chore: fill derivable placeholders, drop false ARCHITECTURE, surface the rest

.github/CODEOWNERS

@@ -1,14 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# CODEOWNERS - Define code review assignments
-# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-#
-# Replace hyperpolymath with your GitHub username or team
-
-# Default owners for everything
-* @hyperpolymath
-
-# Security-sensitive files require explicit review
-SECURITY.md @hyperpolymath
-.github/workflows/ @hyperpolymath
-Trustfile.a2ml @hyperpolymath
-.machine_readable/ @hyperpolymath
+# Solo-maintained hyperpolymath repo: no owner lines by policy.
+# See hyperpolymath/standards CODEOWNERS-POLICY.adoc (Rule 1).
+# Sole-maintainer review is moot; SPDX headers carry attribution.

0-AI-MANIFEST.a2ml

@@ -32,3 +32,20 @@ items = [
   { agent = "GEMINI", task = "estate audits, cross-repo sweeps, long-context triage, pattern detection" },
   { agent = "VIBE", task = "UI/frontend, PanLL panels, ReScript components, theming, rapid prototyping" },
 ]
+
+<!-- BEGIN requires-initialisation -->
+
+## PRIORITY ACTION — this repository is not fully initialised
+
+17 substitution token(s) still have no value. **Read
+`REQUIRES_INITIALISATION.md` in the repository root before doing anything
+else here** — it lists every outstanding token, what it means, and which
+files it belongs in.
+
+Do not fabricate values for them, and do not delete the sections that
+contain them to quiet a gate. They are unfilled because they need a
+decision, not because they were overlooked. Resolve what you legitimately
+can, leave the rest, and delete `REQUIRES_INITIALISATION.md` only when
+nothing outstanding remains.
+
+<!-- END requires-initialisation -->

REQUIRES_INITIALISATION.md

@@ -0,0 +1,173 @@
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+
+# REQUIRES INITIALISATION
+
+**This repository is not finished being set up.** 17 substitution token(s) across 15 file(s) still have no value.
+
+## Why this is not already done
+
+This repo was created from `hyperpolymath/rsr-template-repo`. The mint
+(`just repo-init`) fills every token that has a single mechanical answer —
+owner, repo, author, dates, licence, branch — and it has done so here.
+
+The tokens below are the ones it *deliberately cannot* answer. They need a
+decision or a fact that exists only in your head: what this project is for,
+what command builds it, which port the service listens on, whether a PGP key
+is held at all. The template's own token vocabulary says as much — you cannot
+sensibly answer "required invariants" in a thirty-second bootstrap.
+
+They were left **visibly unfilled on purpose**. The alternatives were both
+worse: inventing plausible values would put confident falsehoods into a
+security policy and an architecture document, and silently deleting the
+sections would hide the fact that a decision is owed. A visible gap is
+honest; a fabricated answer is not.
+
+## Do not delete this file until every item below is resolved
+
+This file is the only marker that the work is outstanding. Deleting it early
+does not finish the setup, it just conceals it — and the next person or agent
+to arrive will reasonably assume the repo is complete.
+
+- **If you are a person:** delete this file yourself once the last item is done.
+- **If you are an agent:** resolve what you legitimately can, leave the rest,
+  and delete this file only when no token below remains anywhere in the tree.
+  Do not delete it to make a gate go green.
+
+Re-running the estate top-up tool will remove this file automatically once
+nothing is outstanding, so the safest way to finish is to fix the tokens and
+let the check confirm it.
+
+## What is needed, and where it goes
+
+### `{{ARGS}}`
+
+Arguments for the justfile recipe this appears in.
+
+Appears in:
+
+- `.machine_readable/contractiles/Justfile`
+- `Justfile`
+
+### `{{BACKUP_POINT_1}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{BACKUP_POINT_2}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{ESCALATION_STEP_1}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{ESCALATION_STEP_2}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{ESCALATION_STEP_3}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{EXPECTED_AUTHOR}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/Trustfile.a2ml`
+
+### `{{MAIN_FUNCTION}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/Intentfile.a2ml`
+
+### `{{OPENSSF_PROJECT_ID}}`
+
+OpenSSF project ID, same registration.
+
+Appears in:
+
+- `docs/governance/TEMPLATE-STANDARDS-AUDIT.adoc`
+
+### `{{PORT}}`
+
+Port the container service listens on.
+
+Appears in:
+
+- `container/Containerfile`
+- `container/compose.toml`
+- `container/entrypoint.sh`
+- `container/manifest.toml`
+- `container/vordr.toml`
+
+### `{{REGISTRY}}`
+
+Container registry to publish to.
+
+Appears in:
+
+- `.machine_readable/configs/stapeln.toml`
+- `container/compose.toml`
+- `container/ct-build.sh`
+
+### `{{SCENARIO_1_NAME}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{SCENARIO_1_ROLLBACK_PROCEDURE}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{SCENARIO_2_NAME}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{SCENARIO_2_ROLLBACK_PROCEDURE}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{SERVICE_NAME}}`
+
+Container service name.
+
+Appears in:
+
+- `.machine_readable/configs/selur-compose.toml`
+- `.machine_readable/configs/stapeln.toml`
+- `container/.gatekeeper.yaml`
+- `container/Containerfile`
+- `container/compose.toml`
+- `container/ct-build.sh`
+- `container/entrypoint.sh`
+- `container/manifest.toml`
+- `container/vordr.toml`
+
+### `{{TARGET_AUDIENCE}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/Intentfile.a2ml`
+
+---
+
+Generated by the estate top-up pass. Rationale and the governing rulings are
+in `hyperpolymath/standards`; the token vocabulary is
+`.machine_readable/ai/PLACEHOLDERS.adoc` in `rsr-template-repo`.

container/manifest.toml

@@ -17,7 +17,7 @@ tracking.
 """
 license = "MPL-2.0"
 homepage = "https://github.com/hyperpolymath/contractiles"
-maintainer = "Jonathan D.A. Jewell <{{EMAIL}}>"
+maintainer = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
 
 [provenance]
 upstream = "https://github.com/hyperpolymath/contractiles"

container/vordr.toml

@@ -94,7 +94,7 @@ output = "stdout"
 # on = ["failure", "recovery", "resource_critical"]
 
 # [notifications.email]
-# to = "{{EMAIL}}"
+# to = "j.d.a.jewell@open.ac.uk"
 # from = "vordr@{{SERVICE_NAME}}.local"
 # smtp = "smtp://localhost:25"
 # on = ["failure", "resource_critical"]