chore: automated sync of local changes

Author: hyperpolymath

contractiles/k9/must-check.k9.ncl

@@ -0,0 +1,49 @@
+K9!
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Repo-local K9 validator required by .machine_readable/MUST.contractile.
+# This file remains data-only and can be consumed by K9 tooling.
+
+{
+  pedigree = {
+    schema_version = "1.0.0",
+    component_type = "must-validator",
+    security = {
+      leash = 'Kennel,
+      trust_level = "data-only",
+      allow_network = false,
+      allow_filesystem_write = false,
+      allow_subprocess = false,
+    },
+    metadata = {
+      name = "must-check",
+      version = "1.0.0",
+      description = "Machine-readable checks for baseline policy and CI contract files.",
+    },
+  },
+
+  validator = {
+    id = "must-check",
+    checks = [
+      {
+        name = "mustfile_present",
+        kind = "path-exists",
+        path = "contractiles/must/Mustfile",
+      },
+      {
+        name = "policy_present",
+        kind = "path-exists",
+        path = "policy/policy.ncl",
+      },
+      {
+        name = "workflow_dir_present",
+        kind = "path-exists",
+        path = ".github/workflows",
+      },
+    ],
+  },
+
+  guidance = [
+    "Run nickel typecheck policy/policy.ncl",
+    "Run repository CI validation before merge",
+  ],
+}

contractiles/must/Mustfile

@@ -20,7 +20,7 @@ checks:
 
   - name: policy-compiles
     description: "policy/policy.ncl must compile."
-    run: "nickel check policy/policy.ncl"
+    run: "nickel typecheck policy/policy.ncl"
 
   - name: gateway-exposes-port
     description: "Service must expose the configured port."

policy/policy.ncl

@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Baseline policy contract consumed by contractiles/must/Mustfile.
+{
+  policy = {
+    version = "1.0.0",
+    enforcement = {
+      require_spdx_headers = true,
+      require_ci_security_checks = true,
+      block_committed_secrets = true,
+      require_pinned_actions = true,
+    },
+    triage = {
+      auto_fix_min_confidence = 0.95,
+      review_min_confidence = 0.85,
+    },
+  },
+}