chore(governance): clear pre-existing CI/governance debt

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: MPL-2.0
+# ClusterFuzzLite build image for betlang.
+#
+# ClusterFuzzLite invokes `docker build -f .clusterfuzzlite/Dockerfile`,
+# so this file must be named `Dockerfile`. It mirrors the OCI-neutral
+# Containerfile in this directory (kept for podman-first local builds per
+# the authority stack); keep the two in sync.
+FROM gcr.io/oss-fuzz-base/base-builder-rust
+RUN apt-get update && apt-get install -y make autoconf automake libtool
+COPY . $SRC/betlang
+WORKDIR $SRC/betlang
+COPY .clusterfuzzlite/build.sh $SRC/

.github/workflows/cargo-audit.yml

@@ -20,6 +20,7 @@ permissions: read-all
 jobs:
   audit:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
 
@@ -35,6 +36,7 @@ jobs:
   # Optional: Create issues for vulnerabilities
   create-issue:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: audit
     if: failure()
     permissions:

.github/workflows/casket-pages.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
@@ -91,6 +92,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/cflite_batch.yml

@@ -7,6 +7,7 @@ permissions: read-all
 jobs:
   fuzz:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1

.github/workflows/cflite_pr.yml

@@ -10,6 +10,7 @@ permissions: read-all
 jobs:
   fuzz:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1

.github/workflows/codeql.yml

@@ -22,6 +22,7 @@ permissions: read-all
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
       security-events: write

.github/workflows/comprehensive-quality.yml

@@ -15,6 +15,7 @@ jobs:
   # DEPENDABILITY - Stability and reliability
   dependability:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Check test coverage
@@ -34,6 +35,7 @@ jobs:
   # SECURITY - Multi-layer security scanning
   security:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Secret scanning
@@ -54,6 +56,7 @@ jobs:
   # INTEROPERABILITY - API and format compatibility
   interoperability:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Check API specs
@@ -71,6 +74,7 @@ jobs:
   # VALIDATION - Input/output validation
   validation:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Check for validation patterns
@@ -81,6 +85,7 @@ jobs:
   # ATTESTATION - Supply chain integrity (SLSA)
   attestation:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       id-token: write
       contents: read
@@ -101,6 +106,7 @@ jobs:
   # VERIFICATION - Formal methods where applicable
   verification:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Check SPARK proofs
@@ -117,6 +123,7 @@ jobs:
   # FUNCTIONALITY - Feature completeness
   functionality:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Check TODOs and FIXMEs
@@ -130,6 +137,7 @@ jobs:
   # PERFORMANCE - Benchmarks and profiling
   performance:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Check for benchmarks
@@ -146,6 +154,7 @@ jobs:
   # ACCESSIBILITY - A11y compliance
   accessibility:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: hashFiles('**/*.html') != ''
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
@@ -161,6 +170,7 @@ jobs:
   # LICENSE COMPLIANCE
   license:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Check license files
@@ -179,6 +189,7 @@ jobs:
   # DOCUMENTATION QUALITY
   documentation:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Check docs completeness

.github/workflows/jekyll-gh-pages.yml

@@ -26,6 +26,7 @@ jobs:
   # Build job
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -45,6 +46,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/release.yml

@@ -20,6 +20,7 @@ env:
 jobs:
   build-linux:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       matrix:
         target:
@@ -57,6 +58,7 @@ jobs:
 
   build-macos:
     runs-on: macos-latest
+    timeout-minutes: 30
     strategy:
       matrix:
         target:
@@ -88,6 +90,7 @@ jobs:
 
   build-windows:
     runs-on: windows-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
 
@@ -113,6 +116,7 @@ jobs:
 
   build-lsp:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
 
@@ -138,6 +142,7 @@ jobs:
   release:
     needs: [build-linux, build-macos, build-windows, build-lsp]
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
 

.github/workflows/scorecard-enforcer.yml

@@ -22,6 +22,7 @@ permissions: read-all
 jobs:
   scorecard:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       security-events: write
       id-token: write  # For OIDC
@@ -60,6 +61,7 @@ jobs:
   # Check specific high-priority items
   check-critical:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
 

.github/workflows/test.yml

@@ -13,6 +13,7 @@ jobs:
   test:
     name: Test on Racket ${{ matrix.racket-version }}
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
 
     strategy:
       fail-fast: false
@@ -28,7 +29,9 @@ jobs:
         uses: Bogdanp/setup-racket@2466913449df77df2bad149d1f2fc4e1ea4795dd # v1.15
         with:
           version: ${{ matrix.racket-version }}
-          packages: 'rackunit'
+          # rackunit ships with the full Racket distribution (already present
+          # at installation scope); re-requesting it at user scope errors with
+          # "package is currently installed in a wider scope".
 
