feat(ux): add onboarding, contractiles, and UX infrastructure

- Purge hardcoded absolute paths (replaced with env vars / relative)
- Add QUICKSTART-USER.adoc with real build/run instructions
- Add doctor/heal/tour/help-me recipes to Justfile
- Add LLM warmup scripts (user + dev, token-efficient)
- Add contractile baselines: MUST, TRUST, INTENT, ADJUST
- Add guix.scm + flake.nix for reproducible environments
- Slim/create AI manifest with tiered context loading

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

0-ai-gatekeeper-protocol/mcp-repo-guardian/README.adoc

@@ -37,10 +37,10 @@ project/
 
 - Include `ai-cli-crash-capture/` and `contractiles/` from this template in new repos.
 - Mirror 6SCM files into `.machine_readable/` (NOT `.machine_readable/6scm/`).
-- Before any code generation, check `/var/mnt/eclipse/repos/proven` for the current Idris "unbreakable" library status.
+- Before any code generation, check `$REPOS_DIR/proven` for the current Idris "unbreakable" library status.
 - If a project uses that Idris library, add an *Idris Inside* badge to the repo.
-- If new bindings are required, add them in `/var/mnt/eclipse/repos/proven` as `idris2-zig-<language>` during the work.
-- If new code suggests additional "unbreakable" Idris modules, add them under `/var/mnt/eclipse/repos/proven` and update binders across all supported languages.
+- If new bindings are required, add them in `$REPOS_DIR/proven` as `idris2-zig-<language>` during the work.
+- If new code suggests additional "unbreakable" Idris modules, add them under `$REPOS_DIR/proven` and update binders across all supported languages.
 
 == Standard Dependencies
 

0-ai-gatekeeper-protocol/repo-guardian-fs/README.adoc

@@ -69,10 +69,10 @@ project/
 - **FIRST:** Customize `0-AI-MANIFEST.a2ml` for your repo before any other work
 - Include `ai-cli-crash-capture/` and `contractiles/` from this template in new repos.
 - Mirror 6SCM files into `.machine_readable/` (NOT `.machine_readable/6scm/`).
-- Before any code generation, check `/var/mnt/eclipse/repos/proven` for the current Idris "unbreakable" library status.
+- Before any code generation, check `$REPOS_DIR/proven` for the current Idris "unbreakable" library status.
 - If a project uses that Idris library, add an *Idris Inside* badge to the repo.
-- If new bindings are required, add them in `/var/mnt/eclipse/repos/proven` as `idris2-zig-<language>` during the work.
-- If new code suggests additional "unbreakable" Idris modules, add them under `/var/mnt/eclipse/repos/proven` and update binders across all supported languages.
+- If new bindings are required, add them in `$REPOS_DIR/proven` as `idris2-zig-<language>` during the work.
+- If new code suggests additional "unbreakable" Idris modules, add them under `$REPOS_DIR/proven` and update binders across all supported languages.
 
