docs: add Signed commits section to CONTRIBUTING

.github/CONTRIBUTING.md

@@ -69,3 +69,22 @@ Conduct](CODE_OF_CONDUCT.md).
 
 By contributing, you agree that your contributions will be licensed
 under the same license as the project (see LICENSE).
+
+## Signed commits
+
+Every commit that reaches the default branch must be signed; a ruleset refuses
+unsigned pushes. Estate policy:
+[SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc).
+
+SSH commit signing requires Git 2.34 or later.
+
+- **People and interactive agents** sign with an SSH key registered on GitHub
+  as a *signing* key (`gpg.format=ssh`, `user.signingkey=<key>.pub`,
+  `commit.gpgsign=true`). The committer email must be verified on that account.
+- **Apps, bots and workflows** never `git push` local commits. They write
+  through the API (`createCommitOnBranch` or the estate `signed-push` action)
+  so that GitHub signs each commit.
+- Merge PRs with **squash**. The ruleset checks every commit on the PR branch,
+  not just the result, so one unsigned commit blocks the merge. Re-create such a
+  branch with signed commits (`git cherry-pick -S`) and open a new PR.
+  Rebase-merge replays commits unsigned and is disabled.

CONTRIBUTING.adoc

@@ -56,3 +56,22 @@ This root document exists because the estate docs gate
 `CONTRIBUTING.md`, `CONTRIBUTING.adoc`, or `3-practice/CONTRIBUTING.adoc`
 at the repository root. Estate documentation policy: AsciiDoc by default —
 see `hyperpolymath/standards`.
+
+== Signed commits
+
+Every commit that reaches the default branch must be signed; a ruleset refuses
+unsigned pushes. Estate policy:
+https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc[SIGNING-POLICY].
+
+SSH commit signing requires Git 2.34 or later.
+
+* **People and interactive agents** sign with an SSH key registered on GitHub
+  as a *signing* key (`gpg.format=ssh`, `user.signingkey=<key>.pub`,
+  `commit.gpgsign=true`). The committer email must be verified on that account.
+* **Apps, bots and workflows** never `git push` local commits. They write
+  through the API (`createCommitOnBranch` or the estate `signed-push` action)
+  so that GitHub signs each commit.
+* Merge PRs with **squash**. The ruleset checks every commit on the PR branch,
+  not just the result, so one unsigned commit blocks the merge. Re-create such a
+  branch with signed commits (`git cherry-pick -S`) and open a new PR.
+  Rebase-merge replays commits unsigned and is disabled.

docs/investigation/2026-09-26-silicon-core-recon/B-backend-status.adoc

@@ -32,12 +32,12 @@ Built with Zig 0.15.2, `-Doptimize=ReleaseFast` (as CI). `[empirical]` unless no
 | `backend_matmul` → `axiom_matmul_checked` | yes (16×12·12×7) | correct | 9–16× slower than `axiom_matmul` (E.1). Rejects NaN/Inf with an error — different contract from the Julia reference (D.4).
 | `backend_relu` → `axiom_relu_checked` | yes (128; NaN → error) | correct | In-place `backend_relu!` uses the *unchecked* `axiom_relu_inplace` — same op, different NaN contract.
 | `backend_gelu`, `backend_sigmoid` → `axiom_gelu/sigmoid` | yes | correct | GELU uses the overflow-safe `1 − 2/(e+1)` form.
-| `backend_tanh` / `backend_tanh!` → `axiom_tanh(_inplace)` | *no* | *NaN for x ≥ 44.5 and +Inf* (Julia: 1.0); rel. error 1.3e-3 at x=1e-5, 100 % at 1e-8 | `activations.zig:103–119` uses `(e^{2x}−1)/(e^{2x}+1)`; `repro/activation_probe.py`.
+| `backend_tanh` / `backend_tanh!` → `axiom_tanh(_inplace)` | *no* | *NaN for x ≥ 44.5 and +Inf* (Julia: 1.0); rel. error 1.3e-3 at x=1e-5, 100 % at 1e-8 | `activations.zig:103–119` uses `(e^{2x}−1)/(e^{2x}+1)`; `repro/activation_probe.jl`.
 | `backend_softmax`, `backend_log_softmax` → `axiom_softmax/log_softmax` | softmax yes (8×5) | correct for `dim == ndims` | `dim` argument ignored (`zig_ffi.jl:329,351`) `[static]`. `[empirical]` B=4…17 × 2048 correct through the `.so`.
 | `backend_conv2d` → `axiom_conv2d` | yes (2×10×10×3, 3×3×3×4) | correct at that shape | Wrapper does full `permutedims` copies both ways (E.3). Stride/padding/dilation/groups other than the tested defaults: untested.
-| `backend_batchnorm` → `axiom_batchnorm` | yes (6×8) | *wrong for `num_features` 4097–8191; SIGSEGV from 8192* | Fixed `[4096]f32` stack scratch (`norm.zig:143`); `repro/batchnorm_probe.py`. Reachable from `forward(bn::BatchNorm)` (`abstract.jl:1072–1086`) with the Zig backend set. `training` flag ignored `[static]`.
-| `backend_layernorm`, `backend_rmsnorm` → `axiom_layernorm/rmsnorm` | *no* | correct through the shipped `.so` for B=4…17 × 2048/4096/65536, canary intact | `threading.zig:392,469,523` `batch_size − last_start` underflows at `batch_size = 5` (with `MAX_WORKERS = 3`, `total ≥ 8192`): panics in Debug/ReleaseSafe; the same function compiled ReleaseFast in a `zig test` binary segfaults; in the shipped `.so` LLVM happened to make it benign. Undefined behaviour either way. `repro/repro_underflow*.zig`, `repro/canary_probe.py`. 3-D inputs: wrapper treats `size(x,2)` as hidden `[static]`.
-| `backend_maxpool2d`, `backend_global_avgpool2d` → `axiom_maxpool2d`, `axiom_global_avgpool2d` (no Zig wrapper exists for `avgpool2d`) | *no* | *wrong values whenever N>1 or C>1 (and for non-square N=1,C=1)* | Wrapper passes column-major bytes to row-major NHWC kernels without `_to_row_major_vec` (`zig_ffi.jl:479–507`, `:513`). `repro/layout_probe.py`: maxpool wrong 5/8, 5/8, 49/54, 7/8 elements in four cases; global-avgpool wrong for every N>1 or C>1. Edge contracts: all-`−Inf` window → `−3.4028235e38` (Julia `−Inf`); NaN in window → `1.0` (Julia `NaN`). Not reachable from `MaxPool2d.forward` (pure Julia) — reachable from direct calls, `SmartBackend`, and benchmarks.
+| `backend_batchnorm` → `axiom_batchnorm` | yes (6×8) | *wrong for `num_features` 4097–8191; SIGSEGV from 8192* | Fixed `[4096]f32` stack scratch (`norm.zig:143`); `repro/batchnorm_probe.jl`. Reachable from `forward(bn::BatchNorm)` (`abstract.jl:1072–1086`) with the Zig backend set. `training` flag ignored `[static]`.
+| `backend_layernorm`, `backend_rmsnorm` → `axiom_layernorm/rmsnorm` | *no* | correct through the shipped `.so` for B=4…17 × 2048/4096/65536, canary intact | `threading.zig:392,469,523` `batch_size − last_start` underflows at `batch_size = 5` (with `MAX_WORKERS = 3`, `total ≥ 8192`): panics in Debug/ReleaseSafe; the same function compiled ReleaseFast in a `zig test` binary segfaults; in the shipped `.so` LLVM happened to make it benign. Undefined behaviour either way. `repro/repro_underflow*.zig`, `repro/canary_probe.jl`. 3-D inputs: wrapper treats `size(x,2)` as hidden `[static]`.
+| `backend_maxpool2d`, `backend_global_avgpool2d` → `axiom_maxpool2d`, `axiom_global_avgpool2d` (no Zig wrapper exists for `avgpool2d`) | *no* | *wrong values whenever N>1 or C>1 (and for non-square N=1,C=1)* | Wrapper passes column-major bytes to row-major NHWC kernels without `_to_row_major_vec` (`zig_ffi.jl:479–507`, `:513`). `repro/layout_probe.jl`: maxpool wrong 5/8, 5/8, 49/54, 7/8 elements in four cases; global-avgpool wrong for every N>1 or C>1. Edge contracts: all-`−Inf` window → `−3.4028235e38` (Julia `−Inf`); NaN in window → `1.0` (Julia `NaN`). Not reachable from `MaxPool2d.forward` (pure Julia) — reachable from direct calls, `SmartBackend`, and benchmarks.
 | `backend_dense` (fused) → `axiom_dense`? | no | not probed | `zig_forward(model::Dense)` (`abstract.jl:2495–2502`) drops bias and activation `[static]`.
 | attention (`axiom_scaled_dot_product_attention`, `axiom_flash_attention`) | no Julia wrapper | silent no-op for `seq_len > 64` (`attention.zig:29`), `> 4096` for flash | Output buffer left untouched, no error code.
 | 15 unwrapped exports | — | unreachable from Julia | `add(_checked)`, `mul(_checked)`, `bmm`, `fill`, `avgpool2d`, `relu`, `relu6(_checked)`, `rotary_embedding`, `scaled_dot_product_attention(_checked)`, `flash_attention(_checked)`.

docs/investigation/2026-09-26-silicon-core-recon/D-numerical-parity-risks.adoc

@@ -15,7 +15,7 @@ column-major `(N,H,W,C)` buffer straight to `axiom_maxpool2d` /
 Every other array wrapper in the file converts with `_to_row_major_vec`
 (`:79`); these two do not.
 
-*Measured* (`repro/layout_probe.py`, simulates exactly what the Julia wrapper
+*Measured* (`repro/layout_probe.jl`, simulates exactly what the Julia wrapper
 does, compares with correct pooling):
 
 [cols="2,1,1"]
@@ -57,7 +57,7 @@ Julia's `tanh` returns `1.0`. `gelu` in the same file already uses the
 overflow-safe `1 − 2/(e^{2x}+1)` (`:135,144`) — the fix is to use the same
 form in `tanh_inplace`/`tanh`. Near zero the formula cancels: relative error
 1.3e-3 at `x = 1e-5`, 100 % at `x = 1e-8` (absolute error negligible).
-Measured with `repro/activation_probe.py`; `axiom_tanh_inplace` behaves the
+Measured with `repro/activation_probe.jl`; `axiom_tanh_inplace` behaves the
 same. `gelu`, `sigmoid`, `silu` are fine over the probed range (sigmoid(−100)
 flushes a denormal to 0 — harmless).
 
@@ -69,7 +69,7 @@ absent from `backend_parity.jl`).
 
 `norm.zig:143` `var inv_std: [4096]f32 = undefined;` indexed by
 `num_features` with no bound check. Through the shipped ReleaseFast `.so`
-(`repro/batchnorm_probe.py`, B=2):
+(`repro/batchnorm_probe.jl`, B=2):
 
 [cols="1,2"]
 |===

docs/investigation/2026-09-26-silicon-core-recon/E-memory-performance.adoc

@@ -12,7 +12,7 @@ that would settle them.
 
 `backend_matmul(::ZigBackend)` always calls `axiom_matmul_checked`
 (`zig_ffi.jl:114`), which runs a scalar `O(m·n·k)` finiteness pre-pass before
-the tiled SIMD kernel. `repro/matmul_cost.py`, same `.so`, same inputs
+the tiled SIMD kernel. `repro/matmul_cost.jl`, same `.so`, same inputs
 (median of repeats):
 
 [cols="1,1,1,1,1"]

docs/investigation/2026-09-26-silicon-core-recon/J-upstream-issues.adoc

@@ -64,46 +64,47 @@ wrong results / false claim on a documented path or major perf regression;
 == J.2 Detailed entries (evidence + reproduction)
 
 All commands assume the library was built as CI does:
-`cd zig && zig build -Doptimize=ReleaseFast` (Zig 0.15.2) and that `numpy`
-is importable. Zig test reproductions compile against the repository's
+`cd zig && zig build -Doptimize=ReleaseFast` (Zig 0.15.2) and that Julia
+is available. The probes use only Julia standard libraries; see link:repro/README.adoc[reproduction notes]
+for the port and historical measurement details. Zig test reproductions compile against the repository's
 `zig/src` tree directly. Paths are relative to `docs/investigation/2026-09-26-silicon-core-recon/repro/`.
 
