chore(root): Justfile, CHANGELOG, .editorconfig, launcher (+ --agent), and the security contact update

.editorconfig

@@ -0,0 +1,42 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# Editor configuration for this repository. The Julia sources indent with four
+# spaces, the frontend with two, YAML with two, and every text file ends with
+# a newline and no trailing whitespace.
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.jl]
+indent_style = space
+indent_size = 4
+
+[*.{jl}]
+max_line_length = off
+
+[{*.ts,*.tsx,*.js,*.jsx,*.json,*.css,*.html}]
+indent_style = space
+indent_size = 2
+
+[{*.yml,*.yaml,*.kyaml}]
+indent_style = space
+indent_size = 2
+
+[*.md]
+indent_style = space
+indent_size = 2
+# Markdown's hard line breaks are two trailing spaces; keep them.
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab
+
+[Justfile]
+indent_style = space
+indent_size = 4

.github/SECURITY.md

@@ -60,7 +60,7 @@ in its `attestation.yml`.
 it enabled; the *Report a vulnerability* button on the Security tab reaches
 the maintainers privately. Use it.
 
-**By email:** contact **jjewell23@rvc.ac.uk** (Jonathan Jewell, the project
+**By email:** contact **developer@joshuajewell.dev** (Jonathan Jewell, the project
 owner) with `[security]` in the subject line.
 
 Include, where they apply:

.gitignore

@@ -323,6 +323,7 @@ archive/
 !.github
 !.github/**
 !.Rprofile
+!.editorconfig
 
 # Brainstorming visual-companion scratch (mock-ups, server state)
 .superpowers/

CHANGELOG.md

@@ -0,0 +1,14 @@
+<!--
+SPDX-License-Identifier: AGPL-3.0-only
+SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+-->
+
+# Changelog
+
+Release notes live under `docs/release-notes/`, one file per release:
+
+- [v0.1.0](docs/release-notes/v0.1.0.md)
+
+This file is the root index the RSR scheme expects; the notes themselves are
+kept where they have always been, and a new release adds a line here in the
+same commit that adds its file there.

Justfile

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# MetaManifold's task entry (RSR scheme: a thin Justfile at the root; the
+# heavy work lives in the commands it names). Every recipe delegates to the
+# repository's own documented entry points -- install.sh, start.sh, the test
+# runner -- so there is exactly one place where each of those is defined and
+# this file never re-implements them.
+
+# The default recipe lists what exists; `just --list` does the same.
+default:
+    @just --list
+
+# The documented installer: Julia (pinned), R, the external tools, the
+# frontend build. Extra args pass through to install.sh (--update,
+# --modify, --sysimage).
+install *ARGS:
+    bash install.sh {{ARGS}}
+
+# The documented server entry point. Serves the UI on port 8080.
+serve:
+    bash start.sh
+
+# The full unit suite. Name files to run a subset:
+#   just test test_install_pins.jl test_server_security.jl
+test *FILES:
+    julia --project=. test/runtests.jl {{FILES}}
+
+# The pin suite alone: toolchain pins, lockfile agreement, workflow shape,
+# and the root-shape allowlist.
+pins:
+    julia --project=. test/runtests.jl test_install_pins.jl
+
+# The Agda proof tree's audit (no postulates, no holes, everything reached
+# from All.agda). The type-check itself runs in CI's Agda proofs job.
+proofs:
+    bash proofs/tests/axiom-audit.sh
+
+# The frontend's own checks.
+frontend-test:
+    cd frontend && bun run test
+
+frontend-typecheck:
+    cd frontend && bun run typecheck
+
+frontend-build:
+    cd frontend && bun run build
+
+# The git-signing agent's state, as the launcher sees it.
+agent-status:
+    ./launcher.sh --agent status