diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e4373df..34b086c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,8 +13,8 @@ jobs: verify: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - - uses: actions/setup-node@v6 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 24.x cache: npm diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml new file mode 100644 index 0000000..01a9e0e --- /dev/null +++ b/.github/workflows/pages.yml @@ -0,0 +1,34 @@ +name: Deploy Pages + +on: + push: + branches: + - main + paths: + - 'site/**' + - '.github/workflows/pages.yml' + workflow_dispatch: + +permissions: + contents: read + pages: write + id-token: write + +concurrency: + group: pages + cancel-in-progress: false + +jobs: + deploy: + environment: + name: github-pages + url: ${{ steps.deployment.outputs.page_url }} + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 + - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 + with: + path: site + - id: deployment + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d066756..5219796 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -14,8 +14,8 @@ jobs: publish: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - - uses: actions/setup-node@v6 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 24.x registry-url: https://registry.npmjs.org diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..9f45224 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,33 @@ +name: OpenSSF Scorecard + +on: + branch_protection_rule: + push: + branches: + - main + pull_request: + schedule: + - cron: '18 4 * * 1' + workflow_dispatch: + +permissions: + contents: read + +jobs: + scorecard: + name: Scorecard + runs-on: ubuntu-latest + timeout-minutes: 20 + permissions: + contents: read + id-token: write + steps: + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + with: + persist-credentials: false + - name: OSSF Scorecard action + uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + with: + results_file: results.json + results_format: json + publish_results: ${{ github.event_name != 'pull_request' }} diff --git a/README.md b/README.md index 73cf5c7..9a01764 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,14 @@ **Your agents write code. Truthmark maintains human-facing, Git-reviewable documentation.** +[![npm version](https://img.shields.io/npm/v/truthmark?color=cb3837&label=npm)](https://www.npmjs.com/package/truthmark) +[![CI](https://github.com/merlinhu1/truthmark/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/merlinhu1/truthmark/actions/workflows/ci.yml) +[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/merlinhu1/truthmark/badge)](https://scorecard.dev/viewer/?uri=github.com/merlinhu1/truthmark) +[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE) +[![Node.js >=24](https://img.shields.io/badge/node-%3E%3D24-339933?logo=node.js&logoColor=white)](package.json) + +[Website](https://merlinhu1.github.io/truthmark/) | [GitHub](https://github.com/merlinhu1/truthmark) | [User Guide](docs/user-guide.md) + [🇺🇸 English](README.md) | [🇨🇳 简体中文](docs/readmes/README.zh.md) | [🇯🇵 日本語](docs/readmes/README.ja.md) | [🇰🇷 한국어](docs/readmes/README.ko.md) | [🇩🇪 Deutsch](docs/readmes/README.de.md) | [🇫🇷 Français](docs/readmes/README.fr.md) | [🇪🇸 Español](docs/readmes/README.es.md) | [🇧🇷 Português](docs/readmes/README.pt.md) | [🇷🇺 Русский](docs/readmes/README.ru.md) | [🇸🇦 العربية](docs/readmes/README.ar.md) | [🇮🇹 Italiano](docs/readmes/README.it.md) | [🇵🇱 Polski](docs/readmes/README.pl.md) | [🇹🇷 Türkçe](docs/readmes/README.tr.md) | [🇻🇳 Tiếng Việt](docs/readmes/README.vi.md) | [🇮🇩 Bahasa Indonesia](docs/readmes/README.id.md) | [🇬🇷 Ελληνικά](docs/readmes/README.el.md) ![Truthmark banner](docs/assets/truthmark-banner.png) @@ -199,6 +207,8 @@ keep the result reviewable in Git The README is the storefront: fast context, quick start, and the core mental model. +The [static website](https://merlinhu1.github.io/truthmark/) is the concise public introduction for GitHub Pages. + For command-by-command usage, surface comparisons, supported platform details, configuration, routing, Portal, and examples, read the [Truthmark User Guide](docs/user-guide.md). ## Project status diff --git a/changes/2026-06-26-static-intro-site.md b/changes/2026-06-26-static-intro-site.md new file mode 100644 index 0000000..f6fc3f8 --- /dev/null +++ b/changes/2026-06-26-static-intro-site.md @@ -0,0 +1,26 @@ +# Static Introduction Website + +Version action: none + +## PR Summary + +- Add a static introduction website under `site/` for GitHub Pages with original CSS-only visual design rather than copied README poster artwork. +- Add a richer tabbed truth-doc storyboard that shows a new invariant, product-promise pressure, ownership splitting, and the final reviewer packet. +- Add product-positioning sections for checkout-native operation, claim-level review, explicit route ownership, topology repair, repository-file authority, host-shaped agent guidance, and Git-reviewable handoff. +- Remove copied poster assets from the site branch; the public page no longer depends on README banner images. +- Add a Pages deployment workflow that publishes `site/**` after relevant pushes to `main` or manual dispatch. +- Link the site from the root README and document that the site is presentation, not canonical repository truth. + +## Release Note + +- Truthmark now has a static GitHub Pages introduction site for public onboarding, with original visual design, a truth-doc curation storyboard, and broader repository-truth positioning. + +## Verification + +- Served `site/` locally with `python3 -m http.server`, captured Playwright screenshots, and validated the rendered HTML response with `curl` plus Python checks. +- `/opt/data/bin/npm run test -- tests/package-files.test.ts tests/product-boundary.test.ts tests/truth/docs.test.ts` passed: 6 tests. +- `/opt/data/bin/npm run check` passed: lint, typecheck, 337 tests, and build. +- `/opt/data/bin/npm run package:check` passed: 4 tests. +- `/opt/data/bin/npx tsx src/cli/main.ts check --json` passed with no diagnostics. +- `/opt/data/bin/npx tsx src/cli/main.ts index --json` passed with no diagnostics. +- `git diff --check` passed. diff --git a/docs/architecture/product-boundary.md b/docs/architecture/product-boundary.md index 0f74e88..15648e9 100644 --- a/docs/architecture/product-boundary.md +++ b/docs/architecture/product-boundary.md @@ -60,6 +60,7 @@ Truthmark owns: - host-native agent workflow surfaces such as skills, prompts, commands, managed instruction blocks, and subagents - branch-local documentation checks, workflow indexes, impact summaries, context packs, and workflow state derived from the active checkout - write boundaries for read-only, documentation-write, route-write, code-write, and presentation-write workflows +- the static GitHub Pages introduction site as marketing/onboarding presentation, not repository truth - optional CLI/package helpers that improve validation or setup without becoming required for normal agent workflow execution Truthmark workflows must remain operational from repository files alone. A design that blocks the agent workflow because a package, CLI, daemon, server, IDE plugin, or external service is missing is outside the product boundary. @@ -91,6 +92,7 @@ Optional integrations are acceptable only when they preserve host-native agent w 7. **Local-first simplicity wins.** Add dependencies, services, or runtime layers only when they preserve the no-blockade repository-file workflow. 8. **Truth docs stay human-friendly.** Truth docs must be structured and written for maintainers to review, scan, and understand before they are optimized for agent or machine consumption. 9. **Curation beats generation.** Truthmark should route overgrown or mixed-owner docs toward Structure instead of rewarding more appended prose. +10. **Presentation is not authority.** The static introduction website may present the product, but canonical behavior remains in README, routed truth docs, source, tests, and config. ## Required Product Boundary Check @@ -114,6 +116,7 @@ A plan that cannot answer these questions is not ready for implementation. - Decision (2026-06-12): Human-facing readability is part of the Truthmark product boundary for canonical truth documents. - Decision (2026-06-26): Ongoing truth-doc curation is a primary product value. - Marketing should emphasize bounded ownership, evidence-backed updates, Git-reviewable docs, and Structure handoff for overgrown docs instead of generic documentation generation. +- Decision (2026-06-26): The GitHub Pages site is a static marketing/onboarding surface, not a documentation hosting platform or source of repository truth. ## Maintenance Notes diff --git a/docs/truthmark/engineering/operations/release-automation.md b/docs/truthmark/engineering/operations/release-automation.md index b76ed7a..130f541 100644 --- a/docs/truthmark/engineering/operations/release-automation.md +++ b/docs/truthmark/engineering/operations/release-automation.md @@ -1,7 +1,7 @@ --- status: active truth_kind: engineering-operations -last_reviewed: 2026-06-20 +last_reviewed: 2026-06-26 --- # Release Automation @@ -16,13 +16,26 @@ It covers GitHub workflow triggers, verification steps, and generated GitHub Act ## Current Implementation Behavior -Release and CI behavior is implemented through checked-in GitHub workflow files and the GitHub Action template renderer. +Release, CI, GitHub Pages deployment, and repository-readiness automation are implemented through checked-in GitHub workflow files and GitHub repository settings. The npm publish workflow runs from `release/**` tag push events, with manual `workflow_dispatch` as an operator fallback. Tag-triggered publishing keeps the GitHub Actions OIDC signing certificate tied to a concrete `refs/tags/...` source ref for npm provenance verification. +The GitHub Pages workflow deploys the committed static introduction site from `site/**` after pushes to `main` that change the site or Pages workflow. + +CodeQL is handled by GitHub's default setup for this repository. + +Checked-in advanced CodeQL workflow configuration is intentionally absent while default setup is enabled. + +OpenSSF Scorecard runs as a repository-readiness check on mainline, pull request, scheduled, manual, and branch-protection-rule events. + +The Scorecard workflow does not upload SARIF and does not request `security-events: write`; it publishes Scorecard results through OIDC on non-pull-request events. + +Dependency-update monitoring is managed by existing GitHub repository configuration outside this PR's checked-in workflow changes. + ## Operational Surface - GitHub Actions workflows under `.github/workflows/**` +- static introduction site files under `site/**` - GitHub Action template rendering in `src/templates/github-action.ts` ## Runtime Topology @@ -31,7 +44,9 @@ Automation runs in GitHub Actions. There is no Truthmark daemon or persistent ru ## Configuration -- GitHub workflow YAML files define CI and release triggers. +- GitHub workflow YAML files define CI, release, Pages deployment, and Scorecard triggers. +- Checked-in workflow actions are pinned to full commit SHAs, with inline comments preserving the upstream action version tag used to choose each SHA. +- GitHub repository settings own CodeQL default setup and existing dependency-update monitoring. - `src/templates/github-action.ts` owns generated GitHub Action template behavior. ## Permissions @@ -40,9 +55,12 @@ Permissions are owned by the checked-in GitHub workflow and action template defi This doc does not add permissions beyond those source files. +The Scorecard workflow keeps workflow-level token permissions read-only and grants `id-token: write` only to the Scorecard job. + ## Deployment And Rollback - Workflow changes deploy when repository workflow files are committed to the target branch. +- Static introduction site changes deploy through GitHub Pages after they merge to `main`. - Rollback is a normal Git revert or follow-up workflow-file change. ## Availability And Observability @@ -57,6 +75,12 @@ This doc does not add permissions beyond those source files. ## Engineering Decisions - Decision (2026-06-14): Release automation truth is engineering/operational truth because it describes current repository mechanics. +- Decision (2026-06-26): GitHub Pages deploys only the committed static introduction site under `site/**`. + - The site is a presentation artifact; Markdown truth docs remain canonical. +- Decision (2026-06-26): Project-readiness checks use standard GitHub-native scanners before custom readiness badges or claims. + - CodeQL default setup covers code scanning without a checked-in advanced workflow. + - OpenSSF Scorecard covers external repository-health/security heuristics. + - Existing GitHub repository configuration covers dependency-update monitoring. ## Rationale @@ -69,11 +93,15 @@ Release automation is documented as operations truth because failures, permissio ## Maintenance Notes -Update when CI triggers, release prerequisites, publish steps, or action templates change. +Update when CI triggers, release prerequisites, publish steps, Pages deployment steps, checked-in readiness scans, or action templates change. ## Source References - ../../../../.github/workflows/ci.yml +- ../../../../.github/workflows/pages.yml - ../../../../src/templates/github-action.ts +- ../../../../.github/workflows/scorecard.yml +- ../../../../site/index.html - `.github/workflows/**` +- `site/**` - `src/templates/github-action.ts` diff --git a/docs/truthmark/routes/areas.md b/docs/truthmark/routes/areas.md index 2b62e34..fa185a8 100644 --- a/docs/truthmark/routes/areas.md +++ b/docs/truthmark/routes/areas.md @@ -105,12 +105,15 @@ Area files: Code surface: - .github/workflows/\*\* +- site/\*\* - src/templates/github-action.ts Update truth when: - CI verification steps or triggers change - release publishing prerequisites or publish steps change +- checked-in repository-readiness scans change +- GitHub Pages deployment or static introduction site behavior changes ## Repository Intelligence diff --git a/docs/truthmark/routes/areas/release-automation.md b/docs/truthmark/routes/areas/release-automation.md index 4e68939..a5731fd 100644 --- a/docs/truthmark/routes/areas/release-automation.md +++ b/docs/truthmark/routes/areas/release-automation.md @@ -20,12 +20,15 @@ truth_documents: Code surface: - .github/workflows/\*\* +- site/\*\* - src/templates/github-action.ts Update truth when: - CI verification steps or triggers change - release publishing prerequisites or publish steps change +- CodeQL, Scorecard, or other checked-in repository-readiness automation changes +- GitHub Pages deployment or static introduction site behavior changes - GitHub Action examples or action template rendering changes ## Source References diff --git a/site/.nojekyll b/site/.nojekyll new file mode 100644 index 0000000..e69de29 diff --git a/site/index.html b/site/index.html new file mode 100644 index 0000000..e1f1134 --- /dev/null +++ b/site/index.html @@ -0,0 +1,862 @@ + + + + + + Truthmark — the branch explains itself + + + + + + + + + + +
+
+
+
Repository truth carried by the branch
+

The branch should explain itself.

+

Truthmark gives AI-assisted work a reviewable truth layer: current claims, ownership routes, product promises, and implementation facts travel with the same Git branch as the code.

+ +
+
Checkout-nativeAfter setup, normal agent work can proceed from committed repository files.
+
Claim-level reviewDocs change as small, source-backed claims instead of anonymous summaries.
+
Topology awareWhen truth gets too broad, ownership gets repaired rather than hidden.
+
Host-shapedInstructions meet agents in their existing coding environments.
+
+
+ + +
+ +
+
+

More than a docs generator.

+

Truthmark is best understood as a repository-truth workflow surface. The value is not one feature; it is how several constraints reinforce each other.

+
+
+
Operation

No resident service in the critical path

Helpers can validate and refresh, but the daily closeout path is designed to remain readable from the checkout.

+
Continuity

Truth is maintained after the first draft

Code changes keep revisiting the mapped docs, so documentation becomes a living review artifact rather than a launch-week export.

+
Architecture

Routes make ownership explicit

Files, areas, and truth docs are connected by committed routing metadata instead of implicit tribal knowledge.

+
Governance

Product truth and mechanics do not collapse together

User-facing promises can link to implementation reality without becoming the same document.

+
Review

Claims are small enough for Git

The desired unit is a durable claim per line or bullet, making truth updates easy to inspect in pull requests.

+
Portability

Agent guidance follows the repo

Generated skills, prompts, commands, and instruction blocks are committed where the agent can read them.

