Apply estate standardization: governance docs, contractiles, CI/CD cleanup

Author: hyperpolymath

.github/CODEOWNERS

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MPL-2.0
+# CODEOWNERS - Define code review assignments for GitHub
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default: sole maintainer for all files
+* @hyperpolymath
+
+# Security-sensitive files require explicit ownership
+SECURITY.md @hyperpolymath
+.github/workflows/ @hyperpolymath
+.machine_readable/ @hyperpolymath
+contractiles/ @hyperpolymath
+
+# License files
+LICENSE @hyperpolymath
+LICENSES/ @hyperpolymath
+
+# Configuration
+.gitignore @hyperpolymath
+.github/ @hyperpolymath
+
+# Documentation
+README* @hyperpolymath
+CONTRIBUTING* @hyperpolymath
+CODE_OF_CONDUCT* @hyperpolymath
+GOVERNANCE* @hyperpolymath
+MAINTAINERS* @hyperpolymath
+CHANGELOG* @hyperpolymath
+ROADMAP* @hyperpolymath
+
+# Build and CI
+Justfile @hyperpolymath
+Makefile @hyperpolymath
+*.sh @hyperpolymath

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Bug report
 about: Create a report to help us improve

.github/ISSUE_TEMPLATE/custom.md

@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Custom issue template
 about: Describe this issue template's purpose here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Feature request
 about: Suggest an idea for this project

.github/workflows/governance.yml

@@ -32,3 +32,4 @@ permissions:
 jobs:
   governance:
     uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+    timeout-minutes: 10

.machine_readable/6a2/AGENTIC.a2ml

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# AGENTIC.a2ml — AI agent constraints and capabilities
+# Defines what AI agents can and cannot do in this repository.
+
+[metadata]
+version = "0.1.0"
+last-updated = "2026-04-11"
+
+[agent-permissions]
+can-edit-source = true
+can-edit-tests = true
+can-edit-docs = true
+can-edit-config = true
+can-create-files = true
+
+[agent-constraints]
+# What AI agents must NOT do:
+# - Never use banned language patterns (believe_me, unsafeCoerce, etc.)
+# - Never commit secrets or credentials
+# - Never use banned languages (TypeScript, Python, Go, etc.)
+# - Never place state files in repository root (must be in .machine_readable/)
+# - Never use AGPL license (use MPL-2.0)
+
+[maintenance-integrity]
+fail-closed = true
+require-evidence-per-step = true
+allow-silent-skip = false
+require-rerun-after-fix = true
+release-claim-requires-hard-pass = true
+
+# ============================================================================
+# METHODOLOGY (ADR-002)
+# ============================================================================
+# Detailed methodology configuration lives in:
+#   .machine_readable/bot_directives/methodology.a2ml
+#   .machine_readable/bot_directives/coverage.a2ml
+#   .machine_readable/bot_directives/debt.a2ml
+#
+# AGENTIC.a2ml declares WHAT agents can do (permissions, gating).
+# bot_directives/ declares HOW agents should work (methodology).
+
+[methodology]
+instructions-dir = ".machine_readable/bot_directives/"
+default-mode = "hybrid"
+
+[automation-hooks]
+# on-enter: Read 0-AI-MANIFEST.a2ml, then STATE.a2ml, then bot_directives/
+# on-exit: Update STATE.a2ml, coverage.a2ml, and debt.a2ml with session outcomes
+# on-commit: Run just validate-rsr

.machine_readable/6a2/ECOSYSTEM.a2ml

@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: MPL-2.0
+# ECOSYSTEM.a2ml — Ecosystem position
+# Converted from ECOSYSTEM.scm on 2026-04-14
+
+[metadata]
+project = "pseudoscript"
+ecosystem = "hyperpolymath"
+
+[position]
+type = "programming-language"
+purpose = "Pseudocode-syntax AffineScript. Write code that looks like pseudocode. Get affine resource guarantees and typed WASM out."
+
+[pipeline]
+position = "co-product"
+chain = "katagoria → typell → typed-wasm → PanLL"
+notes = "PseudoScript compiles to typed WasmGC. TypeLL grounds its type system. typed-wasm provides the shared binary layout and ABI conventions."
+coordination = "nextgen-typing"
+
+[related-projects]
+projects = [
+  { name = "typell", relationship = "type-theory-foundation", notes = "TypeLL's open-ended progressive framework grounds PseudoScript's type system. typell-pseudoscript bridge crate." },
+  { name = "typed-wasm", relationship = "aggregate-library", notes = "Shared binary layout conventions for WasmGC cross-language calls. PseudoScript Option[T]/Result[T,E]/String have agreed layouts here." },
+  { name = "nextgen-typing", relationship = "coordination-parent", notes = "Coordination monorepo for the type theory pipeline. Canonical architecture doc." },
+  { name = "affinescript", relationship = "foundation", notes = "PseudoScript is a syntactic face of AffineScript." },
+  { name = "rattlescript", relationship = "sibling", notes = "Both are syntactic faces of AffineScript." },
+  { name = "ephapax", relationship = "sibling-wasm-target", notes = "Both compile to typed WasmGC. Independent designs; converge at binary level via typed-wasm." },
+  { name = "katagoria", relationship = "research-upstream", notes = "Type theory research origination. Future PseudoScript type system extensions may originate there." },
+  { name = "panll", relationship = "consumer", notes = "PseudoScript is one of PanLL's development language targets." },
+]

