feat: agent-mcp cartridge, build infrastructure, RSR compliance

- Add agent-mcp cartridge (SafeOODA.idr + agent_ffi.zig, 7 tests)
  OODA loop enforcement: agents cannot skip Observe→Orient→Decide→Act
- Add Zig build.zig for all 4 cartridge FFI layers
- Add Idris2 .ipkg package files for all 4 cartridges
- Customize Justfile with BoJ-specific recipes:
  typecheck, verify-no-believe-me, verify, matrix, build, test
- Customize contractiles for BoJ-server:
  Trustfile (replace example.com with boj-server values)
  Mustfile (12 BoJ invariant checks)
  Intentfile (matrix fill, Umoja, security, PanLL, community)
  Dustfile (catalogue rollback, federation quarantine)
- Fix ANCHOR.a2ml (service/infrastructure, correct language policy)
- Remove template instruction blocks from CODE_OF_CONDUCT.md, SECURITY.md
- Clean ABI-FFI-README.md template marker
- Update .gitignore for cartridge build caches

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.gitignore

@@ -104,6 +104,8 @@ src/abi/build/
 # Zig cache
 ffi/zig/.zig-cache/
 ffi/zig/zig-out/
+cartridges/*/ffi/.zig-cache/
+cartridges/*/ffi/zig-out/
 
 # Cartridge Idris2 build artifacts
 cartridges/*/abi/build/

.machine_readable/anchors/ANCHOR.a2ml

@@ -20,9 +20,9 @@ purpose = [
 
 [identity]
 project = "Bundle of Joy Server"
-kind = "{{PROJECT_KIND}}"                # language | library | service | tool
+kind = "service"
 one-sentence = "Unified server capability catalogue with formally verified cartridges"
-domain = "{{PROJECT_DOMAIN}}"
+domain = "infrastructure"
 
 [semantic-authority]
 policy = "canonical"
@@ -34,8 +34,8 @@ owns = [
 ]
 
 [implementation-policy]
-allowed = ["Rust", "Idris2", "Zig", "Scheme", "Shell", "Just", "AsciiDoc", "Markdown"]
-forbidden = ["Node.js", "npm"]
+allowed = ["Idris2", "Zig", "V", "Scheme", "Shell", "Just", "AsciiDoc", "Markdown", "ReScript"]
+forbidden = ["Node.js", "npm", "TypeScript", "Python", "Go"]
 
 [golden-path]
 smoke-test-command = [

.machine_readable/contractiles/dust/Dustfile

@@ -1,29 +1,45 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-# Dustfile template - recovery and rollback semantics
+# Dustfile - recovery and rollback semantics for BoJ Server
 
 version: 1
 
 recovery:
-  logs:
-    - name: decision-log
-      path: logs/decisions.json
-      reversible: true
-      handler: "log-replay --reverse logs/decisions.json"
-
-  policy:
-    - name: policy-rollback
-      path: policy/policy.ncl
-      rollback: "git checkout HEAD~1 -- policy/policy.ncl"
-      notes: "Rollback policy to the previous known-good revision."
-
-  gateway:
-    - name: bad-deployment
-      event: "deploy.failure"
-      undo: "kubectl rollout undo deployment/gateway"
-      notes: "Undo a failed deployment while preserving audit logs."
+  catalogue:
+    - name: catalogue-rollback
+      path: src/abi/Boj/Catalogue.idr
+      rollback: "git checkout HEAD~1 -- src/abi/Boj/Catalogue.idr"
+      notes: "Rollback core catalogue to previous version. Re-run idris2 --check after."
+
+  cartridges:
+    - name: cartridge-rollback
+      event: "cartridge.mount.failure"
+      undo: "just clean && just build"
+      notes: "Clean build and rebuild all FFI layers after a cartridge mount failure."
+
+    - name: cartridge-abi-rollback
+      path: "cartridges/*/abi/**/*.idr"
+      rollback: "git checkout HEAD~1 -- cartridges/"
+      notes: "Rollback all cartridge ABIs. Requires re-typecheck."
+
+  federation:
+    - name: node-deregister
+      event: "umoja.node.attestation.failure"
+      undo: "Remove node from gossip pool. Quarantine until hash re-verified."
+      notes: "Community node failed hash attestation. Isolate, do not route orders."
+
+    - name: gossip-rollback
+      event: "umoja.gossip.corruption"
+      undo: "Reset gossip state to last known-good snapshot."
+      notes: "If gossip data is corrupted, fall back to seed node registry."
+
+  menu:
+    - name: menu-regenerate
+      path: .machine_readable/servers/menu.a2ml
+      rollback: "Regenerate menu.a2ml from catalogue state."
+      notes: "Menu is derived from catalogue — regenerate rather than rollback."
 
   dust-events:
-    - name: decision-log-to-dust
-      source: logs/decisions.json
-      transform: "dustify --input logs/decisions.json --output logs/dust-events.json"
-      notes: "Map gateway decision logs into reversible dust events."
+    - name: ffi-rebuild
+      source: ffi/zig/
+      transform: "just clean && just build && just test"
+      notes: "Full FFI rebuild and test cycle after any Zig source change."

.machine_readable/contractiles/lust/Intentfile

@@ -1,21 +1,38 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-# Intentfile template - declared future intent
+# Intentfile - declared future intent for BoJ Server
 
 version: 1
 
 future:
-  trust-engine:
-    - "Integrate hardware-backed key management."
-    - "Support node attestation for deployments."
+  matrix-fill:
+    - "Fill remaining MCP column: Cloud, Container, K8s, Git, Secrets, Queues, IaC, Observe, SSG, Proof."
+    - "Begin LSP column for key capability domains."
+    - "Evaluate DAP column where debugging adapters make sense."
 
-  control-plane:
-    - "Move to GitOps-backed configuration promotion."
-    - "Add canary and staged rollout support."
+  umoja-federation:
+    - "Implement gossip protocol for community node discovery (IPv6-only)."
+    - "Hash attestation for binary verification of community-hosted nodes."
+    - "Deploy 4 family seed nodes across 4 continents (UK, Central Europe, Australia, Americas)."
+    - "Load-aware routing: route orders to healthiest available node."
 
-  pipeline:
-    - "Adopt Nickel (or your DSL) as the primary policy language."
-    - "Automate policy promotion from dev to prod with signed artifacts."
+  v-lang-adapter:
+    - "Triple API adapter: REST (9000) + gRPC (9001) + GraphQL (9002)."
+    - "Read order-ticket.scm, mount selected cartridges, return endpoints."
+    - "Status endpoint returns live matrix state."
 
-  introspection:
-    - "Expose decision latency and policy evaluation metrics."
-    - "Add tracing for end-to-end request decisions."
+  security:
+    - "Auto-SDP (Software Defined Perimeter) for community nodes."
+    - "DoQ/DoH for encrypted DNS resolution on Umoja network."
+    - "oDNS research: distributed Oblivious DNS as a network service."
+    - "Container hash state monitoring via vordr integration."
+
+  panll-integration:
+    - "BoJ panel in PanLL showing live capability matrix."
+    - "Menu browser and order placement from PanLL."
+    - "A2ML integration: PanLL reads BoJ menu.a2ml for capability discovery."
+
+  community:
+    - "Community cartridge submission process (Ayo menu tier)."
+    - "Hosting documentation for community node operators."
+    - "IndieWeb integration: Webmention, self-hosted node discovery."
+    - "PMPL license as network license for provenance chain verification."

.machine_readable/contractiles/must/Mustfile

@@ -1,35 +1,68 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-# Mustfile - declarative state contract (template)
+# Mustfile - declarative state contract for BoJ Server
 # See: https://github.com/hyperpolymath/mustfile
 
 version: 1
 
 metadata:
-  name: project-state-contract
-  spec: v0.0.1
-  description: "Invariant checks for config, policy, gateway, logs, and schema."
+  name: boj-server-state-contract
+  spec: v0.1.0
+  description: "Invariant checks for BoJ capability catalogue, cartridges, and formal proofs."
 
 parameters:
-  gateway_port: "8080"
-  schema_version: "v0.0.1"
+  gateway_port: "9000"
+  abi_dir: "src/abi"
+  ffi_dir: "ffi/zig"
 
 checks:
-  - name: config-valid
-    description: "config/service.yaml must be valid."
-    run: "yq -e '.' config/service.yaml >/dev/null"
+  - name: zero-believe-me
+    description: "No believe_me, assert_total, or assert_smaller in any Idris2 source."
+    run: "bash -uc '! grep -rn \"believe_me\\|assert_total\\|assert_smaller\" --include=\"*.idr\" src/ cartridges/ | grep -v -- \"--.*believe_me\" | grep -v \"|||.*believe_me\"'"
 
-  - name: policy-compiles
-    description: "policy/policy.ncl must compile."
-    run: "nickel check policy/policy.ncl"
+  - name: abi-typechecks
+    description: "Core ABI Idris2 files must type-check with %default total."
+    run: "cd src/abi && idris2 --check --package boj boj.ipkg"
 
-  - name: gateway-exposes-port
-    description: "Service must expose the configured port."
-    run: "bash -uc 'ss -lnt | rg \":${GATEWAY_PORT:-8080}\"'"
+  - name: ffi-builds
+    description: "Core FFI Zig layer must compile clean."
+    run: "cd ffi/zig && zig build"
 
-  - name: logs-are-json
-    description: "Logs must be JSON."
-    run: "bash -uc 'rg --files -g \"*.json\" logs | xargs -r jq -e .'"
+  - name: ffi-tests-pass
+    description: "Core FFI tests must pass."
+    run: "cd ffi/zig && zig build test"
 
-  - name: schema-version-matches
-    description: "Schema must match version spec."
-    run: "bash -uc 'rg -n \"${SCHEMA_VERSION:-v0.0.1}\" schema'"
+  - name: cartridge-fleet-abi
+    description: "Fleet-MCP ABI must type-check."
+    run: "cd cartridges/fleet-mcp/abi && idris2 --check fleet-mcp.ipkg"
+
+  - name: cartridge-nesy-abi
+    description: "NeSy-MCP ABI must type-check."
+    run: "cd cartridges/nesy-mcp/abi && idris2 --check nesy-mcp.ipkg"
+
+  - name: cartridge-database-abi
+    description: "Database-MCP ABI must type-check."
+    run: "cd cartridges/database-mcp/abi && idris2 --check database-mcp.ipkg"
+
+  - name: cartridge-agent-abi
+    description: "Agent-MCP ABI must type-check."
+    run: "cd cartridges/agent-mcp/abi && idris2 --check agent-mcp.ipkg"
+
+  - name: cartridge-ffi-tests
+    description: "All cartridge FFI tests must pass."
+    run: |
+      cd cartridges/fleet-mcp/ffi && zig build test &&
+      cd ../../nesy-mcp/ffi && zig build test &&
+      cd ../../database-mcp/ffi && zig build test &&
+      cd ../../agent-mcp/ffi && zig build test
+
+  - name: spdx-headers
+    description: "All source files must have PMPL-1.0-or-later SPDX headers."
+    run: "bash -uc 'find src/ ffi/ cartridges/ -name \"*.idr\" -o -name \"*.zig\" | xargs grep -L \"PMPL-1.0-or-later\" | head -5 | { read line && echo \"Missing SPDX: $line\" && exit 1 || true; }'"
+
+  - name: menu-exists
+    description: "A2ML menu must exist."
+    run: "test -f .machine_readable/servers/menu.a2ml"
+
+  - name: order-ticket-exists
+    description: "Order-ticket protocol spec must exist."
+    run: "test -f .machine_readable/servers/order-ticket.scm"