docs: bring repo to estate documentation + contributor convention + substantial wiki

.github/CODEOWNERS

@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
+#
+# CODEOWNERS — julia-professional-registry
+
+# Default owner for all files
+*                              @hyperpolymath
+
+# Registry index — the canonical surface
+/Registry.toml                 @hyperpolymath
+
+# Workflows + dependency policy
+/.github/                      @hyperpolymath
+
+# Machine-readable metadata
+/.machine_readable/            @hyperpolymath
+
+# Security-sensitive
+/SECURITY.md                   @hyperpolymath
+/.well-known/                  @hyperpolymath
+
+# Governance docs
+/GOVERNANCE.adoc               @hyperpolymath
+/MAINTAINERS.adoc              @hyperpolymath
+/CODE_OF_CONDUCT.md            @hyperpolymath

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: [hyperpolymath]

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Report a problem with the registry or a registered package's metadata
+title: ''
+labels: bug
+assignees: ''
+---
+
+**What went wrong?**
+A clear, concise description of what the bug is.
+
+**To reproduce**
+Steps to reproduce the behaviour. For registry-installation issues, include the exact `Pkg` commands you ran:
+
+```julia
+using Pkg
+Pkg.Registry.add(...)
+Pkg.add("...")
+```
+
+**Expected behaviour**
+What you expected to happen.
+
+**Actual behaviour**
+What actually happened. Paste the Julia error output verbatim if there was one.
+
+**Environment**
+ - Julia version (`versioninfo()` output):
+ - OS:
+ - Registry version / commit:
+
+**Affected package (if applicable)**
+ - Package name:
+ - Version:
+ - Upstream repository:
+
+**Additional context**
+Anything else that might help diagnose the problem.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,22 @@
+---
+name: Feature request
+about: Suggest an improvement to the registry's tooling, policies, or scope
+title: ''
+labels: enhancement
+assignees: ''
+---
+
+**Problem this would solve**
+A clear, concise description of the problem. e.g. "It is currently difficult to ..."
+
+**Proposed solution**
+What you would like to happen. Include a sketch of the change if it touches Registry.toml, workflows, or directory layout.
+
+**Alternatives considered**
+Other approaches you thought about and why this one is preferable.
+
+**Estate alignment**
+Does this change touch estate conventions that live in [hyperpolymath/standards](https://github.com/hyperpolymath/standards)? If so, link the relevant standards issue or PR. Avoid drifting away from estate conventions silently.
+
+**Additional context**
+Any other context, links, or screenshots.

.github/ISSUE_TEMPLATE/package_registration.md

@@ -0,0 +1,32 @@
+---
+name: Package registration request
+about: Propose a new package, or a new version of an existing package, for registration
+title: 'register: <Package> v<X.Y.Z>'
+labels: registration
+assignees: ''
+---
+
+**Package**
+ - Name:
+ - Version being registered:
+ - Upstream repository URL:
+ - Maintainer (GitHub handle):
+
+**New registration or update?**
+ - [ ] Brand-new package (not previously in this registry)
+ - [ ] New version of an already-registered package
+
+**Quality bar checklist** (see [GOVERNANCE.adoc](../../GOVERNANCE.adoc))
+
+- [ ] SPDX license headers on all source files
+- [ ] REUSE-compliant `LICENSES/` directory
+- [ ] OpenSSF Scorecard >= 7 (link the scorecard run if available)
+- [ ] No banned-language files in the package
+- [ ] `Project.toml` carries semver-compatible `compat` ranges for all dependencies
+- [ ] A tag exists on the upstream repo matching the version being registered
+
+**Dependencies on other hyperpolymath registry packages?**
+List any deps already in this registry that this package or version requires.
+
+**Additional context**
+Anything else the BDFL should know before reviewing the registration.

.github/copilot-instructions.md

@@ -0,0 +1,49 @@
+<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+<!-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> -->
+
+# Copilot Instructions
+
+## Before Writing Code
+
+- Read `0-AI-MANIFEST.a2ml` in the repo root for canonical file locations.
+- State files (`*.a2ml`) live in `.machine_readable/6a2/` ONLY, never the root.
+- Registry data is structured per the Julia package registry format: `Registry.toml` at the root, per-letter directories (`A/`, `B/`, ...) each containing per-package subdirs with `Package.toml` / `Versions.toml` / `Deps.toml` / `Compat.toml`.
+
+## License
+
+- SPDX: `PMPL-1.0-or-later` on all new files.
+- Never use AGPL-3.0.
+- Copyright: `Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>`.
+
+## Code Style
+
+- Annotate and document all files.
+- Add SPDX header to every source file (Julia, AsciiDoc, Markdown, TOML where comments are supported).
+- Use `just` for build/test/lint commands.
+
+## Banned Languages (estate-wide)
+
+- No TypeScript (use AffineScript).
+- No Node.js / npm / bun (use Deno).
+- No Go (use Rust).
+- No Python (use Julia or Rust).
+
+## Containers
+
+- Use Podman, never Docker.
+- Name the file `Containerfile`, never `Dockerfile`.
+- Base image: `cgr.dev/chainguard/wolfi-base:latest`.
+
+## State Files
+
+Never create these in the repo root:
+`STATE.a2ml`, `META.a2ml`, `ECOSYSTEM.a2ml`, `AGENTIC.a2ml`, `NEUROSYM.a2ml`, `PLAYBOOK.a2ml`.
+They belong in `.machine_readable/6a2/` only.
+
+## Workflow Pins
+
+All wrapper workflows in `.github/workflows/` must pin the upstream standards reusable to a SHA (40-hex), never `@main` or `@v1`. Use the standards repo's current `main` HEAD SHA for new wrappers; let dependabot or rhodibot update the pin afterwards.
+
+## Registration PRs
+
+A package registration PR title follows: `feat(registry): register <Package> v<X.Y.Z>` (or `add <Package>` for first registration). It updates `Registry.toml` plus the relevant per-package directory atomically.

.github/pull_request_template.md

@@ -0,0 +1,41 @@
+<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+## Summary
+
+<!-- Briefly describe what this PR does and why. Link to related issues with "Closes #N". -->
+
+## Changes
+
+<!-- List the key changes introduced by this PR. -->
+
+-
+
+## RSR Quality Checklist
+
+<!-- Check all that apply. PRs that fail required checks will not be merged. -->
+
+### Required
+
+- [ ] No banned language patterns (no TypeScript, no npm/bun, no Go, no Python)
+- [ ] SPDX license headers present on all new/modified source files
+- [ ] No secrets, credentials, or `.env` files included
+- [ ] CI is green (governance, hypatia-scan, codeql, scorecard, secret-scanner)
+
+### As Applicable — Registry Changes
+
+- [ ] `Registry.toml` index updated when a package or version was added
+- [ ] Per-package `Package.toml` / `Versions.toml` / `Deps.toml` / `Compat.toml` consistent
+- [ ] Upstream package meets the quality bar in [GOVERNANCE.adoc](../GOVERNANCE.adoc)
+- [ ] Upstream tag exists and matches the registered version
+
+### As Applicable — Documentation / Infra Changes
+
+- [ ] `.machine_readable/6a2/STATE.a2ml` updated (if project state changed)
+- [ ] `.machine_readable/6a2/ECOSYSTEM.a2ml` updated (if integrations changed)
+- [ ] `.machine_readable/6a2/META.a2ml` updated (if architectural decisions changed)
+- [ ] `TOPOLOGY.md` updated (if architecture changed)
+- [ ] `CHANGELOG.md` updated (or pending auto-generation from conventional commits)
+- [ ] Wiki updated for user-facing changes
+
+## Testing
+
+<!-- Describe how you tested these changes. For registrations, include the `Pkg.Registry.add` + `Pkg.add` sequence you used. -->

.github/workflows/scorecard.yml

@@ -8,9 +8,19 @@ on:
   push:
     branches: [main]
 
-permissions: read-all
+# Workflow-level permissions are read-only. The job that calls the
+# reusable upgrades to the writes required by ossf/scorecard-action.
+# See the canonical caller block in
+# hyperpolymath/standards/.github/workflows/scorecard-reusable.yml --
+# called-workflow permissions are CAPPED by the caller's block, so
+# the job-level overrides below are necessary, not redundant.
+permissions:
+  contents: read
 
 jobs:
   analysis:
+    permissions:
+      security-events: write
+      id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260
     secrets: inherit

CHANGELOG.md

@@ -0,0 +1,52 @@
+<!--
+SPDX-License-Identifier: PMPL-1.0-or-later
+SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
+-->
+
+# Changelog
+
+All notable changes to `julia-professional-registry` will be documented in this file.
+
+This file is generated from conventional commits by the
+[`changelog-reusable.yml`](https://github.com/hyperpolymath/standards/blob/main/.github/workflows/changelog-reusable.yml)
+workflow ([hyperpolymath/standards#206](https://github.com/hyperpolymath/standards/pull/206)). Adopt the workflow in this repo's CI to keep this file in sync automatically — see
+[`templates/cliff.toml`](https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml)
+for the canonical config.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
+this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- `CHANGELOG.md`, `ROADMAP.adoc`, `MAINTAINERS.adoc`, `GOVERNANCE.adoc` — bring repo to estate documentation convention.
+- `.github/ISSUE_TEMPLATE/{bug_report,feature_request,custom}.md`, `.github/pull_request_template.md`, `.github/CODEOWNERS`, `.github/FUNDING.yml`, `.github/copilot-instructions.md` — estate-standard contributor onboarding fleet.
+- `.github/workflows/{scorecard,mirror,secret-scanner,codeql}.yml` — wire the four missing standards reusables (PR #17).
+- Wiki: structured pages mirroring repo documentation (Home, Registry-Usage, Packages, Architecture, Testing, Governance, Roadmap).
+
+### Changed
+
+- `.github/workflows/governance.yml` — SHA-pin the standards governance reusable (was floating `@main`) (PR #17).
+- Consolidate `CONTRIBUTING.md` and `CONTRIBUTING.adoc` into a single canonical Markdown file.
+
+### Removed
+
+- `.machine_readable/STATE.a2ml` (root) — moved to canonical `.machine_readable/6a2/STATE.a2ml` per estate structural-drift policy (PR #17).
+
+### Security
+
+- Dismissed 17 self-referential `hypatia/code_scanning_alerts/CSA00x` alerts as `won't fix`; root cause fixed at SARIF render layer in [hyperpolymath/hypatia#368](https://github.com/hyperpolymath/hypatia/pull/368).
+- Closed seven real open code-scanning alerts via the four reusable wrappers, `codeql.yml@language=actions`, and the STATE.a2ml move (PR #17).
+
+## [1.0.0] — 2026-04-04
+
+### Added
+
+- CRG Grade C test suite (see `TEST-NEEDS.md`).
+- 34 hyperpolymath Julia packages registered via standard Julia Registry layout (Registry.toml + per-letter directories).
+- AsciiDoc top-level documentation: `README.adoc`, `EXPLAINME.adoc`, `TOPOLOGY.md`, three `QUICKSTART-*.adoc` files.
+- `.machine_readable/` dual-track scaffolding: `0-AI-MANIFEST.a2ml`, `6a2/{STATE,ECOSYSTEM,META}.a2ml`, contractiles, integrations, anchors.
+- `flake.nix`, `guix.scm`, `Justfile` — reproducible development environment.
+- Idris2 test harness scaffold (`julia-professional-registry-tests.ipkg`, `tests/`).
+- Initial workflow fleet: `boj-build.yml`, `casket-pages.yml`, `governance.yml`, `hypatia-scan.yml`.

CONTRIBUTING.md

@@ -14,10 +14,19 @@ We welcome contributions in many forms:
 
 ## Getting Started
 
-1. **Read the AI Manifest:** Start with `0-AI-MANIFEST.a2ml` (if present) to understand the repository structure.
-2. **Environment:** Use `nix develop` or `direnv allow` to set up your tools.
+1. **Read the AI Manifest:** Start with `0-AI-MANIFEST.a2ml` to understand the repository structure.
+2. **Environment:** Use `guix shell -D -f guix.scm` (or `direnv allow` if the `.envrc` is honoured) to set up your tools. Guix is the canonical packager per [standards#101](https://github.com/hyperpolymath/standards/issues/101); the prior `nix develop` fallback was retired estate-wide.
 3. **Task Runner:** Use `just` to see available commands (`just --list`).
 
+## Registering a Package
+
+This repo is a Julia package registry. To register a new package or a new version:
+
+1. Confirm the upstream package meets the registry's quality bar (see [GOVERNANCE.adoc](GOVERNANCE.adoc) — SPDX headers, REUSE-compliant `LICENSES/`, OpenSSF Scorecard baseline, no banned-language files).
+2. Add or update the relevant per-letter directory (e.g. a new package `Foo` lives under `F/Foo/`). Each version directory contains the standard Julia registry files: `Package.toml`, `Versions.toml`, `Deps.toml`, `Compat.toml`, `WeakCompat.toml`.
+3. Update the top-level `Registry.toml` index.
+4. Open a PR titled `feat(registry): register <Package> v<X.Y.Z>` (or `feat(registry): add <Package> v<X.Y.Z>`).
+
 ## Development Workflow
 
 ### Branch Naming