chore(machine-readable): populate bot_directives (was a dangling symlink)

The root .bot_directives symlink -> .machine_readable/bot_directives pointed at a missing
directory. Create it with README + hypatia/gitbot-fleet/git-private-farm directives
grounded in the real workflows + .hypatia bot names (no fabricated endpoints/tokens).

https://claude.ai/code/session_013wg3Mtq2QFhYi4XVw1Z6z7

Author: claude

.machine_readable/bot_directives/README.adoc

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: MPL-2.0
+// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= Bot Directives
+:toc: preamble
+:icons: font
+
+Fleet-specific directives for the automation bots that operate on this
+repository. These files declare *what each bot is allowed and expected to do
+here* — they are the per-repo constraint surface for the hyperpolymath
+automation fleet.
+
+The repository root exposes this directory through the `.bot_directives`
+symlink (`.bot_directives` → `.machine_readable/bot_directives`).
+
+[NOTE]
+====
+These directives are *declarative constraint stubs*. They name the hook and its
+purpose and set repo-local policy; they intentionally contain *no endpoints,
+credentials, or tokens*. Concrete bot configuration (URLs, secrets, schedules)
+is supplied by the fleet's own infrastructure, not committed here.
+====
+
+== Relationship to other agent files
+
+(See `.machine_readable/agent_instructions/README.adoc`.)
+
+* `AGENTIC.a2ml` — WHAT agents can do (permissions, gating).
+* `agent_instructions/` — HOW agents should work (methodology).
+* `bot_directives/` — what the *gitbot-fleet and automation bots* do here
+  (this directory).
+* `CLAUDE.md` — how Claude specifically should work (Claude-specific).
+
+== Files
+
+[cols="1,3", options="header"]
+|===
+| File | Bot / fleet
+
+| `hypatia.a2ml`
+| Hypatia neurosymbolic security scanner (the `hypatia-scan` CI gate and the
+  `hypatia-autofix` bot).
+
+| `gitbot-fleet.a2ml`
+| The estate gitbot / agent fleet that operates across repositories.
+
+| `git-private-farm.a2ml`
+| The private mirror / build farm that propagates and builds the repository.
+|===
+
+== Invariants binding on every bot
+
+* Honour the Hyperpolymath Standard language policy (no banned languages).
+* Never introduce proof / unsafe escape hatches (`believe_me`, `assert_total`,
+  `sorry`, `Admitted`, `unsafeCoerce`, `Obj.magic`).
+* Never weaken the consent / affine-safety guarantees the type checker enforces.
+* Keep machine-readable files under `.machine_readable/` only.
+* Preserve SPDX `MPL-2.0` headers on all files.
+* Open changes as reviewable pull requests; do not force-push to the default
+  branch.

.machine_readable/bot_directives/git-private-farm.a2ml

@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# git-private-farm.a2ml — directive for the private mirror / build farm on this
+# repository. The farm mirrors the repository to estate-private infrastructure
+# and runs reproducible builds there.
+
+[metadata]
+bot = "git-private-farm"
+project = "wokelang"
+version = "0.1.0"
+last-updated = "2026-06-12"
+
+[hook]
+# The farm is driven by the mirror / sync / publish workflows.
+related-workflows = [
+  ".github/workflows/mirror.yml",        # mirror the repository
+  ".github/workflows/instant-sync.yml",  # propagate changes on push
+  ".github/workflows/ghcr-publish.yml",  # publish the container image
+  ".github/workflows/boj-build.yml",     # SSG / publish build (boj-server trigger)
+]
+build-tooling = ["cargo", "dune", "podman"]   # Rust + OCaml + container builds
+
+[purpose]
+summary = "Private mirroring and reproducible builds of the repository."
+responsibilities = [
+  "mirror the public repository to estate-private hosting",
+  "run reproducible builds (Guix primary, Nix fallback) of the toolchain",
+  "build and publish the container image (Containerfile / stapeln.toml)",
+  "keep the private mirror in sync with the default branch",
+]
+
+[direction]
+# The farm consumes this repo; it does not write source changes back.
+flow = "outbound-mirror"          # public repo -> private farm
+writes-back-to-public = false
+
+[constraints]
+reproducible-builds = true        # guix.scm primary; flake.nix fallback
+preserve-spdx-headers = true
+no-secrets-in-image = true        # no credentials baked into published images
+sha-pinned-dependencies = true
+https-only = true
+
+[notes]
+# Private endpoints, registry coordinates, and credentials live in the farm
+# infrastructure, NOT in this file. This directive only declares repo-local
+# scope and the build/mirror policy the farm must honour.

