chore(governance): 2026-06-12 checkpoint — 6a2 refresh, repo-true flat contractiles, bot_directives trio, doc currency

Author: claude

.machine_readable/6a2/META.a2ml

@@ -7,3 +7,14 @@ project = "maa-framework"
 author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
 license = "MPL-2.0"
 standard = "RSR 2026"
+last-updated = "2026-06-12"
+
+[architecture-decisions]
+# ADR-001 (2026-04-18): K9 self-validation lives outside contractiles/ so the
+# contractile directory stays a pure verb set. Location updated by the
+# 2026-06 estate standardization: .machine_readable/self-validating/
+# (formerly .machine_readable/svc/k9/).
+# 2026-06 estate wave: Guix manifest.scm is the package entrypoint
+# (flake.nix removed in the estate-standardization merge).
+adr-001 = "K9 self-validation outside contractiles/; now at .machine_readable/self-validating/ per estate standardization"
+packaging = "Guix (guix.scm + manifest.scm); flake.nix removed in estate wave 2026-06"

.machine_readable/6a2/PLAYBOOK.a2ml

@@ -6,14 +6,14 @@
 
 [metadata]
 version = "0.1.0"
-last-updated = "2026-03-16"
+last-updated = "2026-06-12"
 
 [deployment]
 # method = "gitops"
 # target = "container"
 
 [incident-response]
-# 1. Check .machine_readable/STATE.a2ml for current status
+# 1. Check .machine_readable/6a2/STATE.a2ml for current status
 # 2. Review recent commits and CI results
 # 3. Run just validate to check compliance
 

.machine_readable/6a2/STATE.a2ml

@@ -1,28 +1,50 @@
 # SPDX-License-Identifier: MPL-2.0
 # STATE.a2ml — Project state checkpoint
-# Last updated: 2026-04-04 (CRG C Testing & Benchmarking Phase Complete)
+# Last updated: 2026-06-12 (governance checkpoint; previous: 2026-04-04 CRG C complete)
 
 [metadata]
 project = "maa-framework"
 version = "0.1.0"
-last-updated = "2026-04-04"
-status = "CRG C Compliance Achieved"
+last-updated = "2026-06-12"
+status = "CRG C compliance achieved; estate-standardized governance layer landed"
 
 [project-context]
 name = "maa-framework"
 completion-percentage = 50
-phase = "Testing & Benchmarking Complete"
+phase = "Governance & estate standardization (post-CRG-C; spec/implementation phases per ROADMAP.adoc still open)"
 
 [testing-status]
 unit-tests = "26 in aletheia + 13 in brainfuck + 5 in whitespace = 44 total"
 e2e-tests = "10 brainfuck interpreter E2E tests"
 property-tests = "11 property-based tests (determinism, equivalence, reversibility)"
 security-tests = "11 aspect tests (bounds, memory safety, input validation)"
 benchmarks = "criterion-based (absolute-zero/benches/cno_benchmarks.rs)"
-test-result = "ALL PASS: 39 tests absolute-zero + 26 unit tests aletheia"
+test-result = "ALL PASS as of 2026-04-04 CRG C checkpoint: 39 tests absolute-zero + 26 unit tests aletheia"
+note = "absolute-zero/ is a git submodule since PR #89; its tests run in the upstream repo"
 
