Merge branch 'main' into feat/stdlib-fs-env-format

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -1,13 +1,22 @@
+<!--
+SPDX-License-Identifier: CC-BY-SA-4.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ## Machine-Readable Artefacts
 
-The following files in `.machine_readable/` contain structured project metadata:
+The following files in `.machine_readable/6a2/` contain structured project
+metadata (a2ml format; the earlier `.scm` root-level names are retired):
 
-- `STATE.scm` - Current project state and progress
-- `META.scm` - Architecture decisions and development practices
-- `ECOSYSTEM.scm` - Position in the ecosystem and related projects
-- `AGENTIC.scm` - AI agent interaction patterns
-- `NEUROSYM.scm` - Neurosymbolic integration config
-- `PLAYBOOK.scm` - Operational runbook
+- `6a2/STATE.a2ml` - Current project state and progress
+- `6a2/META.a2ml` - Architecture decisions (ADRs) and development practices
+- `6a2/ECOSYSTEM.a2ml` - Position in the ecosystem and related projects
+- `6a2/AGENTIC.a2ml` - AI agent interaction patterns
+- `6a2/NEUROSYM.a2ml` - Neurosymbolic integration config
+- `6a2/PLAYBOOK.a2ml` - Operational runbook
+
+Self-validation / service metadata lives in `.machine_readable/svc/`
+(`svc/k9/my-lang-metadata.k9.ncl`, `svc/README.adoc`). The scope-arrest anchor
+is the top-level `ANCHOR.scope-arrest.2026-01-01.Jewell.scm`.
 
 ---
 
@@ -19,16 +28,16 @@ The following files in `.machine_readable/` contain structured project metadata:
 
 | Language/Tool | Use Case | Notes |
 |---------------|----------|-------|
-| **ReScript** | Primary application code | Compiles to JS, type-safe |
+| **AffineScript** | Primary application code | Compiles to JS, type-safe |
 | **Deno** | Runtime & package management | Replaces Node/npm/bun |
 | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
 | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |
 | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like |
 | **Gleam** | Backend services | Runs on BEAM or compiles to JS |
 | **Bash/POSIX Shell** | Scripts, automation | Keep minimal |
-| **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs |
+| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs |
 | **Nickel** | Configuration language | For complex configs |
-| **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm |
+| **Guile Scheme** | State/meta files | `.machine_readable/6a2/{STATE,META,ECOSYSTEM}.a2ml` (the earlier `.scm` names are retired) |
 | **Julia** | Batch scripts, data processing | Per RSR |
 | **OCaml** | AffineScript compiler | Language-specific |
 | **Ada** | Safety-critical systems | Where required |
@@ -37,13 +46,13 @@ The following files in `.machine_readable/` contain structured project metadata:
 
 | Banned | Replacement |
 |--------|-------------|
-| TypeScript | ReScript |
+| TypeScript | AffineScript |
 | Node.js | Deno |
 | npm | Deno |
 | Bun | Deno |
 | pnpm/yarn | Deno |
 | Go | Rust |
-| Python | Julia/Rust/ReScript |
+| Python | Julia/Rust/AffineScript |
 | Java/Kotlin | Rust/Tauri/Dioxus |
 | Swift | Tauri/Dioxus |
 | React Native | Tauri/Dioxus |
@@ -53,18 +62,18 @@ The following files in `.machine_readable/` contain structured project metadata:
 
 **No exceptions for Kotlin/Swift** - use Rust-first approach:
 
-1. **Tauri 2.0+** - Web UI (ReScript) + Rust backend, MIT/Apache-2.0
+1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0
 2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0
 
 Both are FOSS with independent governance (no Big Tech).
 
 ### Enforcement Rules
 
-1. **No new TypeScript files** - Convert existing TS to ReScript
-2. **No package.json for runtime deps** - Use deno.json imports
+1. **No new TypeScript files** - Convert existing TS to AffineScript
+2. **No package.json - use deno.json deps** - Use deno.json imports
 3. **No node_modules in production** - Deno caches deps automatically
 4. **No Go code** - Use Rust instead
-5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps
+5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps
 6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
 
 ### Package Management

.claude/PROJECT.md

@@ -0,0 +1,37 @@
+<!--
+SPDX-License-Identifier: CC-BY-SA-4.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
+# My Lang - Claude Code Instructions
+
+This repository contains the My Lang programming language implementation.
+
+## Project Structure
+
+```
+my-lang/
+├── .claude/         # AI assistant instructions
+├── .git/           # Version control
+├── .gitignore      # Git ignore rules
+├── .editorconfig   # Editor configuration
+└── ...             # Language files
+```
+
+## Build Commands
+
+Refer to project-specific documentation.
+
+## Coding Conventions
+
+- Follow hyperpolymath standards
+- All code must have SPDX license headers
+- Use approved languages only (see CLAUDE.md)
+- Document all non-obvious decisions
+
+## Security
+
+- No hardcoded secrets
+- All secrets through environment variables or secret management
+- SHA-pinned dependencies where applicable
+- HTTPS only, no HTTP URLs
+- No MD5/SHA1 for security purposes

.clusterfuzzlite/Containerfile

@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# ClusterFuzzLite / OSS-Fuzz build image. The ClusterFuzzLite actions
+# (google/clusterfuzzlite) build the project from `.clusterfuzzlite/Dockerfile`
+# by hard-coded convention, so this file MUST be named `Dockerfile`.
+FROM gcr.io/oss-fuzz-base/base-builder-rust
+RUN apt-get update && apt-get install -y make autoconf automake libtool
+COPY . $SRC/my-lang
+WORKDIR $SRC/my-lang
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/Dockerfile

@@ -1,14 +1,18 @@
 #!/bin/bash -eu
-<<<<<<< HEAD
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# OSS-Fuzz / ClusterFuzzLite build script: compile the cargo-fuzz targets in
+# `fuzz/` and stage each binary into $OUT. Run by `compile` inside the
+# base-builder-rust image (see .clusterfuzzlite/Dockerfile).
+cd "$SRC/my-lang"
+# Build for the sanitizer OSS-Fuzz requests (defaults to address). NOTE: only
+# `address` is configured — Rust/cargo-fuzz cannot emit a valid UBSan binary
+# (it links ASan regardless), which `bad_build_check` rejects; see project.yaml.
+cargo +nightly fuzz build -O --sanitizer "${SANITIZER:-address}"
 
-cd $SRC/project
-cargo +nightly fuzz build --release
-cp fuzz/target/*/release/fuzz_* $OUT/
-=======
-cd $SRC/*/fuzz
-cargo +nightly fuzz build
-for target in fuzz_targets/*; do
-    target_name=$(basename ${target%.rs})
-    cp target/x86_64-unknown-linux-gnu/release/$target_name $OUT/
+release="$SRC/my-lang/fuzz/target/x86_64-unknown-linux-gnu/release"
+for target in fuzz/fuzz_targets/*.rs; do
+    name="$(basename "${target%.rs}")"
+    cp "$release/$name" "$OUT/"
 done
->>>>>>> 7f63c53cc206ad0448f9e17e5b74dde7cf393117

.clusterfuzzlite/build.sh

@@ -1,6 +1,9 @@
 homepage: "https://github.com/hyperpolymath/my-lang"
 language: rust
 main_repo: "https://github.com/hyperpolymath/my-lang"
+# Only ASan: Rust/cargo-fuzz does not produce a valid UndefinedBehaviorSanitizer
+# build (it links ASan regardless), which OSS-Fuzz's `bad_build_check` rejects
+# ("UBSan build ... seems to be compiled with ASan"). ASan is the supported,
+# meaningful sanitizer for Rust fuzzing here.
 sanitizers:
   - address
-  - undefined

.clusterfuzzlite/project.yaml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 
 # Auto detect text files and perform LF normalization
 * text=auto

.gitattributes

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MPL-2.0
+# CODEOWNERS - Define code review assignments for GitHub
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default: sole maintainer for all files
+* @hyperpolymath
+
+# Security-sensitive files require explicit ownership
+SECURITY.md @hyperpolymath
+.github/workflows/ @hyperpolymath
+.machine_readable/ @hyperpolymath
+contractiles/ @hyperpolymath
+
+# License files
+LICENSE @hyperpolymath
+LICENSES/ @hyperpolymath
+
+# Configuration
+.gitignore @hyperpolymath
+.github/ @hyperpolymath
+
+# Documentation
+README* @hyperpolymath
+CONTRIBUTING* @hyperpolymath
+CODE_OF_CONDUCT* @hyperpolymath
+GOVERNANCE* @hyperpolymath
+MAINTAINERS* @hyperpolymath
+CHANGELOG* @hyperpolymath
+ROADMAP* @hyperpolymath
+
+# Build and CI
+Justfile @hyperpolymath
+Makefile @hyperpolymath
+*.sh @hyperpolymath

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+mcp_servers:
+  boj-server:
+    command: npx
+    args: ["-y", "@hyperpolymath/boj-server@latest"]
+    env:
+      BOJ_URL: http://localhost:7700

.github/copilot/coding-agent.yml

@@ -1,9 +1,16 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
     open-pull-requests-limit: 10
+    # Batch this ecosystem into a single PR. Ungrouped, Dependabot
+    # opens one PR per dependency, and each PR re-fires every
+    # workflow in the repo.
+    groups:
+      github-actions:
+        patterns:
+          - "*"