diff --git a/docs/memory-bank/chat.md b/docs/memory-bank/chat.md index 7ffca6c..42a4521 100644 --- a/docs/memory-bank/chat.md +++ b/docs/memory-bank/chat.md @@ -26,10 +26,10 @@ - The repository-local contributor baseline now targets source `main`: 0BSD licensing, a local contribution guide, Issue-to-task-to-PR linkage, and read-only CI all use `task check` as the normal fast contract. Pull request #1 - and the matching `main` check passed, issues #2 through #4 are publicly ready, - and the generated `release` branch carries the root license. -- Contributor rollout remains open for final repository metadata, branch - protection, and account-wide community-profile verification. + and the matching `main` check passed, and the generated `release` branch carries + the root license. No placeholder contributor backlog is retained. +- Repository metadata, branch protection, private vulnerability reporting, and the + account-wide community-profile verification are complete. ## Current State diff --git a/docs/tasks/T002_document_host_capability_matrix.md b/docs/tasks/T002_document_host_capability_matrix.md deleted file mode 100644 index cac3f56..0000000 --- a/docs/tasks/T002_document_host_capability_matrix.md +++ /dev/null @@ -1,52 +0,0 @@ -# Document The Host Capability Matrix - -- ID: `T002` -- Type: `docs` -- Status: `open` -- Parent: `none` -- Public Tracking: https://github.com/codegeist-ai/codegeist-devcontainer-kit/issues/3 -- Contribution Level: `beginner (good first issue)` -- Effort: `small` - -## Goal - -Add one concise host-capability matrix that tells contributors which local -capabilities are needed for the normal check, devcontainer use, and each broad -integration-test category. - -## Context - -The current README documents Docker, KVM, display forwarding, browsers, and QEMU -in their individual sections, but it does not provide one entry-point table for -contributors deciding which checks their host can run. This documentation task -is intentionally suitable for a first contribution and remains unimplemented. - -## Acceptance Criteria - -- The source README has one compact matrix covering `task check`, normal VS Code - Dev Containers use, Docker-backed integration tests, KVM/QEMU tests, and - visible browser tests. -- Each row distinguishes required host capabilities from optional capabilities - and links to existing detailed sections instead of repeating them. -- The matrix does not promise support for an untested host, display transport, - or virtualization configuration. -- Contributor documentation points to the matrix where host prerequisites are - discussed. - -## Files - -- `README.md` -- `CONTRIBUTING.md` - -## Non-Goals - -- Changing the image, Compose configuration, or test behavior. -- Adding support for a new operating system or container runtime. -- Rewriting the existing detailed browser, QEMU, or test documentation. - -## Verification - -- Run `task check`. -- Review every matrix link from the rendered Markdown. -- Confirm every claimed capability is backed by an existing test or documented - runtime contract. diff --git a/docs/tasks/T003_add_read_only_release_preview.md b/docs/tasks/T003_add_read_only_release_preview.md deleted file mode 100644 index 709f5cb..0000000 --- a/docs/tasks/T003_add_read_only_release_preview.md +++ /dev/null @@ -1,56 +0,0 @@ -# Add A Read-Only Release Preview - -- ID: `T003` -- Type: `feature` -- Status: `open` -- Parent: `none` -- Public Tracking: https://github.com/codegeist-ai/codegeist-devcontainer-kit/issues/4 -- Contribution Level: `intermediate (help wanted)` -- Effort: `medium` - -## Goal - -Let contributors materialize and inspect the exact runtime-only release tree -without creating a commit, updating a Git ref, or publishing a branch. - -## Context - -The current `scripts/release-build.sh` owns the runtime file manifest and creates -the generated release commit after the heavyweight release gate. The focused -release test exercises that workflow in a temporary fixture, but there is no -contributor command that only writes a preview tree. This capability remains -unimplemented. - -## Acceptance Criteria - -- A documented command writes the release tree to an explicit temporary or - caller-selected directory without changing repository refs or commits. -- Preview and publication use one canonical runtime manifest; file lists are not - duplicated in separate implementation paths. -- The preview maps `Dockerfile.base` to `Dockerfile` and `README_release.md` to - `README.md` exactly like release publication. -- A deterministic test compares preview contents and paths with the existing - release assembly contract. -- Existing maintainer-only publication and full-suite verification gates remain - unchanged. - -## Files - -- `Taskfile.yaml` -- `scripts/release-build.sh` -- `tests/release-build.sh` -- `README.md` -- `CONTRIBUTING.md` - -## Non-Goals - -- Publishing the `release` branch. -- Weakening the clean-`main` or full-suite release gate. -- Building the devcontainer image during preview. - -## Verification - -- Run the new focused preview test. -- Run `task check`. -- Confirm `git status --short --branch` and relevant local refs are unchanged by - the preview command. diff --git a/docs/tasks/T004_audit_mutable_toolchain_inputs.md b/docs/tasks/T004_audit_mutable_toolchain_inputs.md deleted file mode 100644 index 922ec0e..0000000 --- a/docs/tasks/T004_audit_mutable_toolchain_inputs.md +++ /dev/null @@ -1,64 +0,0 @@ -# Audit Mutable Toolchain Inputs - -- ID: `T004` -- Type: `chore` -- Status: `open` -- Parent: `none` -- Public Tracking: https://github.com/codegeist-ai/codegeist-devcontainer-kit/issues/2 -- Contribution Level: `intermediate` -- Effort: `medium` - -## Goal - -Inventory mutable build-time installer and package inputs, assess their -reproducibility risks, and define a small set of focused improvements that can be -implemented and reviewed independently. - -## Context - -`Dockerfile.base` currently combines explicitly versioned downloads with -`releases/latest` assets, scripts fetched from `main`, unversioned npm and pip -packages, moving APT repositories, and installers executed from network pipes. -Tests verify the resulting tools, but the repository has no complete input -inventory, integrity classification, or documented update policy. This audit and -its proposed improvements remain unimplemented. - -## Acceptance Criteria - -- A repo-owned document inventories every network-fetched image-build input in - `Dockerfile.base`, including its source, current selector, architecture - assumptions, available integrity mechanism, and existing verification. -- Inputs are classified consistently as immutable, version-selected, or mutable. -- The audit prioritizes risks without claiming the complete image is - reproducible when APT repositories or other moving sources remain. -- The audit proposes a bounded first set of improvements, with an update method - and focused verification strategy for each proposal. -- Proposed improvements are split into reviewable follow-up tasks or Issues - rather than a single bulk pinning change. -- Existing intentional choices, including tools that currently follow latest - upstream channels, are identified instead of silently reclassified as defects. - -## Files - -- `Dockerfile.base` -- `tests/docker-build.sh` -- `README.md` -- `README_release.md` -- `docs/` - -## Non-Goals - -- Pinning, upgrading, or replacing packages and installers as part of the audit. -- Generating a lockfile for Debian APT repositories. -- Claiming bit-for-bit image reproducibility. -- Running or publishing a release. - -## Verification - -- Compare the inventory against every URL, package-manager install, and external - repository declaration in `Dockerfile.base`. -- Confirm each proposed improvement names an update path and deterministic - focused check. -- Run `task check` for documentation and release-contract validation. -- Confirm no Dockerfile, installer, package selector, or runtime behavior changed - while completing the audit.