Reflexion design layer + docs/metadata/licence sync

[hyperpolymath]

Summary

Two threads from the discussion: (1) place the reflexive design layer from the toolchain note into Phronesis, and (2) sort out the out-of-date README/EXPLAINME — which turned out to be broader drift.

A · Reflexion layer (lib/phronesis/reflexion/)

A "reflexion" subsystem (design self-relation, not runtime reflection) that observes the ordinary toolchain, turns artefacts into explicit claims, compares justification paths across versions, and emits design obligations that gate changes — never auto-mutating semantics.

• Claim extractor → judgement-evidence graph → invariant-path equivalence engine (8-way classifier) → revaluation loop (:permit/:warn/:gate), plus an append-only SHA-256 hash-chained design ledger and a Phronesis.Reflexion façade.
• Anchor behaviour: dropping a REPORT (map-territory) mandate ⇒ weakening ⇒ gate + a prove / mark-intentional / reject obligation + ledger entry.
• docs/REFLEXION.adoc; just reflexion-test / just reflexion-demo.
• 32 new tests, all green; full suite 460 tests, 0 regressions.

B · Docs / metadata sync

• README (GitLab→GitHub, Haskell→Elixir/Rust roadmap, clone block), TOPOLOGY (OCaml→Rust), LSP summary (debugger/profiler/doc-gen/package-manager are implemented), CONTRIBUTING.md (real structure).
• .machine_readable/6a2: repaired the malformed STATE.a2ml, filled the blank ECOSYSTEM.a2ml, added META ADRs, refreshed dates.
• .claude/CLAUDE.md + 0-AI-MANIFEST.a2ml: metadata is A2ML in .machine_readable/6a2, not Guile .scm.
• Fixed dangling SPEC.core.scm symlink → SPEC.core.a2ml; removed duplicate TESTING-REPORT.scm; fixed a pre-existing just parse error (Justfile //→#).

C · Licence normalisation (owner-approved: MPL-2.0 code + CC-BY-SA-4.0 docs)

• Added REUSE-style LICENSES/{MPL-2.0,CC-BY-SA-4.0}.txt; kept top-level LICENSE (MPL-2.0).
• Removed Palimpsest LICENSE.txt + PALIMPSEST.adoc (this repo is not a Palimpsest carve-out).
• Flipped estate-authored .adoc documentation SPDX headers to CC-BY-SA-4.0; code stays MPL-2.0.

Verification

Built/tested locally on Elixir + OTP 25 (hex tarballs were network-blocked in the sandbox, so jason/stream_data were vendored as path deps for the test run only — mix.exs/mix.lock are committed unchanged with the real hex deps). mix compile is warning-clean for reflexion; just reflexion-demo shows the gate + obligation + verified ledger. 460 tests, 32 new green; the 17 pre-existing failures (Debugger / DocGenerator / IncrementalLexer / Conformance) are unchanged and out of scope.

Flagged for your call (deliberately not done here)

• Narrative .md docs (ANALYSIS-COMPLETE, IMPLEMENTATION-ROADMAP, WOKELANG-*, TEST-NEEDS) left MPL-2.0 — say the word to move them to CC-BY-SA-4.0 as well.
• Version disagreement: mix.exs 0.1.0 vs STATE.a2ml 0.9.0 vs README "Standard Candidate 1.0".
• .md→.adoc rename for TOPOLOGY / LSP-summary (estate ships them as .md) — content fixed in place; rename left as an estate decision.
• Pre-existing test failures (e.g. Phronesis.Trace.merge/2 undefined in debugger.ex, State.variables) — real bugs, but out of this scope.

Draft until you've reviewed the licence flips and the flagged items.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AqMopxUsgu78rg5fhWBUkk

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 21 issues detected

Severity	Count
🔴 Critical	0
🟠 High	7
🟡 Medium	14

View findings

[
  {
    "reason": "Action trufflesecurity/trufflehog@main needs attention",
    "type": "unpinned_action",
    "file": "secret-scanner.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "binary_to_term without :safe option -- deserialization attack (1 occurrences, CWE-502)",
    "type": "elixir_send_unsanitised",
    "file": "/home/runner/work/phronesis/phronesis/lib/phronesis/compiler.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in phronesis: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/phronesis/phronesis",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 6 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD007 -- Hypatia structural_drift: SD007 -- 6 day(s) old",
    "type": "CSA001",
    "file": ".claude/CLAUDE.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD007 -- Hypatia structural_drift: SD007 -- 6 day(s) old",
    "type": "CSA001",
    "file": ".claude/CLAUDE.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD007 -- Hypatia structural_drift: SD007 -- 6 day(s) old",
    "type": "CSA001",
    "file": ".claude/CLAUDE.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD007 -- Hypatia structural_drift: SD007 -- 6 day(s) old",
    "type": "CSA001",
    "file": ".claude/CLAUDE.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence