Release v0.4.0

.claude-plugin/marketplace.json

@@ -4,10 +4,10 @@
   },
   "plugins": [
     {
-      "description": "Design judgment for placing typed probabilistic judgment (Jev-class) using math, logic, and algorithmic mental models — across AI, SWE, business, knowledge work, and life. Not SWE-only. Formal methods are one pillar (Alloy vs Apalache; DST trio Antithesis/Resonate/PufferLib). GLiNER locate / GLiClass categorize are class peers, not footnotes. Expected utility, VOI, MCDA, signal detection, search/control, Leveson safety. Never launder a Noul as a proof. Not an API skill — load typesafe-ai for Jev contracts. Named for Augustus De Morgan, mentor of W. S. Jevons.",
+      "description": "Design judgment for placing typed probabilistic judgment (Jev-class System One) using math, logic, and algorithmic mental models — across AI, SWE, business, knowledge work, and life. Jev is the exemplar, not the monopoly (Laya, kev, OpenJev, TypeAR, GLiNER, encoder ZS). Ranking ≠ calibration; soft Noul ≠ hard gate. Formal methods are one pillar. Never launder a Noul as a proof. Not a TypeSafe product — load typesafe-ai for Jev contracts. Named for Augustus De Morgan, mentor of W. S. Jevons.",
       "name": "augustus",
       "source": "./.agents/skills/augustus",
-      "version": "0.3.0"
+      "version": "0.4.0"
     }
   ]
 }

.github/workflows/scorecard.yml

@@ -0,0 +1,49 @@
+# Official OpenSSF Scorecard action.
+# https://github.com/ossf/scorecard-action
+# Do not invent a numeric score in docs; the API is empty until this
+# workflow publishes a result from default-branch runs.
+
+name: Scorecard supply-chain security
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "30 1 * * 6"
+  push:
+    branches: ["main"]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -1 +1,17 @@
 .DS_Store
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+id_rsa
+id_ed25519
+*.p12
+*.pfx
+secrets/
+.secrets
+credentials.json
+*_credentials.json
+.npmrc
+.pypirc
+*.sarif

CITATION.cff

@@ -0,0 +1,28 @@
+cff-version: 1.2.0
+title: Augustus
+message: If you use this skill, please cite it using these metadata.
+type: software
+authors:
+  - name: Augustus contributors
+    website: https://github.com/24601/Augustus
+  - family-names: Mustafa
+    given-names: Basit
+    alias: "24601"
+repository-code: https://github.com/24601/Augustus
+url: https://24601.github.io/Augustus/
+abstract: >-
+  Design-judgment skill for placing typed probabilistic judgment
+  (the Jev-class of System One / decision models) using mathematical,
+  logical, and algorithmic mental models. TypeSafe Jev is the
+  documented exemplar, not the monopoly. Formal methods are one pillar.
+  Not a TypeSafe product.
+keywords:
+  - system-one
+  - decision-judgment
+  - jev-class
+  - zero-shot-classification
+  - formal-methods
+  - agentic-ai
+license: MIT
+version: 0.4.0
+date-released: "2026-09-20"

CODE_OF_CONDUCT.md

@@ -0,0 +1,12 @@
+# Code of conduct
+
+Be respectful. Do not harass anyone. Argue about placements and evidence,
+not people.
+
+This is a small MIT project. Maintainers may reject contributions that
+are hostile, that invent metrics, or that treat a soft score as a hard
+safety gate.
+
+Report conduct problems the same way as other repo issues — or privately
+via GitHub Security Advisories if the report itself should stay off the
+public tracker. There is no separate conduct email.

CONTRIBUTING.md

@@ -0,0 +1,56 @@
+# Contributing
+
+Docs and skill PRs are welcome. This is a placement skill, not a TypeSafe
+product and not a vendor how-to.
+
+## What to send
+
+- Skill / reference-card clarifications that keep Jev as **exemplar, not
+  monopoly**
+- Measurement-honesty fixes (ranking ≠ calibration; Score is 0..n−1;
+  Noul has no confidence field; soft Noul ≠ hard gate)
+- Composition notes (fail-open vs fail-closed per action; prune ≠ deny)
+- Formal-methods honesty (a Noul is a SENSOR, not a proof)
+
+Do not invent metrics. Do not paste `pipeline()` / `pip` / `npm` install
+recipes that read as endorsements. Quote *theirs* and label vendor
+figures.
+
+## Adversarial review
+
+Read the change against the skill's own non-negotiables before opening
+the PR. The usual failure modes are soundness theater: hard-gating a
+soft Noul, treating ECE as an edge, treating 0.85 / minProbability as
+Harbor, or laundering a score as a proof.
+
+Run what you can locally:
+
+```bash
+python3 .agents/skills/augustus/scripts/evaluate_decisions.py --self-test
+```
+
+The Pages workflow must stay green (`docs/index.md` still contains the
+gate strings the check greps for).
+
+## Fold uniqueness
+
+Hourly research folds carry uniqueness locks so the same cluster is not
+re-opened as "new." Before folding:
+
+- Read `research/notes.md` and the uniqueness fragments in
+  `.agents/skills/augustus/SKILL.md`
+- Do not re-fold an already-landed section as a new beat
+- Do not reopen or amend an in-flight fold PR (including open #31)
+- Pre-0.4.0 uniqueness dump: `research/changelog-hourly.md` (archive,
+  not release notes)
+
+## Secrets
+
+No API keys, tokens, or `.env` files in the tree. Push protection and
+secret scanning are on. See `SECURITY.md`.
+
+## Branch protection
+
+Default-branch protection, required checks, and org settings are
+parent-owned. This file does not change them. Prefer a PR off latest
+`main`. Do not force-push shared branches.

README.md

@@ -1,10 +1,16 @@
 # Augustus
 
+Place typed probabilistic judgment — Jev-class System One / decision
+models — using classical mental models. Jev is the exemplar, not the monopoly.
+
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/github/v/release/24601/Augustus)](https://github.com/24601/Augustus/releases)
+[![Release](https://img.shields.io/github/v/release/24601/Augustus)](https://github.com/24601/Augustus/releases)
+[![Pages](https://img.shields.io/badge/docs-24601.github.io-blue.svg)](https://24601.github.io/Augustus/)
 [![Claude Code](https://img.shields.io/badge/Claude_Code-marketplace-purple.svg)](.claude-plugin/marketplace.json)
 [![Skills.sh](https://img.shields.io/badge/skills.sh-compatible-green.svg)](https://www.skills.sh/)
 
+**Homepage:** [24601.github.io/Augustus](https://24601.github.io/Augustus/)
+
 Agent skill for placing TypeSafe Jev Choice/Score/Noul with classical
 decision methods, composition algebra, and a validation gate.
 
@@ -18,12 +24,13 @@ mathematical, logical, and algorithmic mental models. It applies across
 Exact work stays in code or policy; the model owns narrow judgment;
 never launder a Noul as a proof.
 
-> Companion, not replacement, to the official
+> **Not a TypeSafe product.** Companion, not replacement, to the official
 > [`typesafe-ai` skill](https://github.com/typesafe-ai/skills). That skill
 > owns Jev integration contracts; Augustus owns the **design judgment**:
 > which *pillar*, *family*, and classical method map, what the objective
 > implies for fail-open vs fail-closed, and what experiment would prove a
-> design wrong. Not a TypeSafe-only how-to.
+> design wrong. Not a TypeSafe-only how-to. Integrity / reward-hack
+> companion: [`rh-guard`](https://github.com/24601/rh-guard).
 
