegram-bot/LICENSE deleted file mode 100644 index ec540b34..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/LICENSE +++ /dev/null @@ -1,153 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council - -================================================================================ -PALIMPSEST-MPL LICENSE VERSION 1.0 -================================================================================ - -File-level copyleft with ethical use and quantum-safe provenance - -Based on Mozilla Public License 2.0 - --------------------------------------------------------------------------------- -PREAMBLE --------------------------------------------------------------------------------- - -This License extends the Mozilla Public License 2.0 (MPL-2.0) with provisions -for ethical use, post-quantum cryptographic provenance, and emotional lineage -protection. The base MPL-2.0 terms apply except where explicitly modified by -the Exhibits below. - -Like a palimpsest manuscript where each layer builds upon what came before, -this license recognizes that creative works carry history, context, and meaning -that transcend mere code or text. - --------------------------------------------------------------------------------- -SECTION 1: BASE LICENSE --------------------------------------------------------------------------------- - -This License incorporates the full text of Mozilla Public License 2.0 by -reference. The complete MPL-2.0 text is available at: -https://www.mozilla.org/en-US/MPL/2.0/ - -All terms, conditions, and definitions from MPL-2.0 apply except where -explicitly modified by the Exhibits in this License. - --------------------------------------------------------------------------------- -SECTION 2: ADDITIONAL DEFINITIONS --------------------------------------------------------------------------------- - -2.1. "Emotional Lineage" - means the narrative, cultural, symbolic, and contextual meaning embedded - in Covered Software, including but not limited to: protest traditions, - cultural heritage, trauma narratives, and community stories. - -2.2. "Provenance Metadata" - means cryptographically signed attribution information attached to or - associated with Covered Software, including author identities, timestamps, - modification history, and lineage references. - -2.3. "Non-Interpretive System" - means any automated system that processes Covered Software without - preserving or considering its Emotional Lineage, including but not - limited to: AI training pipelines, content aggregators, and automated - summarization tools. - -2.4. "Quantum-Safe Signature" - means a cryptographic signature using algorithms resistant to attacks - by quantum computers, as specified in Exhibit B. - --------------------------------------------------------------------------------- -SECTION 3: ETHICAL USE REQUIREMENTS --------------------------------------------------------------------------------- - -In addition to the rights and obligations under MPL-2.0: - -3.1. Emotional Lineage Preservation - You must make reasonable efforts to preserve and communicate the - Emotional Lineage of Covered Software when distributing or creating - derivative works. This includes maintaining narrative context, cultural - attributions, and symbolic meaning where documented. - -3.2. Non-Interpretive System Notice - If You use Covered Software as input to a Non-Interpretive System, You - must: - (a) document such use in a publicly accessible manner; and - (b) not claim that outputs of such systems carry the Emotional Lineage - of the original work without explicit permission from Contributors. - -3.3. Ethical Use Declaration - Commercial use of Covered Software requires acknowledgment that You have - read and understood Exhibit A (Ethical Use Guidelines) and agree to act - in good faith accordance with its principles. - -See Exhibit A for complete Ethical Use Guidelines. - --------------------------------------------------------------------------------- -SECTION 4: PROVENANCE REQUIREMENTS --------------------------------------------------------------------------------- - -4.1. Metadata Preservation - You must not strip, alter, or obscure Provenance Metadata from Covered - Software except where technically necessary and with clear documentation - of any changes. - -4.2. Quantum-Safe Provenance (Optional) - Contributors may sign their Contributions using Quantum-Safe Signatures. - If Quantum-Safe Signatures are present, You must preserve them in all - distributions. - -4.3. Lineage Chain - When creating derivative works, You should extend the provenance chain - to include Your own contributions, maintaining cryptographic linkage to - prior Contributors where feasible. - -See Exhibit B for Quantum-Safe Provenance specifications. - --------------------------------------------------------------------------------- -SECTION 5: GOVERNANCE --------------------------------------------------------------------------------- - -5.1. Stewardship Council - This License is maintained by the Palimpsest Stewardship Council, which - may issue clarifications, interpretive guidance, and future versions. - -5.2. Version Selection - You may use Covered Software under this version of the License or any - later version published by the Palimpsest Stewardship Council. - -5.3. Dispute Resolution - Disputes regarding interpretation of Ethical Use Requirements (Section 3) - should first be submitted to the Palimpsest Stewardship Council for - non-binding guidance before pursuing legal remedies. - --------------------------------------------------------------------------------- -SECTION 6: COMPATIBILITY --------------------------------------------------------------------------------- - -6.1. MPL-2.0 Compatibility - Covered Software under this License may be combined with software under - MPL-2.0. The combined work must comply with both licenses. - -6.2. Secondary Licenses - The Secondary License provisions of MPL-2.0 Section 3.3 apply to this - License. - --------------------------------------------------------------------------------- -EXHIBITS --------------------------------------------------------------------------------- - -Exhibit A - Ethical Use Guidelines -Exhibit B - Quantum-Safe Provenance Specification - -See separate files: -- EXHIBIT-A-ETHICAL-USE.txt -- EXHIBIT-B-QUANTUM-SAFE.txt - --------------------------------------------------------------------------------- -END OF PALIMPSEST-MPL LICENSE VERSION 1.0 --------------------------------------------------------------------------------- - -For questions about this License: -- Repository: https://github.com/hyperpolymath/palimpsest-license -- Council: contact via repository Issues diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/MAINTAINERS.adoc b/avow-protocol/telegram-bot/avow-telegram-bot/MAINTAINERS.adoc deleted file mode 100644 index 48d97817..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/MAINTAINERS.adoc +++ /dev/null @@ -1,47 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Maintainers -:toc: preamble - -This document lists the maintainers of this project and their responsibilities. - -== Current Maintainers - -[cols="2,3,2",options="header"] -|=== -| Name | Role | Contact - -| Jonathan D.A. Jewell -| Lead Maintainer -| https://github.com/hyperpolymath[@hyperpolymath] -|=== - -== Responsibilities - -Maintainers are responsible for: - -* Reviewing and merging pull requests -* Triaging issues and feature requests -* Ensuring code quality and security standards -* Managing releases and versioning -* Upholding the project's code of conduct - -== Becoming a Maintainer - -Contributors who demonstrate: - -* Consistent, high-quality contributions -* Understanding of the project's goals and standards -* Constructive participation in discussions -* Commitment to the project's long-term health - -May be invited to become maintainers at the discretion of existing maintainers. - -== Decision Making - -* Routine decisions (bug fixes, minor improvements) can be made by any maintainer -* Significant changes require discussion and consensus among maintainers -* Breaking changes or major features should be discussed in issues before implementation - -== Contact - -For questions about project governance, open an issue or contact the maintainers listed above. diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/NEXT-STEPS.md b/avow-protocol/telegram-bot/avow-telegram-bot/NEXT-STEPS.md deleted file mode 100644 index bfe28cfe..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/NEXT-STEPS.md +++ /dev/null @@ -1,307 +0,0 @@ -# Next Steps: Deploy Your STAMP Bot - -## ✅ What You Have Now - -``` -stamp-telegram-bot/ -├── src/ -│ ├── bot.ts ✓ # Complete Telegram bot (400+ lines) -│ ├── database.ts ✓ # SQLite persistence -│ └── stamp-mock.ts ✓ # Mock verification library -├── test-mock.ts ✓ # Unit tests (all passing) -├── deno.json ✓ # Deno configuration -├── .env.example ✓ # Environment template -├── .gitignore ✓ # Git ignore rules -└── README.md ✓ # Complete documentation -``` - -**Status:** 100% functional, ready to deploy! - -## Quick Start (5 Minutes) - -### 1. Get Bot Token - -Open Telegram, search for `@BotFather`: - -``` -You: /newbot -BotFather: Alright, a new bot. How are we going to call it? - -You: STAMP Demo Bot -BotFather: Good. Now let's choose a username for your bot. - -You: stamp_demo_123_bot -BotFather: Done! Your token is: 1234567890:ABCdefGHIjklMNOpqrsTUVwxyz -``` - -### 2. Configure - -```bash -cd ~/Documents/hyperpolymath-repos/stamp-telegram-bot - -# Create config file -cp .env.example .env - -# Add your token -echo "BOT_TOKEN=1234567890:ABCdefGHIjklMNOpqrsTUVwxyz" > .env -``` - -### 3. Run - -```bash -deno task start -``` - -You'll see: -``` -🤖 STAMP Telegram Bot starting... -✓ Bot initialized -✓ Database connected -✓ Demo messages scheduled (every hour) - -🚀 Bot is now running! -``` - -### 4. Test - -Open Telegram, find your bot, send: -``` -/start -``` - -You should get: -``` -✓ Subscription Confirmed - -Consent Chain Verified: -└─ Requested: 2026-01-30T10:00:00.000Z -└─ Confirmed: /start command (explicit) -└─ Token: 1234567890_abc123... -└─ Proof: Cryptographically signed ✓ -``` - -**Try:** -- `/verify` - See cryptographic proof -- `/status` - Show subscription details -- `/unsubscribe` - Unsubscribe (one-click, proven) - -## What the Bot Demonstrates - -### For Users: -- ✓ **Easy subscribe** - One command -- ✓ **See proofs** - Cryptographic verification visible -- ✓ **Easy unsubscribe** - One command, mathematically proven to work -- ✓ **Transparency** - All actions include proofs - -### For Investors/Partners: -- ✓ **Working prototype** - Not just slides -- ✓ **Novel tech** - Formal verification in messaging -- ✓ **Clear value prop** - Solves real pain (spam, unsubscribe) -- ✓ **Generalizable** - Works for email, social media, etc. - -## Demo Script (For Meetings) - -**Setup** (before meeting): -1. Deploy bot -2. Subscribe with your account -3. Take screenshots of `/verify` output - -**During meeting** (5 minutes): - -1. **Show the problem** (1 min) - - "Email unsubscribe often doesn't work" - - "No proof consent was given" - - Pull up examples of dark patterns - -2. **Live demo** (3 min) - - Open Telegram - - `/start` - Show consent chain with proof - - Receive demo message - - `/verify` - Show cryptographic proof - - `/unsubscribe` - Show proof of removal - -3. **Explain the tech** (1 min) - - "Uses dependent types for formal verification" - - "Idris2 proves properties at compile time" - - "Cannot create invalid messages - mathematically impossible" - - "This works for any messaging: email, social media, etc." - -4. **Show traction path** - - Week 1: ✓ Telegram bot (done!) - - Week 2-3: Dating app pilot - - Month 3-4: Reddit integration - - Month 6: Apple/Google approach - -## Deployment Options - -### Option 1: Local (For Testing - Now) - -```bash -# Run in terminal -deno task start - -# Or: Run in background with screen -screen -S stamp-bot -deno task start -# Ctrl+A, D to detach - -# Later: Reattach -screen -r stamp-bot -``` - -### Option 2: fly.io (For Production - 10 minutes) - -```bash -# Install flyctl -curl -L https://fly.io/install.sh | sh - -# Login -fly auth login - -# Deploy -cd ~/Documents/hyperpolymath-repos/stamp-telegram-bot -fly launch --name stamp-bot - -# Set bot token -fly secrets set BOT_TOKEN=your_token_here - -# Deploy -fly deploy - -# Check logs -fly logs -``` - -**Cost:** Free tier (good for demo) - -### Option 3: VPS (DigitalOcean, Linode, etc.) - -```bash -# SSH to VPS -ssh user@your-server.com - -# Install Deno -curl -fsSL https://deno.land/install.sh | sh - -# Clone repo (or scp files) -git clone https://github.com/yourusername/stamp-telegram-bot -cd stamp-telegram-bot - -# Configure -echo "BOT_TOKEN=your_token_here" > .env - -# Run with systemd (stays running) -sudo nano /etc/systemd/system/stamp-bot.service -``` - -`/etc/systemd/system/stamp-bot.service`: -```ini -[Unit] -Description=STAMP Telegram Bot -After=network.target - -[Service] -Type=simple -User=youruser -WorkingDirectory=/home/youruser/stamp-telegram-bot -ExecStart=/home/youruser/.deno/bin/deno task start -Restart=always - -[Install] -WantedBy=multi-user.target -``` - -```bash -# Start service -sudo systemctl enable stamp-bot -sudo systemctl start stamp-bot - -# Check status -sudo systemctl status stamp-bot -``` - -## Week 1 Checklist - -- [x] Mock STAMP library ✓ -- [x] Telegram bot with all commands ✓ -- [x] Database persistence ✓ -- [x] Unit tests ✓ -- [x] Documentation ✓ -- [ ] Deploy bot (DO THIS TODAY!) -- [ ] Get 5-10 people to test -- [ ] Collect feedback -- [ ] Record demo video (2 minutes) - -## Week 2 Goals - -- [ ] Integrate real libstamp (Idris2 + Zig FFI) -- [ ] Replace mocks with real verification -- [ ] Add real cryptographic signatures -- [ ] Performance benchmarks -- [ ] Write dating app one-pager - -## Common Issues - -### Bot doesn't respond - -**Check:** -```bash -# Is bot running? -ps aux | grep deno - -# Any errors? -tail -f logs.txt # If you redirected output - -# Network connectivity? -ping api.telegram.org -``` - -**Solution:** -- Verify BOT_TOKEN in .env -- Check bot username matches what you set -- Restart bot - -### Database permission errors - -```bash -# Fix permissions -chmod 755 db/ -chmod 644 db/*.db -``` - -### Rate limiting from Telegram - -Bot can send: -- 30 messages/second to different users -- 1 message/second to same user - -If you hit limits: -- Add delays between messages -- Reduce demo message frequency - -## Getting Help - -**If stuck:** -1. Check README.md -2. Run tests: `deno run test-mock.ts` -3. Check logs for errors -4. Ask me for help! - -## Success Criteria - -You know it's working when: -- ✓ Bot responds to /start -- ✓ You receive demo message -- ✓ /verify shows proof -- ✓ /unsubscribe works -- ✓ No more messages after unsubscribe - -**Then:** Show 5 people, get feedback, iterate! - ---- - -**Ready to deploy?** Run the Quick Start above, then message me if you hit any issues. - -**Want to show someone?** Use the demo script above. - -**Ready for Week 2?** We'll integrate real libstamp with Zig FFI. diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/README.adoc b/avow-protocol/telegram-bot/avow-telegram-bot/README.adoc deleted file mode 100644 index 47a9ef24..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/README.adoc +++ /dev/null @@ -1,101 +0,0 @@ -= RSR template repo - see RSR_OUTLINE.adoc in root for general background and specification - -== This is your repo - don't forget to rename me! - -== ABI/FFI Standards (Hyperpolymath Universal Standard) - -**All repos with foreign function interfaces MUST follow this standard:** - -* **ABI (Application Binary Interface)** → **Idris2** (`src/abi/*.idr`) -** Type definitions with dependent type proofs -** Memory layout verification -** Platform-specific ABIs with compile-time selection -** Formal verification of interface correctness - -* **FFI (Foreign Function Interface)** → **Zig** (`ffi/zig/src/*.zig`) -** C-compatible function implementations -** Zero-cost abstractions -** Memory-safe by default -** Cross-compilation support - -* **Generated C Headers** → Auto-generated from Idris2 ABI (`generated/abi/*.h`) -** Bridge between Idris2 and Zig -** Consumed by any language via C ABI - -**Directory Structure:** ----- -project/ -├── src/abi/ # Idris2 ABI definitions (REQUIRED) -├── ffi/zig/ # Zig FFI implementation (REQUIRED) -├── generated/abi/ # Auto-generated C headers -└── bindings/ # Language-specific wrappers (optional) ----- - -**See:** `ABI-FFI-README.md` for complete documentation - -== AI CLI standards - -- Include `ai-cli-crash-capture/` and `contractiles/` from this template in new repos. -- Mirror 6SCM files into `.machine_readable/` (NOT `.machine_readable/6scm/`). -- Before any code generation, check `$REPOS_DIR/proven` for the current Idris "unbreakable" library status. -- If a project uses that Idris library, add an *Idris Inside* badge to the repo. -- If new bindings are required, add them in `$REPOS_DIR/proven` as `idris2-zig-` during the work. -- If new code suggests additional "unbreakable" Idris modules, add them under `$REPOS_DIR/proven` and update binders across all supported languages. - -== Standard Dependencies - -=== Web Projects - -ReScript web projects in the hyperpolymath ecosystem **MUST** use these formally verified components: - -[cols="1,2,1"] -|=== -|Library |Purpose |Status - -|link:https://github.com/hyperpolymath/rescript-dom-mounter[rescript-dom-mounter] -|Formally verified DOM mounting -|**REQUIRED** - -|link:https://github.com/hyperpolymath/rescript-tea[rescript-tea] -|TEA architecture framework -|Recommended - -|link:https://github.com/hyperpolymath/cadre-tea-router[cadre-tea-router] -|Proven-safe URL routing -|Recommended - -|link:https://github.com/hyperpolymath/proven[proven] -|Idris2 formally verified library -|Core Dependency -|=== - -==== Why SafeDOM is Required - -Traditional DOM mounting can fail: - -[source,javascript] ----- -// ❌ UNSAFE: Can crash with null pointer -const el = document.getElementById('app') -el.innerHTML = html // 💥 ----- - -SafeDOM provides **compile-time proofs** that DOM operations cannot fail: - -[source,rescript] ----- -// ✅ PROVEN SAFE: Mathematically guaranteed -SafeDOM.mountSafe("#app", html, - ~onSuccess=el => Console.log("Success"), - ~onError=err => Console.error(err)) ----- - -**Mathematical Guarantees:** - -✓ No null pointer dereferences (Idris2 proof) -✓ No invalid CSS selectors (dependent types) -✓ No malformed HTML (balanced tag checking) -✓ Type-safe operations (ReScript + Idris2) -✓ Zero runtime overhead (proofs erased) - -See link:https://github.com/hyperpolymath/rescript-dom-mounter[rescript-dom-mounter documentation] for full details. diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/ROADMAP.adoc b/avow-protocol/telegram-bot/avow-telegram-bot/ROADMAP.adoc deleted file mode 100644 index 4cbe9842..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/ROADMAP.adoc +++ /dev/null @@ -1,22 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Avow Telegram Bot Roadmap - -== Current Status - -Initial development phase. - -== Milestones - -=== v0.1.0 - Foundation -* [ ] Core functionality -* [ ] Basic documentation -* [ ] CI/CD pipeline - -=== v1.0.0 - Stable Release -* [ ] Full feature set -* [ ] Comprehensive tests -* [ ] Production ready - -== Future Directions - -_To be determined based on community feedback._ diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/RSR_OUTLINE.adoc b/avow-protocol/telegram-bot/avow-telegram-bot/RSR_OUTLINE.adoc deleted file mode 100644 index 94a49d83..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/RSR_OUTLINE.adoc +++ /dev/null @@ -1,218 +0,0 @@ -= RSR Template Repository - -image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] -:toc: -:sectnums: - -// Badges -image:https://img.shields.io/badge/RSR-Infrastructure-cd7f32[RSR Infrastructure] -image:https://img.shields.io/badge/Phase-Maintenance-brightgreen[Phase] -image:https://img.shields.io/badge/Guix-Primary-purple?logo=gnu[Guix] - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This repository provides the standardized structure, configuration, and tooling for all 139 repos in the hyperpolymath ecosystem. Use it to: - -* Bootstrap new projects with RSR compliance -* Reference the standard directory structure -* Copy configuration templates (Justfile, STATE.scm, etc.) - -== Quick Start - -[source,bash] ----- -# Clone the template -git clone https://github.com/hyperpolymath/RSR-template-repo my-project -cd my-project - -# Remove template git history -rm -rf .git -git init - -# Customize -sed -i 's/RSR-template-repo/my-project/g' Justfile guix.scm README.adoc - -# Enter development environment -guix shell -D -f guix.scm - -# Validate compliance -just validate-rsr ----- - -== What's Included - -[cols="1,3"] -|=== -|File/Directory |Purpose - -|`.editorconfig` -|Editor configuration (indent, charset) - -|`.gitignore` -|Standard ignore patterns - -|`.guix-channel` -|Guix channel definition - -|`.well-known/` -|RFC-compliant metadata (security.txt, ai.txt, humans.txt) - -|`docs/` -|Documentation directory - -|`guix.scm` -|Guix package definition - -|`justfile` -|Task runner with 50+ recipes - -|`LICENSE.txt` -|AGPL + Palimpsest dual license - -|`README.adoc` -|This file - -|`RSR_COMPLIANCE.adoc` -|Compliance tracking - -|`STATE.scm` -|Project state checkpoint -|=== - -== Justfile Features - -The template Justfile provides: - -* **~10 billion recipe combinations** via matrix recipes -* **Cookbook generation**: `just cookbook` → `docs/just-cookbook.adoc` -* **Man page generation**: `just man` → `docs/man/project.1` -* **RSR validation**: `just validate-rsr` -* **STATE.scm management**: `just state-touch`, `just state-phase` -* **Container support**: `just container-build`, `just container-push` -* **CI matrix**: `just ci-matrix [stage] [depth]` - -=== Key Recipes - -[source,bash] ----- -just # Show all recipes -just help # Detailed help -just info # Project info -just combinations # Show matrix options - -just build # Build (debug) -just test # Run tests -just quality # Format + lint + test -just ci # Full CI pipeline - -just validate # RSR + STATE validation -just docs # Generate all docs -just cookbook # Generate Justfile docs - -just guix-shell # Guix dev environment -just container-build # Build container ----- - -== Directory Structure - -[source] ----- -project/ -├── .editorconfig # Editor settings -├── .gitignore # Git ignore -├── .guix-channel # Guix channel -├── .well-known/ # RFC metadata -│ ├── ai.txt -│ ├── humans.txt -│ └── security.txt -├── config/ # Nickel configs (optional) -├── docs/ # Documentation -│ ├── generated/ -│ ├── man/ -│ └── just-cookbook.adoc -├── guix.scm # Guix package -├── Justfile # Task runner -├── LICENSE.txt # Dual license -├── README.adoc # Overview -├── RSR_COMPLIANCE.adoc # Compliance -├── src/ # Source code -├── STATE.scm # State checkpoint -└── tests/ # Tests ----- - -== RSR Compliance - -=== Language Tiers - -* **Tier 1** (Gold): Rust, Elixir, Zig, Ada, Haskell, ReScript -* **Tier 2** (Silver): Nickel, Racket, Guile Scheme, Nix -* **Infrastructure**: Guix channels, derivations - -=== Required Files - -* `.editorconfig` -* `.gitignore` -* `justfile` -* `README.adoc` -* `RSR_COMPLIANCE.adoc` -* `LICENSE.txt` (AGPL + Palimpsest) -* `.well-known/security.txt` -* `.well-known/ai.txt` -* `.well-known/humans.txt` -* `guix.scm` OR `flake.nix` - -=== Prohibited - -* Python outside `salt/` directory -* TypeScript/JavaScript (use ReScript) -* CUE (use Guile/Nickel) -* `Dockerfile` (use `Containerfile`) - -== STATE.scm - -The STATE.scm file tracks project state: - -[source,scheme] ----- -(define state - `((metadata - (project . "my-project") - (updated . "2025-12-10")) - (position - (phase . implementation) ; design|implementation|testing|maintenance|archived - (maturity . beta)) ; experimental|alpha|beta|production|lts - (ecosystem - (part-of . ("RSR Framework")) - (depends-on . ())))) ----- - -== Badge Schema - -Generate badges from STATE.scm: - -[source,bash] ----- -just badges standard ----- - -See `docs/BADGE_SCHEMA.adoc` for the full badge taxonomy. - -== Ecosystem Integration - -This template is part of: - -* **STATE.scm Ecosystem**: Conversation checkpoints -* **RSR Framework**: Repository standards -* **Consent-Aware-HTTP**: .well-known compliance - -== License - -SPDX-License-Identifier: MPL-2.0 - -== Links - -* https://github.com/hyperpolymath/elegant-STATE[elegant-STATE] - STATE.scm tooling -* https://github.com/hyperpolymath/conative-gating[conative-gating] - Policy enforcement -* https://rhodium.sh[Rhodium Standard] - RSR documentation diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/SECURITY.md b/avow-protocol/telegram-bot/avow-telegram-bot/SECURITY.md deleted file mode 100644 index 7e0cf11f..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/SECURITY.md +++ /dev/null @@ -1,406 +0,0 @@ -# Security Policy - - - -We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. - -## Table of Contents - -- [Reporting a Vulnerability](#reporting-a-vulnerability) -- [What to Include](#what-to-include) -- [Response Timeline](#response-timeline) -- [Disclosure Policy](#disclosure-policy) -- [Scope](#scope) -- [Safe Harbour](#safe-harbour) -- [Recognition](#recognition) -- [Security Updates](#security-updates) -- [Security Best Practices](#security-best-practices) - ---- - -## Reporting a Vulnerability - -### Preferred Method: GitHub Security Advisories - -The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature: - -1. Navigate to [Report a Vulnerability](https://github.com/hyperpolymath/standards/security/advisories/new) -2. Click **"Report a vulnerability"** -3. Complete the form with as much detail as possible -4. Submit — we'll receive a private notification - -This method ensures: - -- End-to-end encryption of your report -- Private discussion space for collaboration -- Coordinated disclosure tooling -- Automatic credit when the advisory is published - -### Alternative: Encrypted Email - -If you cannot use GitHub Security Advisories, you may email us directly: - -| | | -|---|---| -| **Email** | 6759885+hyperpolymath@users.noreply.github.com | -| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) | -| **Fingerprint** | `[PGP fingerprint not set]` | - -```bash -# Import our PGP key -curl -sSL {{PGP_KEY_URL}} | gpg --import - -# Verify fingerprint -gpg --fingerprint 6759885+hyperpolymath@users.noreply.github.com - -# Encrypt your report -gpg --armor --encrypt --recipient 6759885+hyperpolymath@users.noreply.github.com report.txt -``` - -> **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. - ---- - -## What to Include - -A good vulnerability report helps us understand and reproduce the issue quickly. - -### Required Information - -- **Description**: Clear explanation of the vulnerability -- **Impact**: What an attacker could achieve (confidentiality, integrity, availability) -- **Affected versions**: Which versions/commits are affected -- **Reproduction steps**: Detailed steps to reproduce the issue - -### Helpful Additional Information - -- **Proof of concept**: Code, scripts, or screenshots demonstrating the vulnerability -- **Attack scenario**: Realistic attack scenario showing exploitability -- **CVSS score**: Your assessment of severity (use [CVSS 3.1 Calculator](https://www.first.org/cvss/calculator/3.1)) -- **CWE ID**: Common Weakness Enumeration identifier if known -- **Suggested fix**: If you have ideas for remediation -- **References**: Links to related vulnerabilities, research, or advisories - -### Example Report Structure - -```markdown -## Summary -[One-sentence description of the vulnerability] - -## Vulnerability Type -[e.g., SQL Injection, XSS, SSRF, Path Traversal, etc.] - -## Affected Component -[File path, function name, API endpoint, etc.] - -## Affected Versions -[Version range or specific commits] - -## Severity Assessment -- CVSS 3.1 Score: [X.X] -- CVSS Vector: [CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X] - -## Description -[Detailed technical description] - -## Steps to Reproduce -1. [First step] -2. [Second step] -3. [...] - -## Proof of Concept -[Code, curl commands, screenshots, etc.] - -## Impact -[What can an attacker achieve?] - -## Suggested Remediation -[Optional: your ideas for fixing] - -## References -[Links to related issues, CVEs, research] -``` - ---- - -## Response Timeline - -We commit to the following response times: - -| Stage | Timeframe | Description | -|-------|-----------|-------------| -| **Initial Response** | 48 hours | We acknowledge receipt and confirm we're investigating | -| **Triage** | 7 days | We assess severity, confirm the vulnerability, and estimate timeline | -| **Status Update** | Every 7 days | Regular updates on remediation progress | -| **Resolution** | 90 days | Target for fix development and release (complex issues may take longer) | -| **Disclosure** | 90 days | Public disclosure after fix is available (coordinated with you) | - -> **Note:** These are targets, not guarantees. Complex vulnerabilities may require more time. We'll communicate openly about any delays. - ---- - -## Disclosure Policy - -We follow **coordinated disclosure** (also known as responsible disclosure): - -1. **You report** the vulnerability privately -2. **We acknowledge** and begin investigation -3. **We develop** a fix and prepare a release -4. **We coordinate** disclosure timing with you -5. **We publish** security advisory and fix simultaneously -6. **You may publish** your research after disclosure - -### Our Commitments - -- We will not take legal action against researchers who follow this policy -- We will work with you to understand and resolve the issue -- We will credit you in the security advisory (unless you prefer anonymity) -- We will notify you before public disclosure -- We will publish advisories with sufficient detail for users to assess risk - -### Your Commitments - -- Report vulnerabilities promptly after discovery -- Give us reasonable time to address the issue before disclosure -- Do not access, modify, or delete data beyond what's necessary to demonstrate the vulnerability -- Do not degrade service availability (no DoS testing on production) -- Do not share vulnerability details with others until coordinated disclosure - -### Disclosure Timeline - -``` -Day 0 You report vulnerability -Day 1-2 We acknowledge receipt -Day 7 We confirm vulnerability and share initial assessment -Day 7-90 We develop and test fix -Day 90 Coordinated public disclosure - (earlier if fix is ready; later by mutual agreement) -``` - -If we cannot reach agreement on disclosure timing, we default to 90 days from your initial report. - ---- - -## Scope - -### In Scope ✅ - -The following are within scope for security research: - -- This repository (`hyperpolymath/standards`) and all its code -- Official releases and packages published from this repository -- Documentation that could lead to security issues -- Build and deployment configurations in this repository -- Dependencies (report here, we'll coordinate with upstream) - -### Out of Scope ❌ - -The following are **not** in scope: - -- Third-party services we integrate with (report directly to them) -- Social engineering attacks against maintainers -- Physical security -- Denial of service attacks against production infrastructure -- Spam, phishing, or other non-technical attacks -- Issues already reported or publicly known -- Theoretical vulnerabilities without proof of concept - -### Qualifying Vulnerabilities - -We're particularly interested in: - -- Remote code execution -- SQL injection, command injection, code injection -- Authentication/authorisation bypass -- Cross-site scripting (XSS) and cross-site request forgery (CSRF) -- Server-side request forgery (SSRF) -- Path traversal / local file inclusion -- Information disclosure (credentials, PII, secrets) -- Cryptographic weaknesses -- Deserialisation vulnerabilities -- Memory safety issues (buffer overflows, use-after-free, etc.) -- Supply chain vulnerabilities (dependency confusion, etc.) -- Significant logic flaws - -### Non-Qualifying Issues - -The following generally do not qualify as security vulnerabilities: - -- Missing security headers on non-sensitive pages -- Clickjacking on pages without sensitive actions -- Self-XSS (requires victim to paste code) -- Missing rate limiting (unless it enables a specific attack) -- Username/email enumeration (unless high-risk context) -- Missing cookie flags on non-sensitive cookies -- Software version disclosure -- Verbose error messages (unless exposing secrets) -- Best practice deviations without demonstrable impact - ---- - -## Safe Harbour - -We support security research conducted in good faith. - -### Our Promise - -If you conduct security research in accordance with this policy: - -- ✅ We will not initiate legal action against you -- ✅ We will not report your activity to law enforcement -- ✅ We will work with you in good faith to resolve issues -- ✅ We consider your research authorised under the Computer Fraud and Abuse Act (CFAA), UK Computer Misuse Act, and similar laws -- ✅ We waive any potential claim against you for circumvention of security controls - -### Good Faith Requirements - -To qualify for safe harbour, you must: - -- Comply with this security policy -- Report vulnerabilities promptly -- Avoid privacy violations (do not access others' data) -- Avoid service degradation (no destructive testing) -- Not exploit vulnerabilities beyond proof-of-concept -- Not use vulnerabilities for profit (beyond bug bounties where offered) - -> **⚠️ Important:** This safe harbour does not extend to third-party systems. Always check their policies before testing. - ---- - -## Recognition - -We believe in recognising security researchers who help us improve. - -### Hall of Fame - -Researchers who report valid vulnerabilities will be acknowledged in our [Security Acknowledgments](SECURITY-ACKNOWLEDGMENTS.md) (unless they prefer anonymity). - -Recognition includes: - -- Your name (or chosen alias) -- Link to your website/profile (optional) -- Brief description of the vulnerability class -- Date of report - -### What We Offer - -- ✅ Public credit in security advisories -- ✅ Acknowledgment in release notes -- ✅ Entry in our Hall of Fame -- ✅ Reference/recommendation letter upon request (for significant findings) - -### What We Don't Currently Offer - -- ❌ Monetary bug bounties -- ❌ Hardware or swag -- ❌ Paid security research contracts - -> **Note:** We're a community project with limited resources. Your contributions help everyone who uses this software. - ---- - -## Security Updates - -### Receiving Updates - -To stay informed about security updates: - -- **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts" -- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/standards/security/advisories) -- **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md) - -### Update Policy - -| Severity | Response | -|----------|----------| -| **Critical/High** | Patch release as soon as fix is ready | -| **Medium** | Included in next scheduled release (or earlier) | -| **Low** | Included in next scheduled release | - -### Supported Versions - - - -| Version | Supported | Notes | -|---------|-----------|-------| -| `main` branch | ✅ Yes | Latest development | -| Latest release | ✅ Yes | Current stable | -| Previous minor release | ✅ Yes | Security fixes backported | -| Older versions | ❌ No | Please upgrade | - ---- - -## Security Best Practices - -When using Standards, we recommend: - -### General - -- Keep dependencies up to date -- Use the latest stable release -- Subscribe to security notifications -- Review configuration against security documentation -- Follow principle of least privilege - -### For Contributors - -- Never commit secrets, credentials, or API keys -- Use signed commits (`git config commit.gpgsign true`) -- Review dependencies before adding them -- Run security linters locally before pushing -- Report any concerns about existing code - ---- - -## Additional Resources - -- [Our PGP Public Key]({{PGP_KEY_URL}}) -- [Security Advisories](https://github.com/hyperpolymath/standards/security/advisories) -- [Changelog](CHANGELOG.md) -- [Contributing Guidelines](CONTRIBUTING.md) -- [CVE Database](https://cve.mitre.org/) -- [CVSS Calculator](https://www.first.org/cvss/calculator/3.1) - ---- - -## Contact - -| Purpose | Contact | -|---------|---------| -| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/standards/security/advisories/new) or 6759885+hyperpolymath@users.noreply.github.com | -| **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/standards/discussions) | -| **Other enquiries** | See [README](README.adoc) for contact information | - ---- - -## Policy Changes - -This security policy may be updated from time to time. Significant changes will be: - -- Committed to this repository with a clear commit message -- Noted in the changelog -- Announced via GitHub Discussions (for major changes) - ---- - -*Thank you for helping keep Standards and its users safe.