feat: canonical A2ML dialect = TOML (warn-by-default, enforce flag) (#53)

Estate decision (2026-07-06): **one canonical `.a2ml` dialect = TOML**
(`key = value` / `[section]`). The validator was deliberately polyglot
(accepted TOML, S-expr, *and* YAML-ish identity) — which is exactly how
the estate drifted into three dialects under one extension.

## Change
- **Check 5 (canonical dialect):** flags repo-specific files still
written as YAML (`key:`) or S-expression (`(form ...)`). **Warning by
default** so the estate migrates incrementally; **error** when the new
input `enforce-canonical-dialect: true`.
- AI-manifest templates are **exempt** (they're template-sourced;
converted upstream in `rsr-template-repo`/`standards`, not per-repo —
otherwise every repo drowns in warnings for files it can't fix locally).
- README now **declares TOML canonical**.

Verified: `bash -n` clean, `action.yml` parses, env var wired
(`INPUT_ENFORCE_CANONICAL_DIALECT`).

## The ratchet
1. **This PR** — warn on non-TOML, canon documented. Non-breaking. ✅
2. Convert the `*-AI-MANIFEST.a2ml` + `contractiles/*` templates in
`rsr-template-repo`/`standards` to TOML.
3. Propagate templates to repos.
4. Flip `enforce-canonical-dialect: true` estate-wide → hard
enforcement, one type everywhere.

First consumer already converted its own files:
`hybrid-automation-router` (PR #82).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

README.md

@@ -12,6 +12,16 @@ RSR (Rhodium Standard Repository) projects to declare machine-readable
 metadata, AI agent instructions, and project state. This action scans
 for `.a2ml` files and validates their structure and required fields.
 
+# Canonical dialect: TOML
+
+Estate decision (2026-07-06): the **one canonical A2ML dialect is TOML**
+(`key = value` / `[section]`). Files written in YAML (`key:`) or S-expression
+(`(form ...)`) are non-canonical and should be converted. Check 5 flags them as
+a **warning** by default; set `enforce-canonical-dialect: true` to make it a
+hard **error** once a repository's `.a2ml` files are all converted. AI-manifest
+templates are exempt from this check until they are converted upstream in
+`rsr-template-repo` / `standards`.
+
 # Checks Performed
 
 1.  **SPDX header** — Verifies `SPDX-License-Identifier` is present in

action.yml

@@ -29,6 +29,14 @@ inputs:
       will fail on any validation issue. Defaults to false.
     required: false
     default: 'false'
+  enforce-canonical-dialect:
+    description: >-
+      When true, files written in a non-canonical A2ML dialect (YAML or
+      S-expression instead of canonical TOML) are reported as errors rather
+      than warnings. Defaults to false so the estate can migrate incrementally.
+      Canonical A2ML dialect: TOML (key = value / [section]).
+    required: false
+    default: 'false'
   paths-ignore:
     description: >-
       Newline-separated path fragments to skip. Each line is matched as a
@@ -69,6 +77,7 @@ runs:
       env:
         INPUT_PATH: ${{ inputs.path }}
         INPUT_STRICT: ${{ inputs.strict }}
+        INPUT_ENFORCE_CANONICAL_DIALECT: ${{ inputs.enforce-canonical-dialect }}
         INPUT_PATHS_IGNORE: ${{ inputs.paths-ignore }}
       run: |
         "${GITHUB_ACTION_PATH}/validate-a2ml.sh"

validate-a2ml.sh

@@ -26,6 +26,7 @@ set -euo pipefail
 
 SCAN_PATH="${INPUT_PATH:-.}"
 STRICT="${INPUT_STRICT:-false}"
+ENFORCE_DIALECT="${INPUT_ENFORCE_CANONICAL_DIALECT:-false}"
 PATHS_IGNORE_RAW="${INPUT_PATHS_IGNORE:-}"
 GITHUB_OUTPUT_FILE="${GITHUB_OUTPUT:-/dev/null}"
 
@@ -278,6 +279,32 @@ validate_a2ml() {
             fi
         fi
     done < "$file"
+
+    # --- Check 5: Canonical dialect (TOML) ---
+    # Estate canon (2026-07-06): .a2ml is ONE dialect — TOML (`key = value` /
+    # `[section]`). Flag repo-specific files still written as YAML (`key:`) or
+    # S-expression (`(form ...)`). AI manifests are template-sourced (converted
+    # upstream in rsr-template-repo/standards), so they are exempt here to avoid
+    # estate-wide noise before that conversion lands. Warning by default so the
+    # estate can migrate incrementally; set enforce_canonical_dialect=true to
+    # make it a hard error once conversion is complete.
+    if [[ "$is_manifest" == "false" ]]; then
+        local _sexpr _toml _yaml _dialect=""
+        _sexpr=$(grep -cE '^[[:space:]]*\([a-zA-Z]' "$file" 2>/dev/null || true)
+        _toml=$(grep -cE '^[[:space:]]*(\[[^]]+\]|[A-Za-z0-9_.-]+[[:space:]]*=)' "$file" 2>/dev/null || true)
+        _yaml=$(grep -cE '^[[:space:]]*[A-Za-z0-9_-]+:[[:space:]]' "$file" 2>/dev/null || true)
+        if [[ "${_sexpr:-0}" -gt 2 && "${_toml:-0}" -eq 0 ]]; then
+            _dialect="S-expression"
+        elif [[ "${_yaml:-0}" -gt 2 && "${_toml:-0}" -le 1 ]]; then
+            _dialect="YAML"
+        fi
+        if [[ -n "$_dialect" ]]; then
+            local _sev="warning"
+            [[ "$ENFORCE_DIALECT" == "true" ]] && _sev="error"
+            report_issue "$_sev" "$file" "1" \
+                "Non-canonical A2ML dialect ($_dialect). Canonical A2ML dialect is TOML (key = value / [section]); convert this file."
+        fi
+    fi
 }
 
 # ---------------------------------------------------------------------------