 === J-01 Zig `batchnorm` above 4096 features `[E]` — Critical
 
 * *Where:* `zig/src/norm.zig:143` `var inv_std: [4096]f32 = undefined;` indexed by `num_features`.
 * *Reach:* `abstract.jl:1072–1086` `forward(bn::BatchNorm, x)` → `backend_batchnorm(::ZigBackend, …)` (`zig_ffi.jl:536`) whenever the current backend is not `JuliaBackend`, `!bn.training`, `bn.affine`.
 * *Observed (shipped `.so`):* 4096 correct; 4097 → 2 wrong; 4100 → 8 wrong; 8192 / 65536 / 1e6 → SIGSEGV.
-* *Repro:* `python3 batchnorm_probe.py ../../../../zig/zig-out/lib/libaxiom_zig.so`; Zig-level: `zig test --dep axiom -Mroot=repro_batchnorm.zig -Maxiom=../../../../zig/src/axiom.zig -OReleaseSafe` → index out of bounds panic.
+* *Repro:* `julia --startup-file=no batchnorm_probe.jl ../../../../zig/zig-out/lib/libaxiom_zig.so`; Zig-level: `zig test --dep axiom -Mroot=repro_batchnorm.zig -Maxiom=../../../../zig/src/axiom.zig -OReleaseSafe` → index out of bounds panic.
 * *Julia confirmation:* `set_backend!(ZigBackend(lib)); m = Sequential(Dense(4, 8192), BatchNorm(8192)); m(Tensor(randn(Float32, 2, 4)))` — expected: process terminates.
 * *Fix:* allocate `inv_std` per call (arena/heap) or compute per feature without the scratch; add `num_features ∈ {4096, 4097, 8192, 65536}` to `zig build test` and `backend_parity.jl`.
 
 === J-02 Pooling wrappers: wrong layout `[E]` — High
 
 * *Where:* `src/backends/zig_ffi.jl:479–507` (`backend_maxpool2d`), `:513` (`backend_global_avgpool2d`) pass `input` directly; compare `_to_row_major_vec` use in conv/layernorm/softmax wrappers (`:79–95`). Kernels index row-major NHWC (`zig/src/pool.zig`).
 * *Observed:* maxpool wrong 5/8 (N=1,4×4,C=2), 5/8 (N=2,C=1), 49/54 (N=2,6×6,C=3), 7/8 (N=1,5×3,C=1,k=2,s=1); global-avgpool wrong for any N>1 or C>1; only N=1,C=1,square is correct.
-* *Repro:* `python3 layout_probe.py ../../../../zig/zig-out/lib/libaxiom_zig.so`.
+* *Repro:* `julia --startup-file=no layout_probe.jl ../../../../zig/zig-out/lib/libaxiom_zig.so`.
 * *Julia confirmation:* see D.1.
 * *Reach:* direct API, `SmartBackend`, `benchmark/benchmarks.jl`; not `MaxPool2d.forward` (pure Julia). Not parity-tested.
 
 === J-03 Zig `tanh` NaN overflow `[E]` — High
 
 * *Where:* `zig/src/activations.zig:103–119` `(e^{2x}−1)/(e^{2x}+1)`; `gelu` at `:135,144` already uses `1 − 2/(e^{2x}+1)`.
 * *Observed:* `axiom_tanh(44.5) = NaN`, `(45) = NaN`, `(50) = NaN`, `(100) = NaN`, `(+Inf) = NaN`; `(44.3) = 1.0`. Near zero: rel. err 1.3e-3 at 1e-5, 100 % at 1e-8. `gelu`, `sigmoid`, `silu` fine.
-* *Repro:* `python3 activation_probe.py ../../../../zig/zig-out/lib/libaxiom_zig.so`.
+* *Repro:* `julia --startup-file=no activation_probe.jl ../../../../zig/zig-out/lib/libaxiom_zig.so`.
 * *Reach:* `backend_tanh(::ZigBackend)`, `backend_tanh!`, `SmartBackend`. `tanh` absent from `backend_parity.jl`.
 