* 🛡️ - ---- - -Last updated: 2026 · Policy version: 1.0.0 diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/TESTING-GUIDE.md b/avow-protocol/telegram-bot/avow-telegram-bot/TESTING-GUIDE.md deleted file mode 100644 index 2ad3c3d9..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/TESTING-GUIDE.md +++ /dev/null @@ -1,151 +0,0 @@ -# STAMP Bot Testing Guide - -## 🎯 Goal -Get 3-5 people to test @stamp_demo_bot and provide feedback on: -- Ease of use -- Clarity of proofs -- Understanding of STAMP value proposition -- Any bugs or confusion - -## 👥 Who to Ask - -**Best testers:** -- Tech-savvy friends (understand proofs) -- Non-technical family (test clarity) -- Marketing/business contacts (value prop feedback) -- Security-minded people (appreciate verification) - -## 📧 Message Template - -``` -Hey! I just launched a demo of STAMP Protocol - a new approach to -fighting spam using formal verification (mathematical proofs). - -Could you test it? Takes 2 minutes: - -1. Open Telegram -2. Search: @stamp_demo_bot -3. Send: /start -4. Try: /verify, /status, /unsubscribe - -Would love your feedback: -- Was it clear what's happening? -- Did the "proof" make sense? -- Would you trust this more than regular email? - -Thanks! 🙏 - -Live site: https://stamp-protocol.org -``` - -## 📋 Feedback Form - -Send testers this form to fill out: - -``` -STAMP Bot Feedback - -Name: ___________ -Date: ___________ - -1. First impressions (1-5): ☐☐☐☐☐ - -2. Did the consent proof make sense? - ☐ Yes, totally clear - ☐ Sort of understood it - ☐ Confusing - -3. Most valuable feature: - ☐ Proven consent - ☐ Working unsubscribe - ☐ Rate limiting - ☐ Transparency - -4. Would you use this for: - ☐ Email newsletters - ☐ Social media - ☐ Business messaging - ☐ Other: ___________ - -5. What's confusing or broken? - _________________________________ - _________________________________ - -6. What would make this better? - _________________________________ - _________________________________ - -7. Would you recommend this? ☐ Yes ☐ Maybe ☐ No - -8. Additional comments: - _________________________________ - _________________________________ -``` - -## 📊 Success Metrics - -**Minimum viable feedback:** -- 3 people tested successfully -- At least 2 understood the value prop -- 0 critical bugs found -- Average rating: 3+/5 - -**Ideal feedback:** -- 5+ people tested -- All understood value prop -- Feature requests noted -- Average rating: 4+/5 - -## 🐛 Known Issues to Watch For - -- Slow response times (bot lag) -- Unclear proof formatting -- Confusing terminology ("dependent types", "formal verification") -- Missing help text - -## 📝 How to Collect Feedback - -**Option 1: Direct messages** -- Send them the form above -- Ask follow-up questions -- Take notes - -**Option 2: Video call** -- Watch them use it (screen share) -- Note where they get confused -- Ask questions as they go - -**Option 3: Survey tool** -- Use Google Forms / Typeform -- Send link after they test -- Analyze responses - -## 🔄 After Testing - -1. **Compile feedback** → `~/stamp-bot-feedback.md` -2. **Identify patterns** (most common confusion) -3. **Prioritize fixes** (critical vs nice-to-have) -4. **Update bot** based on feedback -5. **Thank testers** (offer early access, credit them) - -## 🎁 Tester Incentives - -- Early access to production version -- Credit on website ("Thanks to our beta testers") -- Free tier when we monetize -- Swag (if/when available) - -## ✅ Ready to Test - -1. Make sure bot is running: `pgrep -f bot.ts` -2. Test it yourself first (all commands work) -3. Send message to 3-5 people -4. Collect feedback over next 2-3 days -5. Compile results - -**Bot status check:** -```bash -cd ~/Documents/hyperpolymath-repos/stamp-telegram-bot -pgrep -f bot.ts && echo "✓ Bot running" || echo "✗ Start bot" -tail -20 bot.log # Check for errors -``` diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/README.adoc b/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/README.adoc deleted file mode 100644 index d19a3877..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/README.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Contractiles Template Set -:toc: -:sectnums: - -This directory contains the generalized contractiles templates. Copy the `contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework. - -== Fill-In Instructions - -1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports). -2. Replace Trustfile.hs placeholders with your actual key paths and verification commands. -3. Adjust Dustfile handlers to match your rollback and recovery tooling. -4. Update Intentfile to mirror the roadmap you want the system to evolve toward. - -== Contents - -* `must/Mustfile` - required invariants and validations. -* `trust/Trustfile.hs` - cryptographic verification steps. -* `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/dust/Dustfile b/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/dust/Dustfile deleted file mode 100644 index 314903cc..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/dust/Dustfile +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile template - recovery and rollback semantics - -version: 1 - -recovery: - logs: - - name: decision-log - path: logs/decisions.json - reversible: true - handler: "log-replay --reverse logs/decisions.json" - - policy: - - name: policy-rollback - path: policy/policy.ncl - rollback: "git checkout HEAD~1 -- policy/policy.ncl" - notes: "Rollback policy to the previous known-good revision." - - gateway: - - name: bad-deployment - event: "deploy.failure" - undo: "kubectl rollout undo deployment/gateway" - notes: "Undo a failed deployment while preserving audit logs." - - dust-events: - - name: decision-log-to-dust - source: logs/decisions.json - transform: "dustify --input logs/decisions.json --output logs/dust-events.json" - notes: "Map gateway decision logs into reversible dust events." diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/must/Mustfile b/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/must/Mustfile deleted file mode 100644 index dc7b3be5..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/must/Mustfile +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile - declarative state contract (template) -# See: https://github.com/hyperpolymath/mustfile - -version: 1 - -metadata: - name: project-state-contract - spec: v0.0.1 - description: "Invariant checks for config, policy, gateway, logs, and schema." - -parameters: - gateway_port: "8080" - schema_version: "v0.0.1" - -checks: - - name: config-valid - description: "config/service.yaml must be valid." - run: "yq -e '.' config/service.yaml >/dev/null" - - - name: policy-compiles - description: "policy/policy.ncl must compile." - run: "nickel check policy/policy.ncl" - - - name: gateway-exposes-port - description: "Service must expose the configured port." - run: "bash -uc 'ss -lnt | rg \":${GATEWAY_PORT:-8080}\"'" - - - name: logs-are-json - description: "Logs must be JSON." - run: "bash -uc 'rg --files -g \"*.json\" logs | xargs -r jq -e .'" - - - name: schema-version-matches - description: "Schema must match version spec." - run: "bash -uc 'rg -n \"${SCHEMA_VERSION:-v0.0.1}\" schema'" diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/trust/Trustfile.hs b/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/trust/Trustfile.hs deleted file mode 100644 index 00b313fa..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/contractiles/trust/Trustfile.hs +++ /dev/null @@ -1,105 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- Trustfile template - cryptographic and provenance verification - -module Trustfile where - -import Control.Monad (forM) -import System.Directory (doesFileExist) -import System.Environment (lookupEnv) -import System.Exit (exitFailure, exitSuccess) -import System.Process (readProcessWithExitCode) - -policyPath :: FilePath -policyPath = "policy/policy.ncl" - -policyHashPath :: FilePath -policyHashPath = "policy/policy.ncl.sha256" - -schemaPath :: FilePath -schemaPath = "schema/schema.json" - -schemaSigPath :: FilePath -schemaSigPath = "schema/schema.sig" - -schemaPubPath :: FilePath -schemaPubPath = "schema/schema.pub" - -driverPaths :: [FilePath] -driverPaths = ["drivers/gateway-driver.bin"] - -migrationsPath :: FilePath -migrationsPath = "migrations/provenance.json" - -migrationsSigPath :: FilePath -migrationsSigPath = "migrations/provenance.sig" - -migrationsPubPath :: FilePath -migrationsPubPath = "migrations/provenance.pub" - -runCmd :: String -> [String] -> IO Bool -runCmd cmd args = do - (code, _out, _err) <- readProcessWithExitCode cmd args "" - pure (code == mempty) - -readFirstWord :: FilePath -> IO (Maybe String) -readFirstWord path = do - exists <- doesFileExist path - if not exists - then pure Nothing - else do - content <- readFile path - pure (case words content of - [] -> Nothing - (w:_) -> Just w) - -verifyPolicyHash :: IO Bool -verifyPolicyHash = do - expected <- readFirstWord policyHashPath - case expected of - Nothing -> pure False - Just hash -> do - (code, out, _err) <- readProcessWithExitCode "sha256sum" [policyPath] "" - if code /= mempty - then pure False - else do - let actual = case words out of - [] -> "" - (w:_) -> w - pure (actual == hash) - -verifySchemaSignature :: IO Bool -verifySchemaSignature = do - filesOk <- and <$> mapM doesFileExist [schemaPath, schemaSigPath, schemaPubPath] - if not filesOk - then pure False - else runCmd "openssl" ["dgst", "-sha256", "-verify", schemaPubPath, "-signature", schemaSigPath, schemaPath] - -verifyKyber1024Signatures :: IO Bool -verifyKyber1024Signatures = do - cmd <- lookupEnv "KYBER_VERIFY_CMD" - let kyberCmd = maybe "kyber-verify" id cmd - results <- forM driverPaths $ \path -> do - let sig = path <> ".sig" - let pub = path <> ".pub" - filesOk <- and <$> mapM doesFileExist [path, sig, pub] - if not filesOk - then pure False - else runCmd kyberCmd ["--pub", pub, "--sig", sig, "--file", path] - pure (and results) - -verifyMigrationProvenance :: IO Bool -verifyMigrationProvenance = do - filesOk <- and <$> mapM doesFileExist [migrationsPath, migrationsSigPath, migrationsPubPath] - if not filesOk - then pure False - else runCmd "openssl" ["dgst", "-sha256", "-verify", migrationsPubPath, "-signature", migrationsSigPath, migrationsPath] - -main :: IO () -main = do - policyOk <- verifyPolicyHash - schemaOk <- verifySchemaSignature - driversOk <- verifyKyber1024Signatures - migrationsOk <- verifyMigrationProvenance - if and [policyOk, schemaOk, driversOk, migrationsOk] - then exitSuccess - else exitFailure diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/deno.json b/avow-protocol/telegram-bot/avow-telegram-bot/deno.json deleted file mode 100644 index d45aece2..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/deno.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "tasks": { - "start": "deno run --allow-net --allow-read --allow-write --allow-env --allow-import --env=.env src/bot.ts", - "dev": "deno run --allow-net --allow-read --allow-write --allow-env --allow-import --env=.env --watch src/bot.ts", - "test": "deno test --allow-net --allow-read --allow-write" - }, - "imports": { - "@grammy/bot": "https://deno.land/x/grammy@v1.19.2/mod.ts", - "@db/sqlite": "https://deno.land/x/sqlite@v3.9.1/mod.ts" - }, - "compilerOptions": { - "strict": true, - "lib": ["deno.window"] - }, - "fmt": { - "indentWidth": 2, - "lineWidth": 100, - "semiColons": true - }, - "lint": { - "rules": { - "tags": ["recommended"] - } - } -} diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/deno.lock b/avow-protocol/telegram-bot/avow-telegram-bot/deno.lock deleted file mode 100644 index 3cc8bd03..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/deno.lock +++ /dev/null @@ -1,63 +0,0 @@ -{ - "version": "5", - "remote": { - "https://cdn.skypack.dev/-/debug@v4.3.4-o4liVvMlOnQWbLSYZMXw/dist=es2019,mode=imports/optimized/debug.js": "671100993996e39b501301a87000607916d4d2d9f8fc8e9c5200ae5ba64a1389", - "https://cdn.skypack.dev/-/ms@v2.1.2-giBDZ1IA5lmQ3ZXaa87V/dist=es2019,mode=imports/optimized/ms.js": "fd88e2d51900437011f1ad232f3393ce97db1b87a7844b3c58dd6d65562c1276", - "https://cdn.skypack.dev/debug@4.3.4": "7b1d010cc930f71b940ba5941da055bc181115229e29de7214bdb4425c68ea76", - "https://deno.land/std@0.202.0/path/_basename.ts": "057d420c9049821f983f784fd87fa73ac471901fb628920b67972b0f44319343", - "https://deno.land/std@0.202.0/path/_constants.ts": "e49961f6f4f48039c0dfed3c3f93e963ca3d92791c9d478ac5b43183413136e0", - "https://deno.land/std@0.202.0/path/_os.ts": "30b0c2875f360c9296dbe6b7f2d528f0f9c741cecad2e97f803f5219e91b40a2", - "https://deno.land/std@0.202.0/path/_util.ts": "4e191b1bac6b3bf0c31aab42e5ca2e01a86ab5a0d2e08b75acf8585047a86221", - "https://deno.land/std@0.202.0/path/basename.ts": "bdfa5a624c6a45564dc6758ef2077f2822978a6dbe77b0a3514f7d1f81362930", - "https://deno.land/std@0.202.0/streams/_common.ts": "3b2c1f0287ce2ad51fff4091a7d0f48375c85b0ec341468e76d5ac13bb0014dd", - "https://deno.land/std@0.202.0/streams/iterate_reader.ts": "3b42d3056c8ccade561f1c7ac22d5e671e745933d9f9168fd3b5913588d911c3", - "https://deno.land/x/grammy@v1.19.2/bot.ts": "8d13cd72f1512e3f76d685131c7d0db5ba51f2c877db5ac2c0aa4b0f6f876aa8", - "https://deno.land/x/grammy@v1.19.2/composer.ts": "8660f86990f4ef2afc4854a1f2610bb8d60f88116f3a57c8e5515a77b277f82d", - "https://deno.land/x/grammy@v1.19.2/context.ts": "4cf51ed7538750edb4379f757f6b8b3c1f3987242d58393160b463c9ca13c997", - "https://deno.land/x/grammy@v1.19.2/convenience/constants.ts": "3be0f6393ab2b2995fad6bcd4c9cf8a1a615ae4543fc864c107ba0dd38f123f6", - "https://deno.land/x/grammy@v1.19.2/convenience/frameworks.ts": "77e2f9fc841ab92d4310b556126447a42f131ad976a6adfff454c016f339b28e", - "https://deno.land/x/grammy@v1.19.2/convenience/inline_query.ts": "409d1940c7670708064efa495003bcbfdf6763a756b2e6303c464489fd3394ff", - "https://deno.land/x/grammy@v1.19.2/convenience/input_media.ts": "7af72a5fdb1af0417e31b1327003f536ddfdf64e06ab8bc7f5da6b574de38658", - "https://deno.land/x/grammy@v1.19.2/convenience/keyboard.ts": "21220dc2321c40203c699fa4eb7b07ed8217956ea0477c241a551224a58a278d", - "https://deno.land/x/grammy@v1.19.2/convenience/session.ts": "f92d57b6b2b61920912cf5c44d4db2f6ca999fe4f9adef170c321889d49667c2", - "https://deno.land/x/grammy@v1.19.2/convenience/webhook.ts": "f1da7d6426171fb7b5d5f6b59633f91d3bab9a474eea821f714932650965eb9e", - "https://deno.land/x/grammy@v1.19.2/core/api.ts": "7d4d8df3567e322ab3b793360ee48da09f46ad531ef994a87b3e6aef4ec23bf2", - "https://deno.land/x/grammy@v1.19.2/core/client.ts": "39639e4f5fc3a3f9d528c6906d7e3cdc268cf5d33929eeab801bb39642a59103", - "https://deno.land/x/grammy@v1.19.2/core/error.ts": "4638b2127ebe60249c78b83011d468f5e1e1a87748d32fe11a8200d9f824ad13", - "https://deno.land/x/grammy@v1.19.2/core/payload.ts": "420e17c3c2830b5576ea187cfce77578fe09f1204b25c25ea2f220ca7c86e73b", - "https://deno.land/x/grammy@v1.19.2/filter.ts": "201ddac882ab6cd46cae2d18eb8097460dfe7cedadaab2ba16959c5286d5a5f1", - "https://deno.land/x/grammy@v1.19.2/mod.ts": "b81cccf69779667b36bef5d0373d1567684917a3b9827873f3de7a7e6af1926f", - "https://deno.land/x/grammy@v1.19.2/platform.deno.ts": "84735643c8dde2cf8af5ac2e6b8eb0768452260878da93238d673cb1b4ccea55", - "https://deno.land/x/grammy@v1.19.2/types.deno.ts": "0f47eacde6d3d65f107f2abf16ecfe726298d30263367cc82e977c801b766229", - "https://deno.land/x/grammy@v1.19.2/types.ts": "729415590dfa188dbe924dea614dff4e976babdbabb28a307b869fc25777cdf0", - "https://deno.land/x/grammy_types@v3.3.0/api.ts": "efc90a31eb6f59ae5e7a4cf5838f46529e2fa6fa7e97a51a82dbd28afad21592", - "https://deno.land/x/grammy_types@v3.3.0/inline.ts": "b5669d79f8c0c6f7d6ca856d548c1ac7d490efd54ee785d18a7c4fc12abfd73b", - "https://deno.land/x/grammy_types@v3.3.0/manage.ts": "e39ec87e74469f70f35aa51dc520b02136ea5e75f9d7a7e0e513846a00b63fd2", - "https://deno.land/x/grammy_types@v3.3.0/markup.ts": "7b547b79130a112f98fbd3f0f754c8bb926f7cab3040d244b5f597aea0e1ce09", - "https://deno.land/x/grammy_types@v3.3.0/message.ts": "e78a7797174c537bb8de80597e265121615fa36a531dd88ac5af27aa68779172", - "https://deno.land/x/grammy_types@v3.3.0/methods.ts": "7547cedfec2c2727b30b8fa38050aee6642c56673b21cfd0ac56b0e531f02795", - "https://deno.land/x/grammy_types@v3.3.0/mod.ts": "7b5f421b4fbb1761f7f0d68328eaddd515f3222ce3f3cdfbedd8d5a4781e91a7", - "https://deno.land/x/grammy_types@v3.3.0/passport.ts": "e3fb63aec96510bcc317ef48fd25b435444b8f407502d7568c00fce15f2958fd", - "https://deno.land/x/grammy_types@v3.3.0/payment.ts": "d23e9038c5b479b606e620dd84e3e67b6642ada110a962f2d5b5286e99ec7de5", - "https://deno.land/x/grammy_types@v3.3.0/settings.ts": "5e989f5bd6c587d55673bd8052293869aa2f372e9223dd7f6e28632bfe021b6e", - "https://deno.land/x/grammy_types@v3.3.0/update.ts": "6d5ec6d1f6d2acf021f807f6bbf7d541487f30672cfab4700e7f935a490c3b78", - "https://deno.land/x/sqlite@v3.8/build/sqlite.js": "72f63689fffcb9bb5ae10b1e8f7db09ea845cdf713e0e3a9693d8416a28f92a6", - "https://deno.land/x/sqlite@v3.8/build/vfs.js": "08533cc78fb29b9d9bd62f6bb93e5ef333407013fed185776808f11223ba0e70", - "https://deno.land/x/sqlite@v3.8/mod.ts": "e09fc79d8065fe222578114b109b1fd60077bff1bb75448532077f784f4d6a83", - "https://deno.land/x/sqlite@v3.8/src/constants.ts": "90f3be047ec0a89bcb5d6fc30db121685fc82cb00b1c476124ff47a4b0472aa9", - "https://deno.land/x/sqlite@v3.8/src/db.ts": "7d3251021756fa80f382c3952217c7446c5c8c1642b63511da0938fe33562663", - "https://deno.land/x/sqlite@v3.8/src/error.ts": "f7a15cb00d7c3797da1aefee3cf86d23e0ae92e73f0ba3165496c3816ab9503a", - "https://deno.land/x/sqlite@v3.8/src/function.ts": "e4c83b8ec64bf88bafad2407376b0c6a3b54e777593c70336fb40d43a79865f2", - "https://deno.land/x/sqlite@v3.8/src/query.ts": "d58abda928f6582d77bad685ecf551b1be8a15e8e38403e293ec38522e030cad", - "https://deno.land/x/sqlite@v3.8/src/wasm.ts": "e79d0baa6e42423257fb3c7cc98091c54399254867e0f34a09b5bdef37bd9487", - "https://deno.land/x/sqlite@v3.9.1/build/sqlite.js": "2afc7875c7b9c85d89730c4a311ab3a304e5d1bf761fbadd8c07bbdf130f5f9b", - "https://deno.land/x/sqlite@v3.9.1/build/vfs.js": "7f7778a9fe499cd10738d6e43867340b50b67d3e39142b0065acd51a84cd2e03", - "https://deno.land/x/sqlite@v3.9.1/mod.ts": "e09fc79d8065fe222578114b109b1fd60077bff1bb75448532077f784f4d6a83", - "https://deno.land/x/sqlite@v3.9.1/src/constants.ts": "90f3be047ec0a89bcb5d6fc30db121685fc82cb00b1c476124ff47a4b0472aa9", - "https://deno.land/x/sqlite@v3.9.1/src/db.ts": "03d0c860957496eadedd86e51a6e650670764630e64f56df0092e86c90752401", - "https://deno.land/x/sqlite@v3.9.1/src/error.ts": "f7a15cb00d7c3797da1aefee3cf86d23e0ae92e73f0ba3165496c3816ab9503a", - "https://deno.land/x/sqlite@v3.9.1/src/function.ts": "bc778cab7a6d771f690afa27264c524d22fcb96f1bb61959ade7922c15a4ab8d", - "https://deno.land/x/sqlite@v3.9.1/src/query.ts": "d58abda928f6582d77bad685ecf551b1be8a15e8e38403e293ec38522e030cad", - "https://deno.land/x/sqlite@v3.9.1/src/wasm.ts": "e79d0baa6e42423257fb3c7cc98091c54399254867e0f34a09b5bdef37bd9487" - } -} diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/docs/CITATIONS.adoc b/avow-protocol/telegram-bot/avow-telegram-bot/docs/CITATIONS.adoc deleted file mode 100644 index 6f167bdf..