+
Repair

Overgrown docs trigger structure work

When a file starts mixing owners, Truth Structure is the product answer, not a larger paragraph.

+
Boundary

Repository files outrank session memory

Current truth lives where maintainers can diff, revert, blame, and review it.

+
+
+ +
+
+

A truth document over time.

+

This demo is fictional, but the workflow is concrete: create the right doc, update it when behavior changes, and split it when ownership gets crowded.

+
+
+
+ + + + +
+ +
+
Truth Document creates a narrow engineering owner.created
+
+
Evidence read
src/webhooks/retry-policy.ts
tests/webhooks/retry-policy.test.ts
config/webhook-delivery.yml
+
Created doc

Webhook delivery behavior

Current behavior

  • Failed deliveries are retried three times.
  • Backoff starts at 30 seconds and doubles per attempt.
  • Manual replay remains available after automatic retries stop.

Non-goals

  • The service does not claim exactly-once delivery.
+
+
+ +
+
Truth Sync separates a user promise from runtime mechanics.curated
+
+
Branch changes
README.md adds operator reliability copy
src/webhooks/replay-audit.ts
tests/webhooks/replay-audit.test.ts
+
Two updated surfaces

Product promise vs implementation fact

Product truth

  • Operators can inspect failed delivery history before replay.
  • The product presents replay as an operator recovery tool, not an automatic guarantee.

Engineering truth

  • Replay writes an audit row with actor, delivery id, and timestamp.
  • The retry limit remains unchanged.
+
+
+ +
+
Truth Structure changes the shape before prose gets heavier.split
+
+
Topology pressure
delivery retries + manual replay + alert thresholds + export audit
one doc now has four owners
future edits would be ambiguous
+
New ownership map

Owned docs after split

  • engineering/webhook-delivery.md owns retry and delivery lifecycle.
  • engineering/webhook-replay.md owns operator replay behavior.
  • engineering/webhook-audit.md owns audit rows and export format.
  • product/webhook-reliability.md owns customer-facing recovery promises.
+
+
+ +
+
The reviewer sees a small packet, not a mystery transcript.review
+
+
Pull request surface
code diff: retry + replay behavior
test diff: replay audit coverage
truth diff: product + engineering docs
route diff: ownership split
+
Reviewer questions

What the PR now answers

  • Which user promise changed?
  • Which implementation behavior supports it?
  • Which files own future updates?
  • Which claims should be rejected if the code changes again?
+
+
+
+
+ +
+

Two lanes, linked on purpose.

Truthmark can let product and engineering documents reference each other without forcing them into the same voice or authority level.

+
+
Promise lane

What the project says users can rely on

This lane is for product capabilities, boundaries, acceptance criteria, and non-goals.

  • Operators can inspect replay history.
  • The workflow is repository-native by default.
  • Generated presentation pages are not canonical truth.
+
Mechanics lane

What the current implementation actually does

This lane is for runtime behavior, contracts, operations, architecture, and failure modes.

  • Backoff doubles after each failed delivery attempt.
  • GitHub Pages deploys the committed static site under site/**.
  • Generated surfaces refresh when rendered content changes.
+
+
+ +
+

The workflow is deliberately boring at runtime.

Truthmark's ambition is in the repository model, not in requiring every contributor to adopt a new always-on system.

+
+
+
1. SetupConfigure routes and install agent-facing surfaces.
+
+
2. WorkAgent changes code in its normal host.
+
+
3. CloseoutMapped truth docs are checked, edited, split, or left unchanged with evidence.
+
+
+
+ +
+

Start with the repo, not a server.

Install once, commit the workflow surface, and let future branches carry their truth updates through normal review.

+
$ cd /path/to/your-repo
+$ npm install -g truthmark
+$ truthmark config
+$ truthmark init
+$ truthmark check
+
+# After setup, agent guidance and truth routes live in the checkout.
+
+
+ + + + + +