mirror of https://github.com/luxfi/brand-rules.git synced 2026-10-30 17:01:22 +00:00

Files

T

zeekay 36e8a74835 feat(@luxfi/brand-rules): v0.1.0 — per-org brand sovereignty banlists

One published package for LP-0010 / HIP-0303 / ZIP-0031 / PIP-0006 /
LIP-0006 (no-crossover) enforcement. Replaces per-org copies of the
brand-rules YAML files with a single source of truth that:

  * Ships the 5 per-org rule files (rules/{lux,hanzo,zoo,pars,liquidity}.yml)
  * Exports a programmatic loader (rulesFor / rulePath / SUPPORTED_ORGS)
  * Provides a node CLI (brand-check) that mirrors the bash validator
  * Provides the bash validator (scripts/brand-check.sh) for legacy use
  * Adds ZIP-0031 §6 academic-collab exemptions for zoo (model_card*,
    *.bib, papers/**, datasets/**/README*)

CI workflows (ci.yml) run lint + unit tests + CLI smoke against clean
and dirty fixtures. publish.yml fires on v* tags using the luxfi org
NPM_TOKEN secret.

Co-existing with hanzoai/.github's vendored copies until npm publish
is live; consumer-side swap PR follows.

Tests: 20/20 passing. CLI flags dirty fixture with 5 violations across
2 files, exit 1; clean fixture exits 0.

2026-05-30 01:23:02 -07:00

3.6 KiB

Raw Permalink Blame History

@luxfi/brand-rules

Per-org brand sovereignty banlists for LP-0010 / HIP-0303 / ZIP-0031 / PIP-0006 / LIP-0006 enforcement. One source of truth, consumed by:

The reusable CI workflow at hanzoai/.github/.github/workflows/brand-sovereignty.yml
The local pre-push validator (brand-check CLI shipped with this package)
Any future tooling that needs the canonical banlist per org

Why

Each org's repos must never advertise the brand identity of a sibling org or downstream tenant. Cross-org tooling references (Go module imports, npm packages, container image refs) are legitimate; cross-org brand strings are not. This package codifies the line between the two for each org.

Install

pnpm add -D @luxfi/brand-rules   # or: npm i -D, bun add -D

Use — programmatic

import { rulesFor, SUPPORTED_ORGS } from '@luxfi/brand-rules'

console.log(SUPPORTED_ORGS) // ['lux', 'hanzo', 'zoo', 'pars', 'liquidity']

const lux = rulesFor('lux')
console.log(lux.forbidden_in_source) // ['Liquidity.io', 'Liquidity LLC', ...]
console.log(lux.exempt_paths)        // ['**/go.mod', '**/go.sum', ...]
console.log(lux.exempt_patterns)     // ['github\\.com/luxfi/', ...]

Use — CLI

# inside any git repo
npx brand-check lux             # diff merge-base..HEAD vs lux rules
npx brand-check hanzo all       # full-tree scan vs hanzo rules
npx brand-check liquidity main  # diff main..HEAD vs liquidity rules

Exit codes: 0 clean, 1 violations, 2 usage / config error.

Use — CI workflow (consumer side)

In any repo's .github/workflows/brand-sovereignty.yml:

name: Brand Sovereignty
on:
  pull_request:
  push:
    branches: [main]
jobs:
  check:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: actions/setup-node@v4
        with: { node-version: 22 }
      - run: npm i -g @luxfi/brand-rules@^0.1.0
      - run: brand-check <org>   # one of: lux hanzo zoo pars liquidity

Rule file shape

org: <org-id>
forbidden_in_source:
  - "<literal substring>"      # banned anywhere in source
  - ...
exempt_paths:
  - "**/<glob>"                 # files where forbidden strings are OK
  - ...
exempt_patterns:
  - '<regex>'                   # if a hit line also matches, ignore
  - ...

See rules/ for the per-org files.

Specs

LP-0010 — Lux brand discovery + sovereignty (canonical)
HIP-0303 — Hanzo brand discovery (pointer to LP-0010)
ZIP-0031 — Zoo brand discovery + academic-collab exception (pointer to LP-0010)
PIP-0006 — Pars brand discovery (pointer to LP-0010)
LIP-0006 — Liquidity brand discovery (pointer to LP-0010 §7)

Per-org notes

Org	Bans	Tightest rule
lux	Liquidity, Hanzo, Zoo, Pars brand strings	"Liquidity.io" string
hanzo	Lux, Zoo, Pars, Liquidity brand strings	symmetric to lux
zoo	Lux, Hanzo, Pars, Liquidity. Plus academic-collab exempt.	model_card, .bib
pars	Lux, Hanzo, Zoo, Liquidity brand strings	symmetric to lux
liquidity	Everything upstream: Lux/luxfi, Hanzo, Zoo, Pars	regulatory isolation

Liquidity is the broadest because it has US-jurisdiction regulatory isolation requirements per LP-0010 §7 and LIP-0006. Tooling imports survive via exempt_patterns.

License

BSD-3-Clause. See LICENSE.

3.6 KiB Raw Permalink Blame History