arena-ai-coding-agent · Sep 27, 2026 · Sep 27, 2026
diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
@@ -1,70 +1,45 @@
-# CLAUDE.md - AI Assistant Instructions
-
-## Language Policy (Hyperpolymath Standard)
-
-### ALLOWED Languages & Tools
-
-| Language/Tool | Use Case | Notes |
-|---------------|----------|-------|
-| **AffineScript** | Primary application code | Affine-typed, compiles to typed-wasm or ESM |
-| **Bun** | JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns. |
-| **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
-| **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |
-| **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like |
-| **Gleam** | Backend services | Runs on BEAM or compiles to JS |
-| **Bash/POSIX Shell** | Scripts, automation | Keep minimal |
-| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Bun APIs |
-| **Nickel** | Configuration language | For complex configs |
-| **Guile Scheme** | State/meta files | .machine_readable/6a2/STATE.a2ml, .machine_readable/6a2/META.a2ml, .machine_readable/6a2/ECOSYSTEM.a2ml |
-| **Julia** | Batch scripts, data processing | Per RSR |
-| **OCaml** | AffineScript compiler | Language-specific |
-| **Ada** | Safety-critical systems | Where required |
-
-### BANNED - Do Not Use
-
-| Banned | Replacement |
-|--------|-------------|
-| TypeScript | AffineScript |
-| ReScript | AffineScript |
-| Deno | Bun |
-| Node.js | Bun |
-| npm | Bun |
-| pnpm/yarn | Bun |
-| Go | Rust |
-| Python | Julia/Rust/AffineScript |
-| Java/Kotlin | Rust/Tauri/Dioxus |
-| Swift | Tauri/Dioxus |
-| React Native | Tauri/Dioxus |
-| Flutter/Dart | Tauri/Dioxus |
-
-### Mobile Development
-
-**No exceptions for Kotlin/Swift** - use Rust-first approach:
-
-1. **Tauri 2.0+** - Web UI (AffineScript) + Rust backend, MIT/Apache-2.0
-2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0
-
-Both are FOSS with independent governance (no Big Tech).
-
-### Enforcement Rules
-
-1. **No new TypeScript files** - Convert existing TS to AffineScript
-2. **Use `package.json` + `bun.lock` for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
-3. **`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock`
-4. **No Go code** - Use Rust instead
-5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps
-6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
-
-### Package Management
-
-- **Primary**: Guix (guix.scm)
-- **Fallback**: Guix (flake.guix)
-- **JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
-
-### Security Requirements
-
-- No MD5/SHA1 for security (use SHA256+)
-- HTTPS only (no HTTP URLs)
-- No hardcoded secrets
-- SHA-pinned dependencies
-- SPDX license headers on all files
+# Docudactyl agent instructions
+
+Read `0-AI-MANIFEST.a2ml` and `.machine_readable/6a2/AGENTIC.a2ml` first.
+Repository-specific constraints take precedence over generic scaffolding.
+
+## Sources and scope
+
+The estate standards source is `hyperpolymath/standards`; the operational
+scaffold is `hyperpolymath/rsr-template-repo`. Do not confuse a draft,
+historical checklist, or generated status report with ratified policy.
+The 2026-09-26 review and source revisions are recorded in
+`docs/compliance/2026-09-26-repository-audit.adoc`.
+
+## Actual implementation languages
+
+- Chapel: HPC orchestration and distributed processing.
+- Zig: native FFI and parser integrations.
+- Idris2: ABI types and proofs.
+- OCaml: offline Scheme transformation; Ada: standalone TUI.
+- Julia: existing legacy code, not the HPC hot path.
+- Bash: minimal CI/build automation. Guile Scheme/A2ML: existing metadata.
+- Agda: deferred distributed-invariant formalisation, not an existing proof.
+
+Do not migrate these components into an unrelated preferred language.
+No new Python, Go, TypeScript, ReScript, Nix, or Deno code/configuration.
+If JavaScript tooling is needed, use plain JavaScript with Bun and a pinned
+manifest/lockfile; do not introduce AffineScript as an invented requirement.
+The current estate tooling order makes npm a last resort, not a blanket ban.
+Use Guix rather than Nix, and Podman/Containerfile rather than Docker.
+
+## Required behaviour
+
+1. Fix soundness/security holes before features or performance work.
+2. Run the actual tools. Missing prerequisites and skipped checks are not green.
+3. Never bypass a gate, invent evidence, or call a model of assumptions a proof
+   of this implementation. Read the audit before making production claims.
+4. Keep state under `.machine_readable/`; do not move canonical files blindly
+   when upstream directory layouts differ.
+5. Preserve existing licences. No automated relicensing, licence sweeps, or
+   changes to third-party notices. Escalate conflicting notices to the owner.
+6. Never commit secrets; pin remote dependencies and Actions; use HTTPS.
+7. Run the relevant checks in `CONTRIBUTING.adoc`, including regression tests
+   and `git diff --check`, and report exact scope and blockers.
+8. Use signed commits for estate submissions. Publishing and external service
+   operations require deliberate authorisation; local edits are not deployment.
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
@@ -1,121 +1,7 @@
-# Clone the repository
+# Contributing to Docudactyl
 
-git clone https://github.com/hyperpolymath/docudactyl.git
-cd docudactyl
+The repository-specific guide is [CONTRIBUTING.adoc](../CONTRIBUTING.adoc).
+It describes the actual Chapel/Zig/Idris2 toolchain, validation commands,
+change discipline, and optional service setup.
 
-# Using Guix (recommended for reproducibility)
-
-guix develop
-
-# Or using toolbox/distrobox
-
-toolbox create docudactyl-dev
-toolbox enter docudactyl-dev
-# Install dependencies manually
-
-# Verify setup
-
-just check   # or: cargo check / mix compile / etc.
-just test    # Run test suite
-
-### Repository Structure
-
-```text
-docudactyl/
-├── src/ # Source code (Perimeter 1-2)
-├── lib/ # Library code (Perimeter 1-2)
-├── extensions/ # Extensions (Perimeter 2)
-├── plugins/ # Plugins (Perimeter 2)
-├── tools/ # Tooling (Perimeter 2)
-├── docs/ # Documentation (Perimeter 3)
-│   ├── architecture/ # ADRs, specs (Perimeter 2)
-│   └── proposals/ # RFCs (Perimeter 3)
-├── examples/ # Examples (Perimeter 3)
-├── spec/ # Spec tests (Perimeter 3)
-├── tests/ # Test suite (Perimeter 2-3)
-├── .well-known/ # Protocol files (Perimeter 1-3)
-├── .github/ # GitHub config (Perimeter 1)
-│   ├── CONTRIBUTING.md # This file
-│   ├── ISSUE_TEMPLATE/
-│   └── workflows/
-├── CHANGELOG.md
-├── CODE_OF_CONDUCT.md
-├── GOVERNANCE.md
-├── LICENSE
-├── MAINTAINERS.md
-├── README.adoc
-├── SECURITY.md
-├── flake.guix # Guix flake (Perimeter 1)
-└── justfile # Task runner (Perimeter 1)
-```
-
-    ---
-
-## How to Contribute
-
-### Reporting Bugs
-
-    **Before reporting**:
-    1. Search existing issues
-    2. Check if it's already fixed in `main`
-    3. Determine which perimeter the bug affects
-
-    **When reporting**:
-
-    Use the [bug report template](.github/ISSUE_TEMPLATE/bug_report.md) and include:
-
-    - Clear, descriptive title
-    - Environment details (OS, versions, toolchain)
-    - Steps to reproduce
-    - Expected vs actual behaviour
-    - Logs, screenshots, or minimal reproduction
-
-### Suggesting Features
-
-    **Before suggesting**:
-    1. Check the [roadmap](ROADMAP.md) if available
-    2. Search existing issues and discussions
-    3. Consider which perimeter the feature belongs to
-
-    **When suggesting**:
-
-    Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) and include:
-
-    - Problem statement (what pain point does this solve?)
