Reference
Standards
A standard is one named shape every project in the estate
satisfies. Each standard lives as a directory in the
repo holding
three artifacts: prose (CONTRACT.md) describing the
intent, executable assertions (check.sh) that prove
conformance, and templates a consumer can lift to satisfy the
assertions without writing from scratch.
Run them against any project via the
reference-check catalog component (CI) or
just check (local).
The set
container-publishing
Container images published from estate repos are built via the dunn.dev/pipeline `container-image` catalog component and inherit cosign keyless signatures + UBI bases.
design-system
Every site in the estate consumes `@dunn.dev/reference` for tokens and chrome rather than vendoring them.
image-cleanup
Container registries with active publishing have a cleanup policy so short-sha builds don't accumulate forever, and that policy's keep-pattern actually matches the tags the project publishes. Annotated-tag releases and cosign signatures stay; main-branch short-sha builds rotate.
package-publishing
Estate packages (Go binaries, npm tarballs, Rust crates, container images) ship with SBOM + cosign signature + SLSA L2 provenance attestation. Catalog templates handle the wiring.
pipeline
A single estate-wide CI catalog at `dunn.dev/pipeline` is the source of CI job shape for app projects, alongside the `dunn.dev/cairn` and `dunn.dev/immutable` sub-catalogs for bootc OS-image composition. Projects consume any of the three at a bare major, major.minor or major.minor.patch pin. Never `@latest` or `@main` on any of them. Catalog improvements raise every project at once.
repository
Every repo in the estate ships the same skeleton of avatar, hero, favicon and brand.png with token-whitelisted SVGs, LICENSE, CODEOWNERS, README with hero embed and three-badge row.
voice
Estate writing convention for anything that leaves the Den. Direct, no em-dashes, no filler. Applies to MR/PR descriptions, commit bodies, issue replies, runbooks, README prose, advisories, and any markdown shipped or sent to humans outside this project.
worker
A repo that deploys a Cloudflare Worker enables observability and observability logs in its wrangler config, and sets workers_dev = false.