hyperpolymath · Nov 5, 2026 · Nov 4, 2026 · Nov 4, 2026 · Nov 4, 2026 · Nov 5, 2026
diff --git a/.github/GOVERNANCE.md b/.github/GOVERNANCE.md
@@ -44,7 +44,7 @@ release schedules, contributor access, and community standards.
 - ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`.
 - ADRs provide a historical record of why decisions were made and what alternatives
   were considered.
-- See `.machine_readable/META.a2ml` for the machine-readable ADR index.
+- See `.machine_readable/descriptiles/META.a2ml` for the machine-readable ADR index.
 
 ---
 

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -26,9 +26,9 @@
 
 ### As Applicable
 
-- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed)
-- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations changed)
-- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions changed)
+- [ ] `.machine_readable/descriptiles/STATE.a2ml` updated (if project state changed)
+- [ ] `.machine_readable/descriptiles/ECOSYSTEM.a2ml` updated (if integrations changed)
+- [ ] `.machine_readable/descriptiles/META.a2ml` updated (if architectural decisions changed)
 - [ ] Documentation updated for user-facing changes
 - [ ] `TOPOLOGY.md` updated (if architecture changed)
 - [ ] `CHANGELOG` or release notes updated

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
@@ -24,8 +24,7 @@ workflows:
     '.github/workflows/labels.yml': []
     '.github/workflows/lock-sync-gate.yml': []
     '.github/workflows/main-estate-audit.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'hyperpolymath/cicd-suite@main'
+        - 'hyperpolymath/cicd-suite@354c425571c1f27b66dd141daeb0e90fa0c26dd9'
     '.github/workflows/mirror.yml':
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@master'
@@ -115,9 +114,29 @@ dependencies:
         commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938'
         owner_id: 9919
         repo_id: 259445878
-    'hyperpolymath/cicd-suite@main':
-        ref: 'main'
-        commit: 'sha1-5a10b72e574ef63855fafd4568a4c178657f3294'
+    'hyperpolymath/cicd-suite@354c425571c1f27b66dd141daeb0e90fa0c26dd9':
+        ref: '354c425571c1f27b66dd141daeb0e90fa0c26dd9'
+        commit: 'sha1-354c425571c1f27b66dd141daeb0e90fa0c26dd9'
+        owner_id: 6759885
+        repo_id: 1326697643
+        uses:
+            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+            - 'hyperpolymath/cicd-suite@35868f090e4e42b142374d156f2d49a22ad577fd'
+            - 'hyperpolymath/cicd-suite@88c55e28f37b8dfc5a435e86f548737997746cc9'
+            - 'hyperpolymath/cicd-suite@c519c4520afbfe48f16aceb0706d7cfb1d649994'
+    'hyperpolymath/cicd-suite@35868f090e4e42b142374d156f2d49a22ad577fd':
+        ref: '35868f090e4e42b142374d156f2d49a22ad577fd'
+        commit: 'sha1-35868f090e4e42b142374d156f2d49a22ad577fd'
+        owner_id: 6759885
+        repo_id: 1326697643
+    'hyperpolymath/cicd-suite@88c55e28f37b8dfc5a435e86f548737997746cc9':
+        ref: '88c55e28f37b8dfc5a435e86f548737997746cc9'
+        commit: 'sha1-88c55e28f37b8dfc5a435e86f548737997746cc9'
+        owner_id: 6759885
+        repo_id: 1326697643
+    'hyperpolymath/cicd-suite@c519c4520afbfe48f16aceb0706d7cfb1d649994':
+        ref: 'c519c4520afbfe48f16aceb0706d7cfb1d649994'
+        commit: 'sha1-c519c4520afbfe48f16aceb0706d7cfb1d649994'
         owner_id: 6759885
         repo_id: 1326697643
         uses:

diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
@@ -1,4 +1,4 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 #
 # dependabot-automerge.yml — enable GitHub's native auto-merge on
@@ -42,15 +42,20 @@
     types: [opened, reopened, synchronize]
 
 permissions:
-  contents: read        # needed to enable auto-merge
-  pull-requests: write   # needed to approve
+  contents: read
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.
 
 jobs:
   automerge:
     # Only run for PRs actually authored by Dependabot.
     if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
+    # Only this job writes: `gh pr review --approve` needs pull-requests: write,
+    # and `gh pr merge --auto` needs contents: write (with contents: read the
+    # merge request is refused).
+    permissions:
+      contents: write
+      pull-requests: write
 
     steps:
       - name: Fetch Dependabot metadata

diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml
@@ -1,93 +1,35 @@
 # This workflow is managed by gh actions-lock.
-
+# SPDX-License-Identifier: MPL-2.0
 name: Central Estate CI/CD Audit
 
+# Thin caller of the estate audit, which lives in hyperpolymath/cicd-suite as
+# a reusable workflow and reports five component checks: governance,
+# hygiene, manifests, languages, advisory. Do not copy the audit's steps in
+# here. A copy freezes this repository at whatever cicd-suite commit its
+# actions.lock happened to hold, and fixes made upstream never arrive.
+#
+# The pin is a full SHA, advanced weekly by track-estate-audit.yml (a PR
+# whose own run of this audit is the check).
+#
+# ⚠ ONBOARDED in actions.lock at the full SHA, with the cicd-suite gate
+# commits it reaches recorded as dependencies, the same form this
+# repository's other cross-repository callers use (hypatia-scan.yml,
+# secret-scanner.yml, scorecard.yml call hyperpolymath/standards at a full
+# SHA and start normally). cicd-suite's own header records that an
+# onboarded @main or tag ref startup-fails; a full SHA is not that case.
+# If this run ever startup-fails with zero jobs, de-onboard it with
+# cicd-suite/scripts/deonboard-estate-audit.sh and drop its entry from
+# scripts/check-lock-sync.sh's expectations.
+
 on:
   push:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
 
+permissions:
+  contents: read
+
 jobs:
-  estate-audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7.0.1
-
-      - name: Required Files Gate
-        uses: hyperpolymath/cicd-suite/actions/required-files-check@main
-
-      - name: Code Hygiene Gate
-        uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@main
-
-      - name: Manifest Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/manifest-check@main
-
-      - name: Idris2 ABI Purity Gate
-        uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@main
-
-      - name: Zig UnifiedApiAdapter API Gate
-        uses: hyperpolymath/cicd-suite/actions/zig-unified-api-adapter-check@main
-
-      - name: Contractile Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@main
-
-      - name: Recipes Set Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/recipes-set-check@main
-
-      - name: Affirmation Document Gate
-        uses: hyperpolymath/cicd-suite/actions/affirmation-check@main
-
-      - name: Academic Referencing Gate
-        uses: hyperpolymath/cicd-suite/actions/referencing-check@main
-
-      - name: Semantic Audit Gate
-        uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@main
-
-      - name: SPDX License Gate
-        uses: hyperpolymath/cicd-suite/actions/spdx-license-check@main
-
-      - name: Proof Runner Gate
-        uses: hyperpolymath/cicd-suite/actions/proof-runner-check@main
-
-      - name: PRAT Testing Gate
-        uses: hyperpolymath/cicd-suite/actions/prat-check@main
-
-      - name: Panic Attack & Pons Gate
-        uses: hyperpolymath/cicd-suite/actions/custom-tools-check@main
-
-      - name: WWW & Well-Known Compliance Gate
-        uses: hyperpolymath/cicd-suite/actions/www-compliance-check@main
-
-      - name: BoJ Cartridge Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@main
-
-      - name: Formatting Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/formatting-check@main
-
-      - name: Accreditations & Badges Gate
-        uses: hyperpolymath/cicd-suite/actions/badges-check@main
-
-      - name: Metrics Extraction Gate
-        uses: hyperpolymath/cicd-suite/actions/metrics-check@main
-
-      - name: Linguist & Banned Languages Gate
-        uses: hyperpolymath/cicd-suite/actions/linguist-check@main
-
-      - name: Test & Benchmarks Dashboard Gate
-        uses: hyperpolymath/cicd-suite/actions/tests-benches-check@main
-
-      - name: Hosting & Site Status Gate
-        uses: hyperpolymath/cicd-suite/actions/hosting-check@main
-
-      - name: Git-Sea Analytics Gate
-        uses: hyperpolymath/cicd-suite/actions/gitsea-check@main
-
-      - name: Trust & Humans Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/trust-humans-check@main
-
-      - name: Are We UnAPI Gate (Secret Scanning)
-        uses: hyperpolymath/cicd-suite/actions/secrets-check@main
-
-      - name: Reasonably Good Token Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@main
+  estate:
+    uses: hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@354c425571c1f27b66dd141daeb0e90fa0c26dd9 # cicd-suite main
diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml
@@ -74,11 +74,11 @@ jobs:
             exit 1
           fi
 
-          if [ ! -f ".machine_readable/STATE.a2ml" ]; then
-            echo "::error::.machine_readable/STATE.a2ml is required"
+          if [ ! -f ".machine_readable/descriptiles/STATE.a2ml" ]; then
+            echo "::error::.machine_readable/descriptiles/STATE.a2ml is required"
             exit 1
           fi
-          echo ".machine_readable/STATE.a2ml: OK"
+          echo ".machine_readable/descriptiles/STATE.a2ml: OK"
 
       - name: Check CHANGELOG exists
         run: |
@@ -96,8 +96,8 @@ jobs:
           # Collect all required files that exist
           for f in SECURITY.md SECURITY.adoc .github/SECURITY.md LICENSE LICENSE.txt \
                    CONTRIBUTING.md CONTRIBUTING.adoc README.md README.adoc \
-                   .machine_readable/STATE.a2ml .machine_readable/META.a2ml \
-                   .machine_readable/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do
+                   .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml \
+                   .machine_readable/descriptiles/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do
             [ -f "$f" ] && REQUIRED_FILES="$REQUIRED_FILES $f"
           done
 

diff --git a/.machine_readable/0.1-AI-MANIFEST.a2ml b/.machine_readable/0.1-AI-MANIFEST.a2ml
@@ -12,12 +12,12 @@ description: |
   automation scripts.
 
 canonical_locations:
-  state: "STATE.a2ml"
-  meta: "META.a2ml"
-  ecosystem: "ECOSYSTEM.a2ml"
-  agentic: "AGENTIC.a2ml"
-  neurosym: "NEUROSYM.a2ml"
-  playbook: "PLAYBOOK.a2ml"
+  state: "descriptiles/STATE.a2ml"
+  meta: "descriptiles/META.a2ml"
+  ecosystem: "descriptiles/ECOSYSTEM.a2ml"
+  agentic: "descriptiles/AGENTIC.a2ml"
+  neurosym: "descriptiles/NEUROSYM.a2ml"
+  playbook: "descriptiles/PLAYBOOK.a2ml"
   anchors: "anchors/"
   policies: "policies/"
   ai_configs: "ai/"

diff --git a/.machine_readable/ECOSYSTEM.a2ml b/.machine_readable/ECOSYSTEM.a2ml
diff --git a/.machine_readable/META.a2ml b/.machine_readable/META.a2ml
diff --git a/.machine_readable/STATE.a2ml b/.machine_readable/STATE.a2ml
diff --git a/.machine_readable/ai/.clinerules b/.machine_readable/ai/.clinerules
@@ -2,7 +2,7 @@
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 # Authoritative source: docs/AI-CONVENTIONS.md
 
-# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml.
+# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/descriptiles/STATE.a2ml.
 
 # LICENSE
 # All original code: MPL-2.0.

diff --git a/.machine_readable/ai/.windsurfrules b/.machine_readable/ai/.windsurfrules
@@ -2,7 +2,7 @@
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 # Authoritative source: docs/AI-CONVENTIONS.md
 
-# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml.
+# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/descriptiles/STATE.a2ml.
 
 # LICENSE
 # All original code: MPL-2.0.

diff --git a/.machine_readable/ai/AI.a2ml b/.machine_readable/ai/AI.a2ml
@@ -7,8 +7,8 @@
 - Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing.
 
 ## Workflow
-1. Inspect `.machine_readable/STATE.a2ml` for blockers and next actions.
-2. Respect any constraints listed inside `.machine_readable/AGENTIC.a2ml` when tooling changes are requested.
+1. Inspect `.machine_readable/descriptiles/STATE.a2ml` for blockers and next actions.
+2. Respect any constraints listed inside `.machine_readable/descriptiles/AGENTIC.a2ml` when tooling changes are requested.
 3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message.
 
 ## Delivery Promises

diff --git a/.machine_readable/ai/README.adoc b/.machine_readable/ai/README.adoc
@@ -18,5 +18,5 @@ Recommended machine read order:
 * `.machine_readable/policies/MAINTENANCE-AXES.a2ml`
 * `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml`
 * `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml`
-* `.machine_readable/STATE.a2ml`
-* `.machine_readable/META.a2ml`
+* `.machine_readable/descriptiles/STATE.a2ml`
+* `.machine_readable/descriptiles/META.a2ml`
diff --git a/.machine_readable/6a2/AGENTIC.a2ml → .machine_readable/descriptiles/AGENTIC.a2ml b/.machine_readable/6a2/AGENTIC.a2ml → .machine_readable/descriptiles/AGENTIC.a2ml
diff --git a/.machine_readable/6a2/ECOSYSTEM.a2ml → ...hine_readable/descriptiles/ECOSYSTEM.a2ml b/.machine_readable/6a2/ECOSYSTEM.a2ml → ...hine_readable/descriptiles/ECOSYSTEM.a2ml
diff --git a/.machine_readable/6a2/META.a2ml → .machine_readable/descriptiles/META.a2ml b/.machine_readable/6a2/META.a2ml → .machine_readable/descriptiles/META.a2ml
diff --git a/.machine_readable/6a2/NEUROSYM.a2ml → .machine_readable/descriptiles/NEUROSYM.a2ml b/.machine_readable/6a2/NEUROSYM.a2ml → .machine_readable/descriptiles/NEUROSYM.a2ml
diff --git a/.machine_readable/6a2/PLAYBOOK.a2ml → .machine_readable/descriptiles/PLAYBOOK.a2ml b/.machine_readable/6a2/PLAYBOOK.a2ml → .machine_readable/descriptiles/PLAYBOOK.a2ml
@@ -13,7 +13,7 @@ last-updated = "2026-04-11"
 # target = "container"  # container | binary | library | wasm
 
 [incident-response]
-# 1. Check .machine_readable/STATE.a2ml for current status
+# 1. Check .machine_readable/descriptiles/STATE.a2ml for current status
 # 2. Review recent commits and CI results
 # 3. Run `just validate` to check compliance
 # 4. Run `just security` to audit for vulnerabilities
@@ -61,7 +61,7 @@ enforcement-workflow = ".github/workflows/estate-rules.yml"
 
 # === Required directories ===
 # .github/             CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/
-# .machine_readable/   AI manifests (0.1-AI-MANIFEST.a2ml), 6a2/ checkpoints,
+# .machine_readable/   AI manifests (0.1-AI-MANIFEST.a2ml), descriptiles/ checkpoints,
 #                      contractiles/, configs/, anchors/, policies/, scripts/, svc/
 # build/               contractile.just, flake.guix, guix.scm, Containerfile,
 #                      just/*.just (Justfile section imports)
@@ -123,6 +123,9 @@ enforcement-workflow = ".github/workflows/estate-rules.yml"
 #                             vlang.sh + .github/workflows/estate-rules.yml.
 # 5. chore/<repo>-hygiene     Repo-specific drift cleanup (case collisions,
 #                             template-derivation drift in titles, etc.).
+#                             Move a legacy .machine_readable/6a2/ to
+#                             .machine_readable/descriptiles/ and update every
+#                             reference to the old path (Hypatia SD004, SD024).
 
 # === Reference scripts ===
 # scripts/check-root-shape.sh      Root allowlist validator

diff --git a/.machine_readable/6a2/STATE.a2ml → .machine_readable/descriptiles/STATE.a2ml b/.machine_readable/6a2/STATE.a2ml → .machine_readable/descriptiles/STATE.a2ml
diff --git a/.machine_readable/policies/MAINTENANCE-AXES.a2ml b/.machine_readable/policies/MAINTENANCE-AXES.a2ml
@@ -18,7 +18,7 @@ machine-entrypoints = [
   ".machine_readable/policies/MAINTENANCE-AXES.a2ml",
   ".machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml",
   ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml",
-  ".machine_readable/META.a2ml",
+  ".machine_readable/descriptiles/META.a2ml",
   ".machine_readable/ai/README.adoc",
   ".machine_readable/bot_directives/README.scm",
 ]

diff --git a/.machine_readable/svc/k9/methodology-guard.k9.ncl b/.machine_readable/svc/k9/methodology-guard.k9.ncl
@@ -58,7 +58,7 @@ let methodology_guard = {
     state_not_template = {
       description = "STATE.a2ml must not contain template placeholders",
       severity = "warning",
-      file = ".machine_readable/6a2/STATE.a2ml",
+      file = ".machine_readable/descriptiles/STATE.a2ml",
       reject_patterns = ["{{PLACEHOLDER}}", "BOFJ_KITT", "rsr-template-repo"],
     },