feat(rsr): scaffold lifecycle canon, archetype presets, oracle-aligned profile checker (#515)

## What

The normative half of the once-and-for-all scaffolding resolution
(companion: rsr-template-repo PR #2, ADR-0003).

- **`spec/SCAFFOLD-LIFECYCLE.adoc`** — the lifecycle canon: Forge (mint
→ provision → configure → harness) with per-stage MUST exit criteria,
Sustain (corrective / adaptive / perfective / preventive) with the
owning tool for each, the roles table (canon / spine / composer / oracle
/ fleet), the provenance requirement (the estate's Copier-answer-file
equivalent, in the ADR-0002 contract shape), and autonomy boundaries
(unattended read-only vs owner-gated mutation vs never-automated).
- **`template-capability-gates.toml` 0.1.0 → 0.2.0** (additive MINOR per
its own versioning rules): new capability `plugin`; presets
`julia-library`, `wordpress-plugin`, `zotero-plugin`, `userscript`.
- **`check-rsr-profile.sh`** — now accepts the `[rsr-profile]` section
name and multi-line capability arrays. The normative oracle (hypatia
`RsrConformance.load_capabilities/1`) accepts both; the reference
checker was stricter than the oracle and errored on the very profile
rsr-template-repo ships. Canary-tested: template profile parses (real
findings now reported), undeclared profile still exits 2, preset form
resolves.
- **`REPO-STANDARD-MUST-INTEND-LIKE.adoc`** relocated from
rsr-julia-library-template-repo (explicitly language-agnostic; was
misfiled in the Julia variant). Variant-side retirement is a follow-up
there.

## Honest findings surfaced (not fixed here)

Running the fixed checker against rsr-template-repo reports 5 genuine
profile↔tree mismatches (e.g. `Containerfile` at root missing while
`container` declared, `release.yml` present without
`published-package`). Pre-existing template debt, now visible instead of
hidden behind a parse error.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/template-capability-gates.toml

@@ -10,12 +10,16 @@
 # Arrays are kept single-line so the checker can parse them with grep.
 
 [meta]
-version = "0.1.0"
+version = "0.2.0"
 policy = "TEMPLATE-APPLICABILITY-POLICY.adoc"
 
 [capabilities]
 # Every capability a profile may declare.
-known = ["rust", "zig", "agda", "idris2", "haskell", "gleam", "elixir", "affinescript", "julia", "ocaml", "bash", "cli", "library", "ffi", "abi", "api-service", "formal-proofs", "mobile", "web-ui", "docs-site", "published-package", "container", "reproducible-build", "governance-tier", "benchmarks"]
+# "plugin" = code hosted inside a third-party extension host (WordPress,
+# Zotero, a userscript manager): the host owns the runtime and the packaging
+# rules, so host-mandated files are exempt from the usual language gates the
+# way interop-target bindings are.
+known = ["rust", "zig", "agda", "idris2", "haskell", "gleam", "elixir", "affinescript", "julia", "ocaml", "bash", "cli", "library", "ffi", "abi", "api-service", "formal-proofs", "mobile", "web-ui", "docs-site", "published-package", "container", "reproducible-build", "governance-tier", "benchmarks", "plugin"]
 
 [baseline]
 # Always carried (gate = empty). Globs/dirs allowed; not capability-gated.
@@ -55,3 +59,9 @@ rust-service = ["rust", "api-service", "container", "reproducible-build"]
 formal-proof-lib = ["formal-proofs", "library"]
 docs-site = ["docs-site"]
 affinescript-app = ["affinescript", "web-ui"]
+# Archetype presets (rsr-template-repo archetypes/ carry the matching name;
+# see spec/SCAFFOLD-LIFECYCLE.adoc and rsr-template-repo ADR-0003).
+julia-library = ["julia", "library", "docs-site", "published-package"]
+wordpress-plugin = ["plugin", "web-ui"]
+zotero-plugin = ["plugin"]
+userscript = ["plugin"]

rhodium-standard-repositories/spec/REPO-STANDARD-MUST-INTEND-LIKE.adoc

@@ -0,0 +1,216 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+// Relocated 2026-07-21 from rsr-julia-library-template-repo (its VARIANT.a2ml
+// lists it under paths.added). The document is explicitly language-agnostic
+// and belongs in the canon; the variant-side copy is retired separately.
+= Universal Repo Standard (Must / Intend / Like)
+
+This document is designed as a reusable baseline for *every* repository (Julia and non-Julia).
+It combines dependability, security, accessibility, interoperability, functionality, performance,
+and data/information governance into one operational standard.
+
+Use this as:
+
+* A repo bootstrap checklist
+* A release-readiness checklist
+* A policy reference for CI/CD gates
+
+== Top-Level Principles (Apply To Every Repo)
+
+1. Dependability: deterministic behavior, graceful failure, and observable recovery.
+2. Security: secure-by-default design, supply-chain integrity, least privilege.
+3. Accessibility: inclusive UX and docs, equivalent access to critical workflows.
+4. Interoperability: stable contracts, versioned interfaces, compatibility guarantees.
+5. Functionality: features are complete, correct, and match documented claims.
+6. Performance: measurable baselines, regression protection, explicit budgets.
+7. Data/Information Governance: data classification, minimization, lineage, retention, and deletion controls.
+
+== Minimum Files In Every Repo
+
+Must include:
+
+* `README` (what it does, supported scope, quickstart, known limits)
+* `ROADMAP` (Must/Intend/Like or equivalent staged plan)
+* `CHANGELOG` (user-visible changes and migration impact)
+* `SECURITY.md` (reporting + hardening posture)
+* `LICENSE`
+* `CONTRIBUTING` (workflow and quality gates)
+* `CODEOWNERS` or `MAINTAINERS`
+* CI workflow(s) for test + lint + dependency/security checks
+* Reproducible dependency lock strategy (language-specific)
+* Operational runbook or `docs/ops` for incident response
+
+== MUST (Non-Negotiable Baseline)
+
+=== Dependability
+
+* No silent corruption or "fake" token values for critical outputs.
+* Explicit failure modes and fallback policy per critical path.
+* Health checks and structured diagnostics for runtime paths.
+* Fault counters (errors, fallbacks, recoveries) with alert thresholds.
+* Deterministic CI tests for happy path + failure path + fallback behavior.
+
+=== Security
+
+* Threat model exists and is reviewed periodically.
+* Secrets never committed; managed via secure runtime secret injection.
+* Dependency scanning + SAST + license checks in CI.
+* Signed releases/artifacts where supported.
+* Principle of least privilege for CI, runtime identities, and tokens.
+
+=== Containers And Images (High-Security Ready)
+
+* Pinned base images by digest; avoid floating tags in production.
+* Non-root runtime user; read-only root filesystem when possible.
+* Drop unnecessary Linux capabilities; avoid privileged containers.
+* SBOM generation + vulnerability scanning + policy gate.
+* Image signing and provenance attestation in release pipeline.
+* Explicit runtime constraints (seccomp/AppArmor/SELinux as applicable).
+
+=== Interoperability And API Contracts
+
+* Versioned API/ABI contracts with compatibility expectations.
+* Contract tests for REST/gRPC/GraphQL/FFI boundaries.
+* Backward-compatibility policy and deprecation lifecycle.
+* Clear error taxonomy (retryable vs non-retryable) and status semantics.
+
+=== Functionality And Correctness
+
+* Documentation claims must match tested behavior.
+* Acceptance tests for each "shipped" feature claim.
+* No unresolved critical work markers in production code paths.
+* Release checklist gates must pass before merge/release.
+
+=== Performance
+
+* Baseline benchmarks for critical operations and key backends.
+* Regression thresholds enforced in CI where baselines exist.
+* Performance evidence artifacts retained from CI runs.
+* Resource budgets (latency, memory, CPU, I/O) defined for critical flows.
+
+=== Data/Information Governance
+
+* Data classification policy (public/internal/confidential/restricted).
+* Data minimization and purpose limitation documented.
+* Retention and deletion policy documented and testable.
+* Audit trails for critical decisions and transformations.
+* Encryption requirements for data at rest/in transit documented.
+
+=== Accessibility
+
+* User-facing interfaces meet baseline accessibility criteria.
+* Docs include plain-language quickstarts and operational troubleshooting.
+* Keyboard-only and screen-reader considerations for web UI repos.
+
+== INTEND (Planned, High-Value Next Layer)
+
+=== Dependability
+
+* Circuit breakers and adaptive retry with backoff/jitter.
+* Chaos/fault-injection tests in non-production environments.
+* Automatic quarantine of persistently failing backends/providers.
+* Error budget policy tied to SLOs.
+
+=== Security
+
+* Mandatory security review for high-impact changes.
+* Ephemeral credentials and workload identity adoption.
+* Continuous policy-as-code validation (admission controls, OPA, etc.).
+* Signed commits/tags and stricter branch protection.
+
+=== Containers/Runtime
+
+* Distroless/minimal images for production workloads.
+* Runtime sandboxing for untrusted workloads.
+* Dedicated hardened node pools for sensitive workloads.
+* Provenance verification at deploy time.
+
+=== Interoperability
+
+* Multi-version compatibility test matrix (N-1, N, N+1 where applicable).
+* Golden test vectors for serialization/protocol compatibility.
+* SDK/client conformance tests against reference server behavior.
+
+=== Functionality
+
+* Formalized "definition of done" templates by feature type.
+* Auto-generated API docs from source contracts.
+* Domain-specific invariants/property tests.
+
+=== Performance
+
+* Automated trend dashboards with release-over-release comparisons.
+* Capacity modeling and saturation testing.
+* Hardware-specific tuning profiles validated by CI evidence.
+
+=== Data Governance
+
+* Data lineage map and classification tagging automation.
+* Policy checks that block non-compliant schema/data changes.
+* Differential privacy/redaction controls where needed.
+
+=== Accessibility
+
+* Automated accessibility checks in CI for UI repos.
+* Accessibility issue triage and SLA policy.
+
+== LIKE (Aspirational Or Context-Dependent)
+
+* Formal verification for high-assurance modules.
+* Multi-region active-active resilience for critical services.
+* Reproducible builds with full hermetic toolchains.
+* Runtime self-optimization under strict safety guards.
+* Advanced provenance federation across polyrepo ecosystems.
+* Organizational scorecards across all principles per repo.
+
+== Suggested CI Gates (Portable Template)
+
+Must gates:
+
+* Build + unit/integration tests
+* Contract tests (APIs/ABI/FFI)
+* Failure-mode and fallback tests
+* Lint/style/static checks
+* Vulnerability + license scans
+* Performance regression checks (where baseline exists)
+* Documentation claim alignment checks
+
+Evidence artifacts:
+
+* Test results
+* Security scan reports
+* Benchmark/performance evidence
+* Capability/diagnostic snapshots
+* SBOM + provenance attestations (release)
+
+== Practical Scope Control (To Avoid "Infinite Work")
+
+Apply this in tiers:
+
+1. Tier 1 (immediate): production-critical paths and externally exposed interfaces.
+2. Tier 2 (next): high-usage internal paths and integration boundaries.
+3. Tier 3 (later): low-risk or experimental components.
+
+Do not block all progress on full perfection. Gate by risk and blast radius.
+
+== Policy On Fallback Values
+
+For critical computation and security-sensitive flows:
+
+* Do not substitute dummy/token values silently.
+* Prefer: retry -> alternate backend/path -> explicit failure.
+* Every recovery or degradation event must be observable.
+
+For non-critical optional fields:
+
+* Defaults are acceptable only with clear provenance and policy.
+
+== How To Reuse In Other Repos
+
+Copy this file and then customize:
+
+* Language-specific tooling sections
+* API and data governance specifics
+* Backend matrix and performance budgets
+* Regulatory/compliance requirements
+
+Keep the principle set and Must baseline intact unless a stronger control replaces it.