diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index 4feb831..3c6ffd2 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Bug report
 about: Report a problem with the registry or a registered package's metadata
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
index 8e402f6..65550b9 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Feature request
 about: Suggest an improvement to the registry's tooling, policies, or scope
diff --git a/.github/ISSUE_TEMPLATE/package_registration.md b/.github/ISSUE_TEMPLATE/package_registration.md
index e47dafd..90417bb 100644
--- a/.github/ISSUE_TEMPLATE/package_registration.md
+++ b/.github/ISSUE_TEMPLATE/package_registration.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Package registration request
 about: Propose a new package, or a new version of an existing package, for registration
diff --git a/.github/copilot/coding-agent.yml b/.github/copilot/coding-agent.yml
new file mode 100644
index 0000000..a719a77
--- /dev/null
+++ b/.github/copilot/coding-agent.yml
@@ -0,0 +1,6 @@
+mcp_servers:
+  boj-server:
+    command: npx
+    args: ["-y", "@hyperpolymath/boj-server@latest"]
+    env:
+      BOJ_URL: http://localhost:7700
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index 7868fbf..144e367 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -7,6 +7,7 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 367117c..2492e72 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -1,40 +1,36 @@
 # SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages
-
 on:
   push:
     branches: [main, master]
   workflow_dispatch:
-
 permissions:
   contents: read
   pages: write
   id-token: write
-
 concurrency:
   group: "pages"
   cancel-in-progress: false
-
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
 
       - name: Setup Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
-
       - name: Upload artifact
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: '.'
-
   deploy:
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: build
     steps:
       - name: Deploy to GitHub Pages
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fc99b0f..063e408 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,3 +1,4 @@
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
 # Analyses the GitHub Actions workflows in this repo. This is a Julia
 # package registry: source content is TOML and the only executable
@@ -5,7 +6,6 @@
 # matrix that produces meaningful SAST results (closing the
 # `scorecard/StaticAnalysis` nominal-SAST finding).
 name: CodeQL Security Analysis
-
 on:
   push:
     branches: [main, master]
@@ -13,17 +13,15 @@ on:
     branches: [main, master]
   schedule:
     - cron: '0 6 * * 1'
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
-
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
       security-events: write
@@ -33,7 +31,6 @@ jobs:
         include:
           - language: actions
             build-mode: none
-
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -43,7 +40,6 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
-
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3
         with:
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 014b1eb..4871c84 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -11,13 +11,11 @@
 # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
 
 name: Governance
-
 on:
   push:
     branches: [main, master]
   pull_request:
   workflow_dispatch:
-
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
 # Actions concurrency pool. Applied only to read-only check workflows
@@ -25,10 +23,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
-
 jobs:
   governance:
     uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260
+    timeout-minutes: 10
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index c68b9ed..1238f35 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,9 +1,9 @@
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
 # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
 # See standards#191 for the reusable's purpose and design.
 
