docs: OpenSSF Scorecard + Software Heritage badges + CITATION.cff (#85)

## Summary

Three accreditations added with zero new infrastructure required:

1. **OpenSSF Scorecard badge** — numerical score (0–10) alongside the
existing Best Practices boolean badge. Workflow
`.github/workflows/scorecard.yml` already publishes the data; this just
makes it visible.
2. **Software Heritage badge** — automatic archival credential.
softwareheritage.org indexes public GitHub repos without setup; the
badge surfaces it.
3. **CITATION.cff** — Citation File Format 1.2.0. Drives GitHub's "Cite
this repository" sidebar button and is consumable by Zenodo, Zotero,
BibTeX converters, etc.

## What this enables

- The Scorecard score is now externally visible — auditors and
downstream consumers can verify supply-chain posture without inspecting
workflows.
- Software-Heritage archival becomes citable evidence of digital
preservation.
- Academic users can cite BoJ Server properly (OU affiliation surfaced).

## Zenodo (next step, owner action)

README's new **Citing** section documents the 4-step Zenodo enablement
(link via zenodo.org dashboard, flip toggle, cut a release → DOI). After
enablement, add the DOI badge and update `CITATION.cff`'s `doi:` field.
I left the DOI badge OUT of this PR because a placeholder badge is worse
than none.

## What's NOT in this PR

**REUSE compliance** is deferred. `reuse lint` shows the project isn't
compliant — bad licences (EXHIBIT-A/B not `LicenseRef-` prefixed, PMPL
not SPDX-valid), missing `CC-BY-4.0` + `PMPL-2.0-or-later` text files, 4
invalid SPDX expressions. Resolving these collides head-on with the
active licence-debt ledger work (PMPL→MPL-2.0 reconciliation). Better to
land REUSE compliance after that ledger closes so the SPDX fixes happen
exactly once.

## Test plan

- [ ] Scorecard badge renders (will show "loading" briefly, then
numerical score)
- [ ] Software Heritage badge renders
- [ ] GitHub sidebar shows the "Cite this repository" button on the repo
home page
- [ ] No CI regressions (this is docs/config-only)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

CITATION.cff

@@ -0,0 +1,38 @@
+# Citation File Format — https://citation-file-format.github.io/
+# This file describes how to cite the boj-server software.
+cff-version: 1.2.0
+title: "BoJ Server — Bundle of Joy MCP Server"
+message: "If you use this software, please cite it using the metadata below."
+type: software
+authors:
+  - given-names: Jonathan
+    name-particle: D.A.
+    family-names: Jewell
+    email: j.d.a.jewell@open.ac.uk
+    affiliation: "The Open University"
+    alias: hyperpolymath
+repository-code: "https://github.com/hyperpolymath/boj-server"
+url: "https://github.com/hyperpolymath/boj-server"
+abstract: >-
+  Bundle of Joy (BoJ) Server is a cartridge-based Model Context Protocol (MCP)
+  gateway. Each cartridge — covering databases, container runtimes, git forges,
+  Kubernetes, observability, secrets, IaC, cloud providers, and multi-instance
+  AI coordination — is a formally verified Idris2 ABI + Zig FFI + Deno/JS
+  adapter triple. The server exposes 115 cartridges through a unified stdio
+  MCP surface plus a local REST API on port 7700. A local-coord-mcp cartridge
+  provides loopback peer discovery, typed envelopes, claim/heartbeat/watchdog,
+  and master/journeyman/apprentice supervision for multi-agent AI workflows.
+keywords:
+  - mcp
+  - model-context-protocol
+  - llm-tools
+  - formal-verification
+  - idris2
+  - zig
+  - cartridge-architecture
+  - devops
+  - multi-agent
+  - ai-coordination
+license: MPL-2.0
+version: 0.4.6
+date-released: "2026-04-27"

README.md

@@ -1,8 +1,10 @@
 # boj-server
 
 [![OpenSSF Best Practices](https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=opensourcesecurity)](https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/boj-server)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/hyperpolymath/boj-server/badge)](https://scorecard.dev/viewer/?uri=github.com/hyperpolymath/boj-server)
 [![Glama MCP Server](https://glama.ai/mcp/servers/hyperpolymath/boj-server/badge)](https://glama.ai/mcp/servers/hyperpolymath/boj-server)
 [![Green Hosting](https://api.thegreenwebfoundation.org/greencheckimage/boj-server.net)](https://www.thegreenwebfoundation.org/green-web-check/?url=boj-server.net)
+[![Software Heritage](https://archive.softwareheritage.org/badge/origin/https://github.com/hyperpolymath/boj-server/)](https://archive.softwareheritage.org/browse/origin/?origin_url=https://github.com/hyperpolymath/boj-server)
 
 BoJ (Bundle of Joy) is a unified MCP server that consolidates all hyperpolymath tooling into a single endpoint — GitHub, GitLab, Cloudflare, Vercel, Verpex, Gmail, Calendar, browser automation, research, ML, and 115 open-source cartridges.
 
@@ -237,6 +239,21 @@ Run the coherence tests:
 npm test
 ```
 
+## Citing
+
+If you use BoJ Server in academic work, citation metadata is in [`CITATION.cff`](./CITATION.cff). GitHub renders a "Cite this repository" button in the sidebar from this file.
+
+Per-release DOIs are available via Zenodo. To enable them:
+
+1. Log in to [zenodo.org](https://zenodo.org/) with your GitHub account.
+2. Account → GitHub → flip the **boj-server** repository toggle to on.
+3. Cut a new GitHub release; Zenodo auto-archives it and mints a DOI.
+4. Add the DOI badge to this README:
+   ```markdown
+   [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.XXXXXXX.svg)](https://doi.org/10.5281/zenodo.XXXXXXX)
+   ```
+5. Update the `doi:` field in `CITATION.cff` to match.
+
 ## License
 
 MPL-2.0 — see [LICENSE](./LICENSE).

glama.json

@@ -44,6 +44,11 @@
         "description": "URL for the local coordination bus backend.",
         "default": "http://127.0.0.1:7745"
       },
+      "COORD_REQUIRE_NICKEL": {
+        "type": "string",
+        "description": "Set to '1' to enable strict Nickel-contract validation on coord_send_gated envelopes. Default off (envelopes validated permissively).",
+        "default": "0"
+      },
       "BOJ_TOOL_SCOPE": {
         "type": "string",
         "description": "Advertised tool-surface scope. 'full' (or unset) advertises every tool (default, backward-compatible). 'core' advertises only the discovery/dispatch core (boj_health, boj_menu, boj_cartridges, boj_cartridge_info, boj_cartridge_invoke) plus all coord_* tools. A CSV of domain prefixes (e.g. 'core,github,browser') advertises core plus the named explicit groups. Every explicit boj_<domain>_* tool remains reachable via boj_cartridge_invoke regardless of scope.",