CI/CD gate: fix red gates at root (tests, opam, governance) + reconcile branches

.claude/CLAUDE.md

@@ -4,14 +4,19 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 ## Machine-Readable Artefacts
 
-The following files in `.machine_readable/` contain structured project metadata:
-
-- `STATE.scm` - Current project state and progress
-- `META.scm` - Architecture decisions and development practices
-- `ECOSYSTEM.scm` - Position in the ecosystem and related projects
-- `AGENTIC.scm` - AI agent interaction patterns
-- `NEUROSYM.scm` - Neurosymbolic integration config
-- `PLAYBOOK.scm` - Operational runbook
+The following files in `.machine_readable/6a2/` contain structured project metadata
+(a2ml form; converted from the original `.scm` sources):
+
+- `6a2/STATE.a2ml` - Current project state and progress
+- `6a2/META.a2ml` - Architecture decisions and development practices
+- `6a2/ECOSYSTEM.a2ml` - Position in the ecosystem and related projects
+- `6a2/AGENTIC.a2ml` - AI agent interaction patterns
+- `6a2/NEUROSYM.a2ml` - Neurosymbolic integration config
+- `6a2/PLAYBOOK.a2ml` - Operational runbook
+
+Also: `anchors/ANCHOR.a2ml` (canonical identity), `contractiles/{must,trust,dust,bust}/`
+(contract files), `svc/k9/` (self-validation), `bot_directives/` (fleet/hypatia hooks),
+and `0-AI-MANIFEST.a2ml` at repo root (AI entry point — read first).
 
 ---
 

.clusterfuzzlite/Containerfile

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:73c1d5648db54100639339d411a5d192cbc8bf413ee91e843a07cf6f0e319dc7
 
 COPY . $SRC/wokelang

.clusterfuzzlite/build.sh

@@ -1,5 +1,5 @@
 #!/bin/bash -eu
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 cd $SRC/wokelang
 cargo +nightly fuzz build
 for target in $(cargo +nightly fuzz list); do

.github/workflows/dogfood-gate.yml

@@ -39,7 +39,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@6bff6ec134fc977e86d25166a5c522ddea5c1e78 # main
+        uses: hyperpolymath/a2ml-validate-action@d95da62b50b26e7fef64aaba44e28ef92a56b476 # main (repinned 2026-06-12: 6bff6ec startup-failed the gate)
         with:
           path: '.'
           strict: 'false'
@@ -88,7 +88,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        uses: hyperpolymath/k9-validate-action@2d96f43c538964b097d159ed3a56ba5b5ceca227 # main
+        uses: hyperpolymath/k9-validate-action@0cd8a79e579a3b5d93d4d5fe114d8f099d5549c9 # main (repinned 2026-06-12 to live HEAD)
         with:
           path: '.'
           strict: 'false'
@@ -261,28 +261,30 @@ jobs:
 
           echo "has_manifest=true" >> "$GITHUB_OUTPUT"
 
-          # Validate TOML structure using Python 3.11+ tomllib
+          # Validate TOML structure using Python 3.11+ tomllib.
+          # NOTE: the -c body MUST stay indented inside this `run: |` block scalar.
+          # A prior flush-left version was invalid YAML and startup-failed the gate.
           python3 -c "
-import tomllib, sys
-with open('eclexiaiser.toml', 'rb') as f:
-    data = tomllib.load(f)
-project = data.get('project', {})
-if not project.get('name', '').strip():
-    print('ERROR: project.name is required', file=sys.stderr)
-    sys.exit(1)
-functions = data.get('functions', [])
-if not functions:
-    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
-    sys.exit(1)
-for fn in functions:
-    if not fn.get('name', '').strip():
-        print('ERROR: function name cannot be empty', file=sys.stderr)
-        sys.exit(1)
-    if not fn.get('source', '').strip():
-        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)
-        sys.exit(1)
-print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')
-" || {
+          import tomllib, sys
+          with open('eclexiaiser.toml', 'rb') as f:
+              data = tomllib.load(f)
+          project = data.get('project', {})
+          if not project.get('name', '').strip():
+              print('ERROR: project.name is required', file=sys.stderr)
+              sys.exit(1)
+          functions = data.get('functions', [])
+          if not functions:
+              print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
+              sys.exit(1)
+          for fn in functions:
+              if not fn.get('name', '').strip():
+                  print('ERROR: function name cannot be empty', file=sys.stderr)
+                  sys.exit(1)
+              if not fn.get('source', '').strip():
+                  print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)
+                  sys.exit(1)
+          print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')
+          " || {
             echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"
             exit 1
           }

.github/workflows/scorecard.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: Scorecards supply-chain security
 on:
   branch_protection_rule:

.github/workflows/secret-scanner.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: Secret Scanner
 on:
   pull_request:

.machine_readable/6a2/ECOSYSTEM.a2ml

@@ -1,10 +1,43 @@
 # SPDX-License-Identifier: MPL-2.0
 # ECOSYSTEM.a2ml — Ecosystem position
-# Converted from ECOSYSTEM.scm on 2026-03-15
+# Converted from ECOSYSTEM.scm on 2026-03-15; enriched 2026-06-12.
+# Relationships, dependencies, integration points.
 
 [metadata]
 project = "wokelang"
 ecosystem = "hyperpolymath"
+version = "0.1.0"
+last-updated = "2026-06-12"
+
+[project]
+name = "wokelang"
+purpose = "A human-centered, consent-driven programming language whose type system discharges consent / affine-use safety automatically"
+role = "language"  # e.g. language, ffi-infrastructure, cli-tool, library, service
 
 [position]
 type = "component"
+
+[position-in-ecosystem]
+tier = "1"  # 1 | 2 | infrastructure
+notes = "wokelang is a standalone language in the hyperpolymath estate, distinct from the estate-primary AffineScript / my-lang. It consumes echo-types as its formal substrate."
+
+[related-projects]
+projects = [
+  { name = "echo-types", relationship = "upstream-dependency", notes = "Constructive Agda formalization of fiber-based structured loss ('echo types'). The source of truth wokelang consumes for consent / affine-loss reasoning; integrated into the typechecker on the frontier workstream." },
+  { name = "nextgen-languages", relationship = "sibling-estate", notes = "Home of AffineScript / my-lang, the estate-primary language. Coordination monorepo for the language family." },
+  { name = "nextgen-typing", relationship = "sibling-estate", notes = "Coordination monorepo for the hyperpolymath type-theory pipeline; the MAXIMAL reference for these machine-readable governance artefacts." },
+  { name = "panll", relationship = "estate-peer", notes = "Three-pane cognitive-relief HTI in the estate; a consumer-facing surface for estate capabilities." },
+  { name = "verisimdb", relationship = "estate-peer", notes = "Identity-state capture with filesystem fallback (VeriSim family)." },
+  { name = "groove", relationship = "integration-protocol", notes = "HTTP-based service-discovery protocol; lets estate capabilities announce themselves for automatic detection. Part of wokelang's dogfooding gate." },
+  { name = "hypatia", relationship = "security-tooling", notes = "Neurosymbolic security scanner; runs as the hypatia-scan CI gate." },
+  { name = "gitbot-fleet", relationship = "automation", notes = "Estate gitbot / agent fleet that operates across repositories." },
+  { name = "standards", relationship = "governance-upstream", notes = "hyperpolymath/standards supplies the thin-wrapper reusable workflows and the Hyperpolymath Standard language policy wokelang follows." },
+]
+
+[integration-points]
+integrations = [
+  { system = "echo-types", direction = "inbound", protocol = "formalization-consume", notes = "wokelang's typechecker integrates echo-types' fiber-based structured-loss formalization; an Isabelle proof narrative backs the consent-safety guarantees." },
+  { system = "groove", direction = "bidirectional", protocol = "service-discovery", notes = "Groove discovery is exercised by the dogfooding gate so wokelang capabilities are announceable to the estate." },
+  { system = "hypatia", direction = "inbound", protocol = "security-scan", notes = "hypatia-scan analyses the repository as part of CI (neurosymbolic / symbolic-rule scanning)." },
+  { system = "standards", direction = "inbound", protocol = "reusable-workflow", notes = "CI gates are thin wrappers over hyperpolymath/standards reusable workflows." },
+]

.machine_readable/6a2/META.a2ml

@@ -1,9 +1,78 @@
 # SPDX-License-Identifier: MPL-2.0
 # META.a2ml — Project meta-information
-# Converted from META.scm on 2026-03-15
+# Converted from META.scm on 2026-03-15; enriched 2026-06-12.
+# Architecture decisions, design rationale, governance.
 
