fix(carve-out): archive session detritus

.gitattributes

@@ -26,6 +26,13 @@
 *.adoc  text eol=lf
 *.txt   text eol=lf
 
+# These historical artefacts are byte-preserved evidence; do not rewrite or
+# reject their pre-existing whitespace during archival recovery.
+docs/archive/scaffolding/audit-contractiles.sh -whitespace
+docs/archive/scaffolding/contractile.just -whitespace
+docs/archive/scaffolding/stapeln.toml -whitespace
+docs/archive/session-detritus/root/SECURITY_TRAINING_SUMMARY.md -whitespace
+
 # Data
 *.json  text eol=lf
 *.yaml  text eol=lf

.machine_readable/REGISTRY.a2ml

@@ -135,7 +135,7 @@ name = "0-AI Gatekeeper Protocol"
 stream = "protocol"
 home = "0-ai-gatekeeper-protocol/"
 canonical_doc = "0-ai-gatekeeper-protocol/README.adoc"
-source_hash = "sha256:609558b5895d056289d5ea34033cc4625dda1503e58dd598f5b7cbe1bc60e3ba"
+source_hash = "sha256:6098f922fe32867a903871fd8436a5126553673704870e3fd011b4609e568684"
 route = "the AI-agent entry/gating protocol behind 0-AI-MANIFEST"
 
 [[spec]]
@@ -162,7 +162,7 @@ name = "AXEL Protocol"
 stream = "protocol"
 home = "axel-protocol/"
 canonical_doc = "axel-protocol/README.adoc"
-source_hash = "sha256:2076ab707c155dddc70601c72380327f49d905ea37d1c67b6eb345bfef628ce6"
+source_hash = "sha256:b0b7c07f4d63aa11557fa53d289010826bd5d84cb48489ee1f708af5d9c639dc"
 route = "age-gating + explicit-content enforcement"
 
 [[spec]]
@@ -207,7 +207,7 @@ name = "TRG — Toolchain Readiness Grades"
 stream = "readiness"
 home = "toolchain-readiness-grades/"
 canonical_doc = "toolchain-readiness-grades/README.adoc"
-source_hash = "sha256:b887d7d3f3e08b4d7020f225a13dec97f089509cad4f1192b2cf31af5a74e3a8"
+source_hash = "sha256:6290b871c14e8e15ebc07602400bf49deba27724b70dced8e0c0ed7e44859fe5"
 route = "per-toolchain readiness profile templates"
 
 [[spec]]

Justfile

@@ -7,9 +7,6 @@
 # enforcing: import? fails at parse time before any recipe can guard it.
 # See TOOLING-VERSION-INTEGRITY-POLICY.adoc (root cause: burble#39).
 
-# Default recipe
-import? "contractile.just"
-
 default:
     @just --list
 
@@ -176,6 +173,10 @@ test:
 test-runner-test:
     @bash scripts/tests/run-required-test-suite-test.sh
 
+# standards#496 regression: archived artefacts stay out of live spec homes.
+session-detritus-test:
+    @bash scripts/tests/wave9-session-detritus-test.sh
+
 # Format sub-project code
 fmt:
     @echo "=== Standards Monorepo Format ==="
@@ -218,8 +219,8 @@ doctor:
     @command -v git >/dev/null 2>&1 && echo "  [OK] git" || echo "  [FAIL] git not found"
     @echo "Checking for hardcoded paths..."
     @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.res' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo "  [OK] No hardcoded paths"
-    @echo "Checking optional imports (import? does not fail when absent — report it)..."
-    @test -f contractile.just && echo "  [OK] contractile.just present (import resolved)" || echo "  [INFO] contractile.just absent — its recipes are unavailable (needs the external 'contractile' generator)"
+    @echo "Checking canonical contractiles source..."
+    @test -f .machine_readable/contractiles/dust/Dustfile.a2ml && echo "  [OK] canonical Dustfile present" || echo "  [FAIL] canonical Dustfile missing"
     @echo "Checking git hooks are installed..."
     @test -f "$(git rev-parse --git-dir)/hooks/pre-commit" && echo "  [OK] pre-commit hook installed" || echo "  [INFO] pre-commit hook not installed — run 'just hooks-install'"
     @echo "Diagnostics complete."

QUICKSTART-DEV.adoc

@@ -43,7 +43,7 @@ nix develop
 ----
 git clone https://github.com/hyperpolymath/standards.git
 cd standards
-just setup-dev
+just --list
 ----
 
 == Build
@@ -99,7 +99,7 @@ just build          # Build the project
 just test           # Run tests
 just doctor         # Self-diagnostic
 just lint           # Lint and format
-just panic-scan     # Security scan via panic-attacker
+just assail         # Security scan via panic-attacker
 just tour           # Guided tour of the codebase
 ----
 
@@ -109,7 +109,7 @@ just tour           # Guided tour of the codebase
 ----
 just lint           # Format and lint
 just test           # All tests pass
-just panic-scan     # No new security issues
+just assail         # No new security issues
 ----
 
 == Contractile Invariants

TEST-NEEDS.adoc

@@ -4,7 +4,7 @@
 
 To achieve CRG Grades B and above, projects MUST implement *Zigzag
 Testing* for their critical paths, following the
-link:./ZIGZAG-TESTING.md[ZIGZAG-TESTING.md] methodology.
+link:ZIGZAG-TESTING.adoc[ZIGZAG-TESTING.adoc] methodology.
 
 === CRG Grade: C — ACHIEVED 2026-04-04
 

docs/archive/scaffolding/audit-contractiles.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Systemic Contractile Audit Script
+# Audits all Hyperpolymath repositories for complete contractile implementation
+
+set -euo pipefail
+
+echo "═══════════════════════════════════════════════════════════════════════════════"
+echo "  Hyperpolymath Contractile System Audit"
+echo "  $(date '+%Y-%m-%d %H:%M:%S')"
+echo "═══════════════════════════════════════════════════════════════════════════════"
+echo ""
+
+# Repositories to audit.
+# Previously these were hardcoded to the owner's machine (/var/mnt/eclipse/...),
+# so the script could not run in CI or on any other host (Wave-0 fix). Supply
+# repos explicitly as positional args, or via $CONTRACTILE_AUDIT_REPOS
+# (colon-separated). With neither set, default to auditing THIS repo so a bare
+# invocation is still useful — and never silently audit zero repos.
+if [ "$#" -gt 0 ]; then
+  REPOS=("$@")
+elif [ -n "${CONTRACTILE_AUDIT_REPOS:-}" ]; then
+  IFS=':' read -r -a REPOS <<< "$CONTRACTILE_AUDIT_REPOS"
+else
+  SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  REPOS=("$SELF_DIR")
+fi
+
+if [ "${#REPOS[@]}" -eq 0 ]; then
+  echo "error: no repositories to audit (pass paths as args or set CONTRACTILE_AUDIT_REPOS)" >&2
+  exit 2
+fi
+
+# Contractile types to check
+# `lust` deprecated 2026-04-18 — wishes absorbed into intend/Intentfile.a2ml
+CONTRACTILES=("must" "trust" "dust" "bust" "adjust" "intend")
+
+echo "## Contractile Completeness Audit"
+echo ""
+
+for repo in "${REPOS[@]}"; do
+  if [ -d "$repo" ]; then
+    echo "### $(basename "$repo")"
+
+    if [ -d "$repo/.machine_readable/contractiles" ]; then
+      for contractile in "${CONTRACTILES[@]}"; do
+        if [ -f "$repo/.machine_readable/contractiles/$contractile/Intentfile.a2ml" ] || \
+           [ -f "$repo/.machine_readable/contractiles/$contractile/${contractile^}file.a2ml" ]; then
+          echo "  ✅ $contractile: Present"
+        else
+          echo "  ❌ $contractile: MISSING"
+        fi
+      done
+    else
+      echo "  ❌ No contractiles directory"
+    fi
+    echo ""
+  fi
+done
+
+echo "## K9-SVC Integration Audit"
+echo ""
+
+for repo in "${REPOS[@]}"; do
+  if [ -d "$repo" ]; then
+    if grep -q "K9-SVC\|contractile" "$repo/.github/workflows/"*.yml 2>/dev/null || \
+       grep -q "K9-SVC\|contractile" "$repo/.pre-commit-config.yaml" 2>/dev/null; then
+      echo "  ✅ $(basename "$repo"): K9 integrated"
+    else
+      echo "  ❌ $(basename "$repo"): K9 missing"
+    fi
+  fi
+done
+
+echo ""
+echo "## Accessibility Implementation Audit"
+echo ""
+
+for repo in "${REPOS[@]}"; do
+  if [ -d "$repo" ]; then
+    if [ -d "$repo/server/lib/burble/accessibility" ] || \
+       [ -f "$repo/.machine_readable/contractiles/adjust/Adjustfile.a2ml" ]; then
+      echo "  ✅ $(basename "$repo"): Accessibility features present"
+    else
+      echo "  ❌ $(basename "$repo"): No accessibility implementation"
+    fi
+  fi
+done
+
+echo ""
+echo "## Documentation Audit"
+echo ""
+
+for repo in "${REPOS[@]}"; do
+  if [ -d "$repo" ]; then
+    if [ -f "$repo/docs/accessibility/README.adoc" ] || \
+       grep -q "accessibility" "$repo/README.adoc" 2>/dev/null; then
+      echo "  ✅ $(basename "$repo"): Accessibility documented"
+    else
+      echo "  ❌ $(basename "$repo"): Accessibility documentation missing"
+    fi
+  fi
+done
+
+echo ""
+echo "═══════════════════════════════════════════════════════════════════════════════"
+echo "  Audit Complete"
+echo "  Total repositories checked: ${#REPOS[@]}"
+echo "═══════════════════════════════════════════════════════════════════════════════"

docs/archive/scaffolding/contractile.just

@@ -0,0 +1,64 @@
+# Auto-generated by: contractile gen-just
+# Source directory: contractiles
+# Re-generate with: contractile gen-just --dir contractiles
+#
+# SPDX-License-Identifier: MPL-2.0
+
+# === INTEND (Declared Future Intent) ===
+# Source: Intentfile.a2ml
+
+# Display declared future intents
+intend-list:
+    @echo '=== Declared Intent ==='
+    @echo ''
+    @echo 'Purpose:'
+    @echo ''
+    @echo 'Anti-Purpose:'
+    @echo '  - A fork or wrapper around another tool'
+    @echo '  - A monorepo (unless explicitly structured as one)'
+    @echo ''
+    @echo 'If In Doubt:'
+
+
+# === TRUST (Integrity & Provenance Verification) ===
+# Source: Trustfile.a2ml
+
+# Run all trust verifications
+trust-verify: trust-license-content trust-no-secrets-committed
+    @echo 'All trust verifications passed'
+
+# LICENSE contains expected SPDX identifier
+trust-license-content:
+    grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE
+
+# No .env or credential files in repo
+trust-no-secrets-committed:
+    test ! -f .env && test ! -f credentials.json && test ! -f .env.local
+
+
+# === K9 Components ===
+
+# K9 component: contractiles/k9/examples/ci-config.k9.ncl
+k9-ci-config:
+    contractile k9 run contractiles/k9/examples/ci-config.k9.ncl
+
+# K9 component: contractiles/k9/examples/project-metadata.k9.ncl
+k9-project-metadata:
+    contractile k9 run contractiles/k9/examples/project-metadata.k9.ncl
+
+# K9 component: contractiles/k9/examples/setup-repo.k9.ncl
+k9-setup-repo:
+    contractile k9 run contractiles/k9/examples/setup-repo.k9.ncl
+
+# K9 component: contractiles/k9/template-hunt.k9.ncl
+k9-template-hunt:
+    contractile k9 run contractiles/k9/template-hunt.k9.ncl
+
+# K9 component: contractiles/k9/template-kennel.k9.ncl
+k9-template-kennel:
+    contractile k9 run contractiles/k9/template-kennel.k9.ncl
+
+# K9 component: contractiles/k9/template-yard.k9.ncl
+k9-template-yard:
+    contractile k9 run contractiles/k9/template-yard.k9.ncl
+

docs/archive/scaffolding/stapeln.toml

@@ -0,0 +1,90 @@
+# SPDX-License-Identifier: MPL-2.0
+# stapeln.toml — Layer-based container build for standards
+#
+# stapeln builds containers as composable layers (German: "to stack").
+# Each layer is independently cacheable, verifiable, and signable.
+
+[metadata]
+name = "standards"
+version = "0.1.0"
+description = "standards"
+author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
+license = "PMPL-1.0-or-later"
+registry = "ghcr.io/hyperpolymath"
+
+[build]
+containerfile = "Containerfile"
+context = "."
+runtime = "podman"
+
+# ── Layer Definitions ──────────────────────────────────────────
+
+[layers.base]
+description = "Chainguard Wolfi minimal base"
+from = "cgr.dev/chainguard/wolfi-base:latest"
+cache = true
+verify = true
+
+[layers.toolchain]
+description = "Build tools and dependencies"
+extends = "base"
+packages = ["julia"]
+cache = true
+
+[layers.build]
+description = "standards build"
+extends = "toolchain"
+commands = ["julia --project=. -e \"using Pkg; Pkg.instantiate()\""]
+
+[layers.runtime]
+description = "Minimal runtime"
+from = "cgr.dev/chainguard/wolfi-base:latest"
+packages = ["ca-certificates", "curl"]
+copy-from = [
+    { layer = "build", src = "/app/", dst = "/app/" },
+]
+entrypoint = ["/app/bin/standards"]
+user = "nonroot"
+
+# ── Security ───────────────────────────────────────────────────
+
+[security]
+non-root = true
+read-only-root = false
+no-new-privileges = true
+cap-drop = ["ALL"]
+seccomp-profile = "default"
+
+[security.signing]
+algorithm = "ML-DSA-87"
+provider = "cerro-torre"
+
+[security.sbom]
+format = "spdx-json"
+output = "sbom.spdx.json"
+include-deps = true
+
+# ── Verification ──────────────────────────────────────────────
+
+[verify]
+vordr = true
+svalinn = true
+scan-on-build = true
+fail-on = ["critical", "high"]
+
+# ── Targets ───────────────────────────────────────────────────
+
+[targets.development]
+description = "Full development environment"
+layers = ["base", "toolchain", "build"]
+env = { LOG_LEVEL = "debug" }
+
+[targets.production]
+description = "Production deployment"
+layers = ["runtime"]
+env = { LOG_LEVEL = "info" }
+
+[targets.test]
+description = "Test environment"
+layers = ["base", "toolchain", "build"]
+env = { LOG_LEVEL = "debug" }