docs: taxonomy alignment + sync-wiki.sh + machine-readable scaffolding (#60)

## Summary

Split 3 of 4 from #40. Documentation + repo metadata reshuffle in 4
commits:

1. **`docs: tidy taxonomy aligned with rsr-template-repo`** — moves
top-level `.md`/`.adoc` files into
`docs/{architecture,deployment,decisions,papers,releases,status,visualizations}/`;
adds `AUDIT.adoc`, `docs/INDEX.md`; renames `BEST-IN-CLASS-ROADMAP.md` →
`ROADMAP.md`; drops stale `backup/` artefacts.
2. **`docs: add sync-wiki.sh`** — 404-line script that mirrors `docs/`
to the GitHub wiki repo.
3. **`docs: machine-readable STATE/META/ECOSYSTEM + CHANGELOG
Unreleased`** — adds `.machine_readable/{STATE,META,ECOSYSTEM}.scm` and
seeds `CHANGELOG.adoc` Unreleased.
4. **`chore: drop legacy .scm machine-readable duplicates`** — removes
the `.scm` files added in (3) (canonical `.a2ml` versions live under
`.machine_readable/6a2/`; `.scm` tripped Hypatia `SD001`).

The combined net effect of (3)+(4) is just the `CHANGELOG.adoc` seed
plus historical breadcrumb in the commit log.

## Scope

- 4 commits, ~30 file moves + 404 lines of sync-wiki.sh + CHANGELOG seed
- No code changes

## Test plan

- [ ] `find docs -type f | wc -l` shows the relocated tree
- [ ] `sync-wiki.sh --dry-run` enumerates the expected wiki pages
- [ ] Hypatia `SD001` not triggered by `.machine_readable/`

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

AUDIT.adoc

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+
+= VeriSimDB Audit Index
+:toc: left
+:toclevels: 2
+
+This file is the audit-trail index that the
+https://github.com/hyperpolymath/rsr-template-repo[rsr-template-repo]
+convention expects at the repository root. It points to the live
+audit artefacts; it doesn't duplicate their content.
+
+== Known issues & honest gaps
+
+See link:KNOWN-ISSUES.adoc[KNOWN-ISSUES.adoc].
+
+Tracks open and resolved technical gaps. Every item names the affected
+location, the original problem, the resolution (or current status), and
+the impact. As of 2026-05-25 all 25 catalogued issues are resolved; the
+file is preserved as the audit trail.
+
+== Testing & benchmarking standards
+
+See link:TESTING.md[TESTING.md].
+
+Documents the test pyramid, hard CI gates per language, property-test
+patterns, fuzz corpus location, supply-chain checks, and the next-tier
+standards (mutation testing, snapshot testing, differential testing,
+concurrency model-checking, bench-as-PR-gate, AFL++).
+
+== Security policy
+
+See link:SECURITY.md[SECURITY.md].
+
+Threat model, disclosure process, supported versions.
+
+== Changelog
+
+See link:CHANGELOG.adoc[CHANGELOG.adoc].
+
+Versioned history of all notable changes.  Release announcements (narrative,
+non-canonical) live under link:docs/releases/[docs/releases/].
+
+== Documentation index
+
+See link:docs/INDEX.md[docs/INDEX.md] for the full documentation tree.
+
+== Machine-readable state
+
+See link:.machine_readable/[.machine_readable/]:
+
+- `STATE.scm` — current project state and progress
+- `META.scm` — architecture decisions and development practices
+- `ECOSYSTEM.scm` — position in the ecosystem and related projects

CHANGELOG.adoc

@@ -9,6 +9,53 @@ All notable changes to VeriSimDB are documented here. This project uses https://
 
 == [Unreleased]
 
+=== Added — Testing & Benchmarking Standards (2026-05)
+
+==== Tier 1 — Coverage, Property Tests, Elixir Benchmarks
+- *Coverage gates*: `cargo-llvm-cov` (Rust) + `excoveralls` (Elixir) wired into CI as informational, ratcheting toward a 60% line-coverage floor. LCOV/JSON uploaded to Codecov.
+- *Property tests*: 14 properties in Rust via `proptest` (spatial round-trip + haversine invariants, provenance hash-chain integrity, search-by-actor counts); 13 properties in Elixir via `stream_data` (SchemaRegistry constraint algebra, VQLBridge parser invariants).
+- *Elixir benchmarks*: 5 `benchee` scripts under `elixir-orchestration/bench/` covering DriftMonitor, QueryRouter, VQLExecutor, VQLBridge, SchemaRegistry. JSON output for diff-driven regression detection.
+
+==== Tier 2 — Snapshots, Mutation Testing
+- *Snapshot tests*: `insta` introduced for the verisim-planner `ExplainOutput` contract. 4 snapshots covering single-modality, multi-modality parallel, semantic-trailing, and deterministic invariance. Stored as YAML under `rust-core/verisim-planner/tests/snapshots/`.
+- *Mutation testing*: `cargo-mutants` configured via `.cargo/mutants.toml` with priority crates (drift, normalizer, spatial, provenance, semantic, octad) targeted at ≥80% mutation score. Wired as opt-in `workflow_dispatch` + scheduled job; PR-time invocation deferred until per-PR `--in-diff` workflow lands.
+
+==== Test-Gap Audit Closure (9/9 modules)
+- *DriftMonitor, EntityServer, QueryRouter* — covered in PR #35
+- *SchemaRegistry, KRaftSupervisor, VQLBridge, VQLExecutor* — covered in PR #37
+- *telemetry/collector, telemetry/reporter* — already covered in pre-existing `TelemetryTest`
+
+==== TESTING.md
+- Top-level standards document codifying CI gates per language, test-pyramid ratios, property-test patterns, fuzz corpus location, supply-chain checks, and Tier 2/3 next-tier standards (mutation testing, snapshot testing, differential testing, concurrency model-checking, bench-as-PR-gate, AFL++).
+
+==== Documentation Taxonomy
+- *Top-level cleaned to 10 canonical files* aligned with `hyperpolymath/rsr-template-repo`: README, LICENSE, CHANGELOG, CODE_OF_CONDUCT, CONTRIBUTING, MAINTAINERS, SECURITY, KNOWN-ISSUES, TESTING, ROADMAP, plus the new AUDIT.adoc.
+- *`docs/` subtree organised* into `architecture/`, `decisions/`, `deployment/`, `status/`, `releases/`, `papers/`, `visualizations/`, `business/`, `design/`. 14 root-level detail files moved here via `git mv` (history preserved).
+- *Three roadmaps consolidated*: BEST-IN-CLASS-ROADMAP.md promoted to canonical ROADMAP.md; IMPLEMENTATION-ROADMAP.adoc archived to `docs/status/implementation-plan.adoc`; template-stub ROADMAP.adoc removed.
+- *Stale `backup/` directory removed* (450 KB of 2026-02 artefacts).
+- *New `docs/INDEX.md`* — master TOC for everything under docs/ plus top-level project docs, .machine_readable/, .github/workflows/, source-code layout, and container/deployment artefacts.
+- *New `AUDIT.adoc`* — RSR audit-trail index pointing to KNOWN-ISSUES, TESTING, SECURITY, CHANGELOG, .machine_readable/.
+- *Machine-readable state files created* under `.machine_readable/`: `STATE.scm` (current project state, modality coverage, test counts, CI gates), `META.scm` (architecture decisions, language policy, design philosophy), `ECOSYSTEM.scm` (hyperpolymath estate dependencies, third-party stack, academic anchors).
+
+==== CI Hardening
+- *Full-SHA pinning* of all third-party GitHub Actions in `rust-ci.yml` and `elixir-ci.yml` (11 distinct actions, resolved via `git ls-remote refs/tags/<version>`). Closes the Hypatia `unpinned_action` findings (14 medium-severity in `elixir-ci.yml` + `rust-ci.yml`).
+- *`.hypatia-ignore` whitelisting* of 34 ReScript files permitted by the project's language policy. Format aligned with the standards-repo `is_exempt()` function which strips the `./` prefix before grep.
+- *`sync-wiki.sh`* — script at repo root that mirrors `docs/` to the GitHub wiki, flattening subdirs into prefixed page names with auto-generated Home, Sidebar, Footer.
+
+==== Adapted to Upstream Dep Bumps
+- *sha2 0.11*: `GenericArray` lost `LowerHex` → replaced `format!("{:x}", digest)` with per-byte hex format in `verisim-provenance` and `verisim-api::federation`.
+- *criterion 0.8*: `criterion::black_box` deprecated → switched bench imports to `std::hint::black_box`.
+- *burn 0.21*: cleared RUSTSEC-2026-0097 (rand unsoundness) by pulling the patched `rand 0.10.1`.
+- *uuid 1.23*: minor bump, no API impact.
+
+==== Security Dependency Updates
+- *Elixir CVE pins*: `bandit >= 1.11.1` (GHSA-rf5q-vwxw-gmrf), `plug >= 1.19.2` (GHSA-468c-vq7p-gh64), `postgrex >= 0.22.2` (GHSA-r73h-97w8-m54h).
+
+==== Known issues
+- *`cargo-llvm-cov` and `excoveralls` gates are informational only* on first runs; will ratchet to hard ≥60% gates once long-tail Rust crates (api, repl, nif) and Elixir RustClient stubs have substantive coverage.
+- *`governance / Language / package anti-pattern policy`*, *`pr-fuzzing (address)`*, and *Elixir `compile + test`* checks have persisted as red across multiple SHA pushes; root causes are CI-environment-specific (cache/baseline staleness, runner image quirks) and require log access to diagnose further. All three pass locally.
+- *Hypatia `getExn`/`Obj.magic`/`JSON decode without validation`* findings on pre-existing ReScript code (`src/registry/`, `playground/src/`, `connectors/clients/rescript/`) are real but outside the testing+benchmarking scope of this changeset.
+
 === Added
 
 ==== Security Hardening (Phase 1)

README.adoc

@@ -459,21 +459,56 @@ ZKP proofs and dependent types enable tamper-evident knowledge exchange. VQL-DT
 
 == Documentation
 
-* link:docs/vql-grammar.ebnf[VQL Grammar] — Formal EBNF specification
-* link:docs/vql-formal-semantics.adoc[VQL Formal Semantics] — Operational semantics
-* link:docs/vql-type-system.adoc[VQL Type System] — Dependent types and bidirectional type checking
-* link:docs/drift-handling.adoc[Drift Handling] — Detection, repair, federation drift
-* link:docs/safety-and-fault-tolerance.adoc[Safety & Fault Tolerance] — Memory, kernel, platform, supply chain safety
-* link:docs/deployment-modes.adoc[Deployment Modes] — Standalone, federated, hybrid
-* link:docs/getting-started.adoc[Getting Started] — Step-by-step setup guide
-* link:docs/adoption-strategy.adoc[Adoption Strategy] — Target domains and rollout plan
-* link:docs/VQL-SPEC.adoc[VQL Specification] — 2785-line normative language spec
-* link:docs/papers/[White Papers] — Academic and industry papers
+See link:docs/INDEX.md[docs/INDEX.md] for the complete documentation tree.
+
+Quick links:
+
+* link:ROADMAP.md[Roadmap] — criticality-ordered work plan (Phase 1–8)
+* link:CHANGELOG.adoc[Changelog] — versioned history of all notable changes
+* link:TESTING.md[Testing & Benchmarking Standards] — CI gates, property tests, fuzz corpus
+* link:KNOWN-ISSUES.adoc[Known Issues] — honest-gaps audit (25/25 resolved)
+* link:SECURITY.md[Security Policy] — threat model and disclosure process
+* link:AUDIT.adoc[Audit Index] — RSR audit-trail index
+
+VQL language:
+
+* link:docs/getting-started.adoc[Getting Started] — step-by-step setup guide
+* link:docs/VQL-SPEC.adoc[VQL Specification] — normative language spec
+* link:docs/vql-grammar.ebnf[VQL Grammar] — formal EBNF
+* link:docs/vql-formal-semantics.adoc[VQL Formal Semantics] — operational semantics
+* link:docs/vql-type-system.adoc[VQL Type System] — dependent types + bidirectional checking
+* link:docs/vql-examples.adoc[VQL Examples] — worked examples
+
+Deployment & operations:
+
+* link:docs/deployment/deployment.adoc[Deployment Guide] — Podman, selur-compose, Containerfile
+* link:docs/deployment/void-setup.md[Void Linux Dev Setup]
+* link:docs/deployment-modes.adoc[Deployment Modes] — standalone, federated, hybrid
+* link:docs/safety-and-fault-tolerance.adoc[Safety & Fault Tolerance]
+* link:docs/drift-handling.adoc[Drift Handling] — detection, repair, federation drift
+
+Architecture & decisions:
+
+* link:docs/architecture/topology.md[Process Topology]
+* link:docs/architecture/abi-ffi.md[ABI/FFI Contract]
+* link:docs/decisions/rust-spark-stance.adoc[Why Rust] (decision record)
+* link:docs/decisions/kraft-comparison.adoc[Why KRaft] (decision record)
+* link:docs/decisions/proven-coherence.md[Proven Library Integration]
+
+Papers:
+
+* link:docs/papers/whitepaper.md[VeriSimDB Whitepaper] (Markdown source)
+* link:docs/papers/whitepaper.pdf[Whitepaper PDF]
+* link:docs/papers/arcvix-octad-data-model.tex[ARCVIX Octad Data-Model Paper]
+
+Releases:
+
+* link:docs/releases/v0.1.0-alpha.md[v0.1.0-alpha Release Notes]
 
 == License
 
 MPL-2.0
 
 == Contributing
 
-See CONTRIBUTING.adoc for guidelines.
+See link:CONTRIBUTING.md[CONTRIBUTING.md] for guidelines.