philipp.baumann/dse-security-reports
Watch
0
0
Fork
You've already forked dse-security-reports
 0
Code Issues 1 Pull requests Releases Activity

docs: describe the pipeline as of PR 12 and the artifact copy step #14

Merged
Philipp Baumann merged 2 commits from fm/dse-security-reports-project-hygiene into main 2026-10-27 05:36:47 +00:00
Conversation 0 Commits 2 Files changed 2 +56 -15
Philipp Baumann commented 2026-10-27 02:20:04 +00:00
Owner
Copy link

Summary

Project hygiene pass for captain instruction 2026-10-27 ("3. Project hygiene"): the README still described the pipeline as of the PR-4 skeleton, while PRs 5-12 added the cli-cloud-bi theme, the polars lane, per-unit CycloneDX SBOMs, the evidence-v2 collection, the WireGuard coverage-gap unit, kernel-posture statements, the systems.json registry and the pipeline-generated triage template.
This PR updates README.md to that truth and records the recurring manual step of regenerating the captain's record artifacts in README.md and AGENTS.md.
Code, config and reports are untouched; the change is documentation only.

What changed

  • README.md: full pipeline map (fixture/ingest/derive/cve-links/evidence/scan/sbom/report/triage/az-refresh/all/repro/local), the polars data lane with its byte-identity cross-check, the config/systems.json unit registry and how to add a unit, the sensitive-data rules with snapshot-date naming, the report/theme notes, the artifact-regeneration chain (render + copy to the private firstmate artifacts dir) and a pruned follow-ups list.
  • AGENTS.md: one new bullet documenting the captain's record artifacts step (date-stamped PDF copies plus caches into ~/firstmate/data/dse-security-reports-triage/artifacts/) and stating that the hand-written defender-triage.typ scratch in that dir is superseded by reports/defender-triage.typ.

Note: the repository root README.md was edited under explicit captain/firstmate instruction for this hygiene task (named drift: the README describes the pipeline as of PR 4).

Verification

All commands were run in this worktree exactly as documented:

  • just install - uv sync from the committed lock (ok).
  • just test - 22 passed.
  • just all - fixture, derive, both reports on the synthetic fixture (ok).
  • just repro - both PDFs verified byte-identical.
  • just py-crosscheck - polars derivation matches the stdlib pipeline.

Nothing real is committed; all pipeline outputs stayed under gitignored .local/.

Behaviour change

None; documentation only.

## Summary Project hygiene pass for captain instruction 2026-10-27 ("3. Project hygiene"): the README still described the pipeline as of the PR-4 skeleton, while PRs 5-12 added the cli-cloud-bi theme, the polars lane, per-unit CycloneDX SBOMs, the evidence-v2 collection, the WireGuard coverage-gap unit, kernel-posture statements, the systems.json registry and the pipeline-generated triage template. This PR updates README.md to that truth and records the recurring manual step of regenerating the captain's record artifacts in README.md and AGENTS.md. Code, config and reports are untouched; the change is documentation only. ## What changed - `README.md`: full pipeline map (fixture/ingest/derive/cve-links/evidence/scan/sbom/report/triage/az-refresh/all/repro/local), the polars data lane with its byte-identity cross-check, the `config/systems.json` unit registry and how to add a unit, the sensitive-data rules with snapshot-date naming, the report/theme notes, the artifact-regeneration chain (render + copy to the private firstmate artifacts dir) and a pruned follow-ups list. - `AGENTS.md`: one new bullet documenting the captain's record artifacts step (date-stamped PDF copies plus caches into `~/firstmate/data/dse-security-reports-triage/artifacts/`) and stating that the hand-written `defender-triage.typ` scratch in that dir is superseded by `reports/defender-triage.typ`. Note: the repository root README.md was edited under explicit captain/firstmate instruction for this hygiene task (named drift: the README describes the pipeline as of PR 4). ## Verification All commands were run in this worktree exactly as documented: - `just install` - uv sync from the committed lock (ok). - `just test` - 22 passed. - `just all` - fixture, derive, both reports on the synthetic fixture (ok). - `just repro` - both PDFs verified byte-identical. - `just py-crosscheck` - polars derivation matches the stdlib pipeline. Nothing real is committed; all pipeline outputs stayed under gitignored `.local/`. ## Behaviour change None; documentation only. 
- Update the README pipeline map to the full recipe set (ingest, evidence,
  scan, sbom, cve-links, az-refresh, both reports, repro) and the polars
  data lane with its cross-check, replacing the PR-4-era skeleton list.
- Document the config/systems.json unit registry, its match resolution and
  how to add a unit (baseline entry first, az-refresh merges over it).
- Document the sensitive-data rules for real exports, caches and derived
  data, including the snapshot-date naming of copied artifacts.
- Document the recurring manual step of regenerating the captain's record
  artifacts (render chain plus copying date-stamped PDFs and caches into
  the private firstmate artifacts dir).
- Note in AGENTS.md that the hand-written defender-triage.typ scratch in
  the private artifacts dir is superseded by reports/defender-triage.typ.
Philipp Baumann deleted branch fm/dse-security-reports-project-hygiene 2026-10-27 05:36:48 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
philipp.baumann/dse-security-reports!14
No description provided.