hyperpolymath · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026
@@ -5,7 +5,7 @@
 # validate-k9.sh — K9 configuration file validation script
 #
 # Scans for .k9 and .k9.ncl files and validates:
-#   1. K9! magic number on line 1
+#   1. K9! marker (bare envelope or source-compatible comment)
 #   2. Pedigree block presence with required fields (name, version)
 #   3. Security level is one of: kennel, yard, hunt (case-insensitive)
 #   4. Hunt-level files must have a signature or signature_required field
@@ -130,9 +130,11 @@ validate_k9() {
         break
     done < "$file"
 
-    if [[ "$first_content_line" != "K9!" ]]; then
+    # A bare envelope marker is used by the self-validating examples. Native
+    # Nickel and YAML consumers need the marker to be a comment instead.
+    if [[ "$first_content_line" != "K9!" && "$first_content_line" != "# K9!" ]]; then
         report_issue "error" "$file" "$first_content_line_num" \
-            "Missing K9! magic number. First non-empty line must be exactly 'K9!'"
+            "Missing K9! marker. First non-empty line must be 'K9!' or '# K9!'"
     fi
 
     # --- Check 2: SPDX header ---
@@ -164,11 +166,41 @@ validate_k9() {
     local has_signature_field=false
     local in_pedigree=false
     local pedigree_depth=0
+    local yaml_pedigree=false
 
     line_num=0
     while IFS= read -r line; do
         line_num=$((line_num + 1))
 
+        # Session bindings are YAML data, not executable Nickel contracts.
+        # Validate their explicit pedigree without changing the session keys.
+        if [[ "$file" == *.k9 && "$line" == "pedigree:" ]]; then
+            has_pedigree=true
+            yaml_pedigree=true
+            continue
+        fi
+        if [[ "$yaml_pedigree" == "true" ]]; then
+            if [[ "$line" =~ ^[^[:space:]#] ]]; then
+                yaml_pedigree=false
+            else
+                if [[ "$line" =~ ^[[:space:]]+name:[[:space:]]+[^[:space:]#] ]]; then
+                    has_pedigree_name=true
+                fi
+                if [[ "$line" =~ ^[[:space:]]+(version|schema_version):[[:space:]]+[^[:space:]#] ]]; then
+                    has_pedigree_version=true
+                fi
+                if [[ "$line" =~ ^[[:space:]]+(leash|security_level):[[:space:]]* ]]; then
+                    has_security_level=true
+                    security_level_value="$(normalise_level "=${line#*:}")"
+                    security_level_line=$line_num
+                fi
+                if [[ "$line" =~ ^[[:space:]]+(signature|signature_required):[[:space:]]+[^[:space:]#] ]]; then
+                    has_signature_field=true
+                fi
+                continue
+            fi
+        fi
+
         # Detect pedigree block start. Note: do NOT `continue` here — the
         # `pedigree = {` line itself contains the opening brace that
         # establishes the block. Falling through to the brace counter
@@ -179,7 +211,8 @@ validate_k9() {
         # brace, depth started at 0, and the first nested block's close
         # prematurely terminated the validator's view of the pedigree —
         # making `pedigree.metadata.name` invisible.
-        if [[ "$line" =~ ^[[:space:]]*pedigree[[:space:]]*= ]]; then
+        if [[ "$line" =~ ^[[:space:]]*pedigree[[:space:]]*=.*\{ ]] || \
+           [[ "$line" =~ ^let[[:space:]]+component_pedigree[[:space:]]*=[[:space:]]*\{ ]]; then
             has_pedigree=true
             in_pedigree=true
             pedigree_depth=0

@@ -4,24 +4,6 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 # Security Policy
 
-<!-- 
-============================================================================
-TEMPLATE INSTRUCTIONS (delete this block before publishing)
-============================================================================
-Replace all {{PLACEHOLDER}} values with your information:
-  {{PROJECT_NAME}}     - Your project name
-  {{OWNER}}            - GitHub username or org (e.g., hyperpolymath)
-  {{REPO}}             - Repository name
-  {{SECURITY_EMAIL}}   - Security contact email
-  {{PGP_FINGERPRINT}}  - Your PGP key fingerprint (40 chars, no spaces)
-  {{PGP_KEY_URL}}      - URL to your public PGP key
-  {{WEBSITE}}          - Your website/domain
-  {{CURRENT_YEAR}}     - Current year for copyright
-
-Optional: Remove sections that don't apply (e.g., PGP if you don't use it)
-============================================================================
--->
-
 We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions.
 
