fix(ci): resolve the four standing CI/CD failures at their roots (#29)

Every one of these was red on `main` on **every push**. Fixed at source,
not suppressed.

| Check | Root cause | Fix |
|---|---|---|
| 🟡 Estate rules | `flake.nix` not on the root allowlist | removed
(Guix-only ruling) |
| 🟡 OpenSSF best-practices | unfilled `{{PLACEHOLDER}}` tokens in 3
required files | filled / removed |
| 🟡 RSR self-use (dogfooding) | two `uses:` actions that **404** |
replaced with inline checks |
| Dependabot `github_actions` | same 404 actions — the updater cannot
resolve them | same fix |

## 1. `flake.nix` — the sole `estate-rules` blocker

`scripts/check-root-shape.sh` reported exactly one offender. `flake.nix`
is debris
from the 07-21 sweep and contradicts the **2026-05-18 ruling** that the
estate is
Guix-primary with the Nix fallback retired — the file even documents
itself as
*"the Nix fallback tier"*. Removed. `build/guix.scm` is untouched, so
`🔴 Gate: Guix-only package policy` is unaffected (it only checks for the
presence
of `*.scm`).

Now: `PASS: root matches allowlist (45 entries, 46 permitted)`.

If you would rather keep it, the alternative is `git mv flake.nix
build/` — say the
word and I will swap the approach.

## 2. Placeholder tokens

- **`.github/SECURITY.md`** still carried its own *"TEMPLATE
INSTRUCTIONS (delete
this block before publishing)"* header, and advertised a PGP key that
does not
exist (`{{PGP_KEY_URL}}`, `{{PGP_FINGERPRINT}}`). Both removed —
pointing users
at an unfetchable key is worse than saying plainly that there isn't one.
- **`STATE.a2ml` / `ECOSYSTEM.a2ml`** were verbatim copies of
`rsr-template-repo`'s
manifests: `project = "rsr-template-repo"`, the template's purpose, and
`phase = maintenance` / `maturity = production`. They now describe Haec
  (`0.1.0`, design/experimental) and its real pipeline position
  (workbench → **haec** → trope-checker).

This is the **template self-name leak** — it misdirects any tooling that
keys
  off these files.

## 3. Two actions that do not exist

```
hyperpolymath/a2ml-validate-action  → HTTP 404
hyperpolymath/k9-validate-action    → HTTP 404
```

They failed at **"Set up job"** on every push, so they never validated
anything —
`continue-on-error: true` merely hid that they were inert. An
unresolvable action
*also* breaks Dependabot's `github_actions` updater, which is why that
job was
failing as well: **one root cause, two symptoms**.

Replaced with inline checks of the envelope contract that genuinely
exists:

- non-empty, valid UTF-8, `SPDX-License-Identifier` present;
- for K9, the magic first line — `K9!` for `.k9`, `# K9!` for `.k9.ncl`
so
  `nickel typecheck` still parses the file.

**Their limits are stated in the workflow itself:** they do *not* parse
the A2ML
grammar or typecheck Nickel. That still needs the real validators. This
is a
smaller claim than the 404'd actions implied, but unlike them it
actually runs.

Also added SPDX headers to **6 `.a2ml` manifests** that had none — REUSE
compliance, and it stops the new check being vacuous.

## Verified locally

```
root-shape .................. PASS (45/46)
openssf placeholder check ... PASS
A2ML envelope check ......... PASS (119 manifests)
K9 envelope check ........... PASS (10 contracts)
workflow YAML ............... ALL OK (every file has ≥1 live job)
```

## Deliberately not changed

`CLADE.a2ml` still declares `canonical-name = "rsr-template-repo"` with
the
template's registry UUID (`a5ea1382-…`), clade prefix `rm`, and forge
URLs pointing
at the template. Those are assigned by `gv-clade-index`; inventing
replacements
would corrupt that registry, so Haec needs a **real clade assignment**.
Flagging
rather than guessing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/0.1-AI-MANIFEST.a2ml

@@ -1 +1,3 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: © 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 # AI Manifest - Level 1: .github

.github/SECURITY.md

@@ -4,24 +4,6 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 # Security Policy
 
-<!-- 
-============================================================================
-TEMPLATE INSTRUCTIONS (delete this block before publishing)
-============================================================================
-Replace all {{PLACEHOLDER}} values with your information:
-  Haec     - Your project name
-  hyperpolymath            - GitHub username or org (e.g., hyperpolymath)
-  haec             - Repository name
-  j.d.a.jewell@open.ac.uk   - Security contact email
-  {{PGP_FINGERPRINT}}  - Your PGP key fingerprint (40 chars, no spaces)
-  {{PGP_KEY_URL}}      - URL to your public PGP key
-  https://github.com/hyperpolymath/haec          - Your website/domain
-  2026     - Current year for copyright
-
-Optional: Remove sections that don't apply (e.g., PGP if you don't use it)
-============================================================================
--->
-
 We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions.
 
 ## Table of Contents
@@ -56,26 +38,16 @@ This method ensures:
 - Coordinated disclosure tooling
 - Automatic credit when the advisory is published
 
-### Alternative: Encrypted Email
+### Alternative: Email
 
 If you cannot use GitHub Security Advisories, you may email us directly:
 
 | | |
 |---|---|
 | **Email** | j.d.a.jewell@open.ac.uk |
-| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) |
-| **Fingerprint** | `{{PGP_FINGERPRINT}}` |
-
-```bash
-# Import our PGP key
-curl -sSL {{PGP_KEY_URL}} | gpg --import
 
-# Verify fingerprint
-gpg --fingerprint j.d.a.jewell@open.ac.uk
-
-# Encrypt your report
-gpg --armor --encrypt --recipient j.d.a.jewell@open.ac.uk report.txt
-```
+No PGP key is published for this project. If you need to send an encrypted
+report, say so in a first plaintext message and a key will be exchanged.
 
 > **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media.
 
@@ -374,7 +346,6 @@ When using Haec, we recommend:
 
 ## Additional Resources
 
-- [Our PGP Public Key]({{PGP_KEY_URL}})
 - [Security Advisories](https://github.com/hyperpolymath/haec/security/advisories)
 - [Changelog](CHANGELOG.md)
 - [Contributing Guidelines](CONTRIBUTING.md)

.github/workflows/dogfood-gate.yml

@@ -48,23 +48,65 @@ jobs:
             echo "::warning::Found $config_count config files but no K9 contracts"
           fi
 
-      - name: Validate A2ML manifests
+      # hyperpolymath/a2ml-validate-action and hyperpolymath/k9-validate-action
+      # do not exist — both 404. The steps therefore failed at "Set up job" on
+      # every push, and an unresolvable action also breaks Dependabot's
+      # github_actions updater. Validated inline until those are published.
+      #
+      # Scope is deliberately limited and stated honestly: these assert the
+      # file-level envelope contract (encoding, non-emptiness, SPDX header, and
+      # the K9 magic first line). They do NOT parse the A2ML grammar or
+      # typecheck Nickel — that still needs the real validators.
+      - name: Validate A2ML manifest envelopes
         id: a2ml
         if: steps.inventory.outputs.a2ml_count != '0'
-        continue-on-error: true
-        uses: hyperpolymath/a2ml-validate-action@05bcb78917c09702e90ed18004298a6728753914 # main
-        with:
-          path: '.'
-          strict: 'false'
+        shell: bash
+        run: |
+          set -euo pipefail
+          fail=0
+          while IFS= read -r -d '' f; do
+            if [ ! -s "$f" ]; then
+              echo "::error file=$f::empty A2ML manifest"; fail=1; continue
+            fi
+            if ! iconv -f UTF-8 -t UTF-8 "$f" >/dev/null 2>&1; then
+              echo "::error file=$f::not valid UTF-8"; fail=1; continue
+            fi
+            if ! grep -qE 'SPDX-License-Identifier:' "$f"; then
+              echo "::error file=$f::missing SPDX-License-Identifier header"; fail=1
+            fi
+          done < <(find . -name '*.a2ml' -not -path './.git/*' -print0)
+          [ "$fail" -eq 0 ] || { echo "::error::A2ML envelope check failed"; exit 1; }
+          echo "A2ML envelope check: OK"
 
-      - name: Validate K9 contracts
+      - name: Validate K9 contract envelopes
         id: k9
         if: steps.inventory.outputs.k9_count != '0'
-        continue-on-error: true
-        uses: hyperpolymath/k9-validate-action@bddcd9109ee96f9ea3fdb4bf51084fe9cd0909ce # main
-        with:
-          path: '.'
-          strict: 'false'
+        shell: bash
+        run: |
+          set -euo pipefail
+          fail=0
+          while IFS= read -r -d '' f; do
+            if [ ! -s "$f" ]; then
+              echo "::error file=$f::empty K9 contract"; fail=1; continue
+            fi
+            if ! iconv -f UTF-8 -t UTF-8 "$f" >/dev/null 2>&1; then
+              echo "::error file=$f::not valid UTF-8"; fail=1; continue
+            fi
+            first=$(head -1 "$f")
+            case "$f" in
+              # .k9.ncl must comment the magic so `nickel typecheck` still parses.
+              *.k9.ncl) want='# K9!' ;;
+              *)        want='K9!'  ;;
+            esac
+            if [ "$first" != "$want" ]; then
+              echo "::error file=$f::first line must be '$want' (found: '$first')"; fail=1
+            fi
+            if ! grep -qE 'SPDX-License-Identifier:' "$f"; then
+              echo "::error file=$f::missing SPDX-License-Identifier header"; fail=1
+            fi
+          done < <(find . \( -name '*.k9' -o -name '*.k9.ncl' \) -not -path './.git/*' -print0)
+          [ "$fail" -eq 0 ] || { echo "::error::K9 envelope check failed"; exit 1; }
+          echo "K9 envelope check: OK"
 
