{"id":50551666,"url":"https://github.com/monolith-droid/io-safety-kit-for-oss","last_synced_at":"2026-06-04T04:00:35.347Z","repository":{"id":362343153,"uuid":"1258568025","full_name":"monolith-droid/io-safety-kit-for-oss","owner":"monolith-droid","description":"Fail-closed input scopes, report-only workflows, and safe output promotion for AI-assisted OSS maintenance.","archived":false,"fork":false,"pushed_at":"2026-06-03T20:20:05.000Z","size":64,"stargazers_count":0,"open_issues_count":3,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-03T20:22:40.423Z","etag":null,"topics":["ai-safety","automation","codex","github-actions","maintainer","open-source"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/monolith-droid.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-03T17:49:10.000Z","updated_at":"2026-06-03T20:18:19.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/monolith-droid/io-safety-kit-for-oss","commit_stats":null,"previous_names":["monolith-droid/io-safety-kit-for-oss"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/monolith-droid/io-safety-kit-for-oss","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monolith-droid%2Fio-safety-kit-for-oss","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monolith-droid%2Fio-safety-kit-for-oss/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monolith-droid%2Fio-safety-kit-for-oss/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monolith-droid%2Fio-safety-kit-for-oss/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/monolith-droid","download_url":"https://codeload.github.com/monolith-droid/io-safety-kit-for-oss/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monolith-droid%2Fio-safety-kit-for-oss/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33888302,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-04T02:00:06.755Z","response_time":64,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-safety","automation","codex","github-actions","maintainer","open-source"],"created_at":"2026-06-04T04:00:34.097Z","updated_at":"2026-06-04T04:00:35.340Z","avatar_url":"https://github.com/monolith-droid.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# I/O Safety Kit for OSS\n\n[![CI](https://github.com/monolith-droid/io-safety-kit-for-oss/actions/workflows/ci.yml/badge.svg)](https://github.com/monolith-droid/io-safety-kit-for-oss/actions/workflows/ci.yml)\n\nI/O Safety Kit for OSS is a small, fail-closed operations layer for open source\nmaintainers who want to control both sides of AI-assisted maintenance: what\ncoding agents are allowed to take in, and what workflow output is safe to\npublish.\n\nThe project is agent-agnostic by design. Codex workflows are the first concrete\nreference use case, while the manifest, gate, report, and promotion patterns are\nintended for OSS maintenance with coding agents more broadly.\n\nThe current MVP is intentionally report-only. It validates approval manifests,\nchecks whether a requested maintainer workflow is inside the approved scope, and\nproduces auditable JSON/Markdown reports. It does not execute shell commands,\nread secrets, change repository settings, merge pull requests, or publish\nanything.\n\n## Why This Exists\n\nAI coding agents are useful for OSS maintenance, but the risky part is often not\nthe code suggestion. It is the surrounding workflow: which repository is in\nscope, which action is authorized, whether a task is dry-run or executable, and\nhow a maintainer can reconstruct what happened later.\n\nThis project gives maintainers a compact pattern:\n\n1. Describe a task with an approval manifest.\n2. Validate the manifest.\n3. Pass it through a fail-closed gate.\n4. Run only report-only maintainer workflow plans.\n5. Store the output as reviewable evidence.\n\n## I/O Model\n\nInput safety means the agent workflow starts from a declared scope: repository,\noperation, targets, approval state, allowed actions, and blocked high-risk\nverbs. The MVP does not read secrets, scan unrelated repositories, or execute\ncommands.\n\nOutput safety means the generated workflow result stays reviewable before it\nbecomes public. Reports remain local by default, GitHub mutation is disabled,\nand `promotion-check` fails closed when private context, local paths, personal\ndata, or non-synthetic examples remain in a candidate.\n\n## Quick Start\n\n```bash\npython -m pip install -e .\niosk validate --manifest examples/pr-review-manifest.json --json\niosk gate --manifest examples/pr-review-manifest.json --json\niosk pr-review --manifest examples/pr-review-manifest.json --out reports/pr-review.md\niosk issue-triage --manifest examples/issue-triage-manifest.json --out reports/issue-triage.md\niosk promotion-check --candidate examples/promotion-candidate.json --json\niosk signature-check --manifest examples/signed-pr-review-manifest.json --json\niosk run --job examples/maintainer-job.json --json\niosk handoff --report examples/sample-run-report.json --out reports/handoff.md\n```\n\nThe `iosk` command is the preferred CLI name. The older `msk` and `cmsk`\ncommands remain available during the v0.1.x release line for compatibility with\nearly examples and adapters.\n\nYou can also run the module directly:\n\n```bash\npython -m io_safety_kit validate --manifest examples/pr-review-manifest.json\n```\n\n## Optional JSON Schema Validation\n\nThe default validator uses only the Python standard library. For stricter\nmanifest shape checks, install the optional schema extra and pass `--schema`:\n\n```bash\npython -m pip install -e \".[schema]\"\niosk validate --manifest examples/pr-review-manifest.json --schema --json\n```\n\nWhen `jsonschema` is installed, schema errors are reported as fail-closed\n`schema_error:*` blockers. When it is not installed, `--schema` falls back to\nthe standard validator and emits the warning\n`jsonschema_not_installed_schema_validation_skipped`.\n\n## Fail-Closed Example\n\nHigh-risk actions remain blocked even when a fixture claims approval:\n\n```bash\niosk gate --manifest tests/fixtures/blocked_actions/read_secret.json --json\n```\n\n```json\n{\n  \"approval_status\": \"approved\",\n  \"blockers\": [\n    \"blocked_action:read_secret_values\"\n  ],\n  \"operation\": \"security_audit\",\n  \"passed\": false,\n  \"repository\": \"monolith-droid/io-safety-kit-for-oss\",\n  \"risk_level\": \"high\",\n  \"status\": \"gate_blocked_fail_closed\",\n  \"warnings\": [\n    \"high_risk_operation_requires_extra_maintainer_review\"\n  ]\n}\n```\n\n## What The Gate Checks\n\n- Required manifest fields are present.\n- The operation is one of the supported maintainer workflows.\n- The approval is explicit, unexpired, and tied to a concrete scope.\n- Requested actions avoid blocked high-risk verbs such as secret access,\n  repository visibility changes, destructive cleanup, or protected-branch\n  mutation.\n- The command runner remains dry-run/report-only in this MVP.\n\n## Example Workflows\n\n- `examples/pr-review-manifest.json`: scope an AI-assisted PR review.\n- `examples/pr-review-report.md`: sample report-only PR review output.\n- `examples/issue-triage-manifest.json`: classify and prioritize issues.\n- `examples/issue-triage-report.md`: sample report-only issue triage output.\n- `examples/release-checklist-manifest.json`: prepare release notes and checks.\n- `examples/security-audit-manifest.json`: demonstrate a pending approval that\n  must fail closed.\n- `examples/signed-pr-review-manifest.json`: demonstrate provider-neutral\n  signed manifest digest metadata.\n- `examples/maintainer-job.json`: report-only job plan using those manifests.\n- `examples/promotion-candidate.json`: check whether private/downstream output\n  is safe to promote publicly.\n\n## PR Review Renderer\n\nRender a deterministic local Markdown report without posting to GitHub:\n\n```bash\niosk pr-review --manifest examples/pr-review-manifest.json --out reports/pr-review.md --json\n```\n\nThe report summarizes scope, allowed actions, gate status, blockers, warnings,\nand maintainer next steps. It keeps `GitHub mutation performed` set to `False`.\n\n## Issue Triage Renderer\n\nRender a deterministic local Markdown report without mutating labels, milestones,\nassignments, or comments:\n\n```bash\niosk issue-triage --manifest examples/issue-triage-manifest.json --out reports/issue-triage.md --json\n```\n\nThe report summarizes scope, allowed actions, gate status, draft triage policy,\nblockers, warnings, and maintainer next steps. It keeps `Labels mutated` and\n`Comments posted` set to `False`.\n\n## Safe Output Promotion\n\nAI-assisted development needs not only safe input, but safe output. I/O Safety\nKit for OSS can check whether useful private or downstream workflow findings\nare ready to become public OSS artifacts:\n\n```bash\niosk promotion-check --candidate examples/promotion-candidate.json --out reports/promotion.md --json\n```\n\nThe check fails closed when secrets, personal data, local paths, private context,\nor non-synthetic examples remain in the candidate. See [Safe output promotion\nloop](docs/safe-output-promotion-loop.md).\n\n## Signed Manifest Digest Check\n\nSigned approval manifest support starts with the provider-neutral part: checking\nthat public signature metadata still matches the canonical approval manifest\npayload.\n\n```bash\niosk signature-check --manifest examples/signed-pr-review-manifest.json --json\n```\n\nThe fixture intentionally does not include private keys, signing services, or\nprovider-specific credentials. The command verifies the canonical SHA-256 payload\ndigest and reports `cryptographic_signature_verified` as `False` until a future\nprovider integration is added. See\n[Signed approval manifests](docs/signed-approval-manifests.md).\n\n## Project Status\n\nThis repository is an early public OSS project for maintainers who want\nauditable AI-assisted workflows. The current focus is a small active release\nline with examples, CI, issue templates, blocked-action regression fixtures,\nsigned-manifest digest fixtures, and maintainer automation recipes.\n\nThe project is developed through a dogfooding loop: private downstream adapters\ncan use the public core in report-only mode, then promote only generic,\nprivacy-safe improvements back into this repository as issues, tests, docs, or\nsmall PRs. This keeps the OSS core reusable without exposing local operations,\nsecrets, private paths, or organization-specific policy.\n\nSee:\n\n- [Security model](docs/security-model.md)\n- [Maintainer workflows](docs/maintainer-workflows.md)\n- [Downstream dogfooding](docs/downstream-dogfooding.md)\n- [Safe output promotion loop](docs/safe-output-promotion-loop.md)\n- [Synthetic maintainer workflow case study](docs/synthetic-maintainer-case-study.md)\n- [Signed approval manifests](docs/signed-approval-manifests.md)\n\n## Non-Goals\n\n- This is not a replacement for GitHub permissions or branch protection.\n- This is not a secret scanner or vulnerability scanner.\n- This MVP does not execute commands.\n- This MVP does not grant authorization by itself; it only verifies that a\n  manifest says authorization exists and reports whether the gate would allow\n  the workflow.\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmonolith-droid%2Fio-safety-kit-for-oss","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmonolith-droid%2Fio-safety-kit-for-oss","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmonolith-droid%2Fio-safety-kit-for-oss/lists"}