You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 4d0faed
Browse filesBrowse the repository at this point in the historyBrowse files
policy: Bun is tier 1, Deno is being removed (#195)
Bun becomes the tier 1 JS runtime and package manager; Deno is removed rather
than grandfathered, per the owner ruling of 2026-08-26.
Two static-analysis findings were addressed before merge:
- ReScript was absent from the BANNED table although canon bans it
(destination AffineScript), so the table read as permitting it.
- Enforcement Rule 3 said `bun install --production` with no
`--frozen-lockfile`, so a lockfile mismatch silently re-resolved instead of
failing, defeating the point of committing bun.lock.
Enforcement Rule 1 is deliberately untouched: standards#655 records that
collision as not resolvable unilaterally.
Verified before merge: the failing checks on these PRs are repo-specific CI
(cargo/clippy, shell lint, K9 contract and A2ML manifest validators, build) that
a Markdown policy file cannot reach, and they fail on main independently.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|**AffineScript**| Primary application code | Affine-typed, compiles to typed-wasm or ESM |
23
+
|**Bun**|JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns.|
24
24
|**Rust**| Performance-critical, systems, WASM | Preferred for CLI tools |
25
25
|**Tauri 2.0+**| Mobile apps (iOS/Android) | Rust backend + web UI |
26
26
|**Dioxus**| Mobile apps (native UI) | Pure Rust, React-like |
27
27
|**Gleam**| Backend services | Runs on BEAM or compiles to JS |
|**Bun**|JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns.|
24
24
|**Rust**| Performance-critical, systems, WASM | Preferred for CLI tools |
25
25
|**Tauri 2.0+**| Mobile apps (iOS/Android) | Rust backend + web UI |
26
26
|**Dioxus**| Mobile apps (native UI) | Pure Rust, React-like |
27
27
|**Gleam**| Backend services | Runs on BEAM or compiles to JS |
|**Julia**| Batch scripts, data processing | Per RSR |
@@ -38,10 +38,10 @@ The following files in `.machine_readable/` contain structured project metadata:
38
38
| Banned | Replacement |
39
39
|--------|-------------|
40
40
| TypeScript | ReScript |
41
-
|Node.js|Deno|
42
-
|npm|Deno|
43
-
|Bun|Deno|
44
-
| pnpm/yarn |Deno|
41
+
|Deno|Bun|
42
+
|Node.js|Bun|
43
+
|npm|Bun|
44
+
| pnpm/yarn |Bun|
45
45
| Go | Rust |
46
46
| Python | Julia/Rust/AffineScript |
47
47
| Java/Kotlin | Rust/Tauri/Dioxus |
@@ -60,9 +60,9 @@ Both are FOSS with independent governance (no Big Tech).
60
60
61
61
### Enforcement Rules
62
62
63
-
1.**No new TypeScript files** - Convert existing TS to ReScript
64
-
2.**No package.jsonfor runtime deps** - Use deno.json imports
65
-
3.**No node_modules in production** - Deno caches deps automatically
63
+
1.**No new TypeScript files** - Convert existing TS to AffineScript
64
+
2.**Use `package.json` + `bun.lock`for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
65
+
3.**`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock`
66
66
4.**No Go code** - Use Rust instead
67
67
5.**No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps
68
68
6.**No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
@@ -71,7 +71,7 @@ Both are FOSS with independent governance (no Big Tech).
71
71
72
72
-**Primary**: Guix (guix.scm)
73
73
-**Fallback**: Nix (flake.nix)
74
-
-**JS deps**: Deno (deno.json imports)
74
+
-**JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
|**Bun**|JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns.|
24
24
|**Rust**| Performance-critical, systems, WASM | Preferred for CLI tools |
25
25
|**Tauri 2.0+**| Mobile apps (iOS/Android) | Rust backend + web UI |
26
26
|**Dioxus**| Mobile apps (native UI) | Pure Rust, React-like |
27
27
|**Gleam**| Backend services | Runs on BEAM or compiles to JS |
@@ -39,10 +39,10 @@ The following files in `.machine_readable/` contain structured project metadata:
39
39
| Banned | Replacement |
40
40
|--------|-------------|
41
41
| TypeScript | ReScript |
42
-
|Node.js|Deno|
43
-
|npm|Deno|
44
-
|Bun|Deno|
45
-
| pnpm/yarn |Deno|
42
+
|Deno|Bun|
43
+
|Node.js|Bun|
44
+
|npm|Bun|
45
+
| pnpm/yarn |Bun|
46
46
| Go | Rust |
47
47
| Python (general) | ReScript/Rust |
48
48
| Java/Kotlin | Rust/Tauri/Dioxus |
@@ -61,9 +61,9 @@ Both are FOSS with independent governance (no Big Tech).
61
61
62
62
### Enforcement Rules
63
63
64
-
1.**No new TypeScript files** - Convert existing TS to ReScript
65
-
2.**No package.jsonfor runtime deps** - Use deno.json imports
66
-
3.**No node_modules in production** - Deno caches deps automatically
64
+
1.**No new TypeScript files** - Convert existing TS to AffineScript
65
+
2.**Use `package.json` + `bun.lock`for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
66
+
3.**`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock`
67
67
4.**No Go code** - Use Rust instead
68
68
5.**Python only for SaltStack** - All other Python must be rewritten
69
69
6.**No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
@@ -72,7 +72,7 @@ Both are FOSS with independent governance (no Big Tech).
72
72
73
73
-**Primary**: Guix (guix.scm)
74
74
-**Fallback**: Nix (flake.nix)
75
-
-**JS deps**: Deno (deno.json imports)
75
+
-**JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
|**Bun**|JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns.|
11
11
|**Rust**| Performance-critical, systems, WASM | Preferred for CLI tools |
12
12
|**Tauri 2.0+**| Mobile apps (iOS/Android) | Rust backend + web UI |
13
13
|**Dioxus**| Mobile apps (native UI) | Pure Rust, React-like |
14
14
|**Gleam**| Backend services | Runs on BEAM or compiles to JS |
|**Julia**| Batch scripts, data processing | Per RSR |
@@ -25,10 +25,10 @@
25
25
| Banned | Replacement |
26
26
|--------|-------------|
27
27
| TypeScript | ReScript |
28
-
|Node.js|Deno|
29
-
|npm|Deno|
30
-
|Bun|Deno|
31
-
| pnpm/yarn |Deno|
28
+
|Deno|Bun|
29
+
|Node.js|Bun|
30
+
|npm|Bun|
31
+
| pnpm/yarn |Bun|
32
32
| Go | Rust |
33
33
| Python | Julia/Rust/AffineScript |
34
34
| Java/Kotlin | Rust/Tauri/Dioxus |
@@ -47,9 +47,9 @@ Both are FOSS with independent governance (no Big Tech).
47
47
48
48
### Enforcement Rules
49
49
50
-
1.**No new TypeScript files** - Convert existing TS to ReScript
51
-
2.**No package.jsonfor runtime deps** - Use deno.json imports
52
-
3.**No node_modules in production** - Deno caches deps automatically
50
+
1.**No new TypeScript files** - Convert existing TS to AffineScript
51
+
2.**Use `package.json` + `bun.lock`for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
52
+
3.**`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock`
53
53
4.**No Go code** - Use Rust instead
54
54
5.**No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps
55
55
6.**No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
@@ -58,7 +58,7 @@ Both are FOSS with independent governance (no Big Tech).
58
58
59
59
-**Primary**: Guix (guix.scm)
60
60
-**Fallback**: Nix (flake.nix)
61
-
-**JS deps**: Deno (deno.json imports)
61
+
-**JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
|**Bun**|JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns.|
11
11
|**Rust**| Performance-critical, systems, WASM | Preferred for CLI tools |
12
12
|**Tauri 2.0+**| Mobile apps (iOS/Android) | Rust backend + web UI |
13
13
|**Dioxus**| Mobile apps (native UI) | Pure Rust, React-like |
14
14
|**Gleam**| Backend services | Runs on BEAM or compiles to JS |
|**Julia**| Batch scripts, data processing | Per RSR |
@@ -25,10 +25,10 @@
25
25
| Banned | Replacement |
26
26
|--------|-------------|
27
27
| TypeScript | ReScript |
28
-
|Node.js|Deno|
29
-
|npm|Deno|
30
-
|Bun|Deno|
31
-
| pnpm/yarn |Deno|
28
+
|Deno|Bun|
29
+
|Node.js|Bun|
30
+
|npm|Bun|
31
+
| pnpm/yarn |Bun|
32
32
| Go | Rust |
33
33
| Python | Julia/Rust/AffineScript |
34
34
| Java/Kotlin | Rust/Tauri/Dioxus |
@@ -47,9 +47,9 @@ Both are FOSS with independent governance (no Big Tech).
47
47
48
48
### Enforcement Rules
49
49
50
-
1.**No new TypeScript files** - Convert existing TS to ReScript
51
-
2.**No package.jsonfor runtime deps** - Use deno.json imports
52
-
3.**No node_modules in production** - Deno caches deps automatically
50
+
1.**No new TypeScript files** - Convert existing TS to AffineScript
51
+
2.**Use `package.json` + `bun.lock`for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
52
+
3.**`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock`
53
53
4.**No Go code** - Use Rust instead
54
54
5.**No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps
55
55
6.**No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
@@ -58,7 +58,7 @@ Both are FOSS with independent governance (no Big Tech).