 === J-04 Chunking underflow at `batch_size = 5` `[E]` — Medium (UB)
 
 * *Where:* `zig/src/threading.zig:392` (`parallel_layernorm`), `:469` (`parallel_rmsnorm`), `:523` (`parallel_batch`, used by batched softmax): `last_start = (num_threads−1)·chunk`, `last_count = batch_size − last_start` with `chunk = ceil(batch/num_threads)`, `num_threads = min(4, batch)`. For `batch = 5`: `chunk = 2`, `last_start = 6 > 5` → usize wrap. Reached when `total ≥ 8192` and `batch ≥ 4` (`:294–324`).
 * *Observed:* Debug/ReleaseSafe: `panic: integer overflow` at `threading.zig:392`. `zig test -OReleaseFast` binary: *segfault*. Shipped `.so` (ReleaseFast): B=5 × {2048, 4096, 65536} correct with an intact canary after the output — LLVM's treatment of the UB happened to be benign in that compilation unit. It is undefined behaviour and build-dependent.
-* *Repro:* `zig test -OReleaseSafe --dep axiom -Mroot=repro_underflow_canary.zig -Maxiom=../../../../zig/src/threading.zig` (panic); `-OReleaseFast` (crash); `python3 canary_probe.py …libaxiom_zig.so` (benign through the `.so`); `python3 chunking_probe.py …` (B = 4…17 through the `.so`).
+* *Repro:* `zig test -OReleaseSafe --dep axiom -Mroot=repro_underflow_canary.zig -Maxiom=../../../../zig/src/threading.zig` (panic); `-OReleaseFast` (crash); `julia --startup-file=no canary_probe.jl …libaxiom_zig.so` (benign through the `.so`); `julia --startup-file=no chunking_probe.jl …` (B = 4…17 through the `.so`).
 * *Fix:* `last_count = batch_size -| last_start` (saturating) or derive per-thread ranges with `@min(start + chunk, batch_size)` as the element-wise `parallel_unary` already does (`:219`). Add B ∈ {1,…,9,13} to `zig build test` (Debug would have caught it).
 
 === J-05 `axiom_matmul_checked` cost `[E]` — High (performance / claim)
 
 * *Where:* `zig_ffi.jl:114` always calls `axiom_matmul_checked`; `zig/src/axiom.zig:101` pre-pass over `m·n·k` products.
 * *Observed:* checked vs unchecked: 0.311/0.035 ms (64²), 2.82/0.18 (128²), 24.8/2.17 (256²), 284.6/21.7 (512²). Single-thread OpenBLAS 512² = 2.3 ms. `benchmark/results_2026-02-20…` reports 25.6 ms at 512² — the unchecked kernel.
-* *Repro:* `python3 matmul_cost.py ../../../../zig/zig-out/lib/libaxiom_zig.so`.
+* *Repro:* `julia --startup-file=no matmul_cost.jl ../../../../zig/zig-out/lib/libaxiom_zig.so`.
 * *Fix:* check inputs in O(m·k + k·n) (vectorised `isfinite` scans) or the output once; keep the error contract; re-run the benchmark table.
 
 === J-06 `maxpool2d` padding not passed `[S]` — Medium

docs/investigation/2026-09-26-silicon-core-recon/README.adoc

@@ -30,7 +30,7 @@ dependency was added. No PR is opened by this work. Everything here lives under
 | H | link:H-staged-plan.adoc[Staged plan] | Phase 0 fixes + parity tests → Phase 1 internal `Runtime` seam → Phase 2 evidence gate → Phase 3 (conditional) extraction.
 | I | link:I-not-recommended.adoc[Changes explicitly NOT recommended] | No repo split now, no `SiliconCore.jl` from stubs, no GPU deps, no replacing reference kernels, no global warning suppression, no third backend hierarchy.
 | J | link:J-upstream-issues.adoc[Upstream issues with evidence] | 40 issues, each with severity, evidence type (empirical vs static), reproduction, and bucket (fix-in-Axiom / future-standalone / not-yet-verified).
-| — | link:repro/[repro/] | Minimal reproductions (Zig test files + Python/ctypes probes against the built `.so`).
+| — | link:repro/[repro/] | Minimal reproductions (Zig test files + Julia/ccall probes against the built `.so`).
 |===
 
