fix(governance): finish root→6a2 a2ml convergence; openssf gate checks canonical paths

The repo's openssf-compliance gate required .machine_readable/{STATE,META,
ECOSYSTEM}.a2ml at the ROOT — the pre-6a2 paths — while Hypatia SD004
(error-level) requires those files to live ONLY in .machine_readable/6a2/.
The two gates were in direct contradiction; the estate standard (and all
sibling repos) make 6a2/ canonical, so:
- openssf-compliance.yml now checks .machine_readable/6a2/* paths.
- Stale root S-expr duplicates META.a2ml + ECOSYSTEM.a2ml removed
  (canonical TOML versions live in 6a2/; root STATE.a2ml was removed in
  the previous commit).
- Six referencing files repointed to the 6a2/ paths.

https://claude.ai/code/session_01GJatEm2TVFSTBEkKXmserJ

Author: claude

.github/workflows/openssf-compliance.yml

@@ -74,11 +74,13 @@ jobs:
             exit 1
           fi
 
-          if [ ! -f ".machine_readable/STATE.a2ml" ]; then
-            echo "::error::.machine_readable/STATE.a2ml is required"
+          # Canonical location is .machine_readable/6a2/ (estate standard;
+          # Hypatia SD004 flags any *.a2ml of the 6a2 set OUTSIDE 6a2/).
+          if [ ! -f ".machine_readable/6a2/STATE.a2ml" ]; then
+            echo "::error::.machine_readable/6a2/STATE.a2ml is required"
             exit 1
           fi
-          echo ".machine_readable/STATE.a2ml: OK"
+          echo ".machine_readable/6a2/STATE.a2ml: OK"
 
       - name: Check CHANGELOG exists
         run: |
@@ -96,8 +98,8 @@ jobs:
           # Collect all required files that exist
           for f in SECURITY.md SECURITY.adoc .github/SECURITY.md LICENSE LICENSE.txt \
                    CONTRIBUTING.md CONTRIBUTING.adoc README.md README.adoc \
-                   .machine_readable/STATE.a2ml .machine_readable/META.a2ml \
-                   .machine_readable/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do
+                   .machine_readable/6a2/STATE.a2ml .machine_readable/6a2/META.a2ml \
+                   .machine_readable/6a2/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do
             [ -f "$f" ] && REQUIRED_FILES="$REQUIRED_FILES $f"
           done
 

.machine_readable/6a2/PLAYBOOK.a2ml

@@ -13,7 +13,7 @@ last-updated = "2026-04-11"
 # target = "container"  # container | binary | library | wasm
 
 [incident-response]
-# 1. Check .machine_readable/STATE.a2ml for current status
+# 1. Check .machine_readable/6a2/STATE.a2ml for current status
 # 2. Review recent commits and CI results
 # 3. Run `just validate` to check compliance
 # 4. Run `just security` to audit for vulnerabilities

.machine_readable/ECOSYSTEM.a2ml

@@ -7,7 +7,7 @@
 - Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing.
 
 ## Workflow
-1. Inspect `.machine_readable/STATE.a2ml` for blockers and next actions.
+1. Inspect `.machine_readable/6a2/STATE.a2ml` for blockers and next actions.
 2. Respect any constraints listed inside `.machine_readable/AGENTIC.a2ml` when tooling changes are requested.
 3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message.
 

.machine_readable/META.a2ml

@@ -20,5 +20,5 @@ Recommended machine read order:
 * `.machine_readable/policies/MAINTENANCE-AXES.a2ml`
 * `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml`
 * `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml`
-* `.machine_readable/STATE.a2ml`
-* `.machine_readable/META.a2ml`
+* `.machine_readable/6a2/STATE.a2ml`
+* `.machine_readable/6a2/META.a2ml`

.machine_readable/ai/AI.a2ml

@@ -18,7 +18,7 @@ machine-entrypoints = [
   ".machine_readable/policies/MAINTENANCE-AXES.a2ml",
   ".machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml",
   ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml",
-  ".machine_readable/META.a2ml",
+  ".machine_readable/6a2/META.a2ml",
   ".machine_readable/ai/README.adoc",
   ".machine_readable/bot_directives/README.scm",
 ]

.machine_readable/ai/README.adoc

@@ -217,7 +217,7 @@ project/
 * `Justfile`
 * `README.adoc`
 * `LICENSE` (MPL-2.0)
-* `.machine_readable/STATE.a2ml`
+* `.machine_readable/6a2/STATE.a2ml`
 * `.well-known/security.txt`
 * `.well-known/ai.txt`
 * `.well-known/humans.txt`

.machine_readable/policies/MAINTENANCE-AXES.a2ml

@@ -12,7 +12,7 @@ Per-tool config files (.cursorrules, .clinerules, etc.) reference this document.
 ## Session Startup
 
 1. Read `0-AI-MANIFEST.a2ml` FIRST (mandatory gatekeeper).
-2. Read `.machine_readable/STATE.a2ml` for current status and blockers.
+2. Read `.machine_readable/6a2/STATE.a2ml` for current status and blockers.
 3. Read `.machine_readable/anchors/ANCHOR.a2ml` for canonical authority boundaries.
 4. Read `.machine_readable/policies/MAINTENANCE-AXES.a2ml` for maintenance/audit sequencing.
 5. Read `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` for baseline controls.
@@ -80,7 +80,7 @@ Use `just` (Justfile) for all build, test, lint, and format tasks.
 
 - `0-AI-MANIFEST.a2ml` -- universal AI entry point
 - `.machine_readable/AGENTIC.a2ml` -- agent permissions and constraints
-- `.machine_readable/STATE.a2ml` -- current project state
+- `.machine_readable/6a2/STATE.a2ml` -- current project state
 - `.machine_readable/anchors/ANCHOR.a2ml` -- canonical authority and policy boundary
 - `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -- canonical axis sequencing and audit requirements
 - `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -- baseline maintenance checklist policy