feat(phase-2.2): extract the canon's law to 0-canon/rsr/ — and stop short of deleting

.github/workflows/canon-spine-lockstep.yml

@@ -26,10 +26,10 @@ on:
     paths:
       - 'canon.lock'
       - 'standards-map.toml'
-      - 'rhodium-standard-repositories/spec/rsr-criteria-v2.a2ml'
+      - '0-canon/rsr/rsr-criteria-v2.a2ml'
       - '.machine_readable/template-capability-gates.toml'
       - 'TEMPLATE-APPLICABILITY-POLICY.adoc'
-      - 'rhodium-standard-repositories/spec/SCAFFOLD-LIFECYCLE.adoc'
+      - '0-canon/rsr/SCAFFOLD-LIFECYCLE.adoc'
       - 'constitution/**'
       - 'scripts/check-canon-lockstep.sh'
       - 'scripts/check-standards-map.sh'
@@ -39,7 +39,7 @@ on:
     paths:
       - 'canon.lock'
       - 'standards-map.toml'
-      - 'rhodium-standard-repositories/spec/**'
+      - '0-canon/rsr/**'
       - '.machine_readable/**'
       - 'TEMPLATE-APPLICABILITY-POLICY.adoc'
       - 'constitution/**'

.hypatia-baseline.json

@@ -846,7 +846,7 @@
     "severity": "medium",
     "rule_module": "structural_drift",
     "type": "SD022",
-    "file": "rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc",
+    "file": "0-canon/rsr/LANGUAGE-POLICY.adoc",
     "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the src/api policy example as target-relative content or stale local documentation.",
     "expires_at": "2026-11-29",
     "tracking_issue": "hyperpolymath/standards#687"

.machine_readable/rsr-profile.a2ml

@@ -120,7 +120,7 @@ omitted-rationale = "The canon defines conformance; it is not an instance of it.
 
 // ── Things the canon carries that NO capability gates, and therefore must be
 //    named in the gate table's [canon] section rather than declared here ──────
-//   the criteria themselves (rhodium-standard-repositories/spec/rsr-criteria-v2.a2ml)
+//   the criteria themselves (0-canon/rsr/rsr-criteria-v2.a2ml)
 //   the gate table (.machine_readable/template-capability-gates.toml)
 //   the applicability policy (TEMPLATE-APPLICABILITY-POLICY.adoc)
 //   the reusable workflows (.github/workflows/*-reusable.yml)

.machine_readable/scorecards/rhodium-standard-repositories.scorecard.a2ml

@@ -12,10 +12,10 @@ assessor = "estate-audit"
 [[must]]
 id = "M1"
 text = "RSR MUST publish a versioned, normative spec (RSR-SPEC.adoc + TIERS.adoc)."
-system = "test -f rhodium-standard-repositories/spec/RSR-SPEC.adoc && test -f rhodium-standard-repositories/spec/TIERS.adoc"
+system = "test -f 0-canon/rsr/RSR-SPEC.adoc && test -f 0-canon/rsr/TIERS.adoc"
 status = "pass"
 evidence = "spec/RSR-SPEC.adoc + spec/TIERS.adoc present; RSR v1.0.0 FROZEN 2025-12-27."
-check = "test -f rhodium-standard-repositories/spec/RSR-SPEC.adoc && test -f rhodium-standard-repositories/spec/TIERS.adoc"
+check = "test -f 0-canon/rsr/RSR-SPEC.adoc && test -f 0-canon/rsr/TIERS.adoc"
 effects = "Every estate repo is graded against this; a missing spec voids all grades."
 
 [[must]]

.machine_readable/template-capability-gates.toml

@@ -104,9 +104,9 @@ paths = [".github/workflows/rust-ci.yml", ".github/workflows/release.yml", ".git
 # A minted repo declaring role = "canon" to evade a gate is still drift, which
 # is the behaviour that matters for the other ~441 repos.
 paths = [
-  "rhodium-standard-repositories/spec/rsr-criteria-v2.a2ml",  # the criteria SSOT
-  "rhodium-standard-repositories/spec/archive/",              # frozen prior majors
-  "rhodium-standard-repositories/spec/RSR-SPEC-v2.adoc",      # prose authority
+  "0-canon/rsr/rsr-criteria-v2.a2ml",  # the criteria SSOT
+  "0-canon/rsr/archive/",              # frozen prior majors
+  "0-canon/rsr/RSR-SPEC-v2.adoc",      # prose authority
   ".machine_readable/template-capability-gates.toml",         # this file
   "TEMPLATE-APPLICABILITY-POLICY.adoc",
   "constitution/",

canon.lock

@@ -71,12 +71,29 @@
 #     PASSES THEM.
 #
 # ---------------------------------------------------------------------------
+#
+# 2026-09-17 — PATH RELOCATION, NO VERSION BUMP.
+#
+# The whole artefact set moved out of the vendored
+# rhodium-standard-repositories/ copy into 0-canon/rsr/ (11 files, byte
+# identical — every sha256 below is UNCHANGED). This file's `path` values
+# therefore changed while its `sha256` values did not.
+#
+# The bump obligation above is triggered by a change to a FILE named in
+# [canon.artifacts]. No such file changed: the same bytes now live at a
+# different path. The canon's identity is its hash set, and that is identical,
+# so there is no new release identity for the spine to adopt. Bumping here
+# would force a spine re-adoption for a change that alters no law.
+# If you disagree, PATCH is the correct category (editorial; no criteria-set
+# change) - not MINOR, which is additive.
+#
+# ---------------------------------------------------------------------------
 
 [canon]
 # A released major is immutable. Bumping `version` to a new MAJOR means the
 # prior major's criteria file is copied to 0-canon/rsr/archive/ and pinned
 # there; a freeze guard fails any PR that mutates a frozen major.
-version      = "2.0.0"
+version      = "2.0.1"
 spec_family  = "rhodium-standard-repositories"
 status       = "draft"          # draft | stable
 released     = "2026-09-17"
@@ -85,7 +102,7 @@ authority    = "0-canon/constitution/ESTATE-CONSTITUTION.adoc"
 # The full git ref that realises this canon. A tag alone is not sufficient
 # (tags move); a commit alone is not sufficient (it has no version). Both.
 commit       = "0000000000000000000000000000000000000000"   # ← fill at release
-tag          = "canon-v2.0.0"
+tag          = "canon-v2.0.1"
 
 # ---------------------------------------------------------------------------
 # THE ARTEFACT SET — the files that ARE the canon.
@@ -97,19 +114,19 @@ tag          = "canon-v2.0.0"
 # ---------------------------------------------------------------------------
 
 [canon.artifacts]
-criteria = { path = "rhodium-standard-repositories/spec/rsr-criteria-v2.a2ml",                # from rhodium-standard-repositories/spec/
+criteria = { path = "0-canon/rsr/rsr-criteria-v2.a2ml",           # relocated from the vendored copy
              sha256 = "efd024ad9cbdf0d36d4dbce7e491531dd4ccccbfc747a04223ce4149f4b9a53d",
              slot = "criteria", normative = true }
 
 gates = { path = ".machine_readable/template-capability-gates.toml",  # from .machine_readable/
-          sha256 = "4c57d515bd3fa9d149cf54a8f4c8a44e2409cb24c3df72ec874656e4f5a98534",
+          sha256 = "8b1a77669c9ab78e9081669dbb2ab141d8af29700affc327f3dcde99f3dcd243",
           slot = "gates", normative = true }
 
 applicability = { path = "TEMPLATE-APPLICABILITY-POLICY.adoc",
                   sha256 = "7a31dc7e555b05c16a755c5ee599105572f023a2c72f85ec0fb0097436d627b5",
                   slot = "applicability", normative = true }
 
-lifecycle = { path = "rhodium-standard-repositories/spec/SCAFFOLD-LIFECYCLE.adoc",
+lifecycle = { path = "0-canon/rsr/SCAFFOLD-LIFECYCLE.adoc",
               sha256 = "0b25b3d8f2d4ce57fa2c1861b5c7e155383979c03bfcc55bc61c63a929721fdd",
               slot = "lifecycle", normative = true }
 
@@ -152,11 +169,11 @@ contractile-spec = { path = "contractiles/README.adoc",
                      target_repo = "hyperpolymath/contractiles",
                      note = "two-file vs four-file Trident is ruling 2 in STANDARDS-CRITICAL-PATH; the linter is estate task #19" }
 
-rsr-spec = { path = "rhodium-standard-repositories/spec/RSR-SPEC-v2.adoc",       # extracted from the vendored copy
+rsr-spec = { path = "0-canon/rsr/RSR-SPEC-v2.adoc",       # extracted from the vendored copy
              sha256 = "PENDING-FIRST-SYNC",
              slot = "rsr-spec-home", normative = true,
              target_repo = null,                            # stays in the canon
-             note = "the prose authority for rsr-criteria-v2.a2ml; extracted from rhodium-standard-repositories/spec/ before that directory is deleted (D1)" }
+             note = "the prose authority for rsr-criteria-v2.a2ml; relocated out of the vendored rhodium-standard-repositories/ copy, which is ARCHIVED rather than deleted - see AUDIT.adoc" }
 
 # ---------------------------------------------------------------------------
 # THE WORKFLOWS EVERY REPO CALLS.

component-readiness-grades/COMPONENT-READINESS-GRADES.a2ml

@@ -114,7 +114,7 @@
   (rule "Assessments MUST be reviewed at least once per release cycle.")
   (rule "Release stages MUST respect minimum grade thresholds.")
   (rule "Components graded D or above MUST satisfy RSR compliance (Bronze tier minimum) or a documented equivalent repository discipline.")
-  (rule "For TRG alignment: RSR-FULL refers to RSR Gold tier (100% compliance) as defined in rhodium-standard-repositories/spec/TIERS.adoc")
+  (rule "For TRG alignment: RSR-FULL refers to RSR Gold tier (100% compliance) as defined in 0-canon/rsr/TIERS.adoc")
   (rule "Components graded C or above MUST have deep code and folder annotation.")
   (rule "Non-abstract publication claims about implementation-facing work MUST NOT be made below grade B.")
   (rule "Release-candidate is a project-level integration state, not a distinct component-grade threshold.")

docs/AUDIT.adoc

@@ -11,7 +11,7 @@ This root document exists so humans and bots can see the hard audit posture of
 *this* repository without having to discover the standards for the standards.
 
 Canonical source documents live in
-`rhodium-standard-repositories/spec/` and `constitution/`. This file is the
+`0-canon/rsr/` and `constitution/`. This file is the
 repo-local audit gate summary for the canon itself, and it is one of the four
 `governance-tier` artefacts required by
 link:../.machine_readable/template-capability-gates.toml[`template-capability-gates.toml`]
@@ -105,9 +105,17 @@ open at the anchor in link:AFFIRMATION.adoc[AFFIRMATION.adoc].
 | *Blocking*
 
 | F4
-| `rhodium-standard-repositories/` is a vendored copy of a separate
-  repository: 1,138 files, 43% of this repository, with no submodule entry at
-  this root.
+| `rhodium-standard-repositories/` is a vendored copy whose **upstream no
+  longer exists**. Corrected 2026-09-17: this was recorded as a duplicate of a
+  separate repository. It is not one. `hyperpolymath/rhodium-standard-repositories`
+  returns 404, and *8 of its 10 satellites* — `rsr-certifier`, `rsr-deployer`,
+  `mustfile`, `robot-repo-automaton`, `META.scm`, `ECOSYSTEM.scm`, `state.scm`,
+  `well-known-ecosystem` — have no external home. This is the **last copy**.
+  The 2 that do exist (`cccp`, `palimpsest-license`) are stale snapshots, not
+  mirrors. 1,127 files remain, 43% of this repository. The `spec/` law (11
+  files) has been relocated to `0-canon/rsr/`; the remainder is to be
+  *archived, not deleted*. `actions-allowlist/` cannot be moved freely — its
+  path is a published interface consumed estate-wide.
 | High
 
 | F1
@@ -132,6 +140,15 @@ open at the anchor in link:AFFIRMATION.adoc[AFFIRMATION.adoc].
   lapse.
 | High
 
+| F8
+| The spine pins `gates_sha256` but **no gate verifies it**. Its `Canon lockstep`
+  job compares only `criteria_sha256`; the gates hash is recorded and never
+  checked. When this canon changed
+  `.machine_readable/template-capability-gates.toml` for 2.0.1, the spine's
+  pinned value went stale and nothing reported it. A pin nothing verifies is
+  not a binding. Either check it, or stop pinning it.
+| Medium
+
 | —
 | Root link scan: 7 of 72 distinct relative link targets in the root documents
   do not resolve, including `a2ml/` (evicted from this repository on
@@ -158,4 +175,4 @@ Before this repository may be tagged `canon-v*`:
 * link:../canon.lock[`canon.lock`] — the released identity and Gate A's assertions
 * link:../standards-map.toml[`standards-map.toml`] — the map of this repository
 * link:../constitution/ESTATE-CONSTITUTION.adoc[Estate Constitution]
-* link:../rhodium-standard-repositories/spec/rsr-criteria-v2.a2ml[`rsr-criteria-v2.a2ml`]
+* link:../0-canon/rsr/rsr-criteria-v2.a2ml[`rsr-criteria-v2.a2ml`]

launcher/launcher-standard.a2ml

@@ -10,7 +10,7 @@
 # $LAUNCH_SCAFFOLDER_STANDARD.
 #
 # See also:
-#   - standards/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc
+#   - standards/0-canon/rsr/LANGUAGE-POLICY.adoc
 #   - standards/docs/UX-standards/launcher-standard.adoc (prose version)
 #   - standards/docs/UX-standards/LM-LA-LIFECYCLE-STANDARD.adoc (install/uninstall)
 

scripts/check-package-policy.sh

@@ -9,7 +9,7 @@
 # an unconditional `✅ Package policy check passed` (standards#505). It could
 # not detect a violation, and it claimed a pass over any input.
 #
-# POLICY — canonical source is `rhodium-standard-repositories/spec/
+# POLICY — canonical source is `0-canon/rsr/
 # LANGUAGE-POLICY.adoc` §Package Management, NOT CLAUDE.md:
 #
 #   RULED 2026-05-18 (estate-wide): Guix primary + sealed-container escape;

standards-map.toml

@@ -32,7 +32,7 @@
 [map]
 repo        = "hyperpolymath/standards"
 version     = "1.0.0"
-entry_count = 118
+entry_count = 119
 generated   = false   # hand-curated; the district index.adoc files ARE generated
 checked_by  = "scripts/check-standards-map.sh"
 
@@ -69,17 +69,30 @@ question = "(root entries mandated by the spine's root-allow.txt)"
 
 
 [[entry]]
-from        = "rhodium-standard-repositories"
-target      = "0-canon/rsr/ (extract spec/ only)"
+from        = "0-canon"
+target      = "0-canon/ (canonical law; created by phase 2.2)"
 district    = "0-canon"
-kind        = "law-vendored"
-files       = 1138
+kind        = "law"
+files       = 11
+lifecycle   = "canonical"
+canonical   = true
+canon_slot  = "rsr-spec-home"
+canonical_doc = "0-canon/rsr/RSR-SPEC-v2.adoc"
+gate        = "canon-spine-lockstep"
+note        = "Created by extracting spec/ (11 files) out of the vendored rhodium-standard-repositories/ copy. Byte-identical: every sha256 in canon.lock [canon.artifacts] is unchanged, so the spine's pin still holds and no version bump was required. This is the canon's own law; it previously lived inside a vendored copy of another project."
+
+[[entry]]
+from        = "rhodium-standard-repositories"
+target      = "9-archive/rhodium-standard-repositories/ (ARCHIVE, do not delete)"
+district    = "9-archive"
+kind        = "archive-vendored"
+files       = 1127
 lifecycle   = "deprecated"
 canonical   = false
-canon_slot  = "rsr-spec-home"
-canonical_doc = "0-canon/rsr//index.adoc"
+canon_slot  = ""
+canonical_doc = ""
 gate        = "canon-spine-lockstep"
-note        = "VENDORED COPY of hyperpolymath/rhodium-standard-repositories, 1138 files = 43% of this repo. Extract spec/ (11 files) then DELETE. Carries its own .gitmodules naming satellites/rsr-template-repo."
+note        = "ARCHIVE, NOT A DELETABLE DUPLICATE. Earlier revisions of this map called it a vendored copy to extract and DELETE, on the assumption that the upstream repos still existed. They do not: hyperpolymath/rhodium-standard-repositories 404s, and 8 of its 10 satellites (rsr-certifier, rsr-deployer, mustfile, robot-repo-automaton, META.scm, ECOSYSTEM.scm, state.scm, well-known-ecosystem) have no external home - this is the LAST COPY. The 2 that do exist (cccp, palimpsest-license) are stale snapshots, not mirrors. Carries its own .gitmodules naming satellites/rsr-template-repo. NOT moved wholesale: actions-allowlist/ is a live published interface (raw.githubusercontent.com/.../rhodium-standard-repositories/actions-allowlist/allowed-actions.json) consumed estate-wide by allowlist-preflight-reusable.yml, so relocating it is a breaking change to consumers outside this repo."
 
 [[entry]]
 from        = "constitution"