openpay/
compliance/ PCI-DSS readiness package (scope-map,
pci-zero-architecture, hsm-kms-guidance,
qsa-checklist), citing PCI-DSS v4.0.1
requirements. (#1)
examples/pci-zero/ Runnable example demonstrating a deployment
where merchant code never touches a PAN. (#1)
crates/op-core/ Tokenized<Card> typestate + NetworkToken
+ CardNetwork + Cryptogram. (#2)
crates/op-rails-card/network_token/
NetworkTokenProvider trait + VTS adapter
+ MDES adapter, with deterministic stubs
behind a 'live' feature flag. (#2)
crates/op-driver-sdk/conformance/network_token.rs
Conformance harness for third-party
NetworkTokenProvider implementations. (#2)
crates/op-cli/src/ledger/ 'openpay ledger as-of' subcommand for
bi-temporal queries. (#3)
crates/op-orchestrator/src/telemetry.rs
OpenTelemetry span emission per
Payment<S> transition with semantic-
conventions tags. (#3)
docs/observability/ Grafana dashboard JSON + wiring guide
for the bi-temporal ledger lens. (#3)
smart-byte/
smart-byte-rs/ Rust reference implementation: envelope
encode/decode (canonical CBOR + BLAKE3
content addressing), Ed25519 sign +
verify, lockstep BFT commit MVP, Iroh
transport scaffold, CLI. (#4)
spec/identity_and_key_rotation.md
Adopts KERI SAIDs + key-event log
format; explicitly does not adopt ACDC
chaining wholesale. (#5)
conformance/v1/ 21 test vectors covering canonicalisation,
SAID computation, signature verification,
lockstep commit, gossip propagation.
CI gate enforces spec/vector coupling. (#6)
eoc/
eoc-rs/ Rust + WASM reference implementation:
4-stage cascade (cache -> kv -> graph ->
neural), joule counters via RAPL / NVML /
powermetrics, CLI, wasm-bindgen surface.
18 tests pass. (#7)
eoc-bench/ Benchmark harness, MT-Bench and Router
case sets, 'joules per MT-Bench point'
metric, 'eoc-bench run | compare' CLI. (#8)
standards/sci-for-ai-submission.md
Submission proposal mapping EOC's
receipt schema to GSF SCI-for-AI. (#9)
cookbook/ HuggingFace-style cookbook (markdown +
runnable Python) demonstrating EOC's
cascade with HF AI Energy Score. (#9)
docs/bench-v0.md Reproducibility doc for eoc-bench.
Workspace state:
- openpay clippy -- -D warnings: clean across all touched crates
- smart-byte-rs cargo test --workspace + clippy: clean
- eoc-rs cargo test --workspace + clippy: clean (18 tests)
- eoc-bench cargo check --workspace + clippy + 15 tests: clean
Rust 1.95.0 edition 2024 pinned at the open-standards root via
rust-toolchain.toml; every workspace inherits.
Closes #1 #2 #3 #4 #5 #6 #7 #8 #9.
157 lines
5.4 KiB
YAML
157 lines
5.4 KiB
YAML
name: smart-byte conformance gate
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- 'smart-byte/spec/**'
|
|
- 'smart-byte/conformance/**'
|
|
- '.github/workflows/conformance.yml'
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- 'smart-byte/spec/**'
|
|
- 'smart-byte/conformance/**'
|
|
- '.github/workflows/conformance.yml'
|
|
|
|
jobs:
|
|
validate-json:
|
|
name: Validate conformance JSON files
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Ensure jq is available
|
|
run: jq --version
|
|
|
|
- name: Validate every JSON file under smart-byte/conformance/v*
|
|
run: |
|
|
set -euo pipefail
|
|
found=0
|
|
fail=0
|
|
while IFS= read -r -d '' f; do
|
|
found=$((found+1))
|
|
if ! jq empty "$f" >/dev/null 2>&1; then
|
|
echo "::error file=$f::invalid JSON"
|
|
fail=$((fail+1))
|
|
else
|
|
echo "ok: $f"
|
|
fi
|
|
done < <(find smart-byte/conformance -type f -name '*.json' -print0)
|
|
if [ "$found" -eq 0 ]; then
|
|
echo "::error::no JSON files found under smart-byte/conformance/v*"
|
|
exit 1
|
|
fi
|
|
if [ "$fail" -ne 0 ]; then
|
|
echo "::error::$fail JSON file(s) failed validation"
|
|
exit 1
|
|
fi
|
|
echo "validated $found JSON file(s)"
|
|
|
|
- name: Validate vector schema (top-level array, name field present)
|
|
run: |
|
|
set -euo pipefail
|
|
fail=0
|
|
while IFS= read -r -d '' f; do
|
|
if ! jq -e 'type == "array"' "$f" >/dev/null; then
|
|
echo "::error file=$f::top-level value must be a JSON array"
|
|
fail=$((fail+1))
|
|
continue
|
|
fi
|
|
if ! jq -e 'all(.[]; has("name") and has("description"))' "$f" >/dev/null; then
|
|
echo "::error file=$f::every vector must have name and description fields"
|
|
fail=$((fail+1))
|
|
fi
|
|
done < <(find smart-byte/conformance -type f -name '*_vectors.json' -print0)
|
|
if [ "$fail" -ne 0 ]; then
|
|
echo "::error::$fail vector file(s) failed schema validation"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Validate vector names are unique within each file
|
|
run: |
|
|
set -euo pipefail
|
|
fail=0
|
|
while IFS= read -r -d '' f; do
|
|
dupes=$(jq -r '[.[].name] | group_by(.) | map(select(length>1)) | .[][0] // empty' "$f")
|
|
if [ -n "$dupes" ]; then
|
|
echo "::error file=$f::duplicate vector name(s): $dupes"
|
|
fail=$((fail+1))
|
|
fi
|
|
done < <(find smart-byte/conformance -type f -name '*_vectors.json' -print0)
|
|
if [ "$fail" -ne 0 ]; then
|
|
exit 1
|
|
fi
|
|
|
|
spec-vector-coupling:
|
|
name: Spec changes require vector-pack updates
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'pull_request'
|
|
steps:
|
|
- name: Checkout (with full history for diff)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Determine the PR base
|
|
id: base
|
|
run: |
|
|
base="${{ github.event.pull_request.base.sha }}"
|
|
if [ -z "$base" ]; then
|
|
base="origin/main"
|
|
fi
|
|
echo "base=$base" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Enforce coupling between spec and conformance changes
|
|
run: |
|
|
set -euo pipefail
|
|
base="${{ steps.base.outputs.base }}"
|
|
head="${{ github.event.pull_request.head.sha }}"
|
|
if [ -z "$head" ]; then
|
|
head="HEAD"
|
|
fi
|
|
changed=$(git diff --name-only "$base" "$head")
|
|
echo "Files changed in this PR:"
|
|
echo "$changed"
|
|
spec_touched=0
|
|
conformance_touched=0
|
|
if echo "$changed" | grep -qE '^smart-byte/spec/'; then
|
|
spec_touched=1
|
|
fi
|
|
if echo "$changed" | grep -qE '^smart-byte/conformance/'; then
|
|
conformance_touched=1
|
|
fi
|
|
if [ "$spec_touched" -eq 1 ] && [ "$conformance_touched" -eq 0 ]; then
|
|
echo "::error::This PR modifies smart-byte/spec/ without modifying smart-byte/conformance/."
|
|
echo "::error::Per the conformance social contract, every spec change must be accompanied by a vector-pack update."
|
|
echo "::error::If the spec change is editorial and the wire format is unchanged, record the editorial reason in smart-byte/conformance/v<N>/regeneration.md and include that file in the PR."
|
|
exit 1
|
|
fi
|
|
echo "coupling check passed (spec_touched=$spec_touched, conformance_touched=$conformance_touched)"
|
|
|
|
versions-present:
|
|
name: VERSIONS.md and README.md must exist
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
- name: Required pack metadata files
|
|
run: |
|
|
set -euo pipefail
|
|
missing=0
|
|
for f in smart-byte/conformance/README.md smart-byte/conformance/VERSIONS.md; do
|
|
if [ ! -f "$f" ]; then
|
|
echo "::error file=$f::missing required pack metadata file"
|
|
missing=$((missing+1))
|
|
fi
|
|
done
|
|
for d in smart-byte/conformance/v*/ ; do
|
|
if [ ! -f "$d/regeneration.md" ]; then
|
|
echo "::error file=$d/regeneration.md::missing regeneration.md for $d"
|
|
missing=$((missing+1))
|
|
fi
|
|
done
|
|
if [ "$missing" -ne 0 ]; then
|
|
exit 1
|
|
fi
|