diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 7f60a0ce..4714ad52 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,9 +1,4 @@ -# Code Owners - -# Default: All contributors with write access are code owners -* @metadatastician - -# For specific paths, add explicit owners below -# Example: -# /src/* @team-lead -# /docs/* @docs-maintainer +# SPDX-License-Identifier: MPL-2.0 +# Solo-maintained hyperpolymath repo: no owner lines by policy. +# See hyperpolymath/standards CODEOWNERS-POLICY.adoc (Rule 1). +# Sole-maintainer review is moot; SPDX headers carry attribution. diff --git a/0-AI-MANIFEST.a2ml b/0-AI-MANIFEST.a2ml index c361cad3..8040e26d 100644 --- a/0-AI-MANIFEST.a2ml +++ b/0-AI-MANIFEST.a2ml @@ -35,3 +35,20 @@ Project metadata and AI agent configuration files live under `.machine_readable/ 4. Follow methodology gates from `agent_instructions/methodology.a2ml` 5. Update `STATE.a2ml` after completing work 6. Sync to database: `~/sync-language-tracker.sh` + + + +## PRIORITY ACTION — this repository is not fully initialised + +9 substitution token(s) still have no value. **Read +`REQUIRES_INITIALISATION.md` in the repository root before doing anything +else here** — it lists every outstanding token, what it means, and which +files it belongs in. + +Do not fabricate values for them, and do not delete the sections that +contain them to quiet a gate. They are unfilled because they need a +decision, not because they were overlooked. Resolve what you legitimately +can, leave the rest, and delete `REQUIRES_INITIALISATION.md` only when +nothing outstanding remains. + + diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md deleted file mode 100644 index 607e3d8c..00000000 --- a/ARCHITECTURE.md +++ /dev/null @@ -1,47 +0,0 @@ -# Architecture - -## Overview - -This repository follows a modular, maintainable architecture designed for clarity, scalability, and long-term sustainability. - -## Directory Structure - -``` -. -├── src/ # Source code -├── tests/ # Test suites -├── docs/ # Documentation -├── scripts/ # Utility scripts -├── config/ # Configuration files -├── LICENSE # License file -├── LICENSES/ # Full license texts -└── README.adoc # Project documentation -``` - -## Design Principles - -- **Separation of Concerns**: Each module has a single responsibility -- **Testability**: Code is written to be easily testable -- **Documentation**: All public APIs are documented -- **Configuration**: Environment-specific settings are externalized - -## Dependencies - -- External dependencies are minimized and clearly declared -- Version pinning is used for reproducibility - -## Security Considerations - -- Sensitive data is never committed to the repository -- Secrets are managed through environment variables or secure vaults -- Regular dependency audits are performed - -## Maintainability - -- Code follows consistent style guidelines -- Pull requests require review and CI checks -- Issues and discussions are tracked transparently - ---- - -*Last updated: 2026-07-18* diff --git a/REQUIRES_INITIALISATION.md b/REQUIRES_INITIALISATION.md new file mode 100644 index 00000000..c857a77a --- /dev/null +++ b/REQUIRES_INITIALISATION.md @@ -0,0 +1,120 @@ + + +# REQUIRES INITIALISATION + +**This repository is not finished being set up.** 9 substitution token(s) across 6 file(s) still have no value. + +## Why this is not already done + +This repo was created from `hyperpolymath/rsr-template-repo`. The mint +(`just repo-init`) fills every token that has a single mechanical answer — +owner, repo, author, dates, licence, branch — and it has done so here. + +The tokens below are the ones it *deliberately cannot* answer. They need a +decision or a fact that exists only in your head: what this project is for, +what command builds it, which port the service listens on, whether a PGP key +is held at all. The template's own token vocabulary says as much — you cannot +sensibly answer "required invariants" in a thirty-second bootstrap. + +They were left **visibly unfilled on purpose**. The alternatives were both +worse: inventing plausible values would put confident falsehoods into a +security policy and an architecture document, and silently deleting the +sections would hide the fact that a decision is owed. A visible gap is +honest; a fabricated answer is not. + +## Do not delete this file until every item below is resolved + +This file is the only marker that the work is outstanding. Deleting it early +does not finish the setup, it just conceals it — and the next person or agent +to arrive will reasonably assume the repo is complete. + +- **If you are a person:** delete this file yourself once the last item is done. +- **If you are an agent:** resolve what you legitimately can, leave the rest, + and delete this file only when no token below remains anywhere in the tree. + Do not delete it to make a gate go green. + +Re-running the estate top-up tool will remove this file automatically once +nothing is outstanding, so the safest way to finish is to fix the tokens and +let the check confirm it. + +## What is needed, and where it goes + +### `{{AUTHOR_ORG}}` + +Author's organisation. NOTE: no filled instance of this exists anywhere in the estate — consider deleting the field instead. + +Appears in: + +- `.machine_readable/svc/k9/examples/project-metadata.k9.ncl` + +### `{{FILE}}` + +Appears in: + +- `.build/justfile` +- `justfile` + +### `{{LICENSE}}` + +SPDX identifier for this repo's licence. + +Appears in: + +- `docs/reference/ABI-FFI.md` + +### `{{OUT}}` + +Appears in: + +- `justfile` + +### `{{PGP_FINGERPRINT}}` + +Full fingerprint of the security-contact PGP key. NOTE: no key is published anywhere in this estate — if none is held, delete the PGP block rather than inventing one. + +Appears in: + +- `SECURITY.md` +- `docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc` + +### `{{PGP_KEY_URL}}` + +Public URL the PGP key can be fetched from. Same caveat as PGP_FINGERPRINT. + +Appears in: + +- `SECURITY.md` +- `docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc` + +### `{{SECURITY_EMAIL}}` + +Address for private vulnerability reports. Two competing values exist in the estate (`6759885+hyperpolymath@users.noreply.github.com` and `security@hyperpolymath.org`) — pick one deliberately. + +Appears in: + +- `SECURITY.md` +- `docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc` + +### `{{VERSION}}` + +Version/tag for the container image. + +Appears in: + +- `.build/justfile` +- `justfile` + +### `{{WEBSITE}}` + +Project homepage URL, or delete the field if there is none. + +Appears in: + +- `SECURITY.md` +- `docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc` + +--- + +Generated by the estate top-up pass. Rationale and the governing rulings are +in `hyperpolymath/standards`; the token vocabulary is +`.machine_readable/ai/PLACEHOLDERS.adoc` in `rsr-template-repo`. diff --git a/SECURITY.md b/SECURITY.md index 7dd7b29e..1d9842ae 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -5,14 +5,14 @@ TEMPLATE INSTRUCTIONS (delete this block before publishing) ============================================================================ Replace all {{PLACEHOLDER}} values with your information: - {{PROJECT_NAME}} - Your project name - {{OWNER}} - GitHub username or org (e.g., hyperpolymath) - {{REPO}} - Repository name + AffineScript - Your project name + hyperpolymath - GitHub username or org (e.g., hyperpolymath) + affinescript - Repository name {{SECURITY_EMAIL}} - Security contact email {{PGP_FINGERPRINT}} - Your PGP key fingerprint (40 chars, no spaces) {{PGP_KEY_URL}} - URL to your public PGP key {{WEBSITE}} - Your website/domain - {{CURRENT_YEAR}} - Current year for copyright + 2026 - Current year for copyright Optional: Remove sections that don't apply (e.g., PGP if you don't use it) ============================================================================ @@ -40,7 +40,7 @@ We take security seriously. We appreciate your efforts to responsibly disclose v The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature: -1. Navigate to [Report a Vulnerability](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) +1. Navigate to [Report a Vulnerability](https://github.com/hyperpolymath/affinescript/security/advisories/new) 2. Click **"Report a vulnerability"** 3. Complete the form with as much detail as possible 4. Submit — we'll receive a private notification @@ -203,7 +203,7 @@ If we cannot reach agreement on disclosure timing, we default to 90 days from yo The following are within scope for security research: -- This repository (`{{OWNER}}/{{REPO}}`) and all its code +- This repository (`hyperpolymath/affinescript`) and all its code - Official releases and packages published from this repository - Documentation that could lead to security issues - Build and deployment configurations in this repository @@ -322,7 +322,7 @@ Recognition includes: To stay informed about security updates: - **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts" -- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) +- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/affinescript/security/advisories) - **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md) ### Update Policy @@ -348,7 +348,7 @@ To stay informed about security updates: ## Security Best Practices -When using {{PROJECT_NAME}}, we recommend: +When using AffineScript, we recommend: ### General @@ -371,7 +371,7 @@ When using {{PROJECT_NAME}}, we recommend: ## Additional Resources - [Our PGP Public Key]({{PGP_KEY_URL}}) -- [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) +- [Security Advisories](https://github.com/hyperpolymath/affinescript/security/advisories) - [Changelog](CHANGELOG.md) - [Contributing Guidelines](CONTRIBUTING.md) - [CVE Database](https://cve.mitre.org/) @@ -383,8 +383,8 @@ When using {{PROJECT_NAME}}, we recommend: | Purpose | Contact | |---------|---------| -| **Security issues** | [Report via GitHub](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) or {{SECURITY_EMAIL}} | -| **General questions** | [GitHub Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) | +| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/affinescript/security/advisories/new) or {{SECURITY_EMAIL}} | +| **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/affinescript/discussions) | | **Other enquiries** | See [README](README.md) for contact information | --- @@ -399,8 +399,8 @@ This security policy may be updated from time to time. Significant changes will --- -*Thank you for helping keep {{PROJECT_NAME}} and its users safe.* 🛡️ +*Thank you for helping keep AffineScript and its users safe.* 🛡️ --- -Last updated: {{CURRENT_YEAR}} · Policy version: 1.0.0 +Last updated: 2026 · Policy version: 1.0.0 diff --git a/audits/assail-classifications.a2ml b/audits/assail-classifications.a2ml index d26f4438..fdd2bf6d 100644 --- a/audits/assail-classifications.a2ml +++ b/audits/assail-classifications.a2ml @@ -67,7 +67,7 @@ schema_version = "1.0.0" ; ; The two flake.nix files below live in vendored subtrees with their ; own upstream repos. The affinescriptiser/flake.nix that panic-attack - ; ALSO flagged was an unfilled scaffold leftover (had {{PROJECT_NAME}} + ; ALSO flagged was an unfilled scaffold leftover (had AffineScript ; placeholders) — deleted in this PR rather than suppressed. (classification diff --git a/docs/PROOF-NEEDS.adoc b/docs/PROOF-NEEDS.adoc index fc43a258..5c3e8b03 100644 --- a/docs/PROOF-NEEDS.adoc +++ b/docs/PROOF-NEEDS.adoc @@ -456,7 +456,7 @@ F-1 (full transformer preservation) is non-trivial rather than a formality. *Template ABI Cleanup (2026-03-29).* The template ABI was removed — it was creating a false impression of formal verification. The removed files (`Types.idr`, `Layout.idr`, `Foreign.idr`) contained only RSR template -scaffolding with unresolved `{{PROJECT}}`/`{{AUTHOR}}` placeholders and no +scaffolding with unresolved `AFFINESCRIPT`/`Jonathan D.A. Jewell` placeholders and no domain-specific proofs. When this project needs formal ABI verification, create domain-specific Idris2 proofs following the pattern in repos like `typed-wasm`, `proven`, `echidna`, or `boj-server`. (The same caution applies to the diff --git a/docs/reference/ABI-FFI.md b/docs/reference/ABI-FFI.md index 08d35da6..ec5fb116 100644 --- a/docs/reference/ABI-FFI.md +++ b/docs/reference/ABI-FFI.md @@ -1,6 +1,6 @@ {{~ Aditionally delete this line and fill out the template below ~}} -# {{PROJECT}} ABI/FFI Documentation +# AFFINESCRIPT ABI/FFI Documentation ## Overview @@ -247,7 +247,7 @@ gcc -o example example.c -l{{project}} -L./zig-out/lib ### From Idris2 ```idris -import {{PROJECT}}.ABI.Foreign +import AFFINESCRIPT.ABI.Foreign main : IO () main = do diff --git a/docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc b/docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc index ce535fba..b6f24438 100644 --- a/docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc +++ b/docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc @@ -48,7 +48,7 @@ repointed `.md` → `.adoc`. | `docs/PROOF-NEEDS.md` | Owner-gated / parked (modified in working tree; never commit without owner SPDX + sign). -| `docs/reference/ABI-FFI.md` | Uninstantiated RSR template (`{{PROJECT}}` +| `docs/reference/ABI-FFI.md` | Uninstantiated RSR template (`AFFINESCRIPT` placeholders, "delete this line" instruction). Format-converting broken placeholder content forward would mask that it needs instantiation. | `docs/governance/LICENSING-GUIDE.md` | Licence-adjacent. Owner-only per @@ -84,11 +84,11 @@ drift remains owner-only / manual. == Open owner-gated flags (not actioned) * `SECURITY.md` (both `docs/governance/SECURITY.md` and the repo-root copy) - is an *uninstantiated* RSR template — `{{OWNER}}`, `{{REPO}}`, + is an *uninstantiated* RSR template — `hyperpolymath`, `affinescript`, `{{SECURITY_EMAIL}}`, `{{PGP_FINGERPRINT}}`, `{{PGP_KEY_URL}}`, - `{{WEBSITE}}`, `{{CURRENT_YEAR}}` are still literal placeholders. Needs + `{{WEBSITE}}`, `2026` are still literal placeholders. Needs instantiation or an explicit "leave as template" decision. -* `docs/reference/ABI-FFI.md` — `{{PROJECT}}` template; instantiate or +* `docs/reference/ABI-FFI.md` — `AFFINESCRIPT` template; instantiate or remove. * `docs/governance/LICENSING-GUIDE.md` — awaiting owner manual format pass. * `SECURITY.md:388` links to `README.md` for contact info — that root diff --git a/ffi/zig/build.zig b/ffi/zig/build.zig index 4a2e049a..aedd5e8f 100644 --- a/ffi/zig/build.zig +++ b/ffi/zig/build.zig @@ -1,4 +1,4 @@ -// {{PROJECT}} FFI Build Configuration +// AFFINESCRIPT FFI Build Configuration // SPDX-License-Identifier: MPL-2.0 const std = @import("std"); diff --git a/ffi/zig/src/main.zig b/ffi/zig/src/main.zig index 6b233bc7..6d5c3af9 100644 --- a/ffi/zig/src/main.zig +++ b/ffi/zig/src/main.zig @@ -1,4 +1,4 @@ -// {{PROJECT}} FFI Implementation +// AFFINESCRIPT FFI Implementation // // This module implements the C-compatible FFI declared in src/abi/Foreign.idr // All types and layouts must match the Idris2 ABI definitions. @@ -9,7 +9,7 @@ const std = @import("std"); // Version information (keep in sync with project) const VERSION = "0.1.0"; -const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string; +const BUILD_INFO = "AFFINESCRIPT built with Zig " ++ @import("builtin").zig_version_string; /// Thread-local error storage threadlocal var last_error: ?[]const u8 = null; diff --git a/ffi/zig/test/integration_test.zig b/ffi/zig/test/integration_test.zig index 03419949..81693e01 100644 --- a/ffi/zig/test/integration_test.zig +++ b/ffi/zig/test/integration_test.zig @@ -1,4 +1,4 @@ -// {{PROJECT}} Integration Tests +// AFFINESCRIPT Integration Tests // SPDX-License-Identifier: MPL-2.0 // // These tests verify that the Zig FFI correctly implements the Idris2 ABI