No resident service in the critical path
Helpers can validate and refresh, but the daily closeout path is designed to remain readable from the checkout.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e4373df..34b086c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,8 +13,8 @@ jobs: verify: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - - uses: actions/setup-node@v6 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 24.x cache: npm diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml new file mode 100644 index 0000000..01a9e0e --- /dev/null +++ b/.github/workflows/pages.yml @@ -0,0 +1,34 @@ +name: Deploy Pages + +on: + push: + branches: + - main + paths: + - 'site/**' + - '.github/workflows/pages.yml' + workflow_dispatch: + +permissions: + contents: read + pages: write + id-token: write + +concurrency: + group: pages + cancel-in-progress: false + +jobs: + deploy: + environment: + name: github-pages + url: ${{ steps.deployment.outputs.page_url }} + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 + - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 + with: + path: site + - id: deployment + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d066756..5219796 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -14,8 +14,8 @@ jobs: publish: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - - uses: actions/setup-node@v6 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 24.x registry-url: https://registry.npmjs.org diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..9f45224 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,33 @@ +name: OpenSSF Scorecard + +on: + branch_protection_rule: + push: + branches: + - main + pull_request: + schedule: + - cron: '18 4 * * 1' + workflow_dispatch: + +permissions: + contents: read + +jobs: + scorecard: + name: Scorecard + runs-on: ubuntu-latest + timeout-minutes: 20 + permissions: + contents: read + id-token: write + steps: + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + with: + persist-credentials: false + - name: OSSF Scorecard action + uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + with: + results_file: results.json + results_format: json + publish_results: ${{ github.event_name != 'pull_request' }} diff --git a/README.md b/README.md index 73cf5c7..9a01764 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,14 @@ **Your agents write code. Truthmark maintains human-facing, Git-reviewable documentation.** +[](https://www.npmjs.com/package/truthmark) +[](https://github.com/merlinhu1/truthmark/actions/workflows/ci.yml) +[](https://scorecard.dev/viewer/?uri=github.com/merlinhu1/truthmark) +[](LICENSE) +[](package.json) + +[Website](https://merlinhu1.github.io/truthmark/) | [GitHub](https://github.com/merlinhu1/truthmark) | [User Guide](docs/user-guide.md) + [🇺🇸 English](README.md) | [🇨🇳 简体中文](docs/readmes/README.zh.md) | [🇯🇵 日本語](docs/readmes/README.ja.md) | [🇰🇷 한국어](docs/readmes/README.ko.md) | [🇩🇪 Deutsch](docs/readmes/README.de.md) | [🇫🇷 Français](docs/readmes/README.fr.md) | [🇪🇸 Español](docs/readmes/README.es.md) | [🇧🇷 Português](docs/readmes/README.pt.md) | [🇷🇺 Русский](docs/readmes/README.ru.md) | [🇸🇦 العربية](docs/readmes/README.ar.md) | [🇮🇹 Italiano](docs/readmes/README.it.md) | [🇵🇱 Polski](docs/readmes/README.pl.md) | [🇹🇷 Türkçe](docs/readmes/README.tr.md) | [🇻🇳 Tiếng Việt](docs/readmes/README.vi.md) | [🇮🇩 Bahasa Indonesia](docs/readmes/README.id.md) | [🇬🇷 Ελληνικά](docs/readmes/README.el.md)  @@ -199,6 +207,8 @@ keep the result reviewable in Git The README is the storefront: fast context, quick start, and the core mental model. +The [static website](https://merlinhu1.github.io/truthmark/) is the concise public introduction for GitHub Pages. + For command-by-command usage, surface comparisons, supported platform details, configuration, routing, Portal, and examples, read the [Truthmark User Guide](docs/user-guide.md). ## Project status diff --git a/changes/2026-06-26-static-intro-site.md b/changes/2026-06-26-static-intro-site.md new file mode 100644 index 0000000..f6fc3f8 --- /dev/null +++ b/changes/2026-06-26-static-intro-site.md @@ -0,0 +1,26 @@ +# Static Introduction Website + +Version action: none + +## PR Summary + +- Add a static introduction website under `site/` for GitHub Pages with original CSS-only visual design rather than copied README poster artwork. +- Add a richer tabbed truth-doc storyboard that shows a new invariant, product-promise pressure, ownership splitting, and the final reviewer packet. +- Add product-positioning sections for checkout-native operation, claim-level review, explicit route ownership, topology repair, repository-file authority, host-shaped agent guidance, and Git-reviewable handoff. +- Remove copied poster assets from the site branch; the public page no longer depends on README banner images. +- Add a Pages deployment workflow that publishes `site/**` after relevant pushes to `main` or manual dispatch. +- Link the site from the root README and document that the site is presentation, not canonical repository truth. + +## Release Note + +- Truthmark now has a static GitHub Pages introduction site for public onboarding, with original visual design, a truth-doc curation storyboard, and broader repository-truth positioning. + +## Verification + +- Served `site/` locally with `python3 -m http.server`, captured Playwright screenshots, and validated the rendered HTML response with `curl` plus Python checks. +- `/opt/data/bin/npm run test -- tests/package-files.test.ts tests/product-boundary.test.ts tests/truth/docs.test.ts` passed: 6 tests. +- `/opt/data/bin/npm run check` passed: lint, typecheck, 337 tests, and build. +- `/opt/data/bin/npm run package:check` passed: 4 tests. +- `/opt/data/bin/npx tsx src/cli/main.ts check --json` passed with no diagnostics. +- `/opt/data/bin/npx tsx src/cli/main.ts index --json` passed with no diagnostics. +- `git diff --check` passed. diff --git a/docs/architecture/product-boundary.md b/docs/architecture/product-boundary.md index 0f74e88..15648e9 100644 --- a/docs/architecture/product-boundary.md +++ b/docs/architecture/product-boundary.md @@ -60,6 +60,7 @@ Truthmark owns: - host-native agent workflow surfaces such as skills, prompts, commands, managed instruction blocks, and subagents - branch-local documentation checks, workflow indexes, impact summaries, context packs, and workflow state derived from the active checkout - write boundaries for read-only, documentation-write, route-write, code-write, and presentation-write workflows +- the static GitHub Pages introduction site as marketing/onboarding presentation, not repository truth - optional CLI/package helpers that improve validation or setup without becoming required for normal agent workflow execution Truthmark workflows must remain operational from repository files alone. A design that blocks the agent workflow because a package, CLI, daemon, server, IDE plugin, or external service is missing is outside the product boundary. @@ -91,6 +92,7 @@ Optional integrations are acceptable only when they preserve host-native agent w 7. **Local-first simplicity wins.** Add dependencies, services, or runtime layers only when they preserve the no-blockade repository-file workflow. 8. **Truth docs stay human-friendly.** Truth docs must be structured and written for maintainers to review, scan, and understand before they are optimized for agent or machine consumption. 9. **Curation beats generation.** Truthmark should route overgrown or mixed-owner docs toward Structure instead of rewarding more appended prose. +10. **Presentation is not authority.** The static introduction website may present the product, but canonical behavior remains in README, routed truth docs, source, tests, and config. ## Required Product Boundary Check @@ -114,6 +116,7 @@ A plan that cannot answer these questions is not ready for implementation. - Decision (2026-06-12): Human-facing readability is part of the Truthmark product boundary for canonical truth documents. - Decision (2026-06-26): Ongoing truth-doc curation is a primary product value. - Marketing should emphasize bounded ownership, evidence-backed updates, Git-reviewable docs, and Structure handoff for overgrown docs instead of generic documentation generation. +- Decision (2026-06-26): The GitHub Pages site is a static marketing/onboarding surface, not a documentation hosting platform or source of repository truth. ## Maintenance Notes diff --git a/docs/truthmark/engineering/operations/release-automation.md b/docs/truthmark/engineering/operations/release-automation.md index b76ed7a..130f541 100644 --- a/docs/truthmark/engineering/operations/release-automation.md +++ b/docs/truthmark/engineering/operations/release-automation.md @@ -1,7 +1,7 @@ --- status: active truth_kind: engineering-operations -last_reviewed: 2026-06-20 +last_reviewed: 2026-06-26 --- # Release Automation @@ -16,13 +16,26 @@ It covers GitHub workflow triggers, verification steps, and generated GitHub Act ## Current Implementation Behavior -Release and CI behavior is implemented through checked-in GitHub workflow files and the GitHub Action template renderer. +Release, CI, GitHub Pages deployment, and repository-readiness automation are implemented through checked-in GitHub workflow files and GitHub repository settings. The npm publish workflow runs from `release/**` tag push events, with manual `workflow_dispatch` as an operator fallback. Tag-triggered publishing keeps the GitHub Actions OIDC signing certificate tied to a concrete `refs/tags/...` source ref for npm provenance verification. +The GitHub Pages workflow deploys the committed static introduction site from `site/**` after pushes to `main` that change the site or Pages workflow. + +CodeQL is handled by GitHub's default setup for this repository. + +Checked-in advanced CodeQL workflow configuration is intentionally absent while default setup is enabled. + +OpenSSF Scorecard runs as a repository-readiness check on mainline, pull request, scheduled, manual, and branch-protection-rule events. + +The Scorecard workflow does not upload SARIF and does not request `security-events: write`; it publishes Scorecard results through OIDC on non-pull-request events. + +Dependency-update monitoring is managed by existing GitHub repository configuration outside this PR's checked-in workflow changes. + ## Operational Surface - GitHub Actions workflows under `.github/workflows/**` +- static introduction site files under `site/**` - GitHub Action template rendering in `src/templates/github-action.ts` ## Runtime Topology @@ -31,7 +44,9 @@ Automation runs in GitHub Actions. There is no Truthmark daemon or persistent ru ## Configuration -- GitHub workflow YAML files define CI and release triggers. +- GitHub workflow YAML files define CI, release, Pages deployment, and Scorecard triggers. +- Checked-in workflow actions are pinned to full commit SHAs, with inline comments preserving the upstream action version tag used to choose each SHA. +- GitHub repository settings own CodeQL default setup and existing dependency-update monitoring. - `src/templates/github-action.ts` owns generated GitHub Action template behavior. ## Permissions @@ -40,9 +55,12 @@ Permissions are owned by the checked-in GitHub workflow and action template defi This doc does not add permissions beyond those source files. +The Scorecard workflow keeps workflow-level token permissions read-only and grants `id-token: write` only to the Scorecard job. + ## Deployment And Rollback - Workflow changes deploy when repository workflow files are committed to the target branch. +- Static introduction site changes deploy through GitHub Pages after they merge to `main`. - Rollback is a normal Git revert or follow-up workflow-file change. ## Availability And Observability @@ -57,6 +75,12 @@ This doc does not add permissions beyond those source files. ## Engineering Decisions - Decision (2026-06-14): Release automation truth is engineering/operational truth because it describes current repository mechanics. +- Decision (2026-06-26): GitHub Pages deploys only the committed static introduction site under `site/**`. + - The site is a presentation artifact; Markdown truth docs remain canonical. +- Decision (2026-06-26): Project-readiness checks use standard GitHub-native scanners before custom readiness badges or claims. + - CodeQL default setup covers code scanning without a checked-in advanced workflow. + - OpenSSF Scorecard covers external repository-health/security heuristics. + - Existing GitHub repository configuration covers dependency-update monitoring. ## Rationale @@ -69,11 +93,15 @@ Release automation is documented as operations truth because failures, permissio ## Maintenance Notes -Update when CI triggers, release prerequisites, publish steps, or action templates change. +Update when CI triggers, release prerequisites, publish steps, Pages deployment steps, checked-in readiness scans, or action templates change. ## Source References - ../../../../.github/workflows/ci.yml +- ../../../../.github/workflows/pages.yml - ../../../../src/templates/github-action.ts +- ../../../../.github/workflows/scorecard.yml +- ../../../../site/index.html - `.github/workflows/**` +- `site/**` - `src/templates/github-action.ts` diff --git a/docs/truthmark/routes/areas.md b/docs/truthmark/routes/areas.md index 2b62e34..fa185a8 100644 --- a/docs/truthmark/routes/areas.md +++ b/docs/truthmark/routes/areas.md @@ -105,12 +105,15 @@ Area files: Code surface: - .github/workflows/\*\* +- site/\*\* - src/templates/github-action.ts Update truth when: - CI verification steps or triggers change - release publishing prerequisites or publish steps change +- checked-in repository-readiness scans change +- GitHub Pages deployment or static introduction site behavior changes ## Repository Intelligence diff --git a/docs/truthmark/routes/areas/release-automation.md b/docs/truthmark/routes/areas/release-automation.md index 4e68939..a5731fd 100644 --- a/docs/truthmark/routes/areas/release-automation.md +++ b/docs/truthmark/routes/areas/release-automation.md @@ -20,12 +20,15 @@ truth_documents: Code surface: - .github/workflows/\*\* +- site/\*\* - src/templates/github-action.ts Update truth when: - CI verification steps or triggers change - release publishing prerequisites or publish steps change +- CodeQL, Scorecard, or other checked-in repository-readiness automation changes +- GitHub Pages deployment or static introduction site behavior changes - GitHub Action examples or action template rendering changes ## Source References diff --git a/site/.nojekyll b/site/.nojekyll new file mode 100644 index 0000000..e69de29 diff --git a/site/index.html b/site/index.html new file mode 100644 index 0000000..e1f1134 --- /dev/null +++ b/site/index.html @@ -0,0 +1,862 @@ + + +
+ + +Truthmark gives AI-assisted work a reviewable truth layer: current claims, ownership routes, product promises, and implementation facts travel with the same Git branch as the code.
+Truthmark is best understood as a repository-truth workflow surface. The value is not one feature; it is how several constraints reinforce each other.
+Helpers can validate and refresh, but the daily closeout path is designed to remain readable from the checkout.
Code changes keep revisiting the mapped docs, so documentation becomes a living review artifact rather than a launch-week export.
Files, areas, and truth docs are connected by committed routing metadata instead of implicit tribal knowledge.
User-facing promises can link to implementation reality without becoming the same document.
The desired unit is a durable claim per line or bullet, making truth updates easy to inspect in pull requests.
Generated skills, prompts, commands, and instruction blocks are committed where the agent can read them.
When a file starts mixing owners, Truth Structure is the product answer, not a larger paragraph.
Current truth lives where maintainers can diff, revert, blame, and review it.
This demo is fictional, but the workflow is concrete: create the right doc, update it when behavior changes, and split it when ownership gets crowded.
+Truthmark can let product and engineering documents reference each other without forcing them into the same voice or authority level.
This lane is for product capabilities, boundaries, acceptance criteria, and non-goals.
This lane is for runtime behavior, contracts, operations, architecture, and failure modes.
Truthmark's ambition is in the repository model, not in requiring every contributor to adopt a new always-on system.
Install once, commit the workflow surface, and let future branches carry their truth updates through normal review.
$ cd /path/to/your-repo +$ npm install -g truthmark +$ truthmark config +$ truthmark init +$ truthmark check + +# After setup, agent guidance and truth routes live in the checkout.