chore: automated sync of local changes

Author: hyperpolymath

.github/workflows/dogfood-gate.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@main
+        uses: hyperpolymath/a2ml-validate-action@cb3c1e298169dc5ac2b42e257068b0fb5920cd5e
         with:
           path: '.'
           strict: 'false'
@@ -86,7 +86,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        uses: hyperpolymath/k9-validate-action@main
+        uses: hyperpolymath/k9-validate-action@236f0035cc159051c8dd5dc7cd8af1e8cf961462
         with:
           path: '.'
           strict: 'false'

.github/workflows/instant-sync.yml

@@ -30,4 +30,6 @@ jobs:
             }
 
       - name: Confirm
-        run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
+        run: echo "::notice::Propagation triggered for ${REPO_NAME}"

.github/workflows/security-scan.yml

@@ -14,6 +14,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@main
+    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@21fc3f00a088c954912936f4a68970621b82c2e6
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}

.gitignore

@@ -16,6 +16,8 @@ Thumbs.db
 /build/
 /dist/
 /out/
+/connectors/clients/zig/.zig-cache/
+/connectors/clients/zig/zig-out/
 
 # Dependencies
 /node_modules/
@@ -113,3 +115,44 @@ ai-cli-crash-capture/
 
 # ClickHouse backup dumps
 backup/
+
+# ============================================
+# BINARY ARTIFACTS - Scorecard Security Fix
+# ============================================
+
+# Zig build artifacts (resolves Scorecard alerts #10-11)
+/zig-out/
+**/zig-out/
+*.a
+*.so
+
+# Rust build artifacts (resolves Scorecard alerts #12-13)
+*.rlib
+*.dylib
+
+# Elixir NIF binaries
+priv/*.so
+priv/*.dll
+priv/*.exe
+
+# Windows binaries
+*.exe
+*.dll
+
+# macOS binaries
+*.dylib
+
+# JIT compilation
+.jit/
+
+# Pre-built binaries from any source
+*.prebuilt
+*.binary
+
+# Build cache directories
+.cargo/
+**/.cargo/
+
+# ============================================
+# END: Binary Artifacts Section
+# ============================================

.machine_readable/contractiles/README.adoc

@@ -0,0 +1,19 @@
+= Contractiles Template Set
+:toc:
+:sectnums:
+
+This directory contains the generalized contractiles templates. Copy the `.machine_readable/contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework.
+
+== Fill-In Instructions
+
+1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports).
+2. Replace Trustfile.hs placeholders with your actual key paths and verification commands.
+3. Adjust Dustfile handlers to match your rollback and recovery tooling.
+4. Update Intentfile to mirror the roadmap you want the system to evolve toward.
+
+== Contents
+
+* `must/Mustfile` - required invariants and validations.
+* `trust/Trustfile.hs` - cryptographic verification steps.
+* `dust/Dustfile` - rollback and recovery semantics.
+* `lust/Intentfile` - future intent and roadmap direction.