 ## The skill
 
@@ -400,6 +407,14 @@ claude plugin install augustus@augustus
 npx skills add 24601/Augustus --skill augustus
 ```
 
+**Copy the skill path** (Cursor / Amp / any agent that reads repo-local
+skills):
+
+```bash
+git clone https://github.com/24601/Augustus.git
+# skill lives at .agents/skills/augustus/
+```
+
 **ChatGPT**: skills are not a native ChatGPT primitive — paste
 `.agents/skills/augustus/SKILL.md` plus the `references/` files into a
 GPT's instructions or a Project's knowledge and it will follow the protocol.
@@ -411,21 +426,23 @@ GPT's instructions or a Project's knowledge and it will follow the protocol.
 `jev` `typesafe` `typesafe-ai` `system-one` `system-one-models`
 `structured-output` `calibrated-confidence` `ai-agents` `agent-skills`
 `decision-systems` `reranking` `beam-search` `claude-code` `python` `llm`
-`decision-theory` `semantic-search` `agent-workflows` `mixed-architecture`
+`decision-theory` `decision-making` `semantic-search` `agent-workflows`
+`mixed-architecture` `agentic-ai` `zero-shot-classification`
 `tool-routing` `skill-routing` `semantic-lint` `classification` `gliclass`
 `listwise-ranking` `vision-scoring` `open-weights` `formal-methods`
-`model-checking` `deterministic-simulation` `decision-theory`
+`model-checking` `deterministic-simulation`
 `value-of-information` `signal-detection` `mcda` `calibration`
 `alloy` `apalache` `pufferlib` `stamp-stpa`
 
 ## Versioning
 
 See [CHANGELOG.md](CHANGELOG.md) and
-[releases](https://github.com/24601/Augustus/releases). Current: **0.3.0**,
+[releases](https://github.com/24601/Augustus/releases). Current: **0.4.0**,
 written against [`typesafe-ai/skills` v0.5.7](https://github.com/typesafe-ai/skills/tree/v0.5.7)
-(`65a39f3`). Re-read live TypeSafe docs before treating that pin as current
-API behavior.
+(`65a39f3`; live HEAD still this commit). Re-read live TypeSafe docs
+before treating that pin as current API behavior.
 
 ## License
 
-MIT — see [LICENSE](LICENSE).
+MIT — see [LICENSE](LICENSE). Security reports: [SECURITY.md](SECURITY.md).
+Contributions: [CONTRIBUTING.md](CONTRIBUTING.md).

SECURITY.md

@@ -0,0 +1,41 @@
+# Security
+
+## Supported versions
+
+| Version | Supported |
+| ------- | --------- |
+| 0.4.x   | Yes       |
+| 0.3.x   | No        |
+| < 0.3   | No        |
+
+This repo is a design-judgment skill plus offline scripts. There is no
+hosted API and no runtime that accepts untrusted input by default.
+
+## Report a vulnerability
+
+Use GitHub **Security Advisories** / private vulnerability reporting on
+this repository:
+
+https://github.com/24601/Augustus/security/advisories/new
+
+Do not open a public issue for a security report. There is no separate
+security email.
+
+Please include what is affected (skill text, evaluator, workflows, Pages)
+and a way to reproduce. We will acknowledge and ship a fix on the
+supported line when the report is valid.
+
+## Already enabled (do not disable)
+
+- Dependabot security updates
+- Secret scanning
+- Push protection for secrets
+
+## Secrets
+
+Do not commit API keys, tokens, or `.env` files. `.gitignore` covers the
+common names. Research folds quote public READMEs; they are not install
+recipes and must not paste live credentials.
+
+`evaluate_decisions.py --self-test` is local scoring math. It does not
+call a model and does not need a key.

docs/_config.yml

@@ -1,7 +1,8 @@
 title: Augustus
 description: >-
-  Agent skill for placing TypeSafe Jev Choice/Score/Noul with classical
-  decision methods, composition algebra, and a validation gate.
+  System One decision-judgment skill for the Jev-class of typed
+  probabilistic models. Place TypeSafe Jev Choice/Score/Noul — Jev is
+  the exemplar, not the monopoly — beside code, policy, and proof.
 url: https://24601.github.io
 baseurl: /Augustus
 theme: jekyll-theme-cayman

docs/index.md

@@ -1,11 +1,18 @@
 ---
 layout: default
-title: Home
+title: Augustus — System One decision judgment
 permalink: /
 ---
 
-Agent skill for placing TypeSafe Jev Choice/Score/Noul with classical
-decision methods, composition algebra, and a validation gate.
+**Last updated:** 2026-09-20 (v0.4.0)
+
+Agent skill for placing TypeSafe Jev Choice/Score/Noul — and the wider
+Jev-class of System One / decision models — with classical decision
+methods, composition algebra, and a validation gate.
+
+v0.4.0: Jev is the exemplar, not the monopoly (Laya, kev, OpenJev,
+TypeAR, GLiNER, encoder zero-shot). Ranking is not calibration. A soft
+Noul is not a hard gate. Formal methods stay a pillar.
 
 - [Install the skill](https://github.com/24601/Augustus#install)
 - [Ecosystem](ecosystem.md)
@@ -19,4 +26,5 @@ Companion to the official
 [`typesafe-ai` skill](https://github.com/typesafe-ai/skills)
 (Jev contracts). Augustus owns **where** judgment belongs: pillar,
 family, fail polarity, and the experiment that could prove a design
-wrong.
+wrong. Not a TypeSafe product. Integrity / reward-hack companion:
+[`rh-guard`](https://github.com/24601/rh-guard).

docs/release-notes-v0.4.0.md

@@ -0,0 +1,40 @@
+Design judgment across domains. Augustus places typed probabilistic
+judgment (Jev is the exemplar, not the monopoly) using math, logic, and
+algorithmic mental models. The job is not limited to software
+engineering. Formal methods are one pillar. Exact work stays in code or
+policy; the model owns narrow judgment; a soft Noul is not a proof.
+
+Pegged against [`typesafe-ai/skills` v0.5.7](https://github.com/typesafe-ai/skills/tree/v0.5.7)
+(`65a39f3`, 2026-09-12). Live HEAD of that repo is still this commit.
+
+### Added
+
+- **Class breadth.** Laya, kev, OpenJev, TypeAR, GLiNER species, Decision
+  Graph Protocol, encoder zero-shot classifiers. Jev vs GPT-5.6 bakeoffs
+  are a category error (Merve: BERTForXYZ → DeBERTa → ModernBERT).
+- **Measurement honesty.** Harbor / jevals practice: ranking ≠ calibration.
+  Score is 0..n−1. Noul has no confidence field. ECE ≠ an edge. 0.85 /
+  minProbability theater. Soft Noul ≠ hard gate. VERIFY needs
+  discriminating evidence.
+- **Composition.** DGP frame→assess→commit; meaning-grep; gut
+  cost-of-error; fail-open vs fail-closed; compaction 0.5 is not safety;
+  prune ≠ deny.
+- Community-health stubs (SECURITY, CONTRIBUTING, CODE_OF_CONDUCT) and
+  an OpenSSF Scorecard workflow so a score can appear. No invented
+  Scorecard number.
+
+Formal methods pillar unchanged in spirit. Homepage:
+https://24601.github.io/Augustus/
+
+### Install
+
+```bash
+claude plugin marketplace add 24601/Augustus
+claude plugin install augustus@augustus
+```
+
+```bash
+npx skills add 24601/Augustus --skill augustus
+```
+
+Full notes: [CHANGELOG.md](https://github.com/24601/Augustus/blob/main/CHANGELOG.md)

research/README.md

@@ -6,6 +6,8 @@ refreshes diff against a known baseline instead of re-discovering the world.
 - `sources.json` — every source pulled, with type + retrieval date + note.
 - `notes.md` — distilled findings (contracts, recipes, ecosystem, gaps).
 - `refresh-log.md` — dated log of each refresh pass and what changed.
+- `changelog-hourly.md` — pre-0.4.0 uniqueness-lock dump (not release
+  notes; see root `CHANGELOG.md`).
 - `archive/hourly/YYYY-MM-DDTHH/` — raw scan dumps for that UTC hour
   (X theme digest + `topic:jev` JSON when a live scan lands).
 - `archive/curriculum/` — attached research briefs folded into the skill