chore: R-16 toolchain pin + reconciliation

.github/CODEOWNERS

@@ -1,34 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# CODEOWNERS - Define code review assignments for GitHub
-# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-
-# Default: sole maintainer for all files
-* @hyperpolymath
-
-# Security-sensitive files require explicit ownership
-SECURITY.md @hyperpolymath
-.github/workflows/ @hyperpolymath
-.machine_readable/ @hyperpolymath
-contractiles/ @hyperpolymath
-
-# License files
-LICENSE @hyperpolymath
-LICENSES/ @hyperpolymath
-
-# Configuration
-.gitignore @hyperpolymath
-.github/ @hyperpolymath
-
-# Documentation
-README* @hyperpolymath
-CONTRIBUTING* @hyperpolymath
-CODE_OF_CONDUCT* @hyperpolymath
-GOVERNANCE* @hyperpolymath
-MAINTAINERS* @hyperpolymath
-CHANGELOG* @hyperpolymath
-ROADMAP* @hyperpolymath
-
-# Build and CI
-Justfile @hyperpolymath
-Makefile @hyperpolymath
-*.sh @hyperpolymath
+# Solo-maintained hyperpolymath repo: no owner lines by policy.
+# See hyperpolymath/standards CODEOWNERS-POLICY.adoc (Rule 1).
+# Sole-maintainer review is moot; SPDX headers carry attribution.

.github/dependabot.yml

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: MPL-2.0
+# Dependabot configuration for RSR-compliant repositories
+# Covers common ecosystems - remove unused ones for your project
+
+version: 2
+updates:
+  # GitHub Actions - always include
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns:
+          - "*"
+
+  # Rust/Cargo
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    # `open-pull-requests-limit: 0` suppresses routine version-update PRs
+    # while leaving Dependabot SECURITY PRs flowing. The previous
+    # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s
+    # current Dependabot behaviour. See rsr-template-repo commit 78b050e
+    # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
+    open-pull-requests-limit: 0
+
+  # Elixir/Mix
+  - package-ecosystem: "mix"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Node.js/npm
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Python/pip
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Nix flakes
+  - package-ecosystem: "nix"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+# SPDX-License-Identifier: MPL-2.0
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 0 * * 0'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@29b1f65c1f735799893313399435a59f54045865 # v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@29b1f65c1f735799893313399435a59f54045865 # v3

.github/workflows/push-email-notify.yml

@@ -8,6 +8,7 @@ name: Push email notification
 on:
   push: {}
 permissions:
+  actions: read
   contents: read
 jobs:
   notify:

.machine_readable/contractiles/Justfile

@@ -385,8 +385,8 @@ container-init:
     read -rp "Primary port [8080]: " _PORT
     PORT="${_PORT:-8080}"
 
-    read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY
-    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}"
+    read -rp "Container registry [ghcr.io/${OWNER:-hyperpolymath}]: " _REGISTRY
+    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-hyperpolymath}}"
 
     echo ""
     echo "  Service: $SERVICE_NAME"
@@ -601,7 +601,7 @@ test-matrix suite="unit" verbosity="normal" parallel="true":
     @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}"
 
 # Container matrix: [build|run|push|shell|scan] x [registry] x [tag]
-container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest":
+container-matrix action="build" registry="ghcr.io/hyperpolymath" tag="latest":
     @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}"
 
 # CI matrix: [lint|test|build|security|all] x [quick|full]

.mise.toml

@@ -0,0 +1,3 @@
+[tools]
+rust = "1.95.0"
+just = "1.36.0"

0-AI-MANIFEST.a2ml

@@ -14,3 +14,20 @@ status = "design / v0"
 
 [policy]
 docs = "AsciiDoc (.adoc) by default; .md only for GitHub community-health files."
+
+<!-- BEGIN requires-initialisation -->
+
+## PRIORITY ACTION — this repository is not fully initialised
+
+1 substitution token(s) still have no value. **Read
+`REQUIRES_INITIALISATION.md` in the repository root before doing anything
+else here** — it lists every outstanding token, what it means, and which
+files it belongs in.
+
+Do not fabricate values for them, and do not delete the sections that
+contain them to quiet a gate. They are unfilled because they need a
+decision, not because they were overlooked. Resolve what you legitimately
+can, leave the rest, and delete `REQUIRES_INITIALISATION.md` only when
+nothing outstanding remains.
+
+<!-- END requires-initialisation -->