neurophone: licence drift → MPL-2.0, language-policy/STATE refresh, GOVERNANCE.adoc (#160)

## Summary

Documentation-correctness + RSR-compliance follow-up (after merged
#158).

- **chore(licence): PMPL-1.0 → MPL-2.0 drift correction
(owner-approved).** neurophone
is a sole-owner MPL-2.0 repo (licence reverted from PMPL in #102/#118
per HANDOVER),
but several *functional* declarations still read PMPL. Corrected README
badge/body,
`META.a2ml`/`stapeln.toml` licence fields, `AGENTIC.a2ml`,
`0-AI-MANIFEST.a2ml`,
`QUICKSTART-MAINTAINER.adoc`, `llm-warmup-{dev,user}.md`. **Deliberately
not touched**
(owner territory): `PALIMPSEST.adoc`, `docs/CITATIONS.adoc`,
`docs/governance/*`,
`LICENSES/*.txt`, and the README Palimpsest-*philosophy* badge. Docs
stay CC-BY-SA-4.0.
- **docs: refresh stale `.claude/CLAUDE.md` language policy** — drop the
removed
Python/SaltStack allowance and the Nix fallback (Guix-only);
Rust→Rust/SPARK; add
  Zig/Idris2; add ReScript/V-lang/ATS2/Nix/Makefiles to BANNED.
- **docs: correct `STATE.a2ml`** — the neural crates were mislabelled
"stub" but carry
real code + property suites; neurophone-android is now the full JNI
surface. Records
160 tests, clippy/fmt/TLC clean, a `[proofs]` block, and honest external
`[blockers]`.
- **docs: dedup CONTRIBUTING** — removed the 402-byte `.adoc` stub
(estate keeps the
  GitHub-required `.md`; nothing referenced the `.adoc`).
- **docs(rsr): add `GOVERNANCE.adoc`** (was missing at root) and mark
the JNI surface
  audit as implemented by #110.

No code changes; docs/config only. (Prior branch verification stands:
160 tests, clippy
`-D warnings` clean, fmt clean.)

## FLAGS (unchanged)
- `gossamer` + `conative-gating` remain 403-blocked → #83 / #103 staged.
- Owner fills the Trustfile `{{PLACEHOLDER}}` crypto at signing time.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh

---
_Generated by [Claude
Code](https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -21,13 +21,14 @@ The following files in `.machine_readable/` contain structured project metadata:
 |---------------|----------|-------|
 | **AffineScript** | Primary application code | Affine-typed, compiles to typed-wasm or Deno-ESM |
 | **Deno** | Runtime & package management | Replaces Node/npm/bun |
-| **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
+| **Rust/SPARK** | Performance-critical, systems, WASM, CLI, safety-critical | "Rust" always means Rust with SPARK integration as the default stance |
+| **Zig** | APIs, FFIs, gateways, client SDKs | Estate default for FFI/gateway work; Idris2 owns ABIs |
+| **Idris2** | Formal verification (ABI-style proofs) | Proven-library status in `proven` repo |
 | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |
 | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like |
 | **Gleam** | Backend services | Runs on BEAM or compiles to JS |
 | **Bash/POSIX Shell** | Scripts, automation | Keep minimal |
-| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs |
-| **Python** | SaltStack only | No other Python permitted |
+| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs (transitional) |
 | **Nickel** | Configuration language | For complex configs |
 | **Guile Scheme** | State/meta files | .machine_readable/6a2/STATE.a2ml, .machine_readable/6a2/META.a2ml, .machine_readable/6a2/ECOSYSTEM.a2ml |
 | **Julia** | Batch scripts, data processing | Per RSR |
@@ -43,9 +44,14 @@ The following files in `.machine_readable/` contain structured project metadata:
 | npm | Deno |
 | Bun | Deno |
 | pnpm/yarn | Deno |
-| Go | Rust |
-| Python (general) | ReScript/Rust |
-| Java/Kotlin | Rust/Tauri/Dioxus |
+| Go | Rust/SPARK |
+| **Python** (fully banned, no exceptions) | AffineScript/Rust/Julia |
+| **ReScript** (banned 2026-04-30) | AffineScript |
+| **V-lang** (banned 2026-04-10) | Zig |
+| **ATS2** | Idris2 (formal) / Rust/SPARK |
+| **Nix** | Guix (guix.scm) |
+| **Makefiles** | Mustfile/justfile |
+| Java/Kotlin | Rust/SPARK, Tauri, Dioxus |
 | Swift | Tauri/Dioxus |
 | React Native | Tauri/Dioxus |
 | Flutter/Dart | Tauri/Dioxus |
@@ -64,14 +70,13 @@ Both are FOSS with independent governance (no Big Tech).
 1. **No new TypeScript files** - Convert existing TS to AffineScript
 2. **No package.json for runtime deps** - Use deno.json imports
 3. **No node_modules in production** - Deno caches deps automatically
-4. **No Go code** - Use Rust instead
-5. **Python only for SaltStack** - All other Python must be rewritten
-6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
+4. **No Go code** - Use Rust/SPARK instead
+5. **No Python** - fully banned (SaltStack exception removed 2026-01-03); use Rust/SPARK, Julia, or AffineScript
+6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus (this repo's Android client migrates to gossamer per #83)
 
 ### Package Management
 
-- **Primary**: Guix (guix.scm)
-- **Fallback**: Nix (flake.nix)
+- **Primary**: Guix (guix.scm) — this repo is Guix-only (flake.nix removed; Nix is banned estate-wide)
 - **JS deps**: Deno (deno.json imports)
 
 ### Security Requirements

.machine_readable/6a2/AGENTIC.a2ml

@@ -21,4 +21,4 @@ can-create-files = true
 # - Never commit secrets or credentials
 # - Never use banned languages (TypeScript, Python, Go, etc.)
 # - Never place state files in repository root (must be in .machine_readable/)
-# - Never use AGPL license (use PMPL-1.0-or-later)
+# - Never use AGPL license (use MPL-2.0)

.machine_readable/6a2/META.a2ml

@@ -5,5 +5,5 @@
 [metadata]
 project = "neurophone"
 author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
-license = "PMPL-1.0-or-later"
+license = "MPL-2.0"
 standard = "RSR 2026"

.machine_readable/6a2/STATE.a2ml

@@ -1,52 +1,55 @@
 # SPDX-License-Identifier: MPL-2.0
 # STATE.a2ml — Project state checkpoint
-# Updated 2026-04-04 — CRG C grade achieved
+# Updated 2026-07-01 — proofs (2.1 TLC / 2.3 typestate), JNI surface, Trustfile,
+# CI green; crate statuses corrected (the neural crates were never stubs).
 
 [metadata]
 project = "neurophone"
 version = "1.0.0"
-last-updated = "2026-04-04"
+last-updated = "2026-07-01"
 status = "active"
 crg-grade = "C"
 
 [project-context]
 name = "neurophone"
-completion-percentage = 65
-phase = "Testing complete, feature development ready"
+completion-percentage = 80
+phase = "Core + proofs advancing; Android shell blocked on external gossamer"
 
 [test-coverage]
-unit-tests = 41
-smoke-tests = 3
-e2e-tests = 2
-property-tests = 14
-reflexive-tests = 3
-contract-tests = 2
-aspect-tests = 6
-benchmarks = 24
-total-tests = 95
+# Aggregate across the workspace (lib + integration + doc-tests).
+total-tests = 160
+notes = "includes property tests (0.1/0.2/1.2/1.3), typestate compile-fail doc-tests (2.1/2.3), and the TLC lifecycle model check (2.1)"
 
 [test-results]
-unit-tests-status = "PASS"
-smoke-tests-status = "PASS"
-e2e-tests-status = "PASS"
-property-tests-status = "PASS"
 build-status = "SUCCESS"
+test-status = "PASS"
+clippy-status = "CLEAN (--all-targets -- -D warnings)"
+fmt-status = "CLEAN"
+tlc-status = "PASS (Lifecycle: no error, 13 states)"
 
 [crates]
-neurophone-core = "88 tests"
-lsm = "4 tests"
-esn = "9 tests"
-bridge = "stub"
-llm = "stub"
-sensors = "stub"
-claude-client = "stub"
-neurophone-android = "stub"
+# Corrected: bridge/llm/sensors/claude-client carry real code + property suites;
+# neurophone-android is now the full JNI surface, not a stub.
+neurophone-core = "complete — orchestrator + typestate lifecycle + QueryRoute"
+lsm = "complete — proptest_numeric + proptest_bounds"
+esn = "complete — proptest_numeric; true spectral-radius via power iteration"
+bridge = "complete — proptest_soundness (obligation 1.3)"
+llm = "complete — local inference"
+sensors = "complete — proptest_numeric; IIR filtering"
+claude-client = "complete — cloud fallback; egress-scrub test"
+neurophone-android = "implemented — 11-method ai.neurophone.NativeLib JNI surface (#110)"
+
+[proofs]
+# Honest obligation status; full detail in proofs/README.adoc + Trustfile PROOF_ARTIFACTS.
+discharged = "0.1 panic-freedom, 0.2 numeric containment, 0.3 unsafe discipline, 1.2 LSM bounds, 1.3 bridge soundness (property); 2.1 lifecycle (TLC); 2.3 release-once (compile-fail)"
+open = "1.1 Echo State Property (formal contraction), 1.2 formal Dafny bound, 2.2 concurrency (N/A single-owner), 3.1 egress veto (external #103), 3.2 bounded-interaction contract test"
 