       - name: Run core tests
         run: racket tests/basics.rkt
@@ -69,6 +72,7 @@ jobs:
   lint:
     name: Code Quality
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - name: Checkout code
@@ -98,6 +102,7 @@ jobs:
   docs:
     name: Documentation Check
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - name: Checkout code
@@ -125,6 +130,7 @@ jobs:
   rsr-compliance:
     name: RSR Framework Compliance
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - name: Checkout code

.github/workflows/workflow-linter.yml

@@ -15,6 +15,7 @@ permissions: read-all
 jobs:
   lint-workflows:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
 

.governance-allowlist

@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: MPL-2.0
+#
+# .governance-allowlist — Layer 2.5 typed-infrastructure file enumerating
+# per-repo TypeScript exemptions for the standards-repo governance scanner
+# (check-ts-allowlist.deno.js). Sibling to the Layer 2 prose table in
+# .claude/CLAUDE.md (TypeScript Exemptions section), which already approves
+# the `playground/**` sandbox (see playground/README.adoc).
+#
+# Why this file exists *in addition to* the CLAUDE.md table:
+# the upstream scanner's `globToRegex` keeps the glob's relative form
+# (no `./` prefix) while its recursive walk of "." yields paths *with* the
+# `./` prefix (e.g. `./playground/src/ternary.ts`). A glob like
+# `playground/**` therefore compiles to a regex that fails to anchor
+# against `./playground/...`, so the CLAUDE.md row exempts zero files in
+# practice and the scanner reports "1 exemption parsed" yet still flags the
+# files. The lead-`*` wildcard below sidesteps that (it matches any run,
+# including `/` and the `./` prefix) until the scanner itself is fixed
+# upstream.
+#
+# Each non-blank, non-`#` line is a glob; `*` matches any run including `/`.
+# This single pattern covers all six approved playground .ts files:
+#   playground/src/{probability,ternary,main}.ts
+#   playground/test/{ternary_test,probability_test}.ts
+#   playground/examples/uncertainty.ts
+*playground/*.ts

.hypatia-ignore

@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: MPL-2.0
+#
+# .hypatia-ignore — repo-scoped exemptions for the estate governance
+# bundle's anti-pattern / Hypatia scanner. Format (per the bundle's
+# `is_exempt`): each non-comment line is `${rule}:${path}`, matched as a
+# fixed-string whole-line equality. Comment (`#`) and blank lines are
+# tolerated.
+#
+# ─── Playground TypeScript sandbox ──────────────────────────────────
+#
+# The `playground/` directory is an intentional experimental sandbox,
+# decoupled from the Racket core, in which TypeScript is one of several
+# languages explored (see playground/README.adoc). This is an APPROVED
+# carve-out, already documented in the TypeScript Exemptions table in
+# .claude/CLAUDE.md, with the same unblock condition: migrate the sample
+# to AffineScript or delete it once the experiment is settled. These
+# entries implement that approved exemption for the Hypatia scanner.
+cicd_rules/banned_language_file:playground/src/ternary.ts
+cicd_rules/banned_language_file:playground/src/probability.ts
+cicd_rules/banned_language_file:playground/src/main.ts
+cicd_rules/banned_language_file:playground/test/ternary_test.ts
+cicd_rules/banned_language_file:playground/test/probability_test.ts
+cicd_rules/banned_language_file:playground/examples/uncertainty.ts

Cargo.toml

@@ -36,7 +36,7 @@ members = [
 [workspace.package]
 version = "0.1.0"
 edition = "2021"
-license = "MIT OR Apache-2.0"
+license = "MPL-2.0"
 repository = "https://github.com/hyperpolymath/betlang"
 rust-version = "1.75"