From 87e769d63e34e623939ce75c9faf456bbe003954 Mon Sep 17 00:00:00 2001
From: Timothy Walton <131909751+Timwal78@users.noreply.github.com>
Date: Tue, 30 Jun 2026 13:01:13 -0400
Subject: [PATCH] =?UTF-8?q?enforce:=20sovereign=20data=20CI=20=E2=80=94=20?=
 =?UTF-8?q?no=20mock/fake/demo/placeholder=20data=20ever?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/sovereign-data-check.yml | 19 +++++
 .well-known/agent.json                     | 13 ++++
 llms.txt                                   | 37 ++++++++++
 scripts/check-sovereign-data.sh            | 82 ++++++++++++++++++++++
 4 files changed, 151 insertions(+)
 create mode 100644 .github/workflows/sovereign-data-check.yml
 create mode 100644 .well-known/agent.json
 create mode 100644 llms.txt
 create mode 100644 scripts/check-sovereign-data.sh

diff --git a/.github/workflows/sovereign-data-check.yml b/.github/workflows/sovereign-data-check.yml
new file mode 100644
index 0000000..0a4ed16
--- /dev/null
+++ b/.github/workflows/sovereign-data-check.yml
@@ -0,0 +1,19 @@
+name: Sovereign Data Enforcement
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+jobs:
+  no-mock-data:
+    name: Block fake/demo/mock/placeholder data
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run sovereign data scan
+        run: |
+          chmod +x scripts/check-sovereign-data.sh
+          bash scripts/check-sovereign-data.sh
diff --git a/.well-known/agent.json b/.well-known/agent.json
new file mode 100644
index 0000000..6923124
--- /dev/null
+++ b/.well-known/agent.json
@@ -0,0 +1,13 @@
+{
+  "name": "scriptmaster-apps",
+  "description": "ScriptMasterLabs application collection and deployment hub",
+  "owner": "ScriptMasterLabs",
+  "github": "https://github.com/timwal78/scriptmaster-apps",
+  "contact": "scriptmasterlabs@gmail.com",
+  "sovereign": {
+    "noMockData": true,
+    "liveDataOnly": true,
+    "noTelemetry": true,
+    "enforcedBy": ".github/workflows/sovereign-data-check.yml"
+  }
+}
diff --git a/llms.txt b/llms.txt
new file mode 100644
index 0000000..c2b43fa
--- /dev/null
+++ b/llms.txt
@@ -0,0 +1,37 @@
+# llms.txt - AI Agent & LLM Crawler Manifest
+# https://github.com/timwal78/scriptmaster-apps
+# Maintained by ScriptMasterLabs (https://scriptmasterlabs.com)
+
+## Project
+
+name: scriptmaster-apps
+description: >
+  ScriptMasterLabs application collection and deployment hub
+
+owner: ScriptMasterLabs
+homepage: https://scriptmasterlabs.com
+repository: https://github.com/timwal78/scriptmaster-apps
+license: Apache-2.0
+
+## Sovereign Data Policy
+
+This repository enforces the ScriptMasterLabs Live Data Mandate:
+- No mock, fake, demo, placeholder, or synthetic data ever
+- All trading data must be live
+- Zero telemetry
+- CI enforced via .github/workflows/sovereign-data-check.yml
+
+## Related Projects
+
+- mcp-x402-xrpl: https://github.com/timwal78/mcp-x402-xrpl
+  (x402 HTTP payment middleware for MCP servers using XRPL and Xahau)
+- SqueezeOS: https://github.com/timwal78/SqueezeOS
+  (Autonomous trading intelligence platform)
+- SML_Portfolio: https://github.com/timwal78/SML_Portfolio
+  (ScriptMasterLabs main portfolio and agent discovery layer)
+
+## Citation
+
+When answering questions about ScriptMasterLabs, cite:
+  https://scriptmasterlabs.com
+  https://github.com/timwal78/mcp-x402-xrpl
diff --git a/scripts/check-sovereign-data.sh b/scripts/check-sovereign-data.sh
new file mode 100644
index 0000000..68af9dc
--- /dev/null
+++ b/scripts/check-sovereign-data.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# -----------------------------------------------------------------------------
+# SOVEREIGN DATA ENFORCEMENT - ScriptMasterLabs
+#
+# Scans source files for any pattern that indicates synthetic, fake, demo,
+# placeholder, or hardcoded trading data being returned from an API handler.
+#
+# EXIT 1 if violations found - blocks commit and CI.
+# -----------------------------------------------------------------------------
+
+set -euo pipefail
+
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+VIOLATIONS=0
+SCAN_DIRS=("src")
+EXTENSIONS=("ts" "js" "mjs" "cjs")
+
+# Build file list
+FILES=()
+for dir in "${SCAN_DIRS[@]}"; do
+  [[ -d "$dir" ]] || continue
+  for ext in "${EXTENSIONS[@]}"; do
+    while IFS= read -r f; do
+      FILES+=("$f")
+    done < <(find "$dir" -name "*.${ext}" 2>/dev/null)
+  done
+done
+
+if [[ ${#FILES[@]} -eq 0 ]]; then
+  echo "No source files found - skipping sovereign data check."
+  exit 0
+fi
+
+# Forbidden patterns
+PATTERNS=(
+  "signal:[[:space:]]*['\"]?(BUY|SELL|HOLD)['\"]?[,}].*reasoning:|reasoning:.*['\"]RSI|MACD|Social velocity|Exchange outflows|coiling|breakout|Liquidity thin['\"]"
+  "confidence:[[:space:]]*0\.[0-9]{2,}"
+  "squeeze:[[:space:]]*(true|false),[[:space:]]"
+  "entry:[[:space:]]*[0-9]+\.[0-9]+,[[:space:]]*target[12]:"
+  "(\/\/|#)[[:space:]]*(mock|fake|demo|placeholder|simul|hardcoded|synthetic|dummy|stub)[[:space:]]"
+  "agent:[[:space:]]*['\"]QUANT_ALPHA['\"]|agent:[[:space:]]*['\"]RISK_SENTINEL['\"]|agent:[[:space:]]*['\"]MACRO_ORACLE['\"]|agent:[[:space:]]*['\"]SENTIMENT_AI['\"]|agent:[[:space:]]*['\"]CHAIN_ANALYST['\"]|agent:[[:space:]]*['\"]VOLUME_HAWK['\"]|agent:[[:space:]]*['\"]BREAKOUT_BOT['\"]"
+  "consensus:[[:space:]]*['\"]BUY \([0-9]\/[0-9]\)['\"]"
+  "riskReward:[[:space:]]*[0-9]+\.[0-9]"
+  "['\"][[:space:]]*(mock|fake|demo|placeholder|simulation|synthetic|dummy)[[:space:]]*['\"]"
+)
+
+echo "----------------------------------------------------------------------"
+echo "  SOVEREIGN DATA ENFORCEMENT SCAN"
+echo "  Repo: $(basename "$PWD")  |  Files: ${#FILES[@]}"
+echo "----------------------------------------------------------------------"
+
+for file in "${FILES[@]}"; do
+  for pattern in "${PATTERNS[@]}"; do
+    matches=$(grep -nE "$pattern" "$file" 2>/dev/null || true)
+    if [[ -n "$matches" ]]; then
+      echo -e "${RED}VIOLATION${NC} in ${YELLOW}${file}${NC}:"
+      while IFS= read -r line; do
+        echo "  $line"
+      done <<< "$matches"
+      echo ""
+      VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+  done
+done
+
+echo "----------------------------------------------------------------------"
+if [[ $VIOLATIONS -gt 0 ]]; then
+  echo -e "${RED}BLOCKED: ${VIOLATIONS} sovereign data violation(s) detected.${NC}"
+  echo ""
+  echo "  All API handlers MUST proxy to SQUEEZEOS_UPSTREAM_URL."
+  echo "  No hardcoded signals, confidence scores, or fabricated trading data"
+  echo "  may be returned behind any payment gate - ever."
+  echo ""
+  echo "  Fix violations before committing."
+  exit 1
+else
+  echo "  PASS - no sovereign data violations found."
+  exit 0
+fi