refactor: de-vendor foreign services and retire claim-forge + cicd-hyper-a

.github/workflows/trust-pipeline-e2e.yml

@@ -1,9 +1,9 @@
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
-# Enterprise trust pipeline — live-service E2E tests.
+# Trust pipeline — live-service E2E tests.
 #
-# Pulls all 5 trust-tier service images from GHCR (public, no auth required),
+# Pulls the trust-tier service images from GHCR (public, no auth required),
 # starts them via selur-compose.yml, waits for health checks, then runs the
 # :live_service E2E suite against the real HTTP endpoints.
 #
@@ -65,28 +65,22 @@ jobs:
         # -----------------------------------------------------------------------
 
         run: |
-          docker pull ghcr.io/hyperpolymath/claim-forge:latest
           docker pull ghcr.io/hyperpolymath/checky-monkey:latest
           docker pull ghcr.io/hyperpolymath/palimpsest-license:latest
-          docker pull ghcr.io/hyperpolymath/cicd-hyper-a:latest
           docker pull ghcr.io/hyperpolymath/oikos:latest
-      - name: Start trust pipeline (claim-forge, checky-monkey, palimpsest, cicd-hyper-a, oikos)
+      - name: Start trust pipeline (checky-monkey, palimpsest, oikos)
         run: |
-          # Start only the 5 trust-tier services (not the optional container-security profile)
+          # Start only the trust-tier services (not the optional container-security profile)
           docker compose -f selur-compose.yml up -d \
-            claim-forge \
             checky-monkey \
             palimpsest \
-            cicd-hyper-a \
             oikos
       - name: Wait for all services to be healthy
         # Polls each /health endpoint; aborts if any service fails to start within 3 minutes
         run: |
           services=(
-            "http://localhost:8080/health:claim-forge"
             "http://localhost:8081/health:checky-monkey"
             "http://localhost:8082/health:palimpsest"
-            "http://localhost:8083/health:cicd-hyper-a"
             "http://localhost:8084/health:oikos"
           )
           deadline=$(( $(date +%s) + 180 ))
@@ -111,10 +105,8 @@ jobs:
       - name: Run trust pipeline E2E tests
         working-directory: opsm_ex
         env:
-          CLAIM_FORGE_URL: "http://localhost:8080"
           CHECKY_MONKEY_URL: "http://localhost:8081"
           PALIMPSEST_URL: "http://localhost:8082"
-          CICD_HYPER_A_URL: "http://localhost:8083"
           OIKOS_URL: "http://localhost:8084"
           MIX_ENV: test
         run: |
@@ -129,7 +121,7 @@ jobs:
       - name: Dump service logs on failure
         if: failure()
         run: |
-          for svc in claim-forge checky-monkey palimpsest cicd-hyper-a oikos; do
+          for svc in checky-monkey palimpsest oikos; do
             echo "=== $svc logs ==="
             docker compose -f selur-compose.yml logs "$svc" --tail=50 || true
           done

.machine_readable/6a2/ECOSYSTEM.a2ml

@@ -21,12 +21,6 @@ name = "nextgen-databases"
 relationship = "consumer"
 description = "Consumes OPSM workspace operations and custom forth adapters for database toolchain packages."
 
-[[related-projects.co-located-service]]
-name = "claim-forge"
-relationship = "sibling-service"
-location = "services/claim-forge"
-description = "Trust-pipeline service; verifies claim provenance. Co-located in services/."
-
 [[related-projects.co-located-service]]
 name = "checky-monkey"
 relationship = "sibling-service"
@@ -39,12 +33,6 @@ relationship = "sibling-service"
 location = "services/palimpsest"
 description = "Trust-pipeline service; licence compliance verification. Co-located in services/."
 
-[[related-projects.co-located-service]]
-name = "cicd-hyper-a"
-relationship = "sibling-service"
-location = "services/cicd-hyper-a"
-description = "Trust-pipeline service; CI/CD orchestration helper. Co-located in services/."
-
 [[related-projects.co-located-service]]
 name = "oikos"
 relationship = "sibling-service"

.machine_readable/6a2/META.a2ml

@@ -55,8 +55,8 @@ status = "accepted"
 title = "rustls-tls over native-tls in all Rust services"
 decision = """
 Switch all reqwest TLS backend selections from native-tls (openssl-sys) to
-rustls-tls across all Rust services in the project (claim-forge, opsm_mobile,
-selur, svalinn, vordr, cerro-torre, and any future Rust crates).
+rustls-tls across all Rust services in the project (opsm_mobile,
+selur, svalinn, vordr, and any future Rust crates).
 """
 rationale = """
 openssl-sys requires a C toolchain and platform OpenSSL headers, creating

.machine_readable/6a2/STATE.a2ml

@@ -95,17 +95,14 @@ runtime-layout = "~/.opsm/runtimes/<tool>/<version>/ + .active pin file"
 - nif-build.yml: CI workflow that compiles opsm_pq_nif + runs :requires_nif tests ✅
 - test/opsm/wiring/audit_test.exs: 12 tests for Wiring.run_audit/2 + workspace TOML parsing ✅
 - test/opsm/registries/language_adapters_test.exs: +18 tests for Registry dispatch dispatch ✅
-- All 9 service images live in GHCR (CI run 24929720837 = 100% success):
-    ghcr.io/hyperpolymath/claim-forge:latest ✅
+- All 6 service images live in GHCR (CI run 24929720837 = 100% success):
     ghcr.io/hyperpolymath/checky-monkey:latest ✅
     ghcr.io/hyperpolymath/palimpsest-license:latest ✅
-    ghcr.io/hyperpolymath/cicd-hyper-a:latest ✅
     ghcr.io/hyperpolymath/oikos:latest ✅
     ghcr.io/hyperpolymath/selur:latest ✅
     ghcr.io/hyperpolymath/svalinn:latest ✅
     ghcr.io/hyperpolymath/vordr:latest ✅
-    ghcr.io/hyperpolymath/cerro-torre:latest ✅
-- rustls-tls switch: selur, svalinn, vordr, cerro-torre — Dependabot vulns 33→13 ✅
+- rustls-tls switch: selur, svalinn, vordr — Dependabot vulns 33→13 ✅
 - Containerfile fixes: removed unavailable APK packages (afl++/libfuzzer, falco/bpftrace, opa) ✅
 
 [completed-2026-04-25d]
@@ -118,8 +115,8 @@ runtime-layout = "~/.opsm/runtimes/<tool>/<version>/ + .active pin file"
 - Test suite: 814 tests (e2e+integration included), 2 pre-existing failures, 0 new failures ✅
 
 [completed-2026-04-25e]
-- rustls-tls switch: claim-forge dev-dep reqwest + opsm_mobile reqwest 0.11→0.12+rustls-tls ✅
-- Regenerated Cargo.lock for claim-forge + opsm_mobile: openssl removed from both ✅
+- rustls-tls switch: opsm_mobile reqwest 0.11→0.12+rustls-tls ✅
+- Regenerated Cargo.lock for opsm_mobile: openssl removed ✅
 - Dependabot vulns: 13 → 1 (10 openssl HIGH/LOW gone; 2 rand LOW gone/stale; glib MODERATE remains) ✅
 - glib 0.18.5 BLOCKED: tauri 2.10.3 (latest) still pulls glib 0.18.5; unfixable at consumer level;
   fix blocked on tauri upstream GTK-rs 0.20 migration
@@ -160,15 +157,15 @@ evidence-file = "READINESS.md"
 
 [completed-2026-04-25g]
 - Trust pipeline live-service E2E test: test/integration/trust_pipeline_live_e2e_test.exs ✅
-  - 23 tests across 7 describes: health (5), attestation (4), checky-monkey (4),
-    palimpsest (5), cicd-hyper-a (4), oikos (2), full pipeline (3)
+  - 19 tests across 5 describes: health (5), checky-monkey (4),
+    palimpsest (5), oikos (2), full pipeline (3)
   - Direct HTTP via Req (no Opsm.Clients.* wrapper) — tests real HTTP contract
   - @moduletag :live_service excluded from default run; included in trust-pipeline-e2e.yml
   - :live_service added to test_helper.exs exclusion list
 - .github/workflows/trust-pipeline-e2e.yml ✅
   - Triggers: workflow_dispatch + push to main on service/test/compose changes
   - SHA-pinned actions: checkout (v6.0.2), erlef/setup-beam, actions/cache (v4)
-  - docker compose up -d claim-forge checky-monkey palimpsest cicd-hyper-a oikos
+  - docker compose up -d checky-monkey palimpsest oikos
   - Health poll loop (180s deadline, 3s interval) before running tests
   - Full diagnostics (service logs) on failure; docker compose down always
 

.well-known/groove/manifest.json

@@ -34,10 +34,8 @@
     "registry_gateway": 4050,
     "mobile_api": 4051,
     "verisimdb": 6077,
-    "claim_forge": 7001,
     "checky_monkey": 7002,
     "palimpsest_license": 7003,
-    "cicd_hyper_a": 7004,
     "oikos": 7005
   },
   "ipc": {

CHARTER.adoc

@@ -12,7 +12,7 @@ OPSM exists to deliver a federated, multi-language package manager with formal v
 The stewardship council safeguards:
 
 - Verification integrity (proven/Idris2)
-- Trust pipeline correctness (checky-monkey, claim-forge, palimpsest-license)
+- Trust pipeline correctness (checky-monkey, palimpsest-license)
 - Federation neutrality (git-private-farm + Radicle + IPFS)
 - Long-term sustainability (oikos-driven dependency health)
 

EXPLAINME.adoc

@@ -14,11 +14,11 @@ The README makes claims. This file backs them up.
 
 *Evidence:* The registry adapters live in `opsm_ex/lib/opsm/registries/` with 8 core implementations (npm, Hex, Crates, PyPI, Nimble, Idris2, git, agentic) and 93 additional adapters reachable via plugin architecture. Each adapter implements the `RegistryAdapter` callback module with `search/1`, `fetch_package/3`, and `fetch_dependencies/3`. The PubGrub resolver at `opsm_ex/lib/opsm/resolver.ex` handles language-specific version constraint semantics: Semver (npm, Hex, Crates), PEP 440 (PyPI), Go MVS (Go modules), etc. ETS caching at `opsm_ex/lib/opsm/registry_cache.ex` provides TTL-based performance. The test suite at `opsm_ex/test/opsm/resolver_test.exs` validates resolution across mixed-language dependency trees. **Caveat:** Not all 101 adapters are fully tested in CI; community adapters may vary in maturity.
 
-=== Claim 2: Trust Pipeline with 5 Microservices and Post-Quantum Cryptography (Rust NIF)
+=== Claim 2: Trust Pipeline with 3 Microservices and Post-Quantum Cryptography (Rust NIF)
 
-*From README:* "Trust Pipeline: 5-microservice verification (claim-forge, checky-monkey, palimpsest-license, oikos, cicd-hyper-a)... Post-quantum cryptography (Hybrid Ed25519+Dilithium5 signatures, Kyber-1024 KEM, SPHINCS+) (Rust NIF)."
+*From README:* "Trust Pipeline: multi-microservice verification (checky-monkey, palimpsest-license, oikos)... Post-quantum cryptography (Hybrid Ed25519+Dilithium5 signatures, Kyber-1024 KEM, SPHINCS+) (Rust NIF)."
 
-*Evidence:* Every `opsm publish` traverses a 5-stage pipeline: (1) claim-forge generates SLSA attestations at `opsm_ex/lib/opsm/clients/claim_forge.ex`; (2) checky-monkey verifies package integrity with async polling; (3) palimpsest-license checks license compatibility; (4) oikos scores sustainability (8 dimensions); (5) cicd-hyper-a publishes and federates. The post-quantum NIF at `opsm_ex/native/opsm_pq_nif/src/lib.rs` implements Dilithium5 signatures, Kyber-1024 key encapsulation, and SPHINCS+ hashing. The NIF includes a real availability probe and persistent_term caching for performance. Tests at `opsm_ex/test/opsm/verified_test.exs` (40 property-based tests) verify that SSRF is blocked and JSON size/depth limits are enforced. **Caveat:** Post-quantum cryptography is still actively researched; Dilithium5 and Kyber-1024 are NIST finalists but not yet standardized.
+*Evidence:* Every `opsm publish` traverses a 3-stage trust pipeline: (1) checky-monkey verifies package integrity with async polling at `opsm_ex/lib/opsm/clients/checky_monkey.ex`; (2) palimpsest-license checks license compatibility; (3) oikos scores sustainability (8 dimensions). The post-quantum NIF at `opsm_ex/native/opsm_pq_nif/src/lib.rs` implements Dilithium5 signatures, Kyber-1024 key encapsulation, and SPHINCS+ hashing. The NIF includes a real availability probe and persistent_term caching for performance. Tests at `opsm_ex/test/opsm/verified_test.exs` (40 property-based tests) verify that SSRF is blocked and JSON size/depth limits are enforced. **Caveat:** Post-quantum cryptography is still actively researched; Dilithium5 and Kyber-1024 are NIST finalists but not yet standardized.
 
 === Claim 3: 547 Core Tests, 40 Property Tests, 49 Integration Tests with Formal Verification
 
@@ -49,7 +49,7 @@ OPSM is continuously checked by the gitbot-fleet:
 - https://github.com/hyperpolymath/seambot[seambot] — Integration testing
 - https://github.com/hyperpolymath/finishbot[finishbot] — Release readiness
 
-Trust services (claim-forge, checky-monkey, palimpsest-license, oikos, cicd-hyper-a) are shared across all hyperpolymath package publishing workflows.
+Trust services (checky-monkey, palimpsest-license, oikos) are shared across all hyperpolymath package publishing workflows.
 
 == File Map
 
@@ -63,15 +63,14 @@ Trust services (claim-forge, checky-monkey, palimpsest-license, oikos, cicd-hype
 | `opsm_ex/lib/opsm/lockfile.ex` | Lockfile management (read/write)
 | `opsm_ex/lib/opsm/verified.ex` | Security guarantees: URL validation, JSON DoS prevention
 | `opsm_ex/lib/opsm/registries/` | 8 core registry adapters (npm, Hex, Crates, PyPI, Nimble, Idris2, git, agentic)
-| `opsm_ex/lib/opsm/clients/` | Trust service clients (claim-forge, checky-monkey, palimpsest, oikos, cicd-hyper-a)
+| `opsm_ex/lib/opsm/clients/` | Trust service clients (checky-monkey, palimpsest, oikos)
 | `opsm_ex/lib/opsm/crypto/post_quantum.ex` | PQ NIF wrapper with probe and caching
 | `opsm_ex/native/opsm_pq_nif/src/lib.rs` | Rust NIF: Dilithium5, Kyber-1024, SPHINCS+
 | `opsm_ex/test/opsm/` | 547 core tests (resolver, constraints, lockfile, verified)
 | `opsm_ex/test/integration/` | 49 integration tests (trust pipeline, E2E)
 | `services/svalinn/` | Vulnerability scanning (Trivy + Grype)
 | `services/selur/` | Image signing (Cosign + Ed25519)
 | `services/vordr/` | Policy verification (OPA)
-| `services/cerro-torre/` | Security monitoring (Falco + eBPF)
 | `scripts/har-agents/` | HAR discovery agents (GitHub search, web scraper, mirror finder)
 | `docs/v2.0-PLAN.md` | Roadmap and feature specifications
 |===

READINESS.md

@@ -37,7 +37,7 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 - `[runtime]` section: elixir 1.16.0, erlang 26.2.0, just, deno 2.6.10, zig 0.14.0 — all managed by OPSM runtime extension (replaces `.tool-versions`)
 - `[package]` section: OPSM itself as a first-class HFR package (`forth = "elixir"`, `self_hosted = true`)
 - `[opsm]` trust config: `trust_level = "hyperpolymath"`, `registry = "hf"`
-- Trust pipeline service endpoints: claim-forge/checky-monkey/palimpsest-license/cicd-hyper-a/oikos all configured in same file
+- Trust pipeline service endpoints: checky-monkey/palimpsest-license/oikos all configured in same file
 
 **Test coverage:** `opsm runtime install --from-manifest` (live_download tag), self-managed HFR metadata via `hfr_test.exs`
 
@@ -100,7 +100,7 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 - `role = "dogfood-wave-1"` — first wave of external dogfooding
 - `[telemetry] enabled = false` — telemetry opt-out tested
 
-**Distinguishing factor:** exercises OPSM strict policy mode + pathroot routing, which most other targets do not. The strict policy surfaces any permissiveness bugs in the trust pipeline integration; `allow_untrusted = false` forces all packages through the full claim-forge/checky-monkey chain.
+**Distinguishing factor:** exercises OPSM strict policy mode + pathroot routing, which most other targets do not. The strict policy surfaces any permissiveness bugs in the trust pipeline integration; `allow_untrusted = false` forces all packages through the full palimpsest-license/checky-monkey chain.
 
 ---