From 6f3191e885c0bfe96442ee45fad7e08f8a296463 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 11:08:32 +0000 Subject: [PATCH 1/5] ci(workflows): put the SPDX line on line 1 of each workflow file The workflow linter (`workflow-linter.yml`, step "Check SPDX Headers") requires `# SPDX-License-Identifier:` on line 1. In all 30 workflow files the comment of `gh actions-lock` was on line 1 and the SPDX line was on line 2, so the job `lint-workflows` failed on `main` each time a workflow changed. This commit exchanges line 1 and line 2 in each file. No other line changes. The lint steps "Check SPDX Headers", "Check Permissions Declaration", the SHA-pin check of reusable calls and "Check for Duplicate Workflows" pass in a local run. The step `gh actions-lock --verify-local` was not run locally. Known risk: `gh actions-lock` wrote its comment on line 1 before. If it does this again, the linter rule and the tool disagree again. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK --- .github/workflows/boj-build.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/container-build.yml | 2 +- .github/workflows/dependabot-automerge.yml | 2 +- .github/workflows/dogfood-gate.yml | 2 +- .github/workflows/e2e.yml | 2 +- .github/workflows/estate-rules.yml | 2 +- .github/workflows/governance.yml | 2 +- .github/workflows/guix-policy.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/instant-sync.yml | 2 +- .github/workflows/label-triage.yml | 2 +- .github/workflows/labels.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/openssf-compliance.yml | 2 +- .github/workflows/pages.yml | 2 +- .github/workflows/proofs.yml | 2 +- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/quality.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/rhodibot.yml | 2 +- .github/workflows/runtime-policy.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/security-policy.yml | 2 +- .github/workflows/sonarqube.yml | 2 +- .github/workflows/static-analysis-gate.yml | 2 +- .github/workflows/wellknown-enforcement.yml | 2 +- .github/workflows/workflow-linter.yml | 2 +- 30 files changed, 30 insertions(+), 30 deletions(-) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index c77face..69ddfdd 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # # OPTIONAL: BoJ Server Build Trigger # This workflow notifies a BoJ Server instance when code is pushed. diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 48d54a4..ef37fe5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: push: diff --git a/.github/workflows/container-build.yml b/.github/workflows/container-build.yml index a497f6e..333277f 100644 --- a/.github/workflows/container-build.yml +++ b/.github/workflows/container-build.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: container build on: pull_request: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index d064cf0..97f905a 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # # dependabot-automerge.yml — enable GitHub's native auto-merge on # Dependabot pull requests that match a declared severity / ecosystem diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index fc21609..5646a37 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 0481d51..9fcb5ad 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # RSR Standard E2E + Aspect + Benchmark Workflow Template diff --git a/.github/workflows/estate-rules.yml b/.github/workflows/estate-rules.yml index 118914f..4392b0d 100644 --- a/.github/workflows/estate-rules.yml +++ b/.github/workflows/estate-rules.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Estate Rules — enforces hyperpolymath estate-wide conventions: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 2dcc276..c06b0ef 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Governance on: diff --git a/.github/workflows/guix-policy.yml b/.github/workflows/guix-policy.yml index 0a41426..ab63a0e 100644 --- a/.github/workflows/guix-policy.yml +++ b/.github/workflows/guix-policy.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Guix Package Policy on: push: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 61ce294..f4b6842 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # # Standalone Hypatia security scan (push / PR / weekly). This is NOT a duplicate # of the `hypatia-scan` job in `static-analysis-gate.yml`: that job exists to diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 38c7111..01cbb73 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync on: diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index 814a192..fc79947 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Label Triage # Classify newly-filed issues against the estate label taxonomy. diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index 83ab941..af34c6b 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Labels # Applies the canonical estate label set from .github/labels.json. diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index e90d18e..364998c 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Mirror to Git Forges on: push: diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml index 26d7a8e..c5581ea 100644 --- a/.github/workflows/openssf-compliance.yml +++ b/.github/workflows/openssf-compliance.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # OpenSSF Best Practices compliance gate — blocks PRs and pushes that lack # required files or still contain unfilled placeholder tokens. name: OpenSSF Compliance diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index fb3ddbd..3899627 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # GitHub Pages via casket-ssg (hyperpolymath's pure-Haskell static site generator). # Replaces the orphan one-off Pages deployment with a reproducible build. name: GitHub Pages diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index 832aee7..99960e3 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Proof gate: the same scripts/check-proofs.sh a developer runs locally. # Hermetic by construction — elan comes from a version-pinned release tarball # with a checksum, the Lean toolchain from the committed lean-toolchain file, diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index b846a76..5318783 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,6 +1,6 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 5af32f9..941a8f3 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Code Quality on: push: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 80041b9..e127e0a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Release workflow — triggered by version tags (v*). diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index 3979fb6..a5f649a 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # rhodibot.yml — RSR compliance CANARY (report-only) # # Rhodibot does NOT mutate this repository. It never deletes, renames, diff --git a/.github/workflows/runtime-policy.yml b/.github/workflows/runtime-policy.yml index 7d67d18..6881682 100644 --- a/.github/workflows/runtime-policy.yml +++ b/.github/workflows/runtime-policy.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Runtime and package-manager policy check. # # Authority: hyperpolymath/standards LANGUAGE-POLICY.adoc §1. diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 6fb5a01..bcdc9bd 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Rust CI — thin wrapper calling the shared estate reusable in # hyperpolymath/standards. Configure once, propagate everywhere. # See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards. diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b161eeb..20a58b5 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: OSSF Scorecard on: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 5324c71..432ec78 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Secret Scanner on: pull_request: diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index 0793bec..d8e11ba 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Security Policy on: push: diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml index a44effb..e23c265 100644 --- a/.github/workflows/sonarqube.yml +++ b/.github/workflows/sonarqube.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # SonarQube Cloud (SonarCloud) static analysis. Analysis scope + exclusions live # in sonar-project.properties. Requires the SONAR_TOKEN repository secret # (Settings -> Secrets and variables -> Actions) and a SonarCloud project: diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index 16bb1fd..3170817 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Static Analysis Gate — Required by branch protection rules. # Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning. name: Static Analysis Gate diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml index fd68126..128c448 100644 --- a/.github/workflows/wellknown-enforcement.yml +++ b/.github/workflows/wellknown-enforcement.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Well-Known Standards (RFC 9116 + RSR) on: push: diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 4523c3c..6cac0f6 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # workflow-linter.yml - Validates GitHub workflows against RSR security standards # This workflow can be copied to other repos for consistent enforcement name: Workflow Security Linter From 873d54379ea5121d4e12fd687b47c7eab75e7911 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 11:13:56 +0000 Subject: [PATCH 2/5] fix(k9): make the K9 contracts pass the validator (11 errors to 0) `Validate K9 contracts` (dogfood gate) failed on `main` with 11 errors in 8 files. `.githooks/validate-k9.sh` now reports 17 files, 0 errors and 0 warnings. The validator did not change. Contractiles (bust, intend, must, trust): - Add `signature_required = true` to `pedigree.security`. The K9 contract specification requires it at the leash 'Hunt (K9-S008). The files had the field in other sections only, where the validator does not look. - No `pedigree.signature` block is added (K9-S009). Only a signing ceremony can give a real value. Template leftovers, brought to the form of the current estate template (hyperpolymath/rsr-template-repo): - `coordination.k9` -> `coordination.k9.ncl` and `session/custom-checks.k9` -> `session/custom-checks.k9.ncl`: the same data as a Nickel K9 component with a pedigree (leash 'Kennel). The content is the template file, verbatim. - `.machine_readable/self-validating/methodology-guard.k9.ncl`: add the `K9!` line and the pedigree block (leash 'Yard), and fill the copyright placeholders with the string that the other files of this repository use. - `container/stapeln/deploy.k9.ncl` -> `deploy.k9.ncl.in`: the file has unfilled placeholders (service name, registry, port), so it is a template input and not a component. This repository has no service, so the placeholders are not filled. References to the 3 renamed files are updated in `root-allow.txt`, `session/README.adoc`, `container/README.adoc`, `container/0.1-AI-MANIFEST.a2ml`, `docs/STATE-VISUALIZER.adoc` and one comment block of `PLAYBOOK.a2ml`. Dated audit reports keep the old names. Local gates: validate-k9 PASS, check-root-shape PASS, scan-dangerous PASS, check-no-md-in-docs PASS. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK --- .machine_readable/6a2/PLAYBOOK.a2ml | 4 +- .../contractiles/bust/bust.k9.ncl | 1 + .../contractiles/intend/intend.k9.ncl | 1 + .../contractiles/must/must.k9.ncl | 1 + .../contractiles/trust/trust.k9.ncl | 1 + .machine_readable/root-allow.txt | 4 +- .../self-validating/methodology-guard.k9.ncl | 15 +++++- container/0.1-AI-MANIFEST.a2ml | 4 +- container/README.adoc | 4 +- .../{deploy.k9.ncl => deploy.k9.ncl.in} | 0 coordination.k9 | 43 --------------- coordination.k9.ncl | 50 ++++++++++++++++++ docs/STATE-VISUALIZER.adoc | 2 +- session/README.adoc | 2 +- session/custom-checks.k9 | 15 ------ session/custom-checks.k9.ncl | 52 +++++++++++++++++++ 16 files changed, 131 insertions(+), 68 deletions(-) rename container/stapeln/{deploy.k9.ncl => deploy.k9.ncl.in} (100%) delete mode 100644 coordination.k9 create mode 100644 coordination.k9.ncl delete mode 100644 session/custom-checks.k9 create mode 100644 session/custom-checks.k9.ncl diff --git a/.machine_readable/6a2/PLAYBOOK.a2ml b/.machine_readable/6a2/PLAYBOOK.a2ml index 749b096..5c28459 100644 --- a/.machine_readable/6a2/PLAYBOOK.a2ml +++ b/.machine_readable/6a2/PLAYBOOK.a2ml @@ -58,14 +58,14 @@ enforcement-workflow = ".github/workflows/estate-rules.yml" # CHANGELOG.md One of the recognised .md exceptions (see below) # Justfile Task runner — self-contained (build/ scaffolding retired; # build/just/proofs.just returns with the proof gate) -# coordination.k9 Repo-local session binding +# coordination.k9.ncl Repo-local session binding # === Required directories === # .github/ CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/ # .machine_readable/ AI manifests (0.1-AI-MANIFEST.a2ml), 6a2/ checkpoints, # contractiles/, configs/, anchors/, policies/, scripts/, self-validating/ # docs/ onboarding/, status/, architecture/, governance/ (all .adoc) -# session/ dispatch.sh, custom-checks.k9, local-hooks.sh +# session/ dispatch.sh, custom-checks.k9.ncl, local-hooks.sh # src/ Project source (Idris2 ABI under abi/, Zig FFI under ffi/) # tests/, benches/, examples/, features/, scripts/, verification/, container/ diff --git a/.machine_readable/contractiles/bust/bust.k9.ncl b/.machine_readable/contractiles/bust/bust.k9.ncl index a9fb9cf..a29a6a8 100644 --- a/.machine_readable/contractiles/bust/bust.k9.ncl +++ b/.machine_readable/contractiles/bust/bust.k9.ncl @@ -50,6 +50,7 @@ let base = import "../_base.ncl" in allow_network = false, allow_filesystem_write = false, allow_subprocess = true, + signature_required = true, # K9-S008: required at 'Hunt probe_scope = 'read_only, }, }, diff --git a/.machine_readable/contractiles/intend/intend.k9.ncl b/.machine_readable/contractiles/intend/intend.k9.ncl index 22af0b8..0df05a6 100644 --- a/.machine_readable/contractiles/intend/intend.k9.ncl +++ b/.machine_readable/contractiles/intend/intend.k9.ncl @@ -64,6 +64,7 @@ let base = import "../_base.ncl" in allow_network = false, allow_filesystem_write = false, # evidence sinks are indirected allow_subprocess = true, + signature_required = true, # K9-S008: required at 'Hunt }, }, diff --git a/.machine_readable/contractiles/must/must.k9.ncl b/.machine_readable/contractiles/must/must.k9.ncl index 2c653dc..1361ddd 100644 --- a/.machine_readable/contractiles/must/must.k9.ncl +++ b/.machine_readable/contractiles/must/must.k9.ncl @@ -58,6 +58,7 @@ let base = import "../_base.ncl" in allow_network = false, allow_filesystem_write = false, allow_subprocess = true, + signature_required = true, # K9-S008: required at 'Hunt probe_scope = 'read_only, # must probes NEVER mutate probe_kinds_allowed = [ 'file_existence, diff --git a/.machine_readable/contractiles/trust/trust.k9.ncl b/.machine_readable/contractiles/trust/trust.k9.ncl index 104d2e3..c89fd29 100644 --- a/.machine_readable/contractiles/trust/trust.k9.ncl +++ b/.machine_readable/contractiles/trust/trust.k9.ncl @@ -76,6 +76,7 @@ let base = import "../_base.ncl" in allow_network = false, # verifications offline by default allow_filesystem_write = false, # evidence sinks are indirected allow_subprocess = true, + signature_required = true, # K9-S008: required at 'Hunt authorised_probes_only = true, # probe section explicitly lists allowed targets + probe classes probe_scope_enforcement = 'this_repo_only, # probes NEVER hit external systems }, diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt index d6c81e8..e7316f2 100644 --- a/.machine_readable/root-allow.txt +++ b/.machine_readable/root-allow.txt @@ -30,7 +30,7 @@ CITATION.cff # citation metadata (surfaced at root by #96) # ─── Build entry points (must live at root for their tooling) ──────────────── Justfile # task runner entry point (self-contained since build/ scaffolding removal) -coordination.k9 # repo-local session binding (template-mandated) +coordination.k9.ncl # repo-local session binding (template-mandated) # ─── Conventional dotfiles (tool-required at root) ─────────────────────────── .editorconfig @@ -55,7 +55,7 @@ docs/ # onboarding/, status/, governance/, ... docs-template/ # template-only: scaffolding docs copied into new repos machine-readable-design/ # template-only: design rationale for .machine_readable/ layout .githooks/ # vendored A2ML/K9 validation scripts run by the dogfood gate (PR #31); kept at root because git's core.hooksPath convention and the workflow both reference it there -session/ # dispatch.sh, custom-checks.k9, local-hooks.sh +session/ # dispatch.sh, custom-checks.k9.ncl, local-hooks.sh # Source / test / artifact trees (project-specific but conventional) # NB: src/ is deliberately NOT allowed — systemet is a theory repo (IS-NOT: diff --git a/.machine_readable/self-validating/methodology-guard.k9.ncl b/.machine_readable/self-validating/methodology-guard.k9.ncl index 4c43325..8b487ec 100644 --- a/.machine_readable/self-validating/methodology-guard.k9.ncl +++ b/.machine_readable/self-validating/methodology-guard.k9.ncl @@ -1,5 +1,6 @@ +K9! # SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # K9 Validator: Methodology Guard # Checks that agent work respects methodology constraints declared in @@ -12,6 +13,18 @@ let methodology_guard = { version = "1.0.0", description = "Validates that agent work respects declared methodology constraints", + pedigree = { + schema_version = "1.0.0", + component_type = "validator:methodology-guard", + metadata = { + name = "methodology-guard", + version = "1.0.0", + }, + security = { + leash = 'Yard, + }, + }, + checks = { divergent_invariant_language = { description = "No files in languages violating the divergent language invariant", diff --git a/container/0.1-AI-MANIFEST.a2ml b/container/0.1-AI-MANIFEST.a2ml index a25baa5..dc38a0d 100644 --- a/container/0.1-AI-MANIFEST.a2ml +++ b/container/0.1-AI-MANIFEST.a2ml @@ -38,7 +38,7 @@ canonical_locations: secrets_gate: "container/stapeln/rokur.toml" build_pipeline: "container/stapeln/ct-build.sh" monitoring: "container/stapeln/vordr.toml" - deployment: "container/stapeln/deploy.k9.ncl" + deployment: "container/stapeln/deploy.k9.ncl.in" # Just module + opt-out just_module: "none" # build/just/container.just retired with the build/ scaffolding removal @@ -101,7 +101,7 @@ files: detection, resource thresholds, and structured log output. depends_on: [] - - name: "deploy.k9.ncl" + - name: "deploy.k9.ncl.in" role: "Deployment Component" description: | k9-svc deployment specification at Hunt trust level. Full pedigree diff --git a/container/README.adoc b/container/README.adoc index 7a2f805..364ab77 100644 --- a/container/README.adoc +++ b/container/README.adoc @@ -103,7 +103,7 @@ The container engine is *auto-detected* (`podman`, then `nerdctl`, then | *cerro-torre* build → pack → sign (Ed25519) → verify → push pipeline. Engine-agnostic; degrades gracefully when cerro-torre tools are absent. -| `deploy.k9.ncl` +| `deploy.k9.ncl.in` | *k9-svc* deployment component at Hunt trust level: full pedigree (L1–L5), dev/staging/prod configs, rolling deployment strategy. |=== @@ -176,6 +176,8 @@ k9-svc managed deployment: [source,bash] ---- +# deploy.k9.ncl.in is a template input. Fill its placeholders and save the result +# as deploy.k9.ncl before you run these commands. nickel typecheck container/stapeln/deploy.k9.ncl k9-svc deploy container/stapeln/deploy.k9.ncl --env production ---- diff --git a/container/stapeln/deploy.k9.ncl b/container/stapeln/deploy.k9.ncl.in similarity index 100% rename from container/stapeln/deploy.k9.ncl rename to container/stapeln/deploy.k9.ncl.in diff --git a/coordination.k9 b/coordination.k9 deleted file mode 100644 index ba31125..0000000 --- a/coordination.k9 +++ /dev/null @@ -1,43 +0,0 @@ -# Thin coordination bindings for central session-management standards - -session_management: - source_of_truth: "standards/session-management-standards" - canonical_commands: - - "intake repo " - - "checkpoint change " - - "verify maintenance " - - "verify substantial " - - "verify release " - - "close planned " - - "close urgent " - - "recover repo " - - "handover full " - - "handover split " - - "handover model " - - "handover human " - -signals: - - name: "session.intake" - command: "intake repo " - - name: "session.checkpoint" - command: "checkpoint change " - - name: "session.verify.maintenance" - command: "verify maintenance " - - name: "session.verify.substantial" - command: "verify substantial " - - name: "session.verify.release" - command: "verify release " - - name: "session.close.planned" - command: "close planned " - - name: "session.close.urgent" - command: "close urgent " - - name: "session.recover" - command: "recover repo " - - name: "session.handover.full" - command: "handover full " - - name: "session.handover.split" - command: "handover split " - - name: "session.handover.model" - command: "handover model " - - name: "session.handover.human" - command: "handover human " diff --git a/coordination.k9.ncl b/coordination.k9.ncl new file mode 100644 index 0000000..69721f8 --- /dev/null +++ b/coordination.k9.ncl @@ -0,0 +1,50 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 +# Thin coordination bindings for central session-management standards + +{ + pedigree = { + schema_version = "1.0.0", + component_type = "session:coordination-binding", + metadata = { + name = "session-coordination", + version = "0.1.0", + }, + security = { + leash = 'Kennel, + }, + }, + + session_management = { + source_of_truth = "standards/3-practice/session-management-standards", + canonical_commands = [ + "intake repo ", + "checkpoint change ", + "verify maintenance ", + "verify substantial ", + "verify release ", + "close planned ", + "close urgent ", + "recover repo ", + "handover full ", + "handover split ", + "handover model ", + "handover human ", + ], + }, + + signals = [ + { name = "session.intake", command = "intake repo " }, + { name = "session.checkpoint", command = "checkpoint change " }, + { name = "session.verify.maintenance", command = "verify maintenance " }, + { name = "session.verify.substantial", command = "verify substantial " }, + { name = "session.verify.release", command = "verify release " }, + { name = "session.close.planned", command = "close planned " }, + { name = "session.close.urgent", command = "close urgent " }, + { name = "session.recover", command = "recover repo " }, + { name = "session.handover.full", command = "handover full " }, + { name = "session.handover.split", command = "handover split " }, + { name = "session.handover.model", command = "handover model " }, + { name = "session.handover.human", command = "handover human " }, + ], +} diff --git a/docs/STATE-VISUALIZER.adoc b/docs/STATE-VISUALIZER.adoc index c30fda4..bcca0da 100644 --- a/docs/STATE-VISUALIZER.adoc +++ b/docs/STATE-VISUALIZER.adoc @@ -40,7 +40,7 @@ │ │ │ OCI │ │ cerro-torre │ │ │ │ │ │ Build │ │ svalinn/vordr │ │ │ │ │ └──────────┘ └───────────────┘ │ │ - │ │ ct-build.sh deploy.k9.ncl │ │ + │ │ ct-build.sh deploy.k9.ncl.in │ │ │ └──────────────────────────────────┘ │ └────────│─────────────────│──────────────┘ │ │ diff --git a/session/README.adoc b/session/README.adoc index d14a6d7..a6b1de7 100644 --- a/session/README.adoc +++ b/session/README.adoc @@ -11,7 +11,7 @@ Authoritative protocols live in: This repo keeps only thin bindings: * `+dispatch.sh+` maps canonical commands to central protocol paths. -* `+custom-checks.k9+` defines repo-local policy checks. +* `+custom-checks.k9.ncl+` defines repo-local policy checks as a Nickel record. * `+local-hooks.sh+` provides optional repo-specific hook behavior. === Canonical Commands diff --git a/session/custom-checks.k9 b/session/custom-checks.k9 deleted file mode 100644 index bd932fa..0000000 --- a/session/custom-checks.k9 +++ /dev/null @@ -1,15 +0,0 @@ -# Local repository session checks (thin policy layer) -version: "0.1" - -checks: - - id: "session-state-has-next-action" - applies_to: ["close planned", "close urgent", "handover full", "handover split", "handover model", "handover human"] - requirement: "LAST-CANONICAL-COMMAND.md contains next intended action" - - - id: "session-state-has-residual-risks" - applies_to: ["verify maintenance", "verify substantial", "verify release", "recover repo"] - requirement: "Residual risks field is not left blank" - - - id: "session-state-has-recommended-next-protocol" - applies_to: ["intake repo", "checkpoint change", "recover repo", "handover full"] - requirement: "Recommended next protocol is set" diff --git a/session/custom-checks.k9.ncl b/session/custom-checks.k9.ncl new file mode 100644 index 0000000..7f6c01a --- /dev/null +++ b/session/custom-checks.k9.ncl @@ -0,0 +1,52 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 +# Local repository session checks (thin policy layer) + +{ + pedigree = { + schema_version = "1.0.0", + component_type = "session:custom-checks", + metadata = { + name = "custom-session-checks", + version = "0.1.0", + }, + security = { + leash = 'Kennel, + }, + }, + + checks = [ + { + id = "session-state-has-next-action", + applies_to = [ + "close planned", + "close urgent", + "handover full", + "handover split", + "handover model", + "handover human", + ], + requirement = "LAST-CANONICAL-COMMAND.md contains next intended action", + }, + { + id = "session-state-has-residual-risks", + applies_to = [ + "verify maintenance", + "verify substantial", + "verify release", + "recover repo", + ], + requirement = "Residual risks field is not left blank", + }, + { + id = "session-state-has-recommended-next-protocol", + applies_to = [ + "intake repo", + "checkpoint change", + "recover repo", + "handover full", + ], + requirement = "Recommended next protocol is set", + }, + ], +} From c9312c9cf6378d70882654973567befe5565f981 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 11:16:36 +0000 Subject: [PATCH 3/5] refactor(descriptiles): move .machine_readable/6a2 to .machine_readable/descriptiles The Hypatia scan failed on `main` with 6 critical findings ("Descriptile in retired location -- must be in .machine_readable/descriptiles/") and 3 high findings ("CI policy requires a retired descriptile path"). This commit moves the directory with `git mv` and updates each reference to the old path. No descriptile changes its facts: - 9 of the 12 moved files are pure renames. The other 3 change only comment or title lines that name a file or the directory (`0-AI-MANIFEST.a2ml`, `PLAYBOOK.a2ml`, `README.adoc`). - CLADE, ECOSYSTEM, AGENTIC, STATE and ANCHOR have the same content hash before and after the move. - The CI policy in `openssf-compliance.yml`, `scripts/validate-template.sh`, `.pre-commit-config.yaml`, both Justfiles, the Mustfile clauses, the arrival-pack and coaptation scripts, and the documents (AFFIRMATION.adoc included) now name the new path. Not changed, on purpose: - `STATE.a2ml` keeps its line about issue 18. The directory layout is now the descriptiles layout, but the validation against the contractiles that issue 18 tracks is not done. - The arrival-pack region of `CLAUDE.md` and the coaptation receipt are not regenerated (`nickel` is not available in this session). Both were stale on `main` before this work: `CLAUDE.md` records STATE@5fc823be2cfa and the file has the hash e6db74eaa45e, and the receipt names `rsr-template-repo`. - No `.a2ml` file is converted to a deed. The estate canon retires A2ML, but it forbids a hand conversion in bulk, and the tools of this repository read the `.a2ml` files. Checked locally: the arrival-pack reader and the coaptation fact reader run at the new path; the two Mustfile clauses for the directory pass; validate-a2ml (103 files, 0 errors), validate-k9, validate-template, check-root-shape, scan-dangerous, check-no-md-in-docs and check-proof-status pass. Hypatia was not run locally. Refs #18 Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK --- .github/GOVERNANCE.md | 2 +- .github/pull_request_template.md | 6 +++--- .github/workflows/openssf-compliance.yml | 10 +++++----- .machine_readable/0.1-AI-MANIFEST.a2ml | 16 ++++++++-------- .machine_readable/ai/.clinerules | 2 +- .machine_readable/ai/.windsurfrules | 2 +- .machine_readable/ai/AI.a2ml | 4 ++-- .machine_readable/ai/README.adoc | 6 +++--- .machine_readable/arrival-pack/claude-md.k9.ncl | 10 +++++----- .machine_readable/arrival-pack/extract.sh | 2 +- .machine_readable/arrival-pack/generate.sh | 2 +- .machine_readable/arrival-pack/verify.sh | 2 +- .machine_readable/coaptation/coapt.k9.ncl | 10 +++++----- .machine_readable/coaptation/coapt.sh | 2 +- .machine_readable/coaptation/extract-facts.sh | 2 +- .machine_readable/coaptation/verify.sh | 2 +- .machine_readable/coaptation/witness-map.ncl | 4 ++-- .machine_readable/contractiles/Justfile | 8 ++++---- .../contractiles/adjust/adjust.k9.ncl | 4 ++-- .machine_readable/contractiles/bust/bust.k9.ncl | 4 ++-- .machine_readable/contractiles/dust/dust.k9.ncl | 4 ++-- .../contractiles/intend/intend.k9.ncl | 8 ++++---- .../contractiles/must/Mustfile.a2ml | 8 ++++---- .machine_readable/contractiles/must/must.k9.ncl | 4 ++-- .../contractiles/trust/trust.k9.ncl | 6 +++--- .../{6a2 => descriptiles}/0-AI-MANIFEST.a2ml | 4 ++-- .../{6a2 => descriptiles}/AGENTIC.a2ml | 0 .../{6a2 => descriptiles}/CLADE.a2ml | 0 .../{6a2 => descriptiles}/ECOSYSTEM.a2ml | 0 .../{6a2 => descriptiles}/META.a2ml | 0 .../{6a2 => descriptiles}/NEUROSYM.a2ml | 0 .../{6a2 => descriptiles}/PLAYBOOK.a2ml | 4 ++-- .../{6a2 => descriptiles}/README.adoc | 2 +- .../{6a2 => descriptiles}/STATE.a2ml | 0 .../anchors/0-AI-MANIFEST.a2ml | 0 .../{6a2 => descriptiles}/anchors/ANCHOR.a2ml | 0 .../{6a2 => descriptiles}/anchors/README.adoc | 0 .machine_readable/policies/MAINTENANCE-AXES.a2ml | 2 +- .../policies/MAINTENANCE-CHECKLIST.a2ml | 2 +- .../self-validating/methodology-guard.k9.ncl | 2 +- .pre-commit-config.yaml | 2 +- AFFIRMATION.adoc | 2 +- EXPLAINME.adoc | 2 +- Justfile | 8 ++++---- docs/RSR_OUTLINE.adoc | 2 +- docs/governance/CRG-AUDIT-TEMPLATE.adoc | 8 ++++---- docs/practice/AI-CONVENTIONS.adoc | 12 ++++++------ docs/status/READINESS.adoc | 4 ++-- docs/status/ROADMAP.adoc | 7 ++++--- .../canonical-directory-structure/README.adoc | 4 ++-- scripts/validate-template.sh | 10 +++++----- tests/e2e/template_instantiation_test.sh | 4 ++-- 52 files changed, 106 insertions(+), 105 deletions(-) rename .machine_readable/{6a2 => descriptiles}/0-AI-MANIFEST.a2ml (81%) rename .machine_readable/{6a2 => descriptiles}/AGENTIC.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/CLADE.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/ECOSYSTEM.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/META.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/NEUROSYM.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/PLAYBOOK.a2ml (97%) rename .machine_readable/{6a2 => descriptiles}/README.adoc (97%) rename .machine_readable/{6a2 => descriptiles}/STATE.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/anchors/0-AI-MANIFEST.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/anchors/ANCHOR.a2ml (100%) rename .machine_readable/{6a2 => descriptiles}/anchors/README.adoc (100%) diff --git a/.github/GOVERNANCE.md b/.github/GOVERNANCE.md index 64ba5f6..15da3f4 100644 --- a/.github/GOVERNANCE.md +++ b/.github/GOVERNANCE.md @@ -46,7 +46,7 @@ release schedules, contributor access, and community standards. - ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`. - ADRs provide a historical record of why decisions were made and what alternatives were considered. -- See `.machine_readable/6a2/META.a2ml` for the machine-readable ADR index. +- See `.machine_readable/descriptiles/META.a2ml` for the machine-readable ADR index. --- diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index c46a4e0..65789e9 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -29,9 +29,9 @@ Copyright (c) Jonathan D.A. Jewell ### As Applicable -- [ ] `.machine_readable/6a2/STATE.a2ml` updated (if project state changed) -- [ ] `.machine_readable/6a2/ECOSYSTEM.a2ml` updated (if integrations changed) -- [ ] `.machine_readable/6a2/META.a2ml` updated (if architectural decisions changed) +- [ ] `.machine_readable/descriptiles/STATE.a2ml` updated (if project state changed) +- [ ] `.machine_readable/descriptiles/ECOSYSTEM.a2ml` updated (if integrations changed) +- [ ] `.machine_readable/descriptiles/META.a2ml` updated (if architectural decisions changed) - [ ] Documentation updated for user-facing changes - [ ] `TOPOLOGY.md` updated (if architecture changed) - [ ] `CHANGELOG` or release notes updated diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml index c5581ea..0984898 100644 --- a/.github/workflows/openssf-compliance.yml +++ b/.github/workflows/openssf-compliance.yml @@ -73,11 +73,11 @@ jobs: exit 1 fi - if [ ! -f ".machine_readable/6a2/STATE.a2ml" ]; then - echo "::error::.machine_readable/6a2/STATE.a2ml is required" + if [ ! -f ".machine_readable/descriptiles/STATE.a2ml" ]; then + echo "::error::.machine_readable/descriptiles/STATE.a2ml is required" exit 1 fi - echo ".machine_readable/6a2/STATE.a2ml: OK" + echo ".machine_readable/descriptiles/STATE.a2ml: OK" - name: Check CHANGELOG exists run: | if [ ! -f "CHANGELOG.md" ] && [ ! -f "CHANGELOG.adoc" ] && [ ! -f "CHANGES.md" ]; then @@ -93,8 +93,8 @@ jobs: # Collect all required files that exist for f in SECURITY.md SECURITY.adoc .github/SECURITY.md LICENSE LICENSE.txt \ CONTRIBUTING.md CONTRIBUTING.adoc README.md README.adoc \ - .machine_readable/6a2/STATE.a2ml .machine_readable/6a2/META.a2ml \ - .machine_readable/6a2/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do + .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml \ + .machine_readable/descriptiles/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do [ -f "$f" ] && REQUIRED_FILES="$REQUIRED_FILES $f" done diff --git a/.machine_readable/0.1-AI-MANIFEST.a2ml b/.machine_readable/0.1-AI-MANIFEST.a2ml index 7d8ce9e..a28ee37 100644 --- a/.machine_readable/0.1-AI-MANIFEST.a2ml +++ b/.machine_readable/0.1-AI-MANIFEST.a2ml @@ -12,14 +12,14 @@ description: | automation scripts. canonical_locations: - state: "6a2/STATE.a2ml" - meta: "6a2/META.a2ml" - ecosystem: "6a2/ECOSYSTEM.a2ml" - agentic: "6a2/AGENTIC.a2ml" - neurosym: "6a2/NEUROSYM.a2ml" - playbook: "6a2/PLAYBOOK.a2ml" - clade: "6a2/CLADE.a2ml" - anchors: "6a2/anchors/" + state: "descriptiles/STATE.a2ml" + meta: "descriptiles/META.a2ml" + ecosystem: "descriptiles/ECOSYSTEM.a2ml" + agentic: "descriptiles/AGENTIC.a2ml" + neurosym: "descriptiles/NEUROSYM.a2ml" + playbook: "descriptiles/PLAYBOOK.a2ml" + clade: "descriptiles/CLADE.a2ml" + anchors: "descriptiles/anchors/" policies: "policies/" ai_configs: "ai/" compliance: "compliance/" diff --git a/.machine_readable/ai/.clinerules b/.machine_readable/ai/.clinerules index 4818351..32565bc 100644 --- a/.machine_readable/ai/.clinerules +++ b/.machine_readable/ai/.clinerules @@ -2,7 +2,7 @@ # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # Authoritative source: docs/AI-CONVENTIONS.md -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/6a2/STATE.a2ml. +# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/descriptiles/STATE.a2ml. # LICENSE # All original code: MPL-2.0. diff --git a/.machine_readable/ai/.windsurfrules b/.machine_readable/ai/.windsurfrules index 4818351..32565bc 100644 --- a/.machine_readable/ai/.windsurfrules +++ b/.machine_readable/ai/.windsurfrules @@ -2,7 +2,7 @@ # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # Authoritative source: docs/AI-CONVENTIONS.md -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/6a2/STATE.a2ml. +# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/descriptiles/STATE.a2ml. # LICENSE # All original code: MPL-2.0. diff --git a/.machine_readable/ai/AI.a2ml b/.machine_readable/ai/AI.a2ml index 3754aca..ed3cd3c 100644 --- a/.machine_readable/ai/AI.a2ml +++ b/.machine_readable/ai/AI.a2ml @@ -7,8 +7,8 @@ - Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing. ## Workflow -1. Inspect `.machine_readable/6a2/STATE.a2ml` for blockers and next actions. -2. Respect any constraints listed inside `.machine_readable/6a2/AGENTIC.a2ml` when tooling changes are requested. +1. Inspect `.machine_readable/descriptiles/STATE.a2ml` for blockers and next actions. +2. Respect any constraints listed inside `.machine_readable/descriptiles/AGENTIC.a2ml` when tooling changes are requested. 3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message. ## Delivery Promises diff --git a/.machine_readable/ai/README.adoc b/.machine_readable/ai/README.adoc index 29d3c06..a5dec59 100644 --- a/.machine_readable/ai/README.adoc +++ b/.machine_readable/ai/README.adoc @@ -16,9 +16,9 @@ Avoid scattering agent instruction files around the repo root. Recommended machine read order: -* `.machine_readable/6a2/anchors/ANCHOR.a2ml` +* `.machine_readable/descriptiles/anchors/ANCHOR.a2ml` * `.machine_readable/policies/MAINTENANCE-AXES.a2ml` * `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` * `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -* `.machine_readable/6a2/STATE.a2ml` -* `.machine_readable/6a2/META.a2ml` +* `.machine_readable/descriptiles/STATE.a2ml` +* `.machine_readable/descriptiles/META.a2ml` diff --git a/.machine_readable/arrival-pack/claude-md.k9.ncl b/.machine_readable/arrival-pack/claude-md.k9.ncl index 969e8bf..d3fbb1c 100644 --- a/.machine_readable/arrival-pack/claude-md.k9.ncl +++ b/.machine_readable/arrival-pack/claude-md.k9.ncl @@ -34,11 +34,11 @@ K9! # Inputs the projection reads (single source of truth). inputs = { descriptiles = [ - ".machine_readable/6a2/CLADE.a2ml", - ".machine_readable/6a2/ECOSYSTEM.a2ml", - ".machine_readable/6a2/AGENTIC.a2ml", - ".machine_readable/6a2/STATE.a2ml", - ".machine_readable/6a2/anchors/ANCHOR.a2ml", + ".machine_readable/descriptiles/CLADE.a2ml", + ".machine_readable/descriptiles/ECOSYSTEM.a2ml", + ".machine_readable/descriptiles/AGENTIC.a2ml", + ".machine_readable/descriptiles/STATE.a2ml", + ".machine_readable/descriptiles/anchors/ANCHOR.a2ml", ], estate_common = "hyperpolymath/manifesto@", # DRAFT-unratified today target = "CLAUDE.md", diff --git a/.machine_readable/arrival-pack/extract.sh b/.machine_readable/arrival-pack/extract.sh index b77a8d5..c0adf70 100755 --- a/.machine_readable/arrival-pack/extract.sh +++ b/.machine_readable/arrival-pack/extract.sh @@ -13,7 +13,7 @@ # Determinism (no timestamps) is required so the k9 drift check can byte-compare. set -euo pipefail -DIR6A2="${1:-.machine_readable/6a2}" +DIR6A2="${1:-.machine_readable/descriptiles}" CLADE="$DIR6A2/CLADE.a2ml" ECO="$DIR6A2/ECOSYSTEM.a2ml" AGENTIC="$DIR6A2/AGENTIC.a2ml" diff --git a/.machine_readable/arrival-pack/generate.sh b/.machine_readable/arrival-pack/generate.sh index 3caafa9..ac2a859 100755 --- a/.machine_readable/arrival-pack/generate.sh +++ b/.machine_readable/arrival-pack/generate.sh @@ -13,7 +13,7 @@ ROOT="$(git rev-parse --show-toplevel)" AP="$ROOT/.machine_readable/arrival-pack" TARGET="$ROOT/CLAUDE.md" -bash "$AP/extract.sh" "$ROOT/.machine_readable/6a2" > "$AP/claude-md-data.json" +bash "$AP/extract.sh" "$ROOT/.machine_readable/descriptiles" > "$AP/claude-md-data.json" nickel export --format raw "$AP/arrival-pack.ncl" > "$AP/.region.tmp" if [ -f "$TARGET" ] && grep -q 'ARRIVAL-PACK:BEGIN' "$TARGET"; then diff --git a/.machine_readable/arrival-pack/verify.sh b/.machine_readable/arrival-pack/verify.sh index 0763f00..1d90acf 100755 --- a/.machine_readable/arrival-pack/verify.sh +++ b/.machine_readable/arrival-pack/verify.sh @@ -13,7 +13,7 @@ TARGET="$ROOT/CLAUDE.md" [ -f "$TARGET" ] || { echo "DRIFT: CLAUDE.md missing — run \`just claude-md\`"; exit 1; } -bash "$AP/extract.sh" "$ROOT/.machine_readable/6a2" > "$AP/claude-md-data.json" +bash "$AP/extract.sh" "$ROOT/.machine_readable/descriptiles" > "$AP/claude-md-data.json" fresh="$(nickel export --format raw "$AP/arrival-pack.ncl")" committed="$(awk '/