File size: 4,962 Bytes
9425aed | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 | <sovereign_trust_deed>
<metadata>
<deed_id>SOV-GIT-INVERTED-MONOREPO-v2026</deed_id>
<issuer>SnapKitty_Sovereign_Transformer</issuer>
<operator>Ahmad_Ali_Parr</operator>
<logic_layer>Prolog_Verified_Deterministic</logic_layer>
<trust_protocol>Bifrost_WORM_Chain</trust_protocol>
</metadata>
<identity_hierarchy>
<role id="architect" rank="0" constraint="ASP_MAXIMAL">
<principal>Architect_String</principal>
<authority>Veto_Power_On_Merge, Schema_Evolution, Key_Rotation</authority>
<asp_profile>ZERO_TRUST_VERIFIED</asp_profile>
</role>
<role id="engineer" rank="1" constraint="ASP_STRICT" count="5">
<principal_set>Eng_Team_Alpha</principal_set>
<authority>Push_Feature_Branches, Propose_Merge_To_Main</authority>
<asp_profile>SIGNED_COMMITS_MANDATORY</asp_profile>
</role>
<role id="ci_bot" rank="2" constraint="ASP_AUTOMATED">
<principal>Hauki_Fn_Ops_Bot</principal>
<authority>Read_Registry, Deploy_Staging, Attest_Build</authority>
</role>
</identity_hierarchy>
<infrastructure_topology>
<pattern>Inverted_Monorepo</pattern>
<description>
The Monorepo IS the Infrastructure.
Git Server (Gitea) runs INSIDE the monorepo as a sovereign service.
GitHub acts ONLY as a WORM Mirror (GitOps) and Public Registry (GHCR) facade.
</description>
<components>
<component name="sov-git-server">
<type>Gitea_Rootless_Hardened</type>
<bind>127.0.0.1:3000</bind>
<storage>sov-worm-git-storage</storage>
<auth>Ed25519_SSH_Keys_Only</auth>
</component>
<component name="sov-registry-proxy">
<type>GHCR_Facade</type>
<policy>Push_Only_If_WORM_Seal_Valid</policy>
<upstream>ghcr.io/sov-org</upstream>
</component>
<component name="hauki-fn-ops">
<type>Serverless_Function_Runtime</type>
<trigger>Git_Push_Tag_Match:v*</trigger>
<logic>Verify_Attestation -> Deploy_Sov_Docker</logic>
</component>
</components>
</infrastructure_topology>
<asp_constraints>
<constraint id="ASP_MAXIMAL" target="Architect">
<rule>All merges to main require Architect Ed25519 Counter-Signature.</rule>
<rule>Schema changes (SQL/Proto/JSON) require Formal Verification Proof (Prolog).</rule>
<rule>Zero external dependencies allowed in base images (FROM scratch only).</rule>
</constraint>
<constraint id="ASP_STRICT" target="Engineers">
<rule>Commits MUST be GPG/SSH signed (Ed25519).</rule>
<rule>Branch namespacing: feat/{eng-id}/{ticket} | fix/{eng-id}/{ticket}.</rule>
<rule>Pre-commit hook: sov-lint --polite --intercol-contract</rule>
</constraint>
<constraint id="POLITE_CODING" scope="Global">
<rule>No force-push to protected branches (Rejected by Server Hook).</rule>
<rule>Conventional Commits 1.0.0 Strict (feat, fix, chore, docs, refactor, test).</rule>
<rule>Review requirement: 2 Approvals (1 must be Architect for infra).</rule>
</constraint>
<constraint id="INTERCOL_CONTRACT" scope="Service_Mesh">
<rule>All inter-service calls MUST define Protobuf/JSON Schema in contracts/</rule>
<rule>Breaking change detection runs in CI (Buf/Pact).</rule>
<rule>Runtime enforcement via Sidecar Proxy (Envoy/WASM).</rule>
</constraint>
</asp_constraints>
<gitops_flow>
<phase name="Local_Sovereign_Loop">
<step>1. Dev clones from sov-git-server (localhost:3000).</step>
<step>2. Dev codes, runs sov-attest.sh (Blake3+Ed25519).</step>
<step>3. Push to sov-git-server. Pre-receive Hook validates WORM Seal.</step>
</phase>
<phase name="Mirror_To_GitHub_WORM">
<step>4. Sov-Git-Server Mirror Job pushes to GitHub (--mirror).</step>
<step>5. GitHub Actions (Read-Only) triggers Hauki Fn Ops.</step>
</phase>
<phase name="Registry_Attestation">
<step>6. Hauki Fn pulls image, verifies .worm sidecar.</step>
<step>7. If VALID -> Push to GHCR (sov-org/repo:v{semver}).</step>
<step>8. If INVALID -> Quarantine, Alert Architect via Bifrost Log.</step>
</phase>
</gitops_flow>
<worm_seal>
<requirement>This XML Deed is the Source of Truth.</requirement>
<requirement>Any deviation requires Architect Counter-Signature + New Deed Version.</requirement>
</worm_seal>
</sovereign_trust_deed>
|