 == Standard Dependencies
 

a2ml/Justfile

@@ -196,8 +196,8 @@ demo:
 # Run vector checks (prototype runner)
 vectors:
     @echo "Running vector checks..."
-    @if [ -x /home/hyper/.deno/bin/deno ]; then \
-        /home/hyper/.deno/bin/deno run -A npm:rescript@latest build prototype/rescript; \
+    @if [ -x deno ]; then \
+        deno run -A npm:rescript@latest build prototype/rescript; \
       elif command -v deno >/dev/null 2>&1; then \
         deno run -A npm:rescript@latest build prototype/rescript; \
       elif command -v rescript >/dev/null 2>&1; then \
@@ -214,8 +214,8 @@ vectors:
           exit 1; \
         fi; \
       fi
-    @if [ -x /home/hyper/.deno/bin/deno ]; then \
-        /home/hyper/.deno/bin/deno run --allow-read --config prototype/rescript/deno.json prototype/rescript/src/RunVectors.bs.js; \
+    @if [ -x deno ]; then \
+        deno run --allow-read --config prototype/rescript/deno.json prototype/rescript/src/RunVectors.bs.js; \
       elif command -v deno >/dev/null 2>&1; then \
         deno run --allow-read --config prototype/rescript/deno.json prototype/rescript/src/RunVectors.bs.js; \
       elif command -v node >/dev/null 2>&1; then \
@@ -229,8 +229,8 @@ vectors:
 vectors-report:
     @echo "Running vector checks (report)..."
     @mkdir -p build
-    @if [ -x /home/hyper/.deno/bin/deno ]; then \
-        /home/hyper/.deno/bin/deno run -A npm:rescript@latest build prototype/rescript; \
+    @if [ -x deno ]; then \
+        deno run -A npm:rescript@latest build prototype/rescript; \
       elif command -v deno >/dev/null 2>&1; then \
         deno run -A npm:rescript@latest build prototype/rescript; \
       elif command -v rescript >/dev/null 2>&1; then \
@@ -247,8 +247,8 @@ vectors-report:
           exit 1; \
         fi; \
       fi
-    @if [ -x /home/hyper/.deno/bin/deno ]; then \
-        /home/hyper/.deno/bin/deno run --allow-read --allow-write --config prototype/rescript/deno.json prototype/rescript/src/RunReport.bs.js; \
+    @if [ -x deno ]; then \
+        deno run --allow-read --allow-write --config prototype/rescript/deno.json prototype/rescript/src/RunReport.bs.js; \
       elif command -v deno >/dev/null 2>&1; then \
         deno run --allow-read --allow-write --config prototype/rescript/deno.json prototype/rescript/src/RunReport.bs.js; \
       elif command -v node >/dev/null 2>&1; then \
@@ -260,8 +260,8 @@ vectors-report:
 
 # Dump A2ML surface AST as JSON
 dump-ast path:
-    @if [ -x /home/hyper/.deno/bin/deno ]; then \
-        /home/hyper/.deno/bin/deno run -A npm:rescript@latest build prototype/rescript; \
+    @if [ -x deno ]; then \
+        deno run -A npm:rescript@latest build prototype/rescript; \
       elif command -v deno >/dev/null 2>&1; then \
         deno run -A npm:rescript@latest build prototype/rescript; \
       elif command -v rescript >/dev/null 2>&1; then \
@@ -278,8 +278,8 @@ dump-ast path:
           exit 1; \
         fi; \
       fi
-    @if [ -x /home/hyper/.deno/bin/deno ]; then \
-        /home/hyper/.deno/bin/deno run --allow-read --config prototype/rescript/deno.json prototype/rescript/src/DumpAst.bs.js {{path}}; \
+    @if [ -x deno ]; then \
+        deno run --allow-read --config prototype/rescript/deno.json prototype/rescript/src/DumpAst.bs.js {{path}}; \
       elif command -v deno >/dev/null 2>&1; then \
         deno run --allow-read --config prototype/rescript/deno.json prototype/rescript/src/DumpAst.bs.js {{path}}; \
       elif command -v node >/dev/null 2>&1; then \
@@ -322,8 +322,8 @@ package-cli:
 
 # Run CLI (prototype)
 cli *args:
-    @if [ -x /home/hyper/.deno/bin/deno ]; then \
-        /home/hyper/.deno/bin/deno run -A npm:rescript@latest build prototype/rescript; \
+    @if [ -x deno ]; then \
+        deno run -A npm:rescript@latest build prototype/rescript; \
       elif command -v deno >/dev/null 2>&1; then \
         deno run -A npm:rescript@latest build prototype/rescript; \
       elif command -v rescript >/dev/null 2>&1; then \
@@ -332,8 +332,8 @@ cli *args:
         echo "rescript not found; install the ReScript compiler." >&2; \
         exit 1; \
       fi
-    @if [ -x /home/hyper/.deno/bin/deno ]; then \
-        /home/hyper/.deno/bin/deno run --config prototype/rescript/deno.json prototype/rescript/src/Cli.bs.js {{args}}; \
+    @if [ -x deno ]; then \
+        deno run --config prototype/rescript/deno.json prototype/rescript/src/Cli.bs.js {{args}}; \
       elif command -v deno >/dev/null 2>&1; then \
         deno run --config prototype/rescript/deno.json prototype/rescript/src/Cli.bs.js {{args}}; \
       elif command -v node >/dev/null 2>&1; then \

a2ml/actions/validate/docs/governance/MAINTENANCE-CHECKLIST.adoc

@@ -140,7 +140,7 @@ Do **not** move the following out of root if you want default tool behavior:
 Use the helper script first, then use the checklist for deeper/manual follow-up.
 
 Script locations:
-- `/var/mnt/eclipse/repos/run-maintenance.sh`
+- `$REPOS_DIR/run-maintenance.sh`
 - `~/Desktop/run-maintenance.sh`
 
 ```bash
@@ -259,7 +259,7 @@ find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \)
 - [ ] Re-run until acceptable.
 
 ```bash
-PANIC_BIN="/var/mnt/eclipse/repos/panic-attacker/target/release/panic-attack"
+PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack"
 "$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet
 jq -r '.weak_points | length' /tmp/assail.json
 jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json
@@ -550,20 +550,20 @@ Fail closed: if evidence is missing for any checklist item, treat that item as N
 For centralized coverage across existing and new repos:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just enroll-repos
 ```
 
 Optional directive write-back to repos that already have `.machine_readable/`:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
-just enroll-repos /var/mnt/eclipse/repos true
+cd "$REPOS_DIR/gitbot-fleet"
+just enroll-repos "$REPOS_DIR" true
 ```
 
 Release hard gate from fleet:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just maintenance-hard-pass /absolute/path/to/repo
 ```

a2ml/bindings/deno/docs/governance/MAINTENANCE-CHECKLIST.adoc

@@ -140,7 +140,7 @@ Do **not** move the following out of root if you want default tool behavior:
 Use the helper script first, then use the checklist for deeper/manual follow-up.
 
 Script locations:
-- `/var/mnt/eclipse/repos/run-maintenance.sh`
+- `$REPOS_DIR/run-maintenance.sh`
 - `~/Desktop/run-maintenance.sh`
 
 ```bash
@@ -259,7 +259,7 @@ find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \)
 - [ ] Re-run until acceptable.
 
 ```bash
-PANIC_BIN="/var/mnt/eclipse/repos/panic-attacker/target/release/panic-attack"
+PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack"
 "$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet
 jq -r '.weak_points | length' /tmp/assail.json
 jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json
@@ -550,20 +550,20 @@ Fail closed: if evidence is missing for any checklist item, treat that item as N
 For centralized coverage across existing and new repos:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just enroll-repos
 ```
 
 Optional directive write-back to repos that already have `.machine_readable/`:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
-just enroll-repos /var/mnt/eclipse/repos true
+cd "$REPOS_DIR/gitbot-fleet"
+just enroll-repos "$REPOS_DIR" true
 ```
 
 Release hard gate from fleet:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just maintenance-hard-pass /absolute/path/to/repo
 ```

a2ml/bindings/haskell/docs/governance/MAINTENANCE-CHECKLIST.adoc

@@ -140,7 +140,7 @@ Do **not** move the following out of root if you want default tool behavior:
 Use the helper script first, then use the checklist for deeper/manual follow-up.
 
 Script locations:
-- `/var/mnt/eclipse/repos/run-maintenance.sh`
+- `$REPOS_DIR/run-maintenance.sh`
 - `~/Desktop/run-maintenance.sh`
 
 ```bash
@@ -259,7 +259,7 @@ find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \)
 - [ ] Re-run until acceptable.
 
 ```bash
-PANIC_BIN="/var/mnt/eclipse/repos/panic-attacker/target/release/panic-attack"
+PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack"
 "$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet
 jq -r '.weak_points | length' /tmp/assail.json
 jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json
@@ -550,20 +550,20 @@ Fail closed: if evidence is missing for any checklist item, treat that item as N
 For centralized coverage across existing and new repos:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just enroll-repos
 ```
 
 Optional directive write-back to repos that already have `.machine_readable/`:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
-just enroll-repos /var/mnt/eclipse/repos true
+cd "$REPOS_DIR/gitbot-fleet"
+just enroll-repos "$REPOS_DIR" true
 ```
 
 Release hard gate from fleet:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just maintenance-hard-pass /absolute/path/to/repo
 ```

a2ml/bindings/rust/docs/governance/MAINTENANCE-CHECKLIST.adoc

@@ -140,7 +140,7 @@ Do **not** move the following out of root if you want default tool behavior:
 Use the helper script first, then use the checklist for deeper/manual follow-up.
 
 Script locations:
-- `/var/mnt/eclipse/repos/run-maintenance.sh`
+- `$REPOS_DIR/run-maintenance.sh`
 - `~/Desktop/run-maintenance.sh`
 
 ```bash
@@ -259,7 +259,7 @@ find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \)
 - [ ] Re-run until acceptable.
 
 ```bash
-PANIC_BIN="/var/mnt/eclipse/repos/panic-attacker/target/release/panic-attack"
+PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack"
 "$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet
 jq -r '.weak_points | length' /tmp/assail.json
 jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json
@@ -550,20 +550,20 @@ Fail closed: if evidence is missing for any checklist item, treat that item as N
 For centralized coverage across existing and new repos:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just enroll-repos
 ```
 
 Optional directive write-back to repos that already have `.machine_readable/`:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
-just enroll-repos /var/mnt/eclipse/repos true
+cd "$REPOS_DIR/gitbot-fleet"
+just enroll-repos "$REPOS_DIR" true
 ```
 
 Release hard gate from fleet:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just maintenance-hard-pass /absolute/path/to/repo
 ```

a2ml/editors/vscode/docs/governance/MAINTENANCE-CHECKLIST.adoc

@@ -140,7 +140,7 @@ Do **not** move the following out of root if you want default tool behavior:
 Use the helper script first, then use the checklist for deeper/manual follow-up.
 
 Script locations:
-- `/var/mnt/eclipse/repos/run-maintenance.sh`
+- `$REPOS_DIR/run-maintenance.sh`
 - `~/Desktop/run-maintenance.sh`
 
 ```bash
@@ -259,7 +259,7 @@ find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \)
 - [ ] Re-run until acceptable.
 
 ```bash
-PANIC_BIN="/var/mnt/eclipse/repos/panic-attacker/target/release/panic-attack"
+PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack"
 "$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet
 jq -r '.weak_points | length' /tmp/assail.json
 jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json
@@ -550,20 +550,20 @@ Fail closed: if evidence is missing for any checklist item, treat that item as N
 For centralized coverage across existing and new repos:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just enroll-repos
 ```
 
 Optional directive write-back to repos that already have `.machine_readable/`:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
-just enroll-repos /var/mnt/eclipse/repos true
+cd "$REPOS_DIR/gitbot-fleet"
+just enroll-repos "$REPOS_DIR" true
 ```
 
 Release hard gate from fleet:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just maintenance-hard-pass /absolute/path/to/repo
 ```

a2ml/pandoc/docs/governance/MAINTENANCE-CHECKLIST.adoc

@@ -140,7 +140,7 @@ Do **not** move the following out of root if you want default tool behavior:
 Use the helper script first, then use the checklist for deeper/manual follow-up.
 
 Script locations:
-- `/var/mnt/eclipse/repos/run-maintenance.sh`
+- `$REPOS_DIR/run-maintenance.sh`
 - `~/Desktop/run-maintenance.sh`
 
 ```bash
@@ -259,7 +259,7 @@ find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \)
 - [ ] Re-run until acceptable.
 
 ```bash
-PANIC_BIN="/var/mnt/eclipse/repos/panic-attacker/target/release/panic-attack"
+PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack"
 "$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet
 jq -r '.weak_points | length' /tmp/assail.json
 jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json
@@ -550,20 +550,20 @@ Fail closed: if evidence is missing for any checklist item, treat that item as N
 For centralized coverage across existing and new repos:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just enroll-repos
 ```
 
 Optional directive write-back to repos that already have `.machine_readable/`:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
-just enroll-repos /var/mnt/eclipse/repos true
+cd "$REPOS_DIR/gitbot-fleet"
+just enroll-repos "$REPOS_DIR" true
 ```
 
 Release hard gate from fleet:
 
 ```bash
-cd /var/mnt/eclipse/repos/gitbot-fleet
+cd "$REPOS_DIR/gitbot-fleet"
 just maintenance-hard-pass /absolute/path/to/repo
 ```

a2ml/prototype/wasm/README.adoc

@@ -2,7 +2,7 @@
 = A2ML WASM Prototype (ReScript + rescript-wasm-runtime)
 
 This prototype demonstrates a direct-to-WASM flow using the
-`rescript-wasm-runtime` project at `/var/mnt/eclipse/repos/rescript-wasm-runtime`.
+`rescript-wasm-runtime` project (sibling repo `rescript-wasm-runtime`).
 
 == What it shows