ci: zero-cost quality/security/coverage/mirroring pipeline, Deno ratchet, RSR seed rewrites

.claude/CLAUDE.md

@@ -156,9 +156,9 @@ for the canonical statement.
 | TypeScript | AffineScript | RS/TS/JS → AffineScript → typed-wasm. |
 | ReScript | AffineScript | RS/TS/JS → AffineScript → typed-wasm. |
 | **ReScript** | AffineScript | Banned in new code as of 2026-04-30. Existing `.res` files migrate to `.affine` directly (do not pass through ReScript). |
-| **Deno** | Bun | **Being removed.** Owner ruling 2026-08-26: *"deno is to go and bun is the way we are going, put it first everywhere unless not possible and explain why if not."* Existing Deno projects must migrate to Bun; where Bun genuinely cannot be used, the reason must be documented in the repo. Assessment of all 30 remaining `deno.json` locations: #658. |
+| **Deno** | Bun | **Banned 2026-09-22.** Owner ruling: *"deno is over, we're prioritising bun, and using bunx."* `deno.json` task definitions must be ported to `package.json` scripts. Shrink-only ledger: `.machine_readable/deno-allow.txt`. |
 | Node.js | Bun | Bun is Node-compatible; run the code, drop the runtime. |
-| npm | Bun | npm is tier 4 — *permitted, never preferred*, not banned. `package-lock.json` must still not be tracked (standards#67). |
+| npm | Bun | npm is tier 3 — *permitted, never preferred*, not banned. `package-lock.json` must still not be tracked (standards#67). |
 | yarn | Bun | yarn is not in the tier list at all. |
 | Go | Rust/SPARK | |
 | **Python** | AffineScript/Rust/SPARK/Julia | Fully banned, no exceptions (SaltStack exception removed 2026-01-03) |

.githooks/pre-commit

@@ -53,10 +53,46 @@ run_validator() {
   return 0
 }
 
+# run_validator (above) is FAIL-OPEN by design: a missing validator script
+# warns and returns 0. That is tolerable for advisory checks and intolerable
+# for a secrets gate, where "the validator is absent" and "no secrets found"
+# produce exactly the same silence. This sibling fails CLOSED.
+run_validator_required() {
+  local label="$1" script="$2" scope="$3"
+  local target_files=""
+  [ "$scope" = "staged" ] && target_files=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || true)
+  [ -z "$target_files" ] && [ "$scope" = "staged" ] && return 0
+  if [ ! -f "$HOOK_DIR/$script" ]; then
+    echo -e "${RED}[pre-commit] ($label) REQUIRED validator '$script' is missing — refusing to pass a check that does not exist.${NC}" >&2
+    echo "  Restore it from https://github.com/hyperpolymath/standards/tree/main/.githooks" >&2
+    ERRORS=$((ERRORS + 1))
+    return 1
+  fi
+  if [ ! -x "$HOOK_DIR/$script" ]; then
+    # A hook committed 0644 passes every local run that invokes it via `bash`
+    # and dies in CI at exit 126. Catch the mode here, where it is cheap.
+    echo -e "${YELLOW}[pre-commit] ($label) '$script' is not executable (mode should be 100755); running via bash anyway.${NC}" >&2
+  fi
+  echo -e "${BLUE}[pre-commit]${NC} Running ${label}..."
+  if ! INPUT_PATH="$REPO_ROOT" INPUT_STAGED_FILES="$target_files" bash "$HOOK_DIR/$script"; then
+    ERRORS=$((ERRORS + 1))
+    return 1
+  fi
+  return 0
+}
+
 echo -e "${BLUE}========================================${NC}"
 echo -e "${BLUE}Hyperpolymath Pre-commit Checks${NC}"
 echo -e "${BLUE}========================================${NC}"
 
+# Secrets first: it is the cheapest check that prevents the most expensive
+# mistake, and a leaked credential is unrecoverable once pushed.
+run_validator_required "Staged secret scan (gitleaks)" "validate-gitleaks.sh" "staged"
+
+# Ecosystem-scoped lint + format. Read-only; confined to the ecosystems this
+# repo actually has staged.
+run_validator_required "Ecosystem lint + format" "validate-lint-format.sh" "staged"
+
 # Language Policy
 default_validator '\.(ts|tsx)$' "TypeScript files not allowed. Use AffineScript instead."
 default_validator '\.go$' "Go files not allowed. Use Rust instead."