 [metadata]
 project = "wokelang"
 author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
 license = "MPL-2.0"
 standard = "RSR 2026"
+version = "0.1.0"
+last-updated = "2026-06-12"
+
+[project-info]
+type = "monorepo"  # library | binary | monorepo | service | website
+tagline = "A human-centered, consent-driven programming language"
+languages = ["rust", "ocaml"]
+primary-language = "rust"
+
+[implementation]
+primary = "Rust toolchain in src/"
+rust-components = "lexer, parser, typechecker, bytecode VM (compiler + machine), tree-walking interpreter, LSP (woke-lsp), DAP (woke-dap), formatter, linter, REPL, stdlib, codegen, ABI/FFI, security"
+rust-lib-tests = "173 passing"
+binaries = "woke, woke-lsp, woke-dap"
+ocaml-core = "core/ reference implementation: ocamllex lexer + menhir parser + evaluator (dune)"
+
+[architecture-decisions]
+adrs = [
+  { id = "ADR-001", title = "Rust is the primary toolchain; OCaml core is the reference", status = "accepted", date = "2026-03-15",
+    rationale = "The production toolchain (lexer, parser, typechecker, VM, interpreter, LSP, DAP, tooling) is implemented in Rust under src/. A smaller OCaml implementation in core/ (ocamllex + menhir + evaluator) serves as an independent reference for the language semantics and an end-to-end cross-check. Both are first-class; the OCaml core grounds the e2e CI gate." },
+  { id = "ADR-002", title = "Consent / affine safety is the defining language feature", status = "accepted", date = "2026-03-15",
+    rationale = "wokelang is human-centered and consent-driven: the type system discharges consent and affine-use obligations so users never reason about them manually. This is the architectural invariant the whole toolchain serves." },
+  { id = "ADR-003", title = "Echo types are the formal substrate for consent / affine safety", status = "accepted", date = "2026-06-12",
+    rationale = "wokelang consumes hyperpolymath/echo-types (constructive Agda formalization of fiber-based structured loss) as the source of truth for the loss / consent reasoning. The frontier workstream integrates echo types into the typechecker, with an end-to-end, near-first-principles machine-checked proof narrative (Isabelle preferred) backing it." },
+  { id = "ADR-004", title = "Hyperpolymath Standard governance via thin-wrapper reusables", status = "accepted", date = "2026-06-12",
+    rationale = "CI is 20 GitHub Actions workflows built on thin-wrapper reusable workflows from hyperpolymath/standards, plus a dogfooding gate (a2ml / k9 / empty-lint / groove / eclexiaiser), clusterfuzzlite fuzzing, and a hypatia security scan. Machine state lives only under .machine_readable/ (never the repo root)." },
+]
+
+[development-practices]
+build-tool = "just"             # Justfile at repo root; contractile.just for contracts
+rust-build = "cargo"
+ocaml-build = "dune"
+container-runtime = "podman"     # Containerfile present
+ci-platform = "github-actions"
+package-manager = "guix"         # guix.scm primary; flake.nix fallback
+
+[maintenance-axes]
+scoping-first = true
+execution-order = "axis-1 > axis-2 > axis-3"
+axis-1 = "must > intend > like"
+axis-2 = "corrective > adaptive > perfective"
+axis-3 = "systems > compliance > effects"
+
+[scoping]
+sources = "README, ROADMAP, status docs, maintenance checklist, CI/security docs"
+marker-scan = "TODO/FIXME/XXX/HACK/STUB/PARTIAL"
+proof-escape-scan = "believe_me/assert_total/sorry/Admitted/unsafeCoerce/Obj.magic"
+
+[axis-2-maintenance-rules]
+corrective-first = true
+adaptive-second = true
+adaptive-focus = "scope-change reconciliation, stale-reference removal, obsolete-work culling"
+perfective-third = true
+perfective-source = "axis-1 honest state after corrective/adaptive updates"
+
+[axis-3-audit-rules]
+audit-focus = "systems in place, documentation explains actual state, consent/affine-safety and security accounted for, observed effects reviewed"
+compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"
+drift-risk-example = "a single banned-language exception (e.g. ReScript/TypeScript) broadening into a policy violation"
+effects-evidence = "test-suite execution/results (Rust + OCaml e2e) and maintainer status dialogue/review"
+
+[design-rationale]
+summary = [
+  "wokelang is a human-centered, consent-driven language: the type system does the hard consent/affine-safety reasoning so users never have to.",
+  "Rust under src/ is the production toolchain; the OCaml core/ is the independent reference implementation and e2e cross-check.",
+  "Echo types (hyperpolymath/echo-types) are the formal substrate; the frontier is integrating them into the typechecker with a machine-checked Isabelle proof narrative.",
+  "Governance follows the Hyperpolymath Standard: MPL-2.0, allowed/banned language policy, dogfooding gate, and machine state confined to .machine_readable/.",
+]

.machine_readable/6a2/STATE.a2ml

@@ -1,14 +1,38 @@
 # SPDX-License-Identifier: MPL-2.0
 # STATE.a2ml — Project state checkpoint
-# Converted from STATE.scm on 2026-03-15
+# Converted from STATE.scm on 2026-03-15; refreshed 2026-06-12.
 
 [metadata]
 project = "wokelang"
 version = "0.1.0"
-last-updated = "2026-03-15"
+last-updated = "2026-06-12"
 status = "active"
 
 [project-context]
 name = "wokelang"
-completion-percentage = 5
-phase = "concept"
+completion-percentage = 35
+phase = "implementation"
+tagline = "A human-centered, consent-driven programming language"
+
+[implementation]
+primary = "Rust toolchain in src/"
+rust-components = "lexer, parser, typechecker, bytecode VM (compiler + machine), tree-walking interpreter, LSP, DAP, formatter, linter, REPL, stdlib, codegen, ABI/FFI, security"
+rust-lib-tests = "173 passing (0 failing)"
+binaries = "woke, woke-lsp, woke-dap"
+ocaml-core = "core/ reference: ocamllex lexer + menhir parser + evaluator (dune)"
+
+[frontier]
+focus = "integrate echo-types into the type checker + an end-to-end, near-first-principles machine-checked proof narrative"
+proof-assistant = "Isabelle (preferred)"
+echo-types-source = "hyperpolymath/echo-types (constructive Agda formalization of fiber-based structured loss)"
+goal = "the language sorts the hard consent/affine-safety reasoning so users never have to"
+typechecker-note = "TypeChecker::new seeds a ~64-binding builtin prelude (incl. Result/echo constructors)"
+
+[ci]
+workflows = "20 GitHub Actions; thin-wrapper reusables from hyperpolymath/standards"
+gates = "rust-ci, dogfood-gate, e2e (Rust+OCaml), governance, security, codeql, scorecard, secret-scanner, hypatia-scan, clusterfuzzlite, mirror, instant-sync"
+last-shepherd = "2026-06-12 PR #77: fixed 3 Rust tests, empty wokelang.opam, removed banned ReScript VSCode client (governance); issue #78 tracks AffineScript reimpl"
+
+[spec]
+location = "spec/ — grammar.ebnf, axiomatic-semantics.md, system-specs.md, SPEC.core.scm"
+paper = "arxiv-consent-aware-programming.tex (+ references.bib)"

.machine_readable/6a2/anchor/ANCHOR.a2ml

@@ -3,7 +3,7 @@
 
 id: "org.hyperpolymath.wokelang"
 version: "1.0.0"
-clade: "unknown"
+clade: "nl"   # nextgen-languages clade (per .machine_readable/CLADE.a2ml)
 status: "active"
 
 # SSG Configuration (Unified boj-server build)
@@ -15,4 +15,5 @@ ssg:
 
 # Relationships
 parents:
-  - "org.hyperpolymath.boj-server"
+  - "org.hyperpolymath.boj-server"          # SSG / publish parent (boj build trigger)
+  - "org.hyperpolymath.nextgen-languages"   # code lineage (monorepo-child, clade nl)

.machine_readable/bot_directives/git-private-farm.a2ml

@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# git-private-farm.a2ml — directive for the private mirror / build farm on this
+# repository. The farm mirrors the repository to estate-private infrastructure
+# and runs reproducible builds there.
+
+[metadata]
+bot = "git-private-farm"
+project = "wokelang"
+version = "0.1.0"
+last-updated = "2026-06-12"
+
+[hook]
+# The farm is driven by the mirror / sync / publish workflows.
+related-workflows = [
+  ".github/workflows/mirror.yml",        # mirror the repository
+  ".github/workflows/instant-sync.yml",  # propagate changes on push
+  ".github/workflows/ghcr-publish.yml",  # publish the container image
+  ".github/workflows/boj-build.yml",     # SSG / publish build (boj-server trigger)
+]
+build-tooling = ["cargo", "dune", "podman"]   # Rust + OCaml + container builds
+
+[purpose]
+summary = "Private mirroring and reproducible builds of the repository."
+responsibilities = [
+  "mirror the public repository to estate-private hosting",
+  "run reproducible builds (Guix primary, Nix fallback) of the toolchain",
+  "build and publish the container image (Containerfile / stapeln.toml)",
+  "keep the private mirror in sync with the default branch",
+]
+
+[direction]
+# The farm consumes this repo; it does not write source changes back.
+flow = "outbound-mirror"          # public repo -> private farm
+writes-back-to-public = false
+
+[constraints]
+reproducible-builds = true        # guix.scm primary; flake.nix fallback
+preserve-spdx-headers = true
+no-secrets-in-image = true        # no credentials baked into published images
+sha-pinned-dependencies = true
+https-only = true
+
+[notes]
+# Private endpoints, registry coordinates, and credentials live in the farm
+# infrastructure, NOT in this file. This directive only declares repo-local
+# scope and the build/mirror policy the farm must honour.