.machine_readable/6a2/META.a2ml

@@ -0,0 +1,53 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# META.a2ml — Project meta-level information
+# Architecture decisions, design rationale, governance.
+
+[metadata]
+version = "0.1.0"
+last-updated = "2026-04-11"
+
+[project-info]
+type = "library"  # TODO: update type (library|binary|service|website|monorepo)  # library | binary | monorepo | service | website
+languages = []             # e.g. ["rust", "zig", "idris2"]
+license = "MPL-2.0"
+author = "Jonathan D.A. Jewell (hyperpolymath)"
+
+[architecture-decisions]
+# ADR format: status = proposed | accepted | deprecated | superseded | rejected
+# - { id = "ADR-001", title = "Use Zig for FFI", status = "accepted", date = "2026-02-14" }
+
+[development-practices]
+build-tool = "just"
+container-runtime = "podman"
+ci-platform = "github-actions"
+package-manager = "guix"  # guix | nix | cargo | mix
+
+[maintenance-axes]
+scoping-first = true
+execution-order = "axis-1 > axis-2 > axis-3"
+axis-1 = "must > intend > like"
+axis-2 = "corrective > adaptive > perfective"
+axis-3 = "systems > compliance > effects"
+
+[scoping]
+sources = "README, roadmap, status docs, maintenance checklist, CI/security docs"
+marker-scan = "TODO/FIXME/XXX/HACK/STUB/PARTIAL"
+idris-unsound-scan = "believe_me/assert_total"
+
+[axis-2-maintenance-rules]
+corrective-first = true
+adaptive-second = true
+adaptive-focus = "scope-change reconciliation, stale-reference removal, obsolete-work culling"
+perfective-third = true
+perfective-source = "axis-1 honest state after corrective/adaptive updates"
+
+[axis-3-audit-rules]
+audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"
+compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"
+drift-risk-example = "single exception broadening into policy violation (e.g. ReScript->TypeScript spread)"
+effects-evidence = "benchmark execution/results and maintainer status dialogue/review"
+
+[design-rationale]
+# Key design decisions and their reasoning

.machine_readable/6a2/NEUROSYM.a2ml

@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# NEUROSYM.a2ml — Neurosymbolic integration metadata
+# Configuration for Hypatia scanning and symbolic reasoning.
+
+[metadata]
+version = "0.1.0"
+last-updated = "2026-04-11"
+
+[hypatia-config]
+scan-enabled = true
+scan-depth = "standard"  # quick | standard | deep
+report-format = "logtalk"
+
+[symbolic-rules]
+# Custom symbolic rules for this project
+# - { name = "no-unsafe-ffi", pattern = "believe_me|unsafeCoerce", severity = "critical" }
+
+[neural-config]
+# Neural pattern detection settings
+# confidence-threshold = 0.85
+# model = "hypatia-v2"

.machine_readable/6a2/PLAYBOOK.a2ml

@@ -0,0 +1,137 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# PLAYBOOK.a2ml — Operational playbook
+# Runbooks, incident response, deployment procedures.
+
+[metadata]
+version = "0.1.0"
+last-updated = "2026-04-11"
+
+[deployment]
+# method = "gitops"  # gitops | manual | ci-triggered
+# target = "container"  # container | binary | library | wasm
+
+[incident-response]
+# 1. Check .machine_readable/STATE.a2ml for current status
+# 2. Review recent commits and CI results
+# 3. Run `just validate` to check compliance
+# 4. Run `just security` to audit for vulnerabilities
+
+[release-process]
+# 1. Update version in STATE.a2ml, META.a2ml, Justfile
+# 2. Run `just release-preflight` (validate + quality + security + maint-hard-pass)
+# 3. Optional local permission hardening: `just perms-snapshot && just perms-lock`
+# 4. Tag and push
+# 5. Restore local permissions if needed: `just perms-restore`
+# 6. Run `just container-push` if applicable
+
+[maintenance-operations]
+# Baseline audit:
+#   just maint-audit
+# Hard release gate:
+#   just maint-hard-pass
+# Permission audit:
+#   just perms-audit
+
+[rsr-repo-skeleton]
+# Canonical organisation of any RSR-derived repository.
+# Used by tooling, human onboarding, and the scheduled downstream sweep agent.
+# The 5-PR cleanup pattern (below) brings a non-conforming repository into
+# compliance with this skeleton.
+#
+# This section is the single source of truth for "what does an RSR repo look
+# like?". Other docs (TOPOLOGY, AUDIT, etc.) describe the repo at hand;
+# this describes the canonical shape that all RSR repos share.
+
+skeleton-version = "1.0"
+last-updated = "2026-04-30"
+authority-allowlist = ".machine_readable/root-allow.txt"
+enforcement-workflow = ".github/workflows/estate-rules.yml"
+
+# === Required at root ===
+# README.adoc          High-level pitch (project entry point)
+# AUDIT.adoc           Local gate summary (release-readiness)
+# EXPLAINME.adoc       Developer deep-dive (architecture & invariants)
+# 0-AI-MANIFEST.a2ml   AI agent work-allocation policy
+# LICENSE              Repo license (root-bound by convention)
+# CHANGELOG.md         One of the recognised .md exceptions (see below)
+# Justfile             Task runner — thin, imports per-section files from build/just/
+# coordination.k9      Repo-local session binding
+
+# === Required directories ===
+# .github/             CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/
+# .machine_readable/   AI manifests (0.1-AI-MANIFEST.a2ml), 6a2/ checkpoints,
+#                      contractiles/, configs/, anchors/, policies/, scripts/, svc/
+# build/               contractile.just, flake.nix, guix.scm, Containerfile,
+#                      just/*.just (Justfile section imports)
+# docs/                onboarding/, status/, architecture/, governance/  (all .adoc)
+# session/             dispatch.sh, custom-checks.k9, local-hooks.sh
+# src/                 Project source (Idris2 ABI under abi/, Zig FFI under ffi/)
+# tests/, benches/, examples/, features/, scripts/, verification/, container/
+
+# === Documentation format rule ===
+# `.adoc` is the default for all general docs (TOPOLOGY, READINESS, ROADMAP,
+# TEST-NEEDS, PROOF-NEEDS, PROOF-STATUS, llm-warmup-*, etc.).
+#
+# `.md` is reserved ONLY for files GitHub's community-health rules
+# special-case by name:
+#   CONTRIBUTING.md  CODE_OF_CONDUCT.md  SECURITY.md  CHANGELOG.md
+#
+# Enforcement: `scripts/check-no-md-in-docs.sh` (fails if any *.md under docs/).
+
+# === Banned: ziguage ===
+# V (vlang.io) is banned estate-wide. Replaced by `zig-unified-api-adapter`
+# (16 endpoints + transaction-based firewall gating). Do not introduce
+# zig code, scaffolders, or references. Note that Coq theorem files use
+# the same `.v` extension and are unaffected — the rule looks at content
+# patterns, not the extension.
+#
+# Enforcement: `scripts/check-no-vlang.sh`.
+
+# === Justfile structure (post-split) ===
+# The root Justfile is thin — it holds `set` directives, project metadata
+# variables, and the `default`/`help`/`info` recipes. Each major section
+# lives in its own file under build/just/ and is brought in via `import?`.
+#
+# Imported sections (in the canonical split):
+#   build/just/init.just       INIT recipe (template bootstrap)
+#   build/just/assess.just     self-assess + verify (OpenSSF compliance)
+#   build/just/validate.just   validate-rsr/state/ai-install + aggregate
+#   build/just/proofs.just     proof-check-{all,idris2,lean4,agda,coq},
+#                              proof-scan-dangerous, proof-status
+#   build/just/groove.just     Groove protocol setup (after zig removed)
+#
+# Daily-use recipes (BUILD, TEST, LINT, RUN, DEPS, DOCS, CONTAINER, CI,
+# SECURITY, STATE, GUIX/NIX, MATRIX, VERSION CONTROL, UTILITIES, SESSION)
+# stay in the root Justfile where users expect to find them.
+
+# === 5-PR cleanup pattern ===
+# Apply these branches (in order) to bring a non-conforming downstream repo
+# into compliance with this skeleton:
+#
+# 1. chore/root-cleanup       Relocate root sprawl per root-allow.txt; add
+#                             scripts/check-root-shape.sh; remove stub
+#                             health files shadowed by .github/ versions.
+# 2. chore/remove-zig      Purge zig remnants (gen-v-connector recipe,
+#                             "V-TRIPLE" section header, "V-triple
+#                             connectors" comment in groove.a2ml).
+# 3. chore/md-to-adoc         Port general docs in docs/ from .md to .adoc;
+#                             update validate-template.sh to accept .adoc
+#                             fallbacks.
+# 4. chore/estate-rules-ci    Add scripts/check-no-md-in-docs.sh + check-no-
+#                             vlang.sh + .github/workflows/estate-rules.yml.
+# 5. chore/<repo>-hygiene     Repo-specific drift cleanup (case collisions,
+#                             template-derivation drift in titles, etc.).
+
+# === Reference scripts ===
+# scripts/check-root-shape.sh      Root allowlist validator
+# scripts/check-no-md-in-docs.sh   AsciiDoc-by-default validator
+# scripts/check-no-vlang.sh        zig ban validator
+# scripts/validate-template.sh     Aggregate RSR compliance (workflows, SPDX, etc.)
+
+# === Reference memory entries (for AI agents) ===
+# feedback_adoc_default_md_for_githealth   AsciiDoc-by-default rule
+# feedback_v_lang_banned                   zig ban
+# project_zig_unified_api                  Replacement for v-triple/zig
+# feedback_gh_workflow_scope               OAuth scope for workflow files