[hyperpolymath]

Summary

Brings the template in line with three owner rulings recorded on hyperpolymath/standards#787:

• Deno is retired (2026-08-26, standards#655);
• JSON is I-JSON + JCS (D306);
• UUIDv8, KYAML .kyaml, descriptiles as deed clauses, contractiles as k9 verb directories (D305, D307, D312).

The template scaffolds every new repo, so text here that contradicts a ruling gets copied into every repo made from it.

📌 New pins

Head SHA: 0509dbfec1c8e60aff47b3de1b06406dda18fd57.

No action, lockfile or container pin is added or changed. oven-sh/setup-bun@v2.2.0 appears only inside commented-out blocks of e2e.yml.template. Its comment says actions.lock resolves it when the template is instantiated. It is not a live uses:.

Changes

Deno

• release.yml: removed the deno.json branch, and removed deno.json from the "Expected one of" message.
• e2e.yml.template: the DENO/E2E block and the Playwright block now use Bun (bun install --frozen-lockfile, bun test, bunx playwright).
• runtime-policy.yml, workflow-linter.yml and scripts/check-action-pinning.js ordering comments now read "Bun > pnpm > npm; Deno retired".
  • The runtime-policy Deno detector is kept: it is what flags Deno.
  • Raising its ::warning to an error is logged as a finding, not done here.
• .clinerules, .cursorrules, .windsurfrules: "Deno grandfathered" and "TypeScript IS PERMITTED" are replaced by "Deno retired, migrate to Bun; TypeScript and ReScript migrate to AffineScript".
• .machine_readable/arrival-pack/arrival-pack.ncl: the language-policy source of CLAUDE.md, corrected the same way. CLAUDE.md was regenerated with generate.sh.
• .github/pull_request_template.md: the "banned language" checkbox read "(no , no npm/bun, no Go/Python)": a word was missing and it banned Bun. It now names the banned set. The SPDX header is untouched.

JSON (D306)

• Canonicalised with ijson-jcs fix (pinned 0fdeea71), the four template-owned files only:
  • .github/rulesets/Immutable-Tags.json
  • www/.well-known/aibdp.json
  • www/tests/controls/aibdp-bad-status.control.json
  • www/tests/controls/aibdp-enforce-430.control.json
• Deliberately not touched:
  • base.json, branch-floor.json, require-linear-history.json, require-signed-commits.json: byte-identical copies of standards/config/rulesets, said to be sourced verbatim. Canonicalise upstream first.
  • www/schemas/aibdp-schema-v0.2.json: vendored unmodified from consent-aware-web.
  • .github/labels.json, .github/label-classifier.json: generated ("do not edit") by generators in another repo. Logged as a finding.
  • the two devcontainer.json files: tool-demanded JSONC whose comments carry SPDX headers.

CLAUDE.md and the deed

• In the hand-authored block below the generated region (owner marker kept):
  • UUIDv7 → UUIDv8 (ADR-008, D305). Deed literals stay #u5, and existing IDs are not rewritten.
  • KYAML: .kyaml for estate config, .yml only where a tool demands it. Workflows wait for the lock-coverage shim (D280, D307).
  • JSON cites standards/3-practice/JSON-POLICY.adoc. That file lands with feat(json): JSON-POLICY (D306) + report-only ijson-jcs gate metadatastician/standards#1189 and does not exist on standards main until that PR merges.
  • The required-templates list (Intentfile, Mustfile, …) is replaced by descriptiles-as-deed-clauses and contractiles-as-k9-verb-directories (D312).
• rsr-template-repo_chora.deed :contractiles_required now lists the retired names' real directories: ("Mustfile" "Trustfile" "Intentfile") → .machine_readable/contractiles/{must,trust,intend}/.
  • The deed has no (contractiles …) attestation clause yet. CLAUDE.md names it as the D312 target and does not claim it exists.

