Merge branch 'main' into dependabot/github_actions/actions-bdb36a9ff1

Author: hyperpolymath

.claude/CLAUDE.md

@@ -2,12 +2,12 @@
 
 The following files in `.machine_readable/` contain structured project metadata:
 
-- `STATE.scm` - Current project state and progress
-- `META.scm` - Architecture decisions and development practices
-- `ECOSYSTEM.scm` - Position in the ecosystem and related projects
-- `AGENTIC.scm` - AI agent interaction patterns
-- `NEUROSYM.scm` - Neurosymbolic integration config
-- `PLAYBOOK.scm` - Operational runbook
+- `.machine_readable/6a2/STATE.a2ml` - Current project state and progress
+- `.machine_readable/6a2/META.a2ml` - Architecture decisions and development practices
+- `.machine_readable/6a2/ECOSYSTEM.a2ml` - Position in the ecosystem and related projects
+- `.machine_readable/6a2/AGENTIC.a2ml` - AI agent interaction patterns
+- `.machine_readable/6a2/NEUROSYM.a2ml` - Neurosymbolic integration config
+- `.machine_readable/6a2/PLAYBOOK.a2ml` - Operational runbook
 
 ---
 
@@ -28,7 +28,7 @@ The following files in `.machine_readable/` contain structured project metadata:
 | **Bash/POSIX Shell** | Scripts, automation | Keep minimal |
 | **JavaScript** | Only where ReScript cannot | MCP protocol glue, Deno APIs |
 | **Nickel** | Configuration language | For complex configs |
-| **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm |
+| **Guile Scheme** | State/meta files | .machine_readable/6a2/STATE.a2ml, .machine_readable/6a2/META.a2ml, .machine_readable/6a2/ECOSYSTEM.a2ml |
 | **Julia** | Batch scripts, data processing | Per RSR |
 | **OCaml** | AffineScript compiler | Language-specific |
 | **Ada** | Safety-critical systems | Where required |

.gitattributes

@@ -1,3 +1,4 @@
+# RSR-compliant .gitattributes
 # Palimpsest License — Git Attributes
 
 # Normalize line endings
@@ -21,3 +22,64 @@ legal/PALIMPSEST-MPL-1.0.txt text eol=lf
 
 # Prevent GitHub from interpreting Pages
 .nojekyll export-ignore
+
+
+# Source
+*.rs    text eol=lf diff=rust
+*.ex    text eol=lf diff=elixir
+*.exs   text eol=lf diff=elixir
+*.jl    text eol=lf
+*.res   text eol=lf
+*.resi  text eol=lf
+*.ada   text eol=lf diff=ada
+*.adb   text eol=lf diff=ada
+*.ads   text eol=lf diff=ada
+*.hs    text eol=lf
+*.chpl  text eol=lf
+*.scm   text eol=lf
+*.a2ml  text eol=lf linguist-language=TOML
+*.ncl   text eol=lf
+*.nix   text eol=lf
+*.zig   text eol=lf
+
+
+# Docs
+*.md    text eol=lf diff=markdown
+*.adoc  text eol=lf
+*.txt   text eol=lf
+
+
+# Data
+*.json  text eol=lf
+*.yaml  text eol=lf
+*.yml   text eol=lf
+*.toml  text eol=lf
+
+
+# Config
+.gitignore     text eol=lf
+.gitattributes text eol=lf
+.editorconfig  text eol=lf
+.tool-versions text eol=lf
+justfile       text eol=lf
+Makefile       text eol=lf
+Containerfile  text eol=lf
+
+
+# Scripts
+*.sh   text eol=lf
+
+
+# Binary
+*.png   binary
+*.jpg   binary
+*.gif   binary
+*.pdf   binary
+*.woff2 binary
+*.zip   binary
+*.gz    binary
+
+
+# Lock files
+Cargo.lock  text eol=lf -diff
+flake.lock  text eol=lf -diff

.github/workflows/maintenance.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
 
       - name: Install cargo-audit
         run: cargo install cargo-audit || true
@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
 
       - name: Build pmpl-audit
         run: |

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
 
       - name: Build tools
         run: |

.github/workflows/sign-release.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
 
       - name: Build pmpl-sign
         run: |

.gitignore

@@ -1,3 +1,4 @@
+# RSR-compliant .gitignore
 # Palimpsest License — Git Ignore
 
 # Build artefacts
@@ -29,3 +30,88 @@ tools/**/dist/
 # Temporary files
 tmp/
 .cache/
+
+
+# OS & Editor
+.DS_Store
+Thumbs.db
+*.swp
+*.swo
+*~
+.idea/
+.vscode/
+
+
+# Build
+/target/
+/_build/
+/build/
+/dist/
+/out/
+/zig-out/
+/zig-cache/
+
+
+# Cargo.lock  # Keep for binaries
+
+
+# Elixir
+/cover/
+/doc/
+*.ez
+erl_crash.dump
+
+
+# Julia
+*.jl.cov
+*.jl.mem
+/Manifest.toml
+
+
+# ReScript
+/lib/bs/
+/.bsb.lock
+
+
+# Python (SaltStack only)
+__pycache__/
+*.py[cod]
+.venv/
+
+
+# Ada/SPARK
+*.ali
+/obj/
+/bin/
+
+
+# Haskell
+/.stack-work/
+/dist-newstyle/
+
+
+# Chapel
+*.chpl.tmp.*
+
+
+# Secrets
+.env
+.env.*
+*.pem
+*.key
+secrets/
+
+
+# Test/Coverage
+/coverage/
+htmlcov/
+
+
+# Machine-readable locks
+.machine_readable/.locks/
+
+
+# Temp
+/tmp/
+*.tmp
+*.bak

0-AI-MANIFEST.a2ml

@@ -14,12 +14,12 @@ This is the AI manifest for **palimpsest-license**. It declares:
 ### Machine-Readable Metadata: `.machine_readable/` ONLY
 
 These 6 SCM files MUST exist in `.machine_readable/` directory ONLY:
-1. **STATE.scm** - Project state, progress, blockers
-2. **META.scm** - Architecture decisions, governance
-3. **ECOSYSTEM.scm** - Position in ecosystem, relationships
-4. **AGENTIC.scm** - AI agent interaction patterns
-5. **NEUROSYM.scm** - Neurosymbolic integration config
-6. **PLAYBOOK.scm** - Operational runbook
+1. **.machine_readable/6a2/STATE.a2ml** - Project state, progress, blockers
+2. **.machine_readable/6a2/META.a2ml** - Architecture decisions, governance
+3. **.machine_readable/6a2/ECOSYSTEM.a2ml** - Position in ecosystem, relationships
+4. **.machine_readable/6a2/AGENTIC.a2ml** - AI agent interaction patterns
+5. **.machine_readable/6a2/NEUROSYM.a2ml** - Neurosymbolic integration config
+6. **.machine_readable/6a2/PLAYBOOK.a2ml** - Operational runbook
 
 **CRITICAL:** If ANY of these files exist in the root directory, this is an ERROR.
 
@@ -40,7 +40,7 @@ Bot-specific instructions for:
 
 ## CORE INVARIANTS
 
-1. **No SCM duplication** - Root must NOT contain STATE.scm, META.scm, etc.
+1. **No SCM duplication** - Root must NOT contain .machine_readable/6a2/STATE.a2ml, .machine_readable/6a2/META.a2ml, etc.
 2. **Single source of truth** - `.machine_readable/` is authoritative
 3. **No stale metadata** - If root SCMs exist, they are OUT OF DATE
 4. **License consistency** - All code PMPL-1.0-or-later unless platform requires MPL-2.0
@@ -58,12 +58,12 @@ palimpsest-license/
 ├── README.md                   # Project overview
 ├── [your source files]         # Main code
 ├── .machine_readable/          # SCM files (6 files)
-│   ├── STATE.scm
-│   ├── META.scm
-│   ├── ECOSYSTEM.scm
-│   ├── AGENTIC.scm
-│   ├── NEUROSYM.scm
-│   └── PLAYBOOK.scm
+│   ├── .machine_readable/6a2/STATE.a2ml
+│   ├── .machine_readable/6a2/META.a2ml
+│   ├── .machine_readable/6a2/ECOSYSTEM.a2ml
+│   ├── .machine_readable/6a2/AGENTIC.a2ml
+│   ├── .machine_readable/6a2/NEUROSYM.a2ml
+│   └── .machine_readable/6a2/PLAYBOOK.a2ml
 └── .bot_directives/            # Bot instructions
 ```
 
@@ -73,8 +73,8 @@ palimpsest-license/
 ✅ Understand canonical locations (.machine_readable/, .bot_directives/)
 ✅ Know the invariants (no SCM duplication, etc.)
 ✅ Check for MCP enforcement (if applicable)
-✅ Read `.machine_readable/STATE.scm` for current status
-✅ Read `.machine_readable/AGENTIC.scm` for interaction patterns
+✅ Read `.machine_readable/6a2/STATE.a2ml` for current status
+✅ Read `.machine_readable/6a2/AGENTIC.a2ml` for interaction patterns
 
 ## LIFECYCLE HOOKS
 
@@ -86,15 +86,15 @@ When starting a new session:
 2. Log session start (optional but recommended)
    - Format: `[YYYY-MM-DD HH:MM:SS] Session started: [agent-name]`
    - Location: `.machine_readable/session-log.txt`
-3. Read `.machine_readable/STATE.scm`
+3. Read `.machine_readable/6a2/STATE.a2ml`
 4. Check for blockers
 5. State understanding of canonical locations
 
 ### on-exit (Session End)
 
 When ending a session:
 
-1. Update `.machine_readable/STATE.scm` if changes made
+1. Update `.machine_readable/6a2/STATE.a2ml` if changes made
 2. Log session end (optional but recommended)
    - Format: `[YYYY-MM-DD HH:MM:SS] Session ended: [summary]`
    - Location: `.machine_readable/session-log.txt`

tools/pmpl-audit/src/main.rs

@@ -6,6 +6,7 @@
 //! This tool checks a repository for compliance with Palimpsest-MPL
 //! requirements, including SPDX headers, license files, and provenance.
 
+#![forbid(unsafe_code)]
 use anyhow::{Context, Result};
 use clap::Parser;
 use regex::Regex;

tools/pmpl-sign/src/main.rs

@@ -7,6 +7,7 @@
 //! cryptographic algorithms as specified in Exhibit B of the Palimpsest-MPL
 //! license.
 
+#![forbid(unsafe_code)]
 use anyhow::{Context, Result};
 use clap::Parser;
 use sha3::{Digest, Sha3_256};

tools/pmpl-verify/src/main.rs

@@ -6,6 +6,7 @@
 //! This tool verifies PMPL-compliant provenance signatures created by
 //! pmpl-sign, checking both the cryptographic signature and the content hash.
 
+#![forbid(unsafe_code)]
 use anyhow::{Context, Result};
 use clap::Parser;
 use sha3::{Digest, Sha3_256};