fix(dogfood-gate): repair the manifest defects the revived gate exposed (#55)

Follows #53 and #54.

The Dogfood Gate **could not parse** before #53, so it never ran. Now
that it parses, it runs — and immediately reported **2 A2ML errors and 4
K9 errors** on `main`. That's the gate working as intended; this PR
clears what it found.

Each fix was verified by running the **actual validator** locally, not
by reading its source.

## A2ML: 2 errors → 0

### `docs/governance/TSDM.a2ml` was not defective — the pin was stale

This is the
[SHA-pinning-defeats-upstream-fixes](https://github.com/hyperpolymath/krl)
pattern, caught red-handed:

| | |
|---|---|
| Pinned | `6bff6ec` — PR **#26**, *"recognise s-expression
identity/version fields"* |
| Fix needed | `6c47174` — PR **#41**, *"recognise colon/brace-block
identity"* |

TSDM.a2ml declares `id: "tsdm-standard"`, the colon/brace-block form.
The validator's own source comment **names this exact file** as the
motivating case — so the fix existed upstream, and the pin predated it.

Confirmed before changing anything: running the newer validator locally
drops the count **2 → 1**. Bumped to current main (`5468b7f`).

### `docs/governance/MAINTENANCE-CHECKLIST.a2ml` genuinely lacked
identity

The validator exempts four categories — `*AI-MANIFEST*` files,
`.machine_readable/` (structural identity), contractile `@directive`
shape, and named typed manifests. **None applies here**, and the file
has no `name`/`project`/`agent-id`. Added `name` to its `[metadata]`
block.

## K9: 4 errors → 0

Unlike the A2ML case, these are **genuine file defects** — the current
validator reports the same 4 errors as the pinned one, so pin staleness
is ruled out.

- Both `container/deploy.k9.ncl` and
`.machine_readable/self-validating/methodology-guard.k9.ncl` were
missing the mandatory **`K9!` magic number** on line 1.
- `deploy.k9.ncl` had `pedigree = component_pedigree,` where the
canonical template (`rsr-julia-library-template-repo`) has `pedigree =
component_pedigree & { name = "…" },`. Without the merge the pedigree
carries no name. Matched to the template.
- `methodology-guard.k9.ncl` had **no pedigree block at all**. Added
one.

> This is template rot with a measurable blast radius:
`container/deploy.k9.ncl` is missing the `K9!` line in **6 repos**
(lucidscript, pandoc-k9, pseudoscript, squeakwell, stateful-artefacts,
systemet) while the newer template has it.

## ⚠️ `K9!` and Nickel contradict each other, estate-wide

Worth recording, and **not** changed here:

```console
$ nickel typecheck container/deploy.k9.ncl
error: unexpected token
1 │ K9!
  │   ^
```

The magic number **is not valid Nickel**, so `nickel typecheck` fails on
*every* `.k9.ncl` in the estate that carries it — including the
canonical template and every currently-passing file. `k9-svc` evidently
strips the line before parsing. The consequence is that the `nickel
typecheck container/deploy.k9.ncl` usage line **in these files' own
headers can never succeed as written**.

Pre-existing and estate-wide, so left alone. But I used it as a check:
both files were typechecked with the magic line stripped, and **that
caught a real error in my first draft**, where the new pedigree block
sat at top level in a file whose body is `let … in …` — invalid Nickel.
Moved inside the record; the validator matches at any indent.

## Verified

| Check | Result |
|---|---|
| K9 validator | **0 errors** (8 files) |
| A2ML validator | **0 errors** (121 files) |
| `actionlint` | **0 errors** |
| `tests/aspect_tests.sh` | 4/4 |
| `tests/e2e.sh` | 4/4 |
| `tests/smoke/grammar_smoke.sh` | 20/20 |

Author: hyperpolymath

.github/workflows/dogfood-gate.yml

@@ -39,7 +39,11 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@6bff6ec134fc977e86d25166a5c522ddea5c1e78 # main
+        # Pin was 6bff6ec (#26, s-expression identity). That predates #41,
+        # which taught the validator the colon/brace-block identity form
+        # (`id: "..."`), so docs/governance/TSDM.a2ml failed against the old
+        # pin despite being valid. Bumped to current main.
+        uses: hyperpolymath/a2ml-validate-action@5468b7ff0f5129a74d25af5f2468df11a706dc70 # main
         with:
           path: '.'
           strict: 'false'

.machine_readable/self-validating/methodology-guard.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
@@ -12,6 +13,18 @@ let methodology_guard = {
   version = "1.0.0",
   description = "Validates that agent work respects declared methodology constraints",
 
+  # Component pedigree (K9 self-description).
+  pedigree = {
+    name = "methodology-guard",
+    version = "1.0.0",
+    schema_version = "1.0.0",
+    component_type = "config-validator",
+    author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
+    description = "Validates that agent work respects declared methodology constraints",
+    leash = "kennel",
+    k9_spec_version = "1.0.0",
+  },
+
   checks = {
     divergent_invariant_language = {
       description = "No files in languages violating the divergent language invariant",

container/deploy.k9.ncl

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # deploy.k9.ncl — KRL deployment component (Hunt level)
 #
@@ -143,7 +144,7 @@ echo "K9: Rollback complete."
 
 # Export the component
 {
-  pedigree = component_pedigree,
+  pedigree = component_pedigree & { name = "krl-deploy" },
   deployment = deployment,
   scripts = scripts,
 

docs/governance/MAINTENANCE-CHECKLIST.a2ml

@@ -2,6 +2,7 @@
 # Cross-repo maintenance baseline (machine-readable canonical)
 
 [metadata]
+name = "maintenance-checklist"
 version = "1.1.0"
 last-updated = "2026-02-24"
 scope = "cross-repo"