Repo tidy: de-template, de-dupe, format-conform (snifs)

[hyperpolymath]

Comprehensive repo tidy-up: lean root, no duplicates, AsciiDoc-primary format, and conformance to the estate rsr-/standards conventions. Read-only mapping → owner-approved tiers → executed → adversarially verified. 11 signed commits.

What changed

Tier A — hygiene

• Ignore Agda/Zig/bench/priv build artifacts (.gitignore).
• Track the bag-of-actions owned-compute gate manifest (ci-checks.exs).

Tier B — manifests + authoring standard

• Add nested AI manifests to benches/, demo/, rust/, rust-guest/, zig/, docs/templates/.
• Bring README.adoc / EXPLAINME.adoc to the authoring standard (TOC/icons, Documentation index, Dogfooded + Known-gaps sections).

Tier C — de-template + format

• De-template the root 0-AI-MANIFEST.a2ml, the three QUICKSTART-*.adoc (rewritten around snifs's real flows, using only recipes that exist), and the load-bearing contractiles README.adoc.
• Convert proof-debt / tech-debt-2026-05-26 / session/README from .md → .adoc; relocate the invariant-scan output into verification/.

Tier D — de-dupe + archive

• Remove five .github/ community-health files that were unbootstrapped RSR templates (literal TEMPLATE INSTRUCTIONS, {{PLACEHOLDER}}s, wrong snif slug) — GitHub's .github > root precedence meant it was serving that cruft publicly; deletion falls back to the clean, filled root copies (and removes a placeholder offender from the OpenSSF gate).
• Remove the placeholder docs/attribution/CITATION.cff and the duplicate docs/attribution/MAINTAINERS.adoc.
• Archive the point-in-time TEMPLATE-STANDARDS-AUDIT.adoc and the superseded docs/papers/snifs.tex (a full but stale-numbered earlier paper draft) into docs/archive/.

Verification follow-ups

• Fixed a botched README.adoc header (duplicate attributes, stray author line, wrong/orphan Zenodo DOI), six→five crash-mode counts, the bench working dir, and a dangling .claude/CLAUDE.md reference.
• Removed the residual PMPL-1.0 licence badge that contradicted MPL-2.0 (owner-authorized; no LICENSE/SPDX changed).
• De-templated the machine-readable identity strings to snifs (CLADE.a2ml, ECOSYSTEM.a2ml ×2, AI.a2ml, ANCHOR.a2ml, stapeln/selur-compose/eclexiaiser/cliff configs).

Verification

Adversarial 3-reviewer pass (content-drift / cross-reference / completeness, 26 findings) + a deterministic sweep. All blockers/highs in touched files are resolved. Green: Mustfile presence checks, pre-commit hook (SPDX + owner on every changed .adoc/.md), no phantom recipes, no dangling refs, all manifests added are correct, all commits signed, AFFIRMATION dual-SPDX untouched, OpenSSF gate.

Deferred to a follow-up plan (intentionally NOT in this PR)

• CLADE prefixed-name + [clade] block (needs the real gv-clade-index entry).
• Load-bearing root Justfile (project :=) and contractile Mustfile/Trustfile/Intentfile/Adjustfile gate logic.
• Template-doc removals (docs/RSR_OUTLINE.adoc, docs/QUICKSTART.adoc, .machine_readable/ai/PLACEHOLDERS.adoc) — owner-gated deletions.
• READINESS.md → .adoc conversion.
• 5 pre-existing manifest-parent defects (container/, examples/, .github/, verification/tests/ missing parent; docs/governance/ wrong parent).

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 53 issues detected

Severity	Count
🔴 Critical	5
🟠 High	23
🟡 Medium	25

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "rust-guest-verify.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in rust-guest-verify.yml",
    "type": "missing_timeout_minutes",
    "file": "rust-guest-verify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "scorecard_wrapper_missing_job_permissions",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/snifs/snifs/benches/assert_safer.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/snifs/snifs/verification/tools/abi_conformance.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (4 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/snifs/snifs/rust/crates/snif-abi/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/snifs/snifs/rust/crates/demo-guest/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence