fix(ci): green the remaining gates and rebuild the config files honestly (#130)

Follow-on to #129. That PR made the two dead gates *run*; this one makes
the remaining four checks *pass*, and replaces four config files that a
sweep had overwritten with generic estate boilerplate.

## Gates

### Rust CI — `clippy -D warnings` (was exit 101)

~32 lints. Most came straight from `cargo clippy --fix`. Two groups
needed judgement:

- **19 × `&[x.clone()]` → `std::slice::from_ref(&x)`** — single-element
slices; drops a needless clone.
- **5 × `clippy::approx_constant` — a false positive.** Every hit is the
literal `3.14` used as arbitrary decimal test data: `abs(-3.14) ==
3.14`, a JSON float round-trip, a channel send/receive. None of them
mean π. Substituting `std::f64::consts::PI` would change what the tests
assert, so the test modules carry a narrowly scoped `#[allow]` with the
reason written beside it.

**This failure was masking three other jobs.** `Cargo audit`, `Cargo
test` and `Coverage` were all `skipped` behind it. Tests now actually
run: **236 pass, 0 fail.**

### Cargo Audit + Security — RUSTSEC-2026-0190

Both were red on the same advisory (unsoundness in `anyhow`'s
`Error::downcast_mut()`).

The plan was a time-boxed `audit.toml` ignore. It turned out not to be
needed: `anyhow` is transitive and **1.0.104 is released**, so this is a
real fix. Bumped `1.0.102 → 1.0.104`; `cargo audit -D warnings` now
exits 0. **No suppression file added.**

### ClusterFuzzLite — `open Dockerfile: no such file or directory`

`.clusterfuzzlite/` holds a `Containerfile` per the estate's
podman-first naming, but ClusterFuzzLite hardcodes
`.clusterfuzzlite/Dockerfile`. Added `Dockerfile` as a **symlink** to
`Containerfile` (git mode `120000`), so the tool finds the name it
demands while the estate convention remains the single source of truth.

## Config files

These carried generic multi-language boilerplate that didn't describe
this repo — and in two cases actively contradicted it.

| File | What was wrong |
|---|---|
| `mise.toml` | `rust = "latest"` **against** `rust-toolchain.toml`'s
deliberate `1.96.0` pin; declared
node/python/go/java/bun/npm/yarn/pnpm/pip — **all BANNED by this repo's
own `.claude/CLAUDE.md`**; `[alias]` chained `cargo test \|\| npm test
\|\| go test ./...` |
| `.tool-versions` | `rust stable` — same contradiction |
| `.editorconfig` | Covered Elixir/ReScript/Zig/Ada; **omitted Lean,
Coq, ocamllex/menhir and `.woke`/`.wl`** |
| `.gitattributes` | Same — absent languages in, present languages out |
| `.gitignore` | Cruft for absent languages; missing `*.olean`,
`*.ilean`, `.lake/`, Idris `*.ttc` |
| `guix.scm` | Licence field that **could never have evaluated** |

Two of these deserve spelling out.

**The `mise.toml` alias block was a fake gate by construction.** `test =
"cargo test || npm test || go test ./..."` converts a genuine `cargo
test` failure into an attempt at two toolchains that don't exist here.
The pin contradiction matters for the same reason: `rust-toolchain.toml`
documents that a drifting `stable` once broke *this very clippy gate*
with lints local clippy couldn't see.

**`guix.scm`'s licence was broken two ways:**

```scheme
(license ((@@ (guix licenses) license) "MPL-2.0" "..."))
```

`@@` reaches into a **non-exported** binding, and the `license` record
constructor takes three fields but was given two. Because guix isn't
installed on the development host, nothing ever evaluated this file and
the fault sat unnoticed. Now `(license mpl2.0)` — what `(guix licenses)`
actually exports. Confirmed the file parses under guile and that the old
form raises `unbound-variable`.

`.gitignore` was checked both directions: no currently tracked file
becomes ignored, and the tracked `examples/math.wasm` fixture is
explicitly re-included.

## Verified locally

```
cargo clippy --workspace --all-targets -- -D warnings   PASS
cargo fmt --all -- --check                              PASS
cargo test --workspace                                  PASS (236 tests)
cargo audit -D warnings                                 PASS
guix.scm parses under guile                             PASS
all 22 workflows structurally valid for Actions         PASS
no tracked file newly ignored                           PASS
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.clusterfuzzlite/Dockerfile

@@ -0,0 +1 @@
+Containerfile

.editorconfig

@@ -1,13 +1,68 @@
 # SPDX-License-Identifier: MPL-2.0
-# .editorconfig — RSR standard editor configuration
+# .editorconfig — editor settings for the languages this repository actually
+# contains. Deliberately not a generic estate template: the sections below
+# track `git ls-files`, so a language that is not present does not get a rule.
 
 root = true
 
 [*]
-indent_style = space
-indent_size = 2
 charset = utf-8
 end_of_line = lf
-trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
 insert_final_newline = true
+trim_trailing_whitespace = true
+
+# Trailing whitespace is significant here (Markdown hard line breaks,
+# AsciiDoc continuations), so leave it alone.
+[*.{md,adoc}]
+trim_trailing_whitespace = false
+
+# ── WokeLang itself ────────────────────────────────────────────────────────
+[*.{woke,wl}]
+indent_size = 4
 
+[*.ebnf]
+indent_size = 2
+
+# ── Rust: the primary toolchain (src/) ─────────────────────────────────────
+[*.rs]
+indent_size = 4
+
+# ── OCaml: the reference core (core/), incl. ocamllex/menhir ───────────────
+[*.{ml,mli,mll,mly}]
+indent_size = 2
+
+[{dune,dune-project,*.opam}]
+indent_size = 1
+
+# ── Proof assistants ───────────────────────────────────────────────────────
+[*.lean]
+indent_size = 2
+
+[*.v]
+indent_size = 2
+
+[*.{idr,ipkg}]
+indent_size = 2
+
+# ── Configuration and data ─────────────────────────────────────────────────
+[*.{toml,yml,yaml,json,jsonl,ncl,a2ml}]
+indent_size = 2
+
+# Guile / Guix
+[*.scm]
+indent_size = 2
+
+# ── Shell, recipes, TeX ────────────────────────────────────────────────────
+[*.sh]
+indent_size = 2
+
+[{Justfile,Mustfile,*.just}]
+indent_size = 4
+
+[Makefile]
+indent_style = tab
+
+[*.{tex,bib}]
+indent_size = 2

.gitattributes

@@ -1,48 +1,70 @@
 # SPDX-License-Identifier: MPL-2.0
+# .gitattributes — line-ending normalisation, diff drivers and linguist hints
+# for the languages this repository actually contains. Entries track
+# `git ls-files`; absent languages (Elixir, ReScript, TypeScript, Zig) are not
+# listed, and languages that were missing (Lean, ocamllex/menhir, WokeLang's
+# own sources) now are.
 
-# Auto detect text files and perform LF normalization
-* text=auto
-
-# Source code
-*.rs text eol=lf diff=rust
-*.ex text eol=lf diff=elixir
-*.exs text eol=lf diff=elixir
-*.ml text eol=lf diff=ocaml
-*.mli text eol=lf diff=ocaml
-*.res text eol=lf diff=javascript
-*.resi text eol=lf diff=javascript
-*.ts text eol=lf diff=typescript
-*.js text eol=lf diff=javascript
-*.idr text eol=lf
-*.v text eol=lf
-*.zig text eol=lf
-
-# Configuration
-*.toml text eol=lf
-*.json text eol=lf
-*.yml text eol=lf
-*.yaml text eol=lf
-*.scm text eol=lf linguist-language=Scheme
-
-# Documentation
-*.md text eol=lf diff=markdown
-*.adoc text eol=lf
-*.txt text eol=lf
-
-# Scripts
-*.sh text eol=lf
-*.bash text eol=lf
-
-# Build artifacts (binary)
-*.wasm binary
-*.rlib binary
-*.beam binary
-*.so binary
-*.dylib binary
-*.dll binary
-*.exe binary
-
-# Lock files (generated)
+# Normalise everything to LF in the repository.
+* text=auto eol=lf
+
+# ── WokeLang itself ────────────────────────────────────────────────────────
+# Report the project's own sources as its own language rather than letting
+# linguist guess from the extension.
+*.woke  text eol=lf linguist-language=WokeLang
+*.wl    text eol=lf linguist-language=WokeLang
+*.ebnf  text eol=lf
+
+# ── Rust: the primary toolchain (src/) ─────────────────────────────────────
+*.rs    text eol=lf diff=rust
+
+# ── OCaml: the reference core (core/) ──────────────────────────────────────
+*.ml    text eol=lf diff=ocaml
+*.mli   text eol=lf diff=ocaml
+*.mll   text eol=lf linguist-language=OCaml
+*.mly   text eol=lf linguist-language=OCaml
+*.opam  text eol=lf
+
+# ── Proof assistants ───────────────────────────────────────────────────────
+*.lean  text eol=lf linguist-language=Lean
+*.v     text eol=lf linguist-language=Coq
+*.idr   text eol=lf linguist-language=Idris
+*.ipkg  text eol=lf
+
+# ── Configuration and data ─────────────────────────────────────────────────
+*.toml  text eol=lf
+*.json  text eol=lf
+*.jsonl text eol=lf
+*.yml   text eol=lf
+*.yaml  text eol=lf
+*.ncl   text eol=lf
+*.a2ml  text eol=lf
+*.scm   text eol=lf linguist-language=Scheme
+
+# ── Documentation ──────────────────────────────────────────────────────────
+*.md    text eol=lf diff=markdown
+*.adoc  text eol=lf
+*.txt   text eol=lf
+*.tex   text eol=lf
+*.bib   text eol=lf
+
+# Documentation is not the project's language for linguist's purposes.
+docs/**     linguist-documentation
+wiki/**     linguist-documentation
+site/**     linguist-documentation
+
+# ── Scripts ────────────────────────────────────────────────────────────────
+*.sh    text eol=lf
+*.bash  text eol=lf
+
+# ── Binary ─────────────────────────────────────────────────────────────────
+*.wasm    binary
+*.rlib    binary
+*.so      binary
+*.dylib   binary
+*.dll     binary
+*.exe     binary
+*.bundle  binary
+
+# ── Generated ──────────────────────────────────────────────────────────────
 Cargo.lock linguist-generated=true
-package-lock.json linguist-generated=true
-mix.lock linguist-generated=true

.gitignore

@@ -21,17 +21,11 @@ build/
 *.ibc
 
 # Zig
-**/zig-out/
-**/.zig-cache/
 
 # ReScript
-/lib/bs/
-/.bsb.lock
 
 # Dependencies
-/node_modules/
 /vendor/
-/deps/
 
 # Secrets
 .env
@@ -78,9 +72,23 @@ editors/vscode/lib/
 # OS
 .Trash-*/
 target/
-node_modules/
 _build/
-deps/
-.elixir_ls/
 .cache/
 dist/
+
+# ── Proof-assistant build artefacts ────────────────────────────────────────
+# Lean 4 (docs/proofs/verification/) — the .lean sources are tracked, the
+# compiled forms are not.
+*.olean
+*.ilean
+*.trace
+.lake/
+
+# Idris 2
+*.ibc
+*.ttc
+*.ttm
+
+# ── Exceptions ─────────────────────────────────────────────────────────────
+# `*.wasm` is ignored above, but this one is a tracked example fixture.
+!examples/math.wasm

.tool-versions

@@ -1,3 +1,17 @@
 # SPDX-License-Identifier: MPL-2.0
-# asdf version manager configuration
-rust stable
+# asdf / mise tool versions.
+#
+# Rust is pinned to the SAME version as rust-toolchain.toml. That file
+# documents why the pin exists: when a developer's `stable` lagged CI's,
+# clippy versions diverged (1.94 local vs 1.96 CI) and the `-D warnings` gate
+# failed on main with lints local clippy could not see. Declaring `stable`
+# here silently reintroduced exactly that drift, so bump the two together.
+rust 1.96.0
+
+# OCaml builds the reference core under core/ via dune + menhir.
+# Lower bound comes from wokelang.opam ("ocaml" {>= "4.14"}).
+ocaml 4.14.2
+
+# Lean is pinned separately by docs/proofs/verification/lean-toolchain
+# (leanprover/lean4:v4.30.0), which the lean-proofs workflow reads directly.
+# It is deliberately not duplicated here, so there is one source of truth.

Cargo.lock

@@ -11,8 +11,22 @@
   (version "0.1.0")
   (source #f)
   (build-system gnu-build-system)
-  (synopsis "wokelang")
-  (description "wokelang — part of the hyperpolymath ecosystem.")
+  (synopsis "A human-centred, consent-driven programming language")
+  (description
+   "WokeLang is a statically typed programming language whose type system
+discharges consent and affine-use reasoning, so destructive operations are
+scaffolded at the language level rather than by convention.  The primary
+toolchain is written in Rust; a smaller OCaml reference core cross-checks the
+semantics.")
   (home-page "https://github.com/hyperpolymath/wokelang")
-  (license ((@@ (guix licenses) license) "MPL-2.0"
-             "https://github.com/hyperpolymath/palimpsest-license")))
+  ;; Code is MPL-2.0 (documentation is CC-BY-SA-4.0, see LICENSES/).
+  ;;
+  ;; This previously read:
+  ;;   (license ((@@ (guix licenses) license) "MPL-2.0" "…"))
+  ;; which was broken two ways: `@@` reaches into a NON-EXPORTED binding of
+  ;; (guix licenses), and the `license` record constructor takes three fields
+  ;; (name uri comment) but was given two. Since guix is not installed on the
+  ;; development host, nothing ever evaluated this file and the fault went
+  ;; unnoticed. `mpl2.0` is exported by (guix licenses) and is the correct
+  ;; spelling.
+  (license mpl2.0))

guix.scm

@@ -1,57 +1,27 @@
-[tools]
-# Language runtimes
-node = "latest"
-python = "latest"
-rust = "latest"
-go = "latest"
-zig = "latest"
-java = "latest"
-bun = "latest"
-denojs = "latest"
-
-# Package managers
-npm = "latest"
-yarn = "latest"
-pnpm = "latest"
-pip = "latest"
-cargo = "latest"
-go-task = "latest"
-
-# Formatting & Linting
-gofmt = "latest"
-black = "latest"
-isort = "latest"
-ruff = "latest"
-prettier = "latest"
-shfmt = "latest"
-stylua = "latest"
-
-# Build tools
-cmake = "latest"
-make = "latest"
-ninja = "latest"
+# SPDX-License-Identifier: MPL-2.0
+# mise configuration.
+#
+# This file previously carried a generic estate template that was wrong for
+# this repository in three ways, all of which mattered:
+#
+#   1. `rust = "latest"` contradicted rust-toolchain.toml, which pins 1.96.0
+#      precisely because a drifting `stable` broke the clippy `-D warnings`
+#      gate on main with lints local clippy could not see.
+#   2. It declared node, python, go, java, bun, npm, yarn, pnpm and pip —
+#      every one of which is on the BANNED list in this repo's own
+#      .claude/CLAUDE.md language policy.
+#   3. Its [alias] block chained fallbacks, e.g.
+#        test = "cargo test || npm test || go test ./..."
+#      which converts a genuine `cargo test` failure into an attempt at two
+#      more toolchains that do not exist here — a fake gate by construction.
+#
+# Tool versions live in .tool-versions (which mise reads natively); the Rust
+# compiler is owned by rust-toolchain.toml and Lean by
+# docs/proofs/verification/lean-toolchain. Nothing is duplicated here, so
+# there is exactly one source of truth per toolchain.
+#
+# Real entry points are `just` recipes in the Justfile — not aliases here.
 
-# Shell tools
-git = "latest"
-gnu-sed = "latest"
-gnu-tar = "latest"
-gnu-grep = "latest"
-
-# Testing
-vitest = "latest"
-pytest = "latest"
-jest = "latest"
-
-[env]
-# Common environment variables
-NODE_ENV = "development"
-PYTHONDONTWRITEBYTECODE = "1"
-PYTHONUNBUFFERED = "1"
-
-# Task runner alias
-[alias]
-task = "go-task"
-build = "cargo build --release || npm run build || go build"
-test = "cargo test || npm test || go test ./..."
-lint = "ruff check . || prettier --check . || black --check ."
-fmt = "ruff format . || prettier --write . || black ."
+[tools]
+# Intentionally empty: see .tool-versions, rust-toolchain.toml and
+# docs/proofs/verification/lean-toolchain.

mise.toml

@@ -400,7 +400,7 @@ mod tests {
         let mut caps = test_caps();
         let arr = Value::Array(vec![Value::Int(1), Value::Int(2), Value::Int(3)]);
 
-        if let Value::Okay(v) = first(&[arr.clone()], &mut caps).unwrap() {
+        if let Value::Okay(v) = first(std::slice::from_ref(&arr), &mut caps).unwrap() {
             assert_eq!(*v, Value::Int(1));
         }