Skip to content

Commit 04f5b18

Browse files
tufedevtufedev
committed
chore: OSS contributor + CI scaffolding (E follow-up to v1.1.1)
Adds the standard OSS-side files the public repo was missing: - SECURITY.md: RFC 9116 disclosure (security@jecp.dev), scope table separating Hub bugs from Spec/SDK/LP bugs. - .github/PULL_REQUEST_TEMPLATE.md: wire-compat checkbox (v1.x is wire-frozen), spec-alignment requirement, Conventional Commits hint. - .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md + config.yml: blank issues disabled; security disclosures routed to security.txt before they reach public threads. - .github/workflows/ci.yml: cargo fmt / clippy / build + spectral lint on spec/openapi.yaml. Tests are run in the monorepo against managed DB; OSS CI is build-sanity only. - .github/dependabot.yml: weekly cargo + monthly GitHub Actions updates, grouped by stack (tokio / tls / aws) to keep PR volume manageable. No source code changes; preparation for incoming external contributors and the upcoming B-4 audit firm engagement.
1 parent ab08f52 commit 04f5b18

7 files changed

Lines changed: 318 additions & 0 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
name: Bug report
3+
about: A bug in the JECP reference Hub (this repo).
4+
title: 'bug: '
5+
labels: bug
6+
---
7+
8+
## What happened
9+
10+
<!-- One paragraph. Concrete behavior, not "it doesn't work." -->
11+
12+
## What you expected
13+
14+
<!-- One paragraph. -->
15+
16+
## Reproduction
17+
18+
<!--
19+
Smallest possible curl / SDK snippet that reproduces the issue.
20+
Redact any API keys or Mandate signatures.
21+
-->
22+
23+
```bash
24+
# curl ...
25+
```
26+
27+
## Environment
28+
29+
- Hub commit / tag: <!-- e.g., v1.1.1 -->
30+
- Deployment: <!-- jecp.dev hosted / self-hosted / local cargo run -->
31+
- Client SDK: <!-- @jecpdev/sdk vX.Y / curl / your own impl -->
32+
33+
## Logs
34+
35+
<!--
36+
Paste relevant log lines. The Hub emits structured JSON logs; you can
37+
include them as a fenced ```json block. Redact API keys, signatures, and
38+
agent_id values you do not want public.
39+
-->
40+
41+
```json
42+
```
43+
44+
## Security implication
45+
46+
- [ ] This bug has **no** security implication.
47+
- [ ] This bug **may** have security implications — I should email `security@jecp.dev` instead. *(If you check this, close the issue and email — do not paste exploit details in a public issue.)*

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
blank_issues_enabled: false
2+
3+
contact_links:
4+
- name: Security disclosure (do NOT open a public issue)
5+
url: https://jecp.dev/.well-known/security.txt
6+
about: Email security@jecp.dev — RFC 9116 coordinated disclosure.
7+
- name: Question about the JECP protocol spec
8+
url: https://github.com/jecpdev/jecp-spec/issues
9+
about: Spec questions belong in the spec repo, not the Hub reference implementation.
10+
- name: TypeScript SDK / CLI questions
11+
url: https://github.com/jecpdev/jecp-sdk-typescript/issues
12+
about: Issues about @jecpdev/sdk or @jecpdev/cli belong in the SDK repo.
13+
- name: General discussion
14+
url: https://jecp.dev
15+
about: Visit jecp.dev for the protocol overview.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
name: Feature request
3+
about: Propose a new feature for the JECP reference Hub.
4+
title: 'feat: '
5+
labels: enhancement
6+
---
7+
8+
## Problem
9+
10+
<!--
11+
What problem does this solve? One paragraph, user-focused, no jargon.
12+
"It would be nice if X" is not a problem — say what fails today.
13+
-->
14+
15+
## Proposed solution
16+
17+
<!-- High-level shape of the solution. Not the full design. -->
18+
19+
## Wire-format impact
20+
21+
> The v1.x Hub is wire-frozen. New features can land if they are additive
22+
> (new fields with defaults, new error codes, new actions). Breaking
23+
> changes go to a v2.x track.
24+
25+
- [ ] Additive — no breaking change to existing clients
26+
- [ ] Breaking — requires v2.x (state why)
27+
28+
## Spec change required?
29+
30+
- [ ] No — Hub-only change (e.g., internal performance, observability)
31+
- [ ] Yes — open a parallel issue on `jecpdev/jecp-spec` first: <!-- URL -->
32+
33+
## Alternatives considered
34+
35+
<!-- Optional, but helps reviewers see you weighed options. -->
36+
37+
## Are you willing to implement it?
38+
39+
- [ ] Yes, with guidance
40+
- [ ] No, requesting that someone else picks it up

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
<!--
2+
Thanks for contributing to the JECP reference Hub.
3+
4+
Please complete the sections below. Items marked with [REQUIRED] block merge.
5+
-->
6+
7+
## Summary
8+
9+
<!-- One-paragraph description of what this PR changes and why. -->
10+
11+
## Type of change
12+
13+
- [ ] Bug fix (non-breaking)
14+
- [ ] New feature (non-breaking)
15+
- [ ] Breaking change (wire-format or API change)
16+
- [ ] Documentation only
17+
- [ ] CI / tooling only
18+
19+
## Wire compatibility [REQUIRED]
20+
21+
> The v1.x line is **wire-frozen** per `RELEASE_NOTES_v1.0.0.md`. Breaking changes are deferred to v2.x.
22+
23+
- [ ] This PR does not change the wire format of `/v1/invoke`, `/v1/capabilities`, the error envelope, the Mandate schema, or the Provenance v1/v2 wire formats.
24+
- [ ] If checked above is false: this PR is targeting a future v2.x branch (state which).
25+
26+
## Spec alignment [REQUIRED]
27+
28+
- [ ] No spec changes required.
29+
- [ ] Spec change PR opened at `jecpdev/jecp-spec` — link: <!-- URL -->
30+
31+
## Testing
32+
33+
- [ ] `cargo test` passes locally
34+
- [ ] `cargo clippy --all-targets -- -D warnings` passes
35+
- [ ] `cargo fmt --check` passes
36+
- [ ] New tests added where appropriate
37+
38+
## Security implications
39+
40+
<!--
41+
If this PR touches auth, the wallet ledger, the manifest verifier, signing,
42+
or any wire-format parser: describe the security model change. If unsure,
43+
say "unsure — please review" and a maintainer will help.
44+
-->
45+
46+
## Coordinated disclosure
47+
48+
If this PR addresses a security finding, **do not include exploit details**
49+
in the public PR description. Use `security@jecp.dev` for disclosure (see
50+
`SECURITY.md`).
51+
52+
## Checklist
53+
54+
- [ ] I have read [`CONTRIBUTING.md`](../CONTRIBUTING.md)
55+
- [ ] My commit messages follow Conventional Commits (`type(scope): subject`)
56+
- [ ] I have added entries to `CHANGELOG.md` under `[Unreleased]` if user-visible

‎.github/dependabot.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: cargo
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
day: monday
8+
time: '03:00'
9+
timezone: Asia/Tokyo
10+
open-pull-requests-limit: 5
11+
labels:
12+
- dependencies
13+
- rust
14+
groups:
15+
tokio-stack:
16+
patterns:
17+
- tokio*
18+
- hyper*
19+
- tower*
20+
- axum*
21+
tls-stack:
22+
patterns:
23+
- rustls*
24+
- webpki-roots
25+
- ring
26+
aws-stack:
27+
patterns:
28+
- aws-*
29+
- aws-sdk-*
30+
commit-message:
31+
prefix: 'deps'
32+
include: 'scope'
33+
34+
- package-ecosystem: github-actions
35+
directory: /
36+
schedule:
37+
interval: monthly
38+
labels:
39+
- dependencies
40+
- ci
41+
commit-message:
42+
prefix: 'ci(deps)'

‎.github/workflows/ci.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: CI
2+
3+
# Build sanity for the public JECP reference Hub source.
4+
#
5+
# Why no `cargo test` here: integration tests need a live Supabase + Anthropic
6+
# API key, both of which the monorepo runs against. The OSS-side CI exists to
7+
# guarantee anyone cloning this repo can build and lint cleanly. Functional
8+
# tests are gated by the monorepo's CI before mirroring here.
9+
10+
on:
11+
push:
12+
branches: [main]
13+
pull_request:
14+
branches: [main]
15+
16+
env:
17+
CARGO_TERM_COLOR: always
18+
RUSTFLAGS: "-D warnings"
19+
20+
jobs:
21+
fmt:
22+
name: cargo fmt
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@v4
26+
- uses: dtolnay/rust-toolchain@stable
27+
with:
28+
components: rustfmt
29+
- run: cargo fmt --all --check
30+
31+
clippy:
32+
name: cargo clippy
33+
runs-on: ubuntu-latest
34+
steps:
35+
- uses: actions/checkout@v4
36+
- uses: dtolnay/rust-toolchain@stable
37+
with:
38+
components: clippy
39+
- uses: Swatinem/rust-cache@v2
40+
- run: cargo clippy --all-targets --all-features
41+
42+
build:
43+
name: cargo build
44+
runs-on: ubuntu-latest
45+
steps:
46+
- uses: actions/checkout@v4
47+
- uses: dtolnay/rust-toolchain@stable
48+
- uses: Swatinem/rust-cache@v2
49+
- run: cargo build --all-targets --verbose
50+
51+
spec-lint:
52+
name: OpenAPI lint
53+
runs-on: ubuntu-latest
54+
steps:
55+
- uses: actions/checkout@v4
56+
- uses: actions/setup-node@v4
57+
with:
58+
node-version: '20'
59+
- run: npx --yes @stoplight/spectral-cli lint spec/openapi.yaml --ruleset spec/.spectral.yaml

‎SECURITY.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Security Policy
2+
3+
## Coordinated disclosure
4+
5+
Please **do not open public GitHub issues** for security vulnerabilities in the JECP reference Hub.
6+
7+
Email **security@jecp.dev** instead — see [`https://jecp.dev/.well-known/security.txt`](https://jecp.dev/.well-known/security.txt) (RFC 9116) for the canonical contact and PGP key.
8+
9+
We aim to acknowledge reports within **2 business days** (Tokyo time, JST/UTC+9).
10+
11+
## Scope
12+
13+
In scope for this repository (the JECP reference Hub):
14+
15+
| Area | In scope? |
16+
|------|----------|
17+
| `/v1/invoke` request handling, billing, forwarding | ✅ |
18+
| `/v1/providers/*` registration / DNS verify / Stripe Connect | ✅ |
19+
| `/v1/manifests` publish + lifecycle | ✅ |
20+
| Wallet ledger atomicity | ✅ |
21+
| Provenance v1/v2 verification | ✅ |
22+
| API key auth (bcrypt + rotation) | ✅ |
23+
| Mandate / Trust Gate enforcement | ✅ |
24+
| Cert-pin TLS to facilitator | ✅ |
25+
| SSRF guards on outbound HTTP | ✅ |
26+
| Wire-format parsers | ✅ |
27+
28+
Out of scope for **this** repository (report separately):
29+
30+
| Area | Where to report |
31+
|------|----------------|
32+
| Spec ambiguity that enables attack | [`jecpdev/jecp-spec`](https://github.com/jecpdev/jecp-spec/security) |
33+
| TypeScript SDK / CLI vuln | [`jecpdev/jecp-sdk-typescript`](https://github.com/jecpdev/jecp-sdk-typescript/security) |
34+
| Vulnerability in `jecp.dev` LP | Same channel (`security@jecp.dev`) |
35+
| Vulnerability in JobDoneBot (first Provider) | `security@jobdonebot.com` |
36+
37+
## What we do not consider a vulnerability
38+
39+
- Missing rate-limit headers on endpoints not in the documented surface
40+
- Information leakage from `/openapi.json` (it is intentionally public)
41+
- DNS-poisoning attacks on Provider DNS verification when **resolver multi-consensus** is already configured (the operator can adjust the resolver set)
42+
- 3rd-party transitive dependency CVE that does not have a reachable exploit path through the Hub (please still mention, but P3 by default)
43+
44+
## Supported versions
45+
46+
We only patch security issues on:
47+
48+
- The latest published `v1.x.y` tag on this repo
49+
- The currently-deployed Hub at `jecp.dev` (matches the latest tag)
50+
51+
Older versions are unsupported. Pre-1.0 staging snapshots are not supported.
52+
53+
## Bug bounty
54+
55+
We do not currently run a paid bounty. If you would value attribution in the next release's CHANGELOG.md, say so in your report and we'll do that by default.
56+
57+
## Audit reports
58+
59+
External audits are published under [`jecpdev/jecp-contracts`](https://github.com/jecpdev/jecp-contracts) and (for Hub Rust scope) on this repo as they complete. See `B-4` engagement plan in our handoff docs.

0 commit comments

Comments
 (0)