mirror of
https://github.com/piabrota/mu.git
synced 2026-11-07 06:15:59 -10:00
8d401929b6
* The repo scripts make repos on an operator's own account ("owner": "user")
Any operator can now make private or public repos on their own GitHub account with the same setup as
ouroboric-dev's. A config with "owner": "user" gets it, with the differences GitHub forces:
- create-repo.sh creates through /user/repos, after checking that the token belongs to the config's
user, so a repo never lands on the wrong account.
- setup-repo.sh writes each user repo's own Actions allowlist (lint.yml's pinned actions, nothing
else), since a user has no org to hold it. On a user's private repo it skips secret scanning, push
protection and private vulnerability reporting, which GitHub doesn't offer there, and says so.
- If GitHub refuses the ruleset (a user's private repo without GitHub Pro), setup-repo.sh fails and
says main is not protected, after every other setting is in place; new-repo.sh then reports the repo
as unprotected. The ruleset itself is unchanged.
An operator's config is theirs, not the company's: it lives in scripts/orgs/local/, which git ignores
except for its README, and --org reads it from there (a name in both folders is refused). Only
generic examples are committed, in scripts/orgs/examples/: a user config and a proprietary licence
text that names no one. Invariant 9 in AGENTS.md says never to commit an operator's config, and a test
fails if any committed config is neither an org's nor an example. The fakes learn GET /user,
POST /user/repos and refused writes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
* check-repos.sh --check operator: no tracked file names the operator (invariant 9)
The check reads each repo's local clone and fails when a tracked file names the operator who runs it: their
login, their home folder's name, or a user account in scripts/orgs/local/, as whole words in any case. The
names come from the machine, so the check serves any operator and the script names no one;
CHECK_REPOS_OPERATOR replaces them. It prints the files, never the names, and fails closed on a missing
clone, an empty name list or a git error. The records of past work keep their paths as written: RECORDS
lists those files one by one, so a new plan beside them is still checked. It is a default check.
The local-qwen design, plan and how-to now give paths relative to the clones, and the design no longer
names the founder's folders. Invariant 9 also covers docs, plans and fixtures.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---------
Co-authored-by: Bruno Guilhermo de Barros Valério <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
Ouroboric
Ouroboric (ouroboric.dev) builds open factories that improve themselves: for software, companies, and in time research and art. This repository is the company umbrella. Start with the charter.
The map
The names come from Norse myth; the naming and mythology record tells the story behind each one, and its long-term map shows what comes after v0.
Contents
| Folder | What's there |
|---|---|
1-company/ |
charter, roadmap, budget, legal, readiness, repositories |
4-ways-of-working/ |
the standards every Ouroboric product follows: spec-driven development, docs, writing styles, diagrams |
5-research/ |
company-level research |
6-journal/ |
the journey: challenges, solutions, results |
7-branding/ |
the Ouroboric story, identity, voice, prompts |
The repositories page lists every repo in the ouroboric-dev
organisation and where it sits in the tree. The products are submodules under
products/: clone with --recurse-submodules.
Contributing
Run uvx pre-commit install once after cloning, so gitleaks checks each commit for secrets.
Licence
- Documentation (this repository's main content): CC BY 4.0.
- Scripts (
scripts/): AGPL-3.0. - Names and logos are not licensed: see TRADEMARKS.md.
- The products use AGPL-3.0 for factory code and MIT for anything copied into what operators build. What you build with Ouroboric factories is yours.