Review SCM files and security updates

ECOSYSTEM.scm

@@ -1,20 +1,33 @@
 ;; SPDX-License-Identifier: AGPL-3.0-or-later
 ;; SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
-;; ECOSYSTEM.scm — template-repo
+;; ECOSYSTEM.scm — Ephapax
 
 (ecosystem
   (version "1.0.0")
-  (name "template-repo")
-  (type "project")
-  (purpose "Project in the hyperpolymath ecosystem")
+  (name "ephapax")
+  (type "programming-language")
+  (purpose "Linear type system for safe memory management targeting WebAssembly")
 
   (position-in-ecosystem
-    "Part of hyperpolymath ecosystem. Follows RSR guidelines.")
+    "Core research language in the hyperpolymath ecosystem demonstrating linear types and region-based memory management. Follows RSR Gold guidelines.")
 
   (related-projects
     (project (name "rhodium-standard-repositories")
              (url "https://github.com/hyperpolymath/rhodium-standard-repositories")
-             (relationship "standard")))
+             (relationship "standard"))
+    (project (name "linear-types-research")
+             (relationship "research-foundation"))
+    (project (name "wasm-ecosystem")
+             (relationship "target-platform")))
 
-  (what-this-is "Project in the hyperpolymath ecosystem")
-  (what-this-is-not "- NOT exempt from RSR compliance"))
+  (what-this-is
+    "A research programming language exploring:
+     - Linear types for memory safety without garbage collection
+     - Region-based memory management for deterministic deallocation
+     - WebAssembly compilation for safe, portable execution
+     - Formal verification of type system soundness via Coq proofs")
+
+  (what-this-is-not
+    "- NOT a general-purpose production language (yet)
+     - NOT exempt from RSR compliance
+     - NOT a garbage-collected language"))

META.scm

@@ -1,24 +1,49 @@
 ;; SPDX-License-Identifier: AGPL-3.0-or-later
 ;; SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
-;;; META.scm — template-repo
+;;; META.scm — Ephapax
 
-(define-module (template-repo meta)
+(define-module (ephapax meta)
   #:export (architecture-decisions development-practices design-rationale))
 
 (define architecture-decisions
   '((adr-001
      (title . "RSR Compliance")
      (status . "accepted")
      (date . "2025-12-15")
-     (context . "Project in the hyperpolymath ecosystem")
+     (context . "Linear type system for safe memory management targeting WebAssembly")
      (decision . "Follow Rhodium Standard Repository guidelines")
-     (consequences . ("RSR Gold target" "SHA-pinned actions" "SPDX headers" "Multi-platform CI")))))
+     (consequences . ("RSR Gold target" "SHA-pinned actions" "SPDX headers" "Multi-platform CI")))
+    (adr-002
+     (title . "Formal Verification with Coq")
+     (status . "accepted")
+     (date . "2025-12-17")
+     (context . "Type system correctness is critical for memory safety guarantees")
+     (decision . "Mechanize type system proofs in Coq")
+     (consequences . ("Type safety proven" "Progress and preservation theorems" "Coq 8.18+ dependency")))
+    (adr-003
+     (title . "WebAssembly Target")
+     (status . "accepted")
+     (date . "2025-12-17")
+     (context . "Need portable, sandboxed execution environment")
+     (decision . "Target WebAssembly as primary backend")
+     (consequences . ("Browser compatibility" "WASI support" "Region-based memory via linear memory")))))
 
 (define development-practices
-  '((code-style (languages . ("unknown")) (formatter . "auto-detect") (linter . "auto-detect"))
-    (security (sast . "CodeQL") (credentials . "env vars only"))
-    (testing (coverage-minimum . 70))
+  '((code-style
+     (languages . ("rust" "coq" "scheme"))
+     (formatter . "rustfmt")
+     (linter . "clippy"))
+    (security
+     (sast . "CodeQL")
+     (credentials . "env vars only")
+     (dependency-scanning . "dependabot"))
+    (testing
+     (coverage-minimum . 70)
+     (formal-proofs . "coq"))
     (versioning (scheme . "SemVer 2.0.0"))))
 
 (define design-rationale
-  '((why-rsr "RSR ensures consistency, security, and maintainability.")))
+  '((why-rsr "RSR ensures consistency, security, and maintainability.")
+    (why-linear-types "Linear types guarantee each value is used exactly once, enabling deterministic memory management without garbage collection.")
+    (why-regions "Regions provide scoped memory management, enabling safe bulk deallocation without runtime overhead.")
+    (why-wasm "WebAssembly provides a safe, portable, sandboxed execution environment with predictable performance.")))

SECURITY.md

@@ -1,23 +1,5 @@
 # Security Policy
 
-<!-- 
-============================================================================
-TEMPLATE INSTRUCTIONS (delete this block before publishing)
-============================================================================
-Replace all {{PLACEHOLDER}} values with your information:
-  {{PROJECT_NAME}}     - Your project name
-  {{OWNER}}            - GitHub username or org (e.g., hyperpolymath)
-  {{REPO}}             - Repository name
-  {{SECURITY_EMAIL}}   - Security contact email
-  {{PGP_FINGERPRINT}}  - Your PGP key fingerprint (40 chars, no spaces)
-  {{PGP_KEY_URL}}      - URL to your public PGP key
-  {{WEBSITE}}          - Your website/domain
-  {{CURRENT_YEAR}}     - Current year for copyright
-
-Optional: Remove sections that don't apply (e.g., PGP if you don't use it)
-============================================================================
--->
-
 We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions.
 
 ## Table of Contents
@@ -40,7 +22,7 @@ We take security seriously. We appreciate your efforts to responsibly disclose v
 
 The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature:
 
-1. Navigate to [Report a Vulnerability](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new)
+1. Navigate to [Report a Vulnerability](https://github.com/hyperpolymath/ephapax/security/advisories/new)
 2. Click **"Report a vulnerability"**
 3. Complete the form with as much detail as possible
 4. Submit — we'll receive a private notification
@@ -52,28 +34,14 @@ This method ensures:
 - Coordinated disclosure tooling
 - Automatic credit when the advisory is published
 
-### Alternative: Encrypted Email
-
-If you cannot use GitHub Security Advisories, you may email us directly:
-
-| | |
-|---|---|
-| **Email** | {{SECURITY_EMAIL}} |
-| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) |
-| **Fingerprint** | `{{PGP_FINGERPRINT}}` |
+### Alternative: GitHub Issues (Non-Sensitive)
 
-```bash
-# Import our PGP key
-curl -sSL {{PGP_KEY_URL}} | gpg --import
+For non-sensitive security concerns (e.g., dependency updates, security best practices):
 
-# Verify fingerprint
-gpg --fingerprint {{SECURITY_EMAIL}}
-
-# Encrypt your report
-gpg --armor --encrypt --recipient {{SECURITY_EMAIL}} report.txt
-```
+- Open an issue at [GitHub Issues](https://github.com/hyperpolymath/ephapax/issues)
+- Use the "security" label
 
-> **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media.
+> **⚠️ Important:** Do not report sensitive security vulnerabilities through public GitHub issues, pull requests, discussions, or social media.
 
 ---
 
@@ -203,7 +171,7 @@ If we cannot reach agreement on disclosure timing, we default to 90 days from yo
 
 The following are within scope for security research:
 
-- This repository (`{{OWNER}}/{{REPO}}`) and all its code
+- This repository (`hyperpolymath/ephapax`) and all its code
 - Official releases and packages published from this repository
 - Documentation that could lead to security issues
 - Build and deployment configurations in this repository
@@ -226,31 +194,24 @@ The following are **not** in scope:
 We're particularly interested in:
 
 - Remote code execution
-- SQL injection, command injection, code injection
-- Authentication/authorisation bypass
-- Cross-site scripting (XSS) and cross-site request forgery (CSRF)
-- Server-side request forgery (SSRF)
-- Path traversal / local file inclusion
-- Information disclosure (credentials, PII, secrets)
-- Cryptographic weaknesses
-- Deserialisation vulnerabilities
+- Command injection, code injection
 - Memory safety issues (buffer overflows, use-after-free, etc.)
+- Type system soundness bugs (violations of linear type guarantees)
+- WASM sandbox escapes
+- Cryptographic weaknesses
+- Information disclosure (credentials, PII, secrets)
 - Supply chain vulnerabilities (dependency confusion, etc.)
-- Significant logic flaws
+- Significant logic flaws in the type checker
 
 ### Non-Qualifying Issues
 
 The following generally do not qualify as security vulnerabilities:
 
 - Missing security headers on non-sensitive pages
-- Clickjacking on pages without sensitive actions
-- Self-XSS (requires victim to paste code)
-- Missing rate limiting (unless it enables a specific attack)
-- Username/email enumeration (unless high-risk context)
-- Missing cookie flags on non-sensitive cookies
 - Software version disclosure
 - Verbose error messages (unless exposing secrets)
 - Best practice deviations without demonstrable impact
+- Performance issues (unless enabling DoS)
 
 ---
 
@@ -322,7 +283,7 @@ Recognition includes:
 To stay informed about security updates:
 
 - **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts"
-- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories)
+- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/ephapax/security/advisories)
 - **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md)
 
 ### Update Policy
@@ -335,8 +296,6 @@ To stay informed about security updates:
 
 ### Supported Versions
 
-<!-- Adjust this table to match your actual version support policy -->
-
 | Version | Supported | Notes |
 |---------|-----------|-------|
 | `main` branch | ✅ Yes | Latest development |
@@ -348,7 +307,7 @@ To stay informed about security updates:
 
 ## Security Best Practices
 
-When using {{PROJECT_NAME}}, we recommend:
+When using Ephapax, we recommend:
 
 ### General
 
@@ -370,8 +329,7 @@ When using {{PROJECT_NAME}}, we recommend:
 
 ## Additional Resources
 
-- [Our PGP Public Key]({{PGP_KEY_URL}})
-- [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories)
+- [Security Advisories](https://github.com/hyperpolymath/ephapax/security/advisories)
 - [Changelog](CHANGELOG.md)
 - [Contributing Guidelines](CONTRIBUTING.md)
 - [CVE Database](https://cve.mitre.org/)
@@ -383,9 +341,9 @@ When using {{PROJECT_NAME}}, we recommend:
 
 | Purpose | Contact |
 |---------|---------|
-| **Security issues** | [Report via GitHub](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) or {{SECURITY_EMAIL}} |
-| **General questions** | [GitHub Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) |
-| **Other enquiries** | See [README](README.md) for contact information |
+| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/ephapax/security/advisories/new) |
+| **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/ephapax/discussions) |
+| **Other enquiries** | See [README](README.adoc) for contact information |
 
 ---
 
@@ -399,8 +357,8 @@ This security policy may be updated from time to time. Significant changes will
 
 ---
 
-*Thank you for helping keep {{PROJECT_NAME}} and its users safe.* 🛡️
+*Thank you for helping keep Ephapax and its users safe.*
 
 ---
 
-<sub>Last updated: {{CURRENT_YEAR}} · Policy version: 1.0.0</sub>
+<sub>Last updated: 2025 · Policy version: 1.0.0</sub>