Merge branch 'main' into fix/ci-426-batch15

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -30,9 +30,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          - language: actions
+            build-mode: none
+          - language: rust
             build-mode: none
-
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/dogfood-gate.yml

@@ -258,26 +258,26 @@ jobs:
 
           # Validate TOML structure using Python 3.11+ tomllib
           python3 -c "
-import tomllib, sys
-with open('eclexiaiser.toml', 'rb') as f:
-    data = tomllib.load(f)
-project = data.get('project', {})
-if not project.get('name', '').strip():
-    print('ERROR: project.name is required', file=sys.stderr)
-    sys.exit(1)
-functions = data.get('functions', [])
-if not functions:
-    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
-    sys.exit(1)
-for fn in functions:
-    if not fn.get('name', '').strip():
-        print('ERROR: function name cannot be empty', file=sys.stderr)
-        sys.exit(1)
-    if not fn.get('source', '').strip():
-        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)
-        sys.exit(1)
-print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')
-" || {
+          import tomllib, sys
+          with open('eclexiaiser.toml', 'rb') as f:
+              data = tomllib.load(f)
+          project = data.get('project', {})
+          if not project.get('name', '').strip():
+              print('ERROR: project.name is required', file=sys.stderr)
+              sys.exit(1)
+          functions = data.get('functions', [])
+          if not functions:
+              print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
+              sys.exit(1)
+          for fn in functions:
+              if not fn.get('name', '').strip():
+                  print('ERROR: function name cannot be empty', file=sys.stderr)
+                  sys.exit(1)
+              if not fn.get('source', '').strip():
+                  print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)
+                  sys.exit(1)
+          print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')
+          " || {
             echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"
             exit 1
           }

.github/workflows/scorecard.yml

@@ -5,8 +5,6 @@ on:
   branch_protection_rule:
   schedule:
     - cron: '23 4 * * 1'
-  push:
-    branches: [main]
 
 permissions: read-all
 

.github/workflows/secret-scanner.yml

@@ -17,7 +17,5 @@ jobs:
   scan:
     permissions:
       contents: read
-      pull-requests: write
-      actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit

0-AI-MANIFEST.a2ml

@@ -47,3 +47,20 @@ cloudguard dns list|add|delete|bulk-add
 cloudguard zones list|status
 cloudguard pages list
 ```
+
+<!-- BEGIN requires-initialisation -->
+
+## PRIORITY ACTION — this repository is not fully initialised
+
+22 substitution token(s) still have no value. **Read
+`REQUIRES_INITIALISATION.md` in the repository root before doing anything
+else here** — it lists every outstanding token, what it means, and which
+files it belongs in.
+
+Do not fabricate values for them, and do not delete the sections that
+contain them to quiet a gate. They are unfilled because they need a
+decision, not because they were overlooked. Resolve what you legitimately
+can, leave the rest, and delete `REQUIRES_INITIALISATION.md` only when
+nothing outstanding remains.
+
+<!-- END requires-initialisation -->

ARCHITECTURE.md

@@ -71,7 +71,7 @@ sed -i "s/2026-03-02/$(date +%Y-%m-%d)/g" $(grep -rl '2026-03-02' .)
 | `[PGP fingerprint not set]` | 40-char PGP fingerprint | `ABCD 1234 ...` | SECURITY.md |
 | `{{PGP_KEY_URL}}` | URL to public PGP key | `https://keys.openpgp.org/...` | SECURITY.md |
 | `{{WEBSITE}}` | Project website | `https://example.org` | SECURITY.md |
-| `{{CONDUCT_EMAIL}}` | Conduct reports email | `conduct@example.org` | CODE_OF_CONDUCT.md |
+| `j.d.a.jewell@open.ac.uk` | Conduct reports email | `conduct@example.org` | CODE_OF_CONDUCT.md |
 | `{{CONDUCT_TEAM}}` | Conduct committee name | `Code of Conduct Committee` | CODE_OF_CONDUCT.md |
 | `{{RESPONSE_TIME}}` | SLA for initial response | `48 hours` | CODE_OF_CONDUCT.md |
 

PLACEHOLDERS.md

@@ -0,0 +1,216 @@
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+
+# REQUIRES INITIALISATION
+
+**This repository is not finished being set up.** 22 substitution token(s) across 9 file(s) still have no value.
+
+## Why this is not already done
+
+This repo was created from `hyperpolymath/rsr-template-repo`. The mint
+(`just repo-init`) fills every token that has a single mechanical answer —
+owner, repo, author, dates, licence, branch — and it has done so here.
+
+The tokens below are the ones it *deliberately cannot* answer. They need a
+decision or a fact that exists only in your head: what this project is for,
+what command builds it, which port the service listens on, whether a PGP key
+is held at all. The template's own token vocabulary says as much — you cannot
+sensibly answer "required invariants" in a thirty-second bootstrap.
+
+They were left **visibly unfilled on purpose**. The alternatives were both
+worse: inventing plausible values would put confident falsehoods into a
+security policy and an architecture document, and silently deleting the
+sections would hide the fact that a decision is owed. A visible gap is
+honest; a fabricated answer is not.
+
+## Do not delete this file until every item below is resolved
+
+This file is the only marker that the work is outstanding. Deleting it early
+does not finish the setup, it just conceals it — and the next person or agent
+to arrive will reasonably assume the repo is complete.
+
+- **If you are a person:** delete this file yourself once the last item is done.
+- **If you are an agent:** resolve what you legitimately can, leave the rest,
+  and delete this file only when no token below remains anywhere in the tree.
+  Do not delete it to make a gate go green.
+
+Re-running the estate top-up tool will remove this file automatically once
+nothing is outstanding, so the safest way to finish is to fix the tokens and
+let the check confirm it.
+
+## What is needed, and where it goes
+
+### `{{AUTHOR_ORG}}`
+
+Author's organisation. NOTE: no filled instance of this exists anywhere in the estate — consider deleting the field instead.
+
+Appears in:
+
+- `.machine_readable/svc/k9/examples/project-metadata.k9.ncl`
+- `PLACEHOLDERS.md`
+
+### `{{CONDUCT_TEAM}}`
+
+Name of the conduct body. If there is no committee, rewrite the sentence rather than substituting a plural noun into 'a {{CONDUCT_TEAM}} member'.
+
+Appears in:
+
+- `PLACEHOLDERS.md`
+
+### `{{CONSUMER1}}`
+
+A downstream repo that consumes this one.
+
+Appears in:
+
+- `.machine_readable/INTENT.contractile`
+
+### `{{CONSUMER2}}`
+
+A second downstream consumer.
+
+Appears in:
+
+- `.machine_readable/INTENT.contractile`
+
+### `{{DEP1}}`
+
+First named dependency, in .machine_readable/INTENT.contractile.
+
+Appears in:
+
+- `.machine_readable/INTENT.contractile`
+
+### `{{DEP2}}`
+
+Second named dependency, in .machine_readable/INTENT.contractile.
+
+Appears in:
+
+- `.machine_readable/INTENT.contractile`
+
+### `{{DOMAIN}}`
+
+Appears in:
+
+- `.machine_readable/contractiles/trust/Trustfile.a2ml`
+
+### `{{DS_RECORD}}`
+
+Appears in:
+
+- `.machine_readable/contractiles/trust/Trustfile.a2ml`
+
+### `{{KEY_TAG}}`
+
+Appears in:
+
+- `.machine_readable/contractiles/trust/Trustfile.a2ml`
+
+### `{{LICENSE}}`
+
+SPDX identifier for this repo's licence.
+
+Appears in:
+
+- `container/Containerfile`
+- `container/manifest.toml`
+
+### `{{MONOREPO_OR_STANDALONE}}`
+
+Literally 'monorepo' or 'standalone'.
+
+Appears in:
+
+- `.machine_readable/INTENT.contractile`
+
+### `{{MTA_STS_ID}}`
+
+Appears in:
+
+- `.machine_readable/contractiles/trust/Trustfile.a2ml`
+
+### `{{ONE_PARAGRAPH_ANTI_PURPOSE}}`
+
+A paragraph on what this deliberately is NOT for.
+
+Appears in:
+
+- `.machine_readable/INTENT.contractile`
+
+### `{{ONE_PARAGRAPH_PURPOSE}}`
+
+A paragraph on what this is for.
+
+Appears in:
+
+- `.machine_readable/INTENT.contractile`
+
+### `{{PGP_KEY_URL}}`
+
+Public URL the PGP key can be fetched from. Same caveat as PGP_FINGERPRINT.
+
+Appears in:
+
+- `PLACEHOLDERS.md`
+
+### `{{PROJECT_DOMAIN}}`
+
+Taxonomy value for the subject domain.
+
+Appears in:
+
+- `.machine_readable/anchors/ANCHOR.a2ml`
+
+### `{{PROJECT_KIND}}`
+
+Taxonomy value (library, service, tool, lab…).
+
+Appears in:
+
+- `.machine_readable/anchors/ANCHOR.a2ml`
+
+### `{{PROJECT_PURPOSE}}`
+
+One line: what this exists to do.
+
+Appears in:
+
+- `.machine_readable/anchors/ANCHOR.a2ml`
+- `PLACEHOLDERS.md`
+- `guix.scm`
+
+### `{{PROJECT_UNIQUE_STRENGTH}}`
+
+What this does that its alternatives do not.
+
+Appears in:
+
+- `.machine_readable/agent_instructions/methodology.a2ml`
+
+### `{{RESPONSE_TIME}}`
+
+Initial-response SLA for a security or conduct report. Promise only what a solo maintainer can actually meet.
+
+Appears in:
+
+- `PLACEHOLDERS.md`
+
+### `{{SECURITY_TXT_EXPIRES}}`
+
+Appears in:
+
+- `.machine_readable/contractiles/trust/Trustfile.a2ml`
+
+### `{{WEBSITE}}`
+
+Project homepage URL, or delete the field if there is none.
+
+Appears in:
+
+- `PLACEHOLDERS.md`
+
+---
+
+Generated by the estate top-up pass. Rationale and the governing rulings are
+in `hyperpolymath/standards`; the token vocabulary is
+`.machine_readable/ai/PLACEHOLDERS.adoc` in `rsr-template-repo`.

REQUIRES_INITIALISATION.md

@@ -17,7 +17,7 @@ tracking.
 """
 license = "{{LICENSE}}"
 homepage = "https://github.com/hyperpolymath/cloudguard-cli"
-maintainer = "Jonathan D.A. Jewell <{{EMAIL}}>"
+maintainer = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
 
 [provenance]
 upstream = "https://github.com/hyperpolymath/cloudguard-cli"

container/manifest.toml

@@ -94,7 +94,7 @@ output = "stdout"
 # on = ["failure", "recovery", "resource_critical"]
 
 # [notifications.email]
-# to = "{{EMAIL}}"
+# to = "j.d.a.jewell@open.ac.uk"
 # from = "vordr@cloudguard-cli.local"
 # smtp = "smtp://localhost:25"
 # on = ["failure", "resource_critical"]