 [crg-compliance]
 tier = "C"
 requirements = "unit + smoke + build + P2P + E2E + reflexive + contract + aspect + benchmarks"
 status = "COMPLETE"
 notes = "Zero-dependency aletheia (RSR Bronze), no unsafe code, criterion benchmarks established"
+
+[recent-work]
+# Summarized from `git log --since=2026-04-04 origin/main` (51 commits, 2026-05-13..2026-06-04)
+# plus the 2026-06-12 estate-standardization merge.
+license-migration = "PMPL-1.0-or-later -> MPL-2.0 estate-wide sweep (commit e4e3db0)"
+ci-canonicalization = "hypatia-scan/mirror/secret-scanner/scorecard converted to thin wrappers of hyperpolymath/standards reusables (PRs #52, #54, #73, #76, #77, #80); concurrency-cancel guards (#56, #58); scorecard-enforcer OSSF run-step fix (#87); scorecard job-level permissions (#90); CI/CD fix campaigns C001-C005"
+absolute-zero-submodule = "re-vendored subtree to upstream HEAD (#83), then converted absolute-zero/ to a git submodule pinned to upstream (#89, closes #84)"
+language-policy = "ReScript guidance retired -> AffineScript (#53 Item 9); stale SafeDOMExample.res fixture deleted (#74); CLAUDE.md flip per 2026-05-25 estate policy (#88)"
+docs = "CHANGELOG.md seeded, Keep-a-Changelog format (#81); docs-template/ skeleton adopted (#79); tech-debt audit recorded 2026-05-26 (#75); proof-debt.md seeded per standards#203 (#82)"
+dependabot = "actions bumps #59-#69, #92-#96 (checkout, artifacts, codeql-action, rust-toolchain, trufflehog, cache, pages)"
+estate-standardization = "2026-06-12: merged estate-standardization-20260607 — 6a2 manifest + README, anchors/ -> 6a2/anchor/, agent_instructions/ -> bot_directives/, flat contractiles, svc/k9 -> self-validating/, GOVERNANCE.adoc, Guix manifest.scm replaces flake.nix; codeql cron weekly -> monthly cherry-picked (standards#288)"
+
+[blockers]
+spec-uploads = "ROADMAP Phase 1 (specification documents for framework, Oblibeny, Aletheia) not yet uploaded"
+proof-debt = "upstream proof debt recorded in docs/proof-debt.md and docs/tech-debt-2026-05-26.md (80 Coq Axiom/Admitted + 54 Lean sorry/axiom markers across 25 files, all vendored/submodule scope)"
+root-justfile = "root Justfile build/test/fmt/lint recipes are placeholders; real builds live in aletheia/ (cargo)"
+
+[next-actions]
+changelog-automation = "adopt changelog-reusable.yml (standards#206) so CHANGELOG.md stays in sync"
+hypatia-ignore-prune = "drop stale aletheia/examples/SafeDOMExample.res entry (file deleted in #74); migrate demo exemptions per .hypatia-ignore TODO 2026-Q3"
+submodule-docs = "document `git submodule update --init` for absolute-zero/ in QUICKSTART-DEV"

.machine_readable/6a2/anchor/ANCHOR.a2ml

@@ -1,18 +1,28 @@
-# ⚓ ANCHOR: maa-framework
+# SPDX-License-Identifier: MPL-2.0
+# ANCHOR: maa-framework
 # This is the canonical authority for the maa-framework repository.
+# Converted from the YAML-style authority record to TOML-A2ML on 2026-06-12
+# (field content preserved); realignment entries follow estate convention.
 
-id: "org.hyperpolymath.maa-framework"
-version: "1.0.0"
-clade: "unknown"
-status: "active"
+[metadata]
+id = "org.hyperpolymath.maa-framework"
+version = "1.0.0"
+clade = "unknown"
+status = "active"
+last-updated = "2026-06-12"
 
 # SSG Configuration (Unified boj-server build)
-ssg:
-  engine: "casket"
-  output_dir: "public"
-  boj_trigger: true
-  cartridge: "ssg-mcp"
+[ssg]
+engine = "casket"
+output_dir = "public"
+boj_trigger = true
+cartridge = "ssg-mcp"
 
-# Relationships
-parents:
-  - "org.hyperpolymath.boj-server"
+[relationships]
+parents = ["org.hyperpolymath.boj-server"]
+
+[[realignments]]
+date = "2026-06-12"
+what = "Estate standardization + governance checkpoint: merged estate-standardization-20260607 (6a2 manifest/README, anchors/ -> 6a2/anchor/, agent_instructions/ -> bot_directives/, flat contractiles, svc/k9 -> self-validating/, GOVERNANCE.adoc, Guix manifest.scm replacing flake.nix); cherry-picked codeql cron weekly -> monthly (standards#288); refreshed 6a2 STATE/META; wrote repo-true flat Mustfile/Trustfile/Adjustfile/Intentfile and ported nested dust/bust into flat Dustfile/Bustfile; added bot_directives trio (hypatia, gitbot-fleet, git-private-farm)."
+why = "Adopt the newer estate standard (landed in echo-types main via PR #185) and bring machine-readable metadata current with the 2026-04-04..2026-06-04 work (PRs #48-#96)."
+evidence = "merge of origin/estate-standardization-20260607; cherry-pick of origin/cicd/codeql-cron-monthly; git log --since=2026-04-04"