 ## Table of Contents
@@ -44,38 +26,22 @@ We take security seriously. We appreciate your efforts to responsibly disclose v
 
 The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature:
 
-1. Navigate to [Report a Vulnerability](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new)
+1. Navigate to [Report a Vulnerability](https://github.com/hyperpolymath/vocarium/security/advisories/new)
 2. Click **"Report a vulnerability"**
 3. Complete the form with as much detail as possible
 4. Submit — we'll receive a private notification
 
 This method ensures:
 
-- End-to-end encryption of your report
 - Private discussion space for collaboration
 - Coordinated disclosure tooling
 - Automatic credit when the advisory is published
 
-### Alternative: Encrypted Email
-
-If you cannot use GitHub Security Advisories, you may email us directly:
-
-| | |
-|---|---|
-| **Email** | {{SECURITY_EMAIL}} |
-| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) |
-| **Fingerprint** | `{{PGP_FINGERPRINT}}` |
+### Alternative: Email
 
-```bash
-# Import our PGP key
-curl -sSL {{PGP_KEY_URL}} | gpg --import
-
-# Verify fingerprint
-gpg --fingerprint {{SECURITY_EMAIL}}
-
-# Encrypt your report
-gpg --armor --encrypt --recipient {{SECURITY_EMAIL}} report.txt
-```
+If you cannot use GitHub Security Advisories, contact the maintainer at
+[j.d.a.jewell@open.ac.uk](mailto:j.d.a.jewell@open.ac.uk) to arrange private disclosure.
+No project PGP key is published here; agree on a secure channel before sending sensitive details.
 
 > **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media.
 
@@ -207,7 +173,7 @@ If we cannot reach agreement on disclosure timing, we default to 90 days from yo
 
 The following are within scope for security research:
 
-- This repository (`{{OWNER}}/{{REPO}}`) and all its code
+- This repository (`hyperpolymath/vocarium`) and all its code
 - Official releases and packages published from this repository
 - Documentation that could lead to security issues
 - Build and deployment configurations in this repository
@@ -326,8 +292,8 @@ Recognition includes:
 To stay informed about security updates:
 
 - **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts"
-- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories)
-- **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md)
+- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/vocarium/security/advisories)
+- **Release notes**: Security fixes noted in [CHANGELOG](../CHANGELOG.adoc)
 
 ### Update Policy
 
@@ -352,7 +318,7 @@ To stay informed about security updates:
 
 ## Security Best Practices
 
-When using {{PROJECT_NAME}}, we recommend:
+When using Vocarium, we recommend:
 
 ### General
 
@@ -374,10 +340,9 @@ When using {{PROJECT_NAME}}, we recommend:
 
 ## Additional Resources
 
-- [Our PGP Public Key]({{PGP_KEY_URL}})
-- [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories)
-- [Changelog](CHANGELOG.md)
-- [Contributing Guidelines](CONTRIBUTING.md)
+- [Security Advisories](https://github.com/hyperpolymath/vocarium/security/advisories)
+- [Changelog](../CHANGELOG.adoc)
+- [Contributing Guidelines](../CONTRIBUTING.adoc)
 - [CVE Database](https://cve.mitre.org/)
 - [CVSS Calculator](https://www.first.org/cvss/calculator/3.1)
 
@@ -387,9 +352,9 @@ When using {{PROJECT_NAME}}, we recommend:
 
 | Purpose | Contact |
 |---------|---------|
-| **Security issues** | [Report via GitHub](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) or {{SECURITY_EMAIL}} |
-| **General questions** | [GitHub Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) |
-| **Other enquiries** | See [README](README.md) for contact information |
+| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/vocarium/security/advisories/new) or j.d.a.jewell@open.ac.uk |
+| **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/vocarium/discussions) |
+| **Other enquiries** | See [README](../README.adoc) for contact information |
 
 ---
 
@@ -403,8 +368,8 @@ This security policy may be updated from time to time. Significant changes will
 
 ---
 
-*Thank you for helping keep {{PROJECT_NAME}} and its users safe.* 🛡️
+*Thank you for helping keep Vocarium and its users safe.* 🛡️
 
 ---
 
-<sub>Last updated: {{CURRENT_YEAR}} · Policy version: 1.0.0</sub>
+<sub>Last updated: 2026 · Policy version: 1.0.0</sub>
@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
 # ECOSYSTEM.a2ml — Ecosystem position (META-TEMPLATE)
 #
 # This is the ECOSYSTEM file for rsr-template-repo itself. It records the
@@ -23,7 +23,7 @@
 [pipeline]
 position = "foundation"
 chain = "standards → rsr-template-repo → (every estate repo)"
-notes = "rsr-template-repo turns the RSR standard into runnable scaffolding. New repos are created from it via `just init`, which substitutes the {{PLACEHOLDER}} tokens."
+notes = "rsr-template-repo turns the RSR standard into runnable scaffolding. New repos are created from it via `just init`, which substitutes template placeholder tokens."
 coordination = "standards"
 
 [related-projects]

@@ -1,10 +1,10 @@
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # STATE.a2ml — Project state checkpoint (META-TEMPLATE)
 #
 # This is the STATE file for rsr-template-repo itself.
-# When consumed by a new project, replace {{PLACEHOLDER}} tokens
+# When consumed by a new project, replace template placeholder tokens
 # and customize sections below for the target project.
 
 [metadata]
@@ -59,6 +59,6 @@
 
 # ---------------------------------------------------------------------------
 # NOTE FOR CONSUMERS: When using this template to create a new repo, reset
-# the fields above to your project's values and replace all {{PLACEHOLDER}}
+# the fields above to your project's values and replace all template placeholder
 # tokens. The milestones above describe the TEMPLATE's evolution, not yours.
 # ---------------------------------------------------------------------------
@@ -1,3 +1,4 @@
+# K9!
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #

@@ -1,3 +1,4 @@
+# K9!
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #

@@ -1,3 +1,4 @@
+# K9!
 # SPDX-License-Identifier: MPL-2.0
 # adjust.k9.ncl — K9 trust-tier component of the adjust trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>

@@ -1,3 +1,4 @@
+# K9!
 # SPDX-License-Identifier: MPL-2.0
 # bust.k9.ncl — K9 trust-tier component of the bust trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
@@ -45,6 +46,7 @@ let base    = import "../_base.ncl" in
 
     security = {
       leash = 'Hunt,
+      signature_required = true,
       trust_level = "read-only expiry + state-check with subprocess",
       allow_network = false,
       allow_filesystem_write = false,

@@ -1,3 +1,4 @@
+# K9!
 # SPDX-License-Identifier: MPL-2.0
 # dust.k9.ncl — K9 trust-tier component of the dust trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>

@@ -1,3 +1,4 @@
+# K9!
 # SPDX-License-Identifier: MPL-2.0
 # intend.k9.ncl — K9 trust-tier component of the intend trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
@@ -59,6 +60,7 @@ let base    = import "../_base.ncl" in
 
     security = {
       leash = 'Hunt,
+      signature_required = true,
       trust_level = "subprocess + filesystem-read",
       allow_network = false,
       allow_filesystem_write = false,   # evidence sinks are indirected

@@ -1,3 +1,4 @@
+# K9!
 # SPDX-License-Identifier: MPL-2.0
 # must.k9.ncl — K9 trust-tier component of the must trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
@@ -53,6 +54,7 @@ let base    = import "../_base.ncl" in
 
     security = {
       leash = 'Hunt,
+      signature_required = true,
       trust_level = "read-only invariant verification with subprocess",
       allow_network = false,
       allow_filesystem_write = false,

@@ -1,3 +1,4 @@
+# K9!
 # SPDX-License-Identifier: MPL-2.0
 # trust.k9.ncl — K9 trust-tier component of the trust trident
 # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
@@ -71,6 +72,7 @@ let base    = import "../_base.ncl" in
 
     security = {
       leash = 'Hunt,
+      signature_required = true,
       trust_level = "verification + authorised-probe + hard-gate",
       allow_network = false,            # verifications offline by default
       allow_filesystem_write = false,   # evidence sinks are indirected

