Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/ISSUE_TEMPLATE/config.yml
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
blank_issues_enabled: false
contact_links:
- name: Security vulnerability (report privately)
url: https://github.com/fu351/Doberman-Core/security/policy
url: https://github.com/DobermanCore/Doberman-Core/security/policy
about: Do not open a public issue for security problems — report privately per our security policy.
- name: Questions and ideas
url: https://github.com/fu351/Doberman-Core/discussions
url: https://github.com/DobermanCore/Doberman-Core/discussions
about: Ask questions, share usage patterns, or discuss ideas in Discussions.
1 change: 1 addition & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -85,5 +85,6 @@ jobs:
- uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} # org repos need a (free) key: gitleaks.io
GITLEAKS_ENABLE_COMMENTS: "false"
GITLEAKS_ENABLE_SUMMARY: "true"
15 changes: 12 additions & 3 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,20 @@

Shipped history for Doberman. Planned work lives on the [roadmap](README.md#roadmap) and the
[project board](https://github.com/users/fu351/projects/5); exact per-commit detail is in the
[git log](https://github.com/fu351/Doberman-Core/commits/main) and
[releases](https://github.com/fu351/Doberman-Core/releases) (latest: **v0.18.1**, a docs patch fixing the README images on PyPI, atop **v0.18.0**'s security-audit wave — the proxy output-secret gate closed over error and structured/embedded channels, per-user auth state and Windows-separator paths brought under control-plane protection — plus the RAND-aligned guardrail rehaul and the UX/contributor work since 0.17.1).
[git log](https://github.com/DobermanCore/Doberman-Core/commits/main) and
[releases](https://github.com/DobermanCore/Doberman-Core/releases) (latest: **v0.18.1**, a docs patch fixing the README images on PyPI, atop **v0.18.0**'s security-audit wave — the proxy output-secret gate closed over error and structured/embedded channels, per-user auth state and Windows-separator paths brought under control-plane protection — plus the RAND-aligned guardrail rehaul and the UX/contributor work since 0.17.1).

## Unreleased (merged since v0.18.1)

- **Docs rewrite, and a docs site.** Every page under `docs/`, the README, `CONTRIBUTING.md`, and the
OpenClaw adapter README were rewritten for accuracy against the v0.18.1 `--help` output and for voice
(plain, specific, no marketing). The README is now a front door (6.9k → 3.5k words); its deep sections
moved to `docs/TUNING.md`, `docs/PLUGINS.md`, `docs/RECOVERY.md`, and `docs/TURN_GATE.md`. The CLI
reference covers all 37 commands (the `2fa` group, `uninstall`, `message-tone`, and `tools approve` were
missing); the reason-code catalogue header says 57, matching the enum, and five raise-site columns were
corrected; the two overlapping release docs merged into `docs/RELEASING.md`; the OTel sink doc now
states the real log level for failed posts (`warning`, not `debug`). These files are also the source of
the new documentation site at [docs.trydoberman.dev](https://docs.trydoberman.dev).
- **Dashboard: per-project tab title.** `doberman dash` is already scoped to one repo per run
(`--path`, default the current directory), but every browser tab read the same "Doberman
Dashboard" title, so running several dashboards side by side (one per project) gave no way to
Expand Down Expand Up @@ -57,7 +66,7 @@ Shipped history for Doberman. Planned work lives on the [roadmap](README.md#road
denies, and the 2FA code entry stays masked.
- **Release SBOM:** every GitHub Release now ships a CycloneDX SBOM (`sbom.json`) listing the
exact resolved dependency set, generated by `pip-audit` and attached automatically by the
publish workflow. See [RELEASING.md](RELEASING.md#software-bill-of-materials-sbom).
publish workflow. See [RELEASING.md](docs/RELEASING.md#software-bill-of-materials-sbom).
- **New:** `doberman tune` — friction telemetry report (interventions/session, top AUTH reasons,
approval rates, weekly trend) plus possession-gated standing-elevation proposals where an AUTH
class has been approved every time; never applies anything itself, `--accept <id>` routes through
Expand Down
27 changes: 15 additions & 12 deletions CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,18 @@

Doberman is an Apache-2.0 project for AI-agent runtime authorization. This guide
gets you from a fresh clone to the same checks CI runs. `AGENTS.md` and
`CLAUDE.md` remain the operating manual and source of truth for project
invariants.
`CLAUDE.md` are the operating manual and source of truth for project invariants.

New here? Jump straight to [Pick a first task](#pick-a-first-task) for a
`good first issue`, then come back to the setup below to get your environment
running.

## Local setup

You need Python 3.11 or newer (CI tests 3.11, 3.12, and 3.13).

```bash
git clone https://github.com/fu351/Doberman-Core.git
git clone https://github.com/DobermanCore/Doberman-Core.git
cd Doberman-Core
python -m venv .venv
source .venv/bin/activate # Unix/macOS
Expand Down Expand Up @@ -98,7 +101,7 @@ heading anchors, skips external URLs and fenced code blocks, and never makes net
2. The call is normalized into a `SecurityObject`.
3. The decision engine runs objective and adaptive guardrails.
4. Guardrail verdicts merge through raise-only `combine()`.
5. The execution gate returns PASS / AUTH / BLOCK: allow, authenticate, or block.
5. The execution gate returns `PASS` / `AUTH` / `BLOCK`: allow, authenticate, or block.

## Where the docs live

Expand All @@ -116,9 +119,9 @@ heading anchors, skips external URLs and fenced code blocks, and never makes net

Every change must preserve these two safety properties:

- **Fail closed** - on any error, uncertainty, or unhandled case, deny or
- **Fail closed**: on any error, uncertainty, or unhandled case, deny or
`BLOCK`; a protected agent must not reach a tool around Doberman.
- **Raise-only** - guardrails may auto-tighten, but may never silently loosen.
- **Raise-only**: guardrails may auto-tighten, but may never silently loosen.
Any permanent weakening goes through the human-gated policy path.

Also keep secrets out of commits, logs, fixtures, and PR examples. Redacted
Expand All @@ -139,7 +142,7 @@ metadata, classifications, and fingerprints are fine; raw secrets are not.

## Pick a first task

Every open issue carries a `level-1` through `level-10` label — a difficulty ladder:
Every open issue carries a difficulty label from `level-1` through `level-10`:

| Level | What it demands |
| ----- | -------------------------------------------------------------------------------------- |
Expand All @@ -161,18 +164,18 @@ Commenting on an issue claims it. Level-8 and above additionally expect a design
with a maintainer, before any code.

Start with the
[`good first issue`](https://github.com/fu351/Doberman-Core/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22)
[`good first issue`](https://github.com/DobermanCore/Doberman-Core/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22)
or
[`help wanted`](https://github.com/fu351/Doberman-Core/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22)
[`help wanted`](https://github.com/DobermanCore/Doberman-Core/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22)
labels to find level-1/2/3 work, or browse a specific rung directly, e.g.
[`level-1`](https://github.com/fu351/Doberman-Core/labels/level-1) (swap the number for any level
[`level-1`](https://github.com/DobermanCore/Doberman-Core/labels/level-1) (swap the number for any level
1-10). Good first PRs are usually narrow docs, tests, or guardrail hardening changes with a clear
issue to close. Ready for something meatier, the
[`good first challenge`](https://github.com/fu351/Doberman-Core/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+challenge%22)
[`good first challenge`](https://github.com/DobermanCore/Doberman-Core/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+challenge%22)
label marks well-scoped issues a rung or two further up the ladder.

## Questions and community

Ask questions on the issue you're working on — maintainers watch the threads. For
Ask questions on the issue you're working on. Maintainers watch the threads. For
roadmap and design conversation between PRs, join the
[Discord](https://discord.gg/Sfy5XGNqty).
4 changes: 2 additions & 2 deletions CONTRIBUTORS.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ In alphabetical order by handle (ordering is not a ranking):
- [@tomatotomata](https://github.com/tomatotomata)

The living list of everyone who has landed a commit is always on the
[GitHub contributors graph](https://github.com/fu351/Doberman-Core/graphs/contributors).
[GitHub contributors graph](https://github.com/DobermanCore/Doberman-Core/graphs/contributors).

## How to join the list

Expand All @@ -39,7 +39,7 @@ rule all count. Please:

- Keep one slice per PR, with tests (CI must be green).
- Note any AI-assistance you used in the PR description (we value the
transparency — see [PR #58](https://github.com/fu351/Doberman-Core/pull/58) for
transparency — see [PR #58](https://github.com/DobermanCore/Doberman-Core/pull/58) for
an example).
- Preserve Doberman's two non-negotiable properties: **fail closed** and
**raise-only** (guardrails may auto-tighten, never silently loosen).
Expand Down
Loading
Loading