 name: Hypatia Security Scan
-
 on:
   push:
     branches: [main, master, develop]
@@ -12,17 +12,14 @@ on:
   schedule:
     - cron: '0 0 * * 0'
   workflow_dispatch:
-
 # Estate guardrail: cancel superseded runs so re-pushes don't pile up.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
   security-events: write
   pull-requests: write
-
 jobs:
   hypatia:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 4880045..f2ba3cd 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,15 +1,15 @@
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0-or-later
 name: Mirror to Git Forges
-
 on:
   push:
     branches: [main]
   workflow_dispatch:
-
 permissions:
   contents: read
-
 jobs:
   mirror:
     uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260
+    timeout-minutes: 10
+    secrets: inherit
     secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 49310c9..24db3a4 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,13 +1,12 @@
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
 name: Scorecards supply-chain security
-
 on:
   branch_protection_rule:
   schedule:
     - cron: '23 4 * * 1'
   push:
     branches: [main]
-
 # Workflow-level permissions are read-only. The job that calls the
 # reusable upgrades to the writes required by ossf/scorecard-action.
 # See the canonical caller block in
@@ -16,11 +15,11 @@ on:
 # the job-level overrides below are necessary, not redundant.
 permissions:
   contents: read
-
 jobs:
   analysis:
     permissions:
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260
+    timeout-minutes: 10
     secrets: inherit
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 9bdf984..039d109 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,19 +1,28 @@
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0-or-later
 name: Secret Scanner
-
 on:
   pull_request:
   push:
     branches: [main]
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
-
 jobs:
   scan:
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260
+    timeout-minutes: 10
     secrets: inherit
+    secrets: inherit
+  trufflehog:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          fetch-depth: 0
+      - name: TruffleHog Secret Scan
+        uses: trufflesecurity/trufflehog@main
+        with:
+          extra_args: --only-verified --fail
diff --git a/.machine_readable/6a2/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/0-AI-MANIFEST.a2ml
new file mode 100644
index 0000000..6bf1f8c
--- /dev/null
+++ b/.machine_readable/6a2/0-AI-MANIFEST.a2ml
@@ -0,0 +1,31 @@
+# AI Manifest for 6a2 Directory
+
+## Purpose
+
+This manifest declares the AI-assistant context for the 6a2 machine-readable metadata directory.
+
+## Canonical Locations
+
+The 6 core A2ML files MUST exist in this directory:
+1. AGENTIC.a2ml
+2. ECOSYSTEM.a2ml
+3. META.a2ml
+4. NEUROSYM.a2ml
+5. PLAYBOOK.a2ml
+6. STATE.a2ml
+
+## Invariants
+
+- No duplicate files in root directory
+- Single source of truth: this directory is authoritative
+- No stale metadata
+
+## Protocol
+
+When multiple agents may write to A2ML files concurrently:
+1. Read file and record git-sha-at-read in [provenance] section
+2. Lock by creating .lock-<FILENAME>
+3. Write updated file with new [provenance] metadata
+4. Release by removing lock file
+5. On conflict: re-read and retry if git-sha-at-read does not match HEAD
+
diff --git a/.machine_readable/6a2/AGENTIC.a2ml b/.machine_readable/6a2/AGENTIC.a2ml
new file mode 100644
index 0000000..b21d81b
--- /dev/null
+++ b/.machine_readable/6a2/AGENTIC.a2ml
@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# AGENTIC.a2ml — AI agent constraints and capabilities
+# Defines what AI agents can and cannot do in this repository.
+
+[metadata]
+version = "0.1.0"
+last-updated = "2026-04-11"
+
+[agent-permissions]
+can-edit-source = true
+can-edit-tests = true
+can-edit-docs = true
+can-edit-config = true
+can-create-files = true
+
+[agent-constraints]
+# What AI agents must NOT do:
+# - Never use banned language patterns (believe_me, unsafeCoerce, etc.)
+# - Never commit secrets or credentials
+# - Never use banned languages (TypeScript, Python, Go, etc.)
+# - Never place state files in repository root (must be in .machine_readable/)
+# - Never use AGPL license (use MPL-2.0)
+
+[maintenance-integrity]
+fail-closed = true
+require-evidence-per-step = true
+allow-silent-skip = false
+require-rerun-after-fix = true
+release-claim-requires-hard-pass = true
+
+# ============================================================================
+# METHODOLOGY (ADR-002)
+# ============================================================================
+# Detailed methodology configuration lives in:
+#   .machine_readable/bot_directives/methodology.a2ml
+#   .machine_readable/bot_directives/coverage.a2ml
+#   .machine_readable/bot_directives/debt.a2ml
+#
+# AGENTIC.a2ml declares WHAT agents can do (permissions, gating).
+# bot_directives/ declares HOW agents should work (methodology).
+
+[methodology]
+instructions-dir = ".machine_readable/bot_directives/"
+default-mode = "hybrid"
+
+[automation-hooks]
+# on-enter: Read 0-AI-MANIFEST.a2ml, then STATE.a2ml, then bot_directives/
+# on-exit: Update STATE.a2ml, coverage.a2ml, and debt.a2ml with session outcomes
+# on-commit: Run just validate-rsr
diff --git a/.machine_readable/6a2/NEUROSYM.a2ml b/.machine_readable/6a2/NEUROSYM.a2ml
new file mode 100644
index 0000000..1acf7a3
--- /dev/null
+++ b/.machine_readable/6a2/NEUROSYM.a2ml
@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# NEUROSYM.a2ml — Neurosymbolic integration metadata
+# Configuration for Hypatia scanning and symbolic reasoning.
+
+[metadata]
+version = "0.1.0"
+last-updated = "2026-04-11"
+
+[hypatia-config]
+scan-enabled = true
+scan-depth = "standard"  # quick | standard | deep
+report-format = "logtalk"
+
+[symbolic-rules]
+# Custom symbolic rules for this project
+# - { name = "no-unsafe-ffi", pattern = "believe_me|unsafeCoerce", severity = "critical" }
+
+[neural-config]
+# Neural pattern detection settings
+# confidence-threshold = 0.85
+# model = "hypatia-v2"
diff --git a/.machine_readable/6a2/PLAYBOOK.a2ml b/.machine_readable/6a2/PLAYBOOK.a2ml
new file mode 100644
index 0000000..676ec4c
--- /dev/null
+++ b/.machine_readable/6a2/PLAYBOOK.a2ml
@@ -0,0 +1,137 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# PLAYBOOK.a2ml — Operational playbook
+# Runbooks, incident response, deployment procedures.
+
+[metadata]
+version = "0.1.0"
+last-updated = "2026-04-11"
+
+[deployment]
+# method = "gitops"  # gitops | manual | ci-triggered
+# target = "container"  # container | binary | library | wasm
+
+[incident-response]
+# 1. Check .machine_readable/STATE.a2ml for current status
+# 2. Review recent commits and CI results
+# 3. Run `just validate` to check compliance
+# 4. Run `just security` to audit for vulnerabilities
+
+[release-process]
+# 1. Update version in STATE.a2ml, META.a2ml, Justfile
+# 2. Run `just release-preflight` (validate + quality + security + maint-hard-pass)
+# 3. Optional local permission hardening: `just perms-snapshot && just perms-lock`
+# 4. Tag and push
+# 5. Restore local permissions if needed: `just perms-restore`
+# 6. Run `just container-push` if applicable
+
+[maintenance-operations]
+# Baseline audit:
+#   just maint-audit
+# Hard release gate:
+#   just maint-hard-pass
+# Permission audit:
+#   just perms-audit
+
+[rsr-repo-skeleton]
+# Canonical organisation of any RSR-derived repository.
+# Used by tooling, human onboarding, and the scheduled downstream sweep agent.
+# The 5-PR cleanup pattern (below) brings a non-conforming repository into
+# compliance with this skeleton.
+#
+# This section is the single source of truth for "what does an RSR repo look
+# like?". Other docs (TOPOLOGY, AUDIT, etc.) describe the repo at hand;
+# this describes the canonical shape that all RSR repos share.
+
+skeleton-version = "1.0"
+last-updated = "2026-04-30"
+authority-allowlist = ".machine_readable/root-allow.txt"
+enforcement-workflow = ".github/workflows/estate-rules.yml"
+
+# === Required at root ===
+# README.adoc          High-level pitch (project entry point)
+# AUDIT.adoc           Local gate summary (release-readiness)
+# EXPLAINME.adoc       Developer deep-dive (architecture & invariants)
+# 0-AI-MANIFEST.a2ml   AI agent work-allocation policy
+# LICENSE              Repo license (root-bound by convention)
+# CHANGELOG.md         One of the recognised .md exceptions (see below)
+# Justfile             Task runner — thin, imports per-section files from build/just/
+# coordination.k9      Repo-local session binding
+
+# === Required directories ===
+# .github/             CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/
+# .machine_readable/   AI manifests (0.1-AI-MANIFEST.a2ml), 6a2/ checkpoints,
+#                      contractiles/, configs/, anchors/, policies/, scripts/, svc/
+# build/               contractile.just, flake.nix, guix.scm, Containerfile,
+#                      just/*.just (Justfile section imports)
+# docs/                onboarding/, status/, architecture/, governance/  (all .adoc)
+# session/             dispatch.sh, custom-checks.k9, local-hooks.sh
+# src/                 Project source (Idris2 ABI under abi/, Zig FFI under ffi/)
+# tests/, benches/, examples/, features/, scripts/, verification/, container/
+
+# === Documentation format rule ===
+# `.adoc` is the default for all general docs (TOPOLOGY, READINESS, ROADMAP,
+# TEST-NEEDS, PROOF-NEEDS, PROOF-STATUS, llm-warmup-*, etc.).
+#
+# `.md` is reserved ONLY for files GitHub's community-health rules
+# special-case by name:
+#   CONTRIBUTING.md  CODE_OF_CONDUCT.md  SECURITY.md  CHANGELOG.md
+#
+# Enforcement: `scripts/check-no-md-in-docs.sh` (fails if any *.md under docs/).
+
+# === Banned: ziguage ===
+# V (vlang.io) is banned estate-wide. Replaced by `zig-unified-api-adapter`
+# (16 endpoints + transaction-based firewall gating). Do not introduce
+# zig code, scaffolders, or references. Note that Coq theorem files use
+# the same `.v` extension and are unaffected — the rule looks at content
+# patterns, not the extension.
+#
+# Enforcement: `scripts/check-no-vlang.sh`.
+
+# === Justfile structure (post-split) ===
+# The root Justfile is thin — it holds `set` directives, project metadata
+# variables, and the `default`/`help`/`info` recipes. Each major section
+# lives in its own file under build/just/ and is brought in via `import?`.
+#
+# Imported sections (in the canonical split):
+#   build/just/init.just       INIT recipe (template bootstrap)
+#   build/just/assess.just     self-assess + verify (OpenSSF compliance)
+#   build/just/validate.just   validate-rsr/state/ai-install + aggregate
+#   build/just/proofs.just     proof-check-{all,idris2,lean4,agda,coq},
+#                              proof-scan-dangerous, proof-status
+#   build/just/groove.just     Groove protocol setup (after zig removed)
+#
+# Daily-use recipes (BUILD, TEST, LINT, RUN, DEPS, DOCS, CONTAINER, CI,
+# SECURITY, STATE, GUIX/NIX, MATRIX, VERSION CONTROL, UTILITIES, SESSION)
+# stay in the root Justfile where users expect to find them.
+
+# === 5-PR cleanup pattern ===
+# Apply these branches (in order) to bring a non-conforming downstream repo
+# into compliance with this skeleton:
+#
+# 1. chore/root-cleanup       Relocate root sprawl per root-allow.txt; add
+#                             scripts/check-root-shape.sh; remove stub
+#                             health files shadowed by .github/ versions.
+# 2. chore/remove-zig      Purge zig remnants (gen-v-connector recipe,
+#                             "V-TRIPLE" section header, "V-triple
+#                             connectors" comment in groove.a2ml).
+# 3. chore/md-to-adoc         Port general docs in docs/ from .md to .adoc;
+#                             update validate-template.sh to accept .adoc
+#                             fallbacks.
+# 4. chore/estate-rules-ci    Add scripts/check-no-md-in-docs.sh + check-no-
+#                             vlang.sh + .github/workflows/estate-rules.yml.
+# 5. chore/<repo>-hygiene     Repo-specific drift cleanup (case collisions,
+#                             template-derivation drift in titles, etc.).
+
+# === Reference scripts ===
+# scripts/check-root-shape.sh      Root allowlist validator
+# scripts/check-no-md-in-docs.sh   AsciiDoc-by-default validator
+# scripts/check-no-vlang.sh        zig ban validator
+# scripts/validate-template.sh     Aggregate RSR compliance (workflows, SPDX, etc.)
+
+# === Reference memory entries (for AI agents) ===
+# feedback_adoc_default_md_for_githealth   AsciiDoc-by-default rule
+# feedback_v_lang_banned                   zig ban
+# project_zig_unified_api                  Replacement for v-triple/zig
+# feedback_gh_workflow_scope               OAuth scope for workflow files
diff --git a/.machine_readable/6a2/README.adoc b/.machine_readable/6a2/README.adoc
new file mode 100644
index 0000000..bc033d7
--- /dev/null
+++ b/.machine_readable/6a2/README.adoc
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+# A2ML 6a2 Directory
+
+This directory contains the 6 core A2ML machine-readable metadata files for this repository.
+
+## Files
+
+- `AGENTIC.a2ml` - AI agent operational gating, safety controls
+- `ECOSYSTEM.a2ml` - Project ecosystem position, relationships, explicit boundaries
+- `META.a2ml` - Architecture decisions (ADRs), development practices, design rationale
+- `NEUROSYM.a2ml` - Symbolic semantics, composition algebra
+- `PLAYBOOK.a2ml` - Executable plans, operational runbooks
+- `STATE.a2ml` - Project state, phase, milestones, session history
+
+## Standards Compliance
+
+These files follow the A2ML Format Family specification from:
+https://github.com/hyperpolymath/standards/tree/main/a2ml
+
+## Generation
+
+These files may be generated from .scm source files using transpilation tools.
+Source .scm files should be removed after successful transpilation.
+
+## See Also
+
+- [A2ML Repository Template](https://github.com/hyperpolymath/standards/blob/main/A2ML-REPO-TEMPLATE.adoc)
+- [6A2 Format Family](https://github.com/hyperpolymath/standards#a2ml-format-family-7-formats)
+
diff --git a/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml
new file mode 100644
index 0000000..0dd6825
--- /dev/null
+++ b/.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml
@@ -0,0 +1,21 @@
+# AI Manifest for Anchor Directory
+
+## Purpose
+
+This manifest declares the AI-assistant context for the anchor machine-readable metadata directory.
+
+## Canonical Locations
+
+ANCHOR.a2ml files MUST exist in this directory.
+
+## Multiple Versions
+
+Unlike other A2ML files, multiple versions of ANCHOR.a2ml with different dates MAY exist.
+Each version represents a specific recalibration point.
+
+## Invariants
+
+- Multiple versions with different dates are permitted
+- No other A2ML files in this directory
+- Single source of truth for anchor documents
+
diff --git a/.machine_readable/anchors/ANCHOR.a2ml b/.machine_readable/6a2/anchor/ANCHOR.a2ml
similarity index 100%
rename from .machine_readable/anchors/ANCHOR.a2ml
rename to .machine_readable/6a2/anchor/ANCHOR.a2ml
diff --git a/.machine_readable/6a2/anchor/README.adoc b/.machine_readable/6a2/anchor/README.adoc
new file mode 100644
index 0000000..bd23e35
--- /dev/null
+++ b/.machine_readable/6a2/anchor/README.adoc
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+# A2ML Anchor Directory
+
+This directory contains ANCHOR.a2ml files for project recalibration and scope intervention.
+
+## Files
+
+- `ANCHOR.a2ml` - Project recalibration, scope intervention, canonical authority
+
+## Multiple Versions
+
+Unlike other A2ML files, multiple versions of ANCHOR.a2ml with different dates may exist.
+Each version represents a specific recalibration point in the project history.
+
+## Standards Compliance
+
+These files follow the ANCHOR.a2ml specification from:
+https://github.com/hyperpolymath/standards/tree/main/anchor-a2ml
+
+## See Also
+
+- [A2ML Repository Template](https://github.com/hyperpolymath/standards/blob/main/A2ML-REPO-TEMPLATE.adoc)
+- [Anchor A2ML Spec](https://github.com/hyperpolymath/standards/tree/main/anchor-a2ml)
+
diff --git a/.machine_readable/agent_instructions/README.adoc b/.machine_readable/bot_directives/README.adoc
similarity index 94%
rename from .machine_readable/agent_instructions/README.adoc
rename to .machine_readable/bot_directives/README.adoc
index 9bc2e24..4e989c7 100644
--- a/.machine_readable/agent_instructions/README.adoc
+++ b/.machine_readable/bot_directives/README.adoc
@@ -32,7 +32,7 @@ Methodology-aware configuration for AI agents. Read by any AI agent
 == Relationship to Other Files
 
 * `AGENTIC.a2ml` says WHAT agents can do (permissions, gating)
-* `agent_instructions/` says HOW agents should work (methodology)
+* `bot_directives/` says HOW agents should work (methodology)
 * `bot_directives/` says what the gitbot-fleet does (fleet-specific)
 * `CLAUDE.md` says how Claude specifically should work (Claude-specific)
 
diff --git a/.machine_readable/agent_instructions/coverage.a2ml b/.machine_readable/bot_directives/coverage.a2ml
similarity index 100%
rename from .machine_readable/agent_instructions/coverage.a2ml
rename to .machine_readable/bot_directives/coverage.a2ml
diff --git a/.machine_readable/agent_instructions/debt.a2ml b/.machine_readable/bot_directives/debt.a2ml
similarity index 100%
rename from .machine_readable/agent_instructions/debt.a2ml
rename to .machine_readable/bot_directives/debt.a2ml
diff --git a/.machine_readable/agent_instructions/methodology.a2ml b/.machine_readable/bot_directives/methodology.a2ml
similarity index 100%
rename from .machine_readable/agent_instructions/methodology.a2ml
rename to .machine_readable/bot_directives/methodology.a2ml
diff --git a/.machine_readable/contractiles/Adjustfile.a2ml b/.machine_readable/contractiles/Adjustfile.a2ml
new file mode 100644
index 0000000..6f01e89
--- /dev/null
+++ b/.machine_readable/contractiles/Adjustfile.a2ml
@@ -0,0 +1,72 @@
+# SPDX-License-Identifier: MPL-2.0
+# Adjustfile — Drift-tolerance contract for rsr-template-repo
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Cumulative-drift catchment: tolerance bands + corrective actions.
+# Authority: advisory (Yard) — continue-with-warnings; auto_fix where deterministic.
+# Run with: adjust check
+# Fix with: adjust fix (applies deterministic patches; advisory otherwise)
+
+@abstract:
+Drift tolerances and corrective actions for rsr-template-repo. Unlike
+MUST (hard gate), ADJUST tracks cumulative drift against tolerance bands
+and proposes corrective actions. Advisory — it warns and trends, it does
+not block.
+@end
+
+## Template Drift
+
+### placeholder-drift
+- description: Template placeholders should be replaced when copied
+- tolerance: 0 placeholder markers in copied repos
+- corrective: Search and replace all {{PLACEHOLDER}} markers
+- severity: advisory
+- notes: This check only applies to repos that copied from this template
+
+### template-version-drift
+- description: Template version should match RSR spec version
+- tolerance: Template version matches current RSR spec
+- corrective: Update template to match latest RSR spec
+- severity: advisory
+
+## Documentation Drift
+
+### readme-completeness
+- description: README should document all template features
+- tolerance: README covers all contractiles and directory structure
+- corrective: Update README.adoc with missing sections
+- severity: advisory
+
+### example-accuracy
+- description: Examples in documentation should match actual template content
+- tolerance: All code examples in docs are accurate
+- corrective: Audit and fix examples in documentation
+- severity: advisory
+
+## Structural Drift
+
+### contractile-sync
+- description: All contractiles should have matching a2ml and ncl implementations
+- tolerance: Every .a2ml has a corresponding .ncl
+- corrective: Generate missing .ncl files from .a2ml
+- severity: advisory
+
+### no-broken-symlinks
+- description: No broken symbolic links in template structure
+- tolerance: 0 broken symlinks
+- corrective: Run symlink-check script
+- severity: advisory
+
+## Accessibility Drift
+
+### adoc-not-md
+- description: Template docs should prefer AsciiDoc
+- tolerance: New prose docs are *.adoc
+- corrective: Convert any new *.md to *.adoc
+- severity: advisory
+
+### spdx-header-consistency
+- description: All template files have correct SPDX headers
+- tolerance: 0 files missing SPDX-License-Identifier
+- corrective: Add SPDX headers to files that need them
+- severity: advisory
diff --git a/.machine_readable/contractiles/Intentfile.a2ml b/.machine_readable/contractiles/Intentfile.a2ml
new file mode 100644
index 0000000..ef74f45
--- /dev/null
+++ b/.machine_readable/contractiles/Intentfile.a2ml
@@ -0,0 +1,99 @@
+# SPDX-License-Identifier: MPL-2.0
+# Intentfile (A2ML Canonical) — north-star contractile for rsr-template-repo
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Paired runner: intend.ncl
+# Verb:          intend
+#
+# Semantics: North-star contractile. Declares BOTH concrete committed
+#            next-actions AND horizon aspirations the project wishes to
+#            become. Two sections share one file because they answer
+#            the same question at different ranges:
+#              [[intents]] — "we WILL do this; track progress"
+#                            status: declared → in_progress → done |
+#                                    deferred | retired
+#              [[wishes]]  — "we WISH this were true; revisit later"
+#                            status: declared → in_progress → achieved |
+#                                    abandoned
+#                            grouped by horizon: near / mid / far.
+#            Non-gating — this is a report, not a gate. See the `must`
+#            contractile for hard gates.
+
+@abstract:
+North-star contractile for rsr-template-repo. This repository is the
+canonical template for Rhodium Standard Repository compliance. It provides
+the scaffold that all hyperpolymath repos should copy and customize.
+@end
+
+## Purpose
+
+The rsr-template-repo serves as the master template for all hyperpolymath
+repositories. It contains the complete set of contractile files, machine-readable
+specifications, and governance documentation that define the Rhodium Standard.
+
+Every new repository in the hyperpolymath estate should be initialized by
+copying this template and substituting the placeholder values with
+repo-specific content.
+
+## Anti-Purpose
+
+This repository is NOT:
+- A general-purpose project scaffold for external use (hyperpolymath-only)
+- A replacement for per-repo customization (all files must be bespoke)
+- A static template that never changes (evolves with RSR spec)
+- A runtime library or framework (build-time only)
+
+## If In Doubt
+
+If you are unsure whether a change is in scope, ask. Sensitive areas:
+- .machine_readable/ contractile definitions
+- RSR specification files
+- Governance templates
+- License policy documents
+
+## Committed Next-Actions
+
+### repo-initialization
+- description: Provide just copy-and-substitute template for new repos
+- probe: test -f scripts/init-repo.sh
+- status: done
+- notes: Run with source scripts/init-repo.sh <new-repo-name>
+
+### contractile-completeness
+- description: Every RSR contractile has an a2ml and ncl implementation
+- probe: ls .machine_readable/contractiles/*.a2ml | wc -l | grep -q "^6$"
+- status: in_progress
+- notes: Currently 6 contractile verbs: intend, must, trust, adjust, bust, dust
+
+### automation-scripts
+- description: All repetitive tasks have just recipes
+- probe: grep -c "^# " Justfile | grep -q "^[6-9][0-9]*$"
+- status: in_progress
+
+## Wishes
+
+### Near Horizon
+
+#### cross-repo-validation
+- description: Tooling to validate all repos against RSR spec
+- horizon: near
+- status: declared
+
+#### automated-substitution
+- description: Script to automate repo-specific substitution in template
+- horizon: near
+- status: declared
+
+### Mid Horizon
+
+#### formal-verification
+- description: Idris2 proofs for all critical contractile invariants
+- horizon: mid
+- status: declared
+
+### Far Horizon
+
+#### ecosystem-visualization
+- description: Interactive graph of all hyperpolymath repos and dependencies
+- horizon: far
+- status: declared
diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile
new file mode 100644
index 0000000..be63905
--- /dev/null
+++ b/.machine_readable/contractiles/Justfile
@@ -0,0 +1,112 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Justfile — UX recipes
+
+import? "contractile.just"
+
+import? 'contractile.just'
+
+# Default: list recipes
+default:
+    @just --list
+
+# Run the Idris2 test suite (ports validate.test.ts from May 2026).
+test:
+    @export IDRIS2_PREFIX="$(dirname "$(dirname "$(command -v idris2)")")" && \
+        idris2 --build julia-professional-registry-tests.ipkg && \
+        ./build/exec/julia-professional-registry-tests
+
+# Self-diagnostic: check required tools
+doctor:
+    #!/usr/bin/env bash
+    echo "═══════════════════════════════════════════════════"
+    echo "  doctor — Self-Diagnostic"
+    echo "═══════════════════════════════════════════════════"
+    passed=0; failed=0; warn=0
+    if command -v just >/dev/null 2>&1; then echo "[OK]   just"; passed=$((passed+1)); else echo "[FAIL] just"; failed=$((failed+1)); fi
+    if command -v git >/dev/null 2>&1; then echo "[OK]   git"; passed=$((passed+1)); else echo "[FAIL] git"; failed=$((failed+1)); fi
+    if command -v panic-attack >/dev/null 2>&1; then echo "[OK]   panic-attack"; passed=$((passed+1)); else echo "[WARN] panic-attack (optional)"; warn=$((warn+1)); fi
+    # Check for hardcoded paths
+    hc=$(grep -rn "/home/" --include="*.rs" --include="*.res" --include="*.gleam" --include="*.ex" --include="*.exs" --include="*.zig" . 2>/dev/null | grep -v node_modules | grep -v .git | wc -l)
+    if [ "$hc" -eq 0 ]; then echo "[OK]   no hardcoded paths"; passed=$((passed+1)); else echo "[WARN] $hc hardcoded paths found"; warn=$((warn+1)); fi
+    echo "═══════════════════════════════════════════════════"
+    echo "  $passed passed, $failed failed, $warn warnings"
+    if [ "$failed" -gt 0 ]; then exit 1; fi
+
+# Show install instructions for missing tools
+heal:
+    #!/usr/bin/env bash
+    echo "═══════════════════════════════════════════════════"
+    echo "  heal — Install Missing Tools"
+    echo "═══════════════════════════════════════════════════"
+    if ! command -v just >/dev/null 2>&1; then echo "Install just: https://just.systems/man/en/installation.html"; fi
+    if ! command -v panic-attack >/dev/null 2>&1; then echo "Install panic-attack: cargo install panic-attacker"; fi
+    echo "Run 'just doctor' to verify."
+
+# Guided project walkthrough
+tour:
+    #!/usr/bin/env bash
+    echo "═══════════════════════════════════════════════════"
+    echo "  tour — Project Walkthrough"
+    echo "═══════════════════════════════════════════════════"
+    echo ""
+    echo "Project structure:"
+    ls -la --color=never | head -25
+    echo ""
+    echo "Key files:"
+    for f in README.adoc README.md EXPLAINME.adoc LICENSE SECURITY.md; do
+      [ -f "$f" ] && echo "  ✓ $f"
+    done
+    echo ""
+    echo "Available recipes: just --list"
+    echo "Self-check: just doctor"
+
+# Show common workflows and get help
+help-me:
+    #!/usr/bin/env bash
+    echo "═══════════════════════════════════════════════════"
+    echo "  help-me — Common Workflows"
+    echo "═══════════════════════════════════════════════════"
+    echo ""
+    echo "FIRST TIME:"
+    echo "  just doctor          Check everything works"
+    echo "  just heal            Fix missing tools"
+    echo "  just tour            Guided walkthrough"
+    echo ""
+    echo "PRE-COMMIT:"
+    echo "  just assail          Security scan"
+    echo "  just must-check      Policy check"
+    echo ""
+    echo "LEARN:"
+    echo "  cat README.adoc      Project overview"
+    echo "  cat EXPLAINME.adoc   Deeper explanation"
+    echo ""
+    echo "BUG REPORT:"
+    echo "  Platform: $(uname -s) $(uname -m)"
+    echo "  Shell: $SHELL"
+    echo "  Include 'just doctor' output in your issue."
+
+# Pre-commit security scan
+assail:
+    panic-attack assail .
+
+
+
+# Print the current CRG grade (reads from READINESS.md '**Current Grade:** X' line)
+crg-grade:
+    @grade=$$(grep -oP '(?<=\*\*Current Grade:\*\* )[A-FX]' READINESS.md 2>/dev/null | head -1); \
+    [ -z "$$grade" ] && grade="X"; \
+    echo "$$grade"
+
+# Generate a shields.io badge markdown for the current CRG grade
+# Looks for '**Current Grade:** X' in READINESS.md; falls back to X
+crg-badge:
+    @grade=$$(grep -oP '(?<=\*\*Current Grade:\*\* )[A-FX]' READINESS.md 2>/dev/null | head -1); \
+    [ -z "$$grade" ] && grade="X"; \
+    case "$$grade" in \
+      A) color="brightgreen" ;; B) color="green" ;; C) color="yellow" ;; \
+      D) color="orange" ;; E) color="red" ;; F) color="critical" ;; \
+      *) color="lightgrey" ;; esac; \
+    echo "[![CRG $$grade](https://img.shields.io/badge/CRG-$$grade-$$color?style=flat-square)](https://github.com/hyperpolymath/standards/tree/main/component-readiness-grades)"
+
+secret-scan-trufflehog:
+    @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true
diff --git a/.machine_readable/contractiles/Mustfile.a2ml b/.machine_readable/contractiles/Mustfile.a2ml
new file mode 100644
index 0000000..55f8ab4
--- /dev/null
+++ b/.machine_readable/contractiles/Mustfile.a2ml
@@ -0,0 +1,102 @@
+# SPDX-License-Identifier: MPL-2.0
+# Mustfile — Physical state contract for rsr-template-repo
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# What MUST be true about this repository. Hard requirements.
+# Run with: must check
+# Fix with: must fix (where a deterministic fix exists)
+
+@abstract:
+Physical-state invariants for rsr-template-repo. This is the canonical
+RSR template repository. These are hard requirements — CI and pre-commit
+hooks fail if any check fails.
+@end
+
+## File Presence
+
+### license-present
+- description: LICENSE file must exist
+- run: test -f LICENSE
+- severity: critical
+
+### readme-present
+- description: README.adoc must exist
+- run: test -f README.adoc
+- severity: critical
+
+### security-policy
+- description: SECURITY.md must exist
+- run: test -f SECURITY.md
+- severity: critical
+
+### ai-manifest
+- description: 0-AI-MANIFEST.a2ml must exist
+- run: test -f 0-AI-MANIFEST.a2ml
+- severity: critical
+
+### governance-docs
+- description: GOVERNANCE.adoc, MAINTAINERS.adoc, CODEOWNERS must exist
+- run: test -f GOVERNANCE.adoc && test -f MAINTAINERS.adoc && test -f .github/CODEOWNERS
+- severity: critical
+
+### machine-readable-dir
+- description: .machine_readable/ directory must exist
+- run: test -d .machine_readable
+- severity: critical
+
+## Directory Structure
+
+### contractiles-complete
+- description: All required contractile directories exist
+- run: test -d .machine_readable/contractiles && test -d .machine_readable/contractiles/bust && test -d .machine_readable/contractiles/dust
+- severity: critical
+
+### contractiles-files-present
+- description: All four primary contractile files exist
+- run: test -f .machine_readable/contractiles/Intentfile.a2ml && test -f .machine_readable/contractiles/Mustfile.a2ml && test -f .machine_readable/contractiles/Trustfile.a2ml && test -f .machine_readable/contractiles/Adjustfile.a2ml
+- severity: critical
+
+### bust-dust-files-present
+- description: Bustfile and Dustfile exist in their directories
+- run: test -f .machine_readable/contractiles/bust/Bustfile.a2ml && test -f .machine_readable/contractiles/dust/Dustfile.a2ml
+- severity: critical
+
+### six-directory-present
+- description: 6a2 directory exists with required files
+- run: test -d .machine_readable/6a2 && test -f .machine_readable/6a2/META.a2ml && test -f .machine_readable/6a2/ECOSYSTEM.a2ml && test -f .machine_readable/6a2/STATE.a2ml && test -f .machine_readable/6a2/PLAYBOOK.a2ml && test -f .machine_readable/6a2/AGENTIC.a2ml && test -f .machine_readable/6a2/NEUROSYM.a2ml
+- severity: critical
+
+### anchors-directory
+- description: anchors directory exists in 6a2
+- run: test -d .machine_readable/6a2/anchors
+- severity: warning
+
+### self-validating-structure
+- description: self-validating directory has k9-svc and examples
+- run: test -d .machine_readable/self-validating && test -d .machine_readable/self-validating/k9-svc && test -d .machine_readable/self-validating/examples
+- severity: warning
+
+## Template Integrity
+
+### no-placeholder-values
+- description: No placeholder values remain in template files
+- run: test -z "$(grep -r '{{' .machine_readable/contractiles/ 2>/dev/null)"
+- severity: critical
+- notes: All placeholders must be substituted when copying this template
+
+### template-readonly
+- description: Template marker files are not modified
+- run: grep -q 'RSR_TEMPLATE_DO_NOT_EDIT' .machine_readable/0.1-AI-MANIFEST.a2ml
+- severity: warning
+
+## Git State
+
+### no-untracked-contractiles
+- description: All contractile files are tracked in git
+- run: test -z "$(git ls-files -o --exclude-standard .machine_readable/contractiles/ 2>/dev/null)"
+- severity: critical
+
+### signed-commits
+- description: All commits must be signed
+- run: git verify-commit HEAD
+- severity: critical
diff --git a/.machine_readable/contractiles/Trustfile.a2ml b/.machine_readable/contractiles/Trustfile.a2ml
new file mode 100644
index 0000000..e2028b5
--- /dev/null
+++ b/.machine_readable/contractiles/Trustfile.a2ml
@@ -0,0 +1,88 @@
+# SPDX-License-Identifier: MPL-2.0
+# Trustfile — Trust boundaries and integrity invariants for rsr-template-repo
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Defines what LLM/SLM agents are trusted to do without asking, and
+# integrity invariants that verify the repo has not been tampered with.
+
+@abstract:
+Trust boundaries and integrity checks for rsr-template-repo. This file
+combines the trust-level definitions from the original TRUST.contractile
+with the integrity invariants from the old Trustfile.a2ml. It defines
+what AI agents may do autonomously and what requires human approval,
+plus checks that verify repository integrity.
+@end
+
+## Trust Levels
+
+The rsr-template-repo operates at trust level: maximal
+
+Trust levels:
+- maximal:    Agent may read, build, test, lint, format, heal freely.
+             Only destructive/external actions require approval.
+- standard:   Agent may read and build. Test/lint need approval.
+- restricted: Agent may read only. All modifications need approval.
+- minimal:    Agent may read specific files only. Everything else blocked.
+
+Current trust level: maximal
+
+## Integrity Invariants
+
+### Secrets
+
+#### no-secrets-committed
+- description: No credential files in repo
+- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production
+- severity: critical
+
+#### no-private-keys
+- description: No private key files committed
+- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ."
+- severity: critical
+
+#### no-tokens-in-source
+- description: No hardcoded API tokens in source
+- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ."
+- severity: critical
+
+## Provenance
+
+#### author-correct
+- description: Git author matches expected identity
+- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'"
+- severity: warning
+
+#### license-content
+- description: LICENSE contains expected identifier
+- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE
+- severity: warning
+
+## Template-Specific Trust
+
+### template-files-readonly
+- description: Template scaffold files should not be modified except by maintainer
+- run: test -z "$(git status --short .machine_readable/ 2>/dev/null | grep -v '^??' || true)"
+- severity: advisory
+- notes: Changes to template files require careful review
+
+### trust-deny-areas
+- description: Sensitive areas from INTENT.contractile require explicit approval
+- run: echo "Check .machine_readable/ contractiles and governance docs"
+- severity: advisory
+- areas:
+  - .machine_readable/
+  - GOVERNANCE.adoc
+  - MAINTAINERS.adoc
+  - .github/CODEOWNERS
+
+## Container Security
+
+#### container-images-pinned
+- description: Containerfile uses pinned base images
+- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile
+- severity: warning
+
+#### no-dockerfile
+- description: No Dockerfile (use Containerfile)
+- run: test ! -f Dockerfile
+- severity: warning
diff --git a/.machine_readable/contractiles/bust/Bustfile.a2ml b/.machine_readable/contractiles/bust/Bustfile.a2ml
index cab2486..f55a467 100644
--- a/.machine_readable/contractiles/bust/Bustfile.a2ml
+++ b/.machine_readable/contractiles/bust/Bustfile.a2ml
@@ -1,28 +1,37 @@
 // Bustfile.a2ml — meta-repo bust contractile (breakage / rollback)
 // SPDX-License-Identifier: MPL-2.0
 
-Bust {
-    name: "julia-professional-registry"
-    version: "1.0.0"
-    description: "Rollback procedures when something breaks in the meta-repo"
+@abstract:
+Bustfile for julia-professional-registry. Lists failure modes specific to the template
+repository itself, particularly around template distribution, substitution,
+and synchronization across the hyperpolymath estate.
+@end
 
-    scenarios: {
-        "bad-pointer-bump": "git revert <bump-commit> in meta-repo; child repo itself untouched"
-        "submodule-pointer-points-at-missing-sha": "git submodule update --init --checkout <path> resets child to parent-recorded SHA; OR revert the stale bump commit"
-        "submodule-orphan-after-local-only-commit": "roll back locally with git reset to before the stranded commit; fix remote situation before re-attempting"
-        "accidental-private-repo-content-leaked-to-public-submodule": "hard-rotate the leaked secret immediately; git-filter-repo or BFG on the submodule's own history; public re-publication only after rotation complete"
-    }
+## Failure Modes
 
-    escalation-ladder: [
-        "1. revert the meta-repo commit (reversible, low blast radius)",
-        "2. reset the local submodule clone (affects only local workspace)",
-        "3. force-push to main — PROHIBITED without explicit user confirmation (violates branch protection)",
-        "4. registry-level (delete/archive the GitHub repo) — human-only action, never by AI"
-    ]
+### template-substitution-failure
+- class: template_processing
+- description: Template substitution fails when initializing a new repo from this template
+- injection_probe: "cp -r julia-professional-registry test-repo && cd test-repo && sed -i 's/julia-professional-registry/TEST/g' .machine_readable/contractiles/Intentfile.a2ml && grep -q 'TEST' .machine_readable/contractiles/Intentfile.a2ml"
+- recovery_probe: "git -C test-repo diff --quiet .machine_readable/contractiles/Intentfile.a2ml"
+- expected_recovery_time_seconds: 10
+- status: declared
+- notes: Verify that substitution scripts handle all placeholder replacements correctly
 
-    backup-points: [
-        "GitHub serves as the durable backup for every submodule's own history",
-        "Meta-repo history on origin/main is the durable backup for pointer state",
-        "Local backup tags (backup/pre-<operation>-<date>) retained on risky rewrites"
-    ]
-}
+### sync-drift-between-repos
+- class: synchronization
+- description: Drift occurs between julia-professional-registry and other repos after template updates
+- injection_probe: "echo 'template_updated' > /tmp/test_drift_marker"
+- recovery_probe: "test -f /tmp/test_drift_marker && rm /tmp/test_drift_marker"
+- expected_recovery_time_seconds: 60
+- status: declared
+- notes: The estate-wide sync scripts (see scripts/) should prevent this; verify with scripts/verify-sync.sh
+
+### contractile-parse-error
+- class: contractile_format
+- description: A contractile file fails to parse due to syntax errors
+- injection_probe: "echo 'invalid syntax' >> julia-professional-registry/.machine_readable/contractiles/Intentfile.a2ml"
+- recovery_probe: "git checkout julia-professional-registry/.machine_readable/contractiles/Intentfile.a2ml"
+- expected_recovery_time_seconds: 5
+- status: declared
+- notes: All .a2ml files should be valid A2ML; use a2ml-validate runner
diff --git a/.machine_readable/contractiles/dust/Dustfile.a2ml b/.machine_readable/contractiles/dust/Dustfile.a2ml
index 0d619ee..78bc1dc 100644
--- a/.machine_readable/contractiles/dust/Dustfile.a2ml
+++ b/.machine_readable/contractiles/dust/Dustfile.a2ml
@@ -1,22 +1,54 @@
 # SPDX-License-Identifier: MPL-2.0
 # Dustfile — Cleanup and Hygiene Contract
 
-[dustfile]
-version = "1.0.0"
-format = "a2ml"
-
-[cleanup]
-stale-branch-policy = "delete-after-merge"
-artifact-retention = "90-days"
-cache-policy = "clear-on-release"
-
-[hygiene]
-linting = "required"
-formatting = "required"
-dead-code-removal = "encouraged"
-todo-tracking = "tracked-in-issues"
-
-[reversibility]
-backup-before-destructive = true
-rollback-mechanism = "git-revert"
-data-retention-policy = "preserve-30-days"
+@abstract:
+Cleanup and hygiene items for julia-professional-registry. These are maintenance tasks
+that ensure the template repository remains clean and ready for distribution
+to new repositories.
+@end
+
+## Stale Files
+
+### no-template-artifacts
+- description: No generated files from template testing in root
+- run: test -z "$(ls template-test-* 2>/dev/null)"
+- severity: info
+- notes: Template testing should use /tmp or dedicated test directories
+
+### no-example-placeholders
+- description: No example placeholder files (EXAMPLE-, SAMPLE-) in contractiles/
+- run: test -z "$(find .machine_readable/contractiles/ -name 'EXAMPLE-*' -o -name 'SAMPLE-*' 2>/dev/null)"
+- severity: warning
+- notes: All placeholders should be replaced with actual content or removed
+
+### no-old-contractile-formats
+- description: No old .contractile or .hs files remaining
+- run: test -z "$(find .machine_readable/contractiles/ \( -name '*.contractile' -o -name '*.hs' \) 2>/dev/null)"
+- severity: warning
+- notes: All contractiles should be .a2ml format
+
+## Format Duplicates
+
+### no-duplicate-justfile
+- description: Only one Justfile (hardlinked from root to .machine_readable/contractiles/)
+- run: test $(stat -c '%i' Justfile) = $(stat -c '%i' .machine_readable/contractiles/Justfile 2>/dev/null)
+- severity: warning
+- notes: Justfile should be hardlinked, not copied
+
+### no-duplicate-readme-format
+- description: Only one README format in contractiles/ (.adoc canonical)
+- run: test ! -f .machine_readable/contractiles/README.md
+- severity: info
+
+## Template Hygiene
+
+### no-stale-template-references
+- description: No references to julia-professional-registry in generic template files
+- run: test -z "$(grep -r 'julia-professional-registry' machine-readable-design/ 2>/dev/null)"
+- severity: warning
+- notes: Generic templates should use {{PROJECT_NAME}} or similar placeholders
+
+### version-sync-checked
+- description: Version in canonical-directory-structure matches .machine_readable/contractiles
+- verification: compare version identifiers in both locations
+- severity: info
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 34ef433..e7321a2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,8 @@
 <!--
+<!-- Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> -->
 SPDX-License-Identifier: MPL-2.0
 SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
 -->
-
 # Changelog
 
 All notable changes to `julia-professional-registry` will be documented in this file.
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index 6cb48a9..491c54d 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # Code of Conduct
 
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 86b9c51..d7d8f51 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,4 +1,5 @@
 <!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> -->
 # Contributing
 
 Thank you for your interest in contributing! We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`.
diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc
index 2b173cc..76de7ad 100644
--- a/GOVERNANCE.adoc
+++ b/GOVERNANCE.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 = Project Governance
 :toc:
diff --git a/Justfile b/Justfile
index 8022392..ba1f134 100644
--- a/Justfile
+++ b/Justfile
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+// Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # Justfile — UX recipes
 
 import? "contractile.just"
@@ -107,3 +108,6 @@ crg-badge:
       D) color="orange" ;; E) color="red" ;; F) color="critical" ;; \
       *) color="lightgrey" ;; esac; \
     echo "[![CRG $$grade](https://img.shields.io/badge/CRG-$$grade-$$color?style=flat-square)](https://github.com/hyperpolymath/standards/tree/main/component-readiness-grades)"
+
+secret-scan-trufflehog:
+    @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true
diff --git a/LICENSE b/LICENSE
index 2a8b960..d0a1fa1 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,5 +1,3 @@
-SPDX-License-Identifier: MPL-2.0
-
 Mozilla Public License Version 2.0
 ==================================
 
@@ -37,7 +35,7 @@ Mozilla Public License Version 2.0
     means any form of the work other than Source Code Form.
 
 1.7. "Larger Work"
-    means a work that combines Covered Software with other material, in 
+    means a work that combines Covered Software with other material, in
     a separate file or files, that is not Covered Software.
 
 1.8. "License"
@@ -359,7 +357,7 @@ Exhibit A - Source Code Form License Notice
 
   This Source Code Form is subject to the terms of the Mozilla Public
   License, v. 2.0. If a copy of the MPL was not distributed with this
-  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 If it is not possible or desirable to put the notice in a particular
 file, then You may include the notice in a location (such as a LICENSE
diff --git a/MAINTAINERS.adoc b/MAINTAINERS.adoc
index e6f5447..354b47d 100644
--- a/MAINTAINERS.adoc
+++ b/MAINTAINERS.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 = Maintainers
 :toc: preamble
diff --git a/QUICKSTART-DEV.adoc b/QUICKSTART-DEV.adoc
index 3792735..c0dfc81 100644
--- a/QUICKSTART-DEV.adoc
+++ b/QUICKSTART-DEV.adoc
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Hyperpolymathregistry — Developer Quickstart
 :toc: preamble
 
diff --git a/QUICKSTART-MAINTAINER.adoc b/QUICKSTART-MAINTAINER.adoc
index e851213..e9439a9 100644
--- a/QUICKSTART-MAINTAINER.adoc
+++ b/QUICKSTART-MAINTAINER.adoc
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Hyperpolymathregistry — Maintainer Quickstart
 :toc: preamble
 
diff --git a/QUICKSTART-USER.adoc b/QUICKSTART-USER.adoc
index 3c6ac05..84b0412 100644
--- a/QUICKSTART-USER.adoc
+++ b/QUICKSTART-USER.adoc
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Hyperpolymathregistry — User Quickstart
 :toc: preamble
 
diff --git a/README.adoc b/README.adoc
index ff2eab8..77c9f76 100644
--- a/README.adoc
+++ b/README.adoc
@@ -79,4 +79,6 @@ pkg> add SMTLib
 
 == License
 
-MPL-2.0
+This project is licensed under the Mozilla Public License, v. 2.0. See the `LICENSE` file for details.
+
+SPDX-License-Identifier: MPL-2.0
\ No newline at end of file
diff --git a/SECURITY.md b/SECURITY.md
index 1a29117..10d7f51 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,4 +1,5 @@
 <!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> -->
 # Security Policy
 
 ## Reporting a Vulnerability
diff --git a/TEST-NEEDS.md b/TEST-NEEDS.md
index f70d01a..ee741c2 100644
--- a/TEST-NEEDS.md
+++ b/TEST-NEEDS.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # CRG Grade C Test Coverage
 
 ## CRG Grade: C — ACHIEVED 2026-04-04
diff --git a/TOPOLOGY.md b/TOPOLOGY.md
index 7ef534b..a053504 100644
--- a/TOPOLOGY.md
+++ b/TOPOLOGY.md
@@ -1,4 +1,5 @@
 <!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> -->
 <!-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> -->
 
 # TOPOLOGY.md — HyperpolymathRegistry
diff --git a/llm-warmup-dev.md b/llm-warmup-dev.md
index d61f382..40e82be 100644
--- a/llm-warmup-dev.md
+++ b/llm-warmup-dev.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # LLM Warmup — HyperpolymathRegistry (Developer)
 
 ## What is HyperpolymathRegistry?
diff --git a/llm-warmup-user.md b/llm-warmup-user.md
index 3c66889..722c289 100644
--- a/llm-warmup-user.md
+++ b/llm-warmup-user.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # LLM Warmup — HyperpolymathRegistry (User)
 
 ## What is HyperpolymathRegistry?
diff --git a/tests/idris2/Main.idr b/tests/idris2/Main.idr
index 5842804..b851b8a 100644
--- a/tests/idris2/Main.idr
+++ b/tests/idris2/Main.idr
@@ -1,4 +1,5 @@
 -- SPDX-License-Identifier: MPL-2.0
+// Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 
 module Main
diff --git a/tests/idris2/Test/Spec.idr b/tests/idris2/Test/Spec.idr
index c7fe418..8c48bdf 100644
--- a/tests/idris2/Test/Spec.idr
+++ b/tests/idris2/Test/Spec.idr
@@ -1,4 +1,5 @@
 -- SPDX-License-Identifier: MPL-2.0
+// Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 --
 ||| Minimal Idris2 test harness for the Gossamer ABI test suite.
diff --git a/tests/idris2/ValidateTest.idr b/tests/idris2/ValidateTest.idr
index 3899597..87c16c3 100644
--- a/tests/idris2/ValidateTest.idr
+++ b/tests/idris2/ValidateTest.idr
@@ -1,4 +1,5 @@
 -- SPDX-License-Identifier: MPL-2.0
+// Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 --
 -- Port of tests/validate.test.ts to Idris2, estate-rollout port 4/11.