Merge branch 'main' into dependabot/github_actions/erlef/setup-beam-1.23.0

Author: hyperpolymath

.claude/CLAUDE.md

@@ -2,12 +2,12 @@
 
 The following files in `.machine_readable/` contain structured project metadata:
 
-- `STATE.scm` - Current project state and progress
-- `META.scm` - Architecture decisions and development practices
-- `ECOSYSTEM.scm` - Position in the ecosystem and related projects
-- `AGENTIC.scm` - AI agent interaction patterns
-- `NEUROSYM.scm` - Neurosymbolic integration config
-- `PLAYBOOK.scm` - Operational runbook
+- `.machine_readable/6a2/STATE.a2ml` - Current project state and progress
+- `.machine_readable/6a2/META.a2ml` - Architecture decisions and development practices
+- `.machine_readable/6a2/ECOSYSTEM.a2ml` - Position in the ecosystem and related projects
+- `.machine_readable/6a2/AGENTIC.a2ml` - AI agent interaction patterns
+- `.machine_readable/6a2/NEUROSYM.a2ml` - Neurosymbolic integration config
+- `.machine_readable/6a2/PLAYBOOK.a2ml` - Operational runbook
 
 ---
 
@@ -28,7 +28,7 @@ The following files in `.machine_readable/` contain structured project metadata:
 | **Bash/POSIX Shell** | Scripts, automation | Keep minimal |
 | **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs |
 | **Nickel** | Configuration language | For complex configs |
-| **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm |
+| **Guile Scheme** | State/meta files | .machine_readable/6a2/STATE.a2ml, .machine_readable/6a2/META.a2ml, .machine_readable/6a2/ECOSYSTEM.a2ml |
 | **Julia** | Batch scripts, data processing | Per RSR |
 | **OCaml** | AffineScript compiler | Language-specific |
 | **Ada** | Safety-critical systems | Where required |

.gitignore

@@ -1,3 +1,103 @@
+# RSR-compliant .gitignore
 
 # Crash recovery artifacts
 ai-cli-crash-capture/
+
+
+# OS & Editor
+.DS_Store
+Thumbs.db
+*.swp
+*.swo
+*~
+.idea/
+.vscode/
+
+
+# Build
+/target/
+/_build/
+/build/
+/dist/
+/out/
+/zig-out/
+/zig-cache/
+
+
+# Dependencies
+/node_modules/
+/vendor/
+/deps/
+/.elixir_ls/
+
+
+# Rust
+
+# Cargo.lock  # Keep for binaries
+
+
+# Elixir
+/cover/
+/doc/
+*.ez
+erl_crash.dump
+
+
+# Julia
+*.jl.cov
+*.jl.mem
+/Manifest.toml
+
+
+# ReScript
+/lib/bs/
+/.bsb.lock
+
+
+# Python (SaltStack only)
+__pycache__/
+*.py[cod]
+.venv/
+
+
+# Ada/SPARK
+*.ali
+/obj/
+/bin/
+
+
+# Haskell
+/.stack-work/
+/dist-newstyle/
+
+
+# Chapel
+*.chpl.tmp.*
+
+
+# Secrets
+.env
+.env.*
+*.pem
+*.key
+secrets/
+
+
+# Test/Coverage
+/coverage/
+htmlcov/
+
+
+# Logs
+*.log
+/logs/
+
+
+# Machine-readable locks
+.machine_readable/.locks/
+
+
+# Temp
+/tmp/
+*.tmp
+*.bak

.machine_readable/AGENTIC.a2ml .machine_readable/6a2/AGENTIC.a2ml.machine_readable/AGENTIC.a2ml renamed to .machine_readable/6a2/AGENTIC.a2ml

@@ -0,0 +1,26 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Clade declaration — part of the gv-clade-index registry
+# See: https://github.com/hyperpolymath/gv-clade-index
+
+[identity]
+uuid = "84a06742-9413-5581-835c-db6f807c1c4e"
+primary-forge = "github"
+primary-owner = "hyperpolymath"
+canonical-name = "universal-chat-extractor"
+prefixed-name = "ap-universal-chat-extractor"
+
+[clade]
+primary = "ap"
+secondary = []
+assigned = "2026-03-16"
+rationale = ""
+
+[forges]
+github = "hyperpolymath/universal-chat-extractor"
+gitlab = "hyperpolymath/universal-chat-extractor"
+bitbucket = "hyperpolymath/universal-chat-extractor"
+
+[lineage]
+type = "standalone"
+parent = "Chat export/extraction tool"
+born = "2026-03-16"

.machine_readable/ECOSYSTEM.a2ml .machine_readable/6a2/ECOSYSTEM.a2ml.machine_readable/ECOSYSTEM.a2ml renamed to .machine_readable/6a2/ECOSYSTEM.a2ml

@@ -0,0 +1,50 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Trustfile — Integrity and provenance verification
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+
+@abstract:
+Integrity invariants for this repository. These verify that the repo
+has not been tampered with, secrets are not leaked, and provenance
+is traceable.
+@end
+
+## Secrets
+
+### no-secrets-committed
+- description: No credential files in repo
+- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production
+- severity: critical
+
+### no-private-keys
+- description: No private key files committed
+- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ."
+- severity: critical
+
+### no-tokens-in-source
+- description: No hardcoded API tokens in source
+- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ."
+- severity: critical
+
+## Provenance
+
+### author-correct
+- description: Git author matches expected identity
+- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'"
+- severity: warning
+
+### license-content
+- description: LICENSE contains expected identifier
+- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE
+- severity: warning
+
+## Container Security
+
+### container-images-pinned
+- description: Containerfile uses pinned base images
+- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile
+- severity: warning
+
+### no-dockerfile
+- description: No Dockerfile (use Containerfile)
+- run: test ! -f Dockerfile
+- severity: warning