 [recent-work]
-session-date = "2026-04-04"
-fixed = "ESN crate (was missing src/lib.rs and [lib] section)"
-added = "95+ comprehensive tests covering unit/smoke/e2e/property/reflexive/contract/aspect"
-improved = "Cargo.toml license (PMPL), author attribution, dev dependencies"
+session-date = "2026-07-01"
+fixed = "rand 0.9/0.10 build break; retired scorecard-enforcer.yml; re-pinned standards reusables (governance/hypatia/scorecard green)"
+added = "real JNI surface (#110); TLA+ Lifecycle.cfg + TLC; typestate compile-fail proofs; core panic/numeric proptests; full estate Trustfile v2026.2.5-final + trustfile.yml gate"
+improved = "Cargo.toml/manifests licence normalised to MPL-2.0; proofs/README honest status; STATE corrected"
 
 [blockers]
-none = "Ready for feature development"
+gossamer = "External: #83 Android migration (gossamer Idris2+Zig shell) blocked — repo not in session scope (403)"
+conative-gating = "External: #103 egress GO/NO-GO veto (obligation 3.1 residual) blocked — repo not in session scope"

0-AI-MANIFEST.a2ml

@@ -43,7 +43,7 @@ Bot-specific instructions for:
 1. **No SCM duplication** - Root must NOT contain .machine_readable/6a2/STATE.a2ml, .machine_readable/6a2/META.a2ml, etc.
 2. **Single source of truth** - `.machine_readable/` is authoritative
 3. **No stale metadata** - If root SCMs exist, they are OUT OF DATE
-4. **License consistency** - All code PMPL-1.0-or-later unless platform requires MPL-2.0
+4. **License consistency** - All code MPL-2.0 (sole-owner repo)
 5. **Author attribution** - Always "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
 
 ## REPOSITORY STRUCTURE
@@ -112,5 +112,5 @@ After reading this file, demonstrate understanding by stating:
 - **Format Version:** 1.0.0
 - **Created:** [DATE]
 - **Maintained By:** [YOUR-NAME/ORG]
-- **License:** PMPL-1.0-or-later
+- **License:** MPL-2.0
 - **Protocol:** https://github.com/hyperpolymath/0-ai-gatekeeper-protocol

CONTRIBUTING.adoc

@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= Governance Model
+:toc: preamble
+
+Governance model for **neurophone** (on-device neurosymbolic AI). This repo
+follows the hyperpolymath estate governance pattern; the canonical estate policy
+lives in https://github.com/hyperpolymath/standards[hyperpolymath/standards].
+
+== Overview
+
+neurophone follows a **Benevolent Dictator (BDFL)** model:
+
+* A single champion (@hyperpolymath) holds the project's vision and final
+  decision authority, while actively welcoming contributions and delegating.
+* *Current reality:* a sole maintainer. That is a staffing fact, not a closed
+  door — contributions are welcomed and reviewed, and authority is delegable to
+  anyone who demonstrably carries the project's essence.
+* Decisions are made transparently through GitHub issues and pull requests.
+
+== Core Principles
+
+[cols="1,2"]
+|===
+| Principle | Description
+| **Benevolent Dictatorship** | Maintainer has final authority but seeks input.
+| **Meritocracy** | Contributions are judged on technical merit.
+| **Transparency** | Significant decisions are documented publicly.
+| **Fail loudly, seal soundly** | No silent green; seams (ABI/FFI) are sealed and, where load-bearing, proved.
+| **Report faithfully** | No overclaiming — proof obligations are discharged or honestly left open (never faked).
+|===
+
+== Roles and Permissions
+
+[cols="1,2,2"]
+|===
+| Role | Permissions | Assignment
+| **Maintainer** | Write, merge, admin | @hyperpolymath
+| **Contributors** | Fork, submit PRs | All GitHub users
+| **Agents (LLM)** | Bounded per `.machine_readable/6a2/AGENTIC.a2ml` | Automated assistants
+|===
+
+== Decision-Making Framework
+
+Routine (bug fixes, docs, minor features, dependency updates) — maintainer or a
+delegate merges after CI is green. Significant (architecture, ABI/FFI seam
+changes, proof-obligation changes, security policy, licence) — require explicit
+maintainer review; these are gated by the estate policies below.
+
+=== Licence changes — owner-only
+
+Per the estate guardrail, **licence and SPDX changes are manual, per-file, and
+owner-approved only**. Agents and automation must not generate licence-change PRs
+or sweep SPDX headers; findings about licence drift are flag-only. neurophone is a
+sole-owner repo: code is **MPL-2.0**, documentation is **CC-BY-SA-4.0**.
+
+=== Security-critical changes
+
+Changes to the Trustfile, CI/security/release workflows, cryptographic material,
+the JNI FFI boundary, or the `proofs/` corpus require explicit review. See
+`.machine_readable/contractiles/trust/Trustfile.a2ml` (`[CAPABILITY_GATEWAY]`).
+
+== Machine-Readable Governance
+
+The normative substrate is authoritative where it applies:
+
+* `.machine_readable/6a2/AGENTIC.a2ml` — agent permissions / risk gating.
+* `.machine_readable/6a2/META.a2ml` — architecture decisions.
+* `.machine_readable/contractiles/` — MUST / TRUST / INTEND / ADJUST / DUST / BUST
+  contracts (e.g. `MUST.contractile` bans proof escape hatches).
+* `proofs/README.adoc` — proof-obligation map and status.
+
+== Code of Conduct
+
+Participation is governed by `CODE_OF_CONDUCT.md`. Report concerns via the
+security/contact channels in `SECURITY.md`.

GOVERNANCE.adoc

@@ -106,7 +106,7 @@ Or via OPSM: `opsm update {{PACKAGE_NAME}}`
 
 == Security Notes
 
-* License: PMPL-1.0-or-later (Palimpsest License)
+* License: MPL-2.0
 * All dependencies SHA-pinned
 * `panic-attacker` scan results: link:INSTALL-SECURITY-REPORT.adoc[]
 * OpenSSF Scorecard: see badge in README

QUICKSTART-MAINTAINER.adoc

@@ -1,4 +1,4 @@
-image:https://img.shields.io/badge/License-MPL--2.0-blue.svg[License: PMPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"]
+image:https://img.shields.io/badge/License-MPL--2.0-blue.svg[License: MPL-2.0,link="https://github.com/hyperpolymath/neurophone/blob/main/LICENSE"]
 image:https://img.shields.io/badge/Philosophy-Palimpsest-indigo.svg[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"]
 
 
@@ -521,7 +521,7 @@ Contributions welcome! See link:CONTRIBUTING.md[CONTRIBUTING.md].
 
 == License
 
-Palimpsest-MPL-1.0 License - See LICENSE file
+MPL-2.0 License - See the LICENSE file. Documentation is CC-BY-SA-4.0.
 
 == Citation
 

README.adoc

@@ -15,7 +15,20 @@ can finish.
 
 == Current state
 
-* `crates/neurophone-android/src/lib.rs` = 6-line stub (`pub fn hello() -> &'static str`). No JNI exports yet.
+[NOTE]
+====
+*IMPLEMENTED (2026-07-01, issue #110).* The audit below is fulfilled. The 11-method
+surface now lives in `crates/neurophone-android/` (`lib.rs` JNI exports +
+`state.rs` holder/bridge + `sensor_map.rs` + `error.rs`), using jni 0.22's safe
+`EnvUnowned::with_env`. The `query` gap (Gap 3) was resolved by adding
+`QueryRoute` + `query_routed` to `neurophone-core` (so `queryLocal`/`queryClaude`
+force the model); `getNeuralContext` (Gap 4) and the sensor-id map (Gap 2) landed
+as designed. Bridge logic is host-tested and `reset` consumes the core
+`shutdown(self)` typestate (release-once). The historical audit is retained below
+for provenance.
+====
+
+* `crates/neurophone-android/src/lib.rs` = 6-line stub (`pub fn hello() -> &'static str`). No JNI exports yet. *(historical — now implemented; see the note above.)*
 * `crates/neurophone-android/Cargo.toml` already declares `crate-type =
   ["cdylib"]`, depends on `jni`, `neurophone-core`, `sensors`,
   `serde_json`, `tokio`, `chrono`. Foundation is correct.