.machine_readable/bot_directives/gitbot-fleet.a2ml

@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# gitbot-fleet.a2ml — directive for the hyperpolymath gitbot / agent fleet on
+# this repository. The fleet is the estate's automation that operates across
+# repositories (housekeeping, governance sync, dependency hygiene, label and
+# issue triage).
+
+[metadata]
+bot = "gitbot-fleet"
+project = "wokelang"
+version = "0.1.0"
+last-updated = "2026-06-12"
+
+[hook]
+# The fleet acts through pull requests and issue actions on this repo.
+mechanism = "pull-request"
+governance-upstream = "hyperpolymath/standards"   # reusable workflows + policy
+related-workflows = [
+  ".github/workflows/governance.yml",
+  ".github/workflows/workflow-linter.yml",
+]
+
+[purpose]
+summary = "Cross-repository automation and governance synchronisation."
+responsibilities = [
+  "keep CI thin-wrapper reusables in sync with hyperpolymath/standards",
+  "repository hygiene (stale references, empty files, formatting)",
+  "issue / label triage and cross-repo coordination",
+  "open maintenance PRs (never direct pushes to the default branch)",
+]
+
+[permissions]
+can-open-pull-requests = true
+can-comment-on-issues = true
+can-push-to-default-branch = false
+can-edit-source = false           # source changes go through human-reviewed PRs
+can-edit-machine-readable = false # .machine_readable/ is maintainer-curated
+
+[constraints]
+respect-language-policy = true    # Hyperpolymath Standard allowed/banned set
+respect-contractiles = true       # must / trust / dust / bust
+require-dogfood-gate-green = true  # changes must keep the dogfooding gate passing
+preserve-spdx-headers = true
+no-secrets-in-commits = true
+
+[notes]
+# Fleet identity, tokens, and scheduling are managed by the fleet infrastructure
+# and are NOT committed here. This file is the repo-local scope/policy surface.

.machine_readable/bot_directives/hypatia.a2ml

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# hypatia.a2ml — directive for the Hypatia security bot on this repository.
+# Hypatia is the estate's neurosymbolic security scanner. It runs as the
+# `hypatia-scan` CI gate and the `hypatia-autofix` bot.
+
+[metadata]
+bot = "hypatia"
+project = "wokelang"
+version = "0.1.0"
+last-updated = "2026-06-12"
+
+[hook]
+# CI gate workflow that invokes Hypatia.
+ci-workflow = ".github/workflows/hypatia-scan.yml"
+# Local activity ledger Hypatia writes to (see repo root).
+activity-log = ".hypatia/activity.jsonl"
+last-visit = ".hypatia/last-visit.json"
+agents = ["hypatia-scan", "hypatia-autofix"]
+
+[purpose]
+summary = "Symbolic / neurosymbolic security scanning of the repository."
+scans = [
+  "banned-language patterns (Hyperpolymath Standard policy)",
+  "dangerous / unsafe usage in Rust",
+  "proof escape hatches (believe_me, assert_total, sorry, Admitted, unsafeCoerce, Obj.magic)",
+  "secret / credential leakage (complements secret-scanner)",
+]
+
+[autofix-policy]
+# hypatia-autofix may propose fixes, but only within these bounds.
+mode = "propose"                 # propose | apply
+allow-source-edits = false       # never silently edit src/ — open a PR instead
+open-pull-request = true
+require-human-review = true
+never-touch = [
+  ".machine_readable/",          # machine state is maintainer-curated
+  "LICENSE", "NOTICE", "LICENSES/",
+]
+
+[constraints]
+# Hard invariants Hypatia must not violate.
+must-not-weaken-consent-safety = true
+must-not-add-escape-hatches = true
+must-preserve-spdx-headers = true
+fail-closed = true               # a scan error blocks, it does not pass silently
+
+[notes]
+# Endpoints and credentials are supplied by the Hypatia service, not committed here.
+# This directive only declares repo-local scope and policy.