feat: TypeLL 41-panel integration, ECHIDNA ProofChain, SafeDOM defence-in-depth, flaky test fixes

- Wire TypeLL cross-panel type intelligence into all 41 panels (35 new + 7 existing),
  with central panelTypeChecks storage and graceful degradation on errors
- Add ProofChain.res: CI/CD-style visual proof pipeline for ECHIDNA sessions with
  colour-coded status nodes, gap detection, branching, and progress bar
- SafeDOM 4-layer defence: DOMPurify (SRI), regex sanitiser, tag nesting validator,
  Trusted Types; plus K9 contractile, Hypatia scan rules, 37 conformance tests
- Coprocessor Engine (Phase 1-3): control plane, Zig FFI data plane, smart routing
- GovernanceEngine with neurosymbolic integration and Vexometer/Humidity coupling
- A2ML/K9 integration layer: manifest parsing, Kennel/Yard/Hunt contracts
- Fix flaky Rust tests in multiplayer_monitor, valence_shell, vm_inspector, and
  release_manager by adding TEST_LOCK mutexes to serialise shared-state access
- Tea framework enhancements: SSR, SVG, keyboard/mouse subscriptions, HTTP, JSON
- 17 new Rust backend modules (a2ml, aerie, clade_scanner, feedback, fleet, etc.)
- 1383 Deno + 179 Rust tests passing, 0 failures

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.hypatia-rules.yml

@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# PanLL-specific Hypatia scan rules
+
+rules:
+  - id: SAFEDOM-001
+    name: "innerHTML usage outside SafeDOM"
+    description: >
+      Direct innerHTML assignment bypasses SafeDOM's 4-layer defence-in-depth
+      (DOMPurify, regex sanitiser, nesting validator, Trusted Types).
+      All DOM content injection MUST go through SafeDOMCore.mount() or
+      SafeMount.mountRawHtml().
+    severity: high
+    category: security
+    pattern: '\.innerHTML\s*='
+    exclude_paths:
+      - "src/core/SafeDOMCore.res"
+      - "src/core/SafeMount.res"
+      - "src/core/DOMPurify.res"
+      - "src/core/TrustedTypes.res"
+      - "node_modules/"
+      - "tests/"
+    languages:
+      - rescript
+      - javascript
+    remediation: >
+      Use SafeDOMCore.mount(selector, html) or SafeMount.mountRawHtml(selector, html)
+      instead of direct innerHTML assignment. These functions apply DOMPurify sanitisation,
+      regex pattern filtering, structural validation, and Trusted Types enforcement.
+    references:
+      - "src/core/SafeDOMCore.res"
+      - "contractiles/safedom-enforcement.ncl"
+      - "OWASP XSS Prevention Cheat Sheet"
+
+  - id: SAFEDOM-002
+    name: "outerHTML usage"
+    description: >
+      Direct outerHTML assignment bypasses SafeDOM. Use SafeDOMCore.mount() instead.
+    severity: high
+    category: security
+    pattern: '\.outerHTML\s*='
+    exclude_paths:
+      - "src/core/SafeDOMCore.res"
+      - "node_modules/"
+      - "tests/"
+    languages:
+      - rescript
+      - javascript
+    remediation: "Use SafeDOMCore.mount() instead of direct outerHTML assignment."
+
+  - id: SAFEDOM-003
+    name: "document.write usage"
+    description: >
+      document.write bypasses all DOM sanitisation. Never use in production code.
+    severity: critical
+    category: security
+    pattern: 'document\.write\s*\('
+    exclude_paths:
+      - "node_modules/"
+      - "tests/"
+    languages:
+      - rescript
+      - javascript
+    remediation: "Use SafeDOMCore.mount() instead of document.write()."

.machine_readable/ECOSYSTEM.scm

@@ -2,8 +2,8 @@
 ;; ECOSYSTEM.scm - PanLL's position in the hyperpolymath ecosystem
 
 (ecosystem
-  (version "1.0.0")
-  (last-updated "2026-02-09")
+  (version "1.1.0")
+  (last-updated "2026-03-09")
   (format-spec "hyperpolymath/rsr-template-repo/spec/ECOSYSTEM-FORMAT-SPEC.adoc")
 
   (identity
@@ -80,9 +80,9 @@
 
     ((project "rsr-template-repo")
      (relationship "template-source")
-     (nature "PanLL should follow RSR (Repository Structure Requirements) template")
-     (integration-status "partial")
-     (notes "Has AI manifest, PMPL license, but missing .machine_readable/ SCM files (being added now)"))
+     (nature "PanLL follows RSR (Repository Structure Requirements) template")
+     (integration-status "active")
+     (notes "Has AI manifest, PMPL license, .machine_readable/ SCM files, TOPOLOGY.md, all 15 applicable workflows"))
 
     ((project "scaffoldia")
      (relationship "potential-tool")
@@ -117,8 +117,8 @@
     ((project "verisimdb")
      (relationship "primary-backend-module")
      (nature "VeriSimDB is PanLL's first database backend. VQL-DT maps to PanLL's three-pane layout: Pane-L = proof obligations and type constraints, Pane-N = agentic inference ('you need a CITATION proof here'), Pane-W = query results, drift heatmaps, entity explorer. PanLL makes VQL-DT accessible to non-specialist users.")
-     (integration-status "planned")
-     (notes "Anti-Crash circuit breaker validates VQL queries before execution. Vexometer monitors cognitive load during complex VQL-DT sessions. Architecture proven by NQC Web UI (nextgen-databases/nqc/web/) and FormBD Studio (Tauri 2.0 + ReScript proof assistant). This is the neurosymbolic agentic DbVisualizer."))
+     (integration-status "active")
+     (notes "VeriSimDB panel wired with TypeLL cross-panel intelligence. BoJ database-mcp cartridge routes VQL queries when bojRouting=true."))
 
     ((project "quandledb")
      (relationship "future-backend-module")
@@ -141,24 +141,25 @@
     ((project "gitbot-fleet")
      (relationship "automation-orchestration-module")
      (nature "PanLL as command center for gitbot-fleet (rhodibot, echidnabot, sustainabot, glambot, seambot, finishbot). Visualize bot activity, override decisions, review findings.")
-     (integration-status "future")
-     (notes "Anti-Crash validates bot actions before execution. Pane-N shows bot reasoning chains. Extends existing gitbot-fleet → hypatia → verisimdb pipeline with human oversight."))
+     (integration-status "partial")
+     (notes "Fleet panel wired with 6 bots and safety triangle. Seambot integration relevant for compliance seam detection. BoJ agent-mcp cartridge routes automation through BoJ gateway."))
+
+    ((project "boj-server")
+     (relationship "primary-backend-gateway")
+     (nature "BoJ (Bundle of Joy) server provides 17 cartridges as MCP-compatible backend services. PanLL's BoJ panel and primary gateway route through BoJ cartridges.")
+     (integration-status "active")
+     (notes "17 cartridges (all Grade D Alpha), bojRouting toggle for 5 panels (lsp-mcp, database-mcp, dap-mcp, bsp-mcp, agent-mcp). Per-invocation latency tracking. Umoja federation for multi-instance coordination."))
 
     ((project "idaptik")
      (relationship "game-development-module")
-     (nature "PanLL as development environment for IDApTIK game. Level architect integration via VeriSimDB, emulator/simulator panels for game testing.")
-     (integration-status "future")
-     (notes "Already uses VeriSimDB for level data persistence. PanLL provides: level editor panel, game state inspector, A2ML data viewer, sync server monitor."))
-
-    ;; TODO (2026-02-27): COMPREHENSIVE MODULE AUDIT NEEDED
-    ;; The projects listed above were identified ad-hoc during a VeriSimDB session.
-    ;; Many more hyperpolymath projects likely map to PanLL modules — airie (network
-    ;; analysis/simulation/emulation), proven (BGP/crypto), stapeln (containers),
-    ;; ambientops, and others. A dedicated session should systematically walk the
-    ;; full ~265 repo ecosystem and map each candidate to PanLL's three-pane model
-    ;; (Pane-L constraints, Pane-N agent reasoning, Pane-W results/visualisation).
-    ;; This will also identify which projects are pure backends vs which need their
-    ;; own PanLL panels, and prevent duplication or missed integrations.
+     (nature "PanLL as development environment for IDApTIK game. 11 IDApTIK eNSAID panels with full Rust backends.")
+     (integration-status "active")
+     (notes "11 panels wired: Valence Shell, Game Preview, VM Inspector, Network Topology, Level Architect, Multiplayer Monitor, DLC Workshop, Release Manager, Editor Bridge, Build Dashboard, Coprocessors. All have Rust backends with Tauri commands."))
+
+    ;; NOTE (2026-03-09): 41 panels now wired. Comprehensive module audit still
+    ;; pending for remaining ~265 repo ecosystem mapping. Known candidates:
+    ;; airie (network analysis), proven (BGP/crypto), stapeln (containers),
+    ;; ambientops. See PanLL MEMORY.md for integration principle.
     )
 
   (dependencies
@@ -196,24 +197,19 @@
        (criticality "critical")))
 
     (libraries
-      ((name "rescript-tea")
-       (version "0.16.0")
-       (purpose "The Elm Architecture (TEA) state management")
-       (license "MIT")
-       (criticality "critical")
-       (migration-note "Migrating from custom TEA to this official library"))
-
-      ((name "rescript-webapi")
-       (version "0.10.0")
-       (purpose "Browser API bindings")
-       (license "MIT")
-       (criticality "medium"))
-
       ((name "@rescript/core")
        (version "1.6.1")
        (purpose "ReScript standard library")
        (license "MIT")
-       (criticality "high")))
+       (criticality "high"))
+
+      ((name "custom-tea")
+       (version "internal")
+       (purpose "Custom TEA (The Elm Architecture) — 8 modules, ~1011 lines, VDOM diffing, ARIA, message queue")
+       (license "PMPL-1.0-or-later")
+       (criticality "critical")
+       (note "ADR accepted: custom TEA in src/tea/ is permanent. rescript-tea@0.16.0 removed (unmaintained, incompatible).")))
+
 
     (dev-dependencies
       ((name "Deno.test")
@@ -250,8 +246,8 @@
 
   (roadmap-highlights
     ((milestone "v0.2.0")
-     (target "Q1 2026")
-     (focus "Enhanced UI & functional components"))
+     (target "Q2 2026")
+     (focus "TypeLL cross-panel intelligence, backend connections, Coprocessor Phase 2/3, A2ML/K9 integrations"))
 
     ((milestone "v0.3.0")
      (target "Q2 2026")