fix: correct grade inflation and fill template stubs across docs

README, STATE.a2ml, and TOPOLOGY.md all claimed Grade A/B when
READINESS.md honestly reports Grade D (Alpha) with 0 components
at Grade C+. Aligned all documents to Grade D. Also: filled
release workflow build stubs, removed template placeholders from
SECURITY.md and CODE_OF_CONDUCT.md, expanded Justfile test recipe
from 5/18 to all 17 cartridges, and updated ROADMAP.adoc checkboxes
to match actual completion state.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/CODE_OF_CONDUCT.md

@@ -1,25 +1,5 @@
 # Code of Conduct
 
-<!-- 
-============================================================================
-TEMPLATE INSTRUCTIONS (delete this block before publishing)
-============================================================================
-Replace all {{PLACEHOLDER}} values:
-  boj-server     - Your project name
-  hyperpolymath            - GitHub/GitLab username or org
-  boj-server             - Repository name
-  j.d.a.jewell@open.ac.uk    - Email for conduct reports
-  conduct team     - Name of conduct team/committee
-  48 hours    - Initial response SLA (e.g., 48 hours)
-  2026     - Current year
-
-Review and customise:
-- Adjust enforcement ladder for your community size
-- Add/remove examples based on your context
-- Ensure contact methods work for your team
-============================================================================
--->
-
 ## Our Pledge
 
 We as members, contributors, and leaders pledge to make participation in boj-server a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation.
@@ -138,7 +118,7 @@ If you experience or witness unacceptable behaviour, or have any other concerns,
 |--------|---------|----------|
 | **Email** | j.d.a.jewell@open.ac.uk | Detailed reports, sensitive matters |
 | **Private Message** | Contact any maintainer directly | Quick questions, minor issues |
-| **Anonymous Form** | [Link to form if available] | When you need anonymity |
+| **GitHub Issue** | [Open a private report](https://github.com/hyperpolymath/boj-server/security/advisories/new) | When you prefer not to use email |
 
 **What to Include**
 

.github/CONTRIBUTING.md

@@ -1,16 +1,27 @@
-# Clone the repository
+# Contributing to boj-server
+
+## Quick Start
+
+### Clone the repository
+```bash
 git clone https://github.com/hyperpolymath/boj-server.git
 cd boj-server
+```
 
-# Using Nix (recommended for reproducibility)
+### Using Nix (recommended for reproducibility)
+```bash
 nix develop
+```
 
-# Or using toolbox/distrobox
+### Or using toolbox/distrobox
+```bash
 toolbox create boj-server-dev
 toolbox enter boj-server-dev
 # Install dependencies manually
+```
 
-# Verify setup
+### Verify setup
+```bash
 just check   # or: cargo check / mix compile / etc.
 just test    # Run test suite
 ```
@@ -119,3 +130,4 @@ We follow [Conventional Commits](https://www.conventionalcommits.org/):
 [optional body]
 
 [optional footer]
+```

.github/SECURITY.md

@@ -1,23 +1,5 @@
 # Security Policy
 
-<!-- 
-============================================================================
-TEMPLATE INSTRUCTIONS (delete this block before publishing)
-============================================================================
-Replace all {{PLACEHOLDER}} values with your information:
-  boj-server     - Your project name
-  hyperpolymath            - GitHub username or org (e.g., hyperpolymath)
-  boj-server             - Repository name
-  j.d.a.jewell@open.ac.uk   - Security contact email
-  See GitHub profile  - Your PGP key fingerprint (40 chars, no spaces)
-  https://github.com/hyperpolymath.gpg      - URL to your public PGP key
-  github.com/hyperpolymath          - Your website/domain
-  2026     - Current year for copyright
-
-Optional: Remove sections that don't apply (e.g., PGP if you don't use it)
-============================================================================
--->
-
 We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions.
 
 ## Table of Contents
@@ -60,7 +42,6 @@ If you cannot use GitHub Security Advisories, you may email us directly:
 |---|---|
 | **Email** | j.d.a.jewell@open.ac.uk |
 | **PGP Key** | [Download Public Key](https://github.com/hyperpolymath.gpg) |
-| **Fingerprint** | `See GitHub profile` |
 
 ```bash
 # Import our PGP key
@@ -335,8 +316,6 @@ To stay informed about security updates:
 
 ### Supported Versions
 
-<!-- Adjust this table to match your actual version support policy -->
-
 | Version | Supported | Notes |
 |---------|-----------|-------|
 | `main` branch | ✅ Yes | Latest development |

.github/workflows/release.yml

@@ -19,24 +19,56 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-      - name: Build
+      - name: Install Zig
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
+        with:
+          version: 0.15.2
+
+      - name: Build core FFI libraries
+        run: cd ffi/zig && zig build -Doptimize=ReleaseSafe
+
+      - name: Build cartridge shared libraries
+        run: |
+          for cart in database-mcp fleet-mcp nesy-mcp agent-mcp cloud-mcp container-mcp k8s-mcp git-mcp secrets-mcp queues-mcp iac-mcp observe-mcp ssg-mcp proof-mcp lsp-mcp dap-mcp bsp-mcp feedback-mcp; do
+            echo "Building $cart .so..."
+            cd "cartridges/$cart/ffi" && zig build -Doptimize=ReleaseSafe
+            cd "$GITHUB_WORKSPACE"
+          done
+
+      - name: Collect release artifacts
+        run: |
+          mkdir -p release-artifacts/core release-artifacts/cartridges
+          # Core static libraries and benchmark binary
+          cp ffi/zig/zig-out/lib/*.a release-artifacts/core/
+          cp ffi/zig/zig-out/bin/boj_bench release-artifacts/core/ 2>/dev/null || true
+          # Cartridge shared libraries
+          for cart in database-mcp fleet-mcp nesy-mcp agent-mcp cloud-mcp container-mcp k8s-mcp git-mcp secrets-mcp queues-mcp iac-mcp observe-mcp ssg-mcp proof-mcp lsp-mcp dap-mcp bsp-mcp feedback-mcp; do
+            cp "cartridges/$cart/ffi/zig-out/lib/"*.so "release-artifacts/cartridges/" 2>/dev/null || true
+          done
+
+      - name: Create release tarball
         run: |
-          echo "Build your artifacts here"
-          # TODO: Replace with your build commands
-          # Examples:
-          #   cargo build --release
-          #   zig build -Doptimize=ReleaseFast
-          #   gleam build
-          #   mix release
-
-      # TODO: Upload build artifacts if needed
-      # - uses: actions/upload-artifact@v4
-      #   with:
-      #     name: release-artifacts
-      #     path: target/release/
+          VERSION="${GITHUB_REF_NAME#v}"
+          tar czf "boj-server-${VERSION}-linux-x86_64.tar.gz" -C release-artifacts .
+
+      - name: Generate artifact hashes
+        id: hash
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          HASHES=$(sha256sum "boj-server-${VERSION}-linux-x86_64.tar.gz" | base64 -w0)
+          echo "hashes=${HASHES}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: release-artifacts
+          path: boj-server-*-linux-x86_64.tar.gz
+          retention-days: 5
 
   changelog:
     name: Generate Changelog
@@ -92,11 +124,11 @@ jobs:
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-      # TODO: Download build artifacts if uploading to the release
-      # - uses: actions/download-artifact@v4
-      #   with:
-      #     name: release-artifacts
-      #     path: artifacts/
+      - name: Download build artifacts
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          name: release-artifacts
+          path: artifacts/
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
@@ -105,9 +137,8 @@ jobs:
           draft: false
           prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }}
           generate_release_notes: false
-          # TODO: Add artifact files to the release
-          # files: |
-          #   artifacts/*
+          files: |
+            artifacts/*
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -122,7 +153,4 @@ jobs:
     # See: https://slsa.dev/spec/v1.0/requirements#build-l3
     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0
     with:
-      base64-subjects: ""
-      # TODO: Replace with actual artifact hashes
-      # Generate with: sha256sum artifact | base64 -w0
-      # base64-subjects: "${{ needs.build.outputs.hashes }}"
+      base64-subjects: "${{ needs.build.outputs.hashes }}"

.machine_readable/STATE.a2ml

@@ -8,16 +8,16 @@ project = "boj-server"
 version = "0.2.0"
 last-updated = "2026-03-10"
 status = "active"
-grade = "A-production"
+grade = "D-alpha"
 
 [project-context]
 name = "Bundle of Joy Server"
 purpose = "Unified server capability catalogue solving the combinatoric explosion of developer server protocols. Provides a 2D matrix of formally verified cartridges (protocol types x capability domains), distributed via community-hosted nodes with hash attestation and gossip protocol."
-completion-percentage = 100
+completion-percentage = 57
 
 [position]
-phase = "rc"
-maturity = "release-candidate"
+phase = "alpha"
+maturity = "alpha"
 
 [route-to-mvp]
 milestones = [
@@ -29,14 +29,14 @@ milestones = [
   { name = "Phase 5: Umoja federation & PanLL panel", completion = 100 },
   { name = "Phase 6: Remaining cartridges (fill the matrix)", completion = 100 },
   { name = "Phase 7: Polystack deprecation (endgame)", completion = 100 },
-  { name = "Phase 8: Grade C→B (QUIC, multi-node, coprocessor, docs)", completion = 100 },
-  { name = "Phase 9: Grade B→A (SLA, community, SDP, seed nodes)", completion = 100 },
+  { name = "Phase 8: Grade D→C (QUIC, multi-node, coprocessor, docs)", completion = 40 },
+  { name = "Phase 9: Grade C→B (SLA, community, SDP, seed nodes)", completion = 20 },
 ]
 
 # Honest assessment notes:
-# - Phase 8 at 100%: QUIC transport (X25519+ChaCha20-Poly1305), multi-node testing (11 tests),
-#   coprocessor dispatch (14 tests), Podman secure instance, API contract documentation
-# - All Grade C→B and B→A items complete
+# - Phase 8 partial: QUIC transport, multi-node testing, coprocessor dispatch code exists
+#   but lacks external validation, release workflow is stub, placeholders remain
+# - Grade D (Alpha): 18 cartridges built as state machines, tests passing internally
 # - Federation tests: 40 (was 30, +10 QUIC tests)
 # - Coprocessor tests: 14, SLA tests: 11, Community tests: 11, SDP tests: 10
 # - Multi-node tests: 11 (shell tests)
@@ -75,13 +75,13 @@ must = [
 should = [
   "gRPC-compat adapter (done — JSON-over-HTTP with service/method paths)",
   "GraphQL subscriptions for mount/unmount events (done — polling)",
-  "Readiness Grade A tests (done — 7 production tests)",
+  "Readiness Grade D (Alpha) tests (done — 7 production tests)",
   "PanLL module mapping (DONE — 887-line view, 5 tabs, clade definition)",
   "Cartridge hot-reload (done — unmount/verify/remount)",
   "QUIC-first transport (DONE — X25519+ChaCha20-Poly1305, 10 QUIC tests)",
   "Multi-node federation testing (DONE — 11 tests, REST API peering)",
   "Coprocessor dispatch (DONE — Axiom.jl-style, 14 tests)",
-  "Podman secure instance (DONE — quadlet, seccomp, read-only rootfs)",
+  "Podman secure instance (configured-not-deployed — quadlet, seccomp, read-only rootfs defined, image not published)",
   "Stable API contract (DONE — docs/API-CONTRACT.md)",
 ]
 could = [
@@ -91,8 +91,8 @@ could = [
 ]
 
 [blockers-and-issues]
-# No blockers. Grade A production code complete.
-# Remaining: deploy seed nodes, register domain.
+# No critical blockers. Grade D (Alpha) — 18 cartridges built, tests passing.
+# Remaining: external validation, release workflow, deploy seed nodes, register domain.
 
 [critical-next-actions]
 actions = [
@@ -129,7 +129,7 @@ panll-routing = "done — bojRouting toggle on 10 panels (VeriSimDB, Editor Brid
 quic-transport = "done — X25519 ECDH + ChaCha20-Poly1305 AEAD, backward compatible"
 multinode-testing = "done — 2-node federation test script, REST API peering, 11 tests"
 coprocessor-dispatch = "done — detect→select→dispatch→fallback, env-driven, 14 tests"
-podman-secure = "done — quadlet + seccomp profile + read-only rootfs + resource limits"
+podman-secure = "configured-not-deployed — quadlet + seccomp profile + read-only rootfs defined, container image not published, untested in production"
 api-contract = "done — docs/API-CONTRACT.md, all endpoints documented"
 configurable-ports = "done — BOJ_REST_PORT, BOJ_GRPC_PORT, BOJ_GRAPHQL_PORT env vars"
 
@@ -159,11 +159,12 @@ backend-axis = "stubbed — third dimension (domain x protocol x backend) for co
 extension-descriptor = "docs/examples/extension.a2ml"
 documentation = "docs/EXTENSIBILITY.md"
 
-[grade-a-status]
-sla-monitoring = "done — 3-tier (community/standard/premium), percentile tracking, 11 tests"
-community-submissions = "done — Ayo tier, review state machine, hash validation, 11 tests"
-auto-sdp = "done — zero-trust perimeter, allow-list, auto-ban, open mode for bootstrapping, 10 tests"
-seed-nodes = "done — 4-continent config (EU-West, EU-Central, US-East, AP-South)"
+[grade-a-aspirations]
+# These are NOT Grade A — they are initial implementations needing external validation
+sla-monitoring = "initial — 3-tier (community/standard/premium), percentile tracking, 11 tests, no real-world usage"
+community-submissions = "initial — Ayo tier, review state machine, hash validation, 11 tests, no external submitters"
+auto-sdp = "initial — zero-trust perimeter, allow-list, auto-ban, open mode for bootstrapping, 10 tests, untested in production"
+seed-nodes = "config only — 4-continent config (EU-West, EU-Central, US-East, AP-South), not deployed"
 
 [maintenance-status]
 last-run-utc = "2026-03-09"