docs(policy): split-roles language policy (AffineScript general / Ephapax linear core) + stale-status fixes (#95)

## What

Reconciles the two language threads colliding in the estate —
**AffineScript** (the ReScript-replacement app-code migration) vs
**Ephapax** (svalinn's D3, from the Ochránce thread) — as
**complementary roles, not competitors**, and aligns three stale status
docs with verified ground truth.

Maintainer decision on record (this session): **split roles** —
- **AffineScript** = primary *general* application language (gateway /
UI / app code; typed-wasm; replaces ReScript).
- **Ephapax** = *linear security core* (exactly-once tokens, revocation
ledgers, secret/handle lifecycle, container-lifecycle invariants,
zero-copy IPC).

## Changes

- **Language policy** —
`container-stack/{svalinn,cerro-torre,vordr}/.claude/CLAUDE.md`: rewrote
the migration note to state both roles; added an **Ephapax** row to each
ALLOWED-languages table.
- **`stapeln.toml`** — svalinn component description + `language` note
now reflect the in-flight ReScript → AffineScript (general) + Ephapax
(linear core) migration (**11/33 modules ported**).
- **`ECOSYSTEM-STATUS.md`** — marked the 2026-01-25 snapshot stale;
`selur/ephapax/bridge.eph` + `types.eph` are **implemented** (~300 LOC)
— the "NOT EXISTS" line is obsolete.
- **`docs/READINESS.adoc`** — Idris2 proofs are **real** (33 `.idr`, no
`believe_me`/`postulate`/`sorry`), not "stubs only".

## Verification (ground-truth language inventory)

Best-fit per area is **correct** for: backend (Elixir), ffi/zig (Zig),
src/abi (Idris2), cerro-torre (Ada/SPARK, 67 files), vordr
(Rust+Ada+Idris2 polyglot), selur (Rust + Ephapax IPC). svalinn is
mid-migration (right direction).

## Open best-fit calls (NOT in this PR — flagged for decision)

1. **`rokur`** — a *secrets-management gate* written entirely in plain
Deno/JS (7 files, untyped). Secrets are the canonical linear resource
(exactly-once / must-zeroize); candidate to move to **Ephapax (handle
lifecycle) + Rust host**, or at least Rust.
2. **svalinn `auth/*` + `bridge/SelurBridge`** — the migration so far
ported auth types to `.affine`; under split-roles the *linear* security
invariants (JWT/JTI exactly-once, revocation, the selur bridge) are a
better fit for **Ephapax** than AffineScript. Refinement to PR #46, not
a reversal.

## Relationship to PR #46

PR #46 (the AffineScript svalinn migration) continues unchanged; this PR
aligns the policy/docs with it and adds the Ephapax security-core lane
alongside.

https://claude.ai/code/session_01EsxEhRW4rDbxMo2c9xaa7Z

---
_Generated by [Claude
Code](https://claude.ai/code/session_01EsxEhRW4rDbxMo2c9xaa7Z)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

container-stack/cerro-torre/.claude/CLAUDE.md

@@ -15,16 +15,24 @@ The following files in `.machine_readable/` contain structured project metadata:
 
 ## Language Policy (Hyperpolymath Standard)
 
-> **2026 migration: ReScript → AffineScript.** AffineScript is the primary
-> application language; ReScript is deprecated estate-wide — the governance
-> banned-language gate enforces "use AffineScript instead". Existing `.res`
-> files are grandfathered via `.hypatia-baseline.json`; do not add new `.res`.
+> **2026 migration: ReScript retired → two successor languages, by role.**
+> **AffineScript** is the primary *general application* language (affine-typed,
+> compiled to typed-wasm via the OCaml AffineScript compiler) — it replaces
+> ReScript for gateway / UI / app code. **Ephapax** owns the *linear security
+> core*: exactly-once tokens, revocation ledgers, secret/handle lifecycle,
+> container-lifecycle invariants, and zero-copy IPC (see `ephapax-modules/`,
+> `container-stack/selur/`). The two are complementary, not competing — reach
+> for AffineScript for general logic, Ephapax where linearity *is* the guarantee.
+> ReScript is deprecated estate-wide (the governance banned-language gate
+> enforces "use AffineScript instead"); existing `.res` are grandfathered via
+> `.hypatia-baseline.json` — do not add new `.res`.
 
 ### ALLOWED Languages & Tools
 
 | Language/Tool | Use Case | Notes |
 |---------------|----------|-------|
-| **AffineScript** | Primary application code | Affine-typed; compiled via the OCaml AffineScript compiler. Replaces ReScript. |
+| **AffineScript** | Primary *general* application code | Affine-typed; compiled to typed-wasm via the OCaml AffineScript compiler. Replaces ReScript for gateway/UI/app logic. |
+| **Ephapax** | *Linear security core* | Linear/affine types: exactly-once tokens, revocation, secret/handle lifecycle, container-lifecycle invariants, zero-copy IPC. See `ephapax-modules/`, `container-stack/selur/`. Complements AffineScript — not a general app language. |
 | **Deno** | Runtime & package management | Replaces Node/npm/bun |
 | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
 | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |

container-stack/svalinn/.claude/CLAUDE.md

@@ -15,16 +15,24 @@ The following files in `.machine_readable/` contain structured project metadata:
 
 ## Language Policy (Hyperpolymath Standard)
 
-> **2026 migration: ReScript → AffineScript.** AffineScript is the primary
-> application language; ReScript is deprecated estate-wide — the governance
-> banned-language gate enforces "use AffineScript instead". Existing `.res`
-> files are grandfathered via `.hypatia-baseline.json`; do not add new `.res`.
+> **2026 migration: ReScript retired → two successor languages, by role.**
+> **AffineScript** is the primary *general application* language (affine-typed,
+> compiled to typed-wasm via the OCaml AffineScript compiler) — it replaces
+> ReScript for gateway / UI / app code. **Ephapax** owns the *linear security
+> core*: exactly-once tokens, revocation ledgers, secret/handle lifecycle,
+> container-lifecycle invariants, and zero-copy IPC (see `ephapax-modules/`,
+> `container-stack/selur/`). The two are complementary, not competing — reach
+> for AffineScript for general logic, Ephapax where linearity *is* the guarantee.
+> ReScript is deprecated estate-wide (the governance banned-language gate
+> enforces "use AffineScript instead"); existing `.res` are grandfathered via
+> `.hypatia-baseline.json` — do not add new `.res`.
 
 ### ALLOWED Languages & Tools
 
 | Language/Tool | Use Case | Notes |
 |---------------|----------|-------|
-| **AffineScript** | Primary application code | Affine-typed; compiled via the OCaml AffineScript compiler. Replaces ReScript. |
+| **AffineScript** | Primary *general* application code | Affine-typed; compiled to typed-wasm via the OCaml AffineScript compiler. Replaces ReScript for gateway/UI/app logic. |
+| **Ephapax** | *Linear security core* | Linear/affine types: exactly-once tokens, revocation, secret/handle lifecycle, container-lifecycle invariants, zero-copy IPC. See `ephapax-modules/`, `container-stack/selur/`. Complements AffineScript — not a general app language. |
 | **Deno** | Runtime & package management | Replaces Node/npm/bun |
 | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
 | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |

container-stack/svalinn/ECOSYSTEM-STATUS.md

@@ -1,6 +1,12 @@
 # Cerro Torre Ecosystem - Implementation Status
 **Updated:** 2026-01-25
 
+> ⚠️ **Stale snapshot (2026-01-25) — superseded by `STATUS.md` (2026-03-29).**
+> Corrections verified 2026-06-13: selur `ephapax/bridge.eph` **and** `ephapax/types.eph`
+> are now **IMPLEMENTED** (~300 LOC combined) — the "bridge.eph (NOT EXISTS)" line below is
+> obsolete. Svalinn is mid-migration ReScript → AffineScript (general) + Ephapax (linear core),
+> not pure ReScript. Idris2 proofs are real (no `believe_me`/`postulate`), not stubs.
+
 ## 🎯 Big Picture: 4-Phase Implementation Plan
 
 **Original Timeline:** 22-32 weeks total

container-stack/vordr/.claude/CLAUDE.md

@@ -19,10 +19,13 @@ The following files in `.machine_readable/` contain structured project metadata:
 
 ## Language Policy (STRICT)
 
-> **2026 migration: ReScript → AffineScript.** AffineScript replaces ReScript
-> for the MCP adapter / browser UI; the governance banned-language gate enforces
-> "use AffineScript instead". Existing `.res` are grandfathered via
-> `.hypatia-baseline.json`; do not add new `.res`.
+> **2026 migration: ReScript retired → AffineScript (general) + Ephapax (linear core).**
+> **AffineScript** replaces ReScript for the MCP adapter / browser UI (general app
+> code, typed-wasm). **Ephapax** owns the linear security core — exactly-once /
+> revocation / resource-lifecycle invariants and zero-copy IPC (see `selur`,
+> `ephapax-modules/`). The governance banned-language gate enforces "use
+> AffineScript instead"; existing `.res` are grandfathered via
+> `.hypatia-baseline.json` — do not add new `.res`.
 
 ### ALLOWED Languages
 
@@ -32,7 +35,8 @@ The following files in `.machine_readable/` contain structured project metadata:
 | **Rust** | eBPF probes, performance-critical paths, CLI | `src/rust/` |
 | **Elixir** | Orchestration, state management, reversibility | `src/elixir/` |
 | **Ada/SPARK** | Cryptographic operations, SPARK proofs | `src/ada/` |
-| **AffineScript** | MCP adapter, browser UI (replaces ReScript) | `adapters/`, `runtime/` |
+| **AffineScript** | MCP adapter, browser UI — general app code (replaces ReScript) | `adapters/`, `runtime/` |
+| **Ephapax** | Linear security core — exactly-once / lifecycle invariants, zero-copy IPC | `selur` bridge, `ephapax-modules/` |
 | **Guile Scheme** | SCM checkpoint files | `*.scm` |
 | **Bash** | Build scripts only | `scripts/` |
 

docs/READINESS.adoc

@@ -8,6 +8,15 @@ This document defines what "production-ready" means for stapeln and tracks the c
 state of readiness against those criteria. Updated from README.adoc status table
 (last reviewed 2026-02-13).
 
+[NOTE]
+====
+Freshness correction (verified 2026-06-13): the *Idris2 proofs* status below
+("stubs only / zero proven lemmas") is **stale**. The estate now has 33 `.idr`
+files with **no** `believe_me`/`postulate`/`sorry` markers, and cerro-torre's
+lifecycle postulates were discharged (see `STATUS.md`, 2026-03-29). Treat the
+Idris2 rows below as "real proofs, coverage still expanding," not "stubs."
+====
+
 == What "Ready for Production" Means
 
 A production-ready stapeln instance satisfies all of the following:

stapeln.toml

@@ -314,9 +314,9 @@ copy-from = [
 entrypoint = ["/usr/local/bin/vordr"]
 
 [components.svalinn]
-description = "OCI edge gateway — ReScript/Deno with pre-start verification hooks"
+description = "OCI edge gateway — migrating ReScript → AffineScript (general app) + Ephapax (linear security core); Deno host. Pre-start verification hooks."
 path = "container-stack/svalinn"
-language = "rescript"
+language = "rescript"  # in migration: 11/33 modules ported to .affine; auth/bridge security core targets ephapax (linear). Build still compiles remaining .res.
 build-system = "deno"
 containerfile = "container-stack/svalinn/Containerfile"