58
58
59
59
-**Primary**: Guix (guix.scm)
60
60
-**Fallback**: Nix (flake.nix)
61
-
-**JS deps**: Deno (deno.json imports)
61
+
-**JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
|**Bun**|JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns.|
11
11
|**Rust**| Performance-critical, systems, WASM | Preferred for CLI tools |
12
12
|**Tauri 2.0+**| Mobile apps (iOS/Android) | Rust backend + web UI |
13
13
|**Dioxus**| Mobile apps (native UI) | Pure Rust, React-like |
14
14
|**Gleam**| Backend services | Runs on BEAM or compiles to JS |
|**Julia**| Batch scripts, data processing | Per RSR |
@@ -25,10 +25,10 @@
25
25
| Banned | Replacement |
26
26
|--------|-------------|
27
27
| TypeScript | ReScript |
28
-
|Node.js|Deno|
29
-
|npm|Deno|
30
-
|Bun|Deno|
31
-
| pnpm/yarn |Deno|
28
+
|Deno|Bun|
29
+
|Node.js|Bun|
30
+
|npm|Bun|
31
+
| pnpm/yarn |Bun|
32
32
| Go | Rust |
33
33
| Python | Julia/Rust/AffineScript |
34
34
| Java/Kotlin | Rust/Tauri/Dioxus |
@@ -47,9 +47,9 @@ Both are FOSS with independent governance (no Big Tech).
47
47
48
48
### Enforcement Rules
49
49
50
-
1.**No new TypeScript files** - Convert existing TS to ReScript
51
-
2.**No package.jsonfor runtime deps** - Use deno.json imports
52
-
3.**No node_modules in production** - Deno caches deps automatically
50
+
1.**No new TypeScript files** - Convert existing TS to AffineScript
51
+
2.**Use `package.json` + `bun.lock`for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
52
+
3.**`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock`
53
53
4.**No Go code** - Use Rust instead
54
54
5.**No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps
55
55
6.**No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
@@ -58,7 +58,7 @@ Both are FOSS with independent governance (no Big Tech).
58
58
59
59
-**Primary**: Guix (guix.scm)
60
60
-**Fallback**: Nix (flake.nix)
61
-
-**JS deps**: Deno (deno.json imports)
61
+
-**JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
|**Bun**|JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns.|
11
11
|**Rust**| Performance-critical, systems, WASM | Preferred for CLI tools |
12
12
|**Tauri 2.0+**| Mobile apps (iOS/Android) | Rust backend + web UI |
13
13
|**Dioxus**| Mobile apps (native UI) | Pure Rust, React-like |
14
14
|**Gleam**| Backend services | Runs on BEAM or compiles to JS |
|**Julia**| Batch scripts, data processing | Per RSR |
@@ -25,10 +25,10 @@
25
25
| Banned | Replacement |
26
26
|--------|-------------|
27
27
| TypeScript | ReScript |
28
-
|Node.js|Deno|
29
-
|npm|Deno|
30
-
|Bun|Deno|
31
-
| pnpm/yarn |Deno|
28
+
|Deno|Bun|
29
+
|Node.js|Bun|
30
+
|npm|Bun|
31
+
| pnpm/yarn |Bun|
32
32
| Go | Rust |
33
33
| Python | Julia/Rust/AffineScript |
34
34
| Java/Kotlin | Rust/Tauri/Dioxus |
@@ -47,9 +47,9 @@ Both are FOSS with independent governance (no Big Tech).
47
47
48
48
### Enforcement Rules
49
49
50
-
1.**No new TypeScript files** - Convert existing TS to ReScript
51
-
2.**No package.jsonfor runtime deps** - Use deno.json imports
52
-
3.**No node_modules in production** - Deno caches deps automatically
50
+
1.**No new TypeScript files** - Convert existing TS to AffineScript
51
+
2.**Use `package.json` + `bun.lock`for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
52
+
3.**`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock`
53
53
4.**No Go code** - Use Rust instead
54
54
5.**No Python anywhere** - Use Julia for data/batch, Rust for systems, ReScript for apps
55
55
6.**No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
@@ -58,7 +58,7 @@ Both are FOSS with independent governance (no Big Tech).
58
58
59
59
-**Primary**: Guix (guix.scm)
60
60
-**Fallback**: Nix (flake.nix)
61
-
-**JS deps**: Deno (deno.json imports)
61
+
-**JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
0 commit comments