chore: standardize .machine_readable to 06-12 estate layout

[hyperpolymath]

Summary

Standardizes Axiology.jl to the 06-12 estate gold standard for .machine_readable/ layout and governance. Two logical commits; docs/metadata only — Julia test suite unaffected.

What changed

• Governance scaffold pulled from estate-standardization-20260607: GOVERNANCE.adoc, MAINTAINERS.adoc, CODE_OF_CONDUCT.md, CONTRIBUTING.md, .github/CODEOWNERS, ISSUE_TEMPLATE, 6a2/0-AI-MANIFEST.a2ml, 6a2/README.adoc, contractiles/Justfile.
• Four template-leaked contractiles rewritten for Axiology.jl identity (see below).
• Bustfile.a2ml + Dustfile.a2ml added (flat, missing from estate set and from the pre-estate nested contractiles/bust/dust/).
• bot_directives estate trio added: hypatia.a2ml, gitbot-fleet.a2ml, git-private-farm.a2ml.
• STATE.a2ml + META.a2ml refreshed: last-updated → 2026-06-13; completion 0 → 65%; build stats, milestones landed/open, architecture and design-decision records added.

Template-leak fix (FLAGGED)

The estate branch carried four un-substituted rsr-template-repo copies. All four claimed to be the "canonical RSR template repository" or named rsr-template-repo explicitly:

File	What the template said	Fixed to
Mustfile.a2ml	rsr-template-repo; checked old nested layout (contractiles/bust/, self-validating/k9-svc/) as critical	Axiology.jl identity; flat 06-12 layout checks; Julia test gate
Intentfile.a2ml	template repo-initialization intents ("provide copy-and-substitute template for new repos")	Axiology.jl north-star: value-theory Julia library, Idris2 ABI + Zig FFI
Adjustfile.a2ml	drift checks for "template placeholders" and "template version"	Axiology.jl drift bands: state currency, test baseline, FFI source, SPDX
Trustfile.a2ml	rsr-template-repo; trust-deny scoped to "template files"	Axiology.jl identity; trust-deny scoped to src/abi/, ffi/zig/, workflows

Instant-sync / propagation

instant-sync.yml is present → propagation is LIVE. Secret name used: FARM_DISPATCH_TOKEN. Target: hyperpolymath/.git-private-farm. Recorded in git-private-farm.a2ml.

Scope EXCLUDES

• Full SPDX/REUSE header sweep (left to estate rollout).
• CI campaigns or workflow changes.
• Julia test suite (untouched; 43/45 baseline unchanged).

https://claude.ai/code/session_01PWMMxryCcPrAjJ8tuGvygG

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 28 issues detected

Severity	Count
🔴 Critical	0
🟠 High	21
🟡 Medium	7

View findings

[
  {
    "reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
    "type": "codeql_language_matrix_mismatch",
    "file": "codeql.yml",
    "action": "switch_codeql_matrix_to_actions",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence