[hyperpolymath]

Summary

This PR makes rsr-template-repo the first consumer of the estate provisioning canon (hyperpolymath/standards#1096, 3-practice/provisioning). Every repository minted from this template now arrives self-provisioning. It has:

• a launcher.sh with --setup, --doctor, --heal and --ai-setup
• one Justfile covering run, config, test, bench, eval and doctor/heal
• a pinned mise toolchain
• a real Guix package, dev shell and pinned channel
• a manual setup guide
• the neurophone-pattern AI-assisted install, with warm-ups for users, devs and maintainers

It also fixes template recipes that printed success over nothing.

Merge order: after standards#1096. The engine files under build/just/ are byte-identical to that PR's head, b234caf5. Auto-merge is deliberately off: this is the canon that the fan-out copies, so it needs owner review.

Changes

• Engine:
  • build/just/provision{.just,-lib.sh,-modes.sh,-check.sh} are wired via mod provision.
  • Root recipes delegate to it: build, test, bench, fmt, fmt-check, lint, run, setup, doctor, heal, dev-shell, toolchain-refresh, ai-setup, ai-warmup, eval, config-show and opsm.
  • The .machine_readable/contractiles/Justfile copy is kept identical.
• launcher.sh: library archetype, so the runtime modes print N/A and exit 0 rather than faking a result.
• Stubs now fail loudly: build-release, test-smoke and readiness exit 1 with "not wired yet — edit the recipe". deps-audit runs trivy for real and fails if trivy is missing.
• mise: mise.toml is trimmed to the tools the repo uses. It had pinned banned python, deno, node, go, java, npm, yarn and make; those are removed. It is locked in mise.lock, and .tool-versions is removed. trivy is pinned because deps-audit calls it.
• Guix:
  • build/guix.scm is a real package (it had been a stub).
  • build/manifest.scm is the dev shell.
  • build/channels.scm is pinned.
  • .envrc uses the manifest.
• FFI: the template's Zig never compiled: an opaque type with fields, callconv(.C), and no libc. It is fixed, and build.zig gains a real test step.
• Docs:
  • docs/SETUP.adoc gives the manual route, with a troubleshooting table keyed to the doctor's PV codes.
  • The llm-warmup-{user,dev,maintainer}.adoc files are repo-specific.
  • README gains an [[ai-install]] "Just say it" section.
  • validate-ai-install checks the whole set.
• provisioning_praxis.deed: the per-repo descriptor that the generator reads.

Testing

Measured on this branch (head 477e266):

Engine and docs

• just doctor: 18 PASS, 0 WARN, 0 FAIL.

• ./launcher.sh --doctor: rc 0. With an injected failing doctor-local.sh it gives rc 1.

• doctor-hook isolation:

  hook	PASS / WARN / FAIL
  normal	19 / 1 / 0
  exit 3	19 / 0 / 1 + PV-E51
  set -e; false	19 / 0 / 1 + PV-E51

• just validate passes. provision-check.sh --dev gives 0 FAIL, 0 WARN.

• shellcheck is clean on build/just/*.sh and launcher.sh.

• The aspect tests give PASS=3.

• build-release, test-smoke and readiness each exit 1 once, with no recursion.

Toolchain and Guix

• deps-audit: trivy 0.74.0 is installed from mise.lock. The audit is clean, rc 0.
• Guix, via podman with metacall/guix at ae77aeb:
  • guix build -f build/guix.scm gives rc 0.
  • guix shell -m build/manifest.scm --dry-run gives rc 0, with 512 MB to download.
  • channels.scm evaluates to channel guix at the image's own guix describe commit.
• fmt-check on a token-filled copy: clean code gives rc 0; a mis-formatted mutant gives rc 1.
• The FFI zig build test passes 4/4 after repo-init. A broken assertion turns it red.

Red by design on the uninstantiated template

just test, just lint, just fmt and just fmt-check all exit 1 on this template repository itself. The cause is the template token at src/interface/ffi/src/main.zig:55 (export fn {{project}}_init()), which is not valid Zig until just repo-init fills it. They are green on an instantiated copy. The alternative was to skip or fake these recipes on the template, and that would reintroduce the silent-green this PR removes.