       - name: Scan for invisible characters
         id: empty_lint

.machine_readable/6a2/0-AI-MANIFEST.a2ml

@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: © 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 # AI Manifest for 6a2 Directory
 
 ## Purpose

.machine_readable/6a2/ECOSYSTEM.a2ml

@@ -1,23 +1,21 @@
 # SPDX-License-Identifier: MPL-2.0
-# ECOSYSTEM.a2ml — Ecosystem position (META-TEMPLATE)
+# ECOSYSTEM.a2ml — Ecosystem position for Haec.
 #
-# This is the ECOSYSTEM file for rsr-template-repo itself. It records the
-# TEMPLATE's own position in the estate. When consumed by a new project,
-# replace these fields with the target project's ecosystem position and
-# related projects (see the NOTE FOR CONSUMERS at the bottom).
+# Instantiated from the rsr-template-repo meta-template; the fields below
+# describe Haec's own position in the estate.
 
 [metadata]
-project = "rsr-template-repo"
+project = "haec"
 ecosystem = "hyperpolymath"
 
 [position]
-type = "repository-template"
-purpose = "Canonical RSR-compliant repository template: scaffolding (CI/CD, AI manifests, ABI/FFI standards, container ecosystem, governance) that new hyperpolymath projects are instantiated from."
+type = "language"
+purpose = "Writes and type-checks Haec programs and emits Trope IR. Haec is deliberately not the tropechecker (trope-checker) and not the vocabulary (trope-particularity-workbench)."
 
 [pipeline]
-position = "foundation"
-chain = "standards → rsr-template-repo → (every estate repo)"
-notes = "rsr-template-repo turns the RSR standard into runnable scaffolding. New repos are created from it via `just init`, which substitutes the {{PLACEHOLDER}} tokens."
+position = "producer"
+chain = "trope-particularity-workbench (vocabulary) → haec (emits Trope IR) → trope-checker (verdict)"
+notes = "Haec produces a record of graded effects; the checker consumes that IR and returns a verdict against each consumer's declared use-model. The checker never executes a Haec program, so Rice's theorem is no obstacle: an unbounded lossy loop simply gets an honest top grade."
 coordination = "standards"
 
 [related-projects]

.machine_readable/6a2/STATE.a2ml

@@ -1,26 +1,26 @@
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
-# STATE.a2ml — Project state checkpoint (META-TEMPLATE)
+# STATE.a2ml — Project state checkpoint for Haec.
 #
-# This is the STATE file for rsr-template-repo itself.
-# When consumed by a new project, replace {{PLACEHOLDER}} tokens
-# and customize sections below for the target project.
+# Instantiated from the rsr-template-repo meta-template. Identity and
+# project-context below describe Haec; sections further down are still
+# inherited from the template and need review (see NOTE, bottom).
 
 [metadata]
-project = "rsr-template-repo"
-version = "0.2.0"
+project = "haec"
+version = "0.1.0"
 last-updated = "2026-02-28"
 status = "active"  # active | paused | archived
 
 [project-context]
-name = "rsr-template-repo"
-purpose = "Canonical RSR-compliant repository template providing scaffolding for all hyperpolymath projects — including CI/CD, AI manifests, ABI/FFI standards, container ecosystem, and governance infrastructure."
-completion-percentage = 95
+name = "Haec"
+purpose = "A Turing-complete language whose type discipline is trope-particularity: every operation over a property-instance carries a loss-shape grade, emitted as Trope IR for a separate, language-independent tropechecker to verdict."
+completion-percentage = 10  # rough: design stage, see README status '0.1 (design)'
 
 [position]
-phase = "maintenance"      # design | implementation | testing | maintenance | archived
-maturity = "production"    # experimental | alpha | beta | production | lts
+phase = "design"           # design | implementation | testing | maintenance | archived
+maturity = "experimental"  # experimental | alpha | beta | production | lts
 
 [route-to-mvp]
 milestones = [
@@ -58,7 +58,7 @@ part-of = ["RSR Framework", "stapeln ecosystem"]
 depends-on = ["stapeln", "selur-compose", "cerro-torre", "svalinn", "vordr", "k9-svc"]
 
 # ---------------------------------------------------------------------------
-# NOTE FOR CONSUMERS: When using this template to create a new repo, reset
-# the fields above to your project's values and replace all {{PLACEHOLDER}}
-# tokens. The milestones above describe the TEMPLATE's evolution, not yours.
+# NOTE: the milestones and depends-on above are still the meta-template's,
+# not Haec's, and are pending a rewrite. Identity, purpose, phase and
+# maturity have been corrected to describe this project.
 # ---------------------------------------------------------------------------

.machine_readable/6a2/anchors/0-AI-MANIFEST.a2ml

@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: © 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 # AI Manifest for Anchor Directory
 
 ## Purpose

.machine_readable/ai/AI.a2ml

@@ -1,4 +1,5 @@
-
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: © 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 # AI Assistant Instructions
 
 ## Repository Focus

examples/0.1-AI-MANIFEST.a2ml

@@ -1 +1,3 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: © 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 # AI Manifest - Level 1: examples