Coffee Chat Roastery

Coffee Chat Roastery is the public, forkable, Bean-free authority for the Standard Roastery contract. This repository owns the closed schemas, fixed CC BY 4.0 Bean-content declaration, canonical validation and index projection, and the publication boundary consumed by the Coffee Chat Plugin. It also provides the empty public seed that users fork before initializing their own Roastery.

The official repository contains no personal Beans or owner attribution. Its canonical fork seed is:

roastery/
├── roastery.json
└── index.json

After the Plugin's accepted Init flow, a personal fork additionally contains roastery/CONTENT_LICENSE.md, rendered only from validated owner attribution after explicit acceptance. roastery/roastery.json is the sole downstream contract pin and identifies the earlier immutable contract commit and digest.

Commands

roastery validate --root <repository> --contract-commit <sha> --contract-digest <sha256> --format json
roastery project-index --root <repository> [--check]
roastery contract-digest --root <repository> --format json
npm run repository:check

All commands are read-only. validate requires the trusted contract commit and digest instead of accepting a repository's self-declared tuple. project-index emits canonical bytes for a trusted caller to place in a reviewed change; --check compares them with the current index. Every command returns structured JSON and fails closed on invalid or unsafe state.

repository:check binds that validation to the executing GitHub repository. GitHub Actions supplies GITHUB_REPOSITORY; isolated callers may pass --expected-repository to the underlying script (or append it after -- when using the npm command). The official repository must remain the Bean-free seed, while an owner fork must carry its own owner/coffee-chat identity and canonical content declaration.

The package API exports the same canonical content-license renderer/parser, contract digest, validator, and index projector used by the CLI. The bundle digest algorithm is documented in contract/README.md.

For local publication work, install Gitleaks and enable the repository-managed hook with npm run hooks:install. Run npm run security:scan for a complete history scan. Required CI performs the same history scan independently.

Rights boundary

Official code, schemas, contracts, policy, tests, and tooling use the root MIT License, Copyright (c) 2026 Openboa AI.

Personal roastery/beans/** content uses the fixed CC BY 4.0 declaration created with owner-provided attribution. Origin URLs and the resources they identify remain outside that Bean-content license. The official Bean-free repository does not install roastery/CONTENT_LICENSE.md.

See SECURITY.md, the Publication Contract, and the quality map for the enforced boundaries.