.machine_readable/contractiles/adjust/Adjustfile.a2ml

@@ -0,0 +1,211 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Adjustfile — Accessibility Contract for Burble
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Accessibility requirements and compliance for Burble.
+# Voice-first design must be inclusive for all users.
+#
+# Run with: adjust check
+# Fix with: adjust fix (where deterministic fix exists)
+
+@abstract:
+Accessibility requirements and compliance for the Burble voice-first communications platform.
+These requirements ensure Burble is usable by everyone, regardless of ability.
+@end
+
+## Keyboard Accessibility
+
+### keyboard-navigation
+- description: All features accessible via keyboard
+- status: partial
+- probe: test -f server/lib/burble/accessibility/keyboard.ex
+- compliance: WCAG 2.1 AA
+- notes: Basic navigation implemented. Full keyboard-only flow needed.
+- fix: Port PanLL's comprehensive keyboard navigation system
+
+### custom-keybindings
+- description: User-configurable keybindings
+- status: implemented
+- probe: test -f server/lib/burble/accessibility/keyboard.ex
+- compliance: WCAG 2.1 AAA
+- notes: Users can remap PTT, mute, deafen, volume, and room navigation keys
+
+### keyboard-shortcuts-discoverable
+- description: Keyboard shortcuts are documented and discoverable
+- status: missing
+- compliance: WCAG 2.1 A
+- fix: Add keyboard shortcuts help modal in web client
+
+## Visual Accessibility
+
+### high-contrast-mode
+- description: High contrast UI theme
+- status: missing
+- compliance: WCAG 2.1 AA
+- fix: Port PanLL's high-contrast theme system
+- target: CSS variables for contrast ratios >= 4.5:1
+
+### colorblind-support
+- description: Colorblind-friendly color schemes
+- status: missing
+- compliance: WCAG 2.1 AA
+- fix: Implement deuteranopia, protanopia, and tritanopia palettes
+- reference: PanLL's palette system
+
+### font-size-adjustment
+- description: Resizable UI fonts (4 levels: 14-20px)
+- status: missing
+- compliance: WCAG 2.1 AA
+- fix: Port PanLL's font size adjustment system
+- target: User preference persists across sessions
+
+### theme-switching
+- description: Dark/Light/System theme support
+- status: missing
+- compliance: WCAG 2.1 AA
+- fix: Port PanLL's theme system
+- target: Respects OS preference, user override
+
+## Auditory Accessibility
+
+### screen-reader-support
+- description: Full screen reader compatibility
+- status: partial
+- probe: test -f server/lib/burble/accessibility/screen_reader.ex
+- compliance: WCAG 2.1 AA
+- notes: Basic announcements implemented. Needs ARIA attributes and live regions.
+- fix: Complete ARIA implementation in web client
+
+### closed-captions
+- description: Real-time captioning for voice chat
+- status: missing
+- compliance: WCAG 2.1 AA
+- notes: Requires Web Speech API or external STT integration
+- target: 90%+ accuracy for English, configurable display
+
+### visual-notifications
+- description: Visual indicators for audio events
+- status: missing
+- compliance: WCAG 2.1 A
+- notes: Speaking indicators, mute status, connection status
+- fix: Add visual cues that duplicate audio information
+
+### volume-normalization
+- description: Consistent volume levels across users
+- status: missing
+- compliance: WCAG 2.1 AA
+- notes: Prevents sudden loud sounds for sensitive users
+- target: -23 LUFS normalization per EBU R128
+
+## Motor Accessibility
+
+### voice-commands
+- description: Voice-controlled interface
+- status: missing
+- compliance: WCAG 2.1 AAA
+- notes: "Mute", "Deafen", "Join room X", "Volume up/down"
+- target: Web Speech API with fallback to keyboard
+
+### reduced-motion
+- description: Reduced animation options
+- status: missing
+- compliance: WCAG 2.1 AA
+- fix: Port PanLL's animation control (on/reduced/off)
+- target: Respects prefers-reduced-motion media query
+
+### hover-alternatives
+- description: All hover interactions have click alternatives
+- status: partial
+- compliance: WCAG 2.1 AA
+- notes: Some hover tooltips need click-to-show option
+- fix: Audit and add click alternatives
+
+## Cognitive Accessibility
+
+### clear-language
+- description: Simple, consistent terminology
+- status: partial
+- compliance: WCAG 2.1 AAA
+- notes: Technical terms need plain language explanations
+- fix: Add tooltips/glossary for jargon
+
+### predictable-navigation
+- description: Consistent navigation patterns
+- status: partial
+- compliance: WCAG 2.1 AA
+- notes: Navigation structure varies between pages
+- fix: Standardize navigation layout
+
+### error-prevention
+- description: Confirmation for destructive actions
+- status: partial
+- compliance: WCAG 2.1 AA
+- notes: Room deletion has confirmation, others may not
+- fix: Audit all destructive actions
+
+### help-availability
+- description: Context-sensitive help always available
+- status: missing
+- compliance: WCAG 2.1 AAA
+- notes: No persistent help system
+- fix: Add help button with contextual guidance
+
+## Compliance Targets
+
+### wcag-2.1-aa
+- description: WCAG 2.1 AA compliance
+- status: partial
+- target: Full compliance by Q4 2026
+- tracking: https://github.com/hyperpolymath/burble/issues/XXX
+
+### section-508
+- description: U.S. Section 508 compliance
+- status: partial
+- target: Full compliance by Q4 2026
+- notes: Aligns with WCAG 2.1 AA for most requirements
+
+### en-301-549
+- description: EU EN 301 549 compliance
+- status: partial
+- target: Full compliance by Q4 2026
+- notes: EU public sector procurement requirement
+
+## Integration Requirements
+
+### panll-accessibility-port
+- description: Port PanLL's accessibility engine to Burble
+- status: planned
+- reference: /var/mnt/eclipse/repos/panll/tests/accessibility_engine_test.js
+- target: Q2 2026
+
+### k9-accessibility-validator
+- description: Integrate K9 accessibility validator
+- status: planned
+- reference: /var/mnt/eclipse/repos/panll/contractiles/k9/validators/accessibility-baseline.k9.ncl
+- target: Q2 2026
+
+### accessibility-testing
+- description: Add accessibility tests to CI/CD
+- status: planned
+- target: pa11y or axe-core integration
+- compliance: Automated WCAG testing
+
+## Documentation Requirements
+
+### accessibility-guide
+- description: User-facing accessibility guide
+- status: missing
+- target: docs/accessibility/USER-GUIDE.adoc
+- notes: Keyboard shortcuts, screen reader setup, theme switching
+
+### developer-accessibility
+- description: Developer accessibility guidelines
+- status: missing
+- target: docs/accessibility/DEVELOPER.adoc
+- notes: Coding standards, testing requirements, compliance checklist
+
+### compliance-report
+- description: Accessibility compliance report
+- status: missing
+- target: docs/compliance/ACCESSIBILITY.adoc
+- notes: VPAT (Voluntary Product Accessibility Template)

.machine_readable/contractiles/dust/Dustfile.a2ml

@@ -0,0 +1,78 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Dustfile — Cleanup and hygiene contract for Burble
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# What should be cleaned up. Housekeeping, not blockers.
+# Run with: dust status
+# Roll back with: dust rollback <name>
+
+@abstract:
+Cleanup and hygiene items for the Burble voice platform.
+These are maintenance tasks — not blocking, but should be addressed.
+@end
+
+## Stale Files
+
+### no-stale-snapshots
+- description: No dated status/completion files in root
+- run: test -z "$(ls *-STATUS-*.md *-COMPLETION-*.md 2>/dev/null)"
+- severity: info
+
+### no-ai-djot
+- description: AI.djot is superseded by 0-AI-MANIFEST.a2ml
+- run: test ! -f AI.djot
+- severity: warning
+
+### no-next-steps
+- description: NEXT_STEPS.md superseded by ROADMAP
+- run: test ! -f NEXT_STEPS.md
+- severity: info
+
+## Build Artifacts
+
+### no-tracked-elixir-build
+- description: No Elixir build artifacts tracked in git
+- run: test -z "$(git ls-files server/_build/ server/deps/ 2>/dev/null)"
+- severity: warning
+
+### no-tracked-rescript-build
+- description: No ReScript build artifacts tracked in git
+- run: test -z "$(git ls-files 'client/web/src/**/*.res.mjs' client/web/lib/ 2>/dev/null)"
+- severity: warning
+
+## Burble-Specific Cleanup
+
+### stale-room-processes
+- description: Room processes should auto-terminate after idle timeout
+- verification: Burble.Rooms.Room uses @idle_timeout_ms (5 minutes)
+- severity: info
+- notes: Not a file check — design verification that idle rooms are cleaned up
+
+### expired-invite-tokens
+- description: Expired invite tokens should be purged periodically
+- verification: Scheduled task purges tokens past expires_at
+- severity: info
+- notes: Planned — not yet implemented
+
+### orphaned-turn-credentials
+- description: TURN credentials expire after 1 hour
+- verification: Burble.Media.Privacy.generate_turn_credential sets TTL
+- severity: info
+
+### template-example-trustfile
+- description: Remove the example Trustfile (keep only the real one)
+- run: test ! -f .machine_readable/contractiles/trust/Trustfile_just_an_example.a2ml
+- severity: info
+- rollback: git checkout HEAD -- .machine_readable/contractiles/trust/Trustfile_just_an_example.a2ml
+
+## Format Duplicates
+
+### no-duplicate-contributing
+- description: Only one CONTRIBUTING format
+- run: test -z "$(test -f CONTRIBUTING.md && test -f CONTRIBUTING.adoc && echo dup)"
+- severity: warning
+
+### no-duplicate-readme
+- description: Only one README format
+- run: test ! -f README.md || test ! -f README.adoc
+- severity: warning