.githooks/validate-gitleaks.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Hyperpolymath Estate — staged-secret scan (pre-commit)
+# Source: https://github.com/hyperpolymath/standards
+#
+# Scans ONLY what is staged, so it runs in the time a commit can afford.
+#
+# FAILS CLOSED. If gitleaks is not installed this exits non-zero and prints the
+# install line. It never returns 0 on "could not scan": "validator absent" and
+# "no secrets found" produce exactly the same silence, and a gate that reports
+# success having examined nothing is worse than no gate at all — it is a gate
+# somebody trusts.
+#
+# --redact is NOT optional. --verbose without it prints the discovered secret
+# to the terminal and into scrollback, CI logs and any `script`/tmux capture,
+# which turns a near-miss into a second disclosure.
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+REPO_ROOT="${INPUT_PATH:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+cd "$REPO_ROOT"
+
+# Print the denominator. A scan whose input size is never shown cannot be
+# told apart from a scan of nothing.
+STAGED_COUNT="$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -c . || true)"
+echo "[gitleaks] staged files in scope: ${STAGED_COUNT}"
+
+if [ "${STAGED_COUNT}" -eq 0 ]; then
+  echo -e "${YELLOW}[gitleaks] nothing staged; no scan performed (this is not a pass).${NC}"
+  exit 0
+fi
+
+if ! command -v gitleaks >/dev/null 2>&1; then
+  echo -e "${RED}[gitleaks] gitleaks is NOT installed — refusing to let a commit through unscanned.${NC}" >&2
+  echo "" >&2
+  echo "  Install one of:" >&2
+  echo "    brew install gitleaks" >&2
+  echo "    go install github.com/zricethezav/gitleaks/v8@latest" >&2
+  echo "    https://github.com/gitleaks/gitleaks/releases  (pinned binary, verify sha256)" >&2
+  echo "" >&2
+  echo "  Deliberate override for this one commit: git commit --no-verify" >&2
+  exit 1
+fi
+
+# Gitleaks moved staged scanning between major versions: 8.x exposes
+# `protect --staged`, and newer releases expose `git --staged` while hiding
+# `protect`. PROBE for the subcommand instead of assuming either one.
+#
+# ⚠ Do not hard-code `gitleaks git` here. MEASURED 2026-09-22 on the installed
+# binary, whose subcommands are exactly: completion, detect, help, protect,
+# version. `gitleaks git` exits 1 as an unknown command — and because the
+# failure branch below treats ANY non-zero exit as a finding, that reports
+# "SECRET DETECTED" and refuses every commit while having scanned NOTHING.
+# A gate that has scanned nothing must never be able to look like either a
+# pass or a finding.
+if gitleaks git --help >/dev/null 2>&1; then
+  GITLEAKS_STAGED=(gitleaks git --staged --verbose --redact)
+elif gitleaks protect --help >/dev/null 2>&1; then
+  GITLEAKS_STAGED=(gitleaks protect --staged --verbose --redact)
+else
+  echo -e "${RED}[gitleaks] installed gitleaks exposes neither 'git --staged' nor" >&2
+  echo -e "  'protect --staged'. Refusing to report a pass from a scan that cannot run.${NC}" >&2
+  exit 1
+fi
+
+if "${GITLEAKS_STAGED[@]}"; then
+  echo -e "${GREEN}[gitleaks] no secrets detected in ${STAGED_COUNT} staged file(s).${NC}"
+  exit 0
+fi
+
+echo "" >&2
+echo -e "${RED}[gitleaks] SECRET DETECTED in staged changes — commit refused.${NC}" >&2
+echo "  Values above are redacted; the rule id and location are not." >&2
+echo "" >&2
+echo "  If this is a real credential: rotate it FIRST, then unstage." >&2
+echo "  If it is a false positive: add a scoped allow rule to .gitleaks.toml," >&2
+echo "  or append the fingerprint to .gitleaksignore — never a blanket skip." >&2
+exit 1