Skip to content

Commit 3dae78b

Browse files
docs: de-template RSR metadata, complete 6a2 + contractiles, add PROOF-NEEDS (#23)
* docs: de-template RSR metadata, complete 6a2 + contractiles, add PROOF-NEEDS git-reticulator was scaffolded from rsr-template-repo and left with unfilled template cruft. This tidies it into proper form and records honest status throughout (legend: IMPLEMENTED | SKELETON | ASPIRATIONAL). Added: - .machine_readable/6a2/{STATE,META,ECOSYSTEM,AGENTIC,NEUROSYM,PLAYBOOK}.a2ml (was missing entirely). NEUROSYM + PLAYBOOK capture the neuro-symbolic architecture (reticulator -> RAG -> verisim octad -> vcl-ut proofs) and five playbooks incl. proof-carrying Graph-RAG retrieval. - PROOF-NEEDS.md — the formal obligations the word "lattice" incurs (partial order, SCC-condensation, meet/join laws, LOD soundness/completeness, drift predicate), in the vcl-ut house style; recommends Idris2. - READINESS.md — CRG-grade source the Justfile already expected (was missing). De-templated (removed {{AUTHOR}}/{{CURRENT_DATE}}/[YOUR-REPO-NAME]): - 0-AI-MANIFEST.a2ml (now describes the actual tree; points at 6a2/) - agent_instructions/{methodology,debt,coverage,README} - .machine_readable/INTENT.contractile; contractiles/intend/Intentfile.a2ml Corrected to match reality: - TOPOLOGY.md (had described non-existent .as files) - README.adoc / EXPLAINME.adoc (wrong bin name + stale caveats; added neuro-symbolic positioning and an honest status banner) - TEST-NEEDS.md (notes the 27 tests are smoke-level over println stubs) - Cargo.toml readme -> README.adoc (was README.md, which is absent) Removed: - .machine_readable/STATE.a2ml (superseded by 6a2/STATE.a2ml) Open items recorded in debt.a2ml: core-language decision (META ADR-001), contractile-system consolidation, CHANGELOG casket/Jekyll wart. https://claude.ai/code/session_01JNCDaWMB8NV6nAPrvmTg4w * ci: add scorecard/mirror/secret-scanner; timeout-minutes on casket-pages Addresses the Hypatia workflow-audit findings on PR #23 (all pre-existing; none introduced by the docs pass). (b) Add the three missing estate-standard workflows, copied from the canonical sibling form (SHA-pinned standards reusables): - mirror.yml (mirror-reusable @e6b2884) - secret-scanner.yml (secret-scanner-reusable @3e4bd4c) - scorecard.yml (scorecard-reusable @e036864; workflow-level contents:read + job-level security-events/id-token writes — the known-good form that avoids the estate-wide read-all startup_failure) (a) Add timeout-minutes: 10 to casket-pages.yml build + deploy jobs. The remaining missing_timeout_minutes findings (governance/hypatia-scan/ rust-ci) are NOT fixable here: those jobs call reusables via `uses:`, where timeout-minutes is not a legal job key — it must live in the standards reusables (out of scope). Recorded in agent_instructions/debt.a2ml, along with the intentionally-left unpinned governance@main. https://claude.ai/code/session_01JNCDaWMB8NV6nAPrvmTg4w
1 parent 3b32a98 commit 3dae78b

25 files changed

Lines changed: 1083 additions & 268 deletions

.github/workflows/casket-pages.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ concurrency:
1818
jobs:
1919
build:
2020
runs-on: ubuntu-latest
21+
timeout-minutes: 10
2122
steps:
2223
- name: Checkout
2324
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
@@ -36,6 +37,7 @@ jobs:
3637
url: ${{ steps.deployment.outputs.page_url }}
3738
runs-on: ubuntu-latest
3839
needs: build
40+
timeout-minutes: 10
3941
steps:
4042
- name: Deploy to GitHub Pages
4143
id: deployment

.github/workflows/mirror.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
name: Mirror to Git Forges
3+
4+
on:
5+
push:
6+
branches: [main]
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
mirror:
14+
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f
15+
secrets: inherit

.github/workflows/scorecard.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
name: Scorecards supply-chain security
3+
4+
on:
5+
branch_protection_rule:
6+
schedule:
7+
- cron: '23 4 * * 1'
8+
push:
9+
branches: [main]
10+
11+
# Workflow-level permissions are read-only. The job that calls the reusable
12+
# upgrades to the writes `ossf/scorecard-action` requires. Job-level
13+
# permissions REPLACE workflow-level for that job, so `contents: read` here
14+
# plus the writes below yields the correct effective set and avoids the
15+
# `read-all` startup_failure seen estate-wide. Matches the canonical caller in
16+
# hyperpolymath/standards/.github/workflows/scorecard-reusable.yml.
17+
permissions:
18+
contents: read
19+
20+
jobs:
21+
analysis:
22+
permissions:
23+
security-events: write
24+
id-token: write
25+
uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e03686486e11b662834d7090dffae54c3e96fd59
26+
secrets: inherit
Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
name: Secret Scanner
3+
4+
on:
5+
pull_request:
6+
push:
7+
branches: [main]
8+
9+
concurrency:
10+
group: ${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
scan:
18+
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
19+
secrets: inherit

.machine_readable/6a2/AGENTIC.a2ml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
#
4+
# AGENTIC.a2ml — AI agent interaction patterns for git-reticulator.
5+
6+
[metadata]
7+
version = "0.2.0"
8+
last-updated = "2026-06-03"
9+
10+
[agent-permissions]
11+
can-edit-source = true
12+
can-edit-tests = true
13+
can-edit-docs = true
14+
can-edit-config = true
15+
can-create-files = true
16+
17+
[agent-constraints]
18+
rules = [
19+
"HONESTY FIRST: never document a SKELETON/println stub as a working feature. Use the NEUROSYM status legend (IMPLEMENTED|SKELETON|ASPIRATIONAL).",
20+
"Do not assert 'lattice' algebra (meet/join) anywhere unless PROOF-NEEDS.md P1 is discharged — otherwise say 'typed graph/DAG'.",
21+
"Never reintroduce template placeholders ({{...}}, [YOUR-REPO-NAME]).",
22+
"Never commit secrets; SPDX header on every file; MPL-2.0 only.",
23+
"State files live in .machine_readable/6a2/ ONLY (not repo root, not .machine_readable/ root).",
24+
"Banned languages per estate policy (TypeScript, Python (non-Salt), Go, Node/npm/Bun).",
25+
]
26+
27+
# ════════════════════════════════════════════════════════════════════════════
28+
# THE AGENT-FACING ROLE OF THIS REPO
29+
# ════════════════════════════════════════════════════════════════════════════
30+
# git-reticulator exists largely TO SERVE AI agents: it is a RAG context
31+
# provider. Agents are both maintainers of, and consumers of, this repo.
32+
33+
[agent-as-consumer]
34+
primary-call = "zoom_to_node(node, level) -> token-bounded sub-lattice for the prompt"
35+
token-discipline = "request the SMALLEST level that answers the question; widen only on miss"
36+
trust-model = "when layers 3-4 are present, prefer context that carries FRESHNESS/PROVENANCE proofs; drop context that fails them rather than showing it"
37+
38+
[maintenance-integrity]
39+
fail-closed = true
40+
require-evidence-per-step = true
41+
allow-silent-skip = false
42+
require-rerun-after-fix = true
43+
release-claim-requires-hard-pass = true
44+
45+
[automation-hooks]
46+
on-enter = "Read 0-AI-MANIFEST.a2ml, then .machine_readable/6a2/STATE.a2ml, then PROOF-NEEDS.md"
47+
on-exit = "Update 6a2/STATE.a2ml [honest-status] + [critical-next-actions] with session outcomes"
48+
on-commit = "just must-check && just trust-verify"
Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
#
4+
# ECOSYSTEM.a2ml — git-reticulator's position and relationships.
5+
6+
[metadata]
7+
version = "0.2.0"
8+
last-updated = "2026-06-03"
9+
10+
[project]
11+
name = "git-reticulator"
12+
purpose = "Symbolic-lattice + embedding extractor for git repos; layer 1 of the neuro-symbolic retrieval stack."
13+
role = "library + cli (structure extractor / RAG context provider)"
14+
15+
[position-in-ecosystem]
16+
tier = "2" # 1 = foundational language/proof; 2 = tooling/application; infrastructure = scaffolding
17+
neuro-symbolic-layer = 1
18+
19+
# relationship types: dependency, dependent, sibling, substrate, proof-layer,
20+
# potential-consumer, inspiration
21+
[[related-projects.project]]
22+
name = "affinescript"
23+
relationship = "core-language + sibling"
24+
contract = "intended implementation language of the lattice core (src/lattice/affine/*.affine); compiles to Wasm. NOTE: not yet a working compiler, and the current .affine calls Rust crates it cannot bind."
25+
26+
[[related-projects.project]]
27+
name = "verisimdb"
28+
relationship = "substrate (downstream)"
29+
contract = "the octad (8 modalities) is a superset of reticulator's needs: Graph<-lattice, Vector<-embeddings, Document<-source, Temporal<-history, Provenance<-authorship, Semantic<-type tags. reticulator is, in effect, a specialised ingester producing verisim octads."
30+
31+
[[related-projects.project]]
32+
name = "vcl-ut"
33+
relationship = "proof-layer (downstream)"
34+
contract = "typed, proof-carrying query language over verisim. Turns reticulator retrieval into PROPOSITIONS carrying PROVENANCE/FRESHNESS/EXISTENCE certificates — the basis of proof-carrying retrieval (NEUROSYM stack layer 4)."
35+
36+
[[related-projects.project]]
37+
name = "k9"
38+
relationship = "dependency (metadata tooling)"
39+
contract = "k9iser.toml is consumed here; K9 contracts machine-check MUST constraints."
40+
41+
[[related-projects.project]]
42+
name = "hypatia / panic-attack"
43+
relationship = "potential-consumer"
44+
contract = "security/quality scanners; PB-4 feeds them a reachable-set (blast radius) from the lattice. Hypatia also scans this repo (hypatia-scan.yml)."
45+
46+
[[related-projects.project]]
47+
name = "standards"
48+
relationship = "sibling-standard"
49+
contract = "estate standards, CRG grading, changelog-reusable.yml, contractile/RSR conventions."
50+
51+
[[related-projects.project]]
52+
name = "LLM / RAG agents"
53+
relationship = "primary-consumer"
54+
contract = "consume zoom_to_node sub-lattices as token-bounded, (eventually) proof-carrying context."
55+
56+
[integration-points]
57+
# system, direction, protocol
58+
points = [
59+
{ system = "verisimdb-data", direction = "outbound", protocol = "git-backed flat-file / repository_dispatch (PB-5)" },
60+
{ system = "postgres+pgRouting", direction = "outbound", protocol = "SQL (ASPIRATIONAL, feature-gated)" },
61+
{ system = "REST consumers", direction = "inbound", protocol = "actix-web /build /zoom /health (stub responses today)" },
62+
]

.machine_readable/6a2/META.a2ml

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
#
4+
# META.a2ml — Architecture decisions and design rationale for git-reticulator.
5+
6+
[metadata]
7+
version = "0.2.0"
8+
last-updated = "2026-06-03"
9+
10+
[project-info]
11+
type = "library + cli" # library (git_reticulator) + binary (reticulate)
12+
languages = ["rust", "affinescript"]
13+
license = "MPL-2.0"
14+
author = "Jonathan D.A. Jewell (hyperpolymath)"
15+
16+
[development-practices]
17+
build-tool = "just"
18+
container-runtime = "podman"
19+
ci-platform = "github-actions"
20+
package-manager = "cargo" # guix.scm / flake.nix also present for reproducible shells
21+
22+
# ════════════════════════════════════════════════════════════════════════════
23+
# ARCHITECTURE DECISIONS (ADRs) — status: proposed | accepted | superseded | rejected
24+
# ════════════════════════════════════════════════════════════════════════════
25+
26+
[[adr]]
27+
id = "ADR-001"
28+
title = "Rust host, AffineScript core"
29+
status = "accepted-but-under-review"
30+
date = "2026-04"
31+
decision = "CLI/REST/IO in Rust; lattice algorithms in AffineScript (.affine) for affine-typed safe traversal."
32+
consequence = "Today the core cannot compile (no AffineScript compiler) and is written against Rust crates AffineScript cannot bind. STATE.honest-status flags this; ADR may be superseded by a Rust-native core."
33+
34+
[[adr]]
35+
id = "ADR-002"
36+
title = "Level-of-Detail (LOD) lattice over four semantic levels"
37+
status = "accepted"
38+
date = "2026-04"
39+
decision = "Nodes carry a SemanticLevel (Module>File>Definition>Block) and a parent_id, so zoom_to_node can return a token-bounded sub-lattice."
40+
rationale = "The product is a RETRIEVAL GEOMETRY for LLMs — minimal relevant context, not a full dump. This is the feature that justifies the project over `git log`."
41+
42+
[[adr]]
43+
id = "ADR-003"
44+
title = "Per-node embedding (neuro-symbolic fusion at the data model)"
45+
status = "accepted"
46+
date = "2026-04"
47+
decision = "Keyword carries an optional embedding vector alongside its order position."
48+
rationale = "One identity = one lattice element + one vector. This is the seam where symbolic and neural meet (see NEUROSYM.a2ml)."
49+
50+
[[adr]]
51+
id = "ADR-004"
52+
title = "PostgreSQL + pgRouting for persistence and pathfinding"
53+
status = "accepted"
54+
date = "2026-04"
55+
decision = "Store nodes/edges in Postgres; use pgRouting (Dijkstra/A*) for reachability and blast-radius queries."
56+
rationale = "Weighted reachability is a first-class query (refactoring impact, security blast-radius — PLAYBOOK PB-4). pgRouting gives it for free."
57+
caveat = "feature-gated off; not yet wired."
58+
59+
[[adr]]
60+
id = "ADR-005"
61+
title = "'Lattice' must be earned, not asserted"
62+
status = "accepted"
63+
date = "2026-06-03"
64+
decision = "The structure is currently a typed weighted DAG/digraph (TOPOLOGY even notes cycle detection). To call it a lattice we must (a) SCC-condense to a DAG, (b) define a partial order, (c) prove meet/join exist + the lattice laws."
65+
rationale = "Honesty + the formal-methods estate norm (cf. vcl-ut). Tracked in PROOF-NEEDS.md."
66+
67+
[design-rationale]
68+
why-this-exists = "Existing git tools work at raw commit/blob level; git-reticulator lifts analysis to a semantic, navigable, embeddable structure suited to feeding LLMs cheaply and provably."
69+
positioning = "layer 1 of a four-layer neuro-symbolic stack (reticulator -> RAG -> verisim octad -> vcl-ut proofs); see NEUROSYM.a2ml"
70+
71+
[maintenance-axes]
72+
scoping-first = true
73+
axis-1 = "must > intend > like"
74+
axis-2 = "corrective > adaptive > perfective"
75+
axis-3 = "systems > compliance > effects"
Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
#
4+
# NEUROSYM.a2ml — Neurosymbolic integration metadata for git-reticulator
5+
#
6+
# This file is NOT a generic template. It records the specific role
7+
# git-reticulator plays in a neurosymbolic (neuro-symbolic) system and the
8+
# invariants that make that role trustworthy. Status markers are honest:
9+
# IMPLEMENTED | SKELETON | ASPIRATIONAL.
10+
11+
[metadata]
12+
version = "0.2.0"
13+
last-updated = "2026-06-03"
14+
status-legend = "IMPLEMENTED = working in Rust on main; SKELETON = stub/println; ASPIRATIONAL = designed in .affine, not yet compilable"
15+
16+
# ════════════════════════════════════════════════════════════════════════════
17+
# THESIS
18+
# ════════════════════════════════════════════════════════════════════════════
19+
# git-reticulator is the SYMBOLIC half of a neuro-symbolic retrieval system.
20+
# It turns an unstructured git repository into a typed, hierarchical, navigable
21+
# structure (the "lattice"): nodes are semantic keywords at four levels of
22+
# detail (Module > File > Definition > Block); edges are typed relationships
23+
# (calls/contains/inherits/depends_on) with weights. The NEURAL half is an
24+
# embedding attached to each node (models.affine: `Keyword.embedding`).
25+
#
26+
# The two halves are fused at the data-model level — every node is
27+
# simultaneously a lattice element (symbolic, ordered, provable) and a vector
28+
# (neural, similarity-searchable). That fusion is the whole point.
29+
30+
[thesis]
31+
