feat: initialize session-sentinel — multi-AI session health monitor

AffineScript core logic with affine types and effects for storage
scanning, health zone classification (green/yellow/red/purple),
self-healing engine, diagnostics, and multi-AI provider detection.

Idris2 ABI with dependent type proofs for health state machine
transitions, monitor protocol, and PanLL panel communication.

Zig FFI for KDE StatusNotifierItem system tray, DBus integration,
dynamic SVG icon generation, and systemd watchdog with fault
tolerance (degraded/failed states, exponential backoff recovery).

Supports Claude, Copilot, Ollama, LM Studio, Continue.dev, Cursor,
Aider — extensible via TOML config for any AI tool. Starts on boot
via systemd user service with resource limits and security hardening.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.devcontainer/Containerfile

@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# Dev Container image for Session Sentinel
+# Base: Chainguard Wolfi (minimal, supply-chain-secure)
+# Build: podman build -t Session Sentinel-dev -f .devcontainer/Containerfile .
+
+FROM cgr.dev/chainguard/wolfi-base:latest
+
+# Install common development tools
+RUN apk update && apk add --no-cache \
+    bash \
+    curl \
+    git \
+    openssh-client \
+    ca-certificates \
+    build-base \
+    posix-libc-utils \
+    shadow \
+    && rm -rf /var/cache/apk/*
+
+# Create non-root dev user (matches devcontainer.json remoteUser)
+RUN groupadd -g 1000 nonroot || true \
+    && useradd -m -u 1000 -g 1000 -s /bin/bash nonroot || true
+
+# Set workspace directory
+WORKDIR /workspaces/Session Sentinel
+
+# Default shell
+ENV SHELL=/bin/bash
+
+USER nonroot

.devcontainer/README.adoc

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+= Dev Container Usage
+:author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+
+== Overview
+
+This dev container uses `cgr.dev/chainguard/wolfi-base` with git, curl, bash, and just pre-installed. Dev container features add git, just, and nickel automatically.
+
+== VS Code (Local)
+
+. Install the *Dev Containers* extension (`ms-vscode-remote.remote-containers`).
+. Set `dev.containers.dockerPath` to `podman` in VS Code settings.
+. Open the repo folder, then choose **Reopen in Container** from the command palette.
+
+== GitHub Codespaces
+
+. From the repository on GitHub, click **Code > Codespaces > New codespace**.
+. The container builds automatically from this configuration.
+
+== Gitpod
+
+. Prefix the repo URL with `https://gitpod.io/#` to launch a workspace.
+. Gitpod reads `devcontainer.json` and builds the environment.
+
+== Customization
+
+Replace `Session Sentinel` placeholders in both `devcontainer.json` and `Containerfile` with your actual project name. Run `just deps` to verify the environment after first launch.

.devcontainer/devcontainer.json

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+//
+// Dev Container configuration for Session Sentinel
+// Works with: VS Code Dev Containers, GitHub Codespaces, Gitpod
+// Container runtime: Podman (recommended) or any OCI-compliant runtime
+{
+  "name": "Session Sentinel",
+
+  "build": {
+    "dockerfile": "Containerfile",
+    "context": ".."
+  },
+
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {
+      "ppa": false,
+      "version": "latest"
+    },
+    "ghcr.io/jdx/devcontainer-features/just:1": {},
+    "ghcr.io/nickel-lang/devcontainer-feature:0": {}
+  },
+
+  "postCreateCommand": "just deps",
+
+  "remoteUser": "nonroot",
+
+  "containerEnv": {
+    "EDITOR": "code --wait",
+    "LANG": "C.UTF-8"
+  },
+
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "EditorConfig.EditorConfig",
+        "eamodio.gitlens",
+        "streetsidesoftware.code-spell-checker",
+        "timonwong.shellcheck",
+        "tamasfe.even-better-toml",
+        "skellock.just",
+        "redhat.vscode-yaml",
+        "DavidAnson.vscode-markdownlint",
+        "asciidoctor.asciidoctor-vscode",
+        "usernamehw.errorlens"
+      ],
+      "settings": {
+        "editor.formatOnSave": true,
+        "editor.insertSpaces": true,
+        "editor.tabSize": 2,
+        "files.trimTrailingWhitespace": true,
+        "files.insertFinalNewline": true,
+        "files.trimFinalNewlines": true,
+        "[makefile]": {
+          "editor.insertSpaces": false
+        }
+      }
+    },
+    "codespaces": {
+      "openFiles": [
+        "README.adoc"
+      ]
+    }
+  },
+
+  "forwardPorts": [],
+
+  "shutdownAction": "stopContainer"
+}

.editorconfig

@@ -0,0 +1,65 @@
+# RSR-template-repo - Editor Configuration
+# https://editorconfig.org
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.adoc]
+trim_trailing_whitespace = false
+
+[*.rs]
+indent_size = 4
+
+[*.ex]
+indent_size = 2
+
+[*.exs]
+indent_size = 2
+
+[*.zig]
+indent_size = 4
+
+[*.ada]
+indent_size = 3
+
+[*.adb]
+indent_size = 3
+
+[*.ads]
+indent_size = 3
+
+[*.hs]
+indent_size = 2
+
+[*.res]
+indent_size = 2
+
+[*.resi]
+indent_size = 2
+
+[*.ncl]
+indent_size = 2
+
+[*.rkt]
+indent_size = 2
+
+[*.scm]
+indent_size = 2
+
+[*.nix]
+indent_size = 2
+
+[Justfile]
+indent_style = space
+indent_size = 4
+

.envrc

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Activate development environment
+# Install direnv: https://direnv.net/
+
+# Load .tool-versions if asdf is available
+if has asdf; then
+  use asdf
+fi
+
+# Load Guix shell if guix.scm exists
+if has guix && [ -f guix.scm ]; then
+  use guix
+fi
+
+# Load Nix flake if flake.nix exists
+if has nix && [ -f flake.nix ]; then
+  use flake
+fi
+
+# Project environment variables
+export PROJECT_NAME="Session Sentinel"
+export RSR_TIER="infrastructure"
+# export DATABASE_URL="..."
+# export API_KEY="..."
+
+# Source .env if it exists (gitignored)
+dotenv_if_exists

.gitattributes

@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# RSR-compliant .gitattributes
+
+* text=auto eol=lf
+
+# Source
+*.rs    text eol=lf diff=rust
+*.ex    text eol=lf diff=elixir
+*.exs   text eol=lf diff=elixir
+*.jl    text eol=lf
+*.res   text eol=lf
+*.resi  text eol=lf
+*.ada   text eol=lf diff=ada
+*.adb   text eol=lf diff=ada
+*.ads   text eol=lf diff=ada
+*.hs    text eol=lf
+*.chpl  text eol=lf
+*.scm   text eol=lf
+*.a2ml  text eol=lf linguist-language=TOML
+*.ncl   text eol=lf
+*.nix   text eol=lf
+
+# Docs
+*.md    text eol=lf diff=markdown
+*.adoc  text eol=lf
+*.txt   text eol=lf
+
+# Data
+*.json  text eol=lf
+*.yaml  text eol=lf
+*.yml   text eol=lf
+*.toml  text eol=lf
+
+# Config
+.gitignore     text eol=lf
+.gitattributes text eol=lf
+Justfile       text eol=lf
+Makefile       text eol=lf
+Containerfile  text eol=lf
+
+# Scripts
+*.sh   text eol=lf
+
+# Binary
+*.png   binary
+*.jpg   binary
+*.gif   binary
+*.pdf   binary
+*.woff2 binary
+*.zip   binary
+*.gz    binary
+
+# Lock files
+Cargo.lock  text eol=lf -diff
+flake.lock  text eol=lf -diff

.github/.mailmap

@@ -0,0 +1 @@
+Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> <6759885+hyperpolymath@users.noreply.github.com>

.github/.nojekyll

@@ -0,0 +1 @@
+# AI Manifest - Level 1: .github

.github/0.1-AI-MANIFEST.a2ml

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# CODEOWNERS - Define code review assignments
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+#
+# Replace hyperpolymath with your GitHub username or team
+
+# Default owners for everything
+* @hyperpolymath
+
+# Security-sensitive files require explicit review
+SECURITY.md @hyperpolymath
+.github/workflows/ @hyperpolymath
+Trustfile.a2ml @hyperpolymath
+.machine_readable/ @hyperpolymath