reorg(2-protocols): move the estate's protocols under 2-protocols/

.claude/CLAUDE.md

@@ -256,7 +256,7 @@ Existing pre-2026-04-30 `.ts`/`.tsx` outside these carve-outs is grandfathered w
 | `**/deps/**` | vendored package-manager dep | Elixir Mix vendored-dep directory (also adopted by other tools). Exemplar: `tma-mark2/deps/phoenix_live_view/assets/js/phoenix_live_view/*.ts` ships Phoenix LiveView's authored TS. | Never — vendored upstream. |
 | `**/vscode/**` (covers `editors/vscode/`, `extensions/vscode/`, `clients/vscode/`) | editor-host extension | VSCode extension entry points target the `vscode` extension-host API. Five estate repos (`universal-language-server-plugin`, `reposystem`, `proof-burrower`, `phronesis`, `bofj-kitt`) have a single `vscode/extension.ts`. | **Capability SHIPPED, verified 2026-08-28** — `affinescript/stdlib/Vscode.affine` (58 `extern fn`), `VscodeLanguageClient.affine` (4), the JS host shim `packages/affine-vscode/mod.js`, and `affine-vscode-publish.yml`. The remaining blocker is migration effort, not capability. Track under campaign #239; retire this row when the five VSCode extensions are ported. |
 
-Retired 2026-08-31: the `avow-protocol/telegram-bot/**` carve-out (the bot was rewritten in AffineScript — zero `.ts` on main, so the "PERMANENT" rationale no longer described reality); the `affinescript-deno-test/**` + `affinescript-cli/**` bootstrap-shim row (the test harness self-hosted to 100% `.affine` via affinescript#735/#736, and the cli is JS-only — see the npm/JavaScript tables below for its surviving front-door carve-out); and the `**/tsconfig.json` pattern (dead entry — the rule matches `*.ts`, so a `.json` path could never reach the allowlist).
+Retired 2026-08-31: the `2-protocols/avow/telegram-bot/**` carve-out (the bot was rewritten in AffineScript — zero `.ts` on main, so the "PERMANENT" rationale no longer described reality); the `affinescript-deno-test/**` + `affinescript-cli/**` bootstrap-shim row (the test harness self-hosted to 100% `.affine` via affinescript#735/#736, and the cli is JS-only — see the npm/JavaScript tables below for its surviving front-door carve-out); and the `**/tsconfig.json` pattern (dead entry — the rule matches `*.ts`, so a `.json` path could never reach the allowlist).
 
 Adding to this list requires explicit user approval and an unblock condition (except the structural classes above, which are estate-wide policy). The detection rule and its `path_allow_prefixes` field are the single source of truth; this table mirrors that for human readability.
 

.github/workflows/echidna-verify.yml

@@ -5,7 +5,7 @@
 # Scope:
 #   - lol/proofs/theories/**/*.agda
 #   - a2ml/src/A2ML/Proofs.idr
-#   - avow-protocol/avow-lib/src/abi/*.idr
+#   - 2-protocols/avow/avow-lib/src/abi/*.idr
 #
 # Proof-corpus status (issue #748): all three corpora are EVICTED from this
 # repo and live in their own repos today. Each job therefore opens with a
@@ -26,7 +26,7 @@ on:
       - 'lol/proofs/**'
       - 'a2ml/src/**/*.idr'
       - 'a2ml/a2ml-core.ipkg'
-      - 'avow-protocol/avow-lib/src/abi/*.idr'
+      - '2-protocols/avow/avow-lib/src/abi/*.idr'
       - '.github/workflows/echidna-verify.yml'
   # NO path filter on pull_request, deliberately. `Idris2 - a2ml proofs` is a
   # REQUIRED context, and a workflow-level path filter means the whole workflow
@@ -76,7 +76,7 @@ jobs:
           base="${{ github.event.pull_request.base.sha }}"
           head="${{ github.event.pull_request.head.sha }}"
           changed=$(git diff --name-only "$base" "$head" 2>/dev/null || true)
-          if printf '%s\n' "$changed" | grep -qE '^(lol/proofs/|a2ml/src/.*\.idr$|a2ml/a2ml-core\.ipkg$|avow-protocol/avow-lib/src/abi/.*\.idr$|\.github/workflows/echidna-verify\.yml$)'; then
+          if printf '%s\n' "$changed" | grep -qE '^(lol/proofs/|a2ml/src/.*\.idr$|a2ml/a2ml-core\.ipkg$|2-protocols/avow/avow-lib/src/abi/.*\.idr$|\.github/workflows/echidna-verify\.yml$)'; then
             echo "proofs=true" >> "$GITHUB_OUTPUT"
           else
             echo "proofs=false" >> "$GITHUB_OUTPUT"
@@ -289,15 +289,15 @@ jobs:
           # The per-file `if [ -f ]` guard below was written to tolerate absent
           # proofs, but the `cd` ahead of it was NOT guarded, so a missing
           # directory killed the step before the guard could ever run. In this
-          # repo avow-protocol/ holds only BINDING.adoc - the proofs live in the
+          # repo 2-protocols/avow/ holds only BINDING.adoc - the proofs live in the
           # avow-protocol repository - so the cd always failed and this job was
           # permanently red. It only became visible once the workflow began
           # running on pull requests.
-          if [ ! -d avow-protocol/avow-lib ]; then
-            echo "::notice title=AVOW proofs::avow-protocol/avow-lib is not present here (this repo carries only the BINDING). Nothing to type-check."
+          if [ ! -d 2-protocols/avow/avow-lib ]; then
+            echo "::notice title=AVOW proofs::2-protocols/avow/avow-lib is not present here (this repo carries only the BINDING). Nothing to type-check."
             exit 0
           fi
-          cd avow-protocol/avow-lib
+          cd 2-protocols/avow/avow-lib
           for f in src/abi/Consent.idr src/abi/Unsubscribe.idr src/abi/Types.idr; do
             if [ -f "$f" ]; then
               echo "--- checking $f ---"

.github/workflows/secret-scanner-reusable.yml

@@ -15,7 +15,7 @@
 #
 # Critical security debt this PR addresses:
 #   The `shell-secrets` job (added to the canonical 2026-05-21 in
-#   response to the Cloudflare token leak via `avow-protocol/
+#   response to the Cloudflare token leak via `2-protocols/avow/
 #   deploy-repos.sh`, which both `trufflehog --only-verified` and
 #   default gitleaks missed) is currently present in 0 of 16 sampled
 #   estate repos. The post-incident guardrail intended to catch the
@@ -668,7 +668,7 @@ jobs:
 
   # Shell-specific: catch hardcoded credentials in shell scripts.
   # Added to canonical 2026-05-21 after default gitleaks missed a real
-  # Cloudflare API token leaked via avow-protocol/deploy-repos.sh.
+  # Cloudflare API token leaked via 2-protocols/avow/deploy-repos.sh.
   # As of this PR, 0 of 16 sampled estate repos carry this guardrail —
   # the reusable closes that gap.
   #

.gitignore

@@ -94,10 +94,10 @@ htmlcov/
 
 # Rust build artefacts (innervation tools)
 1-formats/sub-specs/inline-annotations/extractor/target/
-k9-coordination-protocol/tools/k9-init/target/
+2-protocols/k9-coordination/tools/k9-init/target/
 hooks/playbook-to-recipe/target/
 1-formats/sub-specs/inline-annotations/extractor/Cargo.lock
-k9-coordination-protocol/tools/k9-init/Cargo.lock
+2-protocols/k9-coordination/tools/k9-init/Cargo.lock
 hooks/playbook-to-recipe/Cargo.lock
 .verisimdb/ecosystem-ingest/target/
 .verisimdb/ecosystem-ingest/Cargo.lock

.gitleaksignore

@@ -4,6 +4,6 @@
 # from the current tree, and the exposed Cloudflare token was removed by
 # 080c3941f091bdc1b94fa32cf11362a77f8fe01a. Keep that token revoked: these
 # entries do not suppress the same rules in any new commit or location.
-55ad53331e530d44b2ada3fb2ca80a024625dbac:avow-protocol/avow-lib/examples/python/stamp_example.py:generic-api-key:237
-55ad53331e530d44b2ada3fb2ca80a024625dbac:avow-protocol/avow-lib/examples/python/stamp_example.py:generic-api-key:251
-55ad53331e530d44b2ada3fb2ca80a024625dbac:avow-protocol/deploy-repos.sh:cloudflare-api-key:5
+55ad53331e530d44b2ada3fb2ca80a024625dbac:2-protocols/avow/avow-lib/examples/python/stamp_example.py:generic-api-key:237
+55ad53331e530d44b2ada3fb2ca80a024625dbac:2-protocols/avow/avow-lib/examples/python/stamp_example.py:generic-api-key:251
+55ad53331e530d44b2ada3fb2ca80a024625dbac:2-protocols/avow/deploy-repos.sh:cloudflare-api-key:5