echo/det-policy.yaml at main · flyingrobots/echo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
# SPDX-License-Identifier: Apache-2.0
# © James Ross Ω FLYING•ROBOTS <https://github.com/flyingrobots>
version: 1

# Crate classification drives path-aware CI gates
classes:
  DET_CRITICAL:
    description: "Determinism/security/replay-critical. Full gates required."
    required_gates: [G1, G2, G3, G4]
  DET_IMPORTANT:
    description: "Affects critical systems indirectly. Reduced gate set."
    # required_gates is consumed by classify_changes.cjs and directly controls
    # workflow execution and merge-blocking evidence validation.
    required_gates: [G2, G4]
  DET_NONCRITICAL:
    description: "No deterministic runtime impact. Standard CI only."
    required_gates: []

# One entry per workspace crate/package
crates:
  # ---- DET_CRITICAL ----
  warp-core:
    class: DET_CRITICAL
    owner_role: "Architect"
    paths: ["crates/warp-core/**"]
  warp-math:
    class: DET_CRITICAL
    owner_role: "Architect"
    paths: ["crates/warp-math/**"]
  warp-geom:
    class: DET_CRITICAL
    owner_role: "Architect"
    paths: ["crates/warp-geom/**"]
  warp-wasm:
    class: DET_CRITICAL
    owner_role: "Architect"
    paths: ["crates/warp-wasm/**"]
  echo-wasm-abi:
    class: DET_CRITICAL
    owner_role: "Architect"
    paths: ["crates/echo-wasm-abi/**"]
  echo-edict-canonical:
    class: DET_CRITICAL
    owner_role: "Tooling Engineer"
    paths: ["crates/echo-edict-canonical/**"]
  echo-edict-provider-artifacts:
    class: DET_CRITICAL
    owner_role: "Tooling Engineer"
    paths: [".gitattributes", "crates/echo-wesley-gen/src/provider_*.rs", "crates/echo-wesley-gen/src/bin/echo-edict-provider-*.rs", "crates/echo-wesley-gen/tests/provider_*.rs", "crates/echo-wesley-gen/assets/v1/**", "schemas/edict-provider/**"]
  echo-edict-provider-lowerer:
    class: DET_CRITICAL
    owner_role: "Tooling Engineer"
    paths: ["crates/echo-edict-provider-lowerer/**", "schemas/edict-provider/components/v1/lowerer.echo-dpo.component.wasm", "tests/edict-provider-host-v1/**"]
  echo-edict-provider-verifier:
    class: DET_CRITICAL
    owner_role: "Tooling Engineer"
    paths: ["crates/echo-edict-provider-verifier/**", "schemas/edict-provider/components/v1/verifier.echo-dpo.component.wasm", "tests/edict-provider-host-v1/**"]
  echo-runtime-schema:
    class: DET_CRITICAL
    owner_role: "Architect"
    paths: ["crates/echo-runtime-schema/**"]
  echo-scene-port:
    class: DET_CRITICAL
    owner_role: "Architect"
    paths: ["crates/echo-scene-port/**"]
  echo-scene-codec:
    class: DET_CRITICAL
    owner_role: "Security Engineer"
    paths: ["crates/echo-scene-codec/**"]
  echo-graph:
    class: DET_CRITICAL
    owner_role: "Architect"
    paths: ["crates/echo-graph/**"]
  echo-dind-harness:
    class: DET_CRITICAL
    owner_role: "CI Engineer"
    paths: ["crates/echo-dind-harness/**"]
  echo-dind-tests:
    class: DET_CRITICAL
    owner_role: "CI Engineer"
    paths: ["crates/echo-dind-tests/**"]
  ci:
    class: DET_CRITICAL
    owner_role: "CI Engineer"
    # Intentional fail-safe: scripts/** is broadly classified as DET_CRITICAL
    # so new CI scripts are automatically covered. Utility scripts pay the cost
    # of extra CI runs but cannot silently bypass gates.
    paths: [".github/workflows/**", "scripts/**", "det-policy.yaml", "Makefile", "xtask/**"]

  # ---- DET_IMPORTANT ----
  build-system:
    class: DET_IMPORTANT
    owner_role: "Architect"
    paths: ["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", "package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml", "deny.toml", "audit.toml"]
  echo-wesley-gen:
    class: DET_IMPORTANT
    owner_role: "Tooling Engineer"
    paths: ["crates/echo-wesley-gen/**"]
  echo-cas:
    class: DET_IMPORTANT
    owner_role: "Architect"
    paths: ["crates/echo-cas/**"]
  echo-file-aperture:
    class: DET_IMPORTANT
    owner_role: "Architect"
    paths: ["crates/echo-file-aperture/**"]
  echo-trace:
    class: DET_IMPORTANT
    owner_role: "Architect"
    paths: ["crates/echo-trace/**"]
  echo-registry-api:
    class: DET_IMPORTANT
    owner_role: "Architect"
    paths: ["crates/echo-registry-api/**"]
  warp-cli:
    class: DET_IMPORTANT
    owner_role: "Architect"
    paths: ["crates/warp-cli/**"]
  warp-benches:
    class: DET_IMPORTANT
    owner_role: "Performance Engineer"
    paths: ["crates/warp-benches/**"]

  dind-tests-root:
    class: DET_IMPORTANT
    owner_role: "CI Engineer"
    paths: ["tests/dind*", "tests/hooks/**", "testdata/dind/**"]

  # ---- DET_NONCRITICAL ----
  # Catch-all: any file not matched by a higher-priority crate entry falls
  # through to DET_NONCRITICAL. classify_changes.cjs uses max-class semantics
  # (line 59), so a file matching both DET_CRITICAL and DET_NONCRITICAL is
  # always classified as DET_CRITICAL. This eliminates the need to enumerate
  # every top-level filename and prevents require_full_classification failures
  # when new non-critical files are added to the repo.
  docs:
    class: DET_NONCRITICAL
    owner_role: "Tech Writer"
    paths: ["**"]
  echo-dry-tests:
    class: DET_NONCRITICAL
    owner_role: "CI Engineer"
    paths: ["crates/echo-dry-tests/**"]

policy:
  require_full_classification: true
  require_owners_for_critical: true
  deterministic_guardrails:
    enabled: true
    # Documentation-only; enforcement is in scripts/ban-nondeterminism.sh
    deny_patterns:
      - "HashMap"
      - "HashSet"
    allowlist_files: []