-    - Proposed solution
-    - Alternatives considered
-    - Which perimeter this affects
-
-### Your First Contribution
-
-    Look for issues labelled:
-
-    - [`good first issue`](https://github.com/hyperpolymath/docudactyl/labels/good%20first%20issue) — Simple Perimeter 3 tasks
-    - [`help wanted`](https://github.com/hyperpolymath/docudactyl/labels/help%20wanted) — Community help needed
-    - [`documentation`](https://github.com/hyperpolymath/docudactyl/labels/documentation) — Docs improvements
-    - [`perimeter-3`](https://github.com/hyperpolymath/docudactyl/labels/perimeter-3) — Community sandbox scope
-
-    ---
-
-## Development Workflow
-
-### Branch Naming
-
-docs/short-description # Documentation (P3) test/what-added # Test
-additions (P3) feat/short-description # New features (P2)
-fix/issue-number-description # Bug fixes (P2) refactor/what-changed #
-Code improvements (P2) security/what-fixed # Security fixes (P1-2)
-
-
-### Commit Messages
-
-    We follow [Conventional Commits](https://www.conventionalcommits.org/):
-
-type(scope): description
-
-Body: what changed and why.
-
-Footer: issue reference, e.g. Closes #123
-\[optional body\]
-
-\[optional footer\]
+For private vulnerability reporting, see [SECURITY.adoc](../SECURITY.adoc).
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
@@ -1,20 +1,30 @@
 # SPDX-License-Identifier: MPL-2.0
 name: BoJ Server Build Trigger
+# Opt-in: GitHub-hosted runners cannot resolve the old boj-server.local URL.
 on:
-  push:
-    branches: [main, master]
   workflow_dispatch:
+permissions:
+  contents: read
 jobs:
   trigger-boj:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Trigger BoJ Server (Casket/ssg-mcp)
+      - name: Trigger configured BoJ server
+        env:
+          BOJ_SERVER_URL: ${{ vars.BOJ_SERVER_URL }}
+          BOJ_TOKEN: ${{ secrets.BOJ_TOKEN }}
+          REPO: ${{ github.repository }}
+          BRANCH: ${{ github.ref_name }}
         run: |
-          # Send a secure trigger to boj-server to build this repository
-          curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
-        continue-on-error: true
-permissions:
-  actions: read
-  contents: read
+          set -euo pipefail
+          : "${BOJ_SERVER_URL:?Set BOJ_SERVER_URL to an HTTPS endpoint reachable by this runner}"
+          : "${BOJ_TOKEN:?Configure BOJ_TOKEN before dispatching}"
+          [[ "$BOJ_SERVER_URL" == https://* ]] || { echo 'HTTPS is required' >&2; exit 1; }
+          jq -n --arg repo "$REPO" --arg branch "$BRANCH" \
+            '{repo: $repo, branch: $branch, engine: "casket"}' > "$RUNNER_TEMP/boj-payload.json"
+          curl --fail-with-body --silent --show-error --proto '=https' \
+            --connect-timeout 10 --max-time 60 \
+            -H "Authorization: Bearer $BOJ_TOKEN" -H 'Content-Type: application/json' \
+            --data-binary "@$RUNNER_TEMP/boj-payload.json" \
+            "${BOJ_SERVER_URL%/}/cartridges/ssg-mcp/invoke"
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
@@ -27,6 +27,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
         with:
           repository: hyperpolymath/casket-ssg
+          ref: 45e72796456b91e0b800304ab0283cd4872c57c5
+          persist-credentials: false
           path: .casket-ssg
 
       - name: Setup GHCup