From af7ae9efe85b9b18f0c8bd24556cd9f148c798d1 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 26 May 2026 12:15:49 +0100
Subject: [PATCH 1/7] chore(fixtures): delete stale SafeDOMExample.res ReScript
 fixture (Refs gitbot-fleet#148, #208; affinescript#229)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removes 2 copies of the stale SafeDOMExample.res ReScript fixture from this repo. One of 1,267 byte-clustered copies across the estate (129 repos). ReScript is fully banned in new code (2026-04-30 policy refresh). Current-grammar AffineScript replacement lives at gitbot-fleet/bots/*/examples/SafeDOMExample.affine (PR gitbot-fleet#210 MERGED). The example fixtures are not load-bearing — propagated from an earlier template-instantiation script.

Refs hyperpolymath/gitbot-fleet#148, #208
Refs hyperpolymath/affinescript#57, #229

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 examples/SafeDOMExample.res            | 109 -------------------------
 playground/examples/SafeDOMExample.res | 109 -------------------------
 2 files changed, 218 deletions(-)
 delete mode 100644 examples/SafeDOMExample.res
 delete mode 100644 playground/examples/SafeDOMExample.res

diff --git a/examples/SafeDOMExample.res b/examples/SafeDOMExample.res
deleted file mode 100644
index e5c9046..0000000
--- a/examples/SafeDOMExample.res
+++ /dev/null
@@ -1,109 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-// Example: Using SafeDOM for formally verified DOM mounting
-
-open SafeDOM
-
-// Example 1: Basic mounting with error handling
-let mountApp = () => {
-  mountSafe(
-    "#app",
-    "<div><h1>Hello, World!</h1><p>Mounted safely with proofs.</p></div>",
-    ~onSuccess=el => {
-      Console.log("✓ App mounted successfully!")
-      Console.log("Element:", el)
-    },
-    ~onError=err => {
-      Console.error("✗ Mount failed:", err)
-    }
-  )
-}
-
-// Example 2: Wait for DOM ready before mounting
-let mountWhenDOMReady = () => {
-  mountWhenReady(
-    "#app",
-    "<div class='container'><h1>App Title</h1></div>",
-    ~onSuccess=_ => Console.log("✓ Mounted after DOM ready"),
-    ~onError=err => Console.error("✗ Failed:", err)
-  )
-}
-
-// Example 3: Batch mounting (atomic - all or nothing)
-let mountMultiple = () => {
-  let specs = [
-    {selector: "#header", html: "<header><h1>Site Title</h1></header>"},
-    {selector: "#nav", html: "<nav><a href='/'>Home</a></nav>"},
-    {selector: "#main", html: "<main><p>Content here</p></main>"},
-    {selector: "#footer", html: "<footer>© 2026</footer>"}
-  ]
-
-  switch mountBatch(specs) {
-  | Ok(elements) => {
-      Console.log(`✓ Successfully mounted ${Array.length(elements)} elements`)
-      elements->Array.forEach(el => Console.log("  -", el))
-    }
-  | Error(err) => {
-      Console.error("✗ Batch mount failed:", err)
-      Console.error("  (None were mounted - atomic operation)")
-    }
-  }
-}
-
-// Example 4: Explicit validation before mounting
-let mountWithValidation = () => {
-  // Validate selector first
-  switch ProvenSelector.validate("#my-app") {
-  | Error(e) => Console.error(`Invalid selector: ${e}`)
-  | Ok(validSelector) => {
-      // Validate HTML
-      switch ProvenHTML.validate("<div>Content</div>") {
-      | Error(e) => Console.error(`Invalid HTML: ${e}`)
-      | Ok(validHtml) => {
-          // Now mount with proven safety
-          switch mount(validSelector, validHtml) {
-          | Mounted(el) => Console.log("✓ Mounted with validated inputs:", el)
-          | MountPointNotFound(s) => Console.error(`✗ Element not found: ${s}`)
-          | InvalidSelector(_) => Console.error("Impossible - already validated")
-          | InvalidHTML(_) => Console.error("Impossible - already validated")
-          }
-        }
-      }
-    }
-}
-
-// Example 5: Integration with TEA
-module MyApp = {
-  type model = {message: string}
-  type msg = NoOp
-
-  let init = () => {message: "Hello from TEA"}
-  let update = (model, _msg) => model
-  let view = model => `<div><h1>${model.message}</h1></div>`
-}
-
-let mountTEAApp = () => {
-  let model = MyApp.init()
-  let html = MyApp.view(model)
-
-  mountWhenReady(
-    "#tea-app",
-    html,
-    ~onSuccess=el => {
-      Console.log("✓ TEA app mounted")
-      // Set up event handlers, subscriptions here
-    },
-    ~onError=err => Console.error(`✗ TEA mount failed: ${err}`)
-  )
-}
-
-// Entry point
-let main = () => {
-  Console.log("SafeDOM Examples")
-  Console.log("================\n")
-
-  // Choose which example to run
-  mountWhenDOMReady()  // Run on DOM ready
-}
-
-// Auto-execute when module loads
-main()
diff --git a/playground/examples/SafeDOMExample.res b/playground/examples/SafeDOMExample.res
deleted file mode 100644
index e5c9046..0000000
--- a/playground/examples/SafeDOMExample.res
+++ /dev/null
@@ -1,109 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-// Example: Using SafeDOM for formally verified DOM mounting
-
-open SafeDOM
-
-// Example 1: Basic mounting with error handling
-let mountApp = () => {
-  mountSafe(
-    "#app",
-    "<div><h1>Hello, World!</h1><p>Mounted safely with proofs.</p></div>",
-    ~onSuccess=el => {
-      Console.log("✓ App mounted successfully!")
-      Console.log("Element:", el)
-    },
-    ~onError=err => {
-      Console.error("✗ Mount failed:", err)
-    }
-  )
-}
-
-// Example 2: Wait for DOM ready before mounting
-let mountWhenDOMReady = () => {
-  mountWhenReady(
-    "#app",
-    "<div class='container'><h1>App Title</h1></div>",
-    ~onSuccess=_ => Console.log("✓ Mounted after DOM ready"),
-    ~onError=err => Console.error("✗ Failed:", err)
-  )
-}
-
-// Example 3: Batch mounting (atomic - all or nothing)
-let mountMultiple = () => {
-  let specs = [
-    {selector: "#header", html: "<header><h1>Site Title</h1></header>"},
-    {selector: "#nav", html: "<nav><a href='/'>Home</a></nav>"},
-    {selector: "#main", html: "<main><p>Content here</p></main>"},
-    {selector: "#footer", html: "<footer>© 2026</footer>"}
-  ]
-
-  switch mountBatch(specs) {
-  | Ok(elements) => {
-      Console.log(`✓ Successfully mounted ${Array.length(elements)} elements`)
-      elements->Array.forEach(el => Console.log("  -", el))
-    }
-  | Error(err) => {
-      Console.error("✗ Batch mount failed:", err)
-      Console.error("  (None were mounted - atomic operation)")
-    }
-  }
-}
-
-// Example 4: Explicit validation before mounting
-let mountWithValidation = () => {
-  // Validate selector first
-  switch ProvenSelector.validate("#my-app") {
-  | Error(e) => Console.error(`Invalid selector: ${e}`)
-  | Ok(validSelector) => {
-      // Validate HTML
-      switch ProvenHTML.validate("<div>Content</div>") {
-      | Error(e) => Console.error(`Invalid HTML: ${e}`)
-      | Ok(validHtml) => {
-          // Now mount with proven safety
-          switch mount(validSelector, validHtml) {
-          | Mounted(el) => Console.log("✓ Mounted with validated inputs:", el)
-          | MountPointNotFound(s) => Console.error(`✗ Element not found: ${s}`)
-          | InvalidSelector(_) => Console.error("Impossible - already validated")
-          | InvalidHTML(_) => Console.error("Impossible - already validated")
-          }
-        }
-      }
-    }
-}
-
-// Example 5: Integration with TEA
-module MyApp = {
-  type model = {message: string}
-  type msg = NoOp
-
-  let init = () => {message: "Hello from TEA"}
-  let update = (model, _msg) => model
-  let view = model => `<div><h1>${model.message}</h1></div>`
-}
-
-let mountTEAApp = () => {
-  let model = MyApp.init()
-  let html = MyApp.view(model)
-
-  mountWhenReady(
-    "#tea-app",
-    html,
-    ~onSuccess=el => {
-      Console.log("✓ TEA app mounted")
-      // Set up event handlers, subscriptions here
-    },
-    ~onError=err => Console.error(`✗ TEA mount failed: ${err}`)
-  )
-}
-
-// Entry point
-let main = () => {
-  Console.log("SafeDOM Examples")
-  Console.log("================\n")
-
-  // Choose which example to run
-  mountWhenDOMReady()  // Run on DOM ready
-}
-
-// Auto-execute when module loads
-main()

From 1a3479818e14e876bdace77abf9b491a24fe2290 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 1 Jun 2026 01:08:28 +0100
Subject: [PATCH 2/7] ci: fix CI/CD configuration (campaigns C001-C005)

- C001: CodeQL language fixes
- C002: License identifier standardization
- C003: Outdated actions audit
- C004: Pin standards refs to SHA 861b5e9
- C005: Add workflow-level permissions
---
 .github/workflows/codeql.yml     | 1 +
 .github/workflows/governance.yml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a94ae1c..805379b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -9,6 +9,7 @@ on:
   schedule:
     - cron: '0 6 * * 1'  # Weekly on Monday
 
+
 permissions: read-all
 
 jobs:
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index b0b1ed6..b4062e0 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -23,4 +23,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613

From 4cea9e741e122492c16df133452b497dc7349432 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 3 Jun 2026 14:46:22 +0100
Subject: [PATCH 3/7] docs: add OpenSSF Best Practices registration badge

---
 README.adoc | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/README.adoc b/README.adoc
index df35cf0..3040fd6 100644
--- a/README.adoc
+++ b/README.adoc
@@ -1,11 +1,14 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Error-Lang: Systems Thinking Education Through Computational Haptics
+image:https://img.shields.io/badge/OpenSSF-Best_Practices-green?logo=openssourcesecurity[OpenSSF Best Practices,link="https://www.bestpractices.dev/en/projects/new?repo_url=https://github.com/hyperpolymath/error-lang"]
+
 :toc: preamble
 :toclevels: 3
 :icons: font
 :source-highlighter: rouge
 
-image:https://img.shields.io/badge/License-PMPL--1.0--or--later-indigo.svg[License: MPL-2.0,link="https://github.com/hyperpolymath/palimpsest-license"]
+image:https://img.shields.io/badge/License-MPL_2.0--1.0--or--later-indigo.svg[License: MPL-2.0,link="https://github.com/hyperpolymath/palimpsest-license"]
 image:https://img.shields.io/badge/Completion-100%25-brightgreen.svg[Completion: 100%]
 image:https://img.shields.io/badge/Status-Production--Ready-success.svg[Status: Production Ready]
 image:https://img.shields.io/badge/Pedagogy-Systems%20Thinking-blue.svg[Pedagogy]
@@ -417,7 +420,7 @@ See link:CONTRIBUTING.adoc[CONTRIBUTING.adoc] for development guidelines.
 
 SPDX-License-Identifier: MPL-2.0
 
-Error-Lang is free software under the https://github.com/hyperpolymath/palimpsest-license[Palimpsest License] (MPL-2.0).
+Error-Lang is free software under the https://github.com/hyperpolymath/palimpsest-license[MPL-2.0] (MPL-2.0).
 
 See link:LICENSE[LICENSE] for full terms.
 

