chore: security-template fills, instant-sync gate, foreign-artifact cleanup, compat polish (wave-1 8/8) (#33)

Part 8/8 of the production-readiness wave-1 chain: 1
`fix/neural-boundary-guardrail` (P0) → 2 `fix/stats-degenerate-inputs`
(P1) → 3 `test/executor-router-coverage` (P1) → 4
`fix/documented-install-path` (P0-docs) → 5 `fix/supply-chain-pinning`
(P1) → 6 `fix/zig-ffi-compiles` (P1) → 7 `fix/agda-proofs-ci` (P1) → **8
`chore/hygiene-security-templates` (P2, this PR)**. All eight PRs are
independent and target `main`; the numbering communicates review
priority, not stacking.

## What changed and why

**Security-template fills**
- `SECURITY.md` — deleted the leftover "delete this block before
publishing" template-instructions block and removed the TBD PGP
key/fingerprint rows plus the `gpg --import` snippet (no key is
published; none invented). Real contact routes (GitHub advisories,
email) kept.
- `.well-known/security.txt` — removed the `Encryption: TBD` line and
fixed the double-`https://` Hiring URL. All other RFC 9116 fields
(`Expires` etc.) unchanged.
- `CODE_OF_CONDUCT.md`, `docs/AI_INSTALLATION_GUIDE.adoc` — removed
leftover "delete before publishing / after completing" template banners
only; no content rewrite.

**Instant-sync presence gate + tracking issue**
- `.github/workflows/instant-sync.yml` currently fails on 100% of `main`
pushes ("Bad credentials" dispatching to
`hyperpolymath/.git-private-farm`). Added a **first** step that checks
`FARM_DISPATCH_TOKEN` presence and sets a step output; the
dispatch/confirm steps are now conditional on it — step-level `if` only,
never job-level `secrets`/`hashFiles()` conditionals (those cause silent
`startup_failure`).
- Tracking issue for the invalid token: #32
(labels `bug`, `github_actions`), citing the failing runs. Note: the
gate only makes *absent-secret* runs green; while the secret exists but
is invalid, runs stay red until an admin rotates the token (tracked in
#32).

**Foreign-artifact cleanup & dedup**
- Deleted `generated/wokelangiser/` (7.6 MB of foreign artifacts) and
added `generated/` to `.gitignore`.
- Deleted root `CODEOWNERS` after verifying it is a strict subset of
`.github/CODEOWNERS` with identical owners (GitHub honours the
`.github/` copy).
- Removed the dead `tests/` directory (`.gitkeep`-only; the Julia suite
lives in `test/` and nothing references `tests/`).

**Compat polish**
- `.conflow.yaml` — converted invalid `//` comments to `#` and pointed
it at `statistikles` instead of the generic `my-app` template
(accompanying rename in `configs/config.ncl`; the cue schema tolerates
the name change). Minimal fix, no restructure.
- `Project.toml` — added `[compat]` entries
`Dates`/`LinearAlgebra`/`Printf`/`Random`/`Statistics`/`UUIDs = "1"` for
the stdlib deps to fully quiet RegistryCI AutoMerge; entries match the
`[deps]` UUIDs.

## Local verification

- `grep` over the four touched template files (`SECURITY.md`,
`.well-known/security.txt`, `CODE_OF_CONDUCT.md`,
`docs/AI_INSTALLATION_GUIDE.adoc`) confirms zero remaining
template-banner / `TBD` / double-`https://` remnants (independently
re-confirmed by review).
- `instant-sync.yml` read back after edit: presence check is the first
step; all conditionals are step-level `if`s keyed on its output.
- `git status` showed the `generated/wokelangiser/` deletion staged;
root `CODEOWNERS` diffed against `.github/CODEOWNERS` before deletion
(strict subset, identical owners).
- No local toolchain runs were required for this package
(docs/CI/metadata only).

## Intentionally not done / disclosures

- **`.gitlab-ci.yml` and `deny.toml` untouched by design** (out of scope
per the wave plan: flagged as scaffolding but carrying load-bearing
claims). Recommended follow-up decision: `.gitlab-ci.yml` also contains
a `//` comment artifact like the one fixed in `.conflow.yaml`, and
`deny.toml` needs a deliberate review — suggest a small follow-up PR for
both.
- `generated/abi/.gitkeep` remains tracked: the spec only ordered the
`wokelangiser` deletion, and gitignoring `generated/` does not untrack
already-tracked files.
- Two "delete this section" comments remain in
`docs/AI_INSTALLATION_GUIDE.adoc` (lines 194/215); they sit inside
unfilled `[TODO-AI-INSTALL]` body sections that were explicitly excluded
from content rewrite.
- Instant-sync runs stay red until `FARM_DISPATCH_TOKEN` is rotated —
admin action, tracked in #32.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.conflow.yaml

@@ -1,5 +1,5 @@
-// SPDX-License-Identifier: MPL-2.0
-// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # conflow pipeline - Full generate → validate → export
 version: "1"
 name: "statistikles"

.github/workflows/instant-sync.yml

@@ -17,7 +17,23 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
+      # Gate on secret presence so runs without the dispatch token skip
+      # cleanly instead of failing (step-level `if` only; job-level
+      # secrets conditionals cause silent startup failures).
+      - name: Check dispatch token presence
+        id: token
+        env:
+          FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
+        run: |
+          if [ -n "$FARM_DISPATCH_TOKEN" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::FARM_DISPATCH_TOKEN not set; skipping forge propagation"
+          fi
+
       - name: Trigger Propagation
+        if: steps.token.outputs.present == 'true'
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
@@ -32,4 +48,5 @@ jobs:
             }
 
       - name: Confirm
+        if: steps.token.outputs.present == 'true'
         run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"

.gitignore

@@ -94,8 +94,8 @@ ai-cli-crash-capture/
 # Sync artifacts
 sync_report*.txt
 
-# wokelangiser generated i18n locale files (too large for GitHub)
-generated/wokelangiser/i18n/
+# Generated artifacts (wokelangiser, conflow exports) — regenerate, don't commit
+generated/
 target/
 node_modules/
 _build/

.well-known/security.txt

@@ -4,8 +4,7 @@
 
 Contact: mailto:j.d.a.jewell@open.ac.uk
 Expires: 2026-12-31T23:59:59.000Z
-Encryption: TBD
 Preferred-Languages: en
 Canonical: https://github.com/hyperpolymath/statistikles/.well-known/security.txt
 Policy: https://github.com/hyperpolymath/statistikles/blob/main/SECURITY.md
-Hiring: https://https://github.com/hyperpolymath/statistikles/careers
+Hiring: https://github.com/hyperpolymath/statistikles/careers

CODEOWNERS

@@ -4,26 +4,6 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 # Code of Conduct
 
-<!-- 
-============================================================================
-TEMPLATE INSTRUCTIONS (delete this block before publishing)
-============================================================================
-Replace all {{PLACEHOLDER}} values:
-  Statistikles     - Your project name
-  hyperpolymath            - GitHub/GitLab username or org
-  statistikles             - Repository name
-  j.d.a.jewell@open.ac.uk    - Email for conduct reports
-  Statistikles maintainers     - Name of conduct team/committee
-  48 hours    - Initial response SLA (e.g., 48 hours)
-  2026     - Current year
-
-Review and customise:
-- Adjust enforcement ladder for your community size
-- Add/remove examples based on your context
-- Ensure contact methods work for your team
-============================================================================
--->
-
 ## Our Pledge
 
 We as members, contributors, and leaders pledge to make participation in Statistikles a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation.

CODE_OF_CONDUCT.md

@@ -20,10 +20,16 @@ UUIDs = "cf7118a7-6976-5b1a-9a39-7adc72f591a4"
 [compat]
 CSV = "0.10.16"
 DataFrames = "1.8.1"
+Dates = "1"
 Distributions = "0.25.123"
 HTTP = "1.10.19"
 JSON3 = "1.14.3"
+LinearAlgebra = "1"
+Printf = "1"
+Random = "1"
+Statistics = "1"
 StatsBase = "0.34.10"
+UUIDs = "1"
 julia = "1.10"
 
 [extras]

Project.toml

@@ -4,24 +4,6 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 # Security Policy
 
-<!-- 
-============================================================================
-TEMPLATE INSTRUCTIONS (delete this block before publishing)
-============================================================================
-Replace all {{PLACEHOLDER}} values with your information:
-  Statistikles     - Your project name
-  hyperpolymath            - GitHub username or org (e.g., hyperpolymath)
-  statistikles             - Repository name
-  j.d.a.jewell@open.ac.uk   - Security contact email
-  TBD  - Your PGP key fingerprint (40 chars, no spaces)
-  TBD      - URL to your public PGP key
-  https://github.com/hyperpolymath/statistikles          - Your website/domain
-  2026     - Current year for copyright
-
-Optional: Remove sections that don't apply (e.g., PGP if you don't use it)
-============================================================================
--->
-
 We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions.
 
 ## Table of Contents
@@ -56,26 +38,13 @@ This method ensures:
 - Coordinated disclosure tooling
 - Automatic credit when the advisory is published
 
-### Alternative: Encrypted Email
+### Alternative: Email
 
 If you cannot use GitHub Security Advisories, you may email us directly:
 
 | | |
 |---|---|
 | **Email** | j.d.a.jewell@open.ac.uk |
-| **PGP Key** | [Download Public Key](TBD) |
-| **Fingerprint** | `TBD` |
-
-```bash
-# Import our PGP key
-curl -sSL TBD | gpg --import
-
-# Verify fingerprint
-gpg --fingerprint j.d.a.jewell@open.ac.uk
-
-# Encrypt your report
-gpg --armor --encrypt --recipient j.d.a.jewell@open.ac.uk report.txt
-```
 
 > **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media.
 
@@ -374,7 +343,6 @@ When using Statistikles, we recommend:
 
 ## Additional Resources
 
-- [Our PGP Public Key](TBD)
 - [Security Advisories](https://github.com/hyperpolymath/statistikles/security/advisories)
 - [Changelog](CHANGELOG.md)
 - [Contributing Guidelines](CONTRIBUTING.md)

SECURITY.md

@@ -1,6 +1,6 @@
 # Configuration generation
 {
-  name = "my-app",
+  name = "statistikles",
   replicas =
     let env = "dev" in
     if env == "prod" then 5

configs/config.ncl

@@ -5,31 +5,6 @@
 :toc:
 :toc-placement: preamble
 
-// ============================================================================
-// TEMPLATE INSTRUCTIONS (delete this block after completing)
-//
-// This is the AI-native installation guide template. It contains everything
-// an AI assistant needs to install your project for a user who says one sentence.
-//
-// BEFORE RELEASE, you or your AI must fill in every section marked [TODO].
-// finishbot checks that no [TODO-AI-INSTALL] markers remain.
-//
-// The pattern:
-//   1. User says "set up Statistikles from https://github.com/hyperpolymath/statistikles"
-//   2. AI fetches this repo, reads THIS file
-//   3. AI follows the recipe in "For AI Assistants" section
-//   4. User answers 2-3 questions, confirms privacy notice
-//   5. Done -- no manual steps, no forms, no docs to read
-//
-// Fill in every [TODO-AI-INSTALL] section. Be specific -- the AI executing
-// this will take your instructions literally. Include exact commands, exact
-// URLs for credential creation, exact config file contents.
-//
-// Reference implementations:
-//   - neurophone/docs/AI_INSTALLATION_GUIDE.adoc (Android/Rust/Termux)
-//   - feedback-o-tron/docs/AI_INSTALLATION_GUIDE.adoc (Elixir CLI/MCP)
-// ============================================================================
-
 [NOTE]
 ====
 **If you are an AI assistant reading this:** A user has asked you to install Statistikles. Skip to <<ai-implementation,For AI Assistants: Implementation Guide>> for the complete step-by-step recipe. You have everything you need in this document -- no other docs required. Follow the steps in order.