Merge branch 'main' into dependabot/github_actions/github/codeql-action-4.33.0

Author: hyperpolymath

.claude/CLAUDE.md

@@ -2,12 +2,12 @@
 
 The following files in `.machine_readable/` contain structured project metadata:
 
-- `STATE.scm` - Current project state and progress
-- `META.scm` - Architecture decisions and development practices
-- `ECOSYSTEM.scm` - Position in the ecosystem and related projects
-- `AGENTIC.scm` - AI agent interaction patterns
-- `NEUROSYM.scm` - Neurosymbolic integration config
-- `PLAYBOOK.scm` - Operational runbook
+- `.machine_readable/6a2/STATE.a2ml` - Current project state and progress
+- `.machine_readable/6a2/META.a2ml` - Architecture decisions and development practices
+- `.machine_readable/6a2/ECOSYSTEM.a2ml` - Position in the ecosystem and related projects
+- `.machine_readable/6a2/AGENTIC.a2ml` - AI agent interaction patterns
+- `.machine_readable/6a2/NEUROSYM.a2ml` - Neurosymbolic integration config
+- `.machine_readable/6a2/PLAYBOOK.a2ml` - Operational runbook
 
 ---
 
@@ -28,7 +28,7 @@ The following files in `.machine_readable/` contain structured project metadata:
 | **Bash/POSIX Shell** | Scripts, automation | Keep minimal |
 | **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs |
 | **Nickel** | Configuration language | For complex configs |
-| **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm |
+| **Guile Scheme** | State/meta files | .machine_readable/6a2/STATE.a2ml, .machine_readable/6a2/META.a2ml, .machine_readable/6a2/ECOSYSTEM.a2ml |
 | **Julia** | Batch scripts, data processing | Per RSR |
 | **OCaml** | AffineScript compiler | Language-specific |
 | **Ada** | Safety-critical systems | Where required |

.machine_readable/AGENTIC.a2ml .machine_readable/6a2/AGENTIC.a2ml.machine_readable/AGENTIC.a2ml renamed to .machine_readable/6a2/AGENTIC.a2ml

@@ -0,0 +1,26 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Clade declaration — part of the gv-clade-index registry
+# See: https://github.com/hyperpolymath/gv-clade-index
+
+[identity]
+uuid = "1df0b387-36cc-518e-aba0-09fb8d9c779f"
+primary-forge = "github"
+primary-owner = "hyperpolymath"
+canonical-name = "scripts"
+prefixed-name = "ix-scripts"
+
+[clade]
+primary = "ix"
+secondary = []
+assigned = "2026-03-16"
+rationale = ""
+
+[forges]
+github = "hyperpolymath/scripts"
+gitlab = "hyperpolymath/scripts"
+bitbucket = "hyperpolymath/scripts"
+
+[lineage]
+type = "standalone"
+parent = "General automation scripts"
+born = "2026-03-16"

.machine_readable/ECOSYSTEM.a2ml .machine_readable/6a2/ECOSYSTEM.a2ml.machine_readable/ECOSYSTEM.a2ml renamed to .machine_readable/6a2/ECOSYSTEM.a2ml

@@ -0,0 +1,50 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Trustfile — Integrity and provenance verification
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+
+@abstract:
+Integrity invariants for this repository. These verify that the repo
+has not been tampered with, secrets are not leaked, and provenance
+is traceable.
+@end
+
+## Secrets
+
+### no-secrets-committed
+- description: No credential files in repo
+- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production
+- severity: critical
+
+### no-private-keys
+- description: No private key files committed
+- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ."
+- severity: critical
+
+### no-tokens-in-source
+- description: No hardcoded API tokens in source
+- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ."
+- severity: critical
+
+## Provenance
+
+### author-correct
+- description: Git author matches expected identity
+- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'"
+- severity: warning
+
+### license-content
+- description: LICENSE contains expected identifier
+- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE
+- severity: warning
+
+## Container Security
+
+### container-images-pinned
+- description: Containerfile uses pinned base images
+- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile
+- severity: warning
+
+### no-dockerfile
+- description: No Dockerfile (use Containerfile)
+- run: test ! -f Dockerfile
+- severity: warning