Close production gap + develop the AffineScript any-game interface

Production gap:
- Fix Secret Scanner startup_failure on main (estate Bug B): grant the
  wrapper job the perms the pinned reusable's gitleaks job requests
  (pull-requests:write, actions:read) and repin standards d135b05->891b1ed
  — same pattern as the green Scorecard wrapper from PR #41
- Migrate deprecated metadata names per estate mandate (2026-06-30):
  .machine_readable/6a2/ -> descriptiles/, agent_instructions/ ->
  bot_directives/, all path references rewritten
- Refresh STATE.a2ml / ROADMAP / CLAUDE.md to verified reality: v0.9.0,
  40 exported FFI symbols, 13 modules, 140 passing tests (94/41/5),
  flake.nix gone (guix only), PRs #61-#63 reflected; record Instant Sync
  red as owner-gated blocker B5 (dead FARM_DISPATCH_TOKEN)

AffineScript interface (the any-game surface):
- NEW src/ui/tea/gsa_ffi.affine — full binding of all 38 libgsa C ABI
  exports as typed externs with / IO effect rows, opaque GsaPtr handle
  type, ResultCode enum mirroring Types.idr codes 0-17, and a cmd_*
  effect layer (bootstrap/probe/action/logs/health/profiles/provision/
  drift/alert/steam) the host dispatches for the pure core
- REWORK src/ui/tea/gsa_gui.affine — from disconnected skeleton to the
  real TEA core: 8 panels (adds NexusSetup), GameProfile registry model
  (18 shipped A2ML profiles + runtime adds + generic auto-detect
  fallback = any game), 15 Msg variants closing the host feedback loop,
  result-code status surface, subscriptions for log/health polling
- Both files typecheck against the affinescript compiler (core face)
- Guard rails: scripts/affine-ffi-contract-check.sh (no phantom
  bindings + 27-symbol core coverage), affine-ffi-contract job in
  abi-contract.yml, just affine-check / affine-contract recipes,
  affine-contract wired into just quality

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -1,3 +1,5 @@
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+<!-- Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> -->
 # CLAUDE.md — Game Server Admin (GSA)
 
 ## Quick Context
@@ -23,7 +25,7 @@ just run version           # print version
 # Run unit tests (fast, no I/O)
 zig build test
 
-# Run integration tests (36 tests, no live services)
+# Run integration tests (41 tests, no live services)
 zig build test-integration
 
 # Run e2e smoke tests (full pipeline, no live services)
@@ -41,7 +43,7 @@ panic-attack assail .
 ```
 Gossamer GUI (Ephapax .eph)        -- src/core/, src/gui/panels/
     |  IPC (gossamer:// protocol)
-Zig FFI (libgsa.so + gsa CLI)     -- src/interface/ffi/src/ (11 modules)
+Zig FFI (libgsa.so + gsa CLI)     -- src/interface/ffi/src/ (13 modules)
     |  C ABI (18 result codes)
 Idris2 ABI (Types/Foreign/Layout)  -- src/interface/abi/
     |  REST (port 8090)
@@ -62,6 +64,8 @@ VeriSimDB (8-modality octads)      -- container/verisimdb/
 | `groove_client.zig` | .well-known Groove voice alerting |
 | `abi_layout.zig` | Canonical C-ABI `extern struct`s + comptime Zig↔Idris layout cross-check |
 | `abi_serde.zig` | Binary ABI emitters + offset readers (`read_int`/`read_ptr`/…) — makes `Layout.idr` offsets a live contract |
+| `steam_client.zig` | Steam Web API (vanity→Steam64, player summary, ownership) |
+| `http_capability.zig` | HTTP capability gateway (Phase 11) — capability-scoped REST surface over the FFI |
 | `cli.zig` | Standalone CLI executable (status, probe, profiles, version) |
 
 `abi_layout_expected.zig` is generated from `Layout.idr` by
@@ -79,13 +83,14 @@ VeriSimDB (8-modality octads)      -- container/verisimdb/
   - **Backup** (port 8091, `GSA_BACKUP_VERISIMDB_URL`): game save metadata, snapshots, restore points
 - **Container images** use Chainguard Wolfi base, Podman, `Containerfile` (never Docker/Dockerfile)
 
-## Current State (2026-06-21)
+## Current State (2026-07-07)
 
-- **Completion**: 93% (15 phases built; v1.0.0 gates still open — see Remaining)
+- **Completion**: 96% (15 phases built; hardening phases 4–8, tri-license + 0.9.0 version SSOT, HTTP capability gateway + illustrated wiki merged via PRs #61–#63; v1.0.0 gates still open — see Remaining)
+- **CI (2026-07-07)**: Secret Scanner startup_failure fixed (caller job-level perms + repin to standards@891b1ed); Instant Sync red is owner-gated (dead FARM_DISPATCH_TOKEN, estate-wide); `.machine_readable/` migrated 6a2→descriptiles, agent_instructions→bot_directives per estate mandate
 - **CI/Governance (2026-06-21, PRs #41–#45)**: workflows hardened (Scorecard wrapper job perms, presence-gated instant-sync, CodeQL `actions`, scoped `deno` perms); standards reusable pins at `4ddc926`; Hypatia false positives suppressed via `.hypatia-ignore` (the inert `.hypatia-baseline.json` was removed — `hypatia scan` never applied it); advisory scan at critical=0/high=0. Doc map + gaps: `docs/INDEX.adoc`.
 - **Zig version**: 0.15.2 (see `.tool-versions`)
 - **Exported FFI symbols**: 40 (comptime linker hints in main.zig)
-- **Tests**: 124 Zig tests across 3 suites (unit: 80, integration: 39, smoke: 5). All passing.
+- **Tests**: 140 Zig tests across 3 suites (unit: 94, integration: 41, smoke: 5). All passing (verified 2026-07-07).
   - Security tests for command injection in server_actions
   - Config parser edge cases for all 8 formats
   - A2ML round-trip, diff, and secret redaction tests
@@ -95,7 +100,7 @@ VeriSimDB (8-modality octads)      -- container/verisimdb/
 - **Cross-language ABI**: `abi_layout.zig` asserts (at compile time + `zig build test`) that the 8 `extern struct`s match the proven `Layout.idr` offsets/sizes; `abi_serde.zig` implements the offset readers/emitters so those offsets are a live runtime contract (was the open HIGH proof item)
 - **VeriSimDB**: Main on 8090 (built, running), backup on 8091 (game saves)
 - **Container**: Containerfile wired with real Zig build, entrypoint.sh execs gsa
-- **Nix/Guix**: Both flake.nix and guix.scm have real build/install phases
+- **Guix**: guix.scm has real build/install phases (flake.nix removed in the nix→guix migration)
 - **Release CI**: release.yml builds Zig, packages tarball, uploads artifacts
 - **Groove**: Full manifest with probe/config/drift/alert capabilities
 - **Icon**: SVG + 256px PNG in assets/
@@ -113,7 +118,7 @@ VeriSimDB (8-modality octads)      -- container/verisimdb/
 | What | Where |
 |------|-------|
 | AI manifest | `0-AI-MANIFEST.a2ml` (read FIRST) |
-| State checkpoint | `.machine_readable/6a2/STATE.a2ml` |
+| State checkpoint | `.machine_readable/descriptiles/STATE.a2ml` |
 | Game profiles | `profiles/*.a2ml` (18 games) |
 | GUI panels | `src/gui/panels/` (8 panels) |
 | Panel clades | `panel-clades/` (9 base + game children) |
@@ -123,6 +128,9 @@ VeriSimDB (8-modality octads)      -- container/verisimdb/
 | Main quadlet | `container/verisimdb/gsa-verisimdb.container` |
 | Backup quadlet | `container/verisimdb-backup/gsa-verisimdb-backup.container` |
 | Icon assets | `assets/icon.svg`, `assets/icon-256.png` |
+| AffineScript interface (pure TEA core) | `src/ui/tea/gsa_gui.affine` |
+| AffineScript FFI layer (libgsa externs + cmd_*) | `src/ui/tea/gsa_ffi.affine` |
+| AffineScript↔Zig symbol contract check | `scripts/affine-ffi-contract-check.sh` (`just affine-contract`; typecheck: `just affine-check`) |
 | E2E test | `scripts/e2e-test.sh` |
 | Gossamer chain test | `scripts/gossamer-integration-test.sh` |
 | CLI binary | `src/interface/ffi/zig-out/bin/gsa` |

.github/workflows/abi-contract.yml

@@ -75,3 +75,19 @@ jobs:
       - name: Type-check the ABI package
         working-directory: src/interface/abi
         run: idris2 --typecheck gsa-abi.ipkg
+
+  affine-ffi-contract:
+    name: AffineScript ↔ Zig FFI symbols in sync
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # Symbol-level contract only (pure grep/comm — no toolchain): every
+      # extern in src/ui/tea/gsa_ffi.affine must be a real Zig export, and
+      # the operational core set must all be bound. The AffineScript
+      # typecheck itself needs the affinescript compiler (not packaged);
+      # run it locally with `just affine-check`.
+      - name: AffineScript FFI symbol contract
+        run: bash scripts/affine-ffi-contract-check.sh

.github/workflows/secret-scanner.yml

@@ -15,5 +15,15 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    # Explicit job-level permissions matching what the pinned reusable's
+    # gitleaks job declares (pull-requests: write for the PR summary
+    # comment, actions: read for its workflow-run metadata calls).
+    # Without this grant the reusable's job-level request exceeds the
+    # caller's workflow-level contents:read cap and the run dies at
+    # startup ("permissions can only be reduced, not elevated").
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@891b1ed6164478616cb3375f328c6487ccb13f80
     secrets: inherit

…_readable/agent_instructions/README.adoc …hine_readable/bot_directives/README.adoc.machine_readable/agent_instructions/README.adoc renamed to .machine_readable/bot_directives/README.adoc .machine_readable/agent_instructions/README.adoc renamed to .machine_readable/bot_directives/README.adoc

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: CC-BY-SA-4.0
-// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
-= Agent Instructions
+// Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= Bot Directives
 :toc: preamble
 
 Methodology-aware configuration for AI agents. Read by any AI agent
@@ -32,7 +32,7 @@ Methodology-aware configuration for AI agents. Read by any AI agent
 == Relationship to Other Files
 
 * `AGENTIC.a2ml` says WHAT agents can do (permissions, gating)
-* `agent_instructions/` says HOW agents should work (methodology)
+* `bot_directives/` says HOW agents should work (methodology)
 * `bot_directives/` says what the gitbot-fleet does (fleet-specific)
 * `CLAUDE.md` says how Claude specifically should work (Claude-specific)