chore: fill or remove RSR template placeholders

.github/workflows/boj-build.yml

@@ -16,4 +16,5 @@ jobs:
           curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
         continue-on-error: true
 permissions:
+  actions: read
   contents: read

.github/workflows/casket-pages.yml

@@ -7,6 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write

.github/workflows/codeql.yml

@@ -18,6 +18,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/dependabot-automerge.yml

@@ -41,6 +41,7 @@ on:
     types: [opened, reopened, synchronize]
 
 permissions:
+  actions: read
   contents: write        # needed to enable auto-merge
   pull-requests: write   # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.

.github/workflows/dogfood-gate.yml

@@ -13,6 +13,7 @@ on:
     branches: [main, master]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/governance.yml

@@ -27,6 +27,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/hypatia-scan.yml

@@ -18,6 +18,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
   # security-events: write serves two purposes (write implies read):
   #   1. read — lets the built-in GITHUB_TOKEN query this repo's own

.github/workflows/instant-sync.yml

@@ -9,6 +9,7 @@ on:
     types: [published]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/mirror.yml

@@ -7,6 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/push-email-notify.yml

@@ -7,6 +7,7 @@ name: Push email notification
 on:
   push: {}
 permissions:
+  actions: read
   contents: read
 jobs:
   notify:

.github/workflows/release.yml

@@ -12,6 +12,7 @@ on:
       - 'v*'
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/rust-ci.yml

@@ -10,6 +10,7 @@ on:
   pull_request:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/scorecard.yml

@@ -9,6 +9,7 @@ on:
     branches: [main]
 
 permissions: read-all
+  actions: read
 
 jobs:
   analysis:

.github/workflows/secret-scanner.yml

@@ -11,6 +11,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

SECURITY.md

@@ -1,23 +1,5 @@
 # Security Policy
 
-<!-- 
-============================================================================
-TEMPLATE INSTRUCTIONS (delete this block before publishing)
-============================================================================
-Replace all {{PLACEHOLDER}} values with your information:
-  intsoc-transactor     - Your project name
-  hyperpolymath            - GitHub username or org (e.g., hyperpolymath)
-  intsoc-transactor             - Repository name
-  j.d.a.jewell@open.ac.uk   - Security contact email
-  [PGP fingerprint not set]  - Your PGP key fingerprint (40 chars, no spaces)
-  {{PGP_KEY_URL}}      - URL to your public PGP key
-  https://github.com/hyperpolymath/intsoc-transactor          - Your website/domain
-  2026     - Current year for copyright
-
-Optional: Remove sections that don't apply (e.g., PGP if you don't use it)
-============================================================================
--->
-
 We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions.
 
 ## Table of Contents
@@ -59,19 +41,8 @@ If you cannot use GitHub Security Advisories, you may email us directly:
 | | |
 |---|---|
 | **Email** | j.d.a.jewell@open.ac.uk |
-| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) |
 | **Fingerprint** | `[PGP fingerprint not set]` |
 
-```bash
-# Import our PGP key
-curl -sSL {{PGP_KEY_URL}} | gpg --import
-
-# Verify fingerprint
-gpg --fingerprint j.d.a.jewell@open.ac.uk
-
-# Encrypt your report
-gpg --armor --encrypt --recipient j.d.a.jewell@open.ac.uk report.txt
-```
 
 > **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media.
 
@@ -370,7 +341,6 @@ When using intsoc-transactor, we recommend:
 
 ## Additional Resources
 
-- [Our PGP Public Key]({{PGP_KEY_URL}})
 - [Security Advisories](https://github.com/hyperpolymath/intsoc-transactor/security/advisories)
 - [Changelog](CHANGELOG.md)
 - [Contributing Guidelines](CONTRIBUTING.md)

guix.scm

@@ -1,71 +1,18 @@
-;; SPDX-License-Identifier: MPL-2.0
-;; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
-;;
-;; Guix package definition for intsoc-transactor
-;;
-;; Usage:
-;;   guix shell -D -f guix.scm    # Enter development shell
-;;   guix build -f guix.scm       # Build package
-;;
-;; TODO: Replace intsoc-transactor and customize inputs for your language/stack.
-;; See: https://guix.gnu.org/manual/en/html_node/Defining-Packages.html
+; SPDX-License-Identifier: MPL-2.0
+;; guix.scm — GNU Guix package definition for squisher-corpus
+;; Usage: guix shell -f guix.scm
 
 (use-modules (guix packages)
-             (guix gexp)
-             (guix git-download)
              (guix build-system gnu)
-             (guix licenses)
-             (gnu packages base))
+             (guix licenses))
 
 (package
-  (name "intsoc-transactor")
+  (name "squisher-corpus")
   (version "0.1.0")
-  (source (local-file "." "source"
-                       #:recursive? #t
-                       #:select? (lambda (file stat)
-                                   (not (string-contains file ".git")))))
+  (source #f)
   (build-system gnu-build-system)
-  (arguments
-   '(#:phases
-     (modify-phases %standard-phases
-       ;; TODO: Customize build phases for your project
-       ;; Examples for common stacks:
-       ;;
-       ;; Rust:
-       ;;   (replace 'build (lambda _ (invoke "cargo" "build" "--release")))
-       ;;   (replace 'check (lambda _ (invoke "cargo" "test")))
-       ;;
-       ;; Elixir:
-       ;;   (replace 'build (lambda _ (invoke "mix" "compile")))
-       ;;   (replace 'check (lambda _ (invoke "mix" "test")))
-       ;;
-       ;; Zig:
-       ;;   (replace 'build (lambda _ (invoke "zig" "build")))
-       ;;   (replace 'check (lambda _ (invoke "zig" "build" "test")))
-       (delete 'configure)
-       (delete 'build)
-       (delete 'check)
-       (replace 'install
-         (lambda* (#:key outputs #:allow-other-keys)
-           (let ((out (assoc-ref outputs "out")))
-             (mkdir-p (string-append out "/share/doc"))
-             (copy-file "README.adoc"
-                        (string-append out "/share/doc/README.adoc"))))))))
-  (native-inputs
-   (list
-    ;; TODO: Add build-time dependencies
-    ;; Examples:
-    ;;   rust (gnu packages rust)
-    ;;   elixir (gnu packages elixir)
-    ;;   zig (gnu packages zig)
-    ))
-  (inputs
-   (list
-    ;; TODO: Add runtime dependencies
-    ))
-  (home-page "https://github.com/hyperpolymath/intsoc-transactor")
-  (synopsis "Internet Society document transactor")
-  (description "RSR-compliant project. See README.adoc for details.")
-  (license (list
-            ;; MPL-2.0 extends MPL-2.0
-            mpl2.0)))
+  (synopsis "squisher-corpus")
+  (description "squisher-corpus — part of the hyperpolymath ecosystem.")
+  (home-page "https://github.com/hyperpolymath/squisher-corpus")
+  (license ((@@ (guix licenses) license) "PMPL-1.0-or-later"
+             "https://github.com/hyperpolymath/palimpsest-license")))