First-run start point: identity, echidna.prove.result/1 consumer, template shape

.bot_directives/methodology.a2ml

@@ -102,7 +102,7 @@ constraints = [
 # These rules detect corrupt/template/stale state files.
 
 [methodology.state-validation]
-reject-if-contains = ["{{PLACEHOLDER}}", "Proof Burrower", "rsr-template-repo"]
+reject-if-contains = ["{{PLACEHOLDER}}", "{{PROJECT_NAME}}", "rsr-template-repo"]
 reject-if-project-name-mismatch = true
 staleness-threshold-days = 90
 fallback-files = ["TODO.md", "TODO.adoc", "ROADMAP.adoc", "README.adoc"]

.github/dependabot.yml

@@ -1,57 +1,45 @@
 # SPDX-License-Identifier: MPL-2.0
 # Dependabot configuration for RSR-compliant repositories
-# Covers common ecosystems - remove unused ones for your project
+# Only ecosystems present in this repository: github-actions, cargo.
 
-version: 2
-updates:
-  # GitHub Actions - always include
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      actions:
-        patterns:
-          - "*"
-
-  # Rust/Cargo
-  #
-  # `open-pull-requests-limit: 0` suppresses routine version-update PRs
-  # (no weekly patch-bump noise) while leaving Dependabot SECURITY PRs
-  # flowing. Under GitHub's current Dependabot behaviour (2024+), using
-  # an `ignore:` rule with `version-update:semver-patch` would ALSO
-  # silence security PRs that happen to be patch-level — historically
-  # the cause of estate-wide vulns sitting un-PR'd for weeks.
-  # `open-pull-requests-limit: 0` is the GitHub-endorsed way to say
-  # "security only, not routine bumps". Pair with the
-  # dependabot-automerge.yml workflow for low-touch security
-  # maintenance.
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 0
-
-  # Elixir/Mix
-  - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Node.js/npm
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Python/pip
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Nix flakes
-  - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
+{
+  version: 2,
+  updates: [
+    # GitHub Actions - always include
+    {
+      package-ecosystem: "github-actions",
+      directory: "/",
+      schedule: {
+        interval: "weekly",
+      },
+      groups: {
+        actions: {
+          patterns: [
+            "*",
+          ],
+        },
+      },
+      open-pull-requests-limit: 2,
+    },
+    # Rust/Cargo
+    #
+    # `open-pull-requests-limit: 0` suppresses routine version-update PRs
+    # (no weekly patch-bump noise) while leaving Dependabot SECURITY PRs
+    # flowing. Under GitHub's current Dependabot behaviour (2024+), using
+    # an `ignore:` rule with `version-update:semver-patch` would ALSO
+    # silence security PRs that happen to be patch-level — historically
+    # the cause of estate-wide vulns sitting un-PR'd for weeks.
+    # `open-pull-requests-limit: 0` is the GitHub-endorsed way to say
+    # "security only, not routine bumps". Pair with the
+    # dependabot-automerge.yml workflow for low-touch security
+    # maintenance.
+    {
+      package-ecosystem: "cargo",
+      directory: "/",
+      schedule: {
+        interval: "weekly",
+      },
+      open-pull-requests-limit: 0,
+    },
+  ],
+}

.github/settings.yml

@@ -45,111 +45,137 @@
 
 # ─── Repository Settings ───────────────────────────────────────────────────────
 
-repository:
-  has_issues: true
-  has_projects: true
-  has_wiki: false
-  has_downloads: true
-  default_branch: main
-  allow_squash_merge: true
-  allow_merge_commit: true
-  allow_rebase_merge: true
-  delete_branch_on_merge: true
-  enable_automated_security_fixes: true
-  enable_vulnerability_alerts: true
-
-# ─── Labels ────────────────────────────────────────────────────────────────────
-
-labels:
-  - name: "bug"
-    color: "d73a4a"
-    description: "Something isn't working"
-
-  - name: "enhancement"
-    color: "a2eeef"
-    description: "New feature or request"
-
-  - name: "documentation"
-    color: "0075ca"
-    description: "Improvements or additions to documentation"
-
-  - name: "security"
-    color: "e4e669"
-    description: "Security-related issue or vulnerability"
-
-  - name: "good first issue"
-    color: "7057ff"
-    description: "Good for newcomers"
-
-  - name: "help wanted"
-    color: "008672"
-    description: "Extra attention is needed"
-
-  - name: "question"
-    color: "d876e3"
-    description: "Further information is requested"
-
-  - name: "duplicate"
-    color: "cfd3d7"
-    description: "This issue or pull request already exists"
-
-  - name: "invalid"
-    color: "e4e669"
-    description: "This doesn't seem right"
-
-  - name: "wontfix"
-    color: "ffffff"
-    description: "This will not be worked on"
-
-  - name: "dependencies"
-    color: "0366d6"
-    description: "Pull requests that update a dependency file"
-
-  - name: "ci/cd"
-    color: "fbca04"
-    description: "Continuous integration and deployment"
-
-  - name: "rsr"
-    color: "006b75"
-    description: "Rhodium Standard Repository compliance"
-
-  - name: "hypatia"
-    color: "5319e7"
-    description: "Hypatia neurosymbolic scanner finding"
-
-  - name: "bot"
-    color: "b4a8d1"
-    description: "Automated action by gitbot-fleet"
-
-  - name: "breaking-change"
-    color: "b60205"
-    description: "Introduces a breaking change"
-
-  - name: "performance"
-    color: "f9d0c4"
-    description: "Performance improvement"
-
-  - name: "refactor"
-    color: "c5def5"
-    description: "Code refactoring with no functional change"
-
-# ─── Branch Protection ─────────────────────────────────────────────────────────
-
-branches:
-  - name: "main"
-    protection:
-      required_pull_request_reviews:
-        required_approving_review_count: 1
-        dismiss_stale_reviews: true
-        require_code_owner_reviews: true
-      required_status_checks:
-        strict: true
-        contexts:
-          - "hypatia-scan"
-          - "codeql"
-          - "openssf-compliance"
-      enforce_admins: true
-      required_signatures: true
-      restrictions: null
-      allow_force_pushes: false
-      allow_deletions: false
+{
+  repository: {
+    has_issues: true,
+    has_projects: true,
+    has_wiki: true,
+    has_downloads: true,
+    default_branch: "main",
+    allow_squash_merge: true,
+    allow_merge_commit: false,
+    allow_rebase_merge: false,
+    delete_branch_on_merge: true,
+    enable_automated_security_fixes: true,
+    enable_vulnerability_alerts: true,
+  },
+  # ─── Labels ────────────────────────────────────────────────────────────────────
+  labels: [
+    {
+      name: "bug",
+      color: "d73a4a",
+      description: "Something isn't working",
+    },
+    {
+      name: "enhancement",
+      color: "a2eeef",
+      description: "New feature or request",
+    },
+    {
+      name: "documentation",
+      color: "0075ca",
+      description: "Improvements or additions to documentation",
+    },
+    {
+      name: "security",
+      color: "e4e669",
+      description: "Security-related issue or vulnerability",
+    },
+    {
+      name: "good first issue",
+      color: "7057ff",
+      description: "Good for newcomers",
+    },
+    {
+      name: "help wanted",
+      color: "008672",
+      description: "Extra attention is needed",
+    },
+    {
+      name: "question",
+      color: "d876e3",
+      description: "Further information is requested",
+    },
+    {
+      name: "duplicate",
+      color: "cfd3d7",
+      description: "This issue or pull request already exists",
+    },
+    {
+      name: "invalid",
+      color: "e4e669",
+      description: "This doesn't seem right",
+    },
+    {
+      name: "wontfix",
+      color: "ffffff",
+      description: "This will not be worked on",
+    },
+    {
+      name: "dependencies",
+      color: "0366d6",
+      description: "Pull requests that update a dependency file",
+    },
+    {
+      name: "ci/cd",
+      color: "fbca04",
+      description: "Continuous integration and deployment",
+    },
+    {
+      name: "rsr",
+      color: "006b75",
+      description: "Rhodium Standard Repository compliance",
+    },
+    {
+      name: "hypatia",
+      color: "5319e7",
+      description: "Hypatia neurosymbolic scanner finding",
+    },
+    {
+      name: "bot",
+      color: "b4a8d1",
+      description: "Automated action by gitbot-fleet",
+    },
+    {
+      name: "breaking-change",
+      color: "b60205",
+      description: "Introduces a breaking change",
+    },
+    {
+      name: "performance",
+      color: "f9d0c4",
+      description: "Performance improvement",
+    },
+    {
+      name: "refactor",
+      color: "c5def5",
+      description: "Code refactoring with no functional change",
+    },
+  ],
+  # ─── Branch Protection ─────────────────────────────────────────────────────────
+  branches: [
+    {
+      name: "main",
+      protection: {
+        required_pull_request_reviews: {
+          required_approving_review_count: 1,
+          dismiss_stale_reviews: true,
+          require_code_owner_reviews: true,
+        },
+        required_status_checks: {
+          strict: true,
+          contexts: [
+            "hypatia-scan",
+            "codeql",
+            "openssf-compliance",
+          ],
+        },
+        enforce_admins: true,
+        required_signatures: true,
+        restrictions: null,
+        allow_force_pushes: false,
+        allow_deletions: false,
+      },
+    },
+  ],
+}

.github/workflows/actions.lock

@@ -59,7 +59,7 @@ workflows:
         - 'actions/upload-artifact@v4.6.2'
         - 'erlef/setup-beam@v1.20.4'
     '.github/workflows/wellknown-enforcement.yml':
-        - 'actions/checkout@v6.0.2'
+        - 'actions/checkout@v7.0.1'
     '.github/workflows/workflow-linter.yml':
         - 'actions/checkout@v6.0.2'
 dependencies: