prune: remove Svalinn/ATS2 identity-crisis — repo now scoped to RGTV only

Context: this repo was originally Svalinn Vault (PQC password manager), then
pivoted to RGTV (LLM-agent credential broker) without pruning the old code
or updating docs. Review on 2026-04-17 found:

- `vault-core/` contained FAKE Ed448 signatures at crypto.rs:280-316 (a
  BLAKE3 hash chain labelled as signatures). Never imported by working
  crates; a timebomb for anyone who assumed the name meant the thing.
- `vault-core/` did not compile (33 rustc errors).
- `vault-core-ats/` was ~1,700 LOC of ATS2, a language the estate has
  explicitly rejected.
- README.adoc/SECURITY.adoc claimed "Formally Verified" + "Post-Quantum
  Secure" — neither was true of any shipping code.
- ~80% of top-level directories (honeypot, validation, network, site,
  ada-cli, asterisk-integration, terraform-provider-svalinn, etc.) were
  aspirational Svalinn scaffolding that never shipped.

Deletions (24,243 lines):
- Rust: vault-core/ vault-interface/ (+ ATS2: vault-core-ats/)
- Aspirational subsystems: honeypot/ validation/ network/ site/
  database/ security/ ffi/ src/ vexometer/
- Svalinn infra: ada-cli/ ansible-collection-svalinn/
  asterisk-integration/ terraform-provider-svalinn/
- Stale docs: PROJECT-SUMMARY.md DEPLOYMENT-CHECKLIST.md ROADMAP.adoc
  TECHSTACK.adoc USERMEMORY.scm TOPOLOGY.md QUICKSTART-*.adoc
  llm-warmup-*.md docs/DEPLOYMENT-GUIDE.md docs/TSDM-ASSESSMENT.md
  docs/wikidata/ docs/whitepaper/svalinn-vault.tex
- Obsolete operational files: config.nickel Mustfile packaging/ (all)
  container/ .github/workflows/{ci,nightly,release}.yml
  config/backup-config.nickel config/mfa-config.nickel

Renames:
- svalinn-cli/ → rgtv-cli/ (crate and binary already named `rgtv`)

Rewrites:
- README.adoc: describes the actual LLM-broker product; adds a prominent
  NOT-FOR-PRODUCTION banner listing the 7 blockers from STATE.a2ml.
- SECURITY.adoc: fresh threat model — defends against LLM context-window
  leakage; honest list of what RGTV does NOT defend against.
- TEST-NEEDS.md: drops post-prune CRG D grade (zero tests in shipping
  code); lists the six minimum-viable broker test cases.
- flake.nix, guix.scm: minimal RGTV-only packages.
- .github/dependabot.yml, CODEOWNERS: target the surviving three crates.
- .github/workflows/rust-ci.yml: new minimal Rust CI replacing the
  ATS-heavy ci/nightly/release workflows.

Legitimate historical refs retained:
- README.adoc + SECURITY.adoc + guix.scm note the old Svalinn brand.
- 0-AI-MANIFEST.a2ml keeps the Svalinn/Rokur disambiguation (three
  distinct projects with confusable names).
- STATE.a2ml + META.a2ml keep timeline/ADR entries for the svalinn_cli
  → rgtv rename.

cargo check passes on vault-broker and rgtv-cli.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.githooks/pre-commit

@@ -12,7 +12,7 @@ YELLOW='\033[1;33m'
 NC='\033[0m'
 
 echo "╔══════════════════════════════════════════════════════════════╗"
-echo "║           SVALINN VAULT PRE-COMMIT VALIDATION                ║"
+echo "║           RGTV PRE-COMMIT VALIDATION                ║"
 echo "╚══════════════════════════════════════════════════════════════╝"
 
 # ===========================================================================

.githooks/pre-push

@@ -12,7 +12,7 @@ YELLOW='\033[1;33m'
 NC='\033[0m'
 
 echo "╔══════════════════════════════════════════════════════════════╗"
-echo "║           SVALINN VAULT PRE-PUSH VALIDATION                  ║"
+echo "║           RGTV PRE-PUSH VALIDATION                  ║"
 echo "╚══════════════════════════════════════════════════════════════╝"
 
 # Get remote and branch
@@ -53,25 +53,20 @@ do
     echo -e "${GREEN}PASS${NC}"
 
     # ===========================================================================
-    # Run tests
+    # Run Rust tests (vault-broker + rgtv-cli)
     # ===========================================================================
     echo -n "Running tests... "
-    if [ -d "vault-core-ats" ]; then
-        if command -v zig &> /dev/null; then
-            cd vault-core-ats
-            if zig build test 2>/dev/null; then
-                echo -e "${GREEN}PASS${NC}"
-            else
-                echo -e "${RED}FAIL${NC}"
-                echo "Tests failed. Fix before pushing."
-                exit 1
-            fi
-            cd ..
+    if command -v cargo &> /dev/null; then
+        if (cd vault-broker && cargo test --quiet 2>/dev/null) && \
+           (cd rgtv-cli && cargo test --quiet 2>/dev/null); then
+            echo -e "${GREEN}PASS${NC}"
         else
-            echo -e "${YELLOW}SKIP${NC} (zig not installed)"
+            echo -e "${RED}FAIL${NC}"
+            echo "Tests failed. Fix before pushing."
+            exit 1
         fi
     else
-        echo -e "${YELLOW}SKIP${NC} (no vault-core-ats)"
+        echo -e "${YELLOW}SKIP${NC} (cargo not installed)"
     fi
 
     # ===========================================================================

.github/CODEOWNERS

@@ -1,25 +1,21 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-# SPDX-FileCopyrightText: 2025 Hyperpolymath
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 #
-# CODEOWNERS - Require review for all changes
+# CODEOWNERS - Require review for all changes.
 
 # Default: require maintainer review for everything
 * @hyperpolymath
 
-# Security-critical files require additional security team review
-/vault-core/src/crypto.rs @hyperpolymath @security-team
-/vault-core/src/auth_protection.rs @hyperpolymath @security-team
-/vault-core/src/mfa.rs @hyperpolymath @security-team
-/vault-core/src/primes.rs @hyperpolymath @security-team
-/security/ @hyperpolymath @security-team
-/container/config/selinux/ @hyperpolymath @security-team
-/container/config/firewalld/ @hyperpolymath @security-team
+# Security-critical paths — reviewer must read SECURITY.adoc before approving.
+/vault-broker/src/    @hyperpolymath
+/vault-worker/src/    @hyperpolymath
+/rgtv-cli/src/        @hyperpolymath
 
 # Configuration files
-/.github/ @hyperpolymath
-/flake.nix @hyperpolymath
-/guix.scm @hyperpolymath
+/.github/             @hyperpolymath
+/flake.nix            @hyperpolymath
+/guix.scm             @hyperpolymath
 
 # License files
-/LICENSES/ @hyperpolymath
-/LICENSE* @hyperpolymath
+/LICENSES/            @hyperpolymath
+/LICENSE*             @hyperpolymath

.github/SECURITY.md

@@ -104,6 +104,6 @@ All releases are signed and include SHA-256 checksums:
 
 ```bash
 # Verify release
-sha256sum -c svalinn-vault-0.1.0.sha256
-gpg --verify svalinn-vault-0.1.0.sig svalinn-vault-0.1.0.tar.gz
+sha256sum -c rgtv-vault-0.1.0.sha256
+gpg --verify rgtv-vault-0.1.0.sig rgtv-vault-0.1.0.tar.gz
 ```

.github/dependabot.yml

@@ -8,29 +8,46 @@
 
 version: 2
 updates:
-  # Rust dependencies - vault-core
+  # Rust dependencies — vault-broker
   - package-ecosystem: "cargo"
-    directory: "/vault-core"
+    directory: "/vault-broker"
     schedule:
       interval: "daily"
-      time: "06:00"
-      timezone: "UTC"
-    open-pull-requests-limit: 20
+    open-pull-requests-limit: 10
     reviewers:
       - "hyperpolymath"
-    labels:
-      - "dependencies"
-      - "security"
-      - "rust"
+    labels: ["dependencies", "security", "rust"]
     commit-message:
       prefix: "chore(deps)"
       include: "scope"
-    # Alert on ALL updates including patch
-    # Do NOT ignore any versions
     groups:
-      rust-all:
-        patterns:
-          - "*"
+      rust-all: { patterns: ["*"] }
+
+  # Rust dependencies — vault-worker
+  - package-ecosystem: "cargo"
+    directory: "/vault-worker"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+    reviewers:
+      - "hyperpolymath"
+    labels: ["dependencies", "security", "rust", "wasm"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+
+  # Rust dependencies — rgtv-cli
+  - package-ecosystem: "cargo"
+    directory: "/rgtv-cli"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+    reviewers:
+      - "hyperpolymath"
+    labels: ["dependencies", "security", "rust"]
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
 
   # GitHub Actions - critical for CI security
   - package-ecosystem: "github-actions"

.github/settings.yml

@@ -8,7 +8,7 @@
 
 repository:
   name: reasonable-good-token-vault
-  description: "Svalinn Secure Identity Vault - Post-quantum cryptography for SSH/PGP/PAT/API credentials"
+  description: "RGTV — one-use credential broker for LLM agents (alpha, not for production)"
   homepage: https://hyperpolymath.github.io/reasonable-good-token-vault
   private: false
   has_issues: true