Estate audit & optimization — Wave 0: kill the false green (holes before goals) (#453)

## Context

This is the first wave of a meticulous, estate-wide **must / should /
could / systems / compliance / effects** audit-and-uplift program
anchored in `standards` (the ~290-repo control plane). A 7-agent
read-only recon found the core problem: the *declarations* are rich but
the *enforcement is largely theatre* — validators pass vacuously,
mandatory-check runners aren't wired, and there's no post-action check
on agent claims. Per estate doctrine (`RSR-PHILOSOPHY.adoc`) the program
is ordered **holes before goals**, **solutions at source**, **always
fail loudly**.

This PR is the branch trunk; subsequent waves land as further commits.

## Wave 0 — Kill the false green (this commit)

Every validator that reported success while checking nothing, or masked
real errors behind `|| true`, is now state-aware and **provably able to
fail**, each backed by a red-team regression fixture.

| Fix | File | Hole closed |
|---|---|---|
| State-aware 6scm check | `a2ml/scripts/check-6scm.sh` | Exited 0
vacuously once `.scm` sources migrated to 6a2; now fails on
orphan-mirror drift / out-of-sync, and declares itself retired (not "in
sync") when obsolete |
| Real Mustfile validation | `.github/workflows/boj-build.yml` +
`scripts/check-mustfile-structure.sh` | Replaced `echo "K9 validation
would run here"` with a real structural check — every Mustfile check
must carry a severity + a means of discharge (`- run:` or `-
verification:`); hollow checks fail loudly |
| Arg parsing (#387) | `rhodium-standard-repositories/rsr-audit.sh` |
Documented `--format json` silently didn't work; invalid format now
exits 4 instead of defaulting to text; bare-positional form kept for
back-compat |
| De-mask `\|\| true` | `Justfile` `validate` +
`scripts/rsr-selfaudit.sh` | A broken audit (exit 4) was swallowed as
green; now a low grade is informational/non-blocking but an audit
*error* fails loudly. `registry-check` stays the hard gate |
| De-hardcode paths | `audit-contractiles.sh` | Removed
`/var/mnt/eclipse/...` owner-machine paths (couldn't run in CI); takes
args/`$CONTRACTILE_AUDIT_REPOS`, never audits zero repos |

## Verification

- `scripts/tests/wave0-false-green-test.sh` — **13/13**, exercising the
pass *and* fail path of every fixed validator (`just false-green-test`).
- Existing `check-workflow-staleness-test.sh` still passes;
`boj-build.yml` validates as YAML; all changed scripts pass `bash -n`.
- The real Mustfile passes structural validation (17 checks); a hollow
check fails; `rsr-audit --format json` emits JSON; an errored audit
fails `validate`.

## Not touched (by policy / scope)

- **Licence/SPDX** — flag-only throughout; no header edits.
- **`continue-on-error` soft-gates** — left in place (documented, with
real blocking equivalents elsewhere); honest-labelling / promotion is a
Wave 1 item, not a blanket removal that would manufacture red noise.

## Coming in later waves (same branch)

Wave 1 (wire the automation that never runs), Wave 3 (MUST/SHOULD/COULD
scorecards + compliance dashboard), Wave 4 (the
`did-you-actually-do-that` post-action claim-verifier spec — the missing
LLM-regulation tier), Wave 5 (AffineScript testing standard + template),
Wave 6 (campaign issues cross-linking #426/#451/#437/#381/#387/#446,
release hygiene).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---
_Generated by [Claude
Code](https://claude.ai/code/session_0114ps6mY5jAH4SzbGxeuYjc)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -66,15 +66,22 @@ jobs:
 
       - name: K9-SVC Validation
         run: |
+          set -euo pipefail
           echo "Running K9-SVC contractile validation..."
-          if [ -f .machine_readable/contractiles/must/Mustfile.a2ml ]; then
-            echo "✅ Mustfile found - running validation"
-            # Placeholder for actual K9 validation
-            echo "K9 validation would run here"
-          else
-            echo "❌ Mustfile not found"
-            exit 1
-          fi
+          # Real structural validation (no placeholder): every Mustfile check
+          # must carry a severity and a means of discharge (run or verification).
+          # A hollow check fails loudly. See scripts/check-mustfile-structure.sh
+          # (unit-tested by scripts/tests/wave0-false-green-test.sh).
+          bash scripts/check-mustfile-structure.sh
+
+      - name: Mustfile Enforcement (execute the checks)
+        run: |
+          set -euo pipefail
+          # Execute the Mustfile's `- run:` invariants — the mandatory checks
+          # that were previously declared but never run by any CI job. A failing
+          # critical/high check fails the build (fail loudly); warning-severity
+          # failures are reported but non-blocking. See scripts/run-mustfile.sh.
+          bash scripts/run-mustfile.sh
 
       - name: Contractile Check
         run: |

.github/workflows/hypatia-scan-reusable.yml

@@ -132,9 +132,20 @@ jobs:
             panic-attack-findings.json
           retention-days: 90
 
-      - name: Check for critical issues
+      - name: Check for critical issues (ADVISORY — does not gate)
         if: steps.scan.outputs.critical > 0
         run: |
-          echo "Critical issues found!"
-          echo "Review hypatia-findings.json for details."
-          # Warn but don't fail — fix forward
+          # This scan is ADVISORY / fix-forward: it never fails the build. The
+          # label and summary state that explicitly so a green check carrying
+          # critical findings is not mistaken for "no critical findings".
+          # (Promotion to blocking is tracked with the baseline reconciliation,
+          # standards#399/#437.)
+          echo "::warning title=Hypatia (ADVISORY, non-blocking)::${{ steps.scan.outputs.critical }} critical finding(s). This scan does not gate — review hypatia-findings.json and fix forward."
+          {
+            echo "### Hypatia scan — ADVISORY (does not gate)"
+            echo ""
+            echo "**${{ steps.scan.outputs.critical }} critical finding(s)** reported."
+            echo "This scan is fix-forward and **never fails the build**; a green"
+            echo "check here does not mean zero critical findings. See the"
+            echo "\`hypatia-scan-findings\` artifact. Blocking promotion: standards#399/#437."
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/registry-verify.yml

@@ -31,4 +31,23 @@ jobs:
 
       - name: Verify registry + derived topology are current
         run: |
-          bash scripts/build-registry.sh --check
+          if ! bash scripts/build-registry.sh --check; then
+            {
+              echo "### Registry drift detected"
+              echo ""
+              echo "A tracked file under a spec home (or STATE.a2ml) changed without"
+              echo "regenerating the derived registry/topology. Fix locally:"
+              echo ""
+              echo '```sh'
+              echo "just registry        # or: bash scripts/build-registry.sh"
+              echo "git add .machine_readable/REGISTRY.a2ml TOPOLOGY.md"
+              echo '```'
+              echo ""
+              echo "Install the pre-commit guard so this is caught before push:"
+              echo ""
+              echo '```sh'
+              echo "just hooks-install"
+              echo '```'
+            } >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi

.machine_readable/REGISTRY.a2ml

@@ -36,7 +36,7 @@ name = "A2ML — Attested Markup Language"
 stream = "foundation"
 home = "a2ml/"
 canonical_doc = "a2ml/README.adoc"
-source_hash = "sha256:5f070c778ad112229878e2d551b564e2ec885d2239c6f348c0a96b700091d84a"
+source_hash = "sha256:9ed18e704be7f0f8f991edf9dcced013691e8b62c8d7cd5a27a3d7a91c0f27dd"
 route = "the typed/verified machine-readable document format"
 
 [[spec]]
@@ -45,7 +45,7 @@ name = "K9 Self-Validating Components"
 stream = "foundation"
 home = "k9-svc/"
 canonical_doc = "k9-svc/README.adoc"
-source_hash = "sha256:2fa2fe6394de60ac7da8672dcfeb21aa65919a7df83e8cf9ee9b82b2260ab0a8"
+source_hash = "sha256:cf2afa97e93597731bdb18f8c56beba3fd553c77e19c02ad9515a919cc4bec00"
 route = "self-validating components with embedded contracts + deploy logic"
 
