chore(floor-raise): add foundational tool integrations

Add AI manifest, Trustfile, Dustfile, and assail recipe as part of the
Floor Raise campaign to establish baseline tooling across all repos.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/contractiles/dust/Dustfile.a2ml

@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Dustfile — Cleanup and Hygiene Contract
+
+[dustfile]
+version = "1.0.0"
+format = "a2ml"
+
+[cleanup]
+stale-branch-policy = "delete-after-merge"
+artifact-retention = "90-days"
+cache-policy = "clear-on-release"
+
+[hygiene]
+linting = "required"
+formatting = "required"
+dead-code-removal = "encouraged"
+todo-tracking = "tracked-in-issues"
+
+[reversibility]
+backup-before-destructive = true
+rollback-mechanism = "git-revert"
+data-retention-policy = "preserve-30-days"

.machine_readable/contractiles/trust/Trustfile.a2ml

@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Trustfile — Integrity and Provenance Contract
+
+[trustfile]
+version = "1.0.0"
+format = "a2ml"
+
+[provenance]
+source-control = "git"
+forge = "github"
+ci-verified = true
+signing-policy = "commit-signing-preferred"
+
+[integrity]
+spdx-compliant = true
+license-audit = "required"
+dependency-pinning = "sha-pinned"
+
+[verification]
+reproducible-builds = "goal"
+sbom-generation = "required"
+attestation = "sigstore-preferred"

.machine_readable/integrations/feedback-o-tron.a2ml

@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Feedback-o-Tron Integration — Autonomous Bug Reporting
+
+[integration]
+name = "feedback-o-tron"
+type = "bug-reporter"
+repository = "https://github.com/hyperpolymath/feedback-o-tron"
+
+[reporting-config]
+platforms = ["github", "gitlab", "bugzilla"]
+deduplication = true
+audit-logging = true
+auto-file-upstream = "on-external-dependency-failure"

.machine_readable/integrations/proven.a2ml

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Proven Integration — Formally Verified Safety Library
+
+[integration]
+name = "proven"
+type = "safety-library"
+repository = "https://github.com/hyperpolymath/proven"
+version = "1.2.0"
+
+[binding-policy]
+approach = "thin-ffi-wrapper"
+unsafe-patterns = "replace-with-proven-equivalent"
+modules-available = ["SafeMath", "SafeString", "SafeJSON", "SafeURL", "SafeRegex", "SafeSQL", "SafeFile", "SafeTemplate", "SafeCrypto"]
+
+[adoption-guidance]
+priority = "high"
+scope = "all-string-json-url-crypto-operations"
+migration = "incremental — replace unsafe patterns as encountered"

.machine_readable/integrations/verisimdb.a2ml

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# VeriSimDB Feed — Cross-Repo Analytics Data Store
+
+[integration]
+name = "verisimdb"
+type = "data-feed"
+repository = "https://github.com/hyperpolymath/nextgen-databases"
+data-store = "verisimdb-data"
+
+[feed-config]
+emit-scan-results = true
+emit-build-metrics = true
+emit-dependency-graph = true
+format = "hexad"
+destination = "verisimdb-data/feeds/"

.machine_readable/integrations/vexometer.a2ml

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Vexometer Integration — Irritation Surface Analysis
+
+[integration]
+name = "vexometer"
+type = "friction-measurement"
+repository = "https://github.com/hyperpolymath/vexometer"
+
+[measurement-config]
+dimensions = 10
+emit-isa-reports = true
+lazy-eliminator = true
+satellite-interventions = true
+
+[hooks]
+cli-tools = "measure-on-error"
+ui-panels = "measure-on-interaction"
+build-failures = "measure-on-failure"

Justfile

@@ -460,3 +460,7 @@ edit:
 build-riscv:
 	@echo "Building for RISC-V..."
 	cross build --target riscv64gc-unknown-linux-gnu
+
+# Run panic-attacker pre-commit scan
+assail:
+    @command -v panic-attack >/dev/null 2>&1 && panic-attack assail . || echo "panic-attack not found — install from https://github.com/hyperpolymath/panic-attacker"

README.adoc

@@ -1,168 +1,5 @@
 = http-capability-gateway
-Jonathan Jewell <jonathan@formdb.org>
-:toc:
+:toc: preamble
 :icons: font
-:sectnums:
 
