chore: fill derivable placeholders, drop false ARCHITECTURE, surface the rest

.github/CODEOWNERS

@@ -1,17 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# CODEOWNERS - Code ownership for echidnabot
-# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-
-# Default owner for everything
-* @hyperpolymath
-
-# Core bot crates
-/src/ @hyperpolymath
-/crates/ @hyperpolymath
-
-# Infrastructure and CI/CD
-/.github/ @hyperpolymath
-/scripts/ @hyperpolymath
-
-# SCM and machine-readable metadata
-/.machine_readable/ @hyperpolymath
+# Solo-maintained hyperpolymath repo: no owner lines by policy.
+# See hyperpolymath/standards CODEOWNERS-POLICY.adoc (Rule 1).
+# Sole-maintainer review is moot; SPDX headers carry attribution.

.machine_readable/contractiles/Justfile

@@ -385,8 +385,8 @@ container-init:
     read -rp "Primary port [8080]: " _PORT
     PORT="${_PORT:-8080}"
 
-    read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY
-    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}"
+    read -rp "Container registry [ghcr.io/${OWNER:-hyperpolymath}]: " _REGISTRY
+    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-hyperpolymath}}"
 
     echo ""
     echo "  Service: $SERVICE_NAME"
@@ -601,7 +601,7 @@ test-matrix suite="unit" verbosity="normal" parallel="true":
     @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}"
 
 # Container matrix: [build|run|push|shell|scan] x [registry] x [tag]
-container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest":
+container-matrix action="build" registry="ghcr.io/hyperpolymath" tag="latest":
     @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}"
 
 # CI matrix: [lint|test|build|security|all] x [quick|full]

.machine_readable/contractiles/dust/Dustfile.a2ml

@@ -54,7 +54,7 @@ to new repositories.
 - description: No references to echidnabot in generic template files
 - run: test -z "$(grep -r 'echidnabot' machine-readable-design/ 2>/dev/null)"
 - severity: warning
-- notes: Generic templates should use {{PROJECT_NAME}} or similar placeholders
+- notes: Generic templates should use echidnabot — Proof-Aware CI Bot or similar placeholders
 
 ### version-sync-checked
 - description: Version in canonical-directory-structure matches .machine_readable/contractiles

0-AI-MANIFEST.a2ml

@@ -42,3 +42,20 @@ respect-claude-md      = true   # .claude/CLAUDE.md is binding for AI assistants
 2026-04-25 = "bot_directives extended with [bot] mode-resolver block"
 2026-04-26 = "test suite reached 184/184 passing"
 2026-05-30 = ".claude/CLAUDE.md flipped ReScript→AffineScript per estate policy"
+
+<!-- BEGIN requires-initialisation -->
+
+## PRIORITY ACTION — this repository is not fully initialised
+
+1 substitution token(s) still have no value. **Read
+`REQUIRES_INITIALISATION.md` in the repository root before doing anything
+else here** — it lists every outstanding token, what it means, and which
+files it belongs in.
+
+Do not fabricate values for them, and do not delete the sections that
+contain them to quiet a gate. They are unfilled because they need a
+decision, not because they were overlooked. Resolve what you legitimately
+can, leave the rest, and delete `REQUIRES_INITIALISATION.md` only when
+nothing outstanding remains.
+
+<!-- END requires-initialisation -->

Justfile

@@ -386,8 +386,8 @@ container-init:
     read -rp "Primary port [8080]: " _PORT
     PORT="${_PORT:-8080}"
 
-    read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY
-    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}"
+    read -rp "Container registry [ghcr.io/${OWNER:-hyperpolymath}]: " _REGISTRY
+    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-hyperpolymath}}"
 
     echo ""
     echo "  Service: $SERVICE_NAME"
@@ -602,7 +602,7 @@ test-matrix suite="unit" verbosity="normal" parallel="true":
     @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}"
 
 # Container matrix: [build|run|push|shell|scan] x [registry] x [tag]
-container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest":
+container-matrix action="build" registry="ghcr.io/hyperpolymath" tag="latest":
     @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}"
 
 # CI matrix: [lint|test|build|security|all] x [quick|full]

REQUIRES_INITIALISATION.md

@@ -0,0 +1,55 @@
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+
+# REQUIRES INITIALISATION
+
+**This repository is not finished being set up.** 1 substitution token(s) across 2 file(s) still have no value.
+
+## Why this is not already done
+
+This repo was created from `hyperpolymath/rsr-template-repo`. The mint
+(`just repo-init`) fills every token that has a single mechanical answer —
+owner, repo, author, dates, licence, branch — and it has done so here.
+
+The tokens below are the ones it *deliberately cannot* answer. They need a
+decision or a fact that exists only in your head: what this project is for,
+what command builds it, which port the service listens on, whether a PGP key
+is held at all. The template's own token vocabulary says as much — you cannot
+sensibly answer "required invariants" in a thirty-second bootstrap.
+
+They were left **visibly unfilled on purpose**. The alternatives were both
+worse: inventing plausible values would put confident falsehoods into a
+security policy and an architecture document, and silently deleting the
+sections would hide the fact that a decision is owed. A visible gap is
+honest; a fabricated answer is not.
+
+## Do not delete this file until every item below is resolved
+
+This file is the only marker that the work is outstanding. Deleting it early
+does not finish the setup, it just conceals it — and the next person or agent
+to arrive will reasonably assume the repo is complete.
+
+- **If you are a person:** delete this file yourself once the last item is done.
+- **If you are an agent:** resolve what you legitimately can, leave the rest,
+  and delete this file only when no token below remains anywhere in the tree.
+  Do not delete it to make a gate go green.
+
+Re-running the estate top-up tool will remove this file automatically once
+nothing is outstanding, so the safest way to finish is to fix the tokens and
+let the check confirm it.
+
+## What is needed, and where it goes
+
+### `{{ARGS}}`
+
+Arguments for the justfile recipe this appears in.
+
+Appears in:
+
+- `.machine_readable/contractiles/Justfile`
+- `Justfile`
+
+---
+
+Generated by the estate top-up pass. Rationale and the governing rulings are
+in `hyperpolymath/standards`; the token vocabulary is
+`.machine_readable/ai/PLACEHOLDERS.adoc` in `rsr-template-repo`.

ffi/zig/build.zig

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MPL-2.0
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-// {{PROJECT}} FFI Build Configuration
+// ECHIDNABOT FFI Build Configuration
 
 const std = @import("std");
 

ffi/zig/src/main.zig

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MPL-2.0
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-// {{PROJECT}} FFI Implementation
+// ECHIDNABOT FFI Implementation
 //
 // This module implements the C-compatible FFI declared in src/abi/Foreign.idr
 // All types and layouts must match the Idris2 ABI definitions.
@@ -10,7 +10,7 @@ const std = @import("std");
 
 // Version information (keep in sync with project)
 const VERSION = "0.1.0";
-const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string;
+const BUILD_INFO = "ECHIDNABOT built with Zig " ++ @import("builtin").zig_version_string;
 
 /// Thread-local error storage
 threadlocal var last_error: ?[]const u8 = null;

ffi/zig/test/integration_test.zig

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MPL-2.0
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-// {{PROJECT}} Integration Tests
+// ECHIDNABOT Integration Tests
 //
 // These tests verify that the Zig FFI correctly implements the Idris2 ABI