Phase 30: Enterprise readiness & compliance — all 12 exit gates complete#23
Merged
Conversation
Tasks completed: - 🔧 Expand .dockerignore — Add git/, docs/, tests/, benchmarks/, tools/, decisions/, *.md - ⚡ Enable bun caching in CI — Remove no-cache: false from setup-bun steps Note: Tasks 5-7 were already completed in first sprint: - ✅ repo-health.yml already uses bun commands + checkout@v7 - ✅ All workflows already use actions/checkout@v7 - ✅ eval package already in scripts/build-all.sh Level 1 Second sprint: 2/2 new tasks completed First sprint: 6/6 tasks completed (CODEOWNERS, dependabot, CHANGELOG, lint-staged script fix, Dockerfile optimization, test count updates) Closes: Audit MEDIUM priority findings #5-9
…to tests/unit/eval/
- Air-gapped mode (AGENT_WORKBENCH_AIRGAPPED=true): blocks external network calls, allows only loopback services - SBOM generation: 'bun run sbom' outputs CycloneDX v1.5, 'bun run sbom:audit' includes dependency vulnerability scanning - Compliance docs: security whitepaper, SOC 2 readiness checklist, GDPR addendum, on-prem deployment guide (docs/compliance/) - Air-gapped fetch wrapper composed into ProviderRegistry via createAirGappedFetch() in @agent-workbench/compliance Docs restructuring: - README.md rewritten for end-users (features, config, deployment scenarios, safety model, enterprise docs) - CONTRIBUTING.md cleaned up for contributors - AGENTS.md moved to docs/dev/ (AI agent build rules) - 22 implementation/docs phase plans + 17 ADRs archived to docs/dev/ - CHANGELOG.md updated with Phase 30 entries - All package/app READMEs audited and stale badges updated
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…n setup to repo-health workflow
…le-web/dashboard errors
- Replace any type with MockRepo interface in eval metrics test (Biome noExplicitAny) - Conditionally pass fetchImpl only when air-gapped (TS exactOptionalPropertyTypes) - Use rejection sampling for unbiased CSPRNG string generation (CodeQL modulo bias)
| // so only bytes in [0, 247] are fair. Reject bytes >= 248. | ||
| while (result.length < length) { | ||
| if (bytes[i]! < 248) { | ||
| result += chars[bytes[i]! % chars.length]; |
- Replace any type with MockRepo interface in eval metrics test (Biome noExplicitAny) - Conditionally pass fetchImpl only when air-gapped (TS exactOptionalPropertyTypes) - Rejection sampling for unbiased CSPRNG string generation (CodeQL modulo bias) - biome.json: ignoreUnknown=true for CI compatibility - biome-ignore comments for intentional any/Function use in eval integrations - Rename escape -> isEscaped in opencode-config (noShadowRestrictedNames) - Properly typed mock repos in export+planner tests - Sync readFileSync in benchmark-runner (no as any cast to Bun.file) - as Record<string, unknown> in protocol openapi
…exactOptionalPropertyTypes)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Completes Phase 30 (enterprise readiness & compliance) across 3 remaining slices.
Air-Gapped Mode
AGENT_WORKBENCH_AIRGAPPED=trueblocks all external network callscreateAirGappedFetch()wrapper composes into ProviderRegistryCompliance Documentation
SBOM Generation
bun run sbom— CycloneDX v1.5 software bill of materialsbun run sbom:audit— includes dependency vulnerability scanningDocs Restructuring
README.mdrewritten for end-users (features, config, deployment, safety)CONTRIBUTING.mdcleaned up for contributorsAGENTS.md→docs/dev/AGENTS.mddocs/dev/CHANGELOG.mdupdated with Phase 30 entriesCloses Phase 30.