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/docs/CITATIONS.adoc +++ /dev/null @@ -1,36 +0,0 @@ -= RSR-template-repo - Citation Guide -:toc: - -== BibTeX - -[source,bibtex] ----- -@software{rsr-template-repo_2025, - author = {Polymath, Hyper}, - title = {RSR-template-repo}, - year = {2025}, - url = {https://github.com/hyperpolymath/RSR-template-repo}, - license = {PMPL-1.0-or-later} -} ----- - -== Harvard Style - -Polymath, H. (2025) _RSR-template-repo_ [Computer software]. Available at: https://github.com/hyperpolymath/RSR-template-repo - -== OSCOLA - -Hyper Polymath, 'RSR-template-repo' (2025) - -== MLA - -Polymath, Hyper. "RSR-template-repo." 2025, github.com/hyperpolymath/RSR-template-repo. - -== APA 7 - -Polymath, H. (2025). _RSR-template-repo_ [Computer software]. GitHub. https://github.com/hyperpolymath/RSR-template-repo - -== See Also - -* link:../CITATION.cff[CITATION.cff] -* link:../codemeta.json[codemeta.json] diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/examples/web-project-deno.json b/avow-protocol/telegram-bot/avow-telegram-bot/examples/web-project-deno.json deleted file mode 100644 index 5ddd3bd7..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/examples/web-project-deno.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "// NOTE": "Example deno.json for ReScript web projects", - "tasks": { - "build": "deno run -A npm:rescript", - "clean": "deno run -A npm:rescript clean", - "watch": "deno run -A npm:rescript -w", - "serve": "deno run -A jsr:@std/http/file-server .", - "test": "deno test --allow-all" - }, - "imports": { - "rescript": "^12.0.0", - "@rescript/core": "npm:@rescript/core@^1.6.0", - "safe-dom/": "https://raw.githubusercontent.com/hyperpolymath/rescript-dom-mounter/main/src/", - "proven/": "../proven/bindings/rescript/src/" - }, - "compilerOptions": { - "allowJs": true, - "checkJs": false - } -} diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/ffi/zig/build.zig b/avow-protocol/telegram-bot/avow-telegram-bot/ffi/zig/build.zig deleted file mode 100644 index 4a2e049a..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/ffi/zig/build.zig +++ /dev/null @@ -1,94 +0,0 @@ -// {{PROJECT}} FFI Build Configuration -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -pub fn build(b: *std.Build) void { - const target = b.standardTargetOptions(.{}); - const optimize = b.standardOptimizeOption(.{}); - - // Shared library (.so, .dylib, .dll) - const lib = b.addSharedLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Set version - lib.version = .{ .major = 0, .minor = 1, .patch = 0 }; - - // Static library (.a) - const lib_static = b.addStaticLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Install artifacts - b.installArtifact(lib); - b.installArtifact(lib_static); - - // Generate header file for C compatibility - const header = b.addInstallHeader( - b.path("include/{{project}}.h"), - "{{project}}.h", - ); - b.getInstallStep().dependOn(&header.step); - - // Unit tests - const lib_tests = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - const run_lib_tests = b.addRunArtifact(lib_tests); - - const test_step = b.step("test", "Run library tests"); - test_step.dependOn(&run_lib_tests.step); - - // Integration tests - const integration_tests = b.addTest(.{ - .root_source_file = b.path("test/integration_test.zig"), - .target = target, - .optimize = optimize, - }); - - integration_tests.linkLibrary(lib); - - const run_integration_tests = b.addRunArtifact(integration_tests); - - const integration_test_step = b.step("test-integration", "Run integration tests"); - integration_test_step.dependOn(&run_integration_tests.step); - - // Documentation - const docs = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = .Debug, - }); - - const docs_step = b.step("docs", "Generate documentation"); - docs_step.dependOn(&b.addInstallDirectory(.{ - .source_dir = docs.getEmittedDocs(), - .install_dir = .prefix, - .install_subdir = "docs", - }).step); - - // Benchmark (if needed) - const bench = b.addExecutable(.{ - .name = "{{project}}-bench", - .root_source_file = b.path("bench/bench.zig"), - .target = target, - .optimize = .ReleaseFast, - }); - - bench.linkLibrary(lib); - - const run_bench = b.addRunArtifact(bench); - - const bench_step = b.step("bench", "Run benchmarks"); - bench_step.dependOn(&run_bench.step); -} diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/ffi/zig/src/main.zig b/avow-protocol/telegram-bot/avow-telegram-bot/ffi/zig/src/main.zig deleted file mode 100644 index 6b233bc7..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/ffi/zig/src/main.zig +++ /dev/null @@ -1,274 +0,0 @@ -// {{PROJECT}} FFI Implementation -// -// This module implements the C-compatible FFI declared in src/abi/Foreign.idr -// All types and layouts must match the Idris2 ABI definitions. -// -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -// Version information (keep in sync with project) -const VERSION = "0.1.0"; -const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string; - -/// Thread-local error storage -threadlocal var last_error: ?[]const u8 = null; - -/// Set the last error message -fn setError(msg: []const u8) void { - last_error = msg; -} - -/// Clear the last error -fn clearError() void { - last_error = null; -} - -//============================================================================== -// Core Types (must match src/abi/Types.idr) -//============================================================================== - -/// Result codes (must match Idris2 Result type) -pub const Result = enum(c_int) { - ok = 0, - @"error" = 1, - invalid_param = 2, - out_of_memory = 3, - null_pointer = 4, -}; - -/// Library handle (opaque to prevent direct access) -pub const Handle = opaque { - // Internal state hidden from C - allocator: std.mem.Allocator, - initialized: bool, - // Add your fields here -}; - -//============================================================================== -// Library Lifecycle -//============================================================================== - -/// Initialize the library -/// Returns a handle, or null on failure -export fn {{project}}_init() ?*Handle { - const allocator = std.heap.c_allocator; - - const handle = allocator.create(Handle) catch { - setError("Failed to allocate handle"); - return null; - }; - - // Initialize handle - handle.* = .{ - .allocator = allocator, - .initialized = true, - }; - - clearError(); - return handle; -} - -/// Free the library handle -export fn {{project}}_free(handle: ?*Handle) void { - const h = handle orelse return; - const allocator = h.allocator; - - // Clean up resources - h.initialized = false; - - allocator.destroy(h); - clearError(); -} - -//============================================================================== -// Core Operations -//============================================================================== - -/// Process data (example operation) -export fn {{project}}_process(handle: ?*Handle, input: u32) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Example processing logic - _ = input; - - clearError(); - return .ok; -} - -//============================================================================== -// String Operations -//============================================================================== - -/// Get a string result (example) -/// Caller must free the returned string -export fn {{project}}_get_string(handle: ?*Handle) ?[*:0]const u8 { - const h = handle orelse { - setError("Null handle"); - return null; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return null; - } - - // Example: allocate and return a string - const result = h.allocator.dupeZ(u8, "Example result") catch { - setError("Failed to allocate string"); - return null; - }; - - clearError(); - return result.ptr; -} - -/// Free a string allocated by the library -export fn {{project}}_free_string(str: ?[*:0]const u8) void { - const s = str orelse return; - const allocator = std.heap.c_allocator; - - const slice = std.mem.span(s); - allocator.free(slice); -} - -//============================================================================== -// Array/Buffer Operations -//============================================================================== - -/// Process an array of data -export fn {{project}}_process_array( - handle: ?*Handle, - buffer: ?[*]const u8, - len: u32, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const buf = buffer orelse { - setError("Null buffer"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Access the buffer - const data = buf[0..len]; - _ = data; - - // Process data here - - clearError(); - return .ok; -} - -//============================================================================== -// Error Handling -//============================================================================== - -/// Get the last error message -/// Returns null if no error -export fn {{project}}_last_error() ?[*:0]const u8 { - const err = last_error orelse return null; - - // Return C string (static storage, no need to free) - const allocator = std.heap.c_allocator; - const c_str = allocator.dupeZ(u8, err) catch return null; - return c_str.ptr; -} - -//============================================================================== -// Version Information -//============================================================================== - -/// Get the library version -export fn {{project}}_version() [*:0]const u8 { - return VERSION.ptr; -} - -/// Get build information -export fn {{project}}_build_info() [*:0]const u8 { - return BUILD_INFO.ptr; -} - -//============================================================================== -// Callback Support -//============================================================================== - -/// Callback function type (C ABI) -pub const Callback = *const fn (u64, u32) callconv(.C) u32; - -/// Register a callback -export fn {{project}}_register_callback( - handle: ?*Handle, - callback: ?Callback, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const cb = callback orelse { - setError("Null callback"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Store callback for later use - _ = cb; - - clearError(); - return .ok; -} - -//============================================================================== -// Utility Functions -//============================================================================== - -/// Check if handle is initialized -export fn {{project}}_is_initialized(handle: ?*Handle) u32 { - const h = handle orelse return 0; - return if (h.initialized) 1 else 0; -} - -//============================================================================== -// Tests -//============================================================================== - -test "lifecycle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try std.testing.expect({{project}}_is_initialized(handle) == 1); -} - -test "error handling" { - const result = {{project}}_process(null, 0); - try std.testing.expectEqual(Result.null_pointer, result); - - const err = {{project}}_last_error(); - try std.testing.expect(err != null); -} - -test "version" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - try std.testing.expectEqualStrings(VERSION, ver_str); -} diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/ffi/zig/test/integration_test.zig b/avow-protocol/telegram-bot/avow-telegram-bot/ffi/zig/test/integration_test.zig deleted file mode 100644 index 03419949..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/ffi/zig/test/integration_test.zig +++ /dev/null @@ -1,182 +0,0 @@ -// {{PROJECT}} Integration Tests -// SPDX-License-Identifier: MPL-2.0 -// -// These tests verify that the Zig FFI correctly implements the Idris2 ABI - -const std = @import("std"); -const testing = std.testing; - -// Import FFI functions -extern fn {{project}}_init() ?*opaque {}; -extern fn {{project}}_free(?*opaque {}) void; -extern fn {{project}}_process(?*opaque {}, u32) c_int; -extern fn {{project}}_get_string(?*opaque {}) ?[*:0]const u8; -extern fn {{project}}_free_string(?[*:0]const u8) void; -extern fn {{project}}_last_error() ?[*:0]const u8; -extern fn {{project}}_version() [*:0]const u8; -extern fn {{project}}_is_initialized(?*opaque {}) u32; - -//============================================================================== -// Lifecycle Tests -//============================================================================== - -test "create and destroy handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try testing.expect(handle != null); -} - -test "handle is initialized" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const initialized = {{project}}_is_initialized(handle); - try testing.expectEqual(@as(u32, 1), initialized); -} - -test "null handle is not initialized" { - const initialized = {{project}}_is_initialized(null); - try testing.expectEqual(@as(u32, 0), initialized); -} - -//============================================================================== -// Operation Tests -//============================================================================== - -test "process with valid handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const result = {{project}}_process(handle, 42); - try testing.expectEqual(@as(c_int, 0), result); // 0 = ok -} - -test "process with null handle returns error" { - const result = {{project}}_process(null, 42); - try testing.expectEqual(@as(c_int, 4), result); // 4 = null_pointer -} - -//============================================================================== -// String Tests -//============================================================================== - -test "get string result" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const str = {{project}}_get_string(handle); - defer if (str) |s| {{project}}_free_string(s); - - try testing.expect(str != null); -} - -test "get string with null handle" { - const str = {{project}}_get_string(null); - try testing.expect(str == null); -} - -//============================================================================== -// Error Handling Tests -//============================================================================== - -test "last error after null handle operation" { - _ = {{project}}_process(null, 0); - - const err = {{project}}_last_error(); - try testing.expect(err != null); - - if (err) |e| { - const err_str = std.mem.span(e); - try testing.expect(err_str.len > 0); - } -} - -test "no error after successful operation" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - _ = {{project}}_process(handle, 0); - - // Error should be cleared after successful operation - // (This depends on implementation) -} - -//============================================================================== -// Version Tests -//============================================================================== - -test "version string is not empty" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - try testing.expect(ver_str.len > 0); -} - -test "version string is semantic version format" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - // Should be in format X.Y.Z - try testing.expect(std.mem.count(u8, ver_str, ".") >= 1); -} - -//============================================================================== -// Memory Safety Tests -//============================================================================== - -test "multiple handles are independent" { - const h1 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h1); - - const h2 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h2); - - try testing.expect(h1 != h2); - - // Operations on h1 should not affect h2 - _ = {{project}}_process(h1, 1); - _ = {{project}}_process(h2, 2); -} - -test "double free is safe" { - const handle = {{project}}_init() orelse return error.InitFailed; - - {{project}}_free(handle); - {{project}}_free(handle); // Should not crash -} - -test "free null is safe" { - {{project}}_free(null); // Should not crash -} - -//============================================================================== -// Thread Safety Tests (if applicable) -//============================================================================== - -test "concurrent operations" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const ThreadContext = struct { - h: *opaque {}, - id: u32, - }; - - const thread_fn = struct { - fn run(ctx: ThreadContext) void { - _ = {{project}}_process(ctx.h, ctx.id); - } - }.run; - - var threads: [4]std.Thread = undefined; - for (&threads, 0..) |*thread, i| { - thread.* = try std.Thread.spawn(.{}, thread_fn, .{ - ThreadContext{ .h = handle, .id = @intCast(i) }, - }); - } - - for (threads) |thread| { - thread.join(); - } -} diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/rescript.json b/avow-protocol/telegram-bot/avow-telegram-bot/rescript.json deleted file mode 100644 index 30e7ab98..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/rescript.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "name": "stamp-telegram-bot", - "version": "1.0.0", - "sources": [ - { - "dir": "src", - "subdirs": true - } - ], - "package-specs": [ - { - "module": "es6", - "in-source": true - } - ], - "suffix": ".res.js", - "bs-dependencies": [], - "warnings": { - "error": "+101" - }, - "bsc-flags": ["-open Belt"] -} diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/src/bot.affine b/avow-protocol/telegram-bot/avow-telegram-bot/src/bot.affine deleted file mode 100644 index 291933df..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/src/bot.affine +++ /dev/null @@ -1,232 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// -// STAMP Telegram Bot. -// AffineScript port of bot.ts. Compiled via --target node-cjs (affinescript#35). -// -// Callback handlers are registered as wasm table index references (@fn_name). -// The Grammy Node-CJS shim calls back into wasm when Telegram delivers a command. -// Async operations (ctx.reply, bot.api.sendMessage) are handled by the shim; -// the wasm code sees them as synchronous extern fn calls. - -module Bot; - -extern type Bot; -extern type Context; -extern type BotInfo; -extern type Db; -extern fn bot_new(token: String) -> Bot; -extern fn bot_command(b: Bot, command: String, handler: Int) -> Int; -extern fn bot_catch(b: Bot, err_handler: Int) -> Int; -extern fn bot_start(b: Bot, on_start_handler: Int) -> Int; -extern fn ctx_from_id(ctx: Context) -> Option; -extern fn ctx_from_username(ctx: Context) -> Option; -extern fn ctx_reply(ctx: Context, text: String, parse_mode: String) -> Int; -extern fn botinfo_username(info: BotInfo) -> String; -extern fn set_interval(handler: Int, interval_ms: Int) -> Int; -extern fn db_open(path: String) -> Db; -extern fn db_execute(d: Db, sql: String) -> Int; -extern fn db_query_int(d: Db, sql: String, params_json: String) -> Int; -extern fn db_query_one(d: Db, sql: String, params_json: String) -> String; -extern fn db_query(d: Db, sql: String, params_json: String) -> String; -extern fn time_ms() -> Int; -extern fn random_string(n: Int) -> String; -extern fn getenv(name: String) -> Option; -extern fn process_exit(code: Int) -> Int; -extern fn log(s: String) -> Int; - -// __ Startup _______________________________________________________________ - -pub fn main() -> Int { - let token = match getenv("BOT_TOKEN") { - Some(t) => t, - None => { - log("Error: BOT_TOKEN environment variable not set"); - process_exit(1); - "" - } - }; - - let bot = bot_new(token); - - log("STAMP Telegram Bot starting..."); - - bot_command(bot, "start", @handle_start); - bot_command(bot, "verify", @handle_verify); - bot_command(bot, "unsubscribe", @handle_unsubscribe); - bot_command(bot, "status", @handle_status); - bot_command(bot, "help", @handle_help); - - set_interval(@send_demo_messages, 3600000); - bot_catch(bot, @handle_error); - bot_start(bot, @handle_bot_start); - 0 -} - -pub fn handle_bot_start(info: BotInfo) -> Int { - log("Connected as @" ++ botinfo_username(info)); - log("Polling for messages..."); - 0 -} - -pub fn handle_error(err_msg: String) -> Int { - log("Bot error: " ++ err_msg); - 0 -} - -// __ DB helpers ____________________________________________________________ - -fn open_db() -> Db { - db_open("./db/stamp-bot.db") -} - -fn is_subscribed(db: Db, uid: Int) -> Bool { - let p = "[" ++ show(uid) ++ "]"; - db_query_int(db, "SELECT COUNT(*) FROM users WHERE telegram_id=? AND subscribed=1", p) > 0 -} - -fn get_token(db: Db, uid: Int) -> String { - let p = "[" ++ show(uid) ++ "]"; - let row = db_query_one(db, "SELECT consent_token FROM users WHERE telegram_id=?", p); - if row == "null" { "" } else { row } -} - -fn subscribe(db: Db, uid: Int, username: String, token: String, proof: String) -> Int { - let now = time_ms(); - db_execute(db, "INSERT INTO users (telegram_id,username,subscribed,consent_timestamp,consent_token,consent_proof,created_at,updated_at) VALUES (" ++ show(uid) ++ ",'" ++ username ++ "',1," ++ show(now) ++ ",'" ++ token ++ "','" ++ proof ++ "'," ++ show(now) ++ "," ++ show(now) ++ ") ON CONFLICT(telegram_id) DO UPDATE SET subscribed=1,consent_timestamp=" ++ show(now) ++ ",consent_token='" ++ token ++ "',consent_proof='" ++ proof ++ "',updated_at=" ++ show(now)) -} - -fn unsubscribe(db: Db, uid: Int) -> Int { - let now = time_ms(); - db_execute(db, "UPDATE users SET subscribed=0,updated_at=" ++ show(now) ++ " WHERE telegram_id=" ++ show(uid)) -} - -// __ /start ________________________________________________________________ - -pub fn handle_start(ctx: Context) -> Int { - let uid = match ctx_from_id(ctx) { - Some(id) => id, - None => { ctx_reply(ctx, "Error: Could not identify user", ""); return 0; } - }; - let username = match ctx_from_username(ctx) { Some(u) => u, None => "" }; - let db = open_db(); - - if is_subscribed(db, uid) { - ctx_reply(ctx, - "You are already subscribed!\\n\\nUse /status or /unsubscribe.", - "Markdown"); - return 0; - } - - let now = time_ms(); - let token = show(uid) ++ "_" ++ show(now) ++ "_" ++ random_string(13); - let proof = "{\"type\":\"consent_verification\",\"timestamp\":" ++ show(now) ++ "}"; - - subscribe(db, uid, username, token, proof); - - ctx_reply(ctx, - "*Subscription Confirmed*\\n\\n" ++ - "Token: " ++ string_sub(token, 0, 20) ++ "...\\n" ++ - "Proof: Cryptographically signed\\n\\n" ++ - "/verify - Show proof for last message\\n" ++ - "/status - Show subscription status\\n" ++ - "/unsubscribe - Unsubscribe", - "Markdown"); - 0 -} - -// __ /verify _______________________________________________________________ - -pub fn handle_verify(ctx: Context) -> Int { - let uid = match ctx_from_id(ctx) { - Some(id) => id, - None => { return 0; } - }; - let db = open_db(); - let p = "[" ++ show(uid) ++ "]"; - let msg = db_query_one(db, "SELECT subject,sent_at,proof FROM messages WHERE telegram_id=? ORDER BY sent_at DESC LIMIT 1", p); - if msg == "null" { - ctx_reply(ctx, "No messages to verify yet. You will receive a demo message soon!", ""); - } else { - ctx_reply(ctx, - "*STAMP Verification Proof*\\n\\n" ++ - "Last message proof:\\n```json\\n" ++ msg ++ "\\n```\\n\\n" ++ - "This proof is cryptographically signed.", - "Markdown"); - } - 0 -} - -// __ /unsubscribe __________________________________________________________ - -pub fn handle_unsubscribe(ctx: Context) -> Int { - let uid = match ctx_from_id(ctx) { - Some(id) => id, - None => { return 0; } - }; - let db = open_db(); - if !is_subscribed(db, uid) { - ctx_reply(ctx, "You are not currently subscribed. Use /start to subscribe.", ""); - return 0; - } - unsubscribe(db, uid); - ctx_reply(ctx, - "*Unsubscribed Successfully*\\n\\n" ++ - "You will NOT receive future messages.\\n" ++ - "Use /start to re-subscribe anytime.", - "Markdown"); - 0 -} - -// __ /status _______________________________________________________________ - -pub fn handle_status(ctx: Context) -> Int { - let uid = match ctx_from_id(ctx) { - Some(id) => id, - None => { return 0; } - }; - let db = open_db(); - let user = db_query_one(db, "SELECT telegram_id,subscribed,consent_token FROM users WHERE telegram_id=?", - "[" ++ show(uid) ++ "]"); - if user == "null" { - ctx_reply(ctx, "No subscription found. Use /start to subscribe.", ""); - } else { - let total = db_query_int(db, "SELECT COUNT(*) FROM users", "[]"); - let active = db_query_int(db, "SELECT COUNT(*) FROM users WHERE subscribed=1", "[]"); - let msgs = db_query_int(db, "SELECT COUNT(*) FROM messages WHERE telegram_id=?", - "[" ++ show(uid) ++ "]"); - ctx_reply(ctx, - "*Your STAMP Subscription*\\n\\n" ++ - "Messages received: " ++ show(msgs) ++ "\\n\\n" ++ - "*Bot Statistics:*\\n" ++ - "Total users: " ++ show(total) ++ "\\n" ++ - "Active subscriptions: " ++ show(active), - "Markdown"); - } - 0 -} - -// __ /help _________________________________________________________________ - -pub fn handle_help(ctx: Context) -> Int { - ctx_reply(ctx, - "*STAMP Protocol Demo Bot*\\n\\n" ++ - "Demonstrates STAMP protocol verification.\\n\\n" ++ - "*Commands:*\\n" ++ - "/start - Subscribe to demo messages\\n" ++ - "/verify - Show proof for last message\\n" ++ - "/status - Show subscription details\\n" ++ - "/unsubscribe - Unsubscribe (one-click, proven)\\n" ++ - "/help - Show this help", - "Markdown"); - 0 -} - -// __ Periodic demo messages ________________________________________________ - -pub fn send_demo_messages() -> Int { - let db = open_db(); - let users = db_query(db, "SELECT telegram_id,consent_token FROM users WHERE subscribed=1", "[]"); - log("Sending demo messages to subscribed users..."); - 0 -} diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/src/database.affine b/avow-protocol/telegram-bot/avow-telegram-bot/src/database.affine deleted file mode 100644 index 87fb5eec..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/src/database.affine +++ /dev/null @@ -1,92 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// -// SQLite database layer for the STAMP Telegram bot. -// AffineScript port of database.ts. Uses stdlib/Sqlite.affine extern bindings. -// Compiled via: affinescript compile --target node-cjs - -module Database; - -extern type Db; -extern fn db_open(path: String) -> Db; -extern fn db_close(d: Db) -> Int; -extern fn db_execute(d: Db, sql: String) -> Int; -extern fn db_query(d: Db, sql: String, params_json: String) -> String; -extern fn db_query_one(d: Db, sql: String, params_json: String) -> String; -extern fn db_query_int(d: Db, sql: String, params_json: String) -> Int; -extern fn time_ms() -> Int; - -// __ Schema ________________________________________________________________ - -fn init_schema(db: Db) -> Int { - db_execute(db, "CREATE TABLE IF NOT EXISTS users (telegram_id INTEGER PRIMARY KEY, username TEXT, subscribed INTEGER NOT NULL DEFAULT 1, consent_timestamp INTEGER NOT NULL, consent_token TEXT NOT NULL, consent_proof TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)"); - db_execute(db, "CREATE TABLE IF NOT EXISTS messages (id INTEGER PRIMARY KEY AUTOINCREMENT, telegram_id INTEGER NOT NULL, subject TEXT NOT NULL, body TEXT NOT NULL, sent_at INTEGER NOT NULL, proof TEXT NOT NULL, FOREIGN KEY (telegram_id) REFERENCES users(telegram_id))"); - db_execute(db, "CREATE INDEX IF NOT EXISTS idx_messages_telegram_id ON messages(telegram_id)"); - db_execute(db, "CREATE INDEX IF NOT EXISTS idx_messages_sent_at ON messages(sent_at)") -} - -pub fn db_new(path: String) -> Db { - let db = db_open(path); - init_schema(db); - db -} - -// __ User operations _______________________________________________________ - -pub fn subscribe_user(db: Db, telegram_id: Int, username: String, - consent_token: String, consent_proof: String) -> Int { - let now = time_ms(); - let params = "[" ++ show(telegram_id) ++ ",\"" ++ username ++ "\"," - ++ show(now) ++ ",\"" ++ consent_token ++ "\",\"" ++ consent_proof ++ "\"," - ++ show(now) ++ "," ++ show(now) ++ "," ++ show(now) ++ ",\"" - ++ consent_token ++ "\",\"" ++ consent_proof ++ "\"," ++ show(now) ++ "]"; - db_execute(db, "INSERT INTO users (telegram_id,username,subscribed,consent_timestamp,consent_token,consent_proof,created_at,updated_at) VALUES (?,?,1,?,?,?,?,?) ON CONFLICT(telegram_id) DO UPDATE SET subscribed=1,consent_timestamp=?,consent_token=?,consent_proof=?,updated_at=?") -} - -pub fn unsubscribe_user(db: Db, telegram_id: Int) -> Int { - let params = "[" ++ show(time_ms()) ++ "," ++ show(telegram_id) ++ "]"; - db_execute(db, "UPDATE users SET subscribed=0,updated_at=? WHERE telegram_id=? AND subscribed=1") -} - -pub fn is_subscribed(db: Db, telegram_id: Int) -> Bool { - let params = "[" ++ show(telegram_id) ++ "]"; - let count = db_query_int(db, "SELECT COUNT(*) FROM users WHERE telegram_id=? AND subscribed=1", params); - count > 0 -} - -pub fn get_subscribed_user_ids(db: Db) -> String { - db_query(db, "SELECT telegram_id,consent_token FROM users WHERE subscribed=1", "[]") -} - -pub fn get_user_json(db: Db, telegram_id: Int) -> String { - let params = "[" ++ show(telegram_id) ++ "]"; - db_query_one(db, "SELECT telegram_id,username,subscribed,consent_timestamp,consent_token,consent_proof,created_at,updated_at FROM users WHERE telegram_id=?", params) -} - -// __ Message operations ____________________________________________________ - -pub fn record_message(db: Db, telegram_id: Int, subject: String, - body: String, proof: String) -> Int { - let params = "[" ++ show(telegram_id) ++ ",\"" ++ subject ++ "\",\"" - ++ body ++ "\"," ++ show(time_ms()) ++ ",\"" ++ proof ++ "\"]"; - db_execute(db, "INSERT INTO messages (telegram_id,subject,body,sent_at,proof) VALUES (?,?,?,?,?)") -} - -pub fn get_last_message_json(db: Db, telegram_id: Int) -> String { - let params = "[" ++ show(telegram_id) ++ "]"; - db_query_one(db, "SELECT id,telegram_id,subject,body,sent_at,proof FROM messages WHERE telegram_id=? ORDER BY sent_at DESC LIMIT 1", params) -} - -// __ Stats _________________________________________________________________ - -pub fn total_users(db: Db) -> Int { - db_query_int(db, "SELECT COUNT(*) FROM users", "[]") -} - -pub fn subscribed_users_count(db: Db) -> Int { - db_query_int(db, "SELECT COUNT(*) FROM users WHERE subscribed=1", "[]") -} - -pub fn total_messages(db: Db) -> Int { - db_query_int(db, "SELECT COUNT(*) FROM messages", "[]") -} diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/src/grammy.affine b/avow-protocol/telegram-bot/avow-telegram-bot/src/grammy.affine deleted file mode 100644 index 0be92a25..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/src/grammy.affine +++ /dev/null @@ -1,32 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// -// FFI bindings for the Grammy Telegram bot framework. -// AffineScript port of Grammy.res. - -module Grammy; - -extern type Context; -extern type Bot; - -module From { - pub type T = { id: Int, username: Option } -} - -extern fn get_from(ctx: Context) -> Option = "grammy" "from"; -extern fn reply(ctx: Context, text: String, options_json: String) -> Promise = "grammy" "reply"; - -extern fn make_bot(token: String) -> Bot = "https://deno.land/x/grammy@v1.19.2/mod.ts" "Bot"; -extern fn command(b: Bot, name: String, handler: fn(Context) -> Promise) -> Unit = "grammy" "command"; -extern fn catch_errors(b: Bot, handler: fn(a) -> Unit) -> Unit = "grammy" "catch"; - -pub type BotInfo = { username: String } -pub type StartOptions = { on_start: fn(BotInfo) -> Unit } - -extern fn start(b: Bot, options: StartOptions) -> Promise = "grammy" "start"; - -module Api { - extern type T; - extern fn api(b: Bot) -> T = "grammy" "api"; - extern fn send_message(a: T, chat_id: Int, text: String, options_json: String) -> Promise = "grammy" "sendMessage"; -} diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/src/sqlite.affine b/avow-protocol/telegram-bot/avow-telegram-bot/src/sqlite.affine deleted file mode 100644 index da37fbbc..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/src/sqlite.affine +++ /dev/null @@ -1,14 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// -// FFI bindings for SQLite (deno.land/x/sqlite). -// AffineScript port of Sqlite.res. - -module Sqlite; - -extern type Db; - -extern fn make_db(path: String) -> Db = "https://deno.land/x/sqlite@v3.9.1/mod.ts" "DB"; -extern fn execute(d: Db, sql: String) -> Unit = "sqlite" "execute"; -extern fn query(d: Db, sql: String, params: [Json]) -> [[Json]] = "sqlite" "query"; -extern fn close(d: Db) -> Unit = "sqlite" "close"; diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/src/stamp-mock.affine b/avow-protocol/telegram-bot/avow-telegram-bot/src/stamp-mock.affine deleted file mode 100644 index 7e0afc01..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/src/stamp-mock.affine +++ /dev/null @@ -1,176 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// -// Mock STAMP verification library. -// -// AffineScript port of stamp-mock.ts. Temporary implementation for the MVP -// Telegram bot without dependent-type proofs. Replace with real libstamp -// FFI when the libstamp Zig bindings land. - -module StampMock; - -extern fn time_ms() -> Int; -extern fn random_string(n: Int) -> String; - -// __ Types _________________________________________________________________ - -pub type VerificationResult = - | VrSuccess - | VrErrInvalidUrl - | VrErrTimeout - | VrErrInvalidResponse - | VrErrInvalidSignature - | VrErrRateLimitExceeded - | VrErrConsentInvalid - | VrErrNullPointer - | VrErrInternal - -pub type UnsubscribeParams = { - url: String, - tested_at: Int, - response_code: Int, - response_time: Int, - token: String, - signature: String, -} - -pub type ConsentParams = { - initial_request: Int, - confirmation: Int, - ip_address: String, - token: String, -} - -pub type RateLimitParams = { - sender_id: String, - account_created: Int, - messages_today: Int, - daily_limit: Int, -} - -pub type Proof = { - proof_type: String, - timestamp: Int, - signature: String, -} - -// __ Helpers _______________________________________________________________ - -fn str_starts_with(s: String, prefix: String) -> Bool { - let plen = len(prefix); - if plen > len(s) { - false - } else { - string_sub(s, 0, plen) == prefix - } -} - -// __ Verification __________________________________________________________ - -pub fn verify_unsubscribe_at(p: UnsubscribeParams, now: Int) -> VerificationResult { - if !str_starts_with(p.url, "https://") { - return VrErrInvalidUrl(); - } - let age = now - p.tested_at; - if age > 60000 || age < 0 { - return VrErrTimeout(); - } - if p.response_code != 200 { - return VrErrInvalidResponse(); - } - if p.response_time >= 200 { - return VrErrTimeout(); - } - if len(p.signature) == 0 { - return VrErrInvalidSignature(); - } - VrSuccess() -} - -pub fn verify_unsubscribe(p: UnsubscribeParams) -> VerificationResult { - verify_unsubscribe_at(p, time_ms()) -} - -pub fn verify_consent(p: ConsentParams) -> VerificationResult { - if p.confirmation <= p.initial_request { - return VrErrConsentInvalid(); - } - let diff = p.confirmation - p.initial_request; - if diff > 86400000 { - return VrErrConsentInvalid(); - } - if len(p.token) == 0 { - return VrErrInvalidSignature(); - } - VrSuccess() -} - -pub fn verify_rate_limit_at(p: RateLimitParams, now: Int) -> VerificationResult { - if p.messages_today >= p.daily_limit { - return VrErrRateLimitExceeded(); - } - let age_days = (now - p.account_created) / 86400000; - let max_limit = if age_days < 30 { - 1000 - } else if age_days < 90 { - 10000 - } else { - 100000 - }; - if p.daily_limit > max_limit { - return VrErrRateLimitExceeded(); - } - VrSuccess() -} - -pub fn verify_rate_limit(p: RateLimitParams) -> VerificationResult { - verify_rate_limit_at(p, time_ms()) -} - -// __ Proof _________________________________________________________________ - -pub fn generate_proof(proof_type: String) -> Proof { - let ts = time_ms(); - Proof #{ - proof_type: proof_type ++ "_verification", - timestamp: ts, - signature: "mock_sig_" ++ show(ts) ++ "_" ++ random_string(7), - } -} - -pub fn format_proof(p: Proof) -> String { - "{\"type\":\"" ++ p.proof_type - ++ "\",\"timestamp\":" ++ show(p.timestamp) - ++ ",\"signature\":\"" ++ p.signature ++ "\"}" -} - -pub fn result_to_string(r: VerificationResult) -> String { - match r { - VrSuccess => "SUCCESS", - VrErrInvalidUrl => "INVALID_URL", - VrErrTimeout => "TIMEOUT", - VrErrInvalidResponse => "INVALID_RESPONSE", - VrErrInvalidSignature => "INVALID_SIGNATURE", - VrErrRateLimitExceeded => "RATE_LIMIT_EXCEEDED", - VrErrConsentInvalid => "CONSENT_INVALID", - VrErrNullPointer => "NULL_POINTER", - VrErrInternal => "INTERNAL_ERROR", - } -} - -pub fn generate_unsubscribe_url(user_id: Int, token: String) -> String { - "https://stamp-bot.example.com/unsubscribe?user=" ++ show(user_id) ++ "&token=" ++ token -} - -pub fn test_unsubscribe_url(url: String) -> (Int, Int) { - let status = if str_starts_with(url, "https://") { 200 } else { 404 }; - (status, 87) -} - -pub fn generate_token(user_id: Int) -> String { - show(user_id) ++ "_" ++ show(time_ms()) ++ "_" ++ random_string(13) -} - -pub fn generate_signature(data: String) -> String { - "sig_" ++ show(time_ms()) ++ "_" ++ show(len(data)) ++ "_" ++ random_string(7) -} diff --git a/avow-protocol/telegram-bot/avow-telegram-bot/test-mock.affine b/avow-protocol/telegram-bot/avow-telegram-bot/test-mock.affine deleted file mode 100644 index 805cfbcc..00000000 --- a/avow-protocol/telegram-bot/avow-telegram-bot/test-mock.affine +++ /dev/null @@ -1,195 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell -// -// Tests for the mock STAMP verification library. -// AffineScript port of test-mock.ts. -// -// Self-contained: declares types and logic inline since module imports -// are not yet resolved at test-harness compile time. Logic is kept in sync -// with stamp-mock.affine; the duplication is tracked and will be removed -// once the module system supports cross-file imports in the deno-test harness. -// -// Convention: pub fn test_() -> Bool (affinescript-deno-test harness) - -// __ Fixed "current time" for deterministic tests ___________________________ - -fn mock_now() -> Int { - 2000000000000 -} - -// __ Types (local copy) ____________________________________________________ - -type VerificationResult = - | VrSuccess - | VrErrInvalidUrl - | VrErrTimeout - | VrErrInvalidResponse - | VrErrInvalidSignature - | VrErrRateLimitExceeded - | VrErrConsentInvalid - | VrErrNullPointer - | VrErrInternal - -type UnsubscribeParams = { - url: String, - tested_at: Int, - response_code: Int, - response_time: Int, - token: String, - signature: String, -} - -type ConsentParams = { - initial_request: Int, - confirmation: Int, - ip_address: String, - token: String, -} - -type Proof = { - proof_type: String, - timestamp: Int, - signature: String, -} - -// __ Logic (local copy) ____________________________________________________ - -fn str_starts_with(s: String, prefix: String) -> Bool { - let plen = len(prefix); - if plen > len(s) { false } else { string_sub(s, 0, plen) == prefix } -} - -fn verify_unsubscribe_at(p: UnsubscribeParams, now: Int) -> VerificationResult { - if !str_starts_with(p.url, "https://") { return VrErrInvalidUrl(); } - let age = now - p.tested_at; - if age > 60000 || age < 0 { return VrErrTimeout(); } - if p.response_code != 200 { return VrErrInvalidResponse(); } - if p.response_time >= 200 { return VrErrTimeout(); } - if len(p.signature) == 0 { return VrErrInvalidSignature(); } - VrSuccess() -} - -fn verify_consent(p: ConsentParams) -> VerificationResult { - if p.confirmation <= p.initial_request { return VrErrConsentInvalid(); } - let diff = p.confirmation - p.initial_request; - if diff > 86400000 { return VrErrConsentInvalid(); } - if len(p.token) == 0 { return VrErrInvalidSignature(); } - VrSuccess() -} - -fn result_to_string(r: VerificationResult) -> String { - match r { - VrSuccess => "SUCCESS", - VrErrInvalidUrl => "INVALID_URL", - VrErrTimeout => "TIMEOUT", - VrErrInvalidResponse => "INVALID_RESPONSE", - VrErrInvalidSignature => "INVALID_SIGNATURE", - VrErrRateLimitExceeded => "RATE_LIMIT_EXCEEDED", - VrErrConsentInvalid => "CONSENT_INVALID", - VrErrNullPointer => "NULL_POINTER", - VrErrInternal => "INTERNAL_ERROR", - } -} - -fn make_valid_unsub() -> UnsubscribeParams { - UnsubscribeParams #{ - url: "https://example.com/unsubscribe", - tested_at: mock_now() - 5000, - response_code: 200, - response_time: 87, - token: "abc123", - signature: "valid_sig", - } -} - -// __ Tests _________________________________________________________________ - -pub fn test_verify_unsubscribe_valid() -> Bool { - match verify_unsubscribe_at(make_valid_unsub(), mock_now()) { - VrSuccess => true, - _ => false, - } -} - -pub fn test_verify_unsubscribe_invalid_url() -> Bool { - let p = UnsubscribeParams #{ - url: "not_https", - tested_at: mock_now() - 5000, - response_code: 200, - response_time: 87, - token: "abc123", - signature: "valid_sig", - }; - match verify_unsubscribe_at(p, mock_now()) { - VrErrInvalidUrl => true, - _ => false, - } -} - -pub fn test_verify_unsubscribe_stale_timestamp() -> Bool { - let p = UnsubscribeParams #{ - url: "https://example.com/unsubscribe", - tested_at: 0, - response_code: 200, - response_time: 87, - token: "abc123", - signature: "valid_sig", - }; - match verify_unsubscribe_at(p, mock_now()) { - VrErrTimeout => true, - _ => false, - } -} - -pub fn test_verify_unsubscribe_bad_response_code() -> Bool { - let p = UnsubscribeParams #{ - url: "https://example.com/unsubscribe", - tested_at: mock_now() - 5000, - response_code: 404, - response_time: 87, - token: "abc123", - signature: "valid_sig", - }; - match verify_unsubscribe_at(p, mock_now()) { - VrErrInvalidResponse => true, - _ => false, - } -} - -pub fn test_verify_consent_valid() -> Bool { - let p = ConsentParams #{ - initial_request: 1000000, - confirmation: 1100000, - ip_address: "192.168.1.1", - token: "token123", - }; - match verify_consent(p) { - VrSuccess => true, - _ => false, - } -} - -pub fn test_verify_consent_simultaneous() -> Bool { - let p = ConsentParams #{ - initial_request: 1000000, - confirmation: 1000000, - ip_address: "192.168.1.1", - token: "token123", - }; - match verify_consent(p) { - VrErrConsentInvalid => true, - _ => false, - } -} - -pub fn test_result_to_string_success() -> Bool { - result_to_string(VrSuccess()) == "SUCCESS" -} - -pub fn test_result_to_string_invalid_url() -> Bool { - result_to_string(VrErrInvalidUrl()) == "INVALID_URL" -} - -pub fn test_result_to_string_consent_invalid() -> Bool { - result_to_string(VrErrConsentInvalid()) == "CONSENT_INVALID" -} diff --git a/avow-protocol/telegram-bot/contractiles/README.adoc b/avow-protocol/telegram-bot/contractiles/README.adoc deleted file mode 100644 index d19a3877..00000000 --- a/avow-protocol/telegram-bot/contractiles/README.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Contractiles Template Set -:toc: -:sectnums: - -This directory contains the generalized contractiles templates. Copy the `contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework. - -== Fill-In Instructions - -1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports). -2. Replace Trustfile.hs placeholders with your actual key paths and verification commands. -3. Adjust Dustfile handlers to match your rollback and recovery tooling. -4. Update Intentfile to mirror the roadmap you want the system to evolve toward. - -== Contents - -* `must/Mustfile` - required invariants and validations. -* `trust/Trustfile.hs` - cryptographic verification steps. -* `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. diff --git a/avow-protocol/telegram-bot/contractiles/dust/Dustfile b/avow-protocol/telegram-bot/contractiles/dust/Dustfile deleted file mode 100644 index 314903cc..00000000 --- a/avow-protocol/telegram-bot/contractiles/dust/Dustfile +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile template - recovery and rollback semantics - -version: 1 - -recovery: - logs: - - name: decision-log - path: logs/decisions.json - reversible: true - handler: "log-replay --reverse logs/decisions.json" - - policy: - - name: policy-rollback - path: policy/policy.ncl - rollback: "git checkout HEAD~1 -- policy/policy.ncl" - notes: "Rollback policy to the previous known-good revision." - - gateway: - - name: bad-deployment - event: "deploy.failure" - undo: "kubectl rollout undo deployment/gateway" - notes: "Undo a failed deployment while preserving audit logs." - - dust-events: - - name: decision-log-to-dust - source: logs/decisions.json - transform: "dustify --input logs/decisions.json --output logs/dust-events.json" - notes: "Map gateway decision logs into reversible dust events." diff --git a/avow-protocol/telegram-bot/contractiles/must/Mustfile b/avow-protocol/telegram-bot/contractiles/must/Mustfile deleted file mode 100644 index dc7b3be5..00000000 --- a/avow-protocol/telegram-bot/contractiles/must/Mustfile +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile - declarative state contract (template) -# See: https://github.com/hyperpolymath/mustfile - -version: 1 - -metadata: - name: project-state-contract - spec: v0.0.1 - description: "Invariant checks for config, policy, gateway, logs, and schema." - -parameters: - gateway_port: "8080" - schema_version: "v0.0.1" - -checks: - - name: config-valid - description: "config/service.yaml must be valid." - run: "yq -e '.' config/service.yaml >/dev/null" - - - name: policy-compiles - description: "policy/policy.ncl must compile." - run: "nickel check policy/policy.ncl" - - - name: gateway-exposes-port - description: "Service must expose the configured port." - run: "bash -uc 'ss -lnt | rg \":${GATEWAY_PORT:-8080}\"'" - - - name: logs-are-json - description: "Logs must be JSON." - run: "bash -uc 'rg --files -g \"*.json\" logs | xargs -r jq -e .'" - - - name: schema-version-matches - description: "Schema must match version spec." - run: "bash -uc 'rg -n \"${SCHEMA_VERSION:-v0.0.1}\" schema'" diff --git a/avow-protocol/telegram-bot/deno.json b/avow-protocol/telegram-bot/deno.json deleted file mode 100644 index d45aece2..00000000 --- a/avow-protocol/telegram-bot/deno.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "tasks": { - "start": "deno run --allow-net --allow-read --allow-write --allow-env --allow-import --env=.env src/bot.ts", - "dev": "deno run --allow-net --allow-read --allow-write --allow-env --allow-import --env=.env --watch src/bot.ts", - "test": "deno test --allow-net --allow-read --allow-write" - }, - "imports": { - "@grammy/bot": "https://deno.land/x/grammy@v1.19.2/mod.ts", - "@db/sqlite": "https://deno.land/x/sqlite@v3.9.1/mod.ts" - }, - "compilerOptions": { - "strict": true, - "lib": ["deno.window"] - }, - "fmt": { - "indentWidth": 2, - "lineWidth": 100, - "semiColons": true - }, - "lint": { - "rules": { - "tags": ["recommended"] - } - } -} diff --git a/avow-protocol/telegram-bot/deno.lock b/avow-protocol/telegram-bot/deno.lock deleted file mode 100644 index 3cc8bd03..00000000 --- a/avow-protocol/telegram-bot/deno.lock +++ /dev/null @@ -1,63 +0,0 @@ -{ - "version": "5", - "remote": { - "https://cdn.skypack.dev/-/debug@v4.3.4-o4liVvMlOnQWbLSYZMXw/dist=es2019,mode=imports/optimized/debug.js": "671100993996e39b501301a87000607916d4d2d9f8fc8e9c5200ae5ba64a1389", - "https://cdn.skypack.dev/-/ms@v2.1.2-giBDZ1IA5lmQ3ZXaa87V/dist=es2019,mode=imports/optimized/ms.js": "fd88e2d51900437011f1ad232f3393ce97db1b87a7844b3c58dd6d65562c1276", - "https://cdn.skypack.dev/debug@4.3.4": "7b1d010cc930f71b940ba5941da055bc181115229e29de7214bdb4425c68ea76", - "https://deno.land/std@0.202.0/path/_basename.ts": "057d420c9049821f983f784fd87fa73ac471901fb628920b67972b0f44319343", - "https://deno.land/std@0.202.0/path/_constants.ts": "e49961f6f4f48039c0dfed3c3f93e963ca3d92791c9d478ac5b43183413136e0", - "https://deno.land/std@0.202.0/path/_os.ts": "30b0c2875f360c9296dbe6b7f2d528f0f9c741cecad2e97f803f5219e91b40a2", - "https://deno.land/std@0.202.0/path/_util.ts": "4e191b1bac6b3bf0c31aab42e5ca2e01a86ab5a0d2e08b75acf8585047a86221", - "https://deno.land/std@0.202.0/path/basename.ts": "bdfa5a624c6a45564dc6758ef2077f2822978a6dbe77b0a3514f7d1f81362930", - "https://deno.land/std@0.202.0/streams/_common.ts": "3b2c1f0287ce2ad51fff4091a7d0f48375c85b0ec341468e76d5ac13bb0014dd", - "https://deno.land/std@0.202.0/streams/iterate_reader.ts": "3b42d3056c8ccade561f1c7ac22d5e671e745933d9f9168fd3b5913588d911c3", - "https://deno.land/x/grammy@v1.19.2/bot.ts": "8d13cd72f1512e3f76d685131c7d0db5ba51f2c877db5ac2c0aa4b0f6f876aa8", - "https://deno.land/x/grammy@v1.19.2/composer.ts": "8660f86990f4ef2afc4854a1f2610bb8d60f88116f3a57c8e5515a77b277f82d", - "https://deno.land/x/grammy@v1.19.2/context.ts": "4cf51ed7538750edb4379f757f6b8b3c1f3987242d58393160b463c9ca13c997", - "https://deno.land/x/grammy@v1.19.2/convenience/constants.ts": "3be0f6393ab2b2995fad6bcd4c9cf8a1a615ae4543fc864c107ba0dd38f123f6", - "https://deno.land/x/grammy@v1.19.2/convenience/frameworks.ts": "77e2f9fc841ab92d4310b556126447a42f131ad976a6adfff454c016f339b28e", - "https://deno.land/x/grammy@v1.19.2/convenience/inline_query.ts": "409d1940c7670708064efa495003bcbfdf6763a756b2e6303c464489fd3394ff", - "https://deno.land/x/grammy@v1.19.2/convenience/input_media.ts": "7af72a5fdb1af0417e31b1327003f536ddfdf64e06ab8bc7f5da6b574de38658", - "https://deno.land/x/grammy@v1.19.2/convenience/keyboard.ts": "21220dc2321c40203c699fa4eb7b07ed8217956ea0477c241a551224a58a278d", - "https://deno.land/x/grammy@v1.19.2/convenience/session.ts": "f92d57b6b2b61920912cf5c44d4db2f6ca999fe4f9adef170c321889d49667c2", - "https://deno.land/x/grammy@v1.19.2/convenience/webhook.ts": "f1da7d6426171fb7b5d5f6b59633f91d3bab9a474eea821f714932650965eb9e", - "https://deno.land/x/grammy@v1.19.2/core/api.ts": "7d4d8df3567e322ab3b793360ee48da09f46ad531ef994a87b3e6aef4ec23bf2", - "https://deno.land/x/grammy@v1.19.2/core/client.ts": "39639e4f5fc3a3f9d528c6906d7e3cdc268cf5d33929eeab801bb39642a59103", - "https://deno.land/x/grammy@v1.19.2/core/error.ts": "4638b2127ebe60249c78b83011d468f5e1e1a87748d32fe11a8200d9f824ad13", - "https://deno.land/x/grammy@v1.19.2/core/payload.ts": "420e17c3c2830b5576ea187cfce77578fe09f1204b25c25ea2f220ca7c86e73b", - "https://deno.land/x/grammy@v1.19.2/filter.ts": "201ddac882ab6cd46cae2d18eb8097460dfe7cedadaab2ba16959c5286d5a5f1", - "https://deno.land/x/grammy@v1.19.2/mod.ts": "b81cccf69779667b36bef5d0373d1567684917a3b9827873f3de7a7e6af1926f", - "https://deno.land/x/grammy@v1.19.2/platform.deno.ts": "84735643c8dde2cf8af5ac2e6b8eb0768452260878da93238d673cb1b4ccea55", - "https://deno.land/x/grammy@v1.19.2/types.deno.ts": "0f47eacde6d3d65f107f2abf16ecfe726298d30263367cc82e977c801b766229", - "https://deno.land/x/grammy@v1.19.2/types.ts": "729415590dfa188dbe924dea614dff4e976babdbabb28a307b869fc25777cdf0", - "https://deno.land/x/grammy_types@v3.3.0/api.ts": "efc90a31eb6f59ae5e7a4cf5838f46529e2fa6fa7e97a51a82dbd28afad21592", - "https://deno.land/x/grammy_types@v3.3.0/inline.ts": "b5669d79f8c0c6f7d6ca856d548c1ac7d490efd54ee785d18a7c4fc12abfd73b", - "https://deno.land/x/grammy_types@v3.3.0/manage.ts": "e39ec87e74469f70f35aa51dc520b02136ea5e75f9d7a7e0e513846a00b63fd2", - "https://deno.land/x/grammy_types@v3.3.0/markup.ts": "7b547b79130a112f98fbd3f0f754c8bb926f7cab3040d244b5f597aea0e1ce09", - "https://deno.land/x/grammy_types@v3.3.0/message.ts": "e78a7797174c537bb8de80597e265121615fa36a531dd88ac5af27aa68779172", - "https://deno.land/x/grammy_types@v3.3.0/methods.ts": "7547cedfec2c2727b30b8fa38050aee6642c56673b21cfd0ac56b0e531f02795", - "https://deno.land/x/grammy_types@v3.3.0/mod.ts": "7b5f421b4fbb1761f7f0d68328eaddd515f3222ce3f3cdfbedd8d5a4781e91a7", - "https://deno.land/x/grammy_types@v3.3.0/passport.ts": "e3fb63aec96510bcc317ef48fd25b435444b8f407502d7568c00fce15f2958fd", - "https://deno.land/x/grammy_types@v3.3.0/payment.ts": "d23e9038c5b479b606e620dd84e3e67b6642ada110a962f2d5b5286e99ec7de5", - "https://deno.land/x/grammy_types@v3.3.0/settings.ts": "5e989f5bd6c587d55673bd8052293869aa2f372e9223dd7f6e28632bfe021b6e", - "https://deno.land/x/grammy_types@v3.3.0/update.ts": "6d5ec6d1f6d2acf021f807f6bbf7d541487f30672cfab4700e7f935a490c3b78", - "https://deno.land/x/sqlite@v3.8/build/sqlite.js": "72f63689fffcb9bb5ae10b1e8f7db09ea845cdf713e0e3a9693d8416a28f92a6", - "https://deno.land/x/sqlite@v3.8/build/vfs.js": "08533cc78fb29b9d9bd62f6bb93e5ef333407013fed185776808f11223ba0e70", - "https://deno.land/x/sqlite@v3.8/mod.ts": "e09fc79d8065fe222578114b109b1fd60077bff1bb75448532077f784f4d6a83", - "https://deno.land/x/sqlite@v3.8/src/constants.ts": "90f3be047ec0a89bcb5d6fc30db121685fc82cb00b1c476124ff47a4b0472aa9", - "https://deno.land/x/sqlite@v3.8/src/db.ts": "7d3251021756fa80f382c3952217c7446c5c8c1642b63511da0938fe33562663", - "https://deno.land/x/sqlite@v3.8/src/error.ts": "f7a15cb00d7c3797da1aefee3cf86d23e0ae92e73f0ba3165496c3816ab9503a", - "https://deno.land/x/sqlite@v3.8/src/function.ts": "e4c83b8ec64bf88bafad2407376b0c6a3b54e777593c70336fb40d43a79865f2", - "https://deno.land/x/sqlite@v3.8/src/query.ts": "d58abda928f6582d77bad685ecf551b1be8a15e8e38403e293ec38522e030cad", - "https://deno.land/x/sqlite@v3.8/src/wasm.ts": "e79d0baa6e42423257fb3c7cc98091c54399254867e0f34a09b5bdef37bd9487", - "https://deno.land/x/sqlite@v3.9.1/build/sqlite.js": "2afc7875c7b9c85d89730c4a311ab3a304e5d1bf761fbadd8c07bbdf130f5f9b", - "https://deno.land/x/sqlite@v3.9.1/build/vfs.js": "7f7778a9fe499cd10738d6e43867340b50b67d3e39142b0065acd51a84cd2e03", - "https://deno.land/x/sqlite@v3.9.1/mod.ts": "e09fc79d8065fe222578114b109b1fd60077bff1bb75448532077f784f4d6a83", - "https://deno.land/x/sqlite@v3.9.1/src/constants.ts": "90f3be047ec0a89bcb5d6fc30db121685fc82cb00b1c476124ff47a4b0472aa9", - "https://deno.land/x/sqlite@v3.9.1/src/db.ts": "03d0c860957496eadedd86e51a6e650670764630e64f56df0092e86c90752401", - "https://deno.land/x/sqlite@v3.9.1/src/error.ts": "f7a15cb00d7c3797da1aefee3cf86d23e0ae92e73f0ba3165496c3816ab9503a", - "https://deno.land/x/sqlite@v3.9.1/src/function.ts": "bc778cab7a6d771f690afa27264c524d22fcb96f1bb61959ade7922c15a4ab8d", - "https://deno.land/x/sqlite@v3.9.1/src/query.ts": "d58abda928f6582d77bad685ecf551b1be8a15e8e38403e293ec38522e030cad", - "https://deno.land/x/sqlite@v3.9.1/src/wasm.ts": "e79d0baa6e42423257fb3c7cc98091c54399254867e0f34a09b5bdef37bd9487" - } -} diff --git a/avow-protocol/telegram-bot/docs/CITATIONS.adoc b/avow-protocol/telegram-bot/docs/CITATIONS.adoc deleted file mode 100644 index 6f167bdf..00000000 --- a/avow-protocol/telegram-bot/docs/CITATIONS.adoc +++ /dev/null @@ -1,36 +0,0 @@ -= RSR-template-repo - Citation Guide -:toc: - -== BibTeX - -[source,bibtex] ----- -@software{rsr-template-repo_2025, - author = {Polymath, Hyper}, - title = {RSR-template-repo}, - year = {2025}, - url = {https://github.com/hyperpolymath/RSR-template-repo}, - license = {PMPL-1.0-or-later} -} ----- - -== Harvard Style - -Polymath, H. (2025) _RSR-template-repo_ [Computer software]. Available at: https://github.com/hyperpolymath/RSR-template-repo - -== OSCOLA - -Hyper Polymath, 'RSR-template-repo' (2025) - -== MLA - -Polymath, Hyper. "RSR-template-repo." 2025, github.com/hyperpolymath/RSR-template-repo. - -== APA 7 - -Polymath, H. (2025). _RSR-template-repo_ [Computer software]. GitHub. https://github.com/hyperpolymath/RSR-template-repo - -== See Also - -* link:../CITATION.cff[CITATION.cff] -* link:../codemeta.json[codemeta.json] diff --git a/avow-protocol/telegram-bot/examples/web-project-deno.json b/avow-protocol/telegram-bot/examples/web-project-deno.json deleted file mode 100644 index 5ddd3bd7..00000000 --- a/avow-protocol/telegram-bot/examples/web-project-deno.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "// NOTE": "Example deno.json for ReScript web projects", - "tasks": { - "build": "deno run -A npm:rescript", - "clean": "deno run -A npm:rescript clean", - "watch": "deno run -A npm:rescript -w", - "serve": "deno run -A jsr:@std/http/file-server .", - "test": "deno test --allow-all" - }, - "imports": { - "rescript": "^12.0.0", - "@rescript/core": "npm:@rescript/core@^1.6.0", - "safe-dom/": "https://raw.githubusercontent.com/hyperpolymath/rescript-dom-mounter/main/src/", - "proven/": "../proven/bindings/rescript/src/" - }, - "compilerOptions": { - "allowJs": true, - "checkJs": false - } -} diff --git a/avow-protocol/telegram-bot/ffi/zig/build.zig b/avow-protocol/telegram-bot/ffi/zig/build.zig deleted file mode 100644 index 4a2e049a..00000000 --- a/avow-protocol/telegram-bot/ffi/zig/build.zig +++ /dev/null @@ -1,94 +0,0 @@ -// {{PROJECT}} FFI Build Configuration -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -pub fn build(b: *std.Build) void { - const target = b.standardTargetOptions(.{}); - const optimize = b.standardOptimizeOption(.{}); - - // Shared library (.so, .dylib, .dll) - const lib = b.addSharedLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Set version - lib.version = .{ .major = 0, .minor = 1, .patch = 0 }; - - // Static library (.a) - const lib_static = b.addStaticLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Install artifacts - b.installArtifact(lib); - b.installArtifact(lib_static); - - // Generate header file for C compatibility - const header = b.addInstallHeader( - b.path("include/{{project}}.h"), - "{{project}}.h", - ); - b.getInstallStep().dependOn(&header.step); - - // Unit tests - const lib_tests = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - const run_lib_tests = b.addRunArtifact(lib_tests); - - const test_step = b.step("test", "Run library tests"); - test_step.dependOn(&run_lib_tests.step); - - // Integration tests - const integration_tests = b.addTest(.{ - .root_source_file = b.path("test/integration_test.zig"), - .target = target, - .optimize = optimize, - }); - - integration_tests.linkLibrary(lib); - - const run_integration_tests = b.addRunArtifact(integration_tests); - - const integration_test_step = b.step("test-integration", "Run integration tests"); - integration_test_step.dependOn(&run_integration_tests.step); - - // Documentation - const docs = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = .Debug, - }); - - const docs_step = b.step("docs", "Generate documentation"); - docs_step.dependOn(&b.addInstallDirectory(.{ - .source_dir = docs.getEmittedDocs(), - .install_dir = .prefix, - .install_subdir = "docs", - }).step); - - // Benchmark (if needed) - const bench = b.addExecutable(.{ - .name = "{{project}}-bench", - .root_source_file = b.path("bench/bench.zig"), - .target = target, - .optimize = .ReleaseFast, - }); - - bench.linkLibrary(lib); - - const run_bench = b.addRunArtifact(bench); - - const bench_step = b.step("bench", "Run benchmarks"); - bench_step.dependOn(&run_bench.step); -} diff --git a/avow-protocol/telegram-bot/ffi/zig/src/main.zig b/avow-protocol/telegram-bot/ffi/zig/src/main.zig deleted file mode 100644 index 6b233bc7..00000000 --- a/avow-protocol/telegram-bot/ffi/zig/src/main.zig +++ /dev/null @@ -1,274 +0,0 @@ -// {{PROJECT}} FFI Implementation -// -// This module implements the C-compatible FFI declared in src/abi/Foreign.idr -// All types and layouts must match the Idris2 ABI definitions. -// -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -// Version information (keep in sync with project) -const VERSION = "0.1.0"; -const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string; - -/// Thread-local error storage -threadlocal var last_error: ?[]const u8 = null; - -/// Set the last error message -fn setError(msg: []const u8) void { - last_error = msg; -} - -/// Clear the last error -fn clearError() void { - last_error = null; -} - -//============================================================================== -// Core Types (must match src/abi/Types.idr) -//============================================================================== - -/// Result codes (must match Idris2 Result type) -pub const Result = enum(c_int) { - ok = 0, - @"error" = 1, - invalid_param = 2, - out_of_memory = 3, - null_pointer = 4, -}; - -/// Library handle (opaque to prevent direct access) -pub const Handle = opaque { - // Internal state hidden from C - allocator: std.mem.Allocator, - initialized: bool, - // Add your fields here -}; - -//============================================================================== -// Library Lifecycle -//============================================================================== - -/// Initialize the library -/// Returns a handle, or null on failure -export fn {{project}}_init() ?*Handle { - const allocator = std.heap.c_allocator; - - const handle = allocator.create(Handle) catch { - setError("Failed to allocate handle"); - return null; - }; - - // Initialize handle - handle.* = .{ - .allocator = allocator, - .initialized = true, - }; - - clearError(); - return handle; -} - -/// Free the library handle -export fn {{project}}_free(handle: ?*Handle) void { - const h = handle orelse return; - const allocator = h.allocator; - - // Clean up resources - h.initialized = false; - - allocator.destroy(h); - clearError(); -} - -//============================================================================== -// Core Operations -//============================================================================== - -/// Process data (example operation) -export fn {{project}}_process(handle: ?*Handle, input: u32) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Example processing logic - _ = input; - - clearError(); - return .ok; -} - -//============================================================================== -// String Operations -//============================================================================== - -/// Get a string result (example) -/// Caller must free the returned string -export fn {{project}}_get_string(handle: ?*Handle) ?[*:0]const u8 { - const h = handle orelse { - setError("Null handle"); - return null; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return null; - } - - // Example: allocate and return a string - const result = h.allocator.dupeZ(u8, "Example result") catch { - setError("Failed to allocate string"); - return null; - }; - - clearError(); - return result.ptr; -} - -/// Free a string allocated by the library -export fn {{project}}_free_string(str: ?[*:0]const u8) void { - const s = str orelse return; - const allocator = std.heap.c_allocator; - - const slice = std.mem.span(s); - allocator.free(slice); -} - -//============================================================================== -// Array/Buffer Operations -//============================================================================== - -/// Process an array of data -export fn {{project}}_process_array( - handle: ?*Handle, - buffer: ?[*]const u8, - len: u32, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const buf = buffer orelse { - setError("Null buffer"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Access the buffer - const data = buf[0..len]; - _ = data; - - // Process data here - - clearError(); - return .ok; -} - -//============================================================================== -// Error Handling -//============================================================================== - -/// Get the last error message -/// Returns null if no error -export fn {{project}}_last_error() ?[*:0]const u8 { - const err = last_error orelse return null; - - // Return C string (static storage, no need to free) - const allocator = std.heap.c_allocator; - const c_str = allocator.dupeZ(u8, err) catch return null; - return c_str.ptr; -} - -//============================================================================== -// Version Information -//============================================================================== - -/// Get the library version -export fn {{project}}_version() [*:0]const u8 { - return VERSION.ptr; -} - -/// Get build information -export fn {{project}}_build_info() [*:0]const u8 { - return BUILD_INFO.ptr; -} - -//============================================================================== -// Callback Support -//============================================================================== - -/// Callback function type (C ABI) -pub const Callback = *const fn (u64, u32) callconv(.C) u32; - -/// Register a callback -export fn {{project}}_register_callback( - handle: ?*Handle, - callback: ?Callback, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const cb = callback orelse { - setError("Null callback"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Store callback for later use - _ = cb; - - clearError(); - return .ok; -} - -//============================================================================== -// Utility Functions -//============================================================================== - -/// Check if handle is initialized -export fn {{project}}_is_initialized(handle: ?*Handle) u32 { - const h = handle orelse return 0; - return if (h.initialized) 1 else 0; -} - -//============================================================================== -// Tests -//============================================================================== - -test "lifecycle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try std.testing.expect({{project}}_is_initialized(handle) == 1); -} - -test "error handling" { - const result = {{project}}_process(null, 0); - try std.testing.expectEqual(Result.null_pointer, result); - - const err = {{project}}_last_error(); - try std.testing.expect(err != null); -} - -test "version" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - try std.testing.expectEqualStrings(VERSION, ver_str); -} diff --git a/avow-protocol/telegram-bot/ffi/zig/test/integration_test.zig b/avow-protocol/telegram-bot/ffi/zig/test/integration_test.zig deleted file mode 100644 index 03419949..00000000 --- a/avow-protocol/telegram-bot/ffi/zig/test/integration_test.zig +++ /dev/null @@ -1,182 +0,0 @@ -// {{PROJECT}} Integration Tests -// SPDX-License-Identifier: MPL-2.0 -// -// These tests verify that the Zig FFI correctly implements the Idris2 ABI - -const std = @import("std"); -const testing = std.testing; - -// Import FFI functions -extern fn {{project}}_init() ?*opaque {}; -extern fn {{project}}_free(?*opaque {}) void; -extern fn {{project}}_process(?*opaque {}, u32) c_int; -extern fn {{project}}_get_string(?*opaque {}) ?[*:0]const u8; -extern fn {{project}}_free_string(?[*:0]const u8) void; -extern fn {{project}}_last_error() ?[*:0]const u8; -extern fn {{project}}_version() [*:0]const u8; -extern fn {{project}}_is_initialized(?*opaque {}) u32; - -//============================================================================== -// Lifecycle Tests -//============================================================================== - -test "create and destroy handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try testing.expect(handle != null); -} - -test "handle is initialized" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const initialized = {{project}}_is_initialized(handle); - try testing.expectEqual(@as(u32, 1), initialized); -} - -test "null handle is not initialized" { - const initialized = {{project}}_is_initialized(null); - try testing.expectEqual(@as(u32, 0), initialized); -} - -//============================================================================== -// Operation Tests -//============================================================================== - -test "process with valid handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const result = {{project}}_process(handle, 42); - try testing.expectEqual(@as(c_int, 0), result); // 0 = ok -} - -test "process with null handle returns error" { - const result = {{project}}_process(null, 42); - try testing.expectEqual(@as(c_int, 4), result); // 4 = null_pointer -} - -//============================================================================== -// String Tests -//============================================================================== - -test "get string result" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const str = {{project}}_get_string(handle); - defer if (str) |s| {{project}}_free_string(s); - - try testing.expect(str != null); -} - -test "get string with null handle" { - const str = {{project}}_get_string(null); - try testing.expect(str == null); -} - -//============================================================================== -// Error Handling Tests -//============================================================================== - -test "last error after null handle operation" { - _ = {{project}}_process(null, 0); - - const err = {{project}}_last_error(); - try testing.expect(err != null); - - if (err) |e| { - const err_str = std.mem.span(e); - try testing.expect(err_str.len > 0); - } -} - -test "no error after successful operation" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - _ = {{project}}_process(handle, 0); - - // Error should be cleared after successful operation - // (This depends on implementation) -} - -//============================================================================== -// Version Tests -//============================================================================== - -test "version string is not empty" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - try testing.expect(ver_str.len > 0); -} - -test "version string is semantic version format" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - // Should be in format X.Y.Z - try testing.expect(std.mem.count(u8, ver_str, ".") >= 1); -} - -//============================================================================== -// Memory Safety Tests -//============================================================================== - -test "multiple handles are independent" { - const h1 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h1); - - const h2 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h2); - - try testing.expect(h1 != h2); - - // Operations on h1 should not affect h2 - _ = {{project}}_process(h1, 1); - _ = {{project}}_process(h2, 2); -} - -test "double free is safe" { - const handle = {{project}}_init() orelse return error.InitFailed; - - {{project}}_free(handle); - {{project}}_free(handle); // Should not crash -} - -test "free null is safe" { - {{project}}_free(null); // Should not crash -} - -//============================================================================== -// Thread Safety Tests (if applicable) -//============================================================================== - -test "concurrent operations" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const ThreadContext = struct { - h: *opaque {}, - id: u32, - }; - - const thread_fn = struct { - fn run(ctx: ThreadContext) void { - _ = {{project}}_process(ctx.h, ctx.id); - } - }.run; - - var threads: [4]std.Thread = undefined; - for (&threads, 0..) |*thread, i| { - thread.* = try std.Thread.spawn(.{}, thread_fn, .{ - ThreadContext{ .h = handle, .id = @intCast(i) }, - }); - } - - for (threads) |thread| { - thread.join(); - } -} diff --git a/avow-protocol/telegram-bot/rescript.json b/avow-protocol/telegram-bot/rescript.json deleted file mode 100644 index 1a633c4c..00000000 --- a/avow-protocol/telegram-bot/rescript.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "name": "stamp-telegram-bot", - "version": "1.0.0", - "sources": [ - {"dir": "src", "subdirs": true}, - {"dir": ".", "subdirs": false, "type": "dev"} - ], - "package-specs": [{"module": "es6", "in-source": true}], - "suffix": ".res.js", - "dependencies": ["@rescript/core"], - "warnings": {"error": "+101"} -} diff --git a/avow-protocol/wrangler.toml b/avow-protocol/wrangler.toml deleted file mode 100644 index e8e33bb1..00000000 --- a/avow-protocol/wrangler.toml +++ /dev/null @@ -1,5 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cloudflare Pages configuration - -name = "avow-protocol" -compatibility_date = "2026-02-04" diff --git a/k9-svc/site/assets/style.css b/k9-svc/site/assets/style.css new file mode 120000 index 00000000..a7c3bb8d --- /dev/null +++ b/k9-svc/site/assets/style.css @@ -0,0 +1 @@ +../../../_shared/assets/style.css \ No newline at end of file diff --git a/k9-svc/site/index.md b/k9-svc/site/index.md new file mode 100644 index 00000000..73d734e8 --- /dev/null +++ b/k9-svc/site/index.md @@ -0,0 +1,72 @@ + +--- +title: K9-SVC +site: K9-SVC +description: Self-Validating Components — a Nickel-based format for configuration and contractiles with three-level trust model +brand: K9-SVC +date: 2026-06-22 +--- + +# K9-SVC — Self-Validating Components + +

A Nickel-based format for configuration and contractiles that carries its own guarantees. Components validate themselves, with a trust model that scales from inert data to cryptographically signed execution.

+ +
+v1.0.0-alpha +Nickel contractiles +.k9 / .k9.ncl +application/vnd.k9+nickel +MPL-2.0 / CC-BY-SA-4.0 +
+ +
+Get started +Read the spec +GitHub +
+ +## The three-level trust model + +K9-SVC is safe by construction: a component declares how much trust it requires, and the environment grants no more. + +| Level | Name | What's permitted | +|-------|------|------------------| +| **1** | Data | Pure data, no execution — safe in all environments. | +| **2** | Validation | Nickel contract evaluation permitted. | +| **3** | Execution | Full execution — requires a cryptographic signature. | + +## What it does + +
+
+

Self-validating

+

A component states its own contract. Validation is intrinsic, not bolted on.

+
+
+

Contractiles in Nickel

+

Contracts are written in Nickel — composable, evaluable, and precise.

+
+
+

Signed execution

+

Anything beyond validation requires a cryptographic signature. No silent escalation.

+
+
+

First-class media type

+

application/vnd.k9+nickel — registered, addressable, toolable.

+
+
+ +## A taste + +```nickel +# greeting.k9.ncl — a level-2 self-validating component +{ + trust_level = 2, + contract = fun value => value | { name | String, repeat | Number }, + data = { name = "world", repeat = 3 }, +} +``` + +## Part of the standards estate + +K9-SVC is coordinated through the [k9-ecosystem](https://github.com/hyperpolymath/k9-ecosystem) hub — implementations (`k9-rs`, `k9_ex`, `k9_gleam`, `k9-deno`, `k9-haskell`), tooling and CI. The normative specification lives in [standards](https://github.com/hyperpolymath/standards). diff --git a/k9-svc/site/public/.well-known/security.txt b/k9-svc/site/public/.well-known/security.txt new file mode 100644 index 00000000..08dec07d --- /dev/null +++ b/k9-svc/site/public/.well-known/security.txt @@ -0,0 +1,29 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +# Security contact for k9-svc.net — RFC 9116 +# https://k9-svc.net/.well-known/security.txt + +Contact: mailto:j.d.a.jewell@open.ac.uk +Encryption: openpgp4fpr:4A03639C1EB1F86C7F0C97A91835A14A2867091E +Expires: 2027-06-21T00:00:00Z +Preferred-Languages: en +Canonical: https://k9-svc.net/.well-known/security.txt +Policy: https://github.com/hyperpolymath/k9-ecosystem/security/policy +Acknowledgments: https://github.com/hyperpolymath/k9-ecosystem/security/advisories +-----BEGIN PGP SIGNATURE----- + +iQIzBAEBCgAdFiEEljlFF1RJblHWtTfK0RkBfr9pWrEFAmo5o0cACgkQ0RkBfr9p +WrFnhw//auzOJy7fkw/d/UO4sCX4LKdWpmSlgrM3x3Hif94Vub9jsMcNuN0NtgAd +6RQGf8Cj4eUCNPln1yDK8jnuwCnafd0RSQ7eS7LsGVZqG51okFrd2U7C/dyOgIHA +yGwLU2rvKXdsxp5VqUyuN60e0BNsB0erJxLZjytmU+OUbnjjWuHVrOmBRWz94DMo +vvA7pFNXM0GI0wkQuAKRFcum3IT0VH2DAzTmD11oW0YQr4vJOgwseiWFS1KfMWPY +bSyHbRYgBU6NRPL4UpBg0vwmWlgo7UolOR2JpCVJN1H6oFX4GZIBEw7hrk5+iD8z +CfyW/yeIKG5fRZfpzfbID4ynt9ji9+BvHedRdou7D+bl6TPoM+xXSJLmjV2I8xYS +su0BLj/6V6Aqpker3VP7NJscDLS7t/+KRXj7O2XIMSRjokRL5yIyxkcQVmhqfVKy +i+qkNS9sMSAY89Ce6E2bpn7f2wdBP42yCOGHISjNjv9LsmmSkuoNjy36qTR3kAgH +0KZWylOErsKdwTh9tU0URTHVTiNfhiw4WOc2/1wt+QN2/Ipg8XdcNnqLG66cs8j3 +hYIYw2a7JA+KlSCrUJ+Zv8FJKnZS6htw9FBHpzxyqQJlCjz55ksZU82hyar8WlX/ +LY6nWrIp/peBURvi3CgVXPuJuKDSOrJnZ8F1INDN1i7uTpE3olw= +=dLTg +-----END PGP SIGNATURE----- diff --git a/k9-svc/site/public/CNAME b/k9-svc/site/public/CNAME new file mode 100644 index 00000000..558028c9 --- /dev/null +++ b/k9-svc/site/public/CNAME @@ -0,0 +1 @@ +k9-svc.net diff --git a/k9-svc/site/public/favicon.svg b/k9-svc/site/public/favicon.svg new file mode 100644 index 00000000..03c67c84 --- /dev/null +++ b/k9-svc/site/public/favicon.svg @@ -0,0 +1,10 @@ + + + + + + + + + K9 + diff --git a/k9-svc/site/public/robots.txt b/k9-svc/site/public/robots.txt new file mode 100644 index 00000000..fd6db010 --- /dev/null +++ b/k9-svc/site/public/robots.txt @@ -0,0 +1,4 @@ +User-agent: * +Allow: / + +Sitemap: https://k9-svc.net/sitemap.xml diff --git a/k9-svc/site/spec.md b/k9-svc/site/spec.md new file mode 100644 index 00000000..a5401dff --- /dev/null +++ b/k9-svc/site/spec.md @@ -0,0 +1,34 @@ + +--- +title: K9-SVC specification +site: K9-SVC +description: K9-SVC v1.0.0-alpha normative specification — contractile specification with three-level trust model +brand: K9-SVC +date: 2026-06-22 +--- + +# Specification + +K9-SVC is at **v1.0.0-alpha**. The normative contractile specification is maintained in the [standards](https://github.com/hyperpolymath/standards) repository. + +## Identity + +| Property | Value | +|----------|-------| +| Extensions | `.k9`, `.k9.ncl` | +| Media type | `application/vnd.k9+nickel` | +| Encoding | UTF-8 | +| Built on | Nickel, Just | +| Licence | MPL-2.0 (code), CC-BY-SA-4.0 (docs) | + +## Trust levels + +The core of the specification is the three-level trust model. A component must declare its level; the host environment grants capability up to — and no further than — that level. + +1. **Data** — pure data, no execution, safe in all environments. +2. **Validation** — Nickel contract evaluation permitted. +3. **Execution** — full execution, requires a cryptographic signature. + +## Conformance + +Conformance fixtures (positive and negative) are coordinated in the [k9-ecosystem](https://github.com/hyperpolymath/k9-ecosystem) hub. Implementations validate against these vectors to claim support at a given trust level. diff --git a/k9-svc/site/start.md b/k9-svc/site/start.md new file mode 100644 index 00000000..d46277e9 --- /dev/null +++ b/k9-svc/site/start.md @@ -0,0 +1,52 @@ + +--- +title: Get started with K9-SVC +site: K9-SVC +description: Learn how to write K9-SVC components with trust levels, contracts, and signed execution +brand: K9-SVC +date: 2026-06-22 +--- + +# Get started + +A K9-SVC component is a Nickel value that declares its own trust level and contract. The toolchain reads the level and grants no more capability than the component asks for. + +## 1. Write a component + +```nickel +# config.k9.ncl +{ + trust_level = 1, # pure data — safe anywhere + data = { + service = "edge", + replicas = 3, + }, +} +``` + +## 2. Add a contract (level 2) + +```nickel +{ + trust_level = 2, # Nickel contract evaluation permitted + contract = fun v => v | { + service | String, + replicas | Number, + }, + data = { service = "edge", replicas = 3 }, +} +``` + +## 3. Sign for execution (level 3) + +Level 3 permits full execution and **requires a cryptographic signature**. Unsigned level-3 components are refused — escalation is never implicit. + +## Files & types + +- Extensions: `.k9`, `.k9.ncl` +- Media type: `application/vnd.k9+nickel` +- Encoding: UTF-8 + +## Tooling + +Implementations and CI live in the [k9-ecosystem](https://github.com/hyperpolymath/k9-ecosystem) hub; the normative spec is in [standards](https://github.com/hyperpolymath/standards). diff --git a/k9-svc/site/templates/default.html b/k9-svc/site/templates/default.html new file mode 120000 index 00000000..57f0c4f8 --- /dev/null +++ b/k9-svc/site/templates/default.html @@ -0,0 +1 @@ +../../../_shared/templates/site-default.html \ No newline at end of file