@@ -13,6 +13,9 @@
 
 # ─── Authority files (template-mandated) ─────────────────────────────────────
 README.adoc
+ARCHITECTURE.adoc          # Project architecture overview linked from the root documentation.
+CHANGELOG.adoc             # AsciiDoc changelog accepted by OpenSSF compliance.
+CONTRIBUTING.adoc          # AsciiDoc contributor guide accepted by GitHub and OpenSSF compliance.
 AUDIT.adoc
 EXPLAINME.adoc
 AFFIRMATION.adoc           # dated/signed honesty snapshot (README/EXPLAINME/AFFIRMATION trio)
@@ -38,6 +41,7 @@ abi.ipkg                   # Idris2 package for the ABI seam; sourcedir=src/inte
 .gitignore
 .tool-versions
 CLAUDE.md                  # AI session instructions, generated by the arrival-pack from .machine_readable/ a2ml and read by agents at repo root (do not hand-edit; edit the a2ml source)
+GEMINI.md                  # Gemini agent entry point; discovered at repository root.
 .hypatia-ignore            # repo-scoped Hypatia scanner exemptions; the scanner reads it from the repo root
 sonar-project.properties   # SonarCloud analysis config; the SonarQube scan action reads it from the repo root
 

@@ -1,3 +1,4 @@
+# K9!
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>
 #
@@ -8,6 +9,16 @@
 # Usage: k9 validate methodology-guard
 
 let methodology_guard = {
+  pedigree = {
+    name = "methodology-guard",
+    schema_version = "1.0.0",
+    security = {
+      leash = 'Yard,
+      allow_network = false,
+      allow_filesystem_write = false,
+      allow_subprocess = false,
+    },
+  },
   name = "methodology-guard",
   version = "1.0.0",
   description = "Validates that agent work respects declared methodology constraints",

@@ -2,10 +2,8 @@
 # RFC 9116 - security.txt
 # https://securitytxt.org/
 
-Contact: mailto:{{SECURITY_EMAIL}}
-Expires: {{CURRENT_YEAR}}-12-31T23:59:59.000Z
-Encryption: {{PGP_KEY_URL}}
+Contact: mailto:j.d.a.jewell@open.ac.uk
+Expires: 2027-10-01T00:00:00Z
 Preferred-Languages: en
-Canonical: https://{{FORGE}}/{{OWNER}}/{{REPO}}/.well-known/security.txt
-Policy: https://{{FORGE}}/{{OWNER}}/{{REPO}}/blob/main/SECURITY.md
-Hiring: https://{{WEBSITE}}/careers
+Canonical: https://raw.githubusercontent.com/hyperpolymath/vocarium/main/.well-known/security.txt
+Policy: https://github.com/hyperpolymath/vocarium/blob/main/.github/SECURITY.md
@@ -179,7 +179,7 @@ Vocarium’s role is to hold the particularities that other systems transform, i
 *Implemented (M1 invoke slice, ADR-0002):* the `voc` store engine (pure Zig,
 no C) — JSONL replay, warrant-door validation, and `voc invoke` emitting a
 Trope IR v0.2 Document verified end-to-end against `tropecheck` (use-relativity
-proven by the gate: same trope, opposite verdicts under two use-models).
+intended to be shown by the gate: same trope, opposite verdicts under two use-models).
 Run `just gate`.
 
 *Not yet implemented:* evoke/convoke/transvoke/provoke/revoke, revocation

@@ -1,3 +1,4 @@
+# K9!
 # SPDX-License-Identifier: MPL-2.0
 # deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level)
 #
@@ -39,6 +40,8 @@ let component_pedigree = {
   # L3: The Leash — Security
   # ─────────────────────────────────────────────────────────────
   security = {
+    leash = 'Hunt,
+    signature_required = true,
     trust_level = 'Hunt,
     allow_network = true,
     allow_filesystem_write = true,

@@ -1,5 +1,11 @@
+# K9!
 # Thin coordination bindings for central session-management standards
 
+pedigree:
+  name: "vocarium-session-coordination"
+  version: "1.0.0"
+  security_level: "kennel"
+
 session_management:
   source_of_truth: "standards/session-management-standards"
   canonical_commands: