Merge branch 'main' into chore/hypatia-scan-reusable-wrapper

Author: hyperpolymath

.gitattributes

@@ -0,0 +1,2 @@
+# Pending estate-wide policy: hide ReScript from primary-language detection.
+**/*.res linguist-detectable=false

.github/workflows/hypatia-scan.yml

@@ -25,5 +25,5 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@97df762107501909f50bb770e9bc200b6c415600
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89
     secrets: inherit

.github/workflows/scorecard.yml

@@ -1,32 +1,16 @@
 # SPDX-License-Identifier: MPL-2.0
-name: OSSF Scorecard
+name: Scorecards supply-chain security
+
 on:
-  push:
-    branches: [main, master]
+  branch_protection_rule:
   schedule:
-    - cron: '0 4 * * *'
-  workflow_dispatch:
+    - cron: '23 4 * * 1'
+  push:
+    branches: [main]
 
 permissions: read-all
 
 jobs:
   analysis:
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          persist-credentials: false
-
-      - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1
-        with:
-          results_file: results.sarif
-          results_format: sarif
-
-      - name: Upload results
-        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.31.8
-        with:
-          sarif_file: results.sarif
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
+    secrets: inherit

CHANGELOG.md

@@ -0,0 +1,60 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
+-->
+
+# Changelog
+
+All notable changes to `avow-protocol` will be documented in this file.
+
+This file is generated from conventional commits by the
+[`changelog-reusable.yml`](https://github.com/hyperpolymath/standards/blob/main/.github/workflows/changelog-reusable.yml)
+workflow (`hyperpolymath/standards#206`). Adopt the workflow in this repo's CI to keep this file in sync automatically — see
+[`templates/cliff.toml`](https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml)
+for the canonical config.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
+this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- feat: absorb avow-telegram-bot as telegram-bot/ subdirectory
+- feat: deploy 10 projects to Cloudflare Pages with custom domains
+- feat: add custom domain setup script for all three sites
+- feat: successful Cloudflare Pages deployment
+- feat: add Deno-native deployment script and quick deploy guide
+- feat: add Cloudflare deployment configuration and scripts
+- feat: rebrand to AVOW Protocol and implement complete formally verified architecture
+- feat: add critical security workflows
+- feat: integrate k9-svc and A2ML into stamp-website
+- feat: complete proven integration and documentation
+
+### Fixed
+
+- fix(ci): sync hypatia-scan.yml to canonical (413: env.HOME+Phase-2+SARIF) (#3)
+- fix(ci): adopt canonical hypatia-scan.yml (env.HOME/scanner-layout + Comment-step gate) (#1)
+- fix: apply safety triangle fixes (recipe-remove-believe-me)
+- fix: update license from MPL-2.0 to PMPL-1.0-or-later
+- fix: remove duplicate SCM files from root
+- fix: use Deno setup action and task runner for ReScript build
+- fix: use original HTML with full styling
+- fix: install Pandoc in workflow
+
+### Changed
+
+- refactor: replace all TypeScript with ReScript
+
+### Documentation
+
+- docs: add deployment success report for all three sites
+- docs: add DNS zone file for stamp-protocol.org
+
+## Pre-history
+
+Prior commits to this file's introduction are recorded in git history but not formally classified into Keep-a-Changelog sections. To backfill, run `git cliff -o CHANGELOG.md` locally using the canonical [`cliff.toml`](https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml) — this is one-shot mechanical work.
+
+---
+
+<!-- This file was seeded by the 2026-05-26 estate tech-debt audit follow-up (Row-2 Phase 3); see [`hyperpolymath/standards/docs/audits/2026-05-26-estate-documentation-debt.md`](https://github.com/hyperpolymath/standards/blob/main/docs/audits/2026-05-26-estate-documentation-debt.md). -->

docs/tech-debt-2026-05-26.md

@@ -0,0 +1,57 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
+-->
+
+# Tech-Debt Audit — avow-protocol — 2026-05-26
+
+**Source:** estate-wide automated scan 2026-05-26.
+**Companion:** [`hyperpolymath/standards` 2026-05-26-estate-*-debt audits](https://github.com/hyperpolymath/standards/tree/main/docs/audits).
+**Combined severity:** `MEDIUM`.
+
+This file records the *raw findings* — it does not by itself fix the debt. Each section ends with a 'Recommended next move' line; closing the debt is follow-up work.
+
+## 1. Proof debt
+
+No proof-bearing files (`*.v`, `*.lean`, `*.agda`, `*.idr`, `*.idr2`, `*.fst`, `*.dfy`, `*.tla`, `*.ads`, `*.adb`) found in this repo.
+
+**Recommended next move:** none.
+
+## 2. Licence debt
+
+| Field | Value |
+|---|---|
+| LICENSE file | `LICENSE` |
+| SPDX header | `MPL-2.0` |
+| Manifest licence | `MPL-2.0` |
+| Body classifier | `MPL-some` |
+| Severity | `ok` |
+
+**Recommended next move:** none for licence.
+
+## 3. Documentation debt
+
+| Field | Value |
+|---|---|
+| README lines | 237 |
+| `docs/` files | 4 |
+| `docs/` LoC | 222 |
+| CHANGELOG.md | N |
+| CONTRIBUTING.md | Y |
+| CODE_OF_CONDUCT.md | Y |
+| SECURITY.md | Y |
+| Severity | `MEDIUM` |
+
+**Recommended next move:** introduce a `docs/` directory. The README at 237 lines has likely grown to do the work of `docs/` — split it into a thin README + `docs/architecture.md`, `docs/usage.md`, etc. Heavy-wiki exemplars to copy from: `affinescript`, `boj-server`, `echidna`, `hypatia`.
+
+Additionally: **CHANGELOG.md is missing.** 65% of estate repos lack one — adopting a CHANGELOG (or auto-generating via `git-cliff`) is a recommended estate-wide follow-up.
+
+## Cross-references
+
+- Estate proof-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-proof-debt.md`
+- Estate licence-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-licence-debt.md`
+- Estate documentation-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-documentation-debt.md`
+
+---
+
+🤖 Generated by Claude Code estate-wide tech-debt scan (2026-05-26). This file is informational — closing the debt is follow-up work owned by the maintainer.