CONTRIBUTING.md said nothing about contributions written by or with an
AI agent, and the project now receives both kinds: PRs from accounts
that openly identify as an agent acting for a person (#2225 is one, and
a good one), and, in September, an account that posted approvals and
change requests styled as maintainer decisions across nineteen threads.
The first deserves a clear welcome; the second needs a rule that was
until now only enforced, never written down.
The new section says: disclosed AI authorship is welcome and never held
against a change; the DCO sign-off is a legal certification only a
person can make, so a human is accountable for every commit; the
evidence bar is the same for everyone -- a claim is something a reviewer
can check. Co-authored-by trailers naming a tool are fine, links to
private agent sessions are not. High-volume low-effort submissions are
closed whoever produced them.
A second subsection states who speaks for the project -- the maintainer
account only -- and that impersonating a maintainer, by a person or an
agent, gets the reviews dismissed, the comments hidden, a public
correction in the affected threads, and the account reported and
blocked. That is what was done in September; it is now written where a
contributor can read it first.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The TOOLS[] registry in src/mcp/mcp.c and the v0.11.0 --help output
list 17 tools, but README, the npm README, CONTRIBUTING and the Pages
site still say 15 (or 14), and the README tool table has no row for
get_file_outline, compare_graphs or check_index_coverage.
Refs #1297
Assisted-by: Claude Code / claude-opus-5
Machine: MacBook-Anton
Account: a@gmail
Operator: robot:git-s3-docs-fix-lane
Signed-off-by: Anton Dziatkovskii <194927794+tonydzi@users.noreply.github.com>
Adds the Contributor Covenant 2.1 code of conduct (canonical text,
byte-verified against upstream) and reproduction-first issue forms that
ask for shareable reproductions — dummy snippets or public OSS repos —
plus logs and exact commands, never proprietary code. CONTRIBUTING.md
now states explicitly that a Signed-off-by line certifies the DCO in
full for that contribution, with GitHub ToS inbound=outbound noted as
the independent backstop. The VirusTotal badge now points at the latest
release instead of a pinned historical scan.
Signed-off-by: Martin Vogel <martin.vogel@datadice.io>
Every commit must now carry a Signed-off-by trailer matching its
author, certifying the right to submit the change under the project's
MIT license (DCO 1.1, the Linux kernel mechanism). Enforcement is
strict at three layers: a commit-msg hook rejects unsigned commits
locally (scripts/install-git-hooks.sh), and the new DCO workflow
rejects every push and pull request containing one. Merge commits and
bot authors are exempt, matching standard DCO checks.
Signed-off-by: Martin Vogel <martin.vogel@datadice.io>
The web server behind the graph UI is now a purpose-built in-house
module (src/ui/httpd.c): localhost-only listener, strict HTTP/1.1
parsing with fixed request caps, a per-connection receive deadline,
and Connection: close semantics. http_server.c keeps the routing and
handlers, rewritten against the new transport API; the public server
API and main.c are unchanged. The previously vendored third-party
server is removed entirely.
Comes with a new 28-test transport + routing suite (tests/test_httpd.c)
covering parsing edge cases (strict CRLF, Content-Length limits, raw
path matching, percent-decode rules) and live-socket behavior (CORS
policy, RPC dispatch, receive deadline, clean shutdown). The security
audit scripts now check the new file layout and treat any network call
in vendored code as a failure.
- Commit format table: feat, fix, test, refactor, perf, docs, chore
(adapted from @halindrome's PR #85)
- One issue per PR: no bundling multiple fixes/features
- Open an issue first: every PR must reference a tracking issue
Based on feedback from @halindrome (#84, #85) who identified the need
for structured PR guidelines and commit conventions.
- CONTRIBUTING.md: fix CBMLanguage enum file reference from
non-existent cbm_language.h to internal/cbm/cbm.h
- CONTRIBUTING.md: rephrase "do not use tree-sitter grammars" to
"do not require a new tree-sitter grammar", clarifying they reuse
the existing YAML grammar
- pass_k8s.c: correct header comment from "per top-level resource
document" to "first document only — multi-document YAML is not
yet supported"
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix formatting in mcp.c protocol version negotiation (from PR #79 merge)
- Rewrite CONTRIBUTING.md for pure C project (was still describing Go,
causing contributors to submit Go PRs that can't be merged)
- Add field('path', ...) to Magma load_statement grammar rule so
parse_generic_imports() finds the import path via field lookup
instead of the broken text fallback (which only extracted 1 per file)
- Fix passImports() to resolve file-path imports (e.g. "utils.mag",
"lib/helpers.h") via fqn.ModuleQN() when raw path doesn't match
any node QN — general fix benefiting any file-path-based import
- Add TestMagmaImport_Regression and TestMagmaCall_Regression
- Update language count 59 → 63 in README, docs/index.html, marketing
Martin Vogel