-== Overview
 
-http-capability-gateway is a lightweight, policy-driven HTTP governance layer
-that enforces a declarative, auditable model of HTTP verb exposure in front of
-existing services.
-
-This project introduces a minimal viable implementation of a new category:
-a capability gateway for HTTP. It does not replace nginx or Apache. Instead,
-it governs what they are allowed to do.
-
-The gateway loads a Verb Governance Spec (DSL v1), validates it, compiles it
-into fast enforcement rules, and applies those rules to real HTTP traffic.
-Every decision is logged in structured form for audit and introspection.
-
-== Why This Exists
-
-Modern systems expose HTTP methods inconsistently and often accidentally.
-DELETE, PUT, PATCH, OPTIONS, and even HEAD can leak capabilities or create
-attack surface when left unmanaged.
-
-Traditional reverse proxies do not provide:
-
-* per-verb governance
-* narrative or provenance
-* reversible policy artefacts
-* trust-aware verb exposure
-* structured constraints
-* intentional stealthing or deception
-
-http-capability-gateway introduces a principled, schema-driven approach to
-HTTP method governance without disrupting existing infrastructure.
-
-== MVP Scope
-
-The MVP focuses on the smallest coherent loop:
-
-1. Load a Verb Governance Spec from disk
-2. Validate it against a top-level schema
-3. Compile it into fast, matchable rules
-4. Enforce those rules on real HTTP traffic
-5. Emit structured logs for every decision
-
-No trust engine, no dynamic scoring, no control plane, no FormBD integration.
-Those will grow around this core in later phases.
-
-== Verb Governance Spec (DSL v1)
-
-The DSL defines:
-
-* global verb rules
-* route-specific overrides
-* stealth profiles
-* narrative metadata
-
-Example:
-
-[source,yaml]
-----
-service:
-  name: ledger-api
-  version: 1
-  environment: dev
-
-verbs:
-  GET: { exposure: public }
-  POST: { exposure: authenticated }
-  DELETE: { exposure: internal }
-
-routes:
-  - path: /accounts
-    verbs:
-      DELETE:
-        exposure: internal
-        narrative: "Account deletion requires internal trust."
-
-stealth:
-  profiles:
-    limited:
-      unauthenticated: 405
-      untrusted: 404
-
-narrative:
-  purpose: "Define safe verb exposure for ledger operations."
-----
-
-== Architecture (MVP)
-
-[source,ascii]
-----
-Policy File (DSL)
-       |
-       v
-Policy Loader → Validator → Compiler
-       |
-       v
-Gateway (Elixir)
-       |
-       v
-HTTP Traffic → Enforcement → JSON Logs
-----
-
-== Running the Gateway
-
-* Install Elixir
-* Clone the repository
-* Provide a policy file under `config/policy.yaml`
-* Start the gateway:
-
-[source,bash]
-----
-mix run --no-halt
-----
-
-== Performance Optimisations (v1.0.0)
-
-=== Tiered ETS Lookup
-
-Policy lookups use a three-tier strategy that eliminates full-table scans:
-
-* **Tier 1 — Exact Path (O(1))**: Literal route patterns (no regex metacharacters) are stored with `{:exact, path, verb}` ETS keys. A direct hash lookup resolves 90%+ of requests instantly.
-* **Tier 2 — Regex Routes (O(r))**: Patterns containing regex metacharacters are tested only against other regex routes, not the entire table.
-* **Tier 3 — Global Rules (O(1))**: If no route matches, a final `{:global, verb}` lookup catches global verb defaults.
-
-For a 1000-route policy, this reduces from ~1000 regex evaluations per request to 1 hash lookup (typical case) or ~50 regex evaluations (edge case).
-
-=== Security Headers
-
-All responses (including health/metrics endpoints) include OWASP-recommended security headers:
-
-* `X-Content-Type-Options: nosniff` — prevent MIME-type sniffing
-* `X-Frame-Options: DENY` — prevent clickjacking
-* `Referrer-Policy: strict-origin-when-cross-origin` — limit referrer leakage
-* `Cache-Control: no-store, no-cache, must-revalidate` — prevent caching of policy decisions
-* `Connection: close` — prevent connection reuse across trust boundaries
-
-== Roadmap
-
-=== Phase 2
-* Rate limits
-* Expanded stealth profiles
-* Hot policy reloads
-
-=== Phase 3
-* Control plane
-* FormBD integration for provenance
-* Distributed gateways
-
-=== Phase 4
-* V-based data plane
-* Agent introspection
-* Constraint engine
-* FQLdt proofs
-
-== Philosophy
-
-This project treats governance as a first-class engineering concern.
-Policies are artefacts. Artefacts are reversible. Decisions have provenance.
-HTTP verbs become capabilities, not accidents.
-
-== License
-
-PMPL-1.0-or-later (Palimpsest License)