Ban TypeScript and add a top-level contribution guide

.github/rulesets/Immutable-Tags.json

@@ -0,0 +1,19 @@
+{
+  "name": "Immutable-Tags",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~ALL"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {"type": "creation"},
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "update"},
+    {"type": "required_signatures"}
+  ]
+}

.github/rulesets/Optimus-Branch.json

@@ -0,0 +1,44 @@
+{
+  "name": "Optimus-Branch",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_signatures"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 2,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_review_thread_resolution": true,
+        "require_extra_approval_for_unattributed_changes": true,
+        "required_reviewers": [],
+        "allowed_merge_methods": []
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": []
+      }
+    }
+  ]
+}

.github/settings.yml

@@ -158,19 +158,3 @@ labels:
 # increased"), which is why every workflow here fails with zero steps while the
 # estate's public repos run normally. Repopulate this list — one context at a
 # time, each pinned to a job id, each verified green — once Actions can run.
-branches:
-  - name: "main"
-    protection:
-      required_pull_request_reviews:
-        required_approving_review_count: 1
-        dismiss_stale_reviews: true
-        require_code_owner_reviews: true
-      required_conversation_resolution: true
-      required_status_checks:
-        strict: true
-        contexts: ["estate-audit"]
-      enforce_admins: true
-      required_signatures: true
-      restrictions: null
-      allow_force_pushes: false
-      allow_deletions: false

.github/workflows/a2ml-validate.yml

@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: MPL-2.0
+name: "🟡 CHECK: A2ML Manifest Validation"
+
+on:
+  pull_request:
+    branches: ['**']
+  push:
+    branches: [main, master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  a2ml-validate:
+    name: Validate A2ML manifests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7.0.1
+
+      - name: Check for A2ML files
+        id: detect
+        run: |
+          COUNT=$(find . -name '*.a2ml' -not -path './.git/*' | wc -l)
+          echo "count=$COUNT" >> "$GITHUB_OUTPUT"
+          if [ "$COUNT" -eq 0 ]; then
+            echo "::warning::No .a2ml manifest files found. Every RSR repo should have 0-AI-MANIFEST.a2ml"
+          fi
+
+      - name: "🟡 CHECK: Validate A2ML manifests"
+        if: steps.detect.outputs.count > 0
+        uses: hyperpolymath/deed-ecosystem/validate-action@main
+        with:
+          path: '.'
+          strict: 'false'
+
+      - name: Write summary
+        run: |
+          A2ML_COUNT="${{ steps.detect.outputs.count }}"
+          if [ "$A2ML_COUNT" -eq 0 ]; then
+            cat <<'EOF' >> "$GITHUB_STEP_SUMMARY"
+          ## A2ML Validation
+
+          :warning: **No .a2ml files found.** Every RSR-compliant repo should have at least `0-AI-MANIFEST.a2ml`.
+
+          Create one with: `a2mliser init` or copy from [rsr-template-repo](https://github.com/hyperpolymath/rsr-template-repo).
+          EOF
+          else
+            echo "## A2ML Validation" >> "$GITHUB_STEP_SUMMARY"
+            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo "Scanned **${A2ML_COUNT}** .a2ml file(s). See step output for details." >> "$GITHUB_STEP_SUMMARY"
+          fi

.github/workflows/boj-build.yml → .github/workflows/build-notification.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.

.github/workflows/codeql.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
@@ -34,13 +35,15 @@ jobs:
             build-mode: none
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.8
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.8
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/dependabot-automerge.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
@@ -44,7 +45,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 permissions:
-  contents: write # needed to enable auto-merge
+  contents: read # needed to enable auto-merge
   pull-requests: write # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.
 jobs:

.github/workflows/container-build.yml → .github/workflows/docker-build.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.

.github/workflows/dogfood-gate.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.