Update: review round (head c251cfb)

• 065a03e — estate-rules and the exemption ratchet.
  • REPOSITORY-MAP.adoc is regenerated (just repo-map; just validate-repo-map: up to date).
  • The root-allow row for launcher.sh now cites launcher-standard 0.6.0.
  • .machine_readable/root-allow.txt grows 47 → 48, declared in that commit: launcher.sh and mise.lock belong at the root because the tools that read them look there, and .tool-versions is retired. The ratchet run locally against origin/main gives OK (declared), rc 0.
• c251cfb — engine synced to standards@7475b184. mise_lock_gaps now needs a sha256 in every [tools.X."platforms.P"] table, so one checksummed tool can no longer vouch for another. On this tree: mise-lock-gaps rc 0, provision-check 0 FAIL / 0 WARN, just doctor 18/0/0, ./launcher.sh --doctor rc 0, shellcheck clean.

Deferred red checks, by context (none is a required check; main's effective rules carry no required_status_checks):

• Canon lockstep → Canon lockstep red on every PR: [canon] pin predates canon 2.1.2 (standards#1088) #215. Canon 2.1.2 (standards#1088) changed canon.lock on 2026-09-30, and rsr-profile.a2ml [canon] still pins 2.1.1. The check is red on every PR since then, including feat(repo-init): {{AUTHOR_ORCID}} replaces the all-zeros ORCID placeholder #214, which does not touch this area. This PR does not change [canon].
• actions.lock is in sync with the workflow YAML and governance / Actions lockfile verify → actions.lock out of sync on main since dependabot #210 (codeql-action, haskell-actions/setup) #217. They are red on main 8256a6e too, because dependabot chore(deps): bump the actions group with 3 updates #210 desynced the lock.
• Hypatia and scan / Hypatia Neurosymbolic Analysis (eval_in_shell at provision-check.sh:23 and provision-lib.sh:17,744,745,754,816) → eval_in_shell matches the word "eval" anywhere, not the builtin in command position hypatia#892. Each finding is the word eval (the verb, .eval/, a comment, or a case label). No builtin call exists. All six threads are answered and resolved.

Elegance arm

• Chosen (the most elegant long-term arm): the engine is vendored byte-identical, and provision-set --check in the generator (next) proves it is equal to canon. This works offline and Guix-hermetic, and there is one gate.
• Rejected: fetching the engine at run time. That would break offline use and add a supply-chain hop.

RSR Quality Checklist

• No banned language patterns. mise no longer pins python, deno, node, go, java, npm, yarn or make.
• SPDX headers present on new files, matching the repo classification. No existing header was changed.
• No secrets: gitleaks is clean in the pre-commit and pre-push hooks.
• Documentation updated: SETUP, warm-ups, README.
• Tests pass: green on an instantiated copy, red on the raw template by design (see above).

🤖 Generated with Claude Code

https://claude.ai/code/session_01UkSmyapDUmuGyyZSJmvbKy

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: hyperpolymath/rsr-template-repo/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 0780cdc3-69ea-4d91-9b9c-e0be49d54a15

📥 Commits

Reviewing files that changed from the base of the PR and between 0115f35 and 7c6c3eb.

⛔ Files ignored due to path filters (1)

• mise.lock is excluded by !**/*.lock

📒 Files selected for processing (26)

• .envrc
• .machine_readable/contractiles/Justfile
• .machine_readable/descriptiles/provisioning_praxis.deed
• .machine_readable/root-allow.txt
• .tool-versions
• Justfile
• README.adoc
• build/channels.scm
• build/guix.scm
• build/just/provision-check.sh
• build/just/provision-lib.sh
• build/just/provision-modes.sh
• build/just/provision.just
• build/just/validate.just
• build/manifest.scm
• docs/AI-INSTALL-README-SECTION.adoc
• docs/SETUP.adoc
• docs/architecture/REPOSITORY-MAP.adoc
• docs/onboarding/llm-warmup-dev.adoc
• docs/onboarding/llm-warmup-maintainer.adoc
• docs/onboarding/llm-warmup-user.adoc
• launcher.sh
• mise.toml
• src/interface/ffi/build.zig
• src/interface/ffi/src/main.zig
• tests/aspect_tests.sh

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Autopilot could not be updated. Open Coding to check access and billing.