sync: re-vendor absolute-zero/ subtree to upstream HEAD (trusted-base + 16-commit catch-up) (#83)

## Summary

Re-syncs maa-framework's vendored `absolute-zero/` tree from its
previous snapshot (16+ commits behind) up to current upstream HEAD
(commit `ab35c07`).

## Primary motivation: pull in standards#203 trusted-base work

| Upstream PR | Phase | Contents |
|-------------|-------|----------|
| absolute-zero#52 | seed | `docs/proof-debt.md` per standards#203
schema |
| absolute-zero#58 | 1 | per-axiom triage of 72 Coq Axioms
(`docs/proof-debt-triage.md`) |
| absolute-zero#59 | 1 cleanup | post-#58 cross-refs + STATE/META
updates |
| absolute-zero#60 | 2a | Lambda cluster — Coq + Lean inline `AXIOM:`
annotations |
| absolute-zero#61 | 2b | `CNOCategory.v:323` `hom_functor` §(d) DEBT
entry |
| absolute-zero#62 | 2c | Filesystem cluster — 26 inline annotations + 8
§(d) DEBT entries |

**Cumulative trusted-base state**: 41 / 129 escape hatches documented
(35.7% covered). Remaining 88 belong to Quantum + Physics clusters
(future Phase 2d/2e PRs upstream).

## Side effects of the full re-vendor

Because the vendored tree was 16+ commits behind, the sync also pulls
in unrelated upstream work:

- Estate-policy / governance / hypatia / language-policy workflow
  updates (~15 `.github/workflows/*` files).
- MPL-2.0 SPDX header migration from PMPL-1.0-or-later (~20 files).
- `.machine_readable/` A2ML updates.
- ReScript interpreter removal (per estate language-policy ban —
  `interpreters/rescript/*` deleted).
- Verification scripts moved to `verification/` subdir.
- Old session debris pruned (`SONNET-HANDOFF.md`, `STACK_AUDIT.txt`,
  `ROADMAP-V1-TO-V12.adoc`, `ROADMAP-UPDATED.adoc`, etc.).

## Preserved (maa-framework-specific, NOT in upstream)

Three Agda extensions were added in maa-framework directly (commits
`0538283` + `e80c5fb`) and survive the re-vendor via rsync filters:

- `proofs/agda/EchoBridgeCNO.agda`
- `proofs/agda/EchoBridgeScaffold.agda`
- `proofs/agda/README.adoc`

## Verification

```
$ bash ~/developer/repos/standards/scripts/check-trusted-base.sh absolute-zero
[INFO] Found 129 soundness-relevant escape hatch(es).
[ERROR] 88/129 escape hatch(es) are undocumented.
```

Matches upstream exactly. The 41 documented entries are Lambda (5) +
CNOCategory (1) + already-passing (1) + Filesystem (34).

## Scope warning

This is a large PR (168 files changed) because of the catch-up. If
desired, I can re-do this as two PRs:
1. proofs/ + docs/proof-debt*.md only (the trusted-base subset)
2. Everything else (workflows + machine_readable + cleanups)

But that requires hand-curating the file list. The single-PR shape
matches the "full re-vendor" option from the planning question.

Refs absolute-zero#52, #58, #59, #60, #61, #62; standards#203.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

absolute-zero/.claude/CLAUDE.md

@@ -19,14 +19,14 @@ The following files in `.machine_readable/` contain structured project metadata:
 
 | Language/Tool | Use Case | Notes |
 |---------------|----------|-------|
-| **ReScript** | Primary application code | Compiles to JS, type-safe |
+| **AffineScript** | Primary application code | Compiles to JS/WASM, linear/affine type system |
 | **Deno** | Runtime & package management | Replaces Node/npm/bun |
 | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
 | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |
 | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like |
 | **Gleam** | Backend services | Runs on BEAM or compiles to JS |
 | **Bash/POSIX Shell** | Scripts, automation | Keep minimal |
-| **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs |
+| **JavaScript** | Only where AffineScript cannot, or as per-language reference (examples/) | Avoid for new code unless integrating an external JS API |
 | **Nickel** | Configuration language | For complex configs |
 | **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm |
 | **Julia** | Batch scripts, data processing | Per RSR |
@@ -37,7 +37,8 @@ The following files in `.machine_readable/` contain structured project metadata:
 
