Chore/deed guix core tests

.cicd-hygiene-allow

@@ -0,0 +1,12 @@
+# Code-hygiene gate allowlist (consumed by cicd-suite actions/code-hygiene-check).
+# Patterns are git pathspec excludes, applied to both the debt-marker scan and
+# the proof-circumvention scan.
+#
+# The two entries below are TEMPLATE SCAFFOLDS, not implementation debt:
+# their TODOs are the instantiation seams every minted repo is meant to fill
+# in (entrypoint command, e2e sections). Excluding them keeps the gate's
+# debt-tracking signal clean for real source in instantiated repos, which
+# inherit this file. If an instantiated repo later owns genuine debt in
+# these paths, resolve or issue-link it there — do not widen this list.
+build/container/entrypoint.sh
+tests/e2e.sh

.clinerules

@@ -0,0 +1,43 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+# Authoritative source: docs/AI-CONVENTIONS.md
+
+# STARTUP: Read 0-AI-MANIFEST.deed first, then .machine_readable/6a2/STATE.deed.
+
+# LICENSE
+# All original code: MPL-2.0.
+# Never AGPL-3.0. MPL-2.0 only as platform-required fallback.
+# SPDX header required on every source file.
+# Copyright: Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+
+# STATE FILES (.machine_readable/ ONLY)
+# Never create in repo root: STATE.deed, META.deed, ECOSYSTEM.deed,
+# AGENTIC.deed, NEUROSYM.deed, PLAYBOOK.deed.
+# The .machine_readable/ directory is the single source of truth.
+
+# BANNED PATTERNS
+# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO
+# Haskell: unsafeCoerce, unsafePerformIO, undefined, error
+# OCaml: Obj.magic, Obj.repr, Obj.obj
+# Coq: Admitted
+# Lean: sorry
+# Rust: transmute (unless FFI with // SAFETY: comment)
+
+# BANNED LANGUAGES
+# TypeScript -> ReScript
+# Node.js / npm / bun -> Deno
+# Go -> Rust
+# Python -> Julia or Rust
+
+# CONTAINERS
+# Runtime: Podman (never Docker).
+# File: Containerfile (never Dockerfile).
+# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest.
+
+# ABI/FFI
+# ABI: Idris2 with dependent types (src/interface/abi/).
+# FFI: Zig with C ABI (src/interface/ffi/).
+# Headers: src/interface/generated/.
+
+# BUILD: Use just (justfile) for all tasks.
+# STYLE: Descriptive names. Document all files. SPDX headers everywhere.

.cursorrules

@@ -0,0 +1,47 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+# Authoritative source: docs/AI-CONVENTIONS.md
+
+# Read 0-AI-MANIFEST.deed in the repo root FIRST for canonical file locations.
+
+# LICENSE
+# All original code: MPL-2.0 (SPDX header required on every file).
+# Never use AGPL-3.0. Fallback to MPL-2.0 only when platform requires it.
+# Copyright: Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+
+# STATE FILES
+# .deed metadata files go in .machine_readable/ ONLY.
+# Never create STATE.deed, META.deed, ECOSYSTEM.deed, AGENTIC.deed,
+# NEUROSYM.deed, or PLAYBOOK.deed in the repository root.
+
+# BANNED PATTERNS
+# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO
+# Haskell: unsafeCoerce, unsafePerformIO, undefined, error
+# OCaml: Obj.magic, Obj.repr, Obj.obj
+# Coq: Admitted
+# Lean: sorry
+# Rust: transmute (unless FFI with // SAFETY: comment)
+
+# BANNED LANGUAGES
+# TypeScript -> use ReScript
+# Node.js / npm / bun -> use Deno
+# Go -> use Rust
+# Python -> use Julia or Rust
+
+# CONTAINERS
+# Runtime: Podman (never Docker)
+# File: Containerfile (never Dockerfile)
+# Base: cgr.dev/chainguard/wolfi-base:latest
+
+# ABI/FFI STANDARD
+# ABI definitions: Idris2 with dependent types (src/interface/abi/)
+# FFI implementation: Zig with C ABI (src/interface/ffi/)
+# Generated C headers: src/interface/generated/
+
+# BUILD SYSTEM
+# Use just (justfile) for all build, test, lint, and format tasks.
+
+# CODE STYLE
+# Use descriptive variable names.
+# Annotate and document all files.
+# Add SPDX-License-Identifier header to every source file.

.gitleaksignore

@@ -0,0 +1,4 @@
+874cfd89ae9e1567275202e829a187d5d2e465c3:build/templates/CHORA.deed.in:generic-api-key:21
+8f8cc39824c23b1badc8cc04862755fcb2c6f8d5:build/templates/CHORA.deed.in:generic-api-key:21
+874cfd89ae9e1567275202e829a187d5d2e465c3:build/templates/CLADE.a2ml.in:generic-api-key:21
+8f8cc39824c23b1badc8cc04862755fcb2c6f8d5:build/templates/CLADE.a2ml.in:generic-api-key:21

.gitmessage

@@ -0,0 +1,18 @@
+# <type>(<optional scope>): <subject> (Max 50 chars)
+# |<------------------------------------------------>|
+
+# Explain WHY this change is being made (Max 72 chars per line)
+# |<---------------------------------------------------------------------->|
+
+# Explain HOW this change was implemented (if not obvious)
+
+# [ ] Tests added/updated
+# [ ] Documentation updated
+# [ ] ABI/FFI boundaries verified (if applicable)
+
+# Issue tracking:
+# Resolves: #
+# See also: #
+# 
+# ---
+# Allowed Types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert

.machine_readable/6a2/ECOSYSTEM.deed

@@ -1,28 +1,16 @@
-# SPDX-License-Identifier: MPL-2.0
-# ECOSYSTEM.deed — Ecosystem position
-#
+;; SPDX-FileCopyrightText: © 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+;; SPDX-License-Identifier: MPL-2.0
+(repo-deed
+  :schema-version "1.0.0"
+  :canonical-name "panoply"
+  :repo-uuid #u5"hyperpolymath/panoply"
+  :beholding-chora #u5"estate/chora"
+  :ecosystem hyperpolymath
+  :type language-discipline
 
-[metadata]
-project = "panoply"
-ecosystem = "hyperpolymath"
+  (related
+    (project :name affinescript :relationship lessons-source)
+    (project :name standards :relationship standard-source))
 
-[position]
-type = "language-discipline"
-purpose = "An envelope-first language discipline extracted from the lessons of AffineScript: make every safety claim explicit, scoped, inspectable, and mechanically accountable via a checked Core, explicit evidence, and a safety-envelope manifest."
-
-[pipeline]
-position = "research"
-chain = "affinescript (broad surface) → panoply (envelope-first discipline)"
-notes = "Panoply narrows one lesson from AffineScript — that broad language surfaces need explicit trust envelopes — into a founding principle."
-coordination = "standards"
-
-[related-projects]
-projects = [
-  { name = "affinescript", relationship = "lessons-source", notes = "Broad experimental language exploring affine types, borrowing, effects, rows, traits, faces, and multiple backends. Panoply is a narrowing of one of its lessons, not a rejection of it; the two share no AST, typing, borrow-checker, or codegen." },
-  { name = "standards", relationship = "standard-source", notes = "Defines the RSR standard, contractile canon, and estate policies this repository follows." },
-]
-
-[boundaries]
-not-the-same-as = [
-  { name = "affinescript", why = "AffineScript is a broad surface language; Panoply is an envelope-first discipline. Distinct projects, distinct artefacts." },
-]
+  (not-the-same-as
+    (project :name affinescript :why "broad surface language vs envelope-first discipline")))

.machine_readable/6a2/META.deed

@@ -1,53 +1,14 @@
-# SPDX-License-Identifier: MPL-2.0
-# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
-#
-# META.deed — Project meta-level information
-# Architecture decisions, design rationale, governance.
-
-[metadata]
-version = "0.1.0"
-last-updated = "2026-04-11"
-
-[project-info]
-type = "monorepo"  # library | binary | monorepo | service | website
-languages = ["idris2", "zig"]   # ABI/FFI seam today; Core/checker languages TBD
-license = "MPL-2.0"
-author = "Jonathan D.A. Jewell (hyperpolymath)"
-
-[architecture-decisions]
-# ADR format: status = proposed | accepted | deprecated | superseded | rejected
-# - { id = "ADR-001", title = "Use Zig for FFI", status = "accepted", date = "2026-02-14" }
-
-[development-practices]
-build-tool = "just"
-container-runtime = "podman"
-ci-platform = "github-actions"
-package-manager = "guix"  # guix | nix | cargo | mix
-
-[maintenance-axes]
-scoping-first = true
-execution-order = "axis-1 > axis-2 > axis-3"
-axis-1 = "must > intend > like"
-axis-2 = "corrective > adaptive > perfective"
-axis-3 = "systems > compliance > effects"
-
-[scoping]
-sources = "README, roadmap, status docs, maintenance checklist, CI/security docs"
-marker-scan = "TODO/FIXME/XXX/HACK/STUB/PARTIAL"
-idris-unsound-scan = "believe_me/assert_total"
-
-[axis-2-maintenance-rules]
-corrective-first = true
-adaptive-second = true
-adaptive-focus = "scope-change reconciliation, stale-reference removal, obsolete-work culling"
-perfective-third = true
-perfective-source = "axis-1 honest state after corrective/adaptive updates"
-
-[axis-3-audit-rules]
-audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"
-compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"
-drift-risk-example = "single exception broadening into policy violation (e.g. ReScript->TypeScript spread)"
-effects-evidence = "benchmark execution/results and maintainer status dialogue/review"
-
-[design-rationale]
-# Key design decisions and their reasoning
+;; SPDX-FileCopyrightText: © 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+;; SPDX-License-Identifier: MPL-2.0
+(repo-deed
+  :schema-version "1.0.0"
+  :canonical-name "panoply"
+  :repo-uuid #u5"hyperpolymath/panoply"
+  :beholding-chora #u5"estate/chora"
+  :type library
+  :languages (idris2 zig)
+  :license "MPL-2.0"
+  :author "Jonathan D.A. Jewell (hyperpolymath)"
+  :build-tool just
+  :container-runtime podman
+  :package-manager guix)