.machine_readable/bot_directives/README.adoc

@@ -1,10 +1,21 @@
 // SPDX-License-Identifier: MPL-2.0
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-= Agent Instructions
+= Bot Directives
 :toc: preamble
 
-Methodology-aware configuration for AI agents. Read by any AI agent
-(Claude, Gemini, Copilot, etc.) at session start.
+Per-repo directives for automated agents, read at session start by any AI
+agent (Claude, Gemini, Copilot, etc.) and by the estate's automated bots.
+Renamed from `agent_instructions/` in the 2026-06 estate standardization.
+
+== Purpose and Precedence
+
+Purpose: per-repo directives for automated agents — both methodology
+(how to work) and bot-specific operating rules (what each bot may do).
+
+Precedence: *maintainer > these directives > bot defaults.*
+
+Scope: applies to the Hypatia scanner, the gitbot fleet, and
+`.git-private-farm` propagation.
 
 == Files
 
@@ -20,21 +31,30 @@ Methodology-aware configuration for AI agents. Read by any AI agent
 
 | `debt.a2ml`
 | Meander debt — things found but not fixed, carried between sessions
+
+| `hypatia.a2ml`
+| Hypatia scanner directives: ignore-file, workflow, accepted findings, prohibited actions
+
+| `gitbot-fleet.a2ml`
+| Fleet roster (rhodibot, echidnabot, sustainabot, glambot, seambot, finishbot), branch policy, per-bot allow/deny
+
+| `git-private-farm.a2ml`
+| Propagation to `hyperpolymath/.git-private-farm` via `instant-sync.yml`; token-rotation runbook
 |===
 
 == How Agents Use These
 
 1. Read `methodology.a2ml` at session start — know mode, invariants, ceiling
 2. Read `coverage.a2ml` — know what was visited last time, what was skipped
 3. Read `debt.a2ml` — know what's outstanding from previous sessions
-4. At session end, update `coverage.a2ml` and `debt.a2ml`
+4. Read your bot-specific file (`hypatia.a2ml` / `gitbot-fleet.a2ml` / `git-private-farm.a2ml`) — know your allow/deny boundaries
+5. At session end, update `coverage.a2ml` and `debt.a2ml`
 
 == Relationship to Other Files
 
-* `AGENTIC.a2ml` says WHAT agents can do (permissions, gating)
-* `bot_directives/` says HOW agents should work (methodology)
-* `bot_directives/` says what the gitbot-fleet does (fleet-specific)
-* `CLAUDE.md` says how Claude specifically should work (Claude-specific)
+* `../6a2/AGENTIC.a2ml` says WHAT agents can do (permissions, gating)
+* `bot_directives/` says HOW agents should work (methodology) and what each bot may do (fleet-specific)
+* `.claude/CLAUDE.md` says how Claude specifically should work (Claude-specific)
 
 == Reference
 

.machine_readable/bot_directives/git-private-farm.a2ml

@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: MPL-2.0
+# git-private-farm.a2ml — .git-private-farm propagation directives for maa-framework
+
+[metadata]
+repo = "maa-framework"
+last-updated = "2026-06-12"
+owner = "hyperpolymath"
+
+[propagation]
+enabled = true
+workflow = ".github/workflows/instant-sync.yml"  # present; fires on push to main/master and on published releases
+target = "hyperpolymath/.git-private-farm"
+event-type = "propagate"
+secret = "FARM_DISPATCH_TOKEN"  # secret NAME only — value lives in GitHub Actions secrets
+presence-gated = false  # the dispatch step runs unconditionally; no `if:` presence gate on the secret in the current workflow
+
+[never-propagate]
+items = ["secrets", "unmerged branches", "work-in-progress"]
+
+[on-token-rotation]
+command = "gh secret set FARM_DISPATCH_TOKEN --repo hyperpolymath/maa-framework"  # name only; paste the new value when prompted

.machine_readable/bot_directives/gitbot-fleet.a2ml

@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: MPL-2.0
+# gitbot-fleet.a2ml — gitbot fleet directives for maa-framework
+# Per-repo directives for the hyperpolymath gitbot fleet.
+
+[metadata]
+repo = "maa-framework"
+last-updated = "2026-06-12"
+owner = "hyperpolymath"
+
+[fleet]
+bots = ["rhodibot", "echidnabot", "sustainabot", "glambot", "seambot", "finishbot"]
+rhodibot = "git operations"
+echidnabot = "code quality"
+sustainabot = "dependency updates"
+glambot = "documentation"
+seambot = "integration"
+finishbot = "task completion"
+
+[branch-policy]
+working-branch-pattern = "bot/<bot-name>/<topic>"
+draft-PRs-only = true
+ci-green-before-merge = true
+never-touch = [
+  ".claude/CLAUDE.md",
+  ".gitmodules",
+  "absolute-zero",          # submodule pointer — bumps are deliberate human acts (PR #89)
+  ".github/workflows/",
+  "LICENSE",
+  "LICENSES/",
+]
+
+[per-bot.rhodibot]
+allow = ["branch create", "rebase of own bot branches"]
+deny = ["submodule pointer bumps", "force-push to shared branches"]
+
+[per-bot.sustainabot]
+allow = ["dependency-update PRs for aletheia/Cargo.toml"]
+deny = ["GitHub Actions version bumps"]
+note = "Actions bumps are handled by dependabot in this repo (see PRs #59-#69, #92-#96); duplicating them creates conflicting PRs."
+
+[per-bot.echidnabot]
+allow = ["lint/format suggestions on aletheia/ and tests/"]
+deny = ["edits under .machine_readable/ without maintainer review"]
+
+[per-bot.glambot]
+allow = ["docs/ and README/EXPLAINME currency fixes as draft PRs"]
+deny = ["governance docs (GOVERNANCE.adoc, MAINTAINERS.adoc) edits"]
+
+[per-bot.seambot]
+allow = ["integration metadata under .machine_readable/integrations/"]
+deny = ["workflow wiring changes"]
+
+[per-bot.finishbot]
+allow = ["closing checklists, marking task completion in PR descriptions"]
+deny = ["merging PRs (humans merge after CI green)"]

.machine_readable/bot_directives/hypatia.a2ml

@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: MPL-2.0
+# hypatia.a2ml — Hypatia scanner directives for maa-framework
+# Per-repo directives for the Hypatia security/policy scanner.
+
+[metadata]
+repo = "maa-framework"
+last-updated = "2026-06-12"
+owner = "hyperpolymath"
+
+[scanner]
+ignore-file = ".hypatia-ignore"  # present at repo root
+workflow = ".github/workflows/hypatia-scan.yml"  # thin wrapper of hyperpolymath/standards hypatia-scan-reusable.yml (standards#191), weekly cron + push/PR
+report-format = "logtalk"  # per 6a2/NEUROSYM.a2ml [hypatia-config]
+
+[accepted-findings]
+# Known, deliberate exemptions — mirrored from .hypatia-ignore with reasons.
+banned-language-absolute-zero-demos = "cicd_rules/banned_language_file entries for absolute-zero/ (.res/.go/.java/.kt/.swift demo files): absolute-zero/ is a submodule pinned to hyperpolymath/absolute-zero; the entries mirror that repo's own .hypatia-ignore and are kept defensively in case hypatia scans through the submodule boundary. Demonstration scaffolds, not load-bearing code (see #71)."
+stale-aletheia-safedom-entry = "the aletheia/examples/SafeDOMExample.res entry is STALE — the file was deleted in PR #74; entry retained pending an ignore-file prune (TODO 2026-Q3 in .hypatia-ignore)."
+glob-collapse-pending = "per .hypatia-ignore: the per-file absolute-zero/examples/** entries will collapse to a single file_pattern entry once standards#180 (glob matching in in_baseline()) merges."
+
+[prohibited-actions]
+auto-delete-branches = false
+auto-merge = false
+modify-workflows = false
+escalation = "open an issue, do not spam PR comments"