Fix/tooling gaps 20260521 (#40)

<!--
SPDX-License-Identifier: CC-BY-SA-4.0
Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-->
## Summary

<!-- Briefly describe what this PR does and why. Link to related issues
with "Closes #N". -->

## Changes

<!-- List the key changes introduced by this PR. -->

-

## RSR Quality Checklist

<!-- Check all that apply. PRs that fail required checks will not be
merged. -->

### Required

- [ ] Tests pass (`just test` or equivalent)
- [ ] Code is formatted (`just fmt` or equivalent)
- [ ] Linter is clean (no new warnings or errors)
- [ ] No banned language patterns (no TypeScript, no npm/bun, no
Go/Python)
- [ ] No `unsafe` blocks without `// SAFETY:` comments
- [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`,
`Admitted`, `sorry`)
- [ ] SPDX license headers present on all new/modified source files
- [ ] No secrets, credentials, or `.env` files included

### As Applicable

- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed)
- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations
changed)
- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions
changed)
- [ ] Documentation updated for user-facing changes
- [ ] `TOPOLOGY.md` updated (if architecture changed)
- [ ] `CHANGELOG` or release notes updated
- [ ] New dependencies reviewed for license compatibility
(PMPL-1.0-or-later / MPL-2.0)
- [ ] ABI/FFI changes validated (`src/interface/abi/` and
`src/interface/ffi/` consistent)

## Testing

<!-- Describe how you tested these changes. -->

## Screenshots

<!-- If applicable, add screenshots or terminal output demonstrating the
change. -->

---------

Co-authored-by: Mistral Vibe <vibe@mistral.ai>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -0,0 +1,40 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
+# CLAUDE.md - AI Assistant Instructions
+
+## Machine-Readable Artefacts
+
+This repo follows the hyperpolymath standard. See `https://github.com/hyperpolymath/standards` for the canonical 6-file `.machine_readable/` layout (STATE/META/ECOSYSTEM/AGENTIC/NEUROSYM/PLAYBOOK in A2ML format).
+
+---
+
+## Language Policy (Hyperpolymath Standard)
+
+The full policy is canonical in `hyperpolymath/standards`. Key points:
+
+- **AffineScript** - Primary application code (compiles to typed-wasm)
+- **Deno** - Runtime & package management (replaces Node/npm/bun)
+- **Rust/SPARK** - Performance-critical, systems, WASM, CLI tools
+- **Zig** - FFI layer, memory-safe systems
+- **Idris2** - Formal verification
+- **Agda** - Formal verification (foundational)
+- **Tauri 2.0+** / **Dioxus** - Mobile apps
+- **Gleam** / **Elixir** - Backend services
+- **Haskell** - Type-heavy tools
+- **Bash/POSIX Shell** - Scripts, automation (keep minimal)
+- **JavaScript** - Only where AffineScript cannot
+- **Nickel** - Configuration language
+- **A2ML** - State/meta files
+
+### BANNED
+- TypeScript (use AffineScript)
+- Node.js (use Deno)
+- Go (use Rust)
+- Python (general, except SaltStack)
+- Java/Kotlin/Swift (use Rust/Tauri/Dioxus)
+
+### Documentation Format
+- All docs `.adoc` (AsciiDoc) except GitHub-required files (SECURITY.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, CHANGELOG.md).
+

.claude/PROJECT.md

@@ -0,0 +1,37 @@
+<!--
+SPDX-License-Identifier: MPL-2.0
+Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
+# Jaffascript - Claude Code Instructions
+
+This repository contains the Jaffascript project.
+
+## Project Structure
+
+```
+jaffascript/
+├── .claude/         # AI assistant instructions
+├── .git/           # Version control
+├── .gitignore      # Git ignore rules
+├── .editorconfig   # Editor configuration
+└── ...             # Project files
+```
+
+## Build Commands
+
+Refer to project-specific documentation.
+
+## Coding Conventions
+
+- Follow hyperpolymath standards
+- All code must have SPDX license headers
+- Use approved languages only (see CLAUDE.md)
+- Document all non-obvious decisions
+
+## Security
+
+- No hardcoded secrets
+- All secrets through environment variables or secret management
+- SHA-pinned dependencies where applicable
+- HTTPS only, no HTTP URLs
+- No MD5/SHA1 for security purposes

.claude/settings.json

@@ -0,0 +1,2 @@
+# jaffascript development configuration
+{}

.devcontainer/Containerfile

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>
 #
 # Dev Container image for {{PROJECT_NAME}}

.devcontainer/README.adoc

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: CC-BY-SA-4.0
+// SPDX-License-Identifier: MPL-2.0
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = Dev Container Usage
 :author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>

.devcontainer/devcontainer.json

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: PMPL-1.0-or-later
 // Copyright (c) {{CURRENT_YEAR}} Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 //
 // Dev Container configuration for {{PROJECT_NAME}}

.editorconfig

@@ -63,3 +63,6 @@ indent_size = 2
 indent_style = space
 indent_size = 4
 
+[justfile]
+indent_style = space
+indent_size = 4

.gitattributes

@@ -19,6 +19,7 @@
 *.a2ml  text eol=lf linguist-language=TOML
 *.ncl   text eol=lf
 *.nix   text eol=lf
+*.zig   text eol=lf
 
 # Docs
 *.md    text eol=lf diff=markdown
@@ -34,7 +35,9 @@
 # Config
 .gitignore     text eol=lf
 .gitattributes text eol=lf
-Justfile       text eol=lf
+.editorconfig  text eol=lf
+.tool-versions text eol=lf
+justfile       text eol=lf
 Makefile       text eol=lf
 Containerfile  text eol=lf
 

.github/CODEOWNERS

@@ -1,14 +1,34 @@
 # SPDX-License-Identifier: MPL-2.0
-# CODEOWNERS - Define code review assignments
+# CODEOWNERS - Define code review assignments for GitHub
 # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-#
-# Replace {{OWNER}} with your GitHub username or team
 
-# Default owners for everything
-* @{{OWNER}}
+# Default: sole maintainer for all files
+* @hyperpolymath
 
-# Security-sensitive files require explicit review
-SECURITY.md @{{OWNER}}
-.github/workflows/ @{{OWNER}}
-Trustfile.a2ml @{{OWNER}}
-.machine_readable/ @{{OWNER}}
+# Security-sensitive files require explicit ownership
+SECURITY.md @hyperpolymath
+.github/workflows/ @hyperpolymath
+.machine_readable/ @hyperpolymath
+contractiles/ @hyperpolymath
+
+# License files
+LICENSE @hyperpolymath
+LICENSES/ @hyperpolymath
+
+# Configuration
+.gitignore @hyperpolymath
+.github/ @hyperpolymath
+
+# Documentation
+README* @hyperpolymath
+CONTRIBUTING* @hyperpolymath
+CODE_OF_CONDUCT* @hyperpolymath
+GOVERNANCE* @hyperpolymath
+MAINTAINERS* @hyperpolymath
+CHANGELOG* @hyperpolymath
+ROADMAP* @hyperpolymath
+
+# Build and CI
+Justfile @hyperpolymath
+Makefile @hyperpolymath
+*.sh @hyperpolymath

.github/workflows/governance.yml

@@ -1,34 +1,16 @@
-# SPDX-License-Identifier: MPL-2.0
-# governance.yml — single wrapper calling the shared estate governance bundle
-# in hyperpolymath/standards instead of carrying per-repo copies.
-#
-# Replaces the per-repo governance scaffolding removed in the same commit:
-#   quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml,
-#   security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml,
-#   workflow-linter.yml
-#
-# Load-bearing build/security workflows stay standalone in the repo
-# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
-
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Governance
 
 on:
   push:
     branches: [main, master]
   pull_request:
+    branches: [main, master]
   workflow_dispatch:
 
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910