From cc4944b4315ea7f6e3edbdcfd36ad6323dfbece1 Mon Sep 17 00:00:00 2001 From: DIDX Date: Thu, 11 Jun 2026 00:03:23 +0800 Subject: [PATCH] Polish public repo launch readiness --- README.md | 12 ++++++++++++ openapi/README.md | 21 +++++++++++++++++++++ tools/check-public-task-repo.sh | 24 +++++++++++++++++++++++- worker-reference/README.md | 15 ++++++++++++++- 4 files changed, 70 insertions(+), 2 deletions(-) create mode 100644 openapi/README.md diff --git a/README.md b/README.md index ef042df..501648d 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,18 @@ Every decision returns a **Trust Action Receipt**. **No receipt, no sensitive action.** +Public demo receipts in this repository are not production-valid receipts. +Production-valid receipts require authorized issuer access through Passpod Hub and the Pilot Access Engine. + +## Start here + +- [Specification](SPEC.md): public v0.1 TASK Core semantics and boundaries. +- [Trust Action Receipt schema](schemas/trust-action-receipt.schema.json): JSON Schema for public draft receipts. +- [OpenAPI reference](openapi/passpod-task.public.yaml): public reference API shape only. +- [Example receipts](examples/README.md): walkthrough for the demo receipts. +- [Validator](validator/README.md): install and run local receipt validation. +- [Pilot Access](PILOT_ACCESS.md): path for real workflow review and hosted pilot access. + ## Public test vs Pilot Access Public repo: schema, examples, local validation, public draft. diff --git a/openapi/README.md b/openapi/README.md new file mode 100644 index 0000000..4ace64b --- /dev/null +++ b/openapi/README.md @@ -0,0 +1,21 @@ +# OpenAPI Reference + +`openapi/passpod-task.public.yaml` is a public reference shape for Passpod TASK +Core. It documents draft endpoints for spec discovery, public demo receipt +validation, and receipt lookup response shape. + +This OpenAPI file is not a production API contract. It does not define or expose: + +- production receipt issuance; +- production signing internals; +- scoped key generation; +- issuer internals; +- Passpod Hub internals; +- customer workflows; +- private commercial logic. + +Production-valid receipts require authorized issuer access through Passpod Hub +and the Pilot Access Engine. + +Use this file to understand the public validation surface only. It is safe for +developer review, mock clients, and standards discussion. diff --git a/tools/check-public-task-repo.sh b/tools/check-public-task-repo.sh index 89a8e3a..6283629 100755 --- a/tools/check-public-task-repo.sh +++ b/tools/check-public-task-repo.sh @@ -2,7 +2,7 @@ set -euo pipefail fail() { echo "❌ $1" >&2; exit 1; } -required_files=(README.md SPEC.md PILOT_ACCESS.md ADOPTION.md SECURITY.md CONTRIBUTING.md GOVERNANCE.md VERSIONING.md requirements.txt schemas/trust-action-receipt.schema.json examples/remote-worker.receipt.json openapi/passpod-task.public.yaml docs/public-vs-pilot.md docs/production-checklist.md docs/standardization-roadmap.md tools/validate-receipts.py) +required_files=(README.md SPEC.md PILOT_ACCESS.md ADOPTION.md SECURITY.md CONTRIBUTING.md GOVERNANCE.md VERSIONING.md requirements.txt schemas/trust-action-receipt.schema.json examples/remote-worker.receipt.json examples/README.md openapi/passpod-task.public.yaml openapi/README.md validator/README.md cli/README.md worker-reference/README.md docs/public-vs-pilot.md docs/production-checklist.md docs/standardization-roadmap.md tools/validate-receipts.py) for f in "${required_files[@]}"; do [ -f "$f" ] || fail "Missing required file: $f" @@ -15,6 +15,28 @@ grep -R "Sensitive Action Control" README.md SPEC.md ADOPTION.md >/dev/null || f grep -R "public draft standard proposal" README.md SPEC.md ADOPTION.md >/dev/null || fail "Public draft standard proposal wording missing" grep -R "pilots@passpod.io" README.md PILOT_ACCESS.md SECURITY.md >/dev/null || fail "Pilot Access email missing" +for link in \ + "SPEC.md" \ + "schemas/trust-action-receipt.schema.json" \ + "openapi/passpod-task.public.yaml" \ + "examples/README.md" \ + "validator/README.md" \ + "PILOT_ACCESS.md" +do + grep -q "$link" README.md || fail "README missing launch navigation link: $link" +done + +grep -q "Public demo receipts in this repository are not production-valid receipts" README.md \ + || fail "README must state that public demo receipts are not production-valid" +grep -q "Production-valid receipts require authorized issuer access through Passpod Hub and the Pilot Access Engine" README.md \ + || fail "README must state the production-valid receipt access boundary" + +for readme in examples/README.md openapi/README.md validator/README.md cli/README.md worker-reference/README.md; do + if grep -Eiq 'placeholder|skeleton placeholder|TODO|TBD|coming soon|lorem|fixme' "$readme"; then + fail "Public directory README still contains placeholder-only language: $readme" + fi +done + dangerous_patterns='SECRET=|PRIVATE_KEY=|BEGIN PRIVATE KEY|real customer receipt:|production signing key:|scoped key value|sk_live_|pk_live_|AKIA[0-9A-Z]{16}' if grep -R -E "$dangerous_patterns" . \ --exclude-dir=.git \ diff --git a/worker-reference/README.md b/worker-reference/README.md index 225fa2f..7a88f4a 100644 --- a/worker-reference/README.md +++ b/worker-reference/README.md @@ -1,3 +1,16 @@ # Worker Reference -Reference Worker skeleton placeholder. Production hosted flows are handled through Pilot Access. +This directory is reserved for a future minimal public reference Worker. + +The purpose would be to show how a developer might call the public validation +shape around Passpod TASK Core receipts. It is not a production Worker, issuer, +hosted verification service, or Passpod Hub component. + +Nothing in this directory should imply that production issuer code exists in +this repository. Production-valid receipts require authorized issuer access +through Passpod Hub and the Pilot Access Engine. + +Future Worker reference material must stay limited to public demo validation +and local developer ergonomics. It must not include production signing, +scoped key generation, issuer internals, customer workflows, Passpod Hub +internals, or private commercial logic.