.github/workflows/dogfood-summary.yml

@@ -0,0 +1,98 @@
+# SPDX-License-Identifier: MPL-2.0
+name: "ℹ️ ADVISORY: Dogfooding Compliance Scorecard"
+
+on:
+  pull_request:
+    branches: ['**']
+  push:
+    branches: [main, master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  dogfood-summary:
+    name: "Dogfooding compliance summary"
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: always()
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7.0.1
+
+      - name: Generate dogfooding scorecard
+        run: |
+          SCORE=0
+          MAX=6
+
+          # A2ML manifest present?
+          if find . -name '*.a2ml' -not -path './.git/*' | head -1 | grep -q .; then
+            SCORE=$((SCORE + 1))
+            A2ML_STATUS=":white_check_mark:"
+          else
+            A2ML_STATUS=":x:"
+          fi
+
+          # K9 contracts present?
+          if find . \( -name '*.k9' -o -name '*.k9.ncl' \) -not -path './.git/*' | head -1 | grep -q .; then
+            SCORE=$((SCORE + 1))
+            K9_STATUS=":white_check_mark:"
+          else
+            K9_STATUS=":x:"
+          fi
+
+          # .editorconfig present?
+          if [ -f ".editorconfig" ]; then
+            SCORE=$((SCORE + 1))
+            EC_STATUS=":white_check_mark:"
+          else
+            EC_STATUS=":x:"
+          fi
+
+          # Groove manifest or code?
+          if [ -f ".well-known/groove/manifest.json" ] || grep -rl 'well-known/groove' --include='*.rs' --include='*.ex' --include='*.zig' . 2>/dev/null | head -1 | grep -q .; then
+            SCORE=$((SCORE + 1))
+            GROOVE_STATUS=":white_check_mark:"
+          else
+            GROOVE_STATUS=":ballot_box_with_check:"
+          fi
+
+          # VeriSimDB integration?
+          if grep -rl 'verisimdb\|VeriSimDB' --include='*.toml' --include='*.yaml' --include='*.yml' --include='*.json' --include='*.rs' --include='*.ex' . 2>/dev/null | head -1 | grep -q .; then
+            SCORE=$((SCORE + 1))
+            VSDB_STATUS=":white_check_mark:"
+          else
+            VSDB_STATUS=":ballot_box_with_check:"
+          fi
+
+          # eclexiaiser energy tracking?
+          if [ -f "eclexiaiser.toml" ]; then
+            SCORE=$((SCORE + 1))
+            ECLEX_STATUS=":white_check_mark:"
+          else
+            ECLEX_STATUS=":ballot_box_with_check:"
+          fi
+
+          cat <<EOF >> "$GITHUB_STEP_SUMMARY"
+          ## Dogfooding Scorecard
+
+          **Score: ${SCORE}/${MAX}**
+
+          | Tool/Format | Status | Notes |
+          |-------------|--------|-------|
+          | A2ML manifest (0-AI-MANIFEST.a2ml) | ${A2ML_STATUS} | Required for all RSR repos |
+          | K9 contracts | ${K9_STATUS} | Required for repos with config files |
+          | .editorconfig | ${EC_STATUS} | Required for all repos |
+          | Groove endpoint | ${GROOVE_STATUS} | Required for service repos |
+          | VeriSimDB integration | ${VSDB_STATUS} | Required for stateful repos |
+          | eclexiaiser | ${ECLEX_STATUS} | Energy/carbon budgets for container services |
+
+          ---
+          *Generated by the Dogfooding Compliance workflow.*
+          *Dogfooding is guinea pig fooding — we test our tools on ourselves.*
+          EOF

.github/workflows/wellknown-enforcement.yml → .github/workflows/dot-wellknown-enforcement.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
@@ -76,10 +77,10 @@
           fi
       - name: Mixed content check
         run: |
           MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com' | head -5 || true)
           if [ -n "$MIXED" ]; then
             echo "::error::Mixed content (HTTP in HTML)"
             echo "$MIXED"
             exit 1
           fi
           echo "✅ No mixed content"

.github/workflows/eclexiaiser-validate.yml

@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: MPL-2.0
+name: "🟡 CHECK: Eclexiaiser Manifest Validation"
+
+on:
+  pull_request:
+    branches: ['**']
+  push:
+    branches: [main, master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  eclexiaiser-validate:
+    name: "🟡 CHECK: Validate eclexiaiser manifest"
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7.0.1
+
+      - name: Check and validate eclexiaiser manifest
+        id: eclex
+        run: |
+          if [ ! -f "eclexiaiser.toml" ]; then
+            # Check if repo has a Containerfile — if so, recommend eclexiaiser
+            if [ -f "Containerfile" ]; then
+              echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."
+            fi
+            echo "has_manifest=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "has_manifest=true" >> "$GITHUB_OUTPUT"
+
+          # Validate eclexiaiser.toml structure (bash + grep; NO Python per estate policy).
+          # Structural presence checks only — deep schema validation is eclexiaiser's own job.
+          err=0
+          grep -qE '^[[:space:]]*\[project\]'        eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::[project] section is required"; err=1; }
+          grep -qE '^[[:space:]]*name[[:space:]]*=[[:space:]]*"[^"]+"' eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::a non-empty name is required"; err=1; }
+          grep -qE '^[[:space:]]*\[\[(functions)\]\]'  eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::at least one [[functions]] entry is required"; err=1; }
+          if [ "$err" -ne 0 ]; then
+            exit 1
+          fi
+          fns=$(grep -cE '^[[:space:]]*\[\[(functions)\]\]' eclexiaiser.toml)
+          echo "Valid: eclexiaiser.toml structure present (${fns} function block(s))"
+
+      - name: "Write summary"
+        run: |
+          if [ "${{ steps.eclex.outputs.has_manifest }}" = "true" ]; then
+            echo "## Eclexiaiser Manifest" >> "$GITHUB_STEP_SUMMARY"
+            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo ":white_check_mark: **eclexiaiser.toml** present and valid." >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "## Eclexiaiser Manifest" >> "$GITHUB_STEP_SUMMARY"
+            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo ":ballot_box_with_check: No eclexiaiser.toml. Add one with \`eclexiaiser init\` for energy/carbon tracking." >> "$GITHUB_STEP_SUMMARY"
+          fi