From 0b67cf48b569e11b28e8fce5b02290b50e01f44e Mon Sep 17 00:00:00 2001 From: Fabrizio Degni <5058737+sev7enITA@users.noreply.github.com> Date: Wed, 12 Aug 2026 11:46:31 +0200 Subject: [PATCH] activate PALO Evidence Pack --- .github/ISSUE_TEMPLATE/config.yml | 8 + .github/activation/issues.json | 62 +++++++ CHANGELOG.md | 10 ++ CITATION.cff | 2 +- CONTRIBUTING.md | 24 +++ PALO_AIGovernance.html | 4 +- PALO_AIProductionReadiness.html | 4 +- PALO_AIQuickstarts.html | 4 +- PALO_AIWhy.html | 4 +- PALO_AgenticCapabilityMatrix.html | 4 +- PALO_AgenticGovernance.html | 2 +- PALO_AssessmentPath.html | 41 +++-- PALO_Community.html | 4 +- PALO_CompanionApp.html | 4 +- PALO_DocumentationHub.html | 4 +- PALO_DocumentationLibrary.html | 4 +- PALO_PlatformMap.html | 4 +- PALO_Recognition.html | 4 +- PALO_RegulatoryWatch.html | 4 +- README.md | 39 ++++- assets/palo-assessment-path.js | 157 +++++++++++++++++- assets/palo-v21.css | 40 +++-- contributions/cases/README.md | 5 + dist/CHANGELOG.html | 61 ++++--- dist/CHANGELOG.md | 10 ++ dist/CONTRIBUTING.html | 19 ++- dist/CONTRIBUTING.md | 24 +++ dist/PALO_AIGovernance.html | 4 +- dist/PALO_AIProductionReadiness.html | 4 +- dist/PALO_AIQuickstarts.html | 4 +- dist/PALO_AIWhy.html | 4 +- dist/PALO_AgenticCapabilityMatrix.html | 4 +- dist/PALO_AgenticGovernance.html | 2 +- dist/PALO_AssessmentPath.html | 41 +++-- dist/PALO_Community.html | 4 +- dist/PALO_CompanionApp.html | 4 +- dist/PALO_DocumentationHub.html | 4 +- dist/PALO_DocumentationLibrary.html | 6 +- dist/PALO_PlatformMap.html | 4 +- dist/PALO_Recognition.html | 4 +- dist/PALO_RegulatoryWatch.html | 4 +- dist/SECURITY.html | 4 +- dist/assets/palo-assessment-path.js | 157 +++++++++++++++++- dist/assets/palo-v21.css | 40 +++-- .../n8n-architecture-preview-post.html | 4 +- .../palo-ai-feedback-design-partner-form.html | 4 +- ...crosoft-agt-interoperability-proposal.html | 4 +- dist/docs/p1-case-file-and-migration.html | 4 +- dist/docs/p2-adoption-integration-index.html | 4 +- dist/docs/p2-connector-patterns.html | 4 +- dist/docs/p2-dependency-inventory.html | 4 +- dist/docs/p2-module-contracts.html | 4 +- dist/docs/p2-publication-hygiene.html | 4 +- dist/docs/palo-ai-adoption-paths.html | 4 +- .../palo-ai-cloud-reference-architecture.html | 4 +- .../palo-ai-community-and-market-entry.html | 4 +- dist/docs/palo-ai-full-cycle-assurance.html | 4 +- .../palo-ai-governance-hub-github-copy.html | 4 +- .../palo-ai-governance-hub-launch-plan.html | 4 +- .../palo-ai-governance-hub-product-spec.html | 4 +- dist/docs/palo-ai-governance-hub-status.html | 4 +- .../palo-ai-governance-hub-user-guide.html | 4 +- .../palo-ai-governance-hub-workflows.html | 4 +- .../palo-ai-governance-integration-guide.html | 4 +- dist/docs/palo-ai-n8n-alpha-test-report.html | 4 +- .../palo-ai-n8n-governance-control-plane.html | 4 +- dist/docs/palo-ai-n8n-launch-playbook.html | 4 +- dist/docs/palo-ai-n8n-publication-status.html | 4 +- .../palo-ai-production-readiness-plan.html | 4 +- .../palo-ai-security-assurance-and-scale.html | 4 +- dist/docs/palo-ai-vps-deployment.html | 4 +- dist/docs/palo-v3-semantic-foundation.html | 4 +- dist/docs/platform-evolution-analysis.html | 4 +- .../palo-ai-governance-hub-page-copy.html | 4 +- dist/examples/agentic-interface/README.html | 4 +- dist/examples/hands-on-demo/README.html | 4 +- dist/examples/policy-as-code/README.html | 4 +- dist/feed.xml | 11 ++ dist/index.html | 52 +++--- dist/media/README.html | 4 +- dist/media/palo-ai-n8n-demo-script.html | 4 +- dist/packages/n8n-nodes-palo-ai/README.html | 4 +- dist/packages/palo-mcp-server/README.html | 4 +- dist/release-manifest.json | 26 ++- dist/templates/board-review.html | 4 +- dist/templates/contribution-starter.html | 4 +- dist/templates/incident-response.html | 4 +- dist/templates/procurement.html | 4 +- dist/templates/red-team-evidence.html | 4 +- docs/activation-freeze-2026-08.md | 50 ++++++ docs/community/activation-window-2026-08.md | 54 ++++++ docs/community/changed-because-of-feedback.md | 20 +++ docs/community/channel-policy.md | 17 ++ docs/community/founding-review-program.md | 39 +++++ docs/publication-model.md | 2 +- evidence-pack/README.md | 37 +++++ .../cases/agentic-invoice-exception.case.json | 65 ++++++++ .../cases/hr-learning-assistant.case.json | 64 +++++++ .../cases/procurement-bid-summary.case.json | 63 +++++++ feed.xml | 11 ++ index.html | 52 +++--- package-lock.json | 4 +- package.json | 6 +- release-manifest.json | 26 ++- .../palo-local-validation-receipt.schema.json | 54 ++++++ scripts/browser-smoke.mjs | 31 ++++ scripts/case-contribute.mjs | 93 +++++++++++ scripts/evidence-pack-core.mjs | 125 ++++++++++++++ scripts/evidence-pack.test.mjs | 58 +++++++ scripts/evidence-validate.mjs | 45 +++++ scripts/public-files.mjs | 10 ++ scripts/publish-activation-issues.mjs | 49 ++++++ scripts/render-public-docs.mjs | 4 +- scripts/validate.mjs | 17 +- 114 files changed, 1800 insertions(+), 299 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/activation/issues.json create mode 100644 contributions/cases/README.md create mode 100644 docs/activation-freeze-2026-08.md create mode 100644 docs/community/activation-window-2026-08.md create mode 100644 docs/community/changed-because-of-feedback.md create mode 100644 docs/community/channel-policy.md create mode 100644 docs/community/founding-review-program.md create mode 100644 evidence-pack/README.md create mode 100644 evidence-pack/cases/agentic-invoice-exception.case.json create mode 100644 evidence-pack/cases/hr-learning-assistant.case.json create mode 100644 evidence-pack/cases/procurement-bid-summary.case.json create mode 100644 schemas/palo-local-validation-receipt.schema.json create mode 100644 scripts/case-contribute.mjs create mode 100644 scripts/evidence-pack-core.mjs create mode 100644 scripts/evidence-pack.test.mjs create mode 100644 scripts/evidence-validate.mjs create mode 100644 scripts/publish-activation-issues.mjs diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..1e28d13 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,8 @@ +blank_issues_enabled: false +contact_links: + - name: PALO Evidence Pack questions and feedback + url: https://github.com/sev7enITA/PALOframework/discussions + about: Use the canonical Discussion channel for questions, reviewer findings and activation feedback. + - name: Private security reporting + url: https://github.com/sev7enITA/PALOframework/security/advisories/new + about: Report vulnerabilities privately. Do not publish exploit details or secrets in an issue or Discussion. diff --git a/.github/activation/issues.json b/.github/activation/issues.json new file mode 100644 index 0000000..bb4b6db --- /dev/null +++ b/.github/activation/issues.json @@ -0,0 +1,62 @@ +[ + { + "title": "[Case] Independently replay the agentic invoice gold case", + "labels": ["activation", "case", "good first issue"], + "body": "## Goal\nReplay the preloaded agentic invoice case from a clean clone and check whether the dossier distinguishes permission from verified effect.\n\n## Scope\nOne case only: `evidence-pack/cases/agentic-invoice-exception.case.json`. Do not propose a new module.\n\n## Acceptance criteria\n- Record setup time and time to the first local receipt.\n- Identify any ambiguous allowed or prohibited action.\n- Verify the receipt digest changes after a material case edit.\n- Report whether the dossier supports a proceed, pause or stop decision.\n\n## Safety boundary\nUse synthetic data only. Validation is not certification or production approval." + }, + { + "title": "[Case] Review the HR learning assistant decision boundary", + "labels": ["activation", "case", "governance"], + "body": "## Goal\nReview whether the HR gold case cleanly separates optional learning support from employment decisions.\n\n## Scope\n`evidence-pack/cases/hr-learning-assistant.case.json` only.\n\n## Acceptance criteria\n- Identify one plausible prohibited inference not already named, or explain why the list is sufficient.\n- Check whether a reviewer can identify the accountable decision owner.\n- Propose one bounded evidence improvement.\n- Make no jurisdiction-wide legal conclusion." + }, + { + "title": "[Case] Verify procurement gold-case sources and decision rights", + "labels": ["activation", "case", "documentation"], + "body": "## Goal\nCheck source freshness and decision rights in the procurement bid-summary gold case.\n\n## Scope\n`evidence-pack/cases/procurement-bid-summary.case.json` only.\n\n## Acceptance criteria\n- Verify every source URL and review date.\n- Confirm scoring and award authority remain outside the assistant boundary.\n- Add or propose one traceability check from bid source to summary.\n- Keep the example synthetic and non-production." + }, + { + "title": "[Adapter] Accept a Case File from stdin in the local validator", + "labels": ["activation", "adapter", "good first issue"], + "body": "## Goal\nAllow `npm run evidence:validate -- -` to validate a Case File supplied through stdin.\n\n## Acceptance criteria\n- Existing file-path behavior remains unchanged.\n- Stdin input has a documented size limit and rejects invalid JSON clearly.\n- Receipt output remains local and deterministic for the same case content.\n- Add Node tests for valid, invalid and oversized input.\n\n## Non-goal\nNo network API or hosted upload." + }, + { + "title": "[Adapter] Add an n8n export-to-Evidence-Pack example", + "labels": ["activation", "adapter", "n8n"], + "body": "## Goal\nCreate one isolated n8n example that exports a synthetic PALO Case File for local Evidence Pack validation.\n\n## Acceptance criteria\n- Uses the existing n8n developer-preview boundary.\n- Produces a Case File that passes `npm run case:contribute -- --validate-all`.\n- Requires no production credentials or personal data.\n- Documents that n8n orchestration does not itself verify the declared outcome.\n\n## Non-goal\nPublishing or claiming an n8n-verified community node." + }, + { + "title": "[Threat test] Reject a validation receipt after case tampering", + "labels": ["activation", "threat-test", "security"], + "body": "## Goal\nAdd a negative test proving that a receipt no longer matches after a material Case File change.\n\n## Acceptance criteria\n- Start from the agentic invoice gold case and its receipt.\n- Change one authority or expected-effect field.\n- Demonstrate a digest mismatch with a deterministic test.\n- Document what the receipt does and does not protect.\n\n## Non-goal\nClaiming signer identity, non-repudiation or independent assurance." + }, + { + "title": "[Threat test] Prove the browser Evidence Pack has no mandatory telemetry", + "labels": ["activation", "threat-test", "privacy"], + "body": "## Goal\nAdd a browser test that fails if the Evidence Pack sends case or receipt content over the network.\n\n## Acceptance criteria\n- Intercept browser requests after page load.\n- Complete the preloaded case, generate and download a receipt.\n- Assert no request contains case answers, receipt content or identifiers.\n- Allow only documented static asset requests required to load the page.\n- Record the tested browser and route." + }, + { + "title": "[Threat test] Add a missing-authority negative gold-case fixture", + "labels": ["activation", "threat-test", "governance"], + "body": "## Goal\nShow that a structurally valid Case File can still be decision-misleading when authority boundaries are absent.\n\n## Acceptance criteria\n- Add one intentionally misleading educational fixture.\n- The base Case File schema may pass, but Evidence Pack readiness must fail or warn.\n- The result names the missing allowed action, prohibited action and verification method.\n- Add a test and plain-language explanation." + }, + { + "title": "[Mapping] Review Evidence Pack claims against the EU AI Act source", + "labels": ["activation", "mapping", "governance"], + "body": "## Goal\nReview only the EU AI Act references and wording exposed by the three gold cases.\n\n## Acceptance criteria\n- Link each material regulatory statement to the exact official source location.\n- Separate source-backed statement, PALO interpretation and open applicability question.\n- Remove or narrow any overbroad claim.\n- Record the source check date.\n\n## Non-goal\nProviding legal advice or a complete compliance mapping." + }, + { + "title": "[Mapping] Trace NIST and ISO references to Evidence Pack decisions", + "labels": ["activation", "mapping", "documentation"], + "body": "## Goal\nMake the NIST AI RMF and ISO/IEC 42001 references actionable for the exact Evidence Pack decisions they support.\n\n## Acceptance criteria\n- Map each reference to a named decision or evidence field.\n- Identify whether the source is official, standard or interpretive.\n- Add a review date and an applicability caveat.\n- Do not reproduce paywalled standards text." + }, + { + "title": "[Accessibility] Complete the Evidence Pack with keyboard and screen reader", + "labels": ["activation", "accessibility", "good first issue"], + "body": "## Goal\nComplete the preloaded case and receipt flow without a pointer device.\n\n## Acceptance criteria\n- Test current Chrome or Firefox with one named screen reader.\n- Confirm logical heading order, field labels, focus order and live-region announcements.\n- Confirm every action has a visible focus state and at least a 44px target.\n- Report exact steps and one screenshot or accessibility-tree excerpt for each failure." + }, + { + "title": "[Accessibility] Verify Evidence Pack at 390px and 200 percent zoom", + "labels": ["activation", "accessibility", "good first issue"], + "body": "## Goal\nVerify the complete Evidence Pack path on a 390px viewport and at 200 percent browser zoom.\n\n## Acceptance criteria\n- No horizontal page overflow.\n- Primary CTA, form, results, receipt actions and disclaimers remain visible and operable.\n- Text does not overlap or truncate material meaning.\n- Add a browser smoke assertion for any reproducible regression." + } +] diff --git a/CHANGELOG.md b/CHANGELOG.md index 7666824..fda7b2e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,10 +9,20 @@ and this project follows Semantic Versioning where practical. ## [Unreleased] +## [3.0.1] - 2026-08-12 + +### Added + +- Added the preloaded local Evidence Pack experience, a voluntary SHA-256 validation receipt and three schema-valid gold cases. +- Added `case:contribute`, a one-command generator and validator for Community Casebook contributions and pull request preparation. +- Added the five-day activation runbook, 20-seat founding review protocol and public changed-because-of-feedback log. + ### Changed - Normalized tracked source and generated publication text to plain ASCII punctuation, separators and status labels. - Added an automated text-style gate for source files, generated `dist` files and current Git metadata. +- Started a 30-day new-module freeze, enabled one canonical GitHub Discussions channel and added the five-day activation and changed-because-of-feedback records. +- Made PALO Evidence Pack the only primary website and README activation route while retaining existing modules as downstream tools. ## [3.0.0] - 2026-08-12 diff --git a/CITATION.cff b/CITATION.cff index dc6fb91..28be245 100644 --- a/CITATION.cff +++ b/CITATION.cff @@ -5,7 +5,7 @@ type: software authors: - family-names: "Degni" given-names: "Fabrizio" -version: "3.0.0" +version: "3.0.1" date-released: "2026-08-12" license: MIT repository-code: "https://github.com/sev7enITA/PALOframework" diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d0320e5..4bcb5d1 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -6,6 +6,30 @@ PALO v3 semantic sources are versioned public contracts. Change the semantic sou First off, thank you for considering contributing to PALO! +## Fast path: contribute a case + +During the 30-day activation freeze, the most valuable contribution is one synthetic or safely publishable Evidence Pack case. Generate the Case File and pull request body with: + +```sh +npm run case:contribute -- \ + --slug retail-returns-assistant \ + --title "Retail returns assistant" \ + --sector retail \ + --scenario "An assistant drafts a recommendation while a named employee approves refunds." \ + --community builders \ + --author "@your-github-handle" +``` + +Complete the generated TODO fields, then run: + +```sh +npm run case:contribute -- --validate-all +npm run evidence:test +npm run validate +``` + +The command does not push, open a pull request or transmit case content. Cases must state allowed and prohibited actions, an observable expected effect, an independent verification method and their non-production boundary. + ## Table of Contents - [Code of Conduct](#code-of-conduct) diff --git a/PALO_AIGovernance.html b/PALO_AIGovernance.html index b969c35..89b1046 100644 --- a/PALO_AIGovernance.html +++ b/PALO_AIGovernance.html @@ -16,9 +16,9 @@ - + - + Skip to main content diff --git a/PALO_AIProductionReadiness.html b/PALO_AIProductionReadiness.html index e84b8a5..dafc07b 100644 --- a/PALO_AIProductionReadiness.html +++ b/PALO_AIProductionReadiness.html @@ -6,8 +6,8 @@ - - + + Skip to main content diff --git a/PALO_AIQuickstarts.html b/PALO_AIQuickstarts.html index 77f3c0f..5ac3fd0 100644 --- a/PALO_AIQuickstarts.html +++ b/PALO_AIQuickstarts.html @@ -14,9 +14,9 @@ /> - + - + diff --git a/PALO_AIWhy.html b/PALO_AIWhy.html index 7a875fb..907c006 100644 --- a/PALO_AIWhy.html +++ b/PALO_AIWhy.html @@ -11,9 +11,9 @@ - + - + diff --git a/PALO_AgenticCapabilityMatrix.html b/PALO_AgenticCapabilityMatrix.html index e58089c..bb12c7f 100644 --- a/PALO_AgenticCapabilityMatrix.html +++ b/PALO_AgenticCapabilityMatrix.html @@ -8,10 +8,10 @@ - + - + diff --git a/PALO_AgenticGovernance.html b/PALO_AgenticGovernance.html index 2e1f4d8..7db5dc4 100644 --- a/PALO_AgenticGovernance.html +++ b/PALO_AgenticGovernance.html @@ -20,7 +20,7 @@ - + diff --git a/PALO_AssessmentPath.html b/PALO_AssessmentPath.html index cfd7543..ef775aa 100644 --- a/PALO_AssessmentPath.html +++ b/PALO_AssessmentPath.html @@ -3,22 +3,22 @@ - PALO Assessment Path | Guided AI Governance Evidence - + PALO Evidence Pack | Reviewable AI Governance Evidence + - - + + - + - + @@ -32,7 +32,7 @@