diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 022cdc6..9f2ef22 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -34,8 +34,8 @@ ## Testing diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..b58802a --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,42 @@ +name: Scorecard + +on: + branch_protection_rule: + schedule: + - cron: '37 9 * * 1' + push: + branches: [main] + +permissions: + security-events: write + id-token: write + contents: read + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run analysis + uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + with: + results_file: scorecard-results.sarif + results_format: sarif + publish_results: false + + - name: Upload artifact + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: SARIF file + path: scorecard-results.sarif + retention-days: 5 + + - name: Upload to code-scanning + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + with: + sarif_file: scorecard-results.sarif diff --git a/AGENTS.md b/AGENTS.md index a662d87..8a72cdd 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -59,7 +59,7 @@ This project is indexed by GitNexus as **falcon** (106 symbols, 207 relationship | `gitnexus://repo/falcon/context` | Codebase overview, check index freshness | | `gitnexus://repo/falcon/clusters` | All functional areas | | `gitnexus://repo/falcon/processes` | All execution flows | -| `gitnexus://repo/falcon/process/{name}` | Step-by-step execution trace | +| `gitnexus://repo/falcon/process/{name}` | Step-by-step execution swift | ## CLI diff --git a/CHANGELOG.md b/CHANGELOG.md index e44afa4..0da58dd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,7 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Removed -- Dead `MCPGraph`, `MCPNode`, `MCPEdge`, and `NewMCPGraph` graph types (`graph.go`): zero references in mcpkit or any ecosystem consumer (yaad, sight, inspect, hawk). `AddGraphResource`/`GraphMIMEType` are unaffected. +- Dead `MCPGraph`, `MCPNode`, `MCPEdge`, and `NewMCPGraph` graph types (`graph.go`): zero references in mcpkit or any ecosystem consumer (harrier, kestrel, merlin, hawk). `AddGraphResource`/`GraphMIMEType` are unaffected. - Unused `fmt` import held alive by a `var _ = fmt.Sprintf` placeholder in `vault.go`. ### Changed diff --git a/CLAUDE.md b/CLAUDE.md index 27b73a0..2b8251a 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -28,7 +28,7 @@ This project is indexed by GitNexus as **falcon** (106 symbols, 207 relationship | `gitnexus://repo/falcon/context` | Codebase overview, check index freshness | | `gitnexus://repo/falcon/clusters` | All functional areas | | `gitnexus://repo/falcon/processes` | All execution flows | -| `gitnexus://repo/falcon/process/{name}` | Step-by-step execution trace | +| `gitnexus://repo/falcon/process/{name}` | Step-by-step execution swift | ## CLI diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 8918759..502d9ce 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -69,7 +69,7 @@ CHANGE:` in the footer. This triggers a major version bump. ## Ecosystem boundaries falcon is a **foundation repo** — it must never import `hawk`, any -engine (`eyrie`, `yaad`, `tok`, `trace`, `sight`, `inspect`), any SDK, or +engine (`eyrie`, `harrier`, `shrike`, `swift`, `kestrel`, `merlin`), any SDK, or `eagle`. Its only non-stdlib dependency is upstream `mark3labs/mcp-go`. Run `make boundaries` (also run in CI) to verify. diff --git a/Makefile b/Makefile index e098938..1e75743 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ # Canonical hawk-eco Makefile for Go LIBRARY repos. # Source of truth: https://github.com/GrayCodeAI/hawk/blob/main/.shared-templates/Makefile.library.tmpl -# falcon is a foundation library consumed by engines (sight, inspect); +# falcon is a foundation library consumed by engines (kestrel, merlin); # no standalone binary, no release beyond tagging. # --------------------------------------------------------------------------- diff --git a/README.md b/README.md index 576733e..499d0c5 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ Shared MCP server scaffolding for the hawk ecosystem. `mcpkit` wraps [`mark3labs/mcp-go`](https://github.com/mark3labs/mcp-go) with the construction, transports, and handler helpers that every hawk-ecosystem -engine (`inspect`, `sight`, ...) would otherwise duplicate. Repos declare their +engine (`merlin`, `kestrel`, ...) would otherwise duplicate. Repos declare their tools and handlers; mcpkit does the rest. **Tagline:** Shared MCP server scaffolding for the hawk ecosystem. @@ -152,14 +152,14 @@ falcon is a **foundation repo** in the hawk-eco mono-ecosystem: | **falcon** | Shared MCP server scaffolding (this repo) | | **eagle** | Shared cross-repo contracts (types, tools, events, policy, review, verify, sessions) | | **eyrie** | LLM provider runtime — routing, streaming, retries, caching | -| **yaad** | Graph-based persistent memory for coding agents | -| **tok** | Tokenizer, compression, secrets scanning, rate limiting | -| **sight** | Diff-based code review and static analysis | -| **inspect** | Security audit library (CVE, API security, CI output) | -| **trace** | Session capture and replay CLI | +| **harrier** | Graph-based persistent memory for coding agents | +| **shrike** | Tokenizer, compression, secrets scanning, rate limiting | +| **kestrel** | Diff-based code review and static analysis | +| **merlin** | Security audit library (CVE, API security, CI output) | +| **swift** | Session capture and replay CLI | | **hawk** | AI coding agent (this repo) | -Engines that serve MCP (`sight`, `inspect`) import `falcon`; it never +Engines that serve MCP (`kestrel`, `merlin`) import `falcon`; it never imports them back. ## Ecosystem Boundaries @@ -167,14 +167,14 @@ imports them back. Rules that keep this repo at the foundation layer: - **Zero hawk-eco dependencies.** This repo must never import `hawk`, any - engine (`eyrie`, `yaad`, `tok`, `trace`, `sight`, `inspect`), any SDK, or + engine (`eyrie`, `harrier`, `shrike`, `swift`, `kestrel`, `merlin`), any SDK, or `eagle`. Its only non-stdlib dependency is upstream `mark3labs/mcp-go`. `make boundaries` (also run in CI) enforces this with `scripts/check-ecosystem-boundaries.sh`. - **Implementation-free of product logic.** This repo holds MCP server scaffolding only — no hawk orchestration, no engine-specific behavior, no provider logic. -- **Consumers, not dependents.** Engines that serve MCP (`sight`, `inspect`) +- **Consumers, not dependents.** Engines that serve MCP (`kestrel`, `merlin`) import `falcon`; it never imports them back. If you need a hawk-ecosystem type here, that's a sign it belongs in the diff --git a/docs/design/tool-catalog-notes.md b/docs/design/tool-catalog-notes.md index 13c742f..e96f4a2 100644 --- a/docs/design/tool-catalog-notes.md +++ b/docs/design/tool-catalog-notes.md @@ -61,7 +61,7 @@ Key decisions, mapped onto existing code: Per the ecosystem architecture note, provider/protocol work lands in the shared library first and hawk consumes it. Every mcpkit consumer -(`inspect`, `sight`) gets governed external tools for free; hawk adds only +(`merlin`, `kestrel`) gets governed external tools for free; hawk adds only host UX (approval prompts, policy editing). ## Adoption path diff --git a/mcpkit.go b/mcpkit.go index cfa8d15..6445ad0 100644 --- a/mcpkit.go +++ b/mcpkit.go @@ -1,5 +1,5 @@ // Package mcpkit provides the shared scaffolding used by hawk-ecosystem -// libraries (inspect, sight, ...) to expose their functionality as MCP +// libraries (merlin, kestrel, ...) to expose their functionality as MCP // servers. It wraps github.com/mark3labs/mcp-go with the ecosystem's // standard construction, transports, and small handler helpers so that // individual repos only declare their tools and handlers. @@ -40,7 +40,7 @@ type Server struct { // convention (tool + prompt + read-only, no resource-list-changed // updates). Pass extra mcpserver.ServerOptions to override — they are // applied after the defaults, so a later option wins over an earlier one. -// This lets repos like yaad (which expose a resource *list* rather than a +// This lets repos like harrier (which expose a resource *list* rather than a // set of subscribable resources) tailor behavior without forks. func New(name, version string, opts ...mcpserver.ServerOption) *Server { base := []mcpserver.ServerOption{