Merge main into fix/absolute-zero-baseline-rot (round 2)

Take main for all 5 round-2 conflicts:
- 3 workflows (jekyll-gh-pages, language-policy, rust-ci): formatting drift only — take main's canonical headers.
- ROADMAP.adoc: take main's 727-line v12 version. Commit 83d51a2 documented this consolidation: 'promoted ROADMAP-V1-TO-V12 to be THE roadmap'. PR#42's branch was filed against the pre-consolidation sprint-checklist.
- ROADMAP-V1-TO-V12.adoc: deleted on main (its content is now in ROADMAP.adoc).

Follow-up known: ROADMAP.adoc carries PMPL-1.0-or-later SPDX; needs migration to MPL-2.0 to match LICENSE. Out of scope for this merge.

Author: hyperpolymath

.github/workflows/cflite_pr.yml

@@ -14,6 +14,9 @@ jobs:
       matrix:
         sanitizer: [address]
     steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build
         uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1

.github/workflows/deno-ci.yml

@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: MPL-2.0-or-later
+# Thin wrapper around the estate-wide reusable Deno CI bundle.
+# See: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml
+name: Deno CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  deno-ci:
+    uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@c3a62f0cfd993c23661519f571087ed16e13631c # standards#168 head

.github/workflows/governance.yml

@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@3ec2e85cc1d54ec2ab20a84fcba96e5008545925 # main 2026-05-25

.github/workflows/jekyll-gh-pages.yml

@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: MPL-2.0-or-later
+# Sample workflow for building and deploying a Jekyll site to GitHub Pages
+name: Deploy Jekyll with GitHub Pages dependencies preinstalled
+
+on:
+  # Runs on pushes targeting the default branch
+  push:
+    branches: ["main"]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
+# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  # Build job
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
+      - name: Build with Jekyll
+        uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1
+        with:
+          source: ./
+          destination: ./_site
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
+
+  # Deployment job
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/language-policy.yml

@@ -1,21 +1,20 @@
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: MPL-2.0-or-later
 name: Language Policy Enforcement
 on: [push, pull_request]
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Enforce language policies
         run: |
           # Block new Python files (except SaltStack)
           NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' | grep -v 'salt' || true)
           if [ -n "$NEW_PY" ]; then
-            echo "❌ New Python files detected. Use Rust or AffineScript instead."
+            echo "❌ New Python files detected. Use Rust or ReScript instead."
             echo "$NEW_PY"
             exit 1
           fi

.github/workflows/rust-ci.yml

@@ -1,57 +1,20 @@
 # SPDX-License-Identifier: MPL-2.0
+# Rust CI — thin wrapper calling the shared estate reusable in
+# hyperpolymath/standards. Configure once, propagate everywhere.
+# See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards.
 name: Rust CI
-on: [push, pull_request]
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
 
 permissions:
   contents: read
 
-env:
-  CARGO_TERM_COLOR: always
-  RUSTFLAGS: -Dwarnings
-
 jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
-      
-      - name: Check formatting
-        run: cargo fmt --all -- --check
-      
-      - name: Clippy lints
-        run: cargo clippy --all-targets --all-features -- -D warnings
-      
-      - name: Run tests
-        run: cargo test --all-features
-      
-      - name: Build release
-        run: cargo build --release
-
-  security:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Install cargo-audit
-        run: cargo install cargo-audit
-      - name: Security audit
-        run: cargo audit
-      - name: Check for outdated deps
-        run: cargo install cargo-outdated && cargo outdated --exit-code 1 || true
-
-  coverage:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Install tarpaulin
-        run: cargo install cargo-tarpaulin
-      - name: Generate coverage
-        run: cargo tarpaulin --out Xml
-      - uses: codecov/codecov-action@v6
-        with:
-          files: cobertura.xml
+  rust-ci:
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@4fdf4314b4ab54269adbaff10e30e483b5e86845
+    with:
+      enable_audit: true
+      enable_coverage: true

.well-known/ai.txt

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# AI agent discovery file for absolute-zero
+# See: https://github.com/hyperpolymath/absolute-zero/blob/main/0-AI-MANIFEST.a2ml
+
+User-Agent: *
+Manifest: /0-AI-MANIFEST.a2ml
+EntryPoint: /docs/CLAUDE.adoc
+State: /.machine_readable/6a2/STATE.a2ml
+Roadmap: /ROADMAP.adoc
+Allow: training-with-attribution
+Allow: documentation-summarisation
+Disallow: closed-source-redistribution
+License: PMPL-1.0-or-later
+Contact: developer@joshuajewell.dev

.well-known/humans.txt

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# humanstxt.org
+
+/* TEAM */
+Maintainer: Jonathan D. A. Jewell
+Contact: developer @ joshuajewell.dev
+Site: https://github.com/hyperpolymath/absolute-zero
+
+/* THANKS */
+Contributors: see git log + docs/MAINTAINERS.adoc
+
+/* SITE */
+Last update: 2026-05-25
+Standards: PMPL-1.0-or-later, RSR (Rhodium Standard Repository) compliant
+Components: Coq, Lean 4, Z3, Agda, Isabelle, Mizar, Idris2, ReScript, Rust

.well-known/security.txt

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+Contact: https://github.com/hyperpolymath/absolute-zero/security/advisories/new
+Expires: 2027-05-25T00:00:00Z
+Preferred-Languages: en
+Canonical: https://github.com/hyperpolymath/absolute-zero/.well-known/security.txt
+Policy: https://github.com/hyperpolymath/absolute-zero/blob/main/SECURITY.md

0-AI-MANIFEST.a2ml

@@ -0,0 +1,71 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# 0-AI-MANIFEST.a2ml — Absolute Zero AI assistant manifest
+# Schema: a2ml v1.0
+# Supersedes legacy AI.a2ml + AI.djot (deleted in repo tidy 2026-05-25)
+
+[metadata]
+project = "absolute-zero"
+repo = "github.com/hyperpolymath/absolute-zero"
+manifest-version = "1.0"
+last-updated = "2026-05-25"
+
+[scope]
+purpose = """
+  Formal verification of Certified Null Operations (CNOs) across multiple
+  proof systems (Coq, Lean 4, Z3, Agda, Isabelle, Mizar) plus an Idris2
+  ABI surface for FFI.
+"""
+
+[entry-points]
+# Where an AI agent should look first.
+root-context  = "docs/CLAUDE.adoc"
+project-state = ".machine_readable/6a2/STATE.a2ml"
+roadmap       = "ROADMAP.adoc"
+contributing  = "CONTRIBUTING.adoc"
+audit-trail   = "AUDIT.adoc"
+rsr-status    = "RSR_COMPLIANCE.adoc"
+
+[machine-readable]
+# Authoritative metadata artefacts; .a2ml format under 6a2/ supersedes
+# the older Guile-Scheme .scm format. Both kept side-by-side during the
+# migration window for legacy tooling compatibility.
+state     = ".machine_readable/6a2/STATE.a2ml"
+meta      = ".machine_readable/6a2/META.a2ml"
+ecosystem = ".machine_readable/6a2/ECOSYSTEM.a2ml"
+agentic   = ".machine_readable/6a2/AGENTIC.a2ml"
+neurosym  = ".machine_readable/6a2/NEUROSYM.a2ml"
+playbook  = ".machine_readable/6a2/PLAYBOOK.a2ml"
+
+legacy-scm-meta      = ".machine_readable/META.scm"
+legacy-scm-ecosystem = ".machine_readable/ECOSYSTEM.scm"
+legacy-scm-agentic   = ".machine_readable/AGENTIC.scm"
+legacy-scm-neurosym  = ".machine_readable/NEUROSYM.scm"
+legacy-scm-playbook  = ".machine_readable/PLAYBOOK.scm"
+
+[language-policy]
+# Single source of truth lives in docs/CLAUDE.adoc + .github/workflows/language-policy.yml.
+# Summary:
+allowed   = ["ReScript", "Deno", "Rust", "Tauri", "Dioxus", "Gleam", "Bash", "JavaScript (limited)", "Nickel", "Guile Scheme", "Julia", "OCaml", "Ada", "Idris2"]
+banned    = ["TypeScript", "Node.js", "npm", "Bun", "pnpm", "yarn", "Go", "Python", "Java", "Kotlin", "Swift", "React Native", "Flutter", "Dart", "Ruby", "Perl"]
+reference = "docs/CLAUDE.adoc#language-policy"
+
+[echidna-protocol]
+# All ECHIDNA invocations route through the echidna-llm-mcp BoJ cartridge.
+# Never call ECHIDNA directly.
+gateway = "boj-server/cartridges/echidna-llm-mcp"
+docs    = "docs/archive/ECHIDNA-2025-11-22.adoc"
+tools = [
+  "echidna_list_provers",
+  "echidna_prove",
+  "echidna_verify",
+  "echidna_verify_raw",
+  "echidna_suggest",
+  "echidna_suggest_tactics",
+  "echidna_search",
+  "echidna_session_create",
+]
+
+[delivery]
+commit-policy = "conventional commits; never amend published commits"
+state-update  = "update .machine_readable/6a2/STATE.a2ml whenever phase/progress changes"
+adr-tracking  = "architectural changes recorded in .machine_readable/META.scm `architecture-decisions`"