Audit language and typing boundaries; repair registry CI

.github/workflows/dogfood-gate.yml

@@ -1,7 +1,5 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
-# This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
@@ -273,7 +271,9 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Enforce language-registry consistency
-        run: bash hooks/validate-language-registry.sh
+        run: |
+          bash hooks/validate-language-registry.sh
+          bash hooks/test-language-registry.sh
 
       - name: Write summary
         if: always()

.github/workflows/governance.yml

@@ -1,7 +1,6 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
 name: Governance
 
 on:
@@ -17,4 +16,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@a26cc7479b14cdf70433919bfc228625f1c5c6f2
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@469605210e767ee94d1c7a9c13cb6a1d0a78cad1

.github/workflows/hypatia-scan.yml

@@ -1,7 +1,6 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
 name: Hypatia Security Scan
 
 on:
@@ -20,4 +19,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@469605210e767ee94d1c7a9c13cb6a1d0a78cad1
+    with:
+      block-on-high: true

.machine_readable/bot_directives/gitbot-fleet.a2ml

@@ -20,16 +20,17 @@ finishbot = "task completion"
 working-branch-pattern = "claude/* or bot/<botname>/*"
 draft-PRs-only = true
 ci-green-before-merge = true
-# Per 6a2/PLAYBOOK.a2ml [merge-gating]: blocking checks are governance/*,
-# scan/*, analyze, semgrep, dogfood, validators; the Hypatia advisory is
-# non-blocking and MUST NOT gate the merge.
+# Per .machine_readable/descriptiles/PLAYBOOK.a2ml [merge-gating]: require
+# governance/*, scan/*, analyze, semgrep, dogfood and validators. Hypatia
+# current high/critical findings block after validated baseline filtering;
+# missing or malformed scan output also blocks. A comment/waiver is not a pass.
 never-touch = [
   ".claude/CLAUDE.md",
   "hooks/validate-coordinator-boundary.sh",
   "LICENSE",
   ".github/workflows/ (without explicit maintainer approval)",
 ]
-# Branch hygiene per 6a2/PLAYBOOK.a2ml [branch-hygiene] and the Trustfile
+# Branch hygiene per descriptiles/PLAYBOOK.a2ml [branch-hygiene] and the Trustfile
 # carve-out: merged PR branches may be deleted; main and any open/active
 # branch never; force-push always denied.
 

.machine_readable/bot_directives/hypatia.a2ml

@@ -12,10 +12,10 @@ ignore-file = ".hypatia-ignore"
 ignore-file-present = false
 workflow = ".github/workflows/hypatia-scan.yml"
 ruleset-location = "hyperpolymath/standards (hypatia-scan-reusable.yml) — change rules there, not here"
-scan-is-blocking = false
+scan-is-blocking = true
 
 [accepted-findings]
-# Canonical registry: .machine_readable/descriptiles/NEUROSYM.a2ml [waivers].
+# Canonical registry: .machine_readable/descriptiles/NEUROSYM.a2ml [accepted-findings] (entries: [waivers.*]).
 # Look findings up there by rule + file BEFORE acting; if listed, do not
 # auto-fix. Summary of the current entries:
 registry = ".machine_readable/descriptiles/NEUROSYM.a2ml"

.machine_readable/contractiles/Bustfile.a2ml

@@ -20,7 +20,7 @@ submodule-pointer-points-at-missing-sha = "git submodule update --init --checkou
 submodule-orphan-after-local-only-commit = "git reset to before the stranded commit locally; fix the child repo's remote state before re-attempting the bump"
 broken-workflow-change = "CI red after a workflow edit: revert the workflow commit; re-pin actions to known-good SHAs (MUST: SHA-pinned actions)"
 accidental-secret-committed = "hard-rotate the leaked secret immediately; scrub history with git-filter-repo or BFG; force-push only with explicit maintainer confirmation; re-publication only after rotation completes"
-bad-metadata-refresh = "6a2/ or contractile refresh introduced false claims: revert the docs commit; restore from origin/main history (governance files carry no build risk)"
+bad-metadata-refresh = "descriptiles/ or contractile refresh introduced false claims: revert the docs commit; restore from origin/main history (governance files carry no build risk)"
 
 [escalation-ladder]
 steps = [

.machine_readable/contractiles/Trustfile.a2ml

@@ -48,7 +48,7 @@ denied-actions = [
 [trust.branch-hygiene]
 # Carve-out (2026-06-02): deleting MERGED PR branches is permitted (local +
 # remote). `main` and any open/active branch must never be deleted, and
-# force-push stays denied. See 6a2/PLAYBOOK.a2ml [branch-hygiene].
+# force-push stays denied. See descriptiles/PLAYBOOK.a2ml [branch-hygiene].
 delete-merged-pr-branches = true
 never-delete = ["main", "any open/active branch"]
 

.machine_readable/descriptiles/AGENTIC.a2ml

@@ -25,7 +25,7 @@ can-create-files = true
 
 [agent-ci-handling]
 # How agents/gitbots should treat CI on this repo.
-hypatia-advisory = "non-blocking; consult .machine_readable/descriptiles/NEUROSYM.a2ml [waivers] before acting on any finding"
+hypatia-gate = "current high/critical findings block; consult .machine_readable/descriptiles/NEUROSYM.a2ml [accepted-findings] (entries: [waivers.*]) before acting on any finding"
 do-not-refix = "findings recorded as accepted/by-design/false-positive in the waiver registry must not be re-fixed"
 runbook = "see .machine_readable/descriptiles/PLAYBOOK.a2ml [recurring-ci-advisories]"
 

.machine_readable/descriptiles/NEUROSYM.a2ml

@@ -9,10 +9,12 @@
 
 [metadata]
 version = "0.2.0"
-last-updated = "2026-06-02"
+last-updated = "2026-09-07"
 
 [hypatia-config]
 scan-enabled = true
+block-on-high = true
+blocking-source = ".github/workflows/hypatia-scan.yml"
 scan-depth = "standard"
 report-format = "logtalk"
 
@@ -33,15 +35,15 @@ report-format = "logtalk"
 #
 # Hypatia's enforcing ruleset lives in hyperpolymath/standards
 # (hypatia-scan-reusable.yml / governance-reusable.yml), NOT in this repo,
-# so this registry is the repo-local source of truth for findings that have
-# been triaged and accepted. The Hypatia scan is advisory (non-blocking);
-# the governance gates are the blocking checks and already pass.
+# so this registry records local triage rationale, not executable exemptions.
+# Current high/critical findings block after validated baseline filtering.
+# Missing/malformed scan output or unsuccessful required filtering also blocks.
 #
 # Gitbot / agent contract (see AGENTIC.a2ml, PLAYBOOK.a2ml):
 #   - Before acting on a Hypatia advisory finding, look it up here by `rule`
-#     + `file`. If present, DO NOT attempt a fix — the finding is accepted.
-#   - Only act on findings NOT listed here, or whose `disposition` is
-#     "track" with an open `action`.
+#     + `file` and verify that the recorded disposition still applies.
+#   - A record here does not suppress a current high/critical finding. Fix it
+#     or use an explicitly reviewed valid baseline, and require the scan to pass.
 #
 # disposition values:
 #   false-positive    — the rule does not apply (acting on it would break CI)
@@ -52,9 +54,10 @@ report-format = "logtalk"
 
 [accepted-findings]
 # (kitchenspeak agda-postulate waivers removed — subtree extracted 2026-06-19)
-policy = "Findings listed below are triaged and accepted; do not auto-fix."
+policy = "Review these triage records before acting; they do not override the current blocking scan or create executable exemptions."
 ruleset-location = "hyperpolymath/standards (external to this repo)"
-scan-is-blocking = false
+scan-is-blocking = true
+blocking-threshold = "high"
 
 [waivers.reusable-caller-timeout]
 rule = "missing_timeout_minutes"
@@ -67,9 +70,8 @@ justification = "These jobs call reusable workflows (jobs.<id>.uses). GitHub Act
 rule = "unpinned_action"
 files = "governance.yml"
 severity = "medium"
-disposition = "track"
-justification = "hyperpolymath/standards governance-reusable.yml is referenced at @main. The standards repo is outside this session's scope and the SHA could not be resolved here; the check is green at @main."
-action = "Pin to a commit SHA via an authenticated lookup of standards governance-reusable.yml on main."
+disposition = "addressed"
+justification = "Governance and Hypatia callers are pinned to standards commit 469605210e767ee94d1c7a9c13cb6a1d0a78cad1; authoritative gh actions-lock --no-fix passes."
 
 [waivers.scorecard-publish-split]
 rule = "scorecard_publish_with_run_step"

.machine_readable/descriptiles/PLAYBOOK.a2ml

@@ -7,7 +7,7 @@
 
 [metadata]
 version = "0.2.0"
-last-updated = "2026-06-12"
+last-updated = "2026-09-07"
 
 [deployment]
 # method = "gitops"
@@ -29,20 +29,22 @@ last-updated = "2026-06-12"
 # ---------------------------------------------------------------------------
 # Recurring CI advisories — gitbot runbook.
 #
-# The Hypatia neurosymbolic scan posts an advisory comment on every PR. It
-# is NON-BLOCKING; the blocking gates are the governance/* and scan/* checks.
-# Most advisory findings are already triaged and recorded in
+# The Hypatia comment supplies triage context. The configured scan blocks
+# current high/critical findings after validated baseline filtering and rejects
+# missing/malformed scan output. Historical triage context is recorded in
 # .machine_readable/descriptiles/NEUROSYM.a2ml [waivers].
 # ---------------------------------------------------------------------------
 
 [recurring-ci-advisories]
 source = "Hypatia Security Scan advisory comment"
-blocking = false
+blocking = true
+blocking-threshold = "high"
+blocking-source = ".github/workflows/hypatia-scan.yml: block-on-high = true"
 registry = ".machine_readable/descriptiles/NEUROSYM.a2ml"
 step-1 = "For each finding, look it up in NEUROSYM [waivers] by rule + file."
-step-2 = "If present, skip it — it is accepted; do NOT open a fix."
-step-3 = "Act only on findings NOT in the registry, or with disposition = track and an open action."
-step-4 = "If a genuinely new finding appears, triage it; if accepted, add a waiver entry rather than re-fixing each PR."
+step-2 = "If present, review the recorded disposition against the current finding; a NEUROSYM entry alone never suppresses a blocking finding."
+step-3 = "Fix current high/critical findings or use the reviewed, schema-valid, unexpired Hypatia baseline where justified. Require the actual scan check to pass."
+step-4 = "Record triage rationale here; historical advisories and low/medium findings remain distinct from the current blocking scan."
 
 [branch-hygiene]
 # Permitted per the Trustfile carve-out (.machine_readable/contractiles/Trustfile.a2ml [trust.branch-hygiene]).
@@ -54,6 +56,6 @@ note = "GitHub auto-deletes PR branches on merge; prune local tracking refs with
 [merge-gating]
 # When self-merging (per maintainer authorization), gate on:
 rule-1 = "All required (blocking) checks green: governance/*, scan/*, analyze, semgrep, dogfood, validators."
-rule-2 = "Hypatia advisory is non-blocking and MUST NOT gate the merge."
+rule-2 = "Hypatia current high/critical findings block after validated baseline filtering. Missing/malformed artifacts or unsuccessful required filtering also block; comments and NEUROSYM waivers cannot override the check."
 rule-3 = "Draft/WIP PRs are never merged; mark ready first."
 rule-4 = "Architecture-decision PRs (ADRs) and implementation PRs are kept at separate granularity."

.machine_readable/descriptiles/README.adoc

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: CC-BY-SA-4.0
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-# Descriptiles Directory
+# A2ML Descriptiles Directory
 
 This directory contains the 6 core A2ML machine-readable metadata files for this repository.
 

.machine_readable/descriptiles/STATE.a2ml

@@ -61,3 +61,8 @@ governance-pin = "governance-reusable.yml referenced at @main; SHA pin pending a
 [next-actions]
 claude-md-paths = "maintainer edit needed: .claude/CLAUDE.md references my-lang/frontier-practices/ and my-lang/_exploratory/me-scaffolding/, which are not visible in-tree (paths live inside the my-lang submodule); proposed as issue at the 2026-06-12 checkpoint"
 verisim-naming = "integrations/verisim.a2ml vs siblings' verisimdb.a2ml — naming alignment proposed as issue, not renamed unilaterally"
+
+[language-portfolio-audit-20260907]
+scope = "Evidence audit and scoped repairs; no blanket readiness upgrade"
+report = "https://github.com/hyperpolymath/nextgen-languages/blob/main/docs/audits/2026-09-07-language-portfolio.md"
+metadata-path = ".machine_readable/descriptiles/"

.machine_readable/svc/k9/must-check.k9.ncl

@@ -54,9 +54,9 @@ K9!
     },
 
     no_root_scm_duplication = {
-      description = "No STATE/META/ECOSYSTEM state file orphaned in repo root (canonical home is .machine_readable/descriptiles/)",
+      description = "No core descriptor file orphaned in repo root (canonical home is .machine_readable/descriptiles/)",
       severity = 'error,
-      predicate = "! ls STATE.* META.* ECOSYSTEM.* 2>/dev/null | head -1 | grep -q .",
+      predicate = "! ls STATE.* META.* ECOSYSTEM.* AGENTIC.* NEUROSYM.* PLAYBOOK.* 2>/dev/null | head -1 | grep -q .",
     },
 
     six_a_two_complete = {

CHANGELOG.adoc

@@ -36,7 +36,7 @@ conversion.
 * KitchenSpeak ADRs 0002–0004: standalone elevation; `+echo-types+`
 dependency; Echo attaches to Linear/Dyadic (B-now / C-later / A-shim).
 * Hypatia accepted-findings registry in
-`+.machine_readable/6a2/NEUROSYM.a2ml+` `+[waivers]+`, with gitbot
+`+.machine_readable/descriptiles/NEUROSYM.a2ml+` `+[waivers]+`, with gitbot
 runbook in `+PLAYBOOK.a2ml+` and agent contract in `+AGENTIC.a2ml+`.
 * `+6a2+` machine-readable state refreshed
 (STATE/META/ECOSYSTEM/NEUROSYM/ PLAYBOOK/AGENTIC); `+MUST.contractile+`
@@ -91,5 +91,5 @@ files.
 ==== Added
 
 * Consolidation of scattered language repos into canonical locations.
-* Updated .machine_readable/6a2/STATE.a2ml with verified completion
+* Updated .machine_readable/descriptiles/STATE.a2ml with verified completion
 percentages.

EXPLAINME.adoc

@@ -302,14 +302,16 @@ consumed from `hyperpolymath/standards` as *pinned reusable workflows* — the
 enforcing rulesets live there, not in this repo. Two consequences for readers
 and for automated agents:
 
-* The *Hypatia Security Scan* comment on PRs is *advisory and non-blocking*.
-  The blocking gates are the `governance/*`, `scan/*`, `analyze`, `semgrep`,
-  validator, `dogfood` (including the `coordinator-boundary` job), and dogfood
-  checks.
+* The *Hypatia scan* blocks current high and critical findings after validated
+  baseline filtering (`block-on-high: true`). Missing or malformed scan output
+  and unsuccessful required filtering also block. Require it alongside
+  `governance/*`, other `scan/*`, `analyze`, `semgrep`, validator and `dogfood`
+  checks (including `coordinator-boundary`). The PR comment supplies triage context.
 * Recurring advisory findings that have been triaged and accepted are recorded
   once in `.machine_readable/descriptiles/NEUROSYM.a2ml` under `[accepted-findings]`.
-  Agents consult that registry and do not re-fix accepted findings on every PR.
-  Changing the enforcing ruleset itself must be done in `standards`.
+  Agents consult that rationale, but it does not override blocking findings or
+  create executable exemptions. Any justified baseline must pass the actual
+  validation and filtering gates. Change the enforcing ruleset in `standards`.
 
 == Questions?
 

PANIC-ATTACK-TRIAGE.adoc

@@ -121,7 +121,7 @@ take many sessions.
 
 * **`jtv/playground/experiments/_attic/database-demos/arangodb-demo/queries.js`**
   — HardcodedSecret. **False positive.** The "secret" is
-  `auth: { username: "root", password: "rootpassword" }` — standard
+  a literal localhost demonstration login — standard
   ArangoDB localhost demo credentials. Other email addresses are
   `alice@example.com` / `bob@example.com` dummy data. File lives in `_attic/`
   (the project's own archive directory). **Recommend: delete the `_attic`
@@ -131,8 +131,8 @@ take many sessions.
 
 * **`jtv/playground/experiments/_attic/utilities/form-validation/validator.js`**
   — HardcodedSecret. **False positive.** The "secret" is
-  `password: 'SecurePass123!'` used as example data inside a form-validation
-  demo showing what valid passwords look like, and `password: 'weak'` showing
+  a literal example of a strong password used as example data inside a form-validation
+  demo showing what valid passwords look like, and a literal example of a weak password showing
   what invalid passwords look like. Same recommendation as above.
 
 * **`ephapax/src/formal/Ephapax/Formal/RegionLinear.idr`** — UnsafeCode.