hyperpolymath · hyperpolymath · Aug 5, 2026
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -1,9 +1,4 @@
-# Code Owners
-
-# Default: All contributors with write access are code owners
-* @metadatastician
-
-# For specific paths, add explicit owners below
-# Example:
-# /src/* @team-lead
-# /docs/* @docs-maintainer
+# SPDX-License-Identifier: MPL-2.0
+# Solo-maintained hyperpolymath repo: no owner lines by policy.
+# See hyperpolymath/standards CODEOWNERS-POLICY.adoc (Rule 1).
+# Sole-maintainer review is moot; SPDX headers carry attribution.
diff --git a/0-AI-MANIFEST.a2ml b/0-AI-MANIFEST.a2ml
@@ -35,3 +35,20 @@ Project metadata and AI agent configuration files live under `.machine_readable/
 4. Follow methodology gates from `agent_instructions/methodology.a2ml`
 5. Update `STATE.a2ml` after completing work
 6. Sync to database: `~/sync-language-tracker.sh`
+
+<!-- BEGIN requires-initialisation -->
+
+## PRIORITY ACTION — this repository is not fully initialised
+
+9 substitution token(s) still have no value. **Read
+`REQUIRES_INITIALISATION.md` in the repository root before doing anything
+else here** — it lists every outstanding token, what it means, and which
+files it belongs in.
+
+Do not fabricate values for them, and do not delete the sections that
+contain them to quiet a gate. They are unfilled because they need a
+decision, not because they were overlooked. Resolve what you legitimately
+can, leave the rest, and delete `REQUIRES_INITIALISATION.md` only when
+nothing outstanding remains.
+
+<!-- END requires-initialisation -->
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
diff --git a/REQUIRES_INITIALISATION.md b/REQUIRES_INITIALISATION.md
@@ -0,0 +1,120 @@
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+
+# REQUIRES INITIALISATION
+
+**This repository is not finished being set up.** 9 substitution token(s) across 6 file(s) still have no value.
+
+## Why this is not already done
+
+This repo was created from `hyperpolymath/rsr-template-repo`. The mint
+(`just repo-init`) fills every token that has a single mechanical answer —
+owner, repo, author, dates, licence, branch — and it has done so here.
+
+The tokens below are the ones it *deliberately cannot* answer. They need a
+decision or a fact that exists only in your head: what this project is for,
+what command builds it, which port the service listens on, whether a PGP key
+is held at all. The template's own token vocabulary says as much — you cannot
+sensibly answer "required invariants" in a thirty-second bootstrap.
+
+They were left **visibly unfilled on purpose**. The alternatives were both
+worse: inventing plausible values would put confident falsehoods into a
+security policy and an architecture document, and silently deleting the
+sections would hide the fact that a decision is owed. A visible gap is
+honest; a fabricated answer is not.
+
+## Do not delete this file until every item below is resolved
+
+This file is the only marker that the work is outstanding. Deleting it early
+does not finish the setup, it just conceals it — and the next person or agent
+to arrive will reasonably assume the repo is complete.
+
+- **If you are a person:** delete this file yourself once the last item is done.
+- **If you are an agent:** resolve what you legitimately can, leave the rest,
+  and delete this file only when no token below remains anywhere in the tree.
+  Do not delete it to make a gate go green.
+
+Re-running the estate top-up tool will remove this file automatically once
+nothing is outstanding, so the safest way to finish is to fix the tokens and
+let the check confirm it.
+
+## What is needed, and where it goes
+
+### `{{AUTHOR_ORG}}`
+
+Author's organisation. NOTE: no filled instance of this exists anywhere in the estate — consider deleting the field instead.
+
+Appears in:
+
+- `.machine_readable/svc/k9/examples/project-metadata.k9.ncl`
+
+### `{{FILE}}`
+
+Appears in:
+
+- `.build/justfile`
+- `justfile`
+
+### `{{LICENSE}}`
+
+SPDX identifier for this repo's licence.
+
+Appears in:
+
+- `docs/reference/ABI-FFI.md`
+
+### `{{OUT}}`
+
+Appears in:
+
+- `justfile`
+
+### `{{PGP_FINGERPRINT}}`
+
+Full fingerprint of the security-contact PGP key. NOTE: no key is published anywhere in this estate — if none is held, delete the PGP block rather than inventing one.
+
+Appears in:
+
+- `SECURITY.md`
+- `docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc`
+
+### `{{PGP_KEY_URL}}`
+
+Public URL the PGP key can be fetched from. Same caveat as PGP_FINGERPRINT.
+
+Appears in:
+
+- `SECURITY.md`
+- `docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc`
+
+### `{{SECURITY_EMAIL}}`
+
+Address for private vulnerability reports. Two competing values exist in the estate (`6759885+hyperpolymath@users.noreply.github.com` and `security@hyperpolymath.org`) — pick one deliberately.
+
+Appears in:
+
+- `SECURITY.md`
+- `docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc`
+
+### `{{VERSION}}`
+
+Version/tag for the container image.
+
+Appears in:
+
+- `.build/justfile`
+- `justfile`
+
+### `{{WEBSITE}}`
+
+Project homepage URL, or delete the field if there is none.
+
+Appears in:
+
+- `SECURITY.md`
+- `docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc`
+
+---
+
+Generated by the estate top-up pass. Rationale and the governing rulings are
+in `hyperpolymath/standards`; the token vocabulary is
+`.machine_readable/ai/PLACEHOLDERS.adoc` in `rsr-template-repo`.
diff --git a/SECURITY.md b/SECURITY.md
@@ -5,14 +5,14 @@
 TEMPLATE INSTRUCTIONS (delete this block before publishing)
 ============================================================================
 Replace all {{PLACEHOLDER}} values with your information:
-  {{PROJECT_NAME}}     - Your project name
-  {{OWNER}}            - GitHub username or org (e.g., hyperpolymath)
-  {{REPO}}             - Repository name
+  AffineScript     - Your project name
+  hyperpolymath            - GitHub username or org (e.g., hyperpolymath)
+  affinescript             - Repository name
   {{SECURITY_EMAIL}}   - Security contact email
   {{PGP_FINGERPRINT}}  - Your PGP key fingerprint (40 chars, no spaces)
   {{PGP_KEY_URL}}      - URL to your public PGP key
   {{WEBSITE}}          - Your website/domain
-  {{CURRENT_YEAR}}     - Current year for copyright
+  2026     - Current year for copyright
 
 Optional: Remove sections that don't apply (e.g., PGP if you don't use it)
 ============================================================================
@@ -40,7 +40,7 @@ We take security seriously. We appreciate your efforts to responsibly disclose v
 
 The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature:
 
-1. Navigate to [Report a Vulnerability](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new)
+1. Navigate to [Report a Vulnerability](https://github.com/hyperpolymath/affinescript/security/advisories/new)
 2. Click **"Report a vulnerability"**
 3. Complete the form with as much detail as possible
 4. Submit — we'll receive a private notification
@@ -203,7 +203,7 @@ If we cannot reach agreement on disclosure timing, we default to 90 days from yo
 
 The following are within scope for security research:
 
-- This repository (`{{OWNER}}/{{REPO}}`) and all its code
+- This repository (`hyperpolymath/affinescript`) and all its code
 - Official releases and packages published from this repository
 - Documentation that could lead to security issues
 - Build and deployment configurations in this repository
@@ -322,7 +322,7 @@ Recognition includes:
 To stay informed about security updates:
 
 - **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts"
-- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories)
+- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/affinescript/security/advisories)
 - **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md)
 
 ### Update Policy
@@ -348,7 +348,7 @@ To stay informed about security updates:
 
 ## Security Best Practices
 
-When using {{PROJECT_NAME}}, we recommend:
+When using AffineScript, we recommend:
 
 ### General
 
@@ -371,7 +371,7 @@ When using {{PROJECT_NAME}}, we recommend:
 ## Additional Resources
 
 - [Our PGP Public Key]({{PGP_KEY_URL}})
-- [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories)
+- [Security Advisories](https://github.com/hyperpolymath/affinescript/security/advisories)
 - [Changelog](CHANGELOG.md)
 - [Contributing Guidelines](CONTRIBUTING.md)
 - [CVE Database](https://cve.mitre.org/)
@@ -383,8 +383,8 @@ When using {{PROJECT_NAME}}, we recommend:
 
 | Purpose | Contact |
 |---------|---------|
-| **Security issues** | [Report via GitHub](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) or {{SECURITY_EMAIL}} |
-| **General questions** | [GitHub Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) |
+| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/affinescript/security/advisories/new) or {{SECURITY_EMAIL}} |
+| **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/affinescript/discussions) |
 | **Other enquiries** | See [README](README.md) for contact information |
 
 ---
@@ -399,8 +399,8 @@ This security policy may be updated from time to time. Significant changes will
 
 ---
 
-*Thank you for helping keep {{PROJECT_NAME}} and its users safe.* 🛡️
+*Thank you for helping keep AffineScript and its users safe.* 🛡️
 
 ---
 
-<sub>Last updated: {{CURRENT_YEAR}} · Policy version: 1.0.0</sub>
+<sub>Last updated: 2026 · Policy version: 1.0.0</sub>
diff --git a/audits/assail-classifications.a2ml b/audits/assail-classifications.a2ml
@@ -67,7 +67,7 @@ schema_version = "1.0.0"
   ;
   ; The two flake.nix files below live in vendored subtrees with their
   ; own upstream repos. The affinescriptiser/flake.nix that panic-attack
-  ; ALSO flagged was an unfilled scaffold leftover (had {{PROJECT_NAME}}
+  ; ALSO flagged was an unfilled scaffold leftover (had AffineScript
   ; placeholders) — deleted in this PR rather than suppressed.
 
   (classification

diff --git a/docs/PROOF-NEEDS.adoc b/docs/PROOF-NEEDS.adoc
@@ -456,7 +456,7 @@ F-1 (full transformer preservation) is non-trivial rather than a formality.
 *Template ABI Cleanup (2026-03-29).* The template ABI was removed — it was
 creating a false impression of formal verification. The removed files
 (`Types.idr`, `Layout.idr`, `Foreign.idr`) contained only RSR template
-scaffolding with unresolved `{{PROJECT}}`/`{{AUTHOR}}` placeholders and no
+scaffolding with unresolved `AFFINESCRIPT`/`Jonathan D.A. Jewell` placeholders and no
 domain-specific proofs. When this project needs formal ABI verification, create
 domain-specific Idris2 proofs following the pattern in repos like `typed-wasm`,
 `proven`, `echidna`, or `boj-server`. (The same caution applies to the

diff --git a/docs/reference/ABI-FFI.md b/docs/reference/ABI-FFI.md
@@ -1,6 +1,6 @@
 {{~ Aditionally delete this line and fill out the template below ~}}
 
-# {{PROJECT}} ABI/FFI Documentation
+# AFFINESCRIPT ABI/FFI Documentation
 
 ## Overview
 
@@ -247,7 +247,7 @@ gcc -o example example.c -l{{project}} -L./zig-out/lib
 ### From Idris2
 
 ```idris
-import {{PROJECT}}.ABI.Foreign
+import AFFINESCRIPT.ABI.Foreign
 
 main : IO ()
 main = do

diff --git a/docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc b/docs/reports/TIDY-UP-LEDGER-2026-06-16.adoc
@@ -48,7 +48,7 @@ repointed `.md` → `.adoc`.
 
 | `docs/PROOF-NEEDS.md` | Owner-gated / parked (modified in working tree;
   never commit without owner SPDX + sign).
-| `docs/reference/ABI-FFI.md` | Uninstantiated RSR template (`{{PROJECT}}`
+| `docs/reference/ABI-FFI.md` | Uninstantiated RSR template (`AFFINESCRIPT`
   placeholders, "delete this line" instruction). Format-converting broken
   placeholder content forward would mask that it needs instantiation.
 | `docs/governance/LICENSING-GUIDE.md` | Licence-adjacent. Owner-only per
@@ -84,11 +84,11 @@ drift remains owner-only / manual.
 == Open owner-gated flags (not actioned)
 
 * `SECURITY.md` (both `docs/governance/SECURITY.md` and the repo-root copy)
-  is an *uninstantiated* RSR template — `{{OWNER}}`, `{{REPO}}`,
+  is an *uninstantiated* RSR template — `hyperpolymath`, `affinescript`,
   `{{SECURITY_EMAIL}}`, `{{PGP_FINGERPRINT}}`, `{{PGP_KEY_URL}}`,
-  `{{WEBSITE}}`, `{{CURRENT_YEAR}}` are still literal placeholders. Needs
+  `{{WEBSITE}}`, `2026` are still literal placeholders. Needs
   instantiation or an explicit "leave as template" decision.
-* `docs/reference/ABI-FFI.md` — `{{PROJECT}}` template; instantiate or
+* `docs/reference/ABI-FFI.md` — `AFFINESCRIPT` template; instantiate or
   remove.
 * `docs/governance/LICENSING-GUIDE.md` — awaiting owner manual format pass.
 * `SECURITY.md:388` links to `README.md` for contact info — that root

diff --git a/ffi/zig/build.zig b/ffi/zig/build.zig
@@ -1,4 +1,4 @@
-// {{PROJECT}} FFI Build Configuration
+// AFFINESCRIPT FFI Build Configuration
 // SPDX-License-Identifier: MPL-2.0
 
 const std = @import("std");

diff --git a/ffi/zig/src/main.zig b/ffi/zig/src/main.zig
@@ -1,4 +1,4 @@
-// {{PROJECT}} FFI Implementation
+// AFFINESCRIPT FFI Implementation
 //
 // This module implements the C-compatible FFI declared in src/abi/Foreign.idr
 // All types and layouts must match the Idris2 ABI definitions.
@@ -9,7 +9,7 @@ const std = @import("std");
 
 // Version information (keep in sync with project)
 const VERSION = "0.1.0";
-const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string;
+const BUILD_INFO = "AFFINESCRIPT built with Zig " ++ @import("builtin").zig_version_string;
 
 /// Thread-local error storage
 threadlocal var last_error: ?[]const u8 = null;

diff --git a/ffi/zig/test/integration_test.zig b/ffi/zig/test/integration_test.zig
@@ -1,4 +1,4 @@
-// {{PROJECT}} Integration Tests
+// AFFINESCRIPT Integration Tests
 // SPDX-License-Identifier: MPL-2.0
 //
 // These tests verify that the Zig FFI correctly implements the Idris2 ABI