Phase 0 follow-up: TROPECHECK_PIN bumped to post-ratification trope-checker (#44), AFFIRMATION review-round fixes, README M2 wording (vocarium)

.github/workflows/governance.yml

@@ -19,4 +19,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
+    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@857ff096af11451841fb10488fed1438523973a1

.github/workflows/hypatia-scan.yml

@@ -28,4 +28,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
+    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@857ff096af11451841fb10488fed1438523973a1

.github/workflows/mirror.yml

@@ -14,5 +14,15 @@ permissions:
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
-    secrets: inherit
+    uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@857ff096af11451841fb10488fed1438523973a1
+    secrets:
+      GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
+      BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
+      CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }}
+      SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }}
+      DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }}
+      GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }}
+      RADICLE_KEY: ${{ secrets.RADICLE_KEY }}
+      R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+      R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      R2_AGE_RECIPIENT: ${{ secrets.R2_AGE_RECIPIENT }}

.github/workflows/rust-ci.yml

@@ -17,4 +17,4 @@ permissions:
   contents: read
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
+    uses: metadatastician/standards/.github/workflows/rust-ci-reusable.yml@857ff096af11451841fb10488fed1438523973a1

.github/workflows/scorecard.yml

@@ -17,11 +17,12 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
+    uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@857ff096af11451841fb10488fed1438523973a1
     # Reusable called-workflow permissions are CAPPED by the caller's grants;
     # without security-events: write here the scorecard SARIF upload fails with
     # startup_failure (hypatia WF018). id-token: write enables OIDC publish.
     permissions:
+      actions: read
       contents: read
       security-events: write
       id-token: write

AFFIRMATION.adoc

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: CC-BY-SA-4.0
 // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-= AFFIRMATION — Vocarium, as of 2026-10-27T08:17Z
+= AFFIRMATION — Vocarium, as of 2026-11-04T22:52Z
 :toc: macro
 :toclevels: 2
 
@@ -12,9 +12,10 @@ toc::[]
 
 A short, dated, signed snapshot of what hyperpolymath can honestly and verifiably
 claim about *Vocarium* at one exact commit. Nothing here is marketing or a
-promise; those live in the README. Every claim is tied to a command, and where a
-command could not be run in the session that wrote this file it says so and names
-the run that attests it instead. The anchor (<<verifiable-anchor>>) fixes commit,
+promise; those live in the README. Every claim is tied to a command or, for a claim
+affirmed by reading, to the named source files; where a command could not be run in
+the session that wrote this file it says so and names the run that attests it
+instead. The anchor (<<verifiable-anchor>>) fixes commit,
 time and toolchain. It is to be landed by a signed commit — the owner signs on
 landing.
 
@@ -32,35 +33,46 @@ failing run, or a contradicting source.
 
 | The store engine `voc` (pure Zig, no C; ADR-0002) builds and its unit tests
 pass under the pinned Zig 0.16.0.
-| NOT RUN here — attested by CI run 40472451463 on commit 71c4374 (success, 2026-10-27T08:17:46Z)
-| `zig build test` (Zig 0.16.0, `.tool-versions`). The session that wrote this
+| NOT RUN here — attested by CI run 41928746295 on commit 376d03a (success, 2026-11-04T22:52:47Z)
+| `zig build test`, then `zig build` (Zig 0.16.0, `.tool-versions`) — the gate
+runs both before it uses `zig-out/bin/voc`. The session that wrote this
 file could not run Zig: ziglang.org and its mirrors were unreachable and a
 checksummed conda-forge 0.16.0 binary was obtained but not permitted to execute.
 CI runs it on pushes to `main`, pull requests and manual dispatch:
 `.github/workflows/vocarium-ci.yml` (mlugg/setup-zig pinned to 0.16.0). On this
-branch, at commit 71c43744ca5304cc7c228c5d8273ef92be789a4e: job "invoke-slice gate" of
-https://github.com/hyperpolymath/vocarium/actions/runs/40472451463 — success,
-2026-10-27T08:17:46Z.
+branch, at commit 376d03a (the checker pin already `4ecba4f`): job "invoke-slice
+gate" of https://github.com/hyperpolymath/vocarium/actions/runs/41928746295 —
+success, 2026-11-04T22:52:47Z. (The 2026-10-27 snapshot cited run 40472451463 on
+71c4374 at the old pin.)
 
 | The M1 invoke slice holds end to end: the canonical fixture ingests; the same
 stored trope yields opposite tropecheck verdicts under two use-models
 (`casual-note` → `p-sufficient`, `critical-paraphrase` → `p-insufficient` with
 the witness edge named); an unwarranted edge is refused at the store door.
-| NOT RUN here — attested by CI run 40472451463 on commit 71c4374 (success, 2026-10-27T08:17:46Z)
-| `TROPECHECK_BIN=/path/to/tropecheck-rs bash tests/e2e/invoke_slice.sh` (placeholder path) → expected
-`GATE PASS: invoke slice proven (use-relativity + warrant door + unit tests)`.
-Same CI workflow (`./tests/e2e/invoke_slice.sh`), which hard-fails on toolchain
-absence or skew. Note: without `TROPECHECK_BIN` the script builds the checker at
-its own pin `69221ad6`; with it set, the pin is bypassed. The pin predates the
-spec v0.2 consolidation and is to be bumped once Phase 0 lands upstream (issue
-filed, not changed here).
+| NOT RUN here — attested by CI run 41928746295 on commit 376d03a (success, 2026-11-04T22:52:47Z)
+| CI reproduction, exactly as `.github/workflows/vocarium-ci.yml` runs it:
+`./tests/e2e/invoke_slice.sh` (no `TROPECHECK_BIN`) → expected final line
+`GATE PASS: invoke slice proven (use-relativity + warrant door + unit tests)`. The
+script hard-fails on toolchain absence or skew, clones trope-checker at its pin
+`4ecba4f` (trope-checker `main` after Phase 0 landed there; bumped from
+`69221ad6`, issue #44) and builds `tropecheck-rs` from it. A separate local check,
+not the CI reproduction: `TROPECHECK_BIN=/path/to/tropecheck-rs bash
+tests/e2e/invoke_slice.sh` (placeholder path) bypasses the pin and accepts any
+executable. Probe run here for the pin bump (not the gate — Zig is still absent):
+the IR that `src/store/emit.zig` writes for `examples/vocarium-ingest.jsonl`,
+reconstructed by hand, was fed to `tropecheck-rs` built from `4ecba4f` and gave
+`casual-note` → `p-sufficient` (exit 0) and `critical-paraphrase` →
+`p-insufficient witness=e_paraphrase coord=fate.quality` (exit 1), the verdicts
+the gate asserts.
 
 | The store format is append-only JSONL (one record per line, `"t"` one of `trope`, `edge`, `use_model`, `warrant`)
 replayed into in-memory indexes; the only external contract is Trope IR v0.2 over
 process I/O, verified by `tropecheck`.
 | affirmed (by reading)
-| `src/store/`, `docs/decisions/0002-pure-zig-wire-boundary.adoc`; the schema
-at `trope-checker/schemas/trope-ir.schema.json` is the trust boundary.
+| `src/store/`, `docs/decisions/0002-pure-zig-wire-boundary.adoc`; the schema at
+https://github.com/hyperpolymath/trope-checker/blob/4ecba4f1862aec144ec940b1d8a93ddabd1cb591/schemas/trope-ir.schema.json
+(the gate's pinned revision; the gate clones it into `.gate-tools/trope-checker`
+when `TROPECHECK_BIN` is unset — it is not vendored here) is the trust boundary.
 |===
 
 == What we do NOT claim
@@ -80,11 +92,12 @@ at `trope-checker/schemas/trope-ir.schema.json` is the trust boundary.
 |===
 | Project | Vocarium
 | Repository | https://github.com/hyperpolymath/vocarium
-| Commit (SHA) tested | 71c43744ca5304cc7c228c5d8273ef92be789a4e (this branch; the commit CI run 40472451463 ran on)
-| Affirmed base | 57944e6ad15067a29456096654e4f7dee44dc816 (`main` at the time; differs from the tested commit only in this file and the README, so the gate result carries over to it)
-| Landing commit | the signed commit that lands this snapshot on `main` (the file itself predates it as a template); after landing, `git log --first-parent --show-signature -1 main -- AFFIRMATION.adoc` selects it. A file cannot record its own commit's SHA
-| Timestamp (UTC) | 2026-10-27T08:17:46Z (completion of the cited CI gate job)
-| Toolchain | Zig 0.16.0 pinned in `.tool-versions`, which the gate enforces; `mise.toml` still says `zig = "latest"` — a drift the gate would reject, to be reconciled (issue). Checker for the gate: `tropecheck-rs` from trope-checker (script pin `69221ad6`; the session's binary was built from 44020f9). Zig was not executed in this session (see above).
+| Commit (SHA) tested | 376d03a (this branch; the commit CI run 41928746295 ran on, with the checker pin at `4ecba4f`)
+| Affirmed base | c9381f10d180969ef343d9cde0179b829627d90d (`main` at the time; differs from the tested commit in `tests/e2e/invoke_slice.sh` (the pin), this file and the README only)
+| Previous snapshot | 2026-10-27T08:17Z, tested commit 71c4374, CI run 40472451463, landed on `main` as 297bdd9 (squash of #42; GitHub reports the commit as verified, signed by GitHub's web-flow key on the owner's merge)
+| Landing commit | the commit that lands this snapshot on `main`; after landing, `git log --first-parent --show-signature -1 main -- AFFIRMATION.adoc` selects it. A file cannot record its own commit's SHA
+| Timestamp (UTC) | 2026-11-04T22:52:47Z (completion of the cited CI gate job)
+| Toolchain | Zig 0.16.0 pinned in `.tool-versions`; the gate reads that file and compares it with `zig version`, so an environment in which `mise.toml`'s `zig = "latest"` resolves to anything else fails the gate (the gate does not read `mise.toml` itself; the drift is issue #46). Checker for the gate: `tropecheck-rs` built from trope-checker at the script pin `4ecba4f` (the probe binary in this session was built from the same revision; the 2026-10-27 session's was from 44020f9). Zig was not executed in either session (see above).
 | Affirmed by | Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> (owner signs on landing; written by the Phase 0 agent)
 |===
 

README.adoc

@@ -165,6 +165,8 @@ Vocarium is an experimental database architecture for trope-aware, loss-aware, w
 
 Vocabulary track: trope-particularity-workbench → haec → trope-checker (verdict). Store/query track: haec → vocarium → hermeneia → trope-checker (verdict). trope-checker depends on nothing (HC-1); the workbench depends on nothing; vocarium and hermeneia meet at the M2 StoreProvider adapter (vocarium ADR-0002: wire, do not link).
 
+The M2 adapter is planned, not built: a Hermeneia-side Rust `StoreProvider` that drives `voc` as a subprocess over the Trope IR v0.2 JSON contract (see `AFFIRMATION.adoc`, "What we do NOT claim"). The five-repo paragraph above is shared verbatim across the five READMEs; this sentence is Vocarium's own.
+
 ## Relationship to other systems
 
 Vocarium is part of a wider language/database ecology:

tests/e2e/invoke_slice.sh

@@ -17,7 +17,7 @@ set -euo pipefail
 cd "$(dirname "$0")/../.."
 
 ZIG_EXPECTED="$(awk '$1=="zig"{print $2}' .tool-versions)"
-TROPECHECK_PIN="69221ad6bec0c9286cb5c917edfad281e7e0089e"
+TROPECHECK_PIN="4ecba4f1862aec144ec940b1d8a93ddabd1cb591"
 
 fail() { echo "GATE FAIL: $*" >&2; exit 1; }