 [[spec]]
@@ -216,7 +216,7 @@ name = "RSR — Rhodium Standard Repositories"
 stream = "governance"
 home = "rhodium-standard-repositories/"
 canonical_doc = "rhodium-standard-repositories/README.adoc"
-source_hash = "sha256:01e6373ae01939b5ed24c72e1c4ace7ea55559b3fc765a956bc2e7ad722b244b"
+source_hash = "sha256:3e721ecb348d176a2e1ba82bb6ea6b9365e8375c4ca80f1f3f4c9e9e343269f8"
 route = "the repository-compliance standard every repo is graded against"
 
 [[spec]]

Justfile

@@ -41,11 +41,35 @@ staleness-test:
     @echo "=== propagate-workflow-pins ==="
     @bash scripts/tests/propagate-workflow-pins-test.sh
 
-# Aggregate compliance gate: registry drift (hard dep) + RSR self-audit (informational)
+# Wave-0 anti-false-green regression: proves each fixed validator CAN fail
+false-green-test:
+    @bash scripts/tests/wave0-false-green-test.sh
+
+# Wave-1 automation regression: Mustfile runner + hook installer
+automation-test:
+    @bash scripts/tests/wave1-automation-test.sh
+
+# Structural validation of the Mustfile contract (severity + run/verification per check)
+mustfile-check path=".machine_readable/contractiles/must/Mustfile.a2ml":
+    @bash scripts/check-mustfile-structure.sh "{{path}}"
+
+# Execute the Mustfile's `- run:` checks (critical/high failures block)
+must-check path=".machine_readable/contractiles/must/Mustfile.a2ml":
+    @bash scripts/run-mustfile.sh "{{path}}"
+
+# Install this repo's git hooks into .git/hooks/ (pre-commit guards)
+hooks-install:
+    @bash hooks/install.sh
+
+# Aggregate compliance gate: registry drift is the HARD gate (registry-check,
+# a hard dep). The RSR self-audit is INFORMATIONAL — a monorepo is not expected
+# to score Gold — but a *broken* audit (exit 4 / unexpected) must fail loudly
+# rather than pass silently under a blanket `|| true` (Wave-0 false-green fix).
 validate: registry-check
-    @echo "=== validate: RSR compliance gate ==="
-    @bash rhodium-standard-repositories/rsr-audit.sh . text || true
-    @echo "=== validate: done (see rsr-audit output above) ==="
+    @echo "=== validate: registry drift (HARD GATE) — passed as a dependency above ==="
+    @echo "=== validate: RSR self-audit (INFORMATIONAL grade; errors fail loudly) ==="
+    @bash scripts/rsr-selfaudit.sh .
+    @echo "=== validate: done ==="
 
 # Print role-appropriate LLM warm-up context (machine front door)
 llm-context role="dev":
@@ -127,6 +151,10 @@ doctor:
     @command -v git >/dev/null 2>&1 && echo "  [OK] git" || echo "  [FAIL] git not found"
     @echo "Checking for hardcoded paths..."
     @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.res' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo "  [OK] No hardcoded paths"
+    @echo "Checking optional imports (import? does not fail when absent — report it)..."
+    @test -f contractile.just && echo "  [OK] contractile.just present (import resolved)" || echo "  [INFO] contractile.just absent — its recipes are unavailable (needs the external 'contractile' generator)"
+    @echo "Checking git hooks are installed..."
+    @test -f "$(git rev-parse --git-dir)/hooks/pre-commit" && echo "  [OK] pre-commit hook installed" || echo "  [INFO] pre-commit hook not installed — run 'just hooks-install'"
     @echo "Diagnostics complete."
 
 # Auto-repair common issues

a2ml/scripts/check-6scm.sh

@@ -1,13 +1,57 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# check-6scm.sh — verify the .machine_readable/6scm/ mirror is honest.
+#