Download the PHP package waaseyaa/anokii without Composer

Anokii

Anokii (working name — Anishinaabemowin verb stem meaning "she/he works"; pending language-keeper verification before public use) is the first opinionated distribution built on the Waaseyaa framework.

Anokii is an alpha-stage workspace distribution being designed with First Nations data sovereignty, accessibility, and local ownership as product requirements. Those outcomes require deployment-specific governance and verification; this repository does not claim that installing the software alone establishes OCAP compliance, AODA conformance, or an offline-capable service.

What Anokii is

The current repository contains an authenticated server-rendered workspace baseline (Identity, Documents, Drive, Pages, Inbox, and cookieless first-party Analytics) plus an opt-in public graph-chat experiment. The following broader product surfaces are roadmap items, not shipped guarantees:

• Governed Drive — Nation-scoped file storage with OCAP classification
• Form Builder — Governed community data capture with offline queue
• Tasks — Governance-aware task tracking
• Data Rooms — Sensitive-data workspaces with per-record access control
• Governed Docs — Collaborative document authoring with conflict resolution
• Governed Sheets — Tabular data with classification-aware field access
• Co-Intelligence Workspaces — Per-record AI access (OCAP A5 flagship)
• Admin Centre — Distribution administration and Nation tenant management

Workforce directory integration (Microsoft Entra ID, SCIM, or on-premises Active Directory Domain Services) is at the discovery stage. No connector is designed, authorized, or shipped, and the record is a research input for Nation-owned decisions rather than a commitment. See docs/architecture/workforce-directory-discovery.md.

Current security posture:

• Workspace routes require authenticated accounts and immutable authorization principals.
• Write actions use server-side permission checks; sealed account fields are read through audited, purpose-scoped framework boundaries.
• Uploads are content-sniffed, size-bounded, and served with restrictive download headers.
• Raw public-chat questions are not retained or written to application logs.

Important limitations:

• Sovereign mode now stamps and scopes Anokii-owned persistent entities to the configured active community and classifies their fields. That is a technical isolation boundary, not by itself proof of an installation's governance, OCAP compliance, or operating practices.
• Offline operation, formal AODA/WCAG conformance, email-change verification, and the roadmap surfaces below remain unshipped until their acceptance gates exist and pass.

Framework vs distribution

Anokii is a distribution — it consumes Waaseyaa via Packagist and adds:

• Opinionated entity types and classification taxonomies for First Nations governance
• Deployer recipes and Nation tenant configuration conventions
• Product-surface UI bundles (Nuxt 3 + Vue 3) with the deep-teal brand baseline
• Indigenous-language translation pipeline (English ↔ Anishinaabemowin, piloting with Sagamok Anishnawbek First Nation then Sheguiandah)

Waaseyaa is the substrate — entity system, storage, access control, API, AI pipeline, SSR, MCP endpoint. Anokii never modifies Waaseyaa from inside this repo. Generally useful improvements are upstreamed as framework-targeted missions filed against the Waaseyaa repo.

Composable capabilities

This repository is also the source monorepo for narrowly installable Anokii capabilities:

• waaseyaa/anokii-core contains shared sovereignty metadata, safe value normalization, and the immutable-principal-aware access-policy base.
• waaseyaa/anokii-identity contains the one canonical revisionable/translatable Identity Pillar entity, its policy and service, provider metadata, migration inventory, and an opt-in authenticated read-only host surface.
• waaseyaa/anokii-operator contains the composable, brandable operator workspace shell and module contract without pulling in the Anokii distribution.

The create-project distribution requires all three packages and uses that same code for its full standalone workspace. Existing Waaseyaa applications can require only the capabilities they adopt; they do not need waaseyaa/anokii, waaseyaa/full, waaseyaa/ai-agent, or waaseyaa/deployer. Before the first coordinated capability release, consumers pin the split repositories' merged main branches; no machine-relative path repository is a deployment contract.

The host surface is enabled in the framework application's config/waaseyaa.php:

Package installation alone registers the Identity entity and policy. It does not replace a host's login, public routes, admin shell, MCP surface, deployment model, or other content types. See docs/architecture/composable-packages.md.

Framework charter: waaseyaa/.kittify/charter/charter.md

Anokii charter: .kittify/charter/charter.md in this repo (added in Wave 1 scaffold).

How we got here

This repo was scaffolded by mission anokii-distribution-scaffold-01KSEFT7 (Wave 1, parallel to M-A5 in the Waaseyaa framework roadmap). The mission spec lives at kitty-specs/anokii-distribution-scaffold-01KSEFT7/spec.md in the Waaseyaa repo.

Wave 1 scope: repo scaffold + composer.json + Anokii charter + deployer recipe baseline + ten artifact draft specs (8 v0.1 surfaces + 2 cross-cutting).

Status

Alpha — active local hardening. Product code exists, but no release or production deployment should be made from an unverified branch. The local release gate is PHPUnit, PHPStan at max level, PHP-CS-Fixer, locked dependency audit, packaged-form provider boot, and browser/accessibility verification.

Test memory policy

Run the test suite with composer test, or run focused tests directly with vendor/bin/phpunit. Both commands load phpunit.xml.dist, which owns a finite memory_limit=1G ceiling so test discovery does not inherit a developer or CI machine's lower PHP CLI default. The hosted Quality workflow uses the same composer test entrypoint. Do not add ad-hoc php -d memory_limit=... folklore to individual test commands; any future subprocess that launches PHPUnit must either load the canonical configuration or explicitly preserve the same 1G ceiling.

This setting applies only to PHPUnit processes. It does not change production, FrankenPHP, queue, web, or application CLI memory limits.

The representative full suite on PHP 8.5.9 (137 tests, 425 assertions) used 30 MiB as reported by PHPUnit and 92,556 KiB maximum resident set size for the Composer invocation. The 1G ceiling matches the first-party Framework test policy and leaves bounded headroom for discovery and coverage-enabled runs; it is not an unlimited-memory waiver.

Brand palette: Deep Teal (#0d4f4f → #0f766e → #14b8a6) — differentiated from Drupal blue, Laravel red, Django/Nuxt green, Strapi purple. Visible once the admin overlay lands.

Verified development runtime

The supported local development profile is WSL2 Ubuntu 24.04 on x86-64. Use the repository launcher so ambient Composer, Node, npm, and FrankenPHP versions cannot silently change the result:

The launcher is pinned to an exact accepted Framework commit by tools/dev-runtime-source.json. It verifies the local launcher and library, then downloads and verifies the canonical Framework runtime source into a content-addressed user cache. It does not change the caller's shell or global tools. Update the launcher, library, commit, and source hashes together from one reviewed Framework commit; do not copy managed-tool versions into this repository.

Install

Not yet published to Packagist. The following command will work once the first release tag is cut.

In the meantime, clone this repo directly and run composer install.

Release tags are deliberately manual and separately authorized. See docs/releasing.md for the exact validation, tagging, and split-publication boundaries.

Copy .env.example to .env and replace its placeholders. In particular, WAASEYAA_APP_SECRET must be base64: followed by canonical base64 for exactly 32 random bytes (generate one with php -r 'echo "base64:" . base64_encode(random_bytes(32)) . PHP_EOL;'), ANOKII_COMMUNITY_ID must identify this installation's community, ANOKII_PRIVACY_SECRET must be at least 32 random bytes or the analytics ingest endpoint stays unavailable, AUTH_TOKEN_SECRET must be a separate non-empty secret in production (not change-me, not a shipped placeholder, and not omitted so Framework would derive a purpose-specific key from WAASEYAA_APP_SECRET), and TRUSTED_PROXIES must name only proxies you operate so Waaseyaa/Symfony can resolve client addresses without trusting forged forwarding headers.

Before a production-equivalent boot, build the database and its checksum-bound field-access artifact against the exact installed lock:

The final command must succeed. .waaseyaa/field-access-classification.json is reviewed source; .waaseyaa/field-access-preflight.json is generated for the exact lock and schema and must not be copied forward after dependencies or the entity model change.

License

GPL-2.0-or-later. See LICENSE.txt.

Anokii is GPL-2.0-or-later because Waaseyaa is GPL-2.0-or-later (framework DIR-008). Relicensing requires both a framework-charter amendment and an Anokii-charter amendment (Anokii DIR-A004).

Working name

"Anokii" is an Anishinaabemowin verb stem meaning approximately "she/he works" or "she/he is working." This working name is pending verification and approval by a language keeper before it is used publicly. The Anishinaabemowin language is spoken by the Anishinaabe peoples, including the Ojibwe Nations of the Great Lakes region.

Pilot Nations: Sagamok Anishnawbek First Nation (Russell's home Nation; OIATC already on Waaseyaa) and Sheguiandah First Nation. Final Nation selection for the language pipeline pilot is deferred to the language-keeper engagement moment.

How to contribute

Issues and contributions will open once the v0.1 surfaces begin landing. In the meantime:

• Framework contributions: waaseyaa/framework
• Anokii surface missions: tracked via Spec Kitty in this repo (.kittify/)
• Nation partnerships and language-keeper engagement: contact Russell Jones via the OIATC stewards channel