refactor: migrate Markdown to AsciiDoc

CHANGELOG.adoc

@@ -0,0 +1,198 @@
+== Changelog
+
+All notable changes to `+boj-server-cartridges+` are recorded here.
+Format follows https://keepachangelog.com/en/1.1.0/[Keep a Changelog];
+the project adheres to https://semver.org/spec/v2.0.0.html[Semantic
+Versioning].
+
+____
+*No release has ever been tagged.* There are no git tags in this
+repository and no GitHub releases. The `+[0.1.0]+` heading below marks
+the 2026-06-01 milestone, not a published artefact — treat it as a dated
+section, not a version you can fetch.
+____
+
+=== https://github.com/hyperpolymath/boj-server-cartridges/commits/main[Unreleased]
+
+Everything landed on `+main+` since the 2026-06-01 milestone — 71
+commits, none of which were recorded here.
+
+==== Added
+
+* *This repository became the sole source of BoJ cartridges.*
+`+boj-server+` retired its own bundled `+cartridges/+` tree in
+https://github.com/hyperpolymath/boj-server/pull/300[boj-server#300]
+(merged 2026-08-04). There is no second copy: what lands here is what
+every host fetches.
+* *Foundry* — a high-assurance cartridge-making subsystem under
+link:tools/foundry/[`+tools/foundry/+`], gated by
+link:.github/workflows/foundry.yml[`+.github/workflows/foundry.yml+`],
+with a machine-checked Idris2 design proof at
+link:tools/foundry/proof/Foundry.idr[`+tools/foundry/proof/Foundry.idr+`].
+Landed across `+002ac93+` (factory + textkit-mcp, A1 closure),
+`+29e1734+` (the checked design proof), `+0b54a8a+` (Provision stage —
+capability partition + enforcement), `+1fb2349+` (per-kind obligation
+bundles, #44) and `+caeb14e+` (the missing Configure stage; the wizard
+now fails closed, #102).
+* *Proofs Gate* — `+368143a+` (#40) added Idris2 to CI here for the
+first time and reconciled *23 cartridge ABI proofs across 21 cartridges*
+that had silently stopped type-checking in this repo while their
+`+boj-server+` twins still passed. Nothing had run `+idris2+` in this
+repository before.
+* *Foundry Wave-1 "`Golden Dozen`"* (`+be17f66+`) — the first 12
+cartridges marked `+"available": true+`. They remain the only 12.
+* New cartridges: *bug-filing-mcp* (`+373dce6+`, wrapping the
+feedback-o-tron engine; `+5a8be0c+` v0.2 interactive loop tools + full
+cartridge layout; `+d0d89f6+` unified adapter) and *cicd-squabbler-mcp*
+(`+77a2edb+`, with review follow-ups in `+6767196+`).
+* *Presence site* for
+https://cartridges.boj-server.net/[cartridges.boj-server.net] —
+`+1bab028+` added link:site/[`+site/+`] plus a Cloudflare Pages deploy
+action; `+b1c09f2+` (#93) added docs deployment via Ddraig SSG.
+* SonarCloud scan workflow, config and badge (`+bf92407+`, #64); OpenSSF
+Best Practices badge (`+5734305+`).
+* link:docs/cartridge-authoring.adoc[`+docs/cartridge-authoring.adoc+`],
+link:docs/known-issues/adapters.adoc[`+docs/known-issues/adapters.adoc+`]
+and
+link:docs/decisions/ADR-0006-cartridge-invoke-abi.adoc[`+docs/decisions/ADR-0006-cartridge-invoke-abi.adoc+`]
+— the layer contract and ABI were previously documented only inside a
+tool config file, and 458 in-tree files cited an ADR-0006 that did not
+exist here.
+* link:tools/build-catalog/[`+tools/build-catalog/+`] — generates
+`+site/catalog.json+` from the manifests. It had been hand-maintained
+and had drifted; there was no generator at all.
+* `+just mint+`, `+just validate+`, `+just catalog+`,
+`+just catalog-check+`. The minter script already existed but had no
+recipe.
+
+==== Changed
+
+* *`+README.md+` → `+README.adoc+`* (`+e75661f+`, #69) per the estate
+`+.adoc+`-default policy. This broke the two `+README.md+` links in
+`+CONTRIBUTING.md+`, now repaired.
+* *`+GOVERNANCE.adoc+` removed, `+GOVERNANCE.md+` kept* (`+c2da9ed+`).
+Note this inverts the repo’s own `+.adoc+`-default policy, under which
+`+GOVERNANCE+` is not an exempt filename — see the open conflict noted
+below.
+* Licence normalised to the canonical MPL-2.0 + CC-BY-SA-4.0 pair
+(`+4f1d042+`, #60).
+* Retired local issue/discussion templates in favour of the org
+`+.github+` canon (`+2ec1bff+`).
+* Secret scanning standardised on TruffleHog (`+f20955a+`), then
+re-pinned onto the real gitleaks gate with the retired inline job
+dropped (`+5013853+` #99, `+10d92c0+` #101).
+* Substantial CI remediation: path-filtered required gates made to
+always report (`+d9c7898+`), 7 startup-failing workflows repaired and
+the schema mirror re-pinned (`+de20566+`, #70), reusable-call job
+permissions granted (`+65e91da+`, #71), the governance gate closed on
+SPDX/permissions/SHA pins (`+b04274c+`, #103), and estate-wide
+foundational remediation (`+18afa91+`, #105).
+* `+SCHEMA-MIRROR.md+` pin values reconciled with `+PINNED-SHA+`
+(`+08bb723+`, #73).
+
+==== Fixed
+
+* *CWE-704* — unchecked `+@ptrCast+` removed from every cartridge shim
+(`+47f1ac3+`, #89, 115 files) and from the bug-filing-mcp adapter
+dispatch call (`+cb4c0cc+`, #91). The shims now use
+`+std.mem.sliceTo(ptr, 0)+` instead of re-typing a raw pointer.
+* `+linear-mcp+` implemented against the real Linear GraphQL API
+(`+5b4cad8+`, #83). The cartridge itself was not new — it shipped in the
+original 125.
+* `+007-mcp+`: `+BindAddress.proof+` renamed to `+.witness+`
+(`+594d08f+`, #34, closes #33).
+* Six hard-coded `+139+`s in `+site/index.html+` and three cartridges
+missing from `+site/catalog.json+`; the catalogue also claimed all 139
+entries were `+available: true+` when only 12 manifests say so.
+* Counts across `+README.adoc+`, `+CONTRIBUTING.md+` and
+`+schemas/SCHEMA-MIRROR.md+` that no longer matched the tree.
+
+==== Known issues
+
+* *The `+adapter/+` tree does not build and no CI job compiles it.*
+`+zig-test.yml+` globs `+cartridges/**/ffi/**+` only, so none of the 99
+`+adapter/build.zig+` files is gated. The canonical template’s adapter
+calls `+ffi.gossamer_init()+`, a symbol defined nowhere in the
+repository, and `+just mint+` copies the defect into every new
+cartridge. This predates the Zig 0.16 work. See
+link:docs/known-issues/adapters.adoc[`+docs/known-issues/adapters.adoc+`].
+* *Shim drift is unenforced.* Nothing in CI compares a cartridge’s
+`+cartridge_shim.zig+` against the canonical copy. 115 of the 116
+in-tree shims are byte-identical; `+npc-mcp+`’s differs in comments
+only.
+* `+GOVERNANCE.md+` versus the repo’s `+.adoc+`-default policy, and
+`+.machine_readable/contractiles/Mustfile.a2ml+` still requiring a
+`+GOVERNANCE.adoc+` that `+c2da9ed+` deleted.
+
+==== Not in this section
+
+The *Zig 0.16.0 migration*
+(https://github.com/hyperpolymath/boj-server-cartridges/pull/109[#109])
+is *open, not merged*, and is therefore deliberately absent above.
+`+.tool-versions+` on `+main+` still pins `+zig 0.15.1+`, and `+main+`
+carries 116 shims, not the 118 that PR describes. Move those entries up
+when it lands.
+
+=== [0.1.0] — 2026-06-01
+
+==== Added
+
+* Initial population from `+boj-server/cartridges/+` (snapshot
+2026-05-26): 125 cartridges migrated into the taxonomied layout under
+link:cartridges/[`+cartridges/+`] per
+link:docs/decisions/ADR-001-taxonomy.adoc[`+docs/decisions/ADR-001-taxonomy.adoc+`].
+* Schema-validation foundation: SHA-pinned mirror of
+https://github.com/hyperpolymath/standards/blob/main/cartridges/cartridge-v1.json[`+hyperpolymath/standards/cartridges/cartridge-v1.json+`]
+under link:schemas/cartridge-v1.json[`+schemas/cartridge-v1.json+`] (pin
+in link:schemas/PINNED-SHA[`+schemas/PINNED-SHA+`], mirror discipline in
+link:schemas/SCHEMA-MIRROR.md[`+schemas/SCHEMA-MIRROR.md+`]).
+* Zero-dependency Deno validator at
+link:tools/validate-cartridges/[`+tools/validate-cartridges/+`] with
+three tasks: `+audit+`, `+audit-verbose+`, `+strict+`.
+* Strict-mode CI gate
+(link:.github/workflows/cartridge-schema.yml[`+.github/workflows/cartridge-schema.yml+`])
+live since 2026-06-01: any manifest that fails schema validation blocks
+the PR.
+* Wave additions bundled into the v0.1 baseline: vector-DB cartridge
+wave (boj-server#100) and multi-modal cartridge wave (boj-server#101).
+* Wiki bootstrapped with Home + Cartridge-Schema-Validation +
+Refresh-Discipline pages. (Verified 2026-08-07: true — commit
+`+c5647a8+` in
+https://github.com/hyperpolymath/boj-server-cartridges/wiki[the wiki
+repository] adds exactly those three pages. The wiki is a separate git
+repository, which is why it is not in this tree.)
+* Documented downstream consumer relationship (the on-demand fetch
+contract) at `+boj-server#183+`.
+
+==== Changed
+
+* Drift-remediation campaigns closed in the run-up to the strict gate
+flip: #18 (`+category+` field backfill), #19 (`+auth.method+` enum
+mismatches), #20 (canonical-only / missing top-level fields /
+name-pattern renames). Post-remediation baseline: 139 / 139 manifests
+passing — see
+link:audits/cartridge-schema-2026-06-01.md[`+audits/cartridge-schema-2026-06-01.md+`].
+* Per-cartridge `+cartridge_shim.zig+` is now the de facto FFI shim
+layout (#29 / #31): 97 `+build.zig+` files rewritten to resolve
+`+b.path("cartridge_shim.zig")+` against the local directory (the
+`+adapter/build.zig+` case uses `+"../ffi/cartridge_shim.zig"+`). The
+canonical shim source remains
+link:cartridges/templates/gossamer-mcp/ffi/cartridge_shim.zig[`+cartridges/templates/gossamer-mcp/ffi/cartridge_shim.zig+`]
+— [line-through]#112 of 114 in-tree shims are byte-identical to it#.
++
+____
+*Correction (2026-08-07):* the "`112 of 114`" figure did not match the
+tree and its provenance is unknown. Recounted on `+main+`: *116 shims,
+115 byte-identical to canon*. The single exception is
+`+cartridges/domains/gaming/npc-mcp/ffi/cartridge_shim.zig+`, which
+differs _only in comments_ — identical API surface (same seven `+RC_*+`
+constants, same three helpers). Left struck through rather than silently
+rewritten, because this section is a dated historical record.
+____
+
+==== Fixed
+
+* `+browser_mcp_error_recover+` now rejects non-Error states with `+-2+`
+(#32). The build never previously ran for browser-mcp because of the
+shim-path issue, so the test logic bug was masked. Fixed alongside the
+#29 build-path rewrite.