From 1ad65bf91b3a4dea94393d859ed63059bb0556cb Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 4 Jun 2026 18:05:07 +0100
Subject: [PATCH 4/7] chore: flatten self-validating directory structure

---
 .github/ISSUE_TEMPLATE/bug_report.md          |   4 +
 .github/ISSUE_TEMPLATE/custom.md              |   4 +
 .github/ISSUE_TEMPLATE/feature_request.md     |   4 +
 .github/copilot/coding-agent.yml              |   6 +
 .github/workflows/casket-pages.yml            |   2 +
 .github/workflows/codeql.yml                  |   1 +
 .github/workflows/governance.yml              |   1 +
 .github/workflows/hypatia-scan.yml            |   1 +
 .github/workflows/mirror.yml                  |   1 +
 .github/workflows/scorecard.yml               |   1 +
 .machine_readable/6a2/0-AI-MANIFEST.a2ml      |  22 +++
 .machine_readable/6a2/README.adoc             |  20 +++
 .../{svc/k9 => self-validating}/README.adoc   |   1 +
 .../examples/ci-config.k9.ncl                 |   0
 .../examples/project-metadata.k9.ncl          |   0
 .../examples/setup-repo.k9.ncl                |   0
 .../template-hunt.k9.ncl                      |   0
 .../template-kennel.k9.ncl                    |   0
 .../template-yard.k9.ncl                      |   0
 .machine_readable/svc/README.adoc             |   2 +
 ABI-FFI-README.md                             |   4 +
 CODE_OF_CONDUCT.md                            |   4 +
 CONTINUATION-GUIDE.adoc                       |   1 +
 CONTRIBUTING.adoc                             |   1 +
 CONTRIBUTING.md                               |   4 +
 ERROR-LANG-COMPLETION-2026-02-07.md           |   4 +
 LICENSE                                       | 165 +++++++-----------
 MAINTAINERS.adoc                              |   1 +
 PROOF-NEEDS.md                                |   4 +
 ROADMAP.adoc                                  |   1 +
 RSR_OUTLINE.adoc                              |   4 +-
 SECURITY.md                                   |   4 +
 WHITEPAPER.md                                 |   4 +
 WOKELANG-COMPARISON.md                        |   4 +
 cli/analyze.js                                |   3 +-
 cli/ast-dump.js                               |   4 +-
 cli/explore.js                                |   3 +-
 cli/five-whys.js                              |   1 +
 cli/layer-navigator.js                        |   1 +
 cli/lsp-server.ts                             |   3 +-
 cli/main.js                                   |   3 +-
 cli/runtime.js                                |   1 +
 cli/stability-tracker.js                      |   1 +
 cli/visual-feedback.js                        |   1 +
 compiler/error-lang-ast/src/lib.rs            |   1 +
 compiler/error-wasm/src/lib.rs                |   1 +
 contractiles/README.adoc                      |   2 +
 docs/CITATIONS.adoc                           |   2 +
 docs/Curriculum.adoc                          |   1 +
 docs/Design-Philosophy.adoc                   |   1 +
 docs/Educational-Framework.adoc               |   1 +
 docs/Error-Categories.adoc                    |   1 +
 docs/Error-Ecosystem-Vision.adoc              |   1 +
 docs/Error-Lang.adoc                          |   1 +
 error-pkg/src/haptics.rs                      |   2 +-
 error-pkg/src/install.rs                      |   2 +-
 error-pkg/src/lib.rs                          |   2 +-
 error-pkg/src/main.rs                         |   2 +-
 error-pkg/src/registry.rs                     |   2 +-
 error-pkg/src/resolve.rs                      |   2 +-
 error-pkg/src/types.rs                        |   2 +-
 ffi/zig/build.zig                             |   3 +-
 ffi/zig/src/main.zig                          |   3 +-
 ffi/zig/test/integration_test.zig             |   3 +-
 ide/ARCHITECTURE.adoc                         |   1 +
 ide/INTEGRATION.adoc                          |   1 +
 ide/README.adoc                               |   1 +
 ide/src/MonacoInterop.js                      |   1 +
 ide/src/monaco-setup.js                       |   1 +
 ide/vite.config.js                            |   1 +
 playground/docs/CITATIONS.adoc                |   2 +
 site/index.md                                 |   4 +
 spec/README.adoc                              |   1 +
 spec/axiomatic-semantics.md                   |   4 +
 spec/operational-semantics.md                 |   4 +
 spec/system-specs.md                          |   4 +
 spec/type-system.md                           |   4 +
 src/abi/Foreign.idr                           |   2 +
 tools/lsp/src/backend.rs                      |   1 +
 tools/lsp/src/main.rs                         |   1 +
 verification/README.adoc                      |   1 +
 81 files changed, 248 insertions(+), 117 deletions(-)
 create mode 100644 .github/copilot/coding-agent.yml
 create mode 100644 .machine_readable/6a2/0-AI-MANIFEST.a2ml
 create mode 100644 .machine_readable/6a2/README.adoc
 rename .machine_readable/{svc/k9 => self-validating}/README.adoc (98%)
 rename .machine_readable/{svc/k9 => self-validating}/examples/ci-config.k9.ncl (100%)
 rename .machine_readable/{svc/k9 => self-validating}/examples/project-metadata.k9.ncl (100%)
 rename .machine_readable/{svc/k9 => self-validating}/examples/setup-repo.k9.ncl (100%)
 rename .machine_readable/{svc/k9 => self-validating}/template-hunt.k9.ncl (100%)
 rename .machine_readable/{svc/k9 => self-validating}/template-kennel.k9.ncl (100%)
 rename .machine_readable/{svc/k9 => self-validating}/template-yard.k9.ncl (100%)

diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index dd84ea7..15a8978 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Bug report
 about: Create a report to help us improve
diff --git a/.github/ISSUE_TEMPLATE/custom.md b/.github/ISSUE_TEMPLATE/custom.md
index 48d5f81..99ebf00 100644
--- a/.github/ISSUE_TEMPLATE/custom.md
+++ b/.github/ISSUE_TEMPLATE/custom.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Custom issue template
 about: Describe this issue template's purpose here.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
index bbcbbe7..41a5455 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 name: Feature request
 about: Suggest an idea for this project
diff --git a/.github/copilot/coding-agent.yml b/.github/copilot/coding-agent.yml
new file mode 100644
index 0000000..a719a77
--- /dev/null
+++ b/.github/copilot/coding-agent.yml
@@ -0,0 +1,6 @@
+mcp_servers:
+  boj-server:
+    command: npx
+    args: ["-y", "@hyperpolymath/boj-server@latest"]
+    env:
+      BOJ_URL: http://localhost:7700
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index f6d4979..24e0c75 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
@@ -91,6 +92,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: build
     steps:
       - name: Deploy to GitHub Pages
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 805379b..b8873b2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -16,6 +16,7 @@ jobs:
   analyze:
     name: CodeQL Analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       security-events: write
       contents: read
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index b4062e0..a044174 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -24,3 +24,4 @@ permissions:
 jobs:
   governance:
     uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+    timeout-minutes: 10
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index dfacf3b..127905d 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -43,6 +43,7 @@ jobs:
   scan:
     name: Hypatia Neurosymbolic Analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index d44c9a3..22b4696 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -11,6 +11,7 @@ jobs:
   mirror:
     name: Sync to Forges
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     if: vars.GITLAB_MIRROR_ENABLED == 'true' || vars.BITBUCKET_MIRROR_ENABLED == 'true'
     permissions:
       contents: read
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 19e26ef..bfb4b61 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -16,6 +16,7 @@ jobs:
   analysis:
     name: Scorecard Analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       security-events: write
       id-token: write
diff --git a/.machine_readable/6a2/0-AI-MANIFEST.a2ml b/.machine_readable/6a2/0-AI-MANIFEST.a2ml
new file mode 100644
index 0000000..cede8a9
--- /dev/null
+++ b/.machine_readable/6a2/0-AI-MANIFEST.a2ml
@@ -0,0 +1,22 @@
+# AI Manifest for 6a2 Directory
+
+## Purpose
+
+This manifest declares the AI-assistant context for the 6a2 machine-readable metadata directory.
+
+## Canonical Locations
+
+The 6 core A2ML files MUST exist in this directory:
+1. AGENTIC.a2ml
+2. ECOSYSTEM.a2ml
+3. META.a2ml
+4. NEUROSYM.a2ml
+5. PLAYBOOK.a2ml
+6. STATE.a2ml
+
+## Invariants
+
+- No duplicate files in root directory
+- Single source of truth: this directory is authoritative
+- No stale metadata
+
diff --git a/.machine_readable/6a2/README.adoc b/.machine_readable/6a2/README.adoc
new file mode 100644
index 0000000..ac38c25
--- /dev/null
+++ b/.machine_readable/6a2/README.adoc
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+# A2ML 6a2 Directory
+
+This directory contains the 6 core A2ML machine-readable metadata files for this repository.
+
+## Files
+
+- `AGENTIC.a2ml` - AI agent operational gating, safety controls
+- `ECOSYSTEM.a2ml` - Project ecosystem position, relationships, explicit boundaries
+- `META.a2ml` - Architecture decisions (ADRs), development practices, design rationale
+- `NEUROSYM.a2ml` - Symbolic semantics, composition algebra
+- `PLAYBOOK.a2ml` - Executable plans, operational runbooks
+- `STATE.a2ml` - Project state, phase, milestones, session history
+
+## Standards Compliance
+
+These files follow the A2ML Format Family specification from:
+https://github.com/hyperpolymath/standards/tree/main/a2ml
+
diff --git a/.machine_readable/svc/k9/README.adoc b/.machine_readable/self-validating/README.adoc
similarity index 98%
rename from .machine_readable/svc/k9/README.adoc
rename to .machine_readable/self-validating/README.adoc
index 9c3099f..ce1825f 100644
--- a/.machine_readable/svc/k9/README.adoc
+++ b/.machine_readable/self-validating/README.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = K9 Contractiles
 :toc: left
 :icons: font
diff --git a/.machine_readable/svc/k9/examples/ci-config.k9.ncl b/.machine_readable/self-validating/examples/ci-config.k9.ncl
similarity index 100%
rename from .machine_readable/svc/k9/examples/ci-config.k9.ncl
rename to .machine_readable/self-validating/examples/ci-config.k9.ncl
diff --git a/.machine_readable/svc/k9/examples/project-metadata.k9.ncl b/.machine_readable/self-validating/examples/project-metadata.k9.ncl
similarity index 100%
rename from .machine_readable/svc/k9/examples/project-metadata.k9.ncl
rename to .machine_readable/self-validating/examples/project-metadata.k9.ncl
diff --git a/.machine_readable/svc/k9/examples/setup-repo.k9.ncl b/.machine_readable/self-validating/examples/setup-repo.k9.ncl
similarity index 100%
rename from .machine_readable/svc/k9/examples/setup-repo.k9.ncl
rename to .machine_readable/self-validating/examples/setup-repo.k9.ncl
diff --git a/.machine_readable/svc/k9/template-hunt.k9.ncl b/.machine_readable/self-validating/template-hunt.k9.ncl
similarity index 100%
rename from .machine_readable/svc/k9/template-hunt.k9.ncl
rename to .machine_readable/self-validating/template-hunt.k9.ncl
diff --git a/.machine_readable/svc/k9/template-kennel.k9.ncl b/.machine_readable/self-validating/template-kennel.k9.ncl
similarity index 100%
rename from .machine_readable/svc/k9/template-kennel.k9.ncl
rename to .machine_readable/self-validating/template-kennel.k9.ncl
diff --git a/.machine_readable/svc/k9/template-yard.k9.ncl b/.machine_readable/self-validating/template-yard.k9.ncl
similarity index 100%
rename from .machine_readable/svc/k9/template-yard.k9.ncl
rename to .machine_readable/self-validating/template-yard.k9.ncl
diff --git a/.machine_readable/svc/README.adoc b/.machine_readable/svc/README.adoc
index 3ea1f5c..8e00df2 100644
--- a/.machine_readable/svc/README.adoc
+++ b/.machine_readable/svc/README.adoc
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = `.machine_readable/svc/` — Service components for error-lang
 :toc:
 
diff --git a/ABI-FFI-README.md b/ABI-FFI-README.md
index f06f72c..af300f5 100644
--- a/ABI-FFI-README.md
+++ b/ABI-FFI-README.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 {{~ Aditionally delete this line and fill out the template below ~}}
 
 # {{PROJECT}} ABI/FFI Documentation
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index 31604d2..5c80c98 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # Code of Conduct
 
 <!-- 
diff --git a/CONTINUATION-GUIDE.adoc b/CONTINUATION-GUIDE.adoc
index be1aa8b..0123a17 100644
--- a/CONTINUATION-GUIDE.adoc
+++ b/CONTINUATION-GUIDE.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Error-Lang: Continuation Guide
 :toc:
 :sectnums:
diff --git a/CONTRIBUTING.adoc b/CONTRIBUTING.adoc
index d4cff25..553ddb7 100644
--- a/CONTRIBUTING.adoc
+++ b/CONTRIBUTING.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Contributing to Error-Lang
 
 Thank you for your interest in contributing to Error-Lang!
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c22b3e4..6a793f4 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # Clone the repository
 git clone https://github.com/hyperpolymath/nextgen-languages.git
 cd nextgen-languages
diff --git a/ERROR-LANG-COMPLETION-2026-02-07.md b/ERROR-LANG-COMPLETION-2026-02-07.md
index 8656c71..376cb70 100644
--- a/ERROR-LANG-COMPLETION-2026-02-07.md
+++ b/ERROR-LANG-COMPLETION-2026-02-07.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # Error-Lang 100% Completion Report
 
 **Date:** 2026-02-07
diff --git a/LICENSE b/LICENSE
index 4a7f1aa..d0a1fa1 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,38 +1,3 @@
-SPDX-License-Identifier: MPL-2.0
-SPDX-FileCopyrightText: 2024-2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
-
-------------------------------------------------------------------------
-PREFERRED LICENCE: Palimpsest License (MPL-2.0)
-------------------------------------------------------------------------
-
-This work is governed by the Palimpsest License (MPL-2.0) as
-its primary intended licence. MPL-2.0 extends the Mozilla
-Public License 2.0 (MPL-2.0) with additional provisions for ethical use,
-post-quantum cryptographic provenance, and emotional lineage protection.
-The canonical PMPL text and stewardship information are maintained at:
-  https://github.com/hyperpolymath/palimpsest-license
-
-------------------------------------------------------------------------
-FALLBACK LICENCE: Mozilla Public License 2.0 (MPL-2.0)
-------------------------------------------------------------------------
-
-Because MPL-2.0 is not yet recognised by the Open Source
-Initiative (OSI) or equivalent bodies, this work also carries MPL-2.0
-as its legally-recognised fallback licence.
-
-In any jurisdiction, platform, or context where MPL-2.0 is
-not accepted as a valid licence, or where an OSI-approved licence is
-required, this work is instead governed by the Mozilla Public License,
-Version 2.0.
-
-MPL-2.0 was chosen as the fallback because MPL-2.0 is
-explicitly based on and extends MPL-2.0; it is therefore the closest
-recognised equivalent to the intended licence.
-
-The complete MPL-2.0 text follows below.
-
-------------------------------------------------------------------------
-
 Mozilla Public License Version 2.0
 ==================================
 
@@ -109,17 +74,17 @@ Mozilla Public License Version 2.0
     means the form of the work preferred for making modifications.
 
 1.14. "You" (or "Your")
-    means an individual or a legal entity exercising rights under
-    this License. For legal entities, "You" includes any entity that
-    controls, is controlled by, or is under common control with You.
-    For the purposes of this definition, "control" means (a) the power,
-    direct or indirect, to cause the direction or management of such
-    entity, whether by contract or otherwise, or (b) ownership of more
-    than fifty percent (50%) of the outstanding shares or beneficial
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
     ownership of such entity.
 
 2. License Grants and Conditions
----------------------------------
+--------------------------------
 
 2.1. Grants
 
@@ -144,11 +109,11 @@ distributes such Contribution.
 
 2.3. Limitations on Grant Scope
 
-The licenses granted in this Section 2 are the only rights granted
-under this License. No additional rights or licenses will be implied
-from the distribution or licensing of Covered Software under this
-License. Notwithstanding Section 2.1(b) above, no patent license is
-granted by a Contributor:
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
 
 (a) for any code that a Contributor has removed from Covered Software;
     or
@@ -158,19 +123,19 @@ granted by a Contributor:
     Contributions with other software (except as part of its Contributor
     Version); or
 
-(c) under Patent Claims infringed by Covered Software in the absence
-    of its Contributions.
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
 
-This License does not grant any rights in the trademarks, service
-marks, or logos of any Contributor (except as may be necessary to
-comply with the notice requirements in Section 3.4).
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
 
 2.4. Subsequent Licenses
 
 No Contributor makes additional grants as a result of Your choice to
 distribute the Covered Software under a subsequent version of this
-License (see Section 10.2) or under the terms of a Secondary License
-(if permitted under the terms of Section 3.3).
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
 
 2.5. Representation
 
@@ -186,11 +151,11 @@ equivalents.
 
 2.7. Conditions
 
-Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses
-granted in Section 2.1.
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
 
 3. Responsibilities
---------------------
+-------------------
 
 3.1. Distribution of Source Form
 
@@ -207,10 +172,10 @@ Form.
 If You distribute Covered Software in Executable Form then:
 
 (a) such Covered Software must also be made available in Source Code
-    Form, as described in Section 3.1, and You must inform recipients
-    of the Executable Form how they can obtain a copy of such Source
-    Code Form by reasonable means in a timely manner, at a charge no
-    more than the cost of distribution to the recipient; and
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
 
 (b) You may distribute such Executable Form under the terms of this
     License, or sublicense it under different terms, provided that the
@@ -222,8 +187,8 @@ If You distribute Covered Software in Executable Form then:
 You may create and distribute a Larger Work under terms of Your choice,
 provided that You also comply with the requirements of this License for
 the Covered Software. If the Larger Work is a combination of Covered
-Software with a work governed by one or more Secondary Licenses, and
-the Covered Software is not Incompatible With Secondary Licenses, this
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
 License permits You to additionally distribute such Covered Software
 under the terms of such Secondary License(s), so that the recipient of
 the Larger Work may, at their option, further distribute the Covered
@@ -241,28 +206,28 @@ the extent required to remedy known factual inaccuracies.
 3.5. Application of Additional Terms
 
 You may choose to offer, and to charge a fee for, warranty, support,
-indemnity or liability obligations to one or more recipients of
-Covered Software. However, You may do so only on Your own behalf, and
-not on behalf of any Contributor. You must make it absolutely clear
-that any such warranty, support, indemnity, or liability obligation is
-offered by You alone, and You hereby agree to indemnify every
-Contributor for any liability incurred by such Contributor as a result
-of warranty, support, indemnity or liability terms You offer. You may
-include additional disclaimers of warranty and limitations of liability
-specific to any jurisdiction.
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
 
 4. Inability to Comply Due to Statute or Regulation
------------------------------------------------------
+---------------------------------------------------
 
 If it is impossible for You to comply with any of the terms of this
 License with respect to some or all of the Covered Software due to
 statute, judicial order, or regulation then You must: (a) comply with
 the terms of this License to the maximum extent possible; and (b)
-describe the limitations and the code they affect. Such description
-must be placed in a text file included with all distributions of the
-Covered Software under this License. Except to the extent prohibited
-by statute or regulation, such description must be sufficiently
-detailed for a recipient of ordinary skill to be able to understand it.
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
 
 5. Termination
 --------------
@@ -271,27 +236,27 @@ detailed for a recipient of ordinary skill to be able to understand it.
 if You fail to comply with any of its terms. However, if You become
 compliant, then the rights granted under this License from a particular
 Contributor are reinstated (a) provisionally, unless and until such
-Contributor explicitly and finally terminates Your grants, and (b) on
-an ongoing basis, if such Contributor fails to notify You of the
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
 non-compliance by some reasonable means prior to 60 days after You have
 come back into compliance. Moreover, Your grants from a particular
 Contributor are reinstated on an ongoing basis if such Contributor
-notifies You of the non-compliance by some reasonable means, this is
-the first time You have received notice of non-compliance with this
-License from such Contributor, and You become compliant prior to 30
-days after Your receipt of the notice.
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
 
-5.2. If You initiate litigation against any entity by asserting a
-patent infringement claim (excluding declaratory judgment actions,
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
 counter-claims, and cross-claims) alleging that a Contributor Version
 directly or indirectly infringes any patent, then the rights granted to
 You by any and all Contributors for the Covered Software under Section
 2.1 of this License shall terminate.
 
 5.3. In the event of termination under Sections 5.1 or 5.2 above, all
-end user license agreements (excluding distributors and resellers)
-which have been validly granted by You or Your distributors under this
-License prior to termination shall survive termination.
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
 
 ************************************************************************
 *                                                                      *
@@ -346,7 +311,7 @@ Nothing in this Section shall prevent a party's ability to bring
 cross-claims or counter-claims.
 
 9. Miscellaneous
------------------
+----------------
 
 This License represents the complete agreement concerning the subject
 matter hereof. If any provision of this License is held to be
@@ -356,14 +321,14 @@ that the language of a contract shall be construed against the drafter
 shall not be used to construe this License against a Contributor.
 
 10. Versions of the License
-----------------------------
+---------------------------
 
 10.1. New Versions
 
-Mozilla Foundation is the license steward. Except as provided in
-Section 10.3, no one other than the license steward has the right to
-modify or publish new versions of this License. Each version will be
-given a distinguishing version number.
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
 
 10.2. Effect of New Versions
 
@@ -392,17 +357,17 @@ Exhibit A - Source Code Form License Notice
 
   This Source Code Form is subject to the terms of the Mozilla Public
   License, v. 2.0. If a copy of the MPL was not distributed with this
-  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 If it is not possible or desirable to put the notice in a particular
 file, then You may include the notice in a location (such as a LICENSE
-file in a relevant directory) where a recipient would be likely to
-look for such a notice.
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
 
 You may add additional accurate notices of copyright ownership.
 
 Exhibit B - "Incompatible With Secondary Licenses" Notice
-----------------------------------------------------------
+---------------------------------------------------------
 
   This Source Code Form is "Incompatible With Secondary Licenses", as
   defined by the Mozilla Public License, v. 2.0.
diff --git a/MAINTAINERS.adoc b/MAINTAINERS.adoc
index a1c6544..becaa3e 100644
--- a/MAINTAINERS.adoc
+++ b/MAINTAINERS.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Maintainers
 :toc: preamble
 
diff --git a/PROOF-NEEDS.md b/PROOF-NEEDS.md
index 8950320..566ed20 100644
--- a/PROOF-NEEDS.md
+++ b/PROOF-NEEDS.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # PROOF-NEEDS.md
 
 ## Template ABI Cleanup (2026-03-29)
diff --git a/ROADMAP.adoc b/ROADMAP.adoc
index cb6aa39..ca26e8f 100644
--- a/ROADMAP.adoc
+++ b/ROADMAP.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Error-Lang Development Roadmap
 :toc:
 :sectnums:
diff --git a/RSR_OUTLINE.adoc b/RSR_OUTLINE.adoc
index 3ce20ed..6baed3c 100644
--- a/RSR_OUTLINE.adoc
+++ b/RSR_OUTLINE.adoc
@@ -1,6 +1,8 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = RSR Template Repository
 
-image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"]
+image:[MPL-2.0-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"]
 :toc:
 :sectnums:
 
diff --git a/SECURITY.md b/SECURITY.md
index bede85e..92688d0 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # Security Policy
 
 <!-- 
diff --git a/WHITEPAPER.md b/WHITEPAPER.md
index dca33ef..f9d8c5d 100644
--- a/WHITEPAPER.md
+++ b/WHITEPAPER.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 
diff --git a/WOKELANG-COMPARISON.md b/WOKELANG-COMPARISON.md
index 45c297f..d8d53cc 100644
--- a/WOKELANG-COMPARISON.md
+++ b/WOKELANG-COMPARISON.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # Error-Lang vs WokeLang Feature Comparison
 
 ## Task Summary
diff --git a/cli/analyze.js b/cli/analyze.js
index 7f859ec..68e1e4c 100755
--- a/cli/analyze.js
+++ b/cli/analyze.js
@@ -1,5 +1,6 @@
-#!/usr/bin/env -S deno run
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#!/usr/bin/env -S deno run
 // analyze.js - Five Whys analyzer CLI
 
 import { interactiveFiveWhys } from './five-whys.js';
diff --git a/cli/ast-dump.js b/cli/ast-dump.js
index 8a95a3c..9154a4f 100644
--- a/cli/ast-dump.js
+++ b/cli/ast-dump.js
@@ -1,6 +1,6 @@
-#!/usr/bin/env -S deno run --allow-read
 // SPDX-License-Identifier: MPL-2.0
-// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#!/usr/bin/env -S deno run --allow-read
 //
 // ast-dump.js — S-expression and JSON AST dump for Error-Lang
 //
diff --git a/cli/explore.js b/cli/explore.js
index b5b8e8d..65c8108 100755
--- a/cli/explore.js
+++ b/cli/explore.js
@@ -1,5 +1,6 @@
-#!/usr/bin/env -S deno run --allow-read
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#!/usr/bin/env -S deno run --allow-read
 // explore.js - Explore code through abstraction layers
 
 import { exploreCode, traceLayerTransformation } from './layer-navigator.js';
diff --git a/cli/five-whys.js b/cli/five-whys.js
index 698f4e9..3ca6c64 100644
--- a/cli/five-whys.js
+++ b/cli/five-whys.js
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // five-whys.js - Five Whys root cause analyzer
 