Left as it is, on purpose: .github/copilot-instructions.md keeps the narrow TypeScript carve-out that standards/3-practice/LANGUAGE-POLICY.adoc §1.2 still states. Reconciling it with the Bun-only ruling is pending in standards.

RSR Quality Checklist

Required

• Tests pass. www/tests/check-aibdp.sh gives rc=0, and its output is byte-identical before and after the JSON change; both planted controls are still rejected.
• Formatted. The canonicalised files pass ijson-jcs check (rc=0 on all four), and jq -S shows the same data before and after.
• Linter is clean, no new warnings. actionlint on the three edited workflows reports two shellcheck warnings (release.yml SC2046, workflow-linter.yml SC2034). Both are present on main unchanged; this PR adds none.
• No banned language patterns. This PR removes them.
• unsafe blocks: not applicable, no Rust touched.
• Banned functions: not applicable, no proof or ML code touched.
• SPDX headers present. No new files; every modified file keeps its existing header.
• No secrets, credentials or .env files.

As Applicable

• Deed (status)/(maturity): no project state change. Only :contractiles_required changed, as above.
• Deed (ecosystem): no integration change.
• Deed (meta) / docs/decisions/: no new decision. This applies rulings already recorded on standards#787.
• ROADMAP: no milestone change.
• Documentation updated: CLAUDE.md, the rules files, and the PR template.
• TOPOLOGY.md: no architecture change.
• CHANGELOG: not updated; the template has no release cut pending.
• Dependencies: none added.
• ABI/FFI: not touched.

Testing

• bash .machine_readable/arrival-pack/verify.sh → OK: CLAUDE.md arrival pack is in sync with the deed. Run before the change (baseline) and after regeneration. Run with nickel 1.16.0.
• bash scripts/validate-template.sh → Validation PASSED, 0 errors. The 7 warnings are placeholders and SPDX headers on files this PR does not touch.
• ijson-jcs check → rc=0 on the four canonicalised files.
• standards/.githooks/docstring-scan.sh --worktree → no functions touched.
• A grep for deno in release.yml returns nothing.
• Not run locally: deed-validate runs a remote action (deed-ecosystem/validate-action). CI is the check for the deed edit, which reuses the multi-line string-list form already used by :machine_readable_required.

Screenshots

Not applicable.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D6JVLvmCeSFGcY6jSNesbL

Summary by CodeRabbit

• Documentation
  • Updated runtime guidance to prioritize Bun, allow pnpm when required by tooling, and retain npm as a last resort. Existing Deno projects are directed to migrate to Bun.
  • TypeScript and ReScript are no longer permitted; projects using them are directed to migrate to AffineScript. Use plain JavaScript where JavaScript is needed.
  • Clarified file-format and identifier rules, including exceptions for formats required by tools.
• Build and workflow support
  • Deno-based builds are no longer recognized. Updated workflow examples use Bun for setup, installation, and tests.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: hyperpolymath/rsr-template-repo/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: ed494fc1-5bf4-4e6d-acc1-4ae27d3d8c75

📥 Commits

Reviewing files that changed from the base of the PR and between 6930318 and 0509dbf.

📒 Files selected for processing (16)

• .clinerules
• .cursorrules
• .github/pull_request_template.md
• .github/rulesets/Immutable-Tags.json
• .github/workflows/e2e.yml.template
• .github/workflows/release.yml
• .github/workflows/runtime-policy.yml
• .github/workflows/workflow-linter.yml
• .machine_readable/arrival-pack/arrival-pack.ncl
• .windsurfrules
• CLAUDE.md
• rsr-template-repo_chora.deed
• scripts/check-action-pinning.js
• www/.well-known/aibdp.json
• www/tests/controls/aibdp-bad-status.control.json
• www/tests/controls/aibdp-enforce-430.control.json

 ____________________________________________________________________________________________________________________________________________________
< There are no final decisions. No decision is cast in stone. Instead, consider each as being written in the sand at the beach, and plan for change. >
 ----------------------------------------------------------------------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE