fix(rsr): finish template instantiation + enforce it (#56)

[hyperpolymath]

Closes both acceptance criteria of #56 — though the second was already satisfied, and the first was mis-scoped.

Criterion 1 — template residue

The issue recorded "5 {{PLACEHOLDER}} files + 8 rsr-template-repo references". Re-measured: 8 files matched {{...}} and 21 lines matched the template name — but most were meta-references: files describing the debt, not carrying it.

Three would have been damaged by a naive search-and-replace:

File	Why it must not be touched
src/rust/src/eval.rs	"...add{{}} block" is a Rust format! escape — {{}} renders as a literal {}, naming the add{} language construct. Working code.
methodology.a2ml	The token appears inside reject-if-contains — the rule that forbids it.
AFFIRMATION.adoc, docs/identity-fabric/	Prose recording the debt.

The genuine residue, now cleared: {{DEPS}}, {{BUILD_OUTPUT_PATH}}, {{PACKAGE_NAME}}, {{LANG_STACK}}, {{BUILD_CMD}}, {{TEST_CMD}}, {{MUST_INVARIANTS}}, {{PROJECT_UNIQUE_STRENGTH}} — plus four contractiles and the citation guide whose subject was still the template. Intentfile asserted "This repository is the canonical template for Rhodium Standard Repository compliance"; CITATIONS.adoc credited "Polymath, Hyper" for "RSR-template-repo" in all five citation formats.

A worse class, found while fixing it

All three QUICKSTARTs documented commands that do not exist — just build, just test, just lint, just panic-scan, just setup-dev, just build-release, just install, just run, just heal, just setup, just uninstall, just stapeln-run — asserted an $XDG_CONFIG_HOME/tangle/config.toml the compiler never reads, and carried a "Multi-Instance Deployment" section for what is a single stateless binary.

Documentation that fails when followed is worse than none. Every command now shown is verified to exist, and the worked example shows the real output (8 assertion passed lines, exit 0) rather than the template's invented Tangle started successfully.

Criterion 2 — already satisfied by #78

README.adoc carries the correction and AFFIRMATION.adoc has "Erratum — 2026-07-21 / Correction 1 — the stack does not exist".

Worth noting: the criterion as worded — "does the simplified diagram supersede, or re-state, the nuance?" — presupposed the stack was real. Both options were wrong. KRL → TangleIR → … describes a dependency that never existed (TangleIR appears in no source file in either repo). It was withdrawn, not reconciled.

Making the rule real

methodology.a2ml has always declared reject-if-contains = [..., "rsr-template-repo"] — and nothing enforced it, which is precisely how the contractiles stayed mis-instantiated. Adds scripts/check-rsr-instantiation.sh (plus just rsr-check and a CI step), using an explicit allowlist so meta-references and the Rust escape aren't false-positived.

Verified adversarially:

Attack	Caught
Reintroduce a {{PLACEHOLDER}}	✅
Claim to be rsr-template-repo	✅
Document a phantom just recipe	✅
Rust format! escape add{{}}	✅ correctly ignored

It earned itself immediately: on first run it flagged QUICKSTART-USER.adoc, a file I had not inspected, with six phantom recipes.

Also

AFFIRMATION.adoc gains a dated Erratum — 2026-07-29 (Corrections 3–5) recording the residue clearance, that the OCaml compiler is no longer unbuilt (#87/#89 — the previous erratum's closing line said it was), and that == is no longer list equality (#50/#87).

All gates pass locally: build, corpus, rsr-check, must-check, trust-verify.

🤖 Generated with Claude Code

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ⚠️ Changes requested 0 resolved / 2 findings

Completes template instantiation and adds verification scripts for RSR compliance, but changes are requested due to the phantom-command check not running in CI and being limited to line-anchored just commands.

⚠️ Bug: Phantom-command check never runs in CI (just not installed)

📄 .github/workflows/ocaml-ci.yml:71-79 📄 .github/workflows/ocaml-ci.yml:119-129 📄 scripts/check-rsr-instantiation.sh:85-99

The ocaml-ci.yml "RSR instantiation guard" step runs check-rsr-instantiation.sh, but the job only installs ocaml ocaml-dune menhir — never just. The script treats a missing just as a non-fatal ::warning:: and skips the phantom-command check entirely (lines 86-88), then exits 0. So the very enforcement the PR advertises for CI — catching documented just recipes that don't exist — is silently inert in CI; only the template-residue check actually runs there. Add a just install step to the workflow before the guard (e.g. sudo apt-get install -y just, or a pinned setup), so the check runs rather than warning.

Install `just` in the CI job so the phantom-command check actually executes instead of emitting a skip warning.

- name: Install OCaml toolchain
  run: |
    set -euo pipefail
    sudo apt-get update -qq
    sudo apt-get install -y --no-install-recommends ocaml ocaml-dune menhir just
    ocaml -version
    dune --version
    menhir --version
    just --version

💡 Quality: Phantom-command check only matches line-anchored just commands

📄 scripts/check-rsr-instantiation.sh:94-101

The doc scan uses grep -oE '^just [a-z][a-z-]*', so only recipes that begin a line are verified. just commands referenced inline/in prose or backticks (e.g. the just tour / just help-me in QUICKSTART-USER's "Get Help" bullets) are never checked. Those happen to exist today, but the script's own comment claims "every just <recipe> named in the docs is checked," which the implementation does not deliver — a future phantom inline command would pass undetected. Consider matching just <recipe> anywhere on the line (including inside backticks) or documenting the line-anchored limitation.

🤖 Prompt for agents

Code Review: Completes template instantiation and adds verification scripts for RSR compliance, but changes are requested due to the phantom-command check not running in CI and being limited to line-anchored just commands.

1. ⚠️ Bug: Phantom-command check never runs in CI (just not installed)
   Files: .github/workflows/ocaml-ci.yml:71-79, .github/workflows/ocaml-ci.yml:119-129, scripts/check-rsr-instantiation.sh:85-99

   The `ocaml-ci.yml` "RSR instantiation guard" step runs `check-rsr-instantiation.sh`, but the job only installs `ocaml ocaml-dune menhir` — never `just`. The script treats a missing `just` as a non-fatal `::warning::` and skips the phantom-command check entirely (lines 86-88), then exits 0. So the very enforcement the PR advertises for CI — catching documented `just` recipes that don't exist — is silently inert in CI; only the template-residue check actually runs there. Add a `just` install step to the workflow before the guard (e.g. `sudo apt-get install -y just`, or a pinned setup), so the check runs rather than warning.

   Fix (Install `just` in the CI job so the phantom-command check actually executes instead of emitting a skip warning.):
   - name: Install OCaml toolchain
     run: |
       set -euo pipefail
       sudo apt-get update -qq
       sudo apt-get install -y --no-install-recommends ocaml ocaml-dune menhir just
       ocaml -version
       dune --version
       menhir --version
       just --version

2. 💡 Quality: Phantom-command check only matches line-anchored `just` commands
   Files: scripts/check-rsr-instantiation.sh:94-101

   The doc scan uses `grep -oE '^just [a-z][a-z-]*'`, so only recipes that begin a line are verified. `just` commands referenced inline/in prose or backticks (e.g. the `just tour` / `just help-me` in QUICKSTART-USER's "Get Help" bullets) are never checked. Those happen to exist today, but the script's own comment claims "every `just <recipe>` named in the docs is checked," which the implementation does not deliver — a future phantom inline command would pass undetected. Consider matching `just <recipe>` anywhere on the line (including inside backticks) or documenting the line-anchored limitation.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}