 == How the evidence was obtained

docs/investigation/2026-09-26-silicon-core-recon/repro/README.adoc

@@ -6,22 +6,34 @@ library first exactly as CI does (Zig 0.15.2):
 
     cd zig && zig build -Doptimize=ReleaseFast     # -> zig/zig-out/lib/libaxiom_zig.so
 
-Python probes need `numpy` (`ctypes` is standard library). Run them from this
-directory; the `.so` path argument is `../../../../zig/zig-out/lib/libaxiom_zig.so`.
+Julia probes use only standard libraries (no package installation required).
+Run them from this directory, for example:
+
+    julia --startup-file=no activation_probe.jl ../../../../zig/zig-out/lib/libaxiom_zig.so
+
+The probes retain the investigated shapes, C ABI calls, comparison tolerances,
+and subprocess isolation for batchnorm/chunking crashes. Normalisation buffers
+store each C row in a Julia column; pooling deliberately passes Julia's native
+column-major NHWC layout to reproduce the wrapper defect. Random samples use
+Julia's seeded generator, so exact mismatch counts and timings can differ from
+the original Python/NumPy measurements recorded in this investigation. Those
+historical measurements are unchanged; the Julia ports reproduce the same cases.
+A successful probe exit means the probe ran, not that the backend is correct;
+inspect its mismatch, NaN, canary, and child-process crash reports.
 
 [cols="2,3,2"]
 |===
 | File | What it shows | Issue
 
-| `batchnorm_probe.py` | `axiom_batchnorm` silently wrong for 4097–8191 features, SIGSEGV from 8192 (each case in a subprocess) | J-01
+| `batchnorm_probe.jl` | `axiom_batchnorm` silently wrong for 4097–8191 features, SIGSEGV from 8192 (each case in a subprocess) | J-01
 | `repro_batchnorm.zig` | Same defect as an index-out-of-bounds panic in ReleaseSafe | J-01
-| `layout_probe.py` | Pooling wrappers' column-major buffers vs row-major kernels → wrong values; `−Inf`/NaN window contracts | J-02, J-07
-| `activation_probe.py` | `axiom_tanh` NaN for x ≥ 44.5 / +Inf; near-zero cancellation; gelu/sigmoid fine | J-03
+| `layout_probe.jl` | Pooling wrappers' column-major buffers vs row-major kernels → wrong values; `−Inf`/NaN window contracts | J-02, J-07
+| `activation_probe.jl` | `axiom_tanh` NaN for x ≥ 44.5 / +Inf; near-zero cancellation; gelu/sigmoid fine | J-03
 | `repro_underflow.zig` | `parallel_layernorm` batch=5 integer-overflow panic (ReleaseSafe) | J-04
 | `repro_underflow_canary.zig` | Same function: `-OReleaseSafe` panics, `-OReleaseFast` test binary crashes | J-04
-| `canary_probe.py` | Through the shipped `.so`, batch=5 is (accidentally) benign: rows correct, canary intact | J-04
-| `chunking_probe.py` | softmax/layernorm for batch 4…17 × 2048 through the `.so` | J-04
-| `matmul_cost.py` | `axiom_matmul_checked` vs `axiom_matmul` timing (9–16×) | J-05
+| `canary_probe.jl` | Through the shipped `.so`, batch=5 is (accidentally) benign: rows correct, canary intact | J-04
+| `chunking_probe.jl` | softmax/layernorm for batch 4…17 × 2048 through the `.so` | J-04
+| `matmul_cost.jl` | `axiom_matmul_checked` vs `axiom_matmul` timing (9–16×) | J-05
 |===
 
 Zig-level reproductions: