fix: RSR compliance — fix SPDX headers, resolve placeholders, rewrite stale SCM

- Fix AGPL-3.0-or-later → PMPL-1.0-or-later in 17 source files
- Fix Cargo.toml license fields and add author attribution
- Add SPDX headers to 5 files missing them
- Resolve template placeholders in CODE_OF_CONDUCT.md, CONTRIBUTING.md
- Rewrite stale .machine_readable/ SCM files (had language-bridges data)
- Fix AI manifest email and placeholders
- Add .well-known/ (security.txt, humans.txt, ai.txt)
- Add .github/CODEOWNERS
- Fix broken README link, expand SECURITY.md
- Fix workflow linter SPDX reference

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.editorconfig

@@ -1,4 +1,5 @@
-# RSR-template-repo - Editor Configuration
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# nexia-list - Editor Configuration
 # https://editorconfig.org
 
 root = true
@@ -59,6 +60,18 @@ indent_size = 2
 [*.nix]
 indent_size = 2
 
+[*.css]
+indent_size = 2
+
+[*.html]
+indent_size = 2
+
+[*.json]
+indent_size = 2
+
+[*.toml]
+indent_size = 2
+
 [Justfile]
 indent_style = space
 indent_size = 4

.gitattributes

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # RSR-compliant .gitattributes
 
 * text=auto eol=lf

.github/CODEOWNERS

@@ -0,0 +1,24 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# CODEOWNERS — Default code ownership for nexia-list
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default owner for all files
+* @hyperpolymath
+
+# Rust core engine
+/core/ @hyperpolymath
+
+# ReScript UI
+/ui/ @hyperpolymath
+
+# Tauri desktop/mobile shell
+/desktop/ @hyperpolymath
+
+# Web / PWA
+/web/ @hyperpolymath
+
+# Workflows and CI
+/.github/ @hyperpolymath
+
+# Machine-readable metadata
+/.machine_readable/ @hyperpolymath

.github/workflows/workflow-linter.yml

@@ -36,7 +36,7 @@ jobs:
             fi
           done
           if [ $failed -eq 1 ]; then
-            echo "Add '# SPDX-License-Identifier: AGPL-3.0-or-later' as first line"
+            echo "Add '# SPDX-License-Identifier: PMPL-1.0-or-later' as first line"
             exit 1
           fi
           echo "All workflows have SPDX headers"

.gitignore

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # RSR-compliant .gitignore
 
 # OS & Editor

.machine_readable/ECOSYSTEM.scm

@@ -1,3 +1,13 @@
 ;; SPDX-License-Identifier: PMPL-1.0-or-later
-(ecosystem (metadata (version "0.1.0") (last-updated "2026-02-08"))
-  (project (name "language-bridges") (purpose "FFI bridges between languages via Zig") (role ffi-infrastructure)))
+(ecosystem
+  (metadata
+    (version "0.1.0")
+    (last-updated "2026-03-02"))
+  (project
+    (name "nexia-list")
+    (purpose "Cross-platform personal knowledge management inspired by Tinderbox")
+    (role application))
+  (related-projects
+    (project "rescript-tea" (relationship dependency) (purpose "TEA architecture for ReScript"))
+    (project "cadre-tea-router" (relationship dependency) (purpose "URL-based navigation for TEA apps"))
+    (project "bunsenite" (relationship potential-consumer) (purpose "Nickel-based configuration schemas"))))

.machine_readable/META.scm

@@ -1,3 +1,23 @@
 ;; SPDX-License-Identifier: PMPL-1.0-or-later
-(meta (metadata (version "0.1.0") (last-updated "2026-02-08"))
-  (project-info (type monorepo) (languages (zig ada gleam idris2 julia ocaml rescript rust swift)) (license "PMPL-1.0-or-later")))
+(meta
+  (metadata
+    (version "0.1.0")
+    (last-updated "2026-03-02"))
+  (project-info
+    (type application)
+    (languages (rust rescript javascript html css))
+    (license "PMPL-1.0-or-later")
+    (author "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"))
+  (architecture-decisions
+    (adr "ADR-001: Use Rust for core engine with serde for serialization"
+      (status accepted)
+      (rationale "Memory safety, WASM compilation, graph libraries (petgraph), search (tantivy)"))
+    (adr "ADR-002: Use ReScript TEA for UI layer"
+      (status accepted)
+      (rationale "Exhaustive pattern matching, pure update functions, type-safe message passing"))
+    (adr "ADR-003: Use Tauri 2.0 for desktop and mobile"
+      (status accepted)
+      (rationale "Cross-platform from single codebase, small binaries, no Node.js attack surface"))
+    (adr "ADR-004: Local-first data storage"
+      (status accepted)
+      (rationale "User data stays on device, JSON files on desktop, IndexedDB on web"))))

.machine_readable/STATE.scm

@@ -1,4 +1,23 @@
 ;; SPDX-License-Identifier: PMPL-1.0-or-later
-(state (metadata (version "0.1.0") (last-updated "2026-02-08") (status active))
-  (project-context (name "language-bridges") (purpose "FFI bridges between languages via Zig") (completion-percentage 20))
-  (components (component "ada-zig-ffi") (component "gleam-zig-ffi") (component "idris2-zig-ffi") (component "julia-zig-ffi") (component "ocaml-zig-ffi") (component "rescript-zig-ffi") (component "rust-zig-ffi") (component "swift-zig-ffi") (component "zig-c-ffi") (component "zig-container-ffi") (component "zig-fuse-ext") (component "zig-libgit2-ffi") (component "zig-nickel-ffi") (component "zig-systemd-ffi") (component "zig-wireguard")))
+(state
+  (metadata
+    (version "0.1.0")
+    (last-updated "2026-03-02")
+    (status active))
+  (project-context
+    (name "nexia-list")
+    (purpose "Cross-platform personal knowledge management with spatial notes, relationships, and intelligent agents")
+    (completion-percentage 30))
+  (components
+    (component "rust-core" (status "implemented") (description "Graph engine, search, storage — Note/Notebook/Storage modules"))
+    (component "rescript-ui" (status "scaffolded") (description "TEA architecture with Model/View/Update/Msg/Types modules"))
+    (component "tauri-desktop" (status "scaffolded") (description "Tauri 2.0 desktop shell with command handlers"))
+    (component "web-pwa" (status "scaffolded") (description "HTML/CSS browser entry point"))
+    (component "deno-tooling" (status "configured") (description "Deno task runner for dev/build/test/lint")))
+  (blockers
+    (blocker "No CI for Rust/ReScript builds yet")
+    (blocker "Mobile (iOS/Android) shell not started"))
+  (critical-next-actions
+    (action "Wire Tauri commands to ReScript UI via invoke bridge")
+    (action "Add full-text search with tantivy integration")
+    (action "Implement spatial canvas drag-and-drop")))

.well-known/ai.txt

@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# ai.txt — AI agent interaction policy
+# See: https://github.com/hyperpolymath/0-ai-gatekeeper-protocol
+
+# This repository permits AI agent interaction.
+# All AI agents MUST read 0-AI-MANIFEST.a2ml before making changes.
+
+User-agent: *
+Allow: /
+
+# AI manifest location
+Manifest: /0-AI-MANIFEST.a2ml
+
+# Machine-readable metadata
+Metadata: /.machine_readable/STATE.scm
+Metadata: /.machine_readable/META.scm
+Metadata: /.machine_readable/ECOSYSTEM.scm
+
+# License
+License: PMPL-1.0-or-later
+
+# Contact
+Contact: j.d.a.jewell@open.ac.uk

.well-known/humans.txt

@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# humans.txt — https://humanstxt.org/
+
+/* TEAM */
+Name: Jonathan D.A. Jewell
+Role: Lead Maintainer
+Site: https://github.com/hyperpolymath
+Location: United Kingdom
+
+/* SITE */
+Software: Nexia — Cross-platform personal knowledge management
+Standards: PMPL-1.0-or-later, RSR (Rhodium Standard Repository)
+Components: Rust core, ReScript TEA UI, Tauri 2.0 desktop/mobile, WASM/PWA web