Merge branch 'main' into dependabot/github_actions/actions-2b5a464f05

Author: hyperpolymath

.github/workflows/governance.yml

@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9

.github/workflows/hypatia-scan.yml

@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9

.github/workflows/secret-scanner.yml

@@ -18,4 +18,4 @@ jobs:
     permissions:
       contents: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
-    secrets: inherit
+    secrets: inherit

.meta/REQUIRED-FILES.adoc

@@ -0,0 +1,58 @@
+== Required Repository Files
+
+The following files *MUST* be present and kept up-to-date in every
+repository:
+
+=== Mandatory Dotfiles
+
+[cols=",",options="header",]
+|===
+|File |Purpose
+|`+.gitignore+` |Exclude build artifacts, secrets, and temp files
+|`+.gitattributes+` |Enforce LF line endings and diff settings
+|`+.editorconfig+` |Consistent editor settings across IDEs
+|`+.tool-versions+` |asdf version pinning for reproducible builds
+|===
+
+=== Mandatory SCM Files
+
+[cols=",",options="header",]
+|===
+|File |Purpose
+|`+META.scm+` |Architecture decisions, development practices
+|`+STATE.scm+` |Project state, phase, milestones
+|`+ECOSYSTEM.scm+` |Ecosystem positioning, related projects
+|`+PLAYBOOK.scm+` |Executable plans, procedures
+|`+AGENTIC.scm+` |AI agent operational gating
+|`+NEUROSYM.scm+` |Symbolic semantics, proof obligations
+|===
+
+=== Build System
+
+[cols=",",options="header",]
+|===
+|File |Purpose
+|`+justfile+` |Task runner (replaces Makefile)
+|`+Mustfile+` |Deployment state contract
+|===
+
+*IMPORTANT*: Makefiles are FORBIDDEN. Use `+just+` for all tasks.
+
+=== Validation
+
+These files are checked by: - CI workflow validation - Pre-commit hooks
+(when configured) - Repository standardization scripts
+
+=== Updates
+
+When updating these files: 1. Use templates from `+rsr-template-repo+`
+as reference 2. Ensure SPDX license header is present 3. Test changes
+locally before pushing 4. Keep language-specific sections relevant to
+the repo
+
+=== See Also
+
+* https://github.com/hyperpolymath/rhodium-standard-repositories[RSR
+(Rhodium Standard Repositories)]
+* https://github.com/hyperpolymath/mustfile[Mustfile Specification]
+* https://github.com/hyperpolymath/meta-scm[SCM Format Family]

.meta/REQUIRED-FILES.md

@@ -0,0 +1,48 @@
+== Architecture
+
+=== Overview
+
+This repository follows a modular, maintainable architecture designed
+for clarity, scalability, and long-term sustainability.
+
+=== Directory Structure
+
+....
+.
+├── src/           # Source code
+├── tests/        # Test suites
+├── docs/         # Documentation
+├── scripts/      # Utility scripts
+├── config/       # Configuration files
+├── LICENSE       # License file
+├── LICENSES/     # Full license texts
+└── README.adoc   # Project documentation
+....
+
+=== Design Principles
+
+* *Separation of Concerns*: Each module has a single responsibility
+* *Testability*: Code is written to be easily testable
+* *Documentation*: All public APIs are documented
+* *Configuration*: Environment-specific settings are externalized
+
+=== Dependencies
+
+* External dependencies are minimized and clearly declared
+* Version pinning is used for reproducibility
+
+=== Security Considerations
+
+* Sensitive data is never committed to the repository
+* Secrets are managed through environment variables or secure vaults
+* Regular dependency audits are performed
+
+=== Maintainability
+
+* Code follows consistent style guidelines
+* Pull requests require review and CI checks
+* Issues and discussions are tracked transparently
+
+'''''
+
+_Last updated: 2026-07-18_

ARCHITECTURE.adoc

@@ -0,0 +1,73 @@
+== Changelog
+
+All notable changes to `+sanctify-php+` will be documented in this file.
+
+This file is generated from conventional commits by the
+https://github.com/hyperpolymath/standards/blob/main/.github/workflows/changelog-reusable.yml[`+changelog-reusable.yml+`]
+workflow (`+hyperpolymath/standards#206+`). Adopt the workflow in this
+repo’s CI to keep this file in sync automatically — see
+https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml[`+templates/cliff.toml+`]
+for the canonical config.
+
+The format follows https://keepachangelog.com/en/1.1.0/[Keep a
+Changelog]; this project aims to follow
+https://semver.org/spec/v2.0.0.html[Semantic Versioning].
+
+=== [Unreleased]
+
+==== Added
+
+* feat(crg): add crg-grade and crg-badge justfile recipes
+* feat: add stapeln.toml container definition
+* feat: deploy UX Manifesto infrastructure
+* feat: add CLADE.a2ml — clade taxonomy declaration
+* feat(ci): enable Hypatia scanning
+* feat: implement security analysis stubs with post-quantum crypto
+detection
+
+==== Fixed
+
+* fix(ci): bump a2ml/k9-validate-action pins to canonical (#29)
+* fix(ci): sync hypatia-scan.yml to canonical (#28)
+* fix(ci): build Hypatia escript from repo root (estate dogfood drift)
+* fix(ci): repair YAML block-scalar in workflow-linter Check Permissions
+step (#26)
+* fix: remove tracked build artifacts, update gitignore
+* fix(scorecard): enforce granular permissions and add fuzzing
+placeholder
+* fix(ci): Resolve workflow-linter self-matching and metadata issues
+* fix: correct email jonathan.jewell → j.d.a.jewell
+* fix: global AGPL-3.0-or-later → PMPL-1.0-or-later replacement
+* fix(license): SPDX AGPL-3.0 → PMPL-1.0-or-later in dotfiles
+
+==== Changed
+
+* refactor: migrate 6SCM → 6A2 (.scm → .a2ml format)
+
+==== Documentation
+
+* docs: substantive CRG C annotation (EXPLAINME.adoc)
+* docs: add TEST-NEEDS.md and/or PROOF-NEEDS.md from audit
+* docs: add EXPLAINME.adoc — prove-it file backing README claims
+* docs: add CONTRIBUTING.md
+* docs: add checkpoint files for state tracking
+* docs: update license from AGPL to PMPL
+
+==== CI
+
+* ci: redistribute concurrency-cancel guard to read-only check workflows
+(#31)
+* ci: bump actions/upload-artifact SHA to current v4 (#25)
+* ci: SHA-pin hyperpolymath validate-actions in dogfood-gate
+* ci: restore Dependabot security path + wire auto-merge
+* ci: deploy dogfood-gate, add Groove manifest and CRG tests
+
+=== Pre-history
+
+Prior commits to this file’s introduction are recorded in git history
+but not formally classified into Keep-a-Changelog sections. To backfill,
+run `+git cliff -o CHANGELOG.md+` locally using the canonical
+https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml[`+cliff.toml+`]
+— this is one-shot mechanical work.
+
+'''''