 /**
diff --git a/cli/layer-navigator.js b/cli/layer-navigator.js
index 3f357ca..a2e6bc1 100644
--- a/cli/layer-navigator.js
+++ b/cli/layer-navigator.js
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // layer-navigator.js - Terminal-based layer navigation
 
 /**
diff --git a/cli/lsp-server.ts b/cli/lsp-server.ts
index 614cbfd..1a5553d 100644
--- a/cli/lsp-server.ts
+++ b/cli/lsp-server.ts
@@ -1,5 +1,6 @@
-#!/usr/bin/env -S deno run --allow-read --allow-env --allow-net
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#!/usr/bin/env -S deno run --allow-read --allow-env --allow-net
 // Error-Lang Language Server Protocol (LSP) Implementation
 //
 // Provides IDE integration with computational haptics visualization
diff --git a/cli/main.js b/cli/main.js
index cc77ec9..e13320a 100644
--- a/cli/main.js
+++ b/cli/main.js
@@ -1,5 +1,6 @@
-#!/usr/bin/env -S deno run --allow-read --allow-write
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#!/usr/bin/env -S deno run --allow-read --allow-write
 // Error-Lang CLI - Main entry point
 
 import { parseArgs } from "jsr:@std/cli@1/parse-args";
diff --git a/cli/runtime.js b/cli/runtime.js
index 381275e..2e80b57 100644
--- a/cli/runtime.js
+++ b/cli/runtime.js
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // runtime.js - Error-Lang runtime with stability tracking
 
 import { StabilityTracker, isPrime } from './stability-tracker.js';
diff --git a/cli/stability-tracker.js b/cli/stability-tracker.js
index 25cd41f..a75fb51 100644
--- a/cli/stability-tracker.js
+++ b/cli/stability-tracker.js
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // stability-tracker.js - Real-time stability tracking and consequence amplification
 
 import {
diff --git a/cli/visual-feedback.js b/cli/visual-feedback.js
index a8368a2..4c0d21a 100644
--- a/cli/visual-feedback.js
+++ b/cli/visual-feedback.js
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // visual-feedback.js - Visual haptic feedback system
 
 /**
diff --git a/compiler/error-lang-ast/src/lib.rs b/compiler/error-lang-ast/src/lib.rs
index 149284c..0f6b95c 100644
--- a/compiler/error-lang-ast/src/lib.rs
+++ b/compiler/error-lang-ast/src/lib.rs
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
 
 //! Abstract Syntax Tree definitions for Error-Lang.
diff --git a/compiler/error-wasm/src/lib.rs b/compiler/error-wasm/src/lib.rs
index d6923af..9699647 100644
--- a/compiler/error-wasm/src/lib.rs
+++ b/compiler/error-wasm/src/lib.rs
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
 
 //! WebAssembly backend for Error-Lang.
diff --git a/contractiles/README.adoc b/contractiles/README.adoc
index d19a387..70ad712 100644
--- a/contractiles/README.adoc
+++ b/contractiles/README.adoc
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Contractiles Template Set
 :toc:
 :sectnums:
diff --git a/docs/CITATIONS.adoc b/docs/CITATIONS.adoc
index 37fdb0f..52ba528 100644
--- a/docs/CITATIONS.adoc
+++ b/docs/CITATIONS.adoc
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = RSR-template-repo - Citation Guide
 :toc:
 
diff --git a/docs/Curriculum.adoc b/docs/Curriculum.adoc
index f84041d..a9da40a 100644
--- a/docs/Curriculum.adoc
+++ b/docs/Curriculum.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Error-Lang Curriculum
 :toc:
 :sectnums:
diff --git a/docs/Design-Philosophy.adoc b/docs/Design-Philosophy.adoc
index 99a23f7..0a20a73 100644
--- a/docs/Design-Philosophy.adoc
+++ b/docs/Design-Philosophy.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Error-Lang Design Philosophy
 :toc:
 :sectnums:
diff --git a/docs/Educational-Framework.adoc b/docs/Educational-Framework.adoc
index 4ad9e41..2641076 100644
--- a/docs/Educational-Framework.adoc
+++ b/docs/Educational-Framework.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Error-Lang Educational Framework
 :toc:
 :sectnums:
diff --git a/docs/Error-Categories.adoc b/docs/Error-Categories.adoc
index 3a80e22..938b48f 100644
--- a/docs/Error-Categories.adoc
+++ b/docs/Error-Categories.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Error-Lang Error Categories
 :toc:
 :sectnums:
diff --git a/docs/Error-Ecosystem-Vision.adoc b/docs/Error-Ecosystem-Vision.adoc
index 40bd936..6f64ee3 100644
--- a/docs/Error-Ecosystem-Vision.adoc
+++ b/docs/Error-Ecosystem-Vision.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = The Error Ecosystem: Educational Fragility Framework
 :toc:
 :sectnums:
diff --git a/docs/Error-Lang.adoc b/docs/Error-Lang.adoc
index 5c82371..a4ed03e 100644
--- a/docs/Error-Lang.adoc
+++ b/docs/Error-Lang.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Error-Lang Language Specification
 :toc:
 :sectnums:
diff --git a/error-pkg/src/haptics.rs b/error-pkg/src/haptics.rs
index 76b6f8d..4de7193 100644
--- a/error-pkg/src/haptics.rs
+++ b/error-pkg/src/haptics.rs
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
-
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 //! Computational haptics for error-lang package manager
 //!
 //! Provides vibration feedback patterns for different error severities.
diff --git a/error-pkg/src/install.rs b/error-pkg/src/install.rs
index 8735fa5..f7bfb11 100644
--- a/error-pkg/src/install.rs
+++ b/error-pkg/src/install.rs
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
-
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 use crate::types::Package;
 use crate::haptics::ErrorHaptics;
 use anyhow::Result;
diff --git a/error-pkg/src/lib.rs b/error-pkg/src/lib.rs
index 06fc185..55db390 100644
--- a/error-pkg/src/lib.rs
+++ b/error-pkg/src/lib.rs
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
-
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 //! error-pkg: Package manager for error-lang with computational haptics
 //!
 //! Features:
diff --git a/error-pkg/src/main.rs b/error-pkg/src/main.rs
index 3e6d419..30f5daa 100644
--- a/error-pkg/src/main.rs
+++ b/error-pkg/src/main.rs
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
-
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 use clap::{Parser, Subcommand};
 use error_pkg::{install, add_package, remove_package, search};
 use anyhow::Result;
diff --git a/error-pkg/src/registry.rs b/error-pkg/src/registry.rs
index d2f8f2e..446feb1 100644
--- a/error-pkg/src/registry.rs
+++ b/error-pkg/src/registry.rs
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
-
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 use crate::types::Package;
 use anyhow::Result;
 use std::collections::HashMap;
diff --git a/error-pkg/src/resolve.rs b/error-pkg/src/resolve.rs
index ee92584..0b007da 100644
--- a/error-pkg/src/resolve.rs
+++ b/error-pkg/src/resolve.rs
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
-
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 use crate::types::Package;
 use crate::registry::RegistryClient;
 use anyhow::Result;
diff --git a/error-pkg/src/types.rs b/error-pkg/src/types.rs
index 63f2f64..41e2c05 100644
--- a/error-pkg/src/types.rs
+++ b/error-pkg/src/types.rs
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
-
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::fs;
diff --git a/ffi/zig/build.zig b/ffi/zig/build.zig
index 97f0cf8..a75958c 100644
--- a/ffi/zig/build.zig
+++ b/ffi/zig/build.zig
@@ -1,5 +1,6 @@
-// Error-Lang FFI Build Configuration
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+// Error-Lang FFI Build Configuration
 
 const std = @import("std");
 
diff --git a/ffi/zig/src/main.zig b/ffi/zig/src/main.zig
index 7a264f8..3e52508 100644
--- a/ffi/zig/src/main.zig
+++ b/ffi/zig/src/main.zig
@@ -1,10 +1,11 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // Error-Lang FFI Implementation
 //
 // This module implements the C-compatible FFI for Error-Lang computational haptics.
 // Provides high-performance native operations for stability scoring, positional
 // semantics, and paradox detection.
 //
-// SPDX-License-Identifier: MPL-2.0
 
 const std = @import("std");
 
diff --git a/ffi/zig/test/integration_test.zig b/ffi/zig/test/integration_test.zig
index 35a6de3..7c204f2 100644
--- a/ffi/zig/test/integration_test.zig
+++ b/ffi/zig/test/integration_test.zig
@@ -1,5 +1,6 @@
-// Error-Lang Integration Tests
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+// Error-Lang Integration Tests
 //
 // These tests verify that the Zig FFI correctly implements error-lang's
 // computational haptics and pedagogical features.
diff --git a/ide/ARCHITECTURE.adoc b/ide/ARCHITECTURE.adoc
index dd082da..85fd902 100644
--- a/ide/ARCHITECTURE.adoc
+++ b/ide/ARCHITECTURE.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Error-Lang Studio: IDE Architecture
 :toc:
 :sectnums:
diff --git a/ide/INTEGRATION.adoc b/ide/INTEGRATION.adoc
index e996acc..a8231be 100644
--- a/ide/INTEGRATION.adoc
+++ b/ide/INTEGRATION.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Error-Lang Studio: Ecosystem Integration
 :toc:
 :sectnums:
diff --git a/ide/README.adoc b/ide/README.adoc
index 444addd..29f673e 100644
--- a/ide/README.adoc
+++ b/ide/README.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Error-Lang Studio: The Language Stabilizer IDE
 :toc:
 :sectnums:
diff --git a/ide/src/MonacoInterop.js b/ide/src/MonacoInterop.js
index 3c07f40..eb2c5c7 100644
--- a/ide/src/MonacoInterop.js
+++ b/ide/src/MonacoInterop.js
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // MonacoInterop.js - JavaScript interop layer for Monaco Editor
 // Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 //
diff --git a/ide/src/monaco-setup.js b/ide/src/monaco-setup.js
index 7888568..68f3110 100644
--- a/ide/src/monaco-setup.js
+++ b/ide/src/monaco-setup.js
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // monaco-setup.js - Monaco Editor initialization for Error-Lang Studio
 // Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 //
diff --git a/ide/vite.config.js b/ide/vite.config.js
index 5ca6092..87769a9 100644
--- a/ide/vite.config.js
+++ b/ide/vite.config.js
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // vite.config.js - Build configuration
 // Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 
diff --git a/playground/docs/CITATIONS.adoc b/playground/docs/CITATIONS.adoc
index 37fdb0f..52ba528 100644
--- a/playground/docs/CITATIONS.adoc
+++ b/playground/docs/CITATIONS.adoc
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = RSR-template-repo - Citation Guide
 :toc:
 
diff --git a/site/index.md b/site/index.md
index c571f68..bb76a2f 100644
--- a/site/index.md
+++ b/site/index.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 ---
 title: Error-Lang: Systems Thinking Education Through Computational Haptics
 date: 2026-03-31
diff --git a/spec/README.adoc b/spec/README.adoc
index 64779e8..f41a5e9 100644
--- a/spec/README.adoc
+++ b/spec/README.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // @taxonomy: spec/index
 = error-lang — Specification Directory
 :toc:
diff --git a/spec/axiomatic-semantics.md b/spec/axiomatic-semantics.md
index 3ef9e50..693eb56 100644
--- a/spec/axiomatic-semantics.md
+++ b/spec/axiomatic-semantics.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 
diff --git a/spec/operational-semantics.md b/spec/operational-semantics.md
index ad3158a..fdb9d21 100644
--- a/spec/operational-semantics.md
+++ b/spec/operational-semantics.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 
diff --git a/spec/system-specs.md b/spec/system-specs.md
index fd5cb46..1a6ff8a 100644
--- a/spec/system-specs.md
+++ b/spec/system-specs.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 
diff --git a/spec/type-system.md b/spec/type-system.md
index 7bdb4bf..144e559 100644
--- a/spec/type-system.md
+++ b/spec/type-system.md
@@ -1,3 +1,7 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 
diff --git a/src/abi/Foreign.idr b/src/abi/Foreign.idr
index 9d58fbe..f3158df 100644
--- a/src/abi/Foreign.idr
+++ b/src/abi/Foreign.idr
@@ -1,3 +1,5 @@
+-- SPDX-License-Identifier: MPL-2.0
+-- Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 ||| Foreign Function Interface Declarations for Error-Lang
 |||
 ||| This module declares all C-compatible functions implemented in the
diff --git a/tools/lsp/src/backend.rs b/tools/lsp/src/backend.rs
index 6267a16..ec61745 100644
--- a/tools/lsp/src/backend.rs
+++ b/tools/lsp/src/backend.rs
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 //! Backend implementation for the Error-Lang LSP server.
 //!
 //! Analyses `.err` source files to produce diagnostics, type information,
diff --git a/tools/lsp/src/main.rs b/tools/lsp/src/main.rs
index 68e9143..6b19617 100644
--- a/tools/lsp/src/main.rs
+++ b/tools/lsp/src/main.rs
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 //! error-lang-lsp — Language Server Protocol server for Error-Lang.
 //!
 //! Error-Lang is an educational programming language where errors are features,
diff --git a/verification/README.adoc b/verification/README.adoc
index 473ce77..8e4e925 100644
--- a/verification/README.adoc
+++ b/verification/README.adoc
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 // @taxonomy: verification/index
 = error-lang — Verification Directory
 :toc:

From aa0419395ad59c66217bf611eb7962b015c079f8 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 7 Jun 2026 23:18:49 +0100
Subject: [PATCH 5/7] Apply estate standardization: governance docs,
 contractiles, CI/CD cleanup

---
 .github/CODEOWNERS                            |  34 ++++
 .../contractiles/Adjustfile.a2ml              |  72 ++++++++
 .../contractiles/Intentfile.a2ml              |  99 +++++++++++
 .machine_readable/contractiles/Justfile       |  78 +++++++++
 .machine_readable/contractiles/Mustfile.a2ml  | 102 +++++++++++
 .machine_readable/contractiles/Trustfile.a2ml |  88 ++++++++++
 GOVERNANCE.adoc                               | 162 ++++++++++++++++++
 contractiles/README.adoc                      |  21 ---
 contractiles/dust/Dustfile                    |  29 ----
 contractiles/must/Mustfile                    |  35 ----
 manifest.scm                                  |  24 +++
 11 files changed, 659 insertions(+), 85 deletions(-)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .machine_readable/contractiles/Adjustfile.a2ml
 create mode 100644 .machine_readable/contractiles/Intentfile.a2ml
 create mode 100644 .machine_readable/contractiles/Justfile
 create mode 100644 .machine_readable/contractiles/Mustfile.a2ml
 create mode 100644 .machine_readable/contractiles/Trustfile.a2ml
 create mode 100644 GOVERNANCE.adoc
 delete mode 100644 contractiles/README.adoc
 delete mode 100644 contractiles/dust/Dustfile
 delete mode 100644 contractiles/must/Mustfile
 create mode 100644 manifest.scm

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..3a3b7f2
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MPL-2.0
+# CODEOWNERS - Define code review assignments for GitHub
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default: sole maintainer for all files
+* @hyperpolymath
+
+# Security-sensitive files require explicit ownership
+SECURITY.md @hyperpolymath
+.github/workflows/ @hyperpolymath
+.machine_readable/ @hyperpolymath
+contractiles/ @hyperpolymath
+
+# License files
+LICENSE @hyperpolymath
+LICENSES/ @hyperpolymath
+
+# Configuration
+.gitignore @hyperpolymath
+.github/ @hyperpolymath
+
+# Documentation
+README* @hyperpolymath
+CONTRIBUTING* @hyperpolymath
+CODE_OF_CONDUCT* @hyperpolymath
+GOVERNANCE* @hyperpolymath
+MAINTAINERS* @hyperpolymath
+CHANGELOG* @hyperpolymath
+ROADMAP* @hyperpolymath
+
+# Build and CI
+Justfile @hyperpolymath
+Makefile @hyperpolymath
+*.sh @hyperpolymath
diff --git a/.machine_readable/contractiles/Adjustfile.a2ml b/.machine_readable/contractiles/Adjustfile.a2ml
new file mode 100644
index 0000000..6f01e89
--- /dev/null
+++ b/.machine_readable/contractiles/Adjustfile.a2ml
@@ -0,0 +1,72 @@
+# SPDX-License-Identifier: MPL-2.0
+# Adjustfile — Drift-tolerance contract for rsr-template-repo
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Cumulative-drift catchment: tolerance bands + corrective actions.
+# Authority: advisory (Yard) — continue-with-warnings; auto_fix where deterministic.
+# Run with: adjust check
+# Fix with: adjust fix (applies deterministic patches; advisory otherwise)
+
+@abstract:
+Drift tolerances and corrective actions for rsr-template-repo. Unlike
+MUST (hard gate), ADJUST tracks cumulative drift against tolerance bands
+and proposes corrective actions. Advisory — it warns and trends, it does
+not block.
+@end
+
+## Template Drift
+
+### placeholder-drift
+- description: Template placeholders should be replaced when copied
+- tolerance: 0 placeholder markers in copied repos
+- corrective: Search and replace all {{PLACEHOLDER}} markers
+- severity: advisory
+- notes: This check only applies to repos that copied from this template
+
+### template-version-drift
+- description: Template version should match RSR spec version
+- tolerance: Template version matches current RSR spec
+- corrective: Update template to match latest RSR spec
+- severity: advisory
+
+## Documentation Drift
+
+### readme-completeness
+- description: README should document all template features
+- tolerance: README covers all contractiles and directory structure
+- corrective: Update README.adoc with missing sections
+- severity: advisory
+
+### example-accuracy
+- description: Examples in documentation should match actual template content
+- tolerance: All code examples in docs are accurate
+- corrective: Audit and fix examples in documentation
+- severity: advisory
+
+## Structural Drift
+
+### contractile-sync
+- description: All contractiles should have matching a2ml and ncl implementations
+- tolerance: Every .a2ml has a corresponding .ncl
+- corrective: Generate missing .ncl files from .a2ml
+- severity: advisory
+
+### no-broken-symlinks
+- description: No broken symbolic links in template structure
+- tolerance: 0 broken symlinks
+- corrective: Run symlink-check script
+- severity: advisory
+
+## Accessibility Drift
+
+### adoc-not-md
+- description: Template docs should prefer AsciiDoc
+- tolerance: New prose docs are *.adoc
+- corrective: Convert any new *.md to *.adoc
+- severity: advisory
+
+### spdx-header-consistency
+- description: All template files have correct SPDX headers
+- tolerance: 0 files missing SPDX-License-Identifier
+- corrective: Add SPDX headers to files that need them
+- severity: advisory
diff --git a/.machine_readable/contractiles/Intentfile.a2ml b/.machine_readable/contractiles/Intentfile.a2ml
new file mode 100644
index 0000000..ef74f45
--- /dev/null
+++ b/.machine_readable/contractiles/Intentfile.a2ml
@@ -0,0 +1,99 @@
+# SPDX-License-Identifier: MPL-2.0
+# Intentfile (A2ML Canonical) — north-star contractile for rsr-template-repo
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Paired runner: intend.ncl
+# Verb:          intend
+#
+# Semantics: North-star contractile. Declares BOTH concrete committed
+#            next-actions AND horizon aspirations the project wishes to
+#            become. Two sections share one file because they answer
+#            the same question at different ranges:
+#              [[intents]] — "we WILL do this; track progress"
+#                            status: declared → in_progress → done |
+#                                    deferred | retired
+#              [[wishes]]  — "we WISH this were true; revisit later"
+#                            status: declared → in_progress → achieved |
+#                                    abandoned
+#                            grouped by horizon: near / mid / far.
+#            Non-gating — this is a report, not a gate. See the `must`
+#            contractile for hard gates.
+
+@abstract:
+North-star contractile for rsr-template-repo. This repository is the
+canonical template for Rhodium Standard Repository compliance. It provides
+the scaffold that all hyperpolymath repos should copy and customize.
+@end
+
+## Purpose
+
+The rsr-template-repo serves as the master template for all hyperpolymath
+repositories. It contains the complete set of contractile files, machine-readable
+specifications, and governance documentation that define the Rhodium Standard.
+
+Every new repository in the hyperpolymath estate should be initialized by
+copying this template and substituting the placeholder values with
+repo-specific content.
+
+## Anti-Purpose
+
+This repository is NOT:
+- A general-purpose project scaffold for external use (hyperpolymath-only)
+- A replacement for per-repo customization (all files must be bespoke)
+- A static template that never changes (evolves with RSR spec)
+- A runtime library or framework (build-time only)
+
+## If In Doubt
+
+If you are unsure whether a change is in scope, ask. Sensitive areas:
+- .machine_readable/ contractile definitions
+- RSR specification files
+- Governance templates
+- License policy documents
+
+## Committed Next-Actions
+
+### repo-initialization
+- description: Provide just copy-and-substitute template for new repos
+- probe: test -f scripts/init-repo.sh
+- status: done
+- notes: Run with source scripts/init-repo.sh <new-repo-name>
+
+### contractile-completeness
+- description: Every RSR contractile has an a2ml and ncl implementation
+- probe: ls .machine_readable/contractiles/*.a2ml | wc -l | grep -q "^6$"
+- status: in_progress
+- notes: Currently 6 contractile verbs: intend, must, trust, adjust, bust, dust
+
+### automation-scripts
+- description: All repetitive tasks have just recipes
+- probe: grep -c "^# " Justfile | grep -q "^[6-9][0-9]*$"
+- status: in_progress
+
+## Wishes
+
+### Near Horizon
+
+#### cross-repo-validation
+- description: Tooling to validate all repos against RSR spec
+- horizon: near
+- status: declared
+
+#### automated-substitution
+- description: Script to automate repo-specific substitution in template
+- horizon: near
+- status: declared
+
+### Mid Horizon
+
+#### formal-verification
+- description: Idris2 proofs for all critical contractile invariants
+- horizon: mid
+- status: declared
+
+### Far Horizon
+
+#### ecosystem-visualization
+- description: Interactive graph of all hyperpolymath repos and dependencies
+- horizon: far
+- status: declared
diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile
new file mode 100644
index 0000000..d8fdf0d
--- /dev/null
+++ b/.machine_readable/contractiles/Justfile
@@ -0,0 +1,78 @@
+# SPDX-License-Identifier: MPL-2.0
+# justfile - Error-Lang build commands
+
+set shell := ["bash", "-uc"]
+
+# Default recipe
+default: help
+
+# Show help
+help:
+    @echo "Error-Lang Build Commands"
+    @echo "========================="
+    @echo ""
+    @echo "Usage: just <recipe>"
+    @echo ""
+    @echo "Recipes:"
+    @echo "  run <file>    Run an Error-Lang program"
+    @echo "  doctor        Check environment"
+    @echo "  explain       Explain an error code"
+    @echo "  test          Run tests"
+    @echo "  lint          Lint code"
+    @echo "  fmt           Format code"
+    @echo "  build         Build ReScript compiler"
+    @echo "  clean         Clean build artifacts"
+
+# Run an Error-Lang program
+run file:
+    deno run --allow-read --allow-write cli/runtime.js {{file}}
+
+# Check environment
+doctor:
+    deno run cli/main.js doctor
+
+# Explain an error code
+explain code="--all":
+    deno run cli/main.js explain {{code}}
+
+# Run tests
+test:
+    deno test --allow-read --allow-write
+
+# Lint code
+lint:
+    deno lint
+    @if command -v rescript &> /dev/null; then \
+        cd compiler && npx rescript build; \
+    fi
+
+# Format code
+fmt:
+    deno fmt
+
+# Build ReScript compiler
+build:
+    @if [ -d "compiler" ] && [ -f "compiler/rescript.json" ]; then \
+        cd compiler && npx rescript build; \
+    else \
+        echo "ReScript compiler not yet configured"; \
+    fi
+
+# Clean build artifacts
+clean:
+    rm -rf compiler/lib
+    rm -f compiler/src/*.res.js
+    rm -rf .error-lang
+
+# Run all examples
+examples:
+    @for f in examples/*.err; do \
+        echo "=== Running $$f ==="; \
+        just run "$$f"; \
+        echo ""; \
+    done
+
+# Initialize state for a fresh start
+init:
+    rm -rf .error-lang
+    @echo "State cleared. Next run will be Run #1."
diff --git a/.machine_readable/contractiles/Mustfile.a2ml b/.machine_readable/contractiles/Mustfile.a2ml
new file mode 100644
index 0000000..55f8ab4
--- /dev/null
+++ b/.machine_readable/contractiles/Mustfile.a2ml
@@ -0,0 +1,102 @@
+# SPDX-License-Identifier: MPL-2.0
+# Mustfile — Physical state contract for rsr-template-repo
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# What MUST be true about this repository. Hard requirements.
+# Run with: must check
+# Fix with: must fix (where a deterministic fix exists)
+
+@abstract:
+Physical-state invariants for rsr-template-repo. This is the canonical
+RSR template repository. These are hard requirements — CI and pre-commit
+hooks fail if any check fails.
+@end
+
+## File Presence
+
+### license-present
+- description: LICENSE file must exist
+- run: test -f LICENSE
+- severity: critical
+
+### readme-present
+- description: README.adoc must exist
+- run: test -f README.adoc
+- severity: critical
+
+### security-policy
+- description: SECURITY.md must exist
+- run: test -f SECURITY.md
+- severity: critical
+
+### ai-manifest
+- description: 0-AI-MANIFEST.a2ml must exist
+- run: test -f 0-AI-MANIFEST.a2ml
+- severity: critical
+
+### governance-docs
+- description: GOVERNANCE.adoc, MAINTAINERS.adoc, CODEOWNERS must exist
+- run: test -f GOVERNANCE.adoc && test -f MAINTAINERS.adoc && test -f .github/CODEOWNERS
+- severity: critical
+
+### machine-readable-dir
+- description: .machine_readable/ directory must exist
+- run: test -d .machine_readable
+- severity: critical
+
+## Directory Structure
+
+### contractiles-complete
+- description: All required contractile directories exist
+- run: test -d .machine_readable/contractiles && test -d .machine_readable/contractiles/bust && test -d .machine_readable/contractiles/dust
+- severity: critical
+
+### contractiles-files-present
+- description: All four primary contractile files exist
+- run: test -f .machine_readable/contractiles/Intentfile.a2ml && test -f .machine_readable/contractiles/Mustfile.a2ml && test -f .machine_readable/contractiles/Trustfile.a2ml && test -f .machine_readable/contractiles/Adjustfile.a2ml
+- severity: critical
+
+### bust-dust-files-present
+- description: Bustfile and Dustfile exist in their directories
+- run: test -f .machine_readable/contractiles/bust/Bustfile.a2ml && test -f .machine_readable/contractiles/dust/Dustfile.a2ml
+- severity: critical
+
+### six-directory-present
+- description: 6a2 directory exists with required files
+- run: test -d .machine_readable/6a2 && test -f .machine_readable/6a2/META.a2ml && test -f .machine_readable/6a2/ECOSYSTEM.a2ml && test -f .machine_readable/6a2/STATE.a2ml && test -f .machine_readable/6a2/PLAYBOOK.a2ml && test -f .machine_readable/6a2/AGENTIC.a2ml && test -f .machine_readable/6a2/NEUROSYM.a2ml
+- severity: critical
+
+### anchors-directory
+- description: anchors directory exists in 6a2
+- run: test -d .machine_readable/6a2/anchors
+- severity: warning
+
+### self-validating-structure
+- description: self-validating directory has k9-svc and examples
+- run: test -d .machine_readable/self-validating && test -d .machine_readable/self-validating/k9-svc && test -d .machine_readable/self-validating/examples
+- severity: warning
+
+## Template Integrity
+
+### no-placeholder-values
+- description: No placeholder values remain in template files
+- run: test -z "$(grep -r '{{' .machine_readable/contractiles/ 2>/dev/null)"
+- severity: critical
+- notes: All placeholders must be substituted when copying this template
+
+### template-readonly
+- description: Template marker files are not modified
+- run: grep -q 'RSR_TEMPLATE_DO_NOT_EDIT' .machine_readable/0.1-AI-MANIFEST.a2ml
+- severity: warning
+
+## Git State
+
+### no-untracked-contractiles
+- description: All contractile files are tracked in git
+- run: test -z "$(git ls-files -o --exclude-standard .machine_readable/contractiles/ 2>/dev/null)"
+- severity: critical
+
+### signed-commits
+- description: All commits must be signed
+- run: git verify-commit HEAD
+- severity: critical
diff --git a/.machine_readable/contractiles/Trustfile.a2ml b/.machine_readable/contractiles/Trustfile.a2ml
new file mode 100644
index 0000000..e2028b5
--- /dev/null
+++ b/.machine_readable/contractiles/Trustfile.a2ml
@@ -0,0 +1,88 @@
+# SPDX-License-Identifier: MPL-2.0
+# Trustfile — Trust boundaries and integrity invariants for rsr-template-repo
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Defines what LLM/SLM agents are trusted to do without asking, and
+# integrity invariants that verify the repo has not been tampered with.
+
+@abstract:
+Trust boundaries and integrity checks for rsr-template-repo. This file
+combines the trust-level definitions from the original TRUST.contractile
+with the integrity invariants from the old Trustfile.a2ml. It defines
+what AI agents may do autonomously and what requires human approval,
+plus checks that verify repository integrity.
+@end
+
+## Trust Levels
+
+The rsr-template-repo operates at trust level: maximal
+
+Trust levels:
+- maximal:    Agent may read, build, test, lint, format, heal freely.
+             Only destructive/external actions require approval.
+- standard:   Agent may read and build. Test/lint need approval.
+- restricted: Agent may read only. All modifications need approval.
+- minimal:    Agent may read specific files only. Everything else blocked.
+
+Current trust level: maximal
+
+## Integrity Invariants
+
+### Secrets
+
+#### no-secrets-committed
+- description: No credential files in repo
+- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production
+- severity: critical
+
+#### no-private-keys
+- description: No private key files committed
+- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ."
+- severity: critical
+
+#### no-tokens-in-source
+- description: No hardcoded API tokens in source
+- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ."
+- severity: critical
+
+## Provenance
+
+#### author-correct
+- description: Git author matches expected identity
+- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'"
+- severity: warning
+
+#### license-content
+- description: LICENSE contains expected identifier
+- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE
+- severity: warning
+
+## Template-Specific Trust
+
+### template-files-readonly
+- description: Template scaffold files should not be modified except by maintainer
+- run: test -z "$(git status --short .machine_readable/ 2>/dev/null | grep -v '^??' || true)"
+- severity: advisory
+- notes: Changes to template files require careful review
+
+### trust-deny-areas
+- description: Sensitive areas from INTENT.contractile require explicit approval
+- run: echo "Check .machine_readable/ contractiles and governance docs"
+- severity: advisory
+- areas:
+  - .machine_readable/
+  - GOVERNANCE.adoc
+  - MAINTAINERS.adoc
+  - .github/CODEOWNERS
+
+## Container Security
+
+#### container-images-pinned
+- description: Containerfile uses pinned base images
+- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile
+- severity: warning
+
+#### no-dockerfile
+- description: No Dockerfile (use Containerfile)
+- run: test ! -f Dockerfile
+- severity: warning
diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc
new file mode 100644
index 0000000..8bbf167
--- /dev/null
+++ b/GOVERNANCE.adoc
@@ -0,0 +1,162 @@
+// SPDX-License-Identifier: MPL-2.0
+// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= Governance Model
+:toc: preamble
+
+This document describes the governance model for this repository.
+
+== Overview
+
+This repository follows a **Sole Maintainer Governance Model**:
+
+* Single maintainer (@hyperpolymath) has full authority over the project
+* All contributions are welcome and reviewed by the maintainer
+* Decisions are made transparently through GitHub issues and discussions
+* The project adheres to the hyperpolymath estate policies where applicable
+
+== Core Principles
+
+[cols="1,2"]
+|===
+| Principle | Description
+
+| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input
+
+| **Meritocracy** | Contributions are judged on technical merit, not contributor identity
+
+| **Transparency** | All significant decisions are documented publicly
+
+| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary
+
+| **Open Contribution** | Anyone can contribute via fork and pull request
+
+|===
+
+== Roles and Permissions
+
+[cols="1,2,2"]
+|===
+| Role | Permissions | Assignment
+
+| **Maintainer** | Write access, merge rights, admin | @hyperpolymath
+| **Contributors** | Read access, fork, submit PRs | All GitHub users
+| **Users** | Use the software, report issues | All GitHub users
+
+|===
+
+== Decision Making Framework
+
+=== Routine Decisions
+
+* Bug fixes
+* Documentation improvements
+* Minor feature additions
+* Dependency updates
+
+**Process**: Maintainer reviews and merges PRs that meet quality standards.
+
+=== Significant Changes
+
+* New major features
+* API changes
+* Architecture modifications
+* Breaking changes
+
+**Process**:
+. Open issue describing the change
+. Discuss with community (minimum 72 hours)
+. Maintainer makes final decision
+. Document rationale in issue/PR
+
+=== Structural Decisions
+
+* Repository purpose/renaming
+* License changes
+* Ownership transfer
+* Deprecation/archival
+
+**Process**: 
+. Extended discussion (minimum 1 week)
+. Maintainer makes final decision
+. Document in CHANGELOG and governance docs
+
+== Contribution Lifecycle
+
+[cols="1,2"]
+|===
+| Stage | Process
+
+| **Ideation** | Open issue, discuss feasibility
+
+| **Development** | Fork, implement, test thoroughly
+
+| **Review** | Submit PR, maintainer reviews within 7 days
+
+| **Merge** | Maintainer merges or requests changes
+
+| **Release** | Maintainer publishes according to project conventions
+
+|===
+
+== Conflict Resolution
+
+In case of disagreements:
+
+. Discuss in the relevant GitHub issue or PR
+. Provide technical justification for positions
+. Maintainer mediates and makes final decision
+. Decision is documented and can be revisited later
+
+== Project Policies
+
+This repository adheres to hyperpolymath estate-wide policies:
+
+* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc)
+* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md
+* **Security**: Follows hyperpolymath SECURITY.md
+* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions
+
+== Repository-Specific Conventions
+
+[cols="1,2"]
+|===
+| Convention | Description
+
+| **Signing** | All commits must be signed (SSH or GPG)
+
+| **SPDX Headers** | All source files must have SPDX license identifiers
+
+| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root
+
+| **Machine Readable** | META.a2ml in .machine_readable/6a2/
+
+| **CI/CD** | GitHub Actions workflows in .github/workflows/
+
+|===
+
+== Governance Evolution
+
+As the project grows, this governance model may evolve:
+
+* **Adding Co-Maintainers**: When contribution volume warrants it
+* **Forming a Team**: For complex multi-maintainer projects
+* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories)
+
+Changes to this document require the same process as Significant Changes above.
+
+== See Also
+
+* link:MAINTAINERS.adoc[Maintainers]
+* link:CODE_OF_CONDUCT.md[Code of Conduct]
+* link:CONTRIBUTING.adoc[Contributing Guide]
+* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy]
+* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)]
+
+== Changelog
+
+[cols="1,1,1"]
+|===
+| Date | Change | By
+
+| 2026-06-07 | Initial governance model established | @hyperpolymath
+|===
diff --git a/contractiles/README.adoc b/contractiles/README.adoc
deleted file mode 100644
index 70ad712..0000000
--- a/contractiles/README.adoc
+++ /dev/null
@@ -1,21 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-= Contractiles Template Set
-:toc:
-:sectnums:
-
-This directory contains the generalized contractiles templates. Copy the `contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework.
-
-== Fill-In Instructions
-
-1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports).
-2. Replace Trustfile.hs placeholders with your actual key paths and verification commands.
-3. Adjust Dustfile handlers to match your rollback and recovery tooling.
-4. Update Intentfile to mirror the roadmap you want the system to evolve toward.
-
-== Contents
-
-* `must/Mustfile` - required invariants and validations.
-* `trust/Trustfile.hs` - cryptographic verification steps.
-* `dust/Dustfile` - rollback and recovery semantics.
-* `lust/Intentfile` - future intent and roadmap direction.
diff --git a/contractiles/dust/Dustfile b/contractiles/dust/Dustfile
deleted file mode 100644
index 6f93c6a..0000000
--- a/contractiles/dust/Dustfile
+++ /dev/null
@@ -1,29 +0,0 @@
-# SPDX-License-Identifier: PLMP-1.0-or-later
-# Dustfile template - recovery and rollback semantics
-
-version: 1
-
-recovery:
-  logs:
-    - name: decision-log
-      path: logs/decisions.json
-      reversible: true
-      handler: "log-replay --reverse logs/decisions.json"
-
-  policy:
-    - name: policy-rollback
-      path: policy/policy.ncl
-      rollback: "git checkout HEAD~1 -- policy/policy.ncl"
-      notes: "Rollback policy to the previous known-good revision."
-
-  gateway:
-    - name: bad-deployment
-      event: "deploy.failure"
-      undo: "kubectl rollout undo deployment/gateway"
-      notes: "Undo a failed deployment while preserving audit logs."
-
-  dust-events:
-    - name: decision-log-to-dust
-      source: logs/decisions.json
-      transform: "dustify --input logs/decisions.json --output logs/dust-events.json"
-      notes: "Map gateway decision logs into reversible dust events."
diff --git a/contractiles/must/Mustfile b/contractiles/must/Mustfile
deleted file mode 100644
index dc2c6b6..0000000
--- a/contractiles/must/Mustfile
+++ /dev/null
@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: PLMP-1.0-or-later
-# Mustfile - declarative state contract (template)
-# See: https://github.com/hyperpolymath/mustfile
-
-version: 1
-
-metadata:
-  name: project-state-contract
-  spec: v0.0.1
-  description: "Invariant checks for config, policy, gateway, logs, and schema."
-
-parameters:
-  gateway_port: "8080"
-  schema_version: "v0.0.1"
-
-checks:
-  - name: config-valid
-    description: "config/service.yaml must be valid."
-    run: "yq -e '.' config/service.yaml >/dev/null"
-
-  - name: policy-compiles
-    description: "policy/policy.ncl must compile."
-    run: "nickel check policy/policy.ncl"
-
-  - name: gateway-exposes-port
-    description: "Service must expose the configured port."
-    run: "bash -uc 'ss -lnt | rg \":${GATEWAY_PORT:-8080}\"'"
-
-  - name: logs-are-json
-    description: "Logs must be JSON."
-    run: "bash -uc 'rg --files -g \"*.json\" logs | xargs -r jq -e .'"
-
-  - name: schema-version-matches
-    description: "Schema must match version spec."
-    run: "bash -uc 'rg -n \"${SCHEMA_VERSION:-v0.0.1}\" schema'"
diff --git a/manifest.scm b/manifest.scm
new file mode 100644
index 0000000..dd942c7
--- /dev/null
+++ b/manifest.scm
@@ -0,0 +1,24 @@
+;;; SPDX-License-Identifier: MPL-2.0
+;;; manifest.scm — Generic Guix manifest for RSR-compliant projects
+;;;
+;;; Usage:
+;;;   guix shell -m manifest.scm
+;;;
+
+(specifications->manifest
+  '(;; Core development tools
+    "git"
+    "just"
+    "nickel"
+    "curl"
+    "bash"
+    "coreutils"
+
+    ;; Documentation
+    "asciidoctor"
+    "pandoc"
+
+    ;; Common build dependencies
+    "openssl"
+    "zlib"
+    "pkg-config"))

From 42d6e8a117267821f7834065bdfc59f959769e8b Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 8 Jun 2026 00:59:44 +0100
Subject: [PATCH 6/7] Add missing bust/dust contractiles

---
 .../contractiles/bust/Bustfile.a2ml           | 52 ++++++++++++++++
 .../contractiles/dust/Dustfile.a2ml           | 62 +++++++++++++++++++
 2 files changed, 114 insertions(+)
 create mode 100644 .machine_readable/contractiles/bust/Bustfile.a2ml
 create mode 100644 .machine_readable/contractiles/dust/Dustfile.a2ml

diff --git a/.machine_readable/contractiles/bust/Bustfile.a2ml b/.machine_readable/contractiles/bust/Bustfile.a2ml
new file mode 100644
index 0000000..0c5baed
--- /dev/null
+++ b/.machine_readable/contractiles/bust/Bustfile.a2ml
@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: MPL-2.0
+# Bustfile — failure mode contractile for error-lang
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Paired runner: bust.ncl
+# Verb:          bust
+# Semantics:     Every declared failure mode must have a working recovery path
+#                that has been exercised. Status moves:
+#                  declared → drilled (probe run) → verified (recovery confirmed)
+#                  or → failing (recovery broken)
+#
+# CLI:
+#   contractile bust check  → list failure modes + recovery status
+#   contractile bust drill  → inject failures, verify recovery paths
+#
+# This repository: error-lang is the canonical template for RSR compliance.
+# Failure modes here relate to template distribution and substitution.
+
+@abstract:
+Bustfile for error-lang. Lists failure modes specific to the template
+repository itself, particularly around template distribution, substitution,
+and synchronization across the hyperpolymath estate.
+@end
+
+## Failure Modes
+
+### template-substitution-failure
+- class: template_processing
+- description: Template substitution fails when initializing a new repo from this template
+- injection_probe: "cp -r error-lang test-repo && cd test-repo && sed -i 's/error-lang/TEST/g' .machine_readable/contractiles/Intentfile.a2ml && grep -q 'TEST' .machine_readable/contractiles/Intentfile.a2ml"
+- recovery_probe: "git -C test-repo diff --quiet .machine_readable/contractiles/Intentfile.a2ml"
+- expected_recovery_time_seconds: 10
+- status: declared
+- notes: Verify that substitution scripts handle all placeholder replacements correctly
+
+### sync-drift-between-repos
+- class: synchronization
+- description: Drift occurs between error-lang and other repos after template updates
+- injection_probe: "echo 'template_updated' > /tmp/test_drift_marker"
+- recovery_probe: "test -f /tmp/test_drift_marker && rm /tmp/test_drift_marker"
+- expected_recovery_time_seconds: 60
+- status: declared
+- notes: The estate-wide sync scripts (see scripts/) should prevent this; verify with scripts/verify-sync.sh
+
+### contractile-parse-error
+- class: contractile_format
+- description: A contractile file fails to parse due to syntax errors
+- injection_probe: "echo 'invalid syntax' >> error-lang/.machine_readable/contractiles/Intentfile.a2ml"
+- recovery_probe: "git checkout error-lang/.machine_readable/contractiles/Intentfile.a2ml"
+- expected_recovery_time_seconds: 5
+- status: declared
+- notes: All .a2ml files should be valid A2ML; use a2ml-validate runner
diff --git a/.machine_readable/contractiles/dust/Dustfile.a2ml b/.machine_readable/contractiles/dust/Dustfile.a2ml
new file mode 100644
index 0000000..ce55f94
--- /dev/null
+++ b/.machine_readable/contractiles/dust/Dustfile.a2ml
@@ -0,0 +1,62 @@
+# SPDX-License-Identifier: MPL-2.0
+# Dustfile — Cleanup and hygiene contract for error-lang
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Paired runner: dust.ncl
+# Verb:          dust
+# Semantics:     What should be cleaned up. Housekeeping, not blockers.
+#
+# This repository: error-lang is the canonical template.
+# Cleanup items here ensure the template itself remains pristine.
+
+@abstract:
+Cleanup and hygiene items for error-lang. These are maintenance tasks
+that ensure the template repository remains clean and ready for distribution
+to new repositories.
+@end
+
+## Stale Files
+
+### no-template-artifacts
+- description: No generated files from template testing in root
+- run: test -z "$(ls template-test-* 2>/dev/null)"
+- severity: info
+- notes: Template testing should use /tmp or dedicated test directories
+
+### no-example-placeholders
+- description: No example placeholder files (EXAMPLE-, SAMPLE-) in contractiles/
+- run: test -z "$(find .machine_readable/contractiles/ -name 'EXAMPLE-*' -o -name 'SAMPLE-*' 2>/dev/null)"
+- severity: warning
+- notes: All placeholders should be replaced with actual content or removed
+
+### no-old-contractile-formats
+- description: No old .contractile or .hs files remaining
+- run: test -z "$(find .machine_readable/contractiles/ \( -name '*.contractile' -o -name '*.hs' \) 2>/dev/null)"
+- severity: warning
+- notes: All contractiles should be .a2ml format
+
+## Format Duplicates
+
+### no-duplicate-justfile
+- description: Only one Justfile (hardlinked from root to .machine_readable/contractiles/)
+- run: test $(stat -c '%i' Justfile) = $(stat -c '%i' .machine_readable/contractiles/Justfile 2>/dev/null)
+- severity: warning
+- notes: Justfile should be hardlinked, not copied
+
+### no-duplicate-readme-format
+- description: Only one README format in contractiles/ (.adoc canonical)
+- run: test ! -f .machine_readable/contractiles/README.md
+- severity: info
+
+## Template Hygiene
+
+### no-stale-template-references
+- description: No references to error-lang in generic template files
+- run: test -z "$(grep -r 'error-lang' machine-readable-design/ 2>/dev/null)"
+- severity: warning
+- notes: Generic templates should use {{PROJECT_NAME}} or similar placeholders
+
+### version-sync-checked
+- description: Version in canonical-directory-structure matches .machine_readable/contractiles
+- verification: compare version identifiers in both locations
+- severity: info

From 02ee9fc61c119f31e861513dd71329620fbeeb91 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 11 Jun 2026 22:15:54 +0100
Subject: [PATCH 7/7] security: standardize secret scanning on TruffleHog

---
 .github/workflows/casket-pages.yml      |  12 ---
 .github/workflows/codeql.yml            |  11 +--
 .github/workflows/governance.yml        |   3 -
 .github/workflows/hypatia-scan.yml      | 107 +++---------------------
 .github/workflows/mirror.yml            |   6 --
 .github/workflows/scorecard.yml         |   8 +-
 .machine_readable/contractiles/Justfile |   3 +
 Justfile                                |   3 +
 8 files changed, 20 insertions(+), 133 deletions(-)

diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 24e0c75..32c256f 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -1,20 +1,16 @@
 # SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages
-
 on:
   push:
     branches: [main]
   workflow_dispatch:
-
 permissions:
   contents: read
   pages: write
   id-token: write
-
 concurrency:
   group: "pages"
   cancel-in-progress: false
-
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -22,19 +18,16 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-
       - name: Checkout casket-ssg
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
-
       - name: Setup GHCup
         uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
-
       - name: Cache Cabal
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
@@ -43,11 +36,9 @@ jobs:
             ~/.cabal/store
             .casket-ssg/dist-newstyle
           key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }}
-
       - name: Build casket-ssg
         working-directory: .casket-ssg
         run: cabal build
-
       - name: Build site
         run: |
           mkdir -p site _site
@@ -78,15 +69,12 @@ jobs:
             fi
           fi
           cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site
-
       - name: Setup Pages
         uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
-
       - name: Upload artifact
         uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: '_site'
-
   deploy:
     environment:
       name: github-pages
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b8873b2..d85bdbd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,17 +1,13 @@
 # SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
-
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
   schedule:
-    - cron: '0 6 * * 1'  # Weekly on Monday
-
-
+    - cron: '0 6 * * 1' # Weekly on Monday
 permissions: read-all
-
 jobs:
   analyze:
     name: CodeQL Analysis
@@ -20,23 +16,18 @@ jobs:
     permissions:
       security-events: write
       contents: read
-
     strategy:
       fail-fast: false
       matrix:
         language: ['javascript-typescript']
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-
       - name: Initialize CodeQL
         uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3
         with:
           languages: ${{ matrix.language }}
-
       - name: Autobuild
         uses: github/codeql-action/autobuild@662472033e021d55d94146f66f6058822b0b39fd # v3
-
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index a044174..60e8e90 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -11,16 +11,13 @@
 # (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
 
 name: Governance
-
 on:
   push:
     branches: [main, master]
   pull_request:
   workflow_dispatch:
-
 permissions:
   contents: read
-
 jobs:
   governance:
     uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 127905d..6f6edde 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,14 +1,13 @@
 # SPDX-License-Identifier: MPL-2.0
 # Hypatia Neurosymbolic CI/CD Security Scan
 name: Hypatia Security Scan
-
 on:
   push:
-    branches: [ main, master, develop ]
+    branches: [main, master, develop]
   pull_request:
-    branches: [ main, master ]
+    branches: [main, master]
   schedule:
-    - cron: '0 0 * * 0'  # Weekly on Sunday
+    - cron: '0 0 * * 0' # Weekly on Sunday
   workflow_dispatch:
 # Estate guardrail: cancel superseded runs so re-pushes don't pile up
 # queued runs across the estate. Safe here because this workflow only
@@ -16,7 +15,6 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 permissions:
   contents: read
   # security-events: write serves two purposes (write implies read):
@@ -38,31 +36,26 @@ permissions:
   # "Resource not accessible by integration" and (absent continue-on-error)
   # hard-fails the scan — exactly what the gate-decoupling design forbids.
   pull-requests: write
-
 jobs:
   scan:
     name: Hypatia Neurosymbolic Analysis
     runs-on: ubuntu-latest
     timeout-minutes: 15
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          fetch-depth: 0  # Full history for better pattern analysis
-
+          fetch-depth: 0 # Full history for better pattern analysis
       - name: Setup Elixir for Hypatia scanner
         uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2
         with:
           elixir-version: '1.18'
           otp-version: '27'
-
       - name: Clone Hypatia
         run: |
           if [ ! -d "$HOME/hypatia" ]; then
             git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia"
           fi
-
       - name: Build Hypatia scanner (if needed)
         run: |
           cd "$HOME/hypatia"
@@ -71,7 +64,6 @@ jobs:
             mix deps.get
             mix escript.build
           fi
-
       - name: Run Hypatia scan
         id: scan
         env:
@@ -104,14 +96,12 @@ jobs:
           echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY
           echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY
           echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
-
       - name: Upload findings artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: hypatia-findings
           path: hypatia-findings.json
           retention-days: 90
-
       - name: Convert Hypatia findings to SARIF
         # Always runs (no findings_count guard): an EMPTY SARIF run is
         # valid and intentional — uploading it clears stale Hypatia
@@ -227,7 +217,6 @@ jobs:
           console.log(`hypatia.sarif written: ${results.length} result(s).`);
           CJS
           node "$RUNNER_TEMP/hypatia-sarif.cjs"
-
       - name: Upload SARIF to GitHub code scanning
         # Fork PRs get a read-only GITHUB_TOKEN, so security-events:write
         # is unavailable and upload-sarif cannot publish — skip there
@@ -239,8 +228,12 @@ jobs:
         # exists to end). The empty-SARIF "clear stale alerts" path is
         # handled in the converter above and does not error here.
         if: >-
-          always() &&
-          (github.event_name != 'pull_request' ||
+          always() && (github.event_name != 'pull_request' ||
+
+
+
+
+
            github.event.pull_request.head.repo.fork != true)
         uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1
         with:
@@ -248,7 +241,6 @@ jobs:
           # Distinct category so Hypatia results coexist with CodeQL's
           # (codeql.yml) instead of overwriting them on the same surface.
           category: hypatia
-
       - name: Submit findings to gitbot-fleet (Phase 2)
         if: steps.scan.outputs.findings_count > 0
         # Phase 2 is the collaborative LEARNING side-channel ("bots share
@@ -272,52 +264,7 @@ jobs:
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_SHA: ${{ github.sha }}
           FINDINGS_COUNT: ${{ steps.scan.outputs.findings_count }}
-        run: |
-          echo "📤 Submitting $FINDINGS_COUNT findings to gitbot-fleet..."
-
-          # Clone gitbot-fleet to temp directory. A clone failure (network,
-          # repo gone) is non-fatal: learning submission is best-effort.
-          FLEET_DIR="/tmp/gitbot-fleet-$$"
-          if ! git clone --depth 1 https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR"; then
-            echo "::warning::Could not clone gitbot-fleet — skipping Phase 2 learning submission (non-fatal)."
-            exit 0
-          fi
-
-          # The submission script's location in gitbot-fleet has drifted
-          # before (it was absent from the default branch, which exit-127'd
-          # every consuming repo's scan). Probe known locations rather than
-          # hard-coding one path, and skip gracefully if none is present.
-          SUBMIT_SCRIPT=""
-          for cand in \
-            "$FLEET_DIR/scripts/submit-finding.sh" \
-            "$FLEET_DIR/scripts/submit_finding.sh" \
-            "$FLEET_DIR/bin/submit-finding.sh" \
-            "$FLEET_DIR/submit-finding.sh"; do
-            if [ -f "$cand" ]; then
-              SUBMIT_SCRIPT="$cand"
-              break
-            fi
-          done
-
-          if [ -z "$SUBMIT_SCRIPT" ]; then
-            echo "::warning::gitbot-fleet submit-finding script not found at any known path — skipping Phase 2 learning submission (non-fatal). Findings are still uploaded as an artifact and gated below."
-            rm -rf "$FLEET_DIR"
-            exit 0
-          fi
-
-          # Run submission script. Pass the findings path as ABSOLUTE —
-          # the script cd's into its own working dir before reading the
-          # file, so a relative path would resolve to the wrong place.
-          # A submission-script failure is logged but non-fatal.
-          if bash "$SUBMIT_SCRIPT" "$GITHUB_WORKSPACE/hypatia-findings.json"; then
-            echo "✅ Finding submission complete"
-          else
-            echo "::warning::gitbot-fleet submission script exited non-zero — Phase 2 learning submission skipped (non-fatal)."
-          fi
-
-          # Cleanup
-          rm -rf "$FLEET_DIR"
-
+        run: "echo \"\U0001F4E4 Submitting $FINDINGS_COUNT findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory. A clone failure (network,\n# repo gone) is non-fatal: learning submission is best-effort.\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\nif ! git clone --depth 1 https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"; then\n  echo \"::warning::Could not clone gitbot-fleet — skipping Phase 2 learning submission (non-fatal).\"\n  exit 0\nfi\n\n# The submission script's location in gitbot-fleet has drifted\n# before (it was absent from the default branch, which exit-127'd\n# every consuming repo's scan). Probe known locations rather than\n# hard-coding one path, and skip gracefully if none is present.\nSUBMIT_SCRIPT=\"\"\nfor cand in \\\n  \"$FLEET_DIR/scripts/submit-finding.sh\" \\\n  \"$FLEET_DIR/scripts/submit_finding.sh\" \\\n  \"$FLEET_DIR/bin/submit-finding.sh\" \\\n  \"$FLEET_DIR/submit-finding.sh\"; do\n  if [ -f \"$cand\" ]; then\n    SUBMIT_SCRIPT=\"$cand\"\n    break\n  fi\ndone\n\nif [ -z \"$SUBMIT_SCRIPT\" ]; then\n  echo \"::warning::gitbot-fleet submit-finding script not found at any known path — skipping Phase 2 learning submission (non-fatal). Findings are still uploaded as an artifact and gated below.\"\n  rm -rf \"$FLEET_DIR\"\n  exit 0\nfi\n\n# Run submission script. Pass the findings path as ABSOLUTE —\n# the script cd's into its own working dir before reading the\n# file, so a relative path would resolve to the wrong place.\n# A submission-script failure is logged but non-fatal.\nif bash \"$SUBMIT_SCRIPT\" \"$GITHUB_WORKSPACE/hypatia-findings.json\"; then\n  echo \"✅ Finding submission complete\"\nelse\n  echo \"::warning::gitbot-fleet submission script exited non-zero — Phase 2 learning submission skipped (non-fatal).\"\nfi\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n"
       - name: Check for critical issues
         if: steps.scan.outputs.critical > 0
         # GATING POLICY (explicit, by design — not an oversight):
@@ -335,7 +282,6 @@ jobs:
           echo "::warning::Hypatia found critical security issue(s) — advisory."
           echo "See the Security → Code scanning page (category: hypatia)"
           echo "and the hypatia-findings.json artifact for details."
-
       - name: Generate scan report
         run: |
           cat << EOF > hypatia-report.md
@@ -374,7 +320,6 @@ jobs:
           EOF
 
           cat hypatia-report.md >> $GITHUB_STEP_SUMMARY
-
       - name: Comment on PR with findings
         if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0
         # Advisory only — posting findings as a PR comment must never gate
@@ -384,32 +329,4 @@ jobs:
         continue-on-error: true
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7
         with:
-          script: |
-            const fs = require('fs');
-            const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));
-
-            const critical = findings.filter(f => f.severity === 'critical').length;
-            const high = findings.filter(f => f.severity === 'high').length;
-
-            let comment = `## 🔍 Hypatia Security Scan\n\n`;
-            comment += `**Findings:** ${findings.length} issues detected\n\n`;
-            comment += `| Severity | Count |\n|----------|-------|\n`;
-            comment += `| 🔴 Critical | ${critical} |\n`;
-            comment += `| 🟠 High | ${high} |\n`;
-            comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`;
-
-            if (critical > 0) {
-              comment += `⚠️ **Action Required:** Critical security issues found!\n\n`;
-            }
-
-            comment += `<details><summary>View findings</summary>\n\n`;
-            comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`;
-            comment += `</details>\n\n`;
-            comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;
-
-            github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: comment
-            });
\ No newline at end of file
+          script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n  comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `<details><summary>View findings</summary>\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `</details>\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n  owner: context.repo.owner,\n  repo: context.repo.repo,\n  issue_number: context.issue.number,\n  body: comment\n});"
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 22b4696..a3deed0 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,12 +1,9 @@
 # SPDX-License-Identifier: MPL-2.0
 name: Mirror to GitLab and Bitbucket
-
 on:
   push:
     branches: [main]
-
 permissions: read-all
-
 jobs:
   mirror:
     name: Sync to Forges
@@ -15,13 +12,11 @@ jobs:
     if: vars.GITLAB_MIRROR_ENABLED == 'true' || vars.BITBUCKET_MIRROR_ENABLED == 'true'
     permissions:
       contents: read
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0
-
       - name: Mirror to GitLab
         if: vars.GITLAB_MIRROR_ENABLED == 'true' && secrets.GITLAB_SSH_KEY != ''
         run: |
@@ -31,7 +26,6 @@ jobs:
           ssh-keyscan gitlab.com >> ~/.ssh/known_hosts
           git remote add gitlab git@gitlab.com:hyperpolymath/error-lang.git || true
           git push --mirror gitlab
-
       - name: Mirror to Bitbucket
         if: vars.BITBUCKET_MIRROR_ENABLED == 'true' && secrets.BITBUCKET_SSH_KEY != ''
         run: |
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index bfb4b61..ee6c503 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,17 +1,14 @@
 # SPDX-License-Identifier: MPL-2.0
 name: OpenSSF Scorecard
-
 on:
   branch_protection_rule:
   schedule:
-    - cron: '0 3 * * 1'  # Weekly on Monday
+    - cron: '0 3 * * 1' # Weekly on Monday
   push:
     branches: [main]
   pull_request:
     branches: [main]
-
 permissions: read-all
-
 jobs:
   analysis:
     name: Scorecard Analysis
@@ -22,20 +19,17 @@ jobs:
       id-token: write
       contents: read
       actions: read
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           persist-credentials: false
-
       - name: Run Scorecard analysis
         uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-
       - name: Upload to code-scanning
         uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3
         with:
diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile
index d8fdf0d..de9e22d 100644
--- a/.machine_readable/contractiles/Justfile
+++ b/.machine_readable/contractiles/Justfile
@@ -76,3 +76,6 @@ examples:
 init:
     rm -rf .error-lang
     @echo "State cleared. Next run will be Run #1."
+
+secret-scan-trufflehog:
+    @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true
diff --git a/Justfile b/Justfile
index d8fdf0d..de9e22d 100644
--- a/Justfile
+++ b/Justfile
@@ -76,3 +76,6 @@ examples:
 init:
     rm -rf .error-lang
     @echo "State cleared. Next run will be Run #1."
+
+secret-scan-trufflehog:
+    @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true