Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/FUNDING.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
Space LEAF Corp# These are supported funding model platforms

Copilot AI Jan 10, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The first line contains "Space LEAF Corp" outside of any YAML structure, which makes this an invalid YAML file. This will cause parsing errors when the funding configuration is processed by GitHub. The content should either be removed or moved to a comment (prefixed with #).

Suggested change
Space LEAF Corp# These are supported funding model platforms
# These are supported funding model platforms

Copilot uses AI. Check for mistakes.

github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
patreon: # Replace with a single Patreon username
open_collective: # Replace with a single Open Collective username
ko_fi: # Replace with a single Ko-fi username
tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
liberapay: # Replace with a single Liberapay username
issuehunt: # Replace with a single IssueHunt username
lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
polar: # Replace with a single Polar username
buy_me_a_coffee: # Replace with a single Buy Me a Coffee username
thanks_dev: # Replace with a single thanks.dev username
custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
37 changes: 37 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
name: CI

on:
push:
branches: [ main ]
pull_request:
branches: [ main ]

jobs:
build-and-test:
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [18.x]
steps:
- name: Checkout repo
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}

- name: Install pnpm
run: npm install -g pnpm@8

- name: Install dependencies
run: pnpm install --frozen-lockfile

- name: Run lint
run: pnpm lint || true

- name: Run tests (workspace)
run: pnpm test

- name: Build (workspace)
run: pnpm build
Comment on lines +11 to +37

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 9 months ago

In general, the fix is to explicitly declare a permissions block for the workflow or for the specific job, reducing GITHUB_TOKEN permissions to the minimal scope required. For this CI job, all steps only need to read repository contents, so contents: read is sufficient.

The best minimal fix without changing existing functionality is to add a job-level permissions block under build-and-test (or a root-level block if preferred). Since the analysis points to line 11 within the job, we’ll add permissions: just before runs-on: ubuntu-latest, with proper indentation, and set contents: read. No other steps, imports, or configuration changes are required.

Concretely, in .github/workflows/ci.yml, edit the build-and-test job definition so that lines 10–12 become:

  build-and-test:
    permissions:
      contents: read
    runs-on: ubuntu-latest

All other lines remain unchanged.

Suggested changeset 1
.github/workflows/ci.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,8 @@
 
 jobs:
   build-and-test:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     strategy:
       matrix:
EOF
@@ -8,6 +8,8 @@

jobs:
build-and-test:
permissions:
contents: read
runs-on: ubuntu-latest
strategy:
matrix:
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How does this help

3 changes: 3 additions & 0 deletions .vscode/settings.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
{
"markdown.validate.enabled": true
}
38 changes: 28 additions & 10 deletions FULL_STACK_LOOP.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,17 +5,20 @@ This guide walks you through testing the complete **Frontend → Backend → Dat
## ✅ What's Implemented

### 1. Frontend (`/hello` page)
- **Location**: `apps/web/src/pages/hello.tsx`
- **Route**: http://localhost:3000/hello

- **Location**: `apps/web/src/app/hello/page.tsx`
- **Route**: <http://localhost:3000/hello>
- **Features**:
- Displays "Captain's Log Online"
- Shows status of frontend, backend, and database connections
- Fetches and displays latest log entry from database

### 2. Backend API (`/api/hello` endpoint)

- **Location**: `apps/api/src/index.ts`
- **Route**: http://localhost:3001/api/hello
- **Route**: <http://localhost:3001/api/hello>
- **Response**:

```json
{
"message": "Backend alive",
Expand All @@ -26,6 +29,7 @@ This guide walks you through testing the complete **Frontend → Backend → Dat
```

### 3. Database (Prisma + PostgreSQL)

- **Model**: `LogEntry` in `packages/database/prisma/schema.prisma`
- **Fields**:
- `id`: Unique identifier
Expand All @@ -39,35 +43,41 @@ This guide walks you through testing the complete **Frontend → Backend → Dat
### Option 1: With Docker (Full Database)

1. **Install Docker Desktop** (if not already installed)
- Download from: https://www.docker.com/products/docker-desktop
- Download from: <https://www.docker.com/products/docker-desktop>

2. **Start PostgreSQL**:

```bash
docker-compose up -d
```

3. **Setup Database**:

```bash
pnpm db:setup
```

This will:
- Generate Prisma client
- Push schema to database
- Seed with sample data

4. **Install dependencies with database package**:

```bash
pnpm install
```

5. **Restart backend** to connect to database:

```bash
# Stop current backend (Ctrl+C)
pnpm dev --filter backend
```

6. **Visit the page**:
```

```text
http://localhost:3000/hello
```

Expand All @@ -76,7 +86,8 @@ This guide walks you through testing the complete **Frontend → Backend → Dat
If you don't have Docker, you can still test frontend ↔ backend:

1. **Visit the hello page**:
```

```text
http://localhost:3000/hello
```

Expand All @@ -87,12 +98,14 @@ If you don't have Docker, you can still test frontend ↔ backend:

## 🧪 Testing the Full Loop

### Test Backend Directly:
### Test Backend Directly

```bash
curl http://localhost:3001/api/hello
```

Expected response (with database):

```json
{
"message": "Backend alive",
Expand All @@ -109,10 +122,12 @@ Expected response (with database):
}
```

### View in Browser:
Navigate to: http://localhost:3000/hello
### View in Browser

Navigate to: <http://localhost:3000/hello>

You should see:

- 🚀 **Captain's Log Online** (big animated title)
- ✅ **Frontend**: Next.js page loaded
- ✅ **Backend**: Backend alive
Expand Down Expand Up @@ -141,16 +156,19 @@ pnpm db:setup
## 🐛 Troubleshooting

### Backend can't connect to database?

- Make sure Docker is running: `docker ps`
- Check docker-compose is up: `docker-compose ps`
- Verify DATABASE_URL in `packages/database/.env`

### Port already in use?

- Frontend (3000): Stop other Next.js instances
- Backend (3001): Stop other Node.js servers
- Database (5432): Stop other PostgreSQL instances

### CORS errors?

- Backend has CORS enabled for all origins in development
- Make sure backend is running on port 3001

Expand All @@ -166,7 +184,7 @@ Now that the full loop is confirmed, you can:

## 📊 Architecture

```
```text
┌─────────────────┐
│ Frontend │ Next.js on :3000
│ /hello page │ → Fetches from backend
Expand Down
13 changes: 9 additions & 4 deletions KUBERNETES_DEPLOY.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ Deploy your Turbo Stack full-stack application to Kubernetes using Helm charts a
## 📋 Prerequisites

### 1. Install Minikube

```bash
# macOS
brew install minikube
Expand All @@ -15,6 +16,7 @@ sudo install minikube-darwin-amd64 /usr/local/bin/minikube
```

### 2. Install Helm

```bash
# macOS
brew install helm
Expand All @@ -24,6 +26,7 @@ curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
```

### 3. Install kubectl (if not already installed)

```bash
# macOS
brew install kubectl
Expand All @@ -44,6 +47,7 @@ chmod +x deploy-minikube.sh
```

This will:

1. ✅ Start Minikube
2. 🐳 Build Docker images
3. ⚓ Deploy with Helm
Expand Down Expand Up @@ -136,6 +140,7 @@ minikube dashboard --url
```

The dashboard shows:

- 🎭 Pod status and health
- 📈 Resource usage (CPU/Memory)
- 🔄 Deployment scaling
Expand Down Expand Up @@ -205,7 +210,7 @@ kubectl port-forward service/backend 3001:3001

## 🎨 Helm Chart Structure

```
```text
helm/
├── frontend/
│ ├── Chart.yaml # Chart metadata
Expand Down Expand Up @@ -290,10 +295,10 @@ minikube delete --all --purge

After deployment, your services are exposed on NodePorts:

- **Frontend**: http://localhost:30000 (via `minikube service frontend`)
- **Backend**: http://localhost:30001 (via `minikube service backend`)
- **Frontend**: <http://localhost:30000> (via `minikube service frontend`)
- **Backend**: <http://localhost:30001> (via `minikube service backend`)

### Get URLs automatically:
### Get URLs automatically

```bash
echo "Frontend: $(minikube service frontend --url)"
Expand Down
50 changes: 29 additions & 21 deletions LICENSE
Original file line number Diff line number Diff line change
@@ -1,21 +1,29 @@
MIT License

Copyright (c) 2025 Space LEAF corp

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
# MIT Stewardship License (Modified)

MIT Stewardship License (Modified)

Copyright (c) 2025 Leif William Sogge

Copilot AI Jan 10, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The copyright holder has been changed from "Space LEAF corp" to "Leif William Sogge". This is a significant legal change that should be verified as accurate and authorized. If this represents a transfer of copyright ownership, proper documentation and authorization should be in place.

Copilot uses AI. Check for mistakes.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, subject to the following conditions:

1. **Open Access for Education and Research**
The Software may be freely used for non-commercial educational, scientific, and environmental research purposes.

2. **Stewardship Clause — Profit Sharing for Planetary Care**
Any commercial use of the Software or its derivatives that results in **financial profit from scientific research, data products, or technological applications** must contribute **10% of net profits** to a designated nonprofit vault or trust.
This fund shall be used exclusively for:
- Supporting youth education in planetary stewardship
- Funding open-access environmental science
- Ensuring long-term economic stability for future generations

The vault shall be managed by a nonprofit organization aligned with the mission of Jarvondis University and the ceremonial stewardship principles outlined by the original author.

3. **Preservation of Authorship and Mission**
The name “Leif William Sogge” and the ceremonial mission of Jarvondis University must be preserved in all public forks, derivatives, and publications referencing this Software.

4. **Standard MIT Terms Apply**
Except as modified above, the Software is provided “as is”, without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability.

---

This license is a living document. Stewardship is not static — it evolves with the needs of the planet and the people.
Comment on lines +1 to +29

Copilot AI Jan 10, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The LICENSE file has been changed from the standard MIT License to a custom "MIT Stewardship License (Modified)" which includes profit-sharing requirements (10% of net profits) and other non-standard clauses. This is a breaking change that significantly alters the legal terms under which the software can be used. The new license includes commercial restrictions that are not part of the MIT license, which may not be compatible with downstream users' expectations and could create legal complications. This change should be carefully reviewed by legal counsel and clearly communicated to all stakeholders.

Suggested change
# MIT Stewardship License (Modified)
MIT Stewardship License (Modified)
Copyright (c) 2025 Leif William Sogge
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, subject to the following conditions:
1. **Open Access for Education and Research**
The Software may be freely used for non-commercial educational, scientific, and environmental research purposes.
2. **Stewardship Clause — Profit Sharing for Planetary Care**
Any commercial use of the Software or its derivatives that results in **financial profit from scientific research, data products, or technological applications** must contribute **10% of net profits** to a designated nonprofit vault or trust.
This fund shall be used exclusively for:
- Supporting youth education in planetary stewardship
- Funding open-access environmental science
- Ensuring long-term economic stability for future generations
The vault shall be managed by a nonprofit organization aligned with the mission of Jarvondis University and the ceremonial stewardship principles outlined by the original author.
3. **Preservation of Authorship and Mission**
The name “Leif William Sogge” and the ceremonial mission of Jarvondis University must be preserved in all public forks, derivatives, and publications referencing this Software.
4. **Standard MIT Terms Apply**
Except as modified above, the Software is provided “as is”, without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability.
---
This license is a living document. Stewardship is not static — it evolves with the needs of the planet and the people.
MIT License
Copyright (c) 2025 Leif William Sogge
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Copilot uses AI. Check for mistakes.
36 changes: 36 additions & 0 deletions MLK-Justice-Sweep/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# MLK Justice Sweep – Turbo Stack Security Ritual

This project encodes an annual **MLK Jr. Day justice sweep** and a **daily integrity test** for systems that participate in the **Turbo Stack / Krystal Core Satellite Relay** network.

## Core concepts

- **AI sponge & validation sweep:**
Forward analysis of logs, access patterns, and configuration changes.

- **Reverse algorithm anomaly detection:**
Reverse-time reprocessing, looking for impossible sequences and hidden backdoors.

- **Infinity loop passes (0.2s / 0.25s):**
Symbolic cadence for scheduling: two tightly coupled passes that converge into a single stream.

- **Reverse gyroscopic cataloging & indexing:**
Multi-axis indexing (time, user, resource, device, anomaly score) for stability and later forensics.

- **Integrity vault:**
Cryptographically chained evidence store, optionally anchored to **Turbo Stack Krystal Core satellites** to detect tampering.

- **JARVONDIS integration:**
Final, normalized anomaly stream formatted for the JARVONDIS game engine / analytic core.

## Modes

- **Daily integrity test** – lightweight run over a recent time window.
- **MLK Justice Sweep** – deep annual run with full vault anchoring and report generation.

## Stack

- **Language:** Python 3.x
- **Structure:** Modular components under `src/`
- **Config:** YAML files under `config/`

You are encouraged to fork, extend, and adapt this system to your own ethical frameworks and infrastructures.

Copilot AI Jan 10, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The entire MLK-Justice-Sweep directory appears to be unrelated to the Turbo Stack template project. This directory contains a complete Python-based security monitoring system with concepts like "MLK Jr. Day justice sweep", "JARVONDIS integration", and "infinity loop passes". This content does not align with the repository's stated purpose as a "Production-Ready Full-Stack Template" for Next.js/Express applications and should likely be in a separate repository.

Suggested change
You are encouraged to fork, extend, and adapt this system to your own ethical frameworks and infrastructures.
Note: This directory contains an archived experimental concept and is not part of the supported Turbo Stack production template. It is retained only for historical/reference purposes and any further development should occur in a separate, dedicated repository.

Copilot uses AI. Check for mistakes.
40 changes: 40 additions & 0 deletions MLK-Justice-Sweep/SECURITY_POLICIES.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
# Security Policies

## 1. Threat model

- **Adversaries:**
- External attackers attempting unauthorized access.
- Insiders attempting to erase or alter forensic evidence.
- Malicious automation (bots, worms, scripts) attempting lateral movement.

- **Assets:**
- Access logs, auth logs, system logs.
- Configuration snapshots.
- Integrity vault records.
- Turbo Stack / Krystal Core anchor proofs.

- **Key goals:**
- Detect anomalies and possible backdoors.
- Preserve tamper-evident records.
- Provide structured reports to appropriate entities.

## 2. Log integrity

- Log entries are:
- Hashed with a cryptographic hash.
- Linked via hash chains (each entry includes previous hash).
- Optionally anchored via Turbo Stack Krystal Core satellite relay.

## 3. Least privilege

- Each component runs under a restricted role:
- Collector: read-only on logs.
- Analyzer: read-only on collected data.
- Vault: append-only on integrity store.
- Satellite client: outbound-only to trusted relay endpoints.

## 4. Privacy and governance

- Use only operationally necessary data in analysis.
- Document retention policies and deletion criteria.
- Any external reporting must comply with local laws and contracts.
Loading
Loading