.machine_readable/6a2/STATE.deed

@@ -1,53 +1,28 @@
-# SPDX-License-Identifier: MPL-2.0
-# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
-#
-# STATE.deed — Project state checkpoint
-#
-
-[metadata]
-project = "panoply"
-version = "0.1.0"
-last-updated = "2026-06-21"
-status = "active"  # active | paused | archived
-
-[project-context]
-name = "Panoply"
-purpose = "An envelope-first language discipline: every safety claim explicit, scoped, inspectable, and mechanically accountable. Defined by three artefacts — a checked Core, explicit evidence, and a safety-envelope manifest."
-completion-percentage = 5
-
-[position]
-phase = "design"           # design | implementation | testing | maintenance | archived
-maturity = "experimental"  # experimental | alpha | beta | production | lts
-
-[route-to-mvp]
-milestones = [
-  { name = "Charter: envelope-first design discipline (docs/architecture/DESIGN-DISCIPLINE.adoc + ADR-0002)", completion = 100 },
-  { name = "Core: the checked core language and its checker", completion = 0 },
-  { name = "Evidence: witness formats for claims (proof / check / runtime discipline)", completion = 0 },
-  { name = "Manifest: per-program, per-backend safety-envelope manifest schema", completion = 0 },
-  { name = "Projections: first surface projection + projection-equivalence witnesses", completion = 0 },
-  { name = "Backend contracts: first backend envelope and its contract", completion = 0 },
-]
-
-[blockers-and-issues]
-# No active blockers. The mechanisms named by the charter are not yet implemented;
-# this is expected at the design phase, not a blocker.
-
-[critical-next-actions]
-actions = [
-  "Specify the Core: abstract syntax, typing/checking judgements, and the projection target.",
-  "Specify the evidence model: what counts as a witness for each guarantee class.",
-  "Specify the manifest schema: how earned and un-earned guarantees are recorded per backend.",
-  "Define the first backend contract and what guarantees it can uphold.",
-]
-
-[maintenance-status]
-last-run-utc = "never"
-last-report = "docs/reports/maintenance/latest.json"
-last-result = "unknown"  # unknown | pass | warn | fail
-open-warnings = 0
-open-failures = 0
-
-[ecosystem]
-part-of = ["hyperpolymath"]
-related = ["affinescript"]
+;; SPDX-FileCopyrightText: © 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+;; SPDX-License-Identifier: MPL-2.0
+;;
+;; Project state as a repo-deed body fragment stored under 6a2 for
+;; existing Justfile readers. Canonical identity lives in
+;; ../../panoply_chora.deed. This file is a repo-deed so the ABNF
+;; applies; do not reintroduce TOML [section] form.
+(repo-deed
+  :schema-version "1.0.0"
+  :canonical-name "panoply"
+  :repo-uuid #u5"hyperpolymath/panoply"
+  :beholding-chora #u5"estate/chora"
+  :last-updated "2026-09-20"
+  :status active
+  :phase design
+  :maturity experimental
+  :completion-percentage 5
+
+  (purpose
+    "An envelope-first language discipline: every safety claim explicit, scoped, inspectable, and mechanically accountable.")
+
+  (milestones
+    (milestone :name charter :completion 100)
+    (milestone :name core :completion 20)
+    (milestone :name evidence :completion 20)
+    (milestone :name manifest :completion 0)
+    (milestone :name projections :completion 0)
+    (milestone :name backends :completion 0)))

.machine_readable/arrival-pack/0.1-AI-MANIFEST.deed

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+[metadata]
+version = "0.1.0"
+layer = ".machine_readable/arrival-pack"
+note = "Holding 0.1-AI-MANIFEST — gatekeeper prose, not DEED ABNF chora."

.machine_readable/arrival-pack/README.adoc

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= arrival-pack
+
+Holding directory required by `rsr-template-repo`.
+Not yet populated with panoply-specific content.
+
+TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).

.machine_readable/coaptation/0.1-AI-MANIFEST.deed

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+[metadata]
+version = "0.1.0"
+layer = ".machine_readable/coaptation"
+note = "Holding 0.1-AI-MANIFEST — gatekeeper prose, not DEED ABNF chora."

.machine_readable/coaptation/README.adoc

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= coaptation
+
+Holding directory required by `rsr-template-repo`.
+Not yet populated with panoply-specific content.
+
+TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).

.machine_readable/coaptation/core/0.1-AI-MANIFEST.deed

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+[metadata]
+version = "0.1.0"
+layer = ".machine_readable/coaptation/core"
+note = "Holding 0.1-AI-MANIFEST — gatekeeper prose, not DEED ABNF chora."

.machine_readable/coaptation/core/README.adoc

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= core
+
+Holding directory required by `rsr-template-repo`.
+Not yet populated with panoply-specific content.
+
+TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).

.machine_readable/coaptation/receipts/0.1-AI-MANIFEST.deed

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+[metadata]
+version = "0.1.0"
+layer = ".machine_readable/coaptation/receipts"
+note = "Holding 0.1-AI-MANIFEST — gatekeeper prose, not DEED ABNF chora."

.machine_readable/coaptation/receipts/README.adoc

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= receipts
+
+Holding directory required by `rsr-template-repo`.
+Not yet populated with panoply-specific content.
+
+TODO: see `docs/status/ROADMAP.adoc` (Phase 1 structural placeholders).

.machine_readable/contractiles/adjust/0.1-AI-MANIFEST.deed

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+[metadata]
+version = "0.1.0"
+layer = ".machine_readable/contractiles/adjust"
+note = "Holding 0.1-AI-MANIFEST — gatekeeper prose, not DEED ABNF chora."