symbolic-substrate = "typed keyword lattice + weighted relationship graph (src/lattice/affine/models.affine)"
32+
neural-layer = "per-node embedding vector (Keyword.embedding: Option<Vec<f64>>)"
33+
fusion-point = "the Keyword node — one identity carries both an order position and an embedding"
34+
headline-capability = "proof-carrying retrieval: neural search PROPOSES context, the symbolic lattice + proofs DISPOSE"
35+
36+
# ════════════════════════════════════════════════════════════════════════════
37+
# THE FOUR-LAYER NEURO-SYMBOLIC STACK
38+
# ════════════════════════════════════════════════════════════════════════════
39+
# git-reticulator is layer 1. It is designed to feed layers 2-4. Layers 2-4 are
40+
# OPTIONAL — git-reticulator + a plain vector store is already a useful
41+
# Graph-RAG. The verisim/vcl-ut layers are what make retrieval *provable*.
42+
43+
[stack.layer-1-reticulator]
44+
role = "structure extractor + retrieval geometry"
45+
status = "SKELETON (Rust host 237 LOC of println stubs) + ASPIRATIONAL (.affine core)"
46+
produces = "lattice nodes (keywords w/ embeddings) + typed weighted edges"
47+
key-operation = "zoom_to_node(node, level) — level-of-detail subgraph for token-bounded LLM context"
48+
49+
[stack.layer-2-rag]
50+
role = "neural retrieval over the lattice"
51+
status = "ASPIRATIONAL (embeddings feature-gated: Cargo.toml `embeddings`/tch off by default)"
52+
mechanism = "vector similarity finds candidate nodes; lattice edges expand/constrain/explain them (Graph-RAG)"
53+
token-discipline = "LOD zoom returns the minimal relevant sub-lattice, not the whole repo — bounds prompt size"
54+
55+
[stack.layer-3-verisim]
56+
role = "the substrate at scale — the octad IS a superset of what reticulator needs"
57+
status = "EXTERNAL (hyperpolymath/verisimdb); integration ASPIRATIONAL"
58+
modality-mapping = [
59+
"Graph modality <- the reticulator lattice",
60+
"Vector modality <- the node embeddings",
61+
"Document modality <- source text of each unit",
62+
"Temporal modality <- commit history (when a concept entered the codebase)",
63+
"Provenance modality <- authorship attribution at semantic-unit granularity",
64+
"Semantic modality <- type/category tags",
65+
]
66+
drift-payoff = "verisim drift detection becomes 'has the symbolic lattice drifted from the embedding space / from HEAD?' — i.e. stale-index detection for RAG, for free"
67+
68+
[stack.layer-4-vcl-ut]
69+
role = "typed, proof-carrying query layer over verisim"
70+
status = "EXTERNAL (hyperpolymath/vcl-ut — REAL: machine-checked Idris2 corpus, %default total, zero proof-escape)"
71+
mechanism = "retrieval is a PROPOSITION to a consonance engine with up to 10 levels of type safety + optional PROOF clause"
72+
differentiator = "ordinary RAG retrieves text and hopes; here a retrieved context item can CARRY a machine-checked certificate"
73+
proofs-that-matter-for-rag = [
74+
"PROVENANCE -> 'this snippet was authored by X at commit Y' (auditable citation)",
75+
"FRESHNESS -> 'this line still exists at HEAD' (kills stale-context bugs)",
76+
"EXISTENCE -> 'this entity is real, not hallucinated' (kills fabricated citations)",
77+
"INTEGRITY -> 'the retrieved text matches the stored hash'",
78+
]
79+
80+
# ════════════════════════════════════════════════════════════════════════════
81+
# CONSISTENCY INVARIANT (the neuro-symbolic seam — the genuinely novel proof target)
82+
# ════════════════════════════════════════════════════════════════════════════
83+
# When neural similarity and symbolic proximity disagree, ONE of them is stale.
84+
# We do not assume they agree; we make the disagreement observable and either
85+
# repair it (re-reticulate) or DISCLOSE it. See PROOF-NEEDS.md obligation P6.
86+
87+
[consistency-invariant]
88+
statement = "for nodes a,b: high embedding-cosine(a,b) without a short lattice path is a DRIFT SIGNAL, not an error"
89+
action-on-drift = "re-extract (re-reticulate) the affected sub-lattice; or surface as verisim drift event"
90+
honest-position = "neural and symbolic layers are INDEPENDENT by default; any claimed correlation must be proven or disclosed, never assumed"
91+
92+
# ════════════════════════════════════════════════════════════════════════════
93+
# HYPATIA SCANNER CONFIG (estate neurosym CI)
94+
# ════════════════════════════════════════════════════════════════════════════
95+
[hypatia-config]
96+
scan-enabled = true
97+
scan-depth = "standard" # quick | standard | deep
98+
report-format = "logtalk"
99+
100+
[symbolic-rules]
101+
# Project-specific symbolic rules Hypatia should enforce here.
102+
rules = [
103+
{ name = "no-lattice-claim-without-proof", pattern = "lattice", note = "if a module asserts lattice algebra (meet/join), PROOF-NEEDS.md P1 must cover it", severity = "info" },
104+
{ name = "no-stub-passed-as-done", pattern = "println!\\(\"", note = "build_lattice/query_lattice are SKELETON; do not document them as working", severity = "warning" },
105+
]
106+
107+
[neural-config]
108+
# Embedding model selection is deferred until the `embeddings` feature is wired.
109+
# candidate-model = "code-embedding (local, deno/rust-hosted) — NOT a cloud call"
110+
# confidence-threshold = 0.85
111+
embedding-source = "ASPIRATIONAL (Cargo feature `embeddings` = tch/PyTorch, off by default)"

0 commit comments

Comments
 (0)