 | Banned | Replacement |
 |--------|-------------|
-| TypeScript | ReScript |
+| TypeScript | AffineScript |
+| ReScript | AffineScript |
 | Node.js | Deno |
 | npm | Deno |
 | Bun | Deno |
@@ -48,24 +49,26 @@ The following files in `.machine_readable/` contain structured project metadata:
 | Swift | Tauri/Dioxus |
 | React Native | Tauri/Dioxus |
 | Flutter/Dart | Tauri/Dioxus |
+| PMPL-1.0 / PMPL-1.0-or-later | MPL-2.0 |
 
 ### Mobile Development
 
 **No exceptions for Kotlin/Swift** - use Rust-first approach:
 
-1. **Tauri 2.0+** - Web UI (ReScript) + Rust backend, MIT/Apache-2.0
+1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0
 2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0
 
 Both are FOSS with independent governance (no Big Tech).
 
 ### Enforcement Rules
 
-1. **No new TypeScript files** - Convert existing TS to ReScript
+1. **No new TypeScript or ReScript files** - Use AffineScript; meaningfully migrate existing TS/JS to AffineScript when touched (per-language `examples/` references may stay)
 2. **No package.json for runtime deps** - Use deno.json imports
 3. **No node_modules in production** - Deno caches deps automatically
 4. **No Go code** - Use Rust instead
-5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps
+5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps
 6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
+7. **License**: MPL-2.0 only — never PMPL-1.0 / PMPL-1.0-or-later / MPL-2.0-or-later
 
 ### Package Management
 

…lute-zero/.clusterfuzzlite/Containerfile absolute-zero/.clusterfuzzlite/Dockerfileabsolute-zero/.clusterfuzzlite/Containerfile renamed to absolute-zero/.clusterfuzzlite/Dockerfile absolute-zero/.clusterfuzzlite/Containerfile renamed to absolute-zero/.clusterfuzzlite/Dockerfile

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:73c1d5648db54100639339d411a5d192cbc8bf413ee91e843a07cf6f0e319dc7
 
 COPY . $SRC/absolute-zero

absolute-zero/.clusterfuzzlite/build.sh

@@ -1,7 +1,11 @@
 #!/bin/bash -eu
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 cd "$SRC"/absolute-zero
 cargo +nightly fuzz build
+# cargo-fuzz writes binaries to `fuzz/target/<triple>/release/<target>`
+# (the fuzz crate's own target dir), not to the workspace root. The
+# previous `./target/...` path was a vestige of an earlier layout where
+# fuzz/ depended on the parent crate's `[lib]` (since removed).
 for target in $(cargo +nightly fuzz list); do
-    cp ./target/x86_64-unknown-linux-gnu/release/$target $OUT/
+    cp fuzz/target/x86_64-unknown-linux-gnu/release/$target $OUT/
 done

absolute-zero/.clusterfuzzlite/project.yaml

@@ -1,2 +1,2 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 language: rust

absolute-zero/.gitattributes

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: AGPL-3.0-or-later
 # RSR-compliant .gitattributes
 
 * text=auto eol=lf

absolute-zero/.github/FUNDING.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Funding platforms for hyperpolymath projects
 # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
 

absolute-zero/.github/dependabot.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 version: 2
 updates:
   - package-ecosystem: "cargo"

absolute-zero/.github/workflows/cflite_batch.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: ClusterFuzzLite batch fuzzing
 on:
   schedule:

absolute-zero/.github/workflows/cflite_pr.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: ClusterFuzzLite PR fuzzing
 on:
   pull_request:
@@ -14,6 +14,9 @@ jobs:
       matrix:
         sanitizer: [address]
     steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build
         uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1

absolute-zero/.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
 
 on:
@@ -9,6 +9,14 @@ on:
   schedule:
     - cron: '0 6 * * 1'
 
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: read-all
 
 jobs:
@@ -26,15 +34,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3.28.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3.28.1
         with:
           category: "/language:${{ matrix.language }}"