feat(rsr): capability-gated template-applicability policy (presets + gates)

[hyperpolymath]

Summary

Formalises which parts of rsr-template-repo a repo should carry, replacing "every repo looks like the full template" with a capability-gated rule + a test. Addresses the over-scaffolding that check-root-shape.sh + root-allow.txt currently bake in (they list abi.ipkg, verification/, container/, affinescript/ as canonical for every repo).

Model — hybrid presets + gates

• Universal baseline (identity, community-health, machine-readable state, the licence invariant) — always carried.
• Capability gates — every other module is tagged with the capability it serves; a repo carries it iff it declares that capability.
• Presets (rust-cli, rust-ffi-lib, rust-service, formal-proof-lib, docs-site, affinescript-app) are named capability bundles a profile adopts, then adjusts with add/remove.

The test: carries(M) ⟺ M ∈ baseline ∨ gate(M) ⊆ profile.capabilities.

• VESTIGIAL = present without the gating capability → remove or declare it.
• MISSING = capability declared but module absent → add it.

Key distinction baked in: consuming a prover (e.g. shelling out to Agda) is not the formal-proofs capability — only containing in-tree proofs is. That's precisely why a tool like arghda-core shouldn't carry verification/proofs/.

Files

• TEMPLATE-APPLICABILITY-POLICY.adoc — the human policy (taxonomy, gate table, presets, the test, the per-repo profile, how it evolves root-allow.txt).
• .machine_readable/template-capability-gates.toml — machine-readable source of truth.
• scripts/check-rsr-profile.sh — reference checker (reads a repo's rsr-profile.a2ml, resolves effective capabilities, reports VESTIGIAL/MISSING).

Validation

Ran the checker against arghda-core (preset = rust-cli): OK. Planting a stray abi.ipkg + container/ is correctly flagged VESTIGIAL (exit 1). arghda-core's companion rsr-profile.a2ml is a separate PR on hyperpolymath/arghda-core.

Status

DRAFT, first pass per the agreed scope. Follow-ups: fold effective-allowlist(repo) into check-root-shape.sh/validate-template.sh; confirm the governance-tier boundary (which repos must carry the full AUDIT/AFFIRMATION/GOVERNANCE/MAINTAINERS trio); enumerate remaining maximal-template modules into the gate table.

🤖 Generated with Claude Code

https://claude.ai/code/session_019GiSiEfgZCte35dyykgBHs

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 148 issues detected

Severity	Count
🔴 Critical	60
🟠 High	75
🟡 Medium	13

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": ".github/workflows/scorecard.yml",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/scripts/check-ts-allowlist.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (5 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/avow-protocol/public/demo.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/axel-protocol/src/Tea.res.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "HTTP URL in Nickel config -- must use HTTPS (1 occurrences, CWE-319)",
    "type": "ncl_http_url",
    "file": "/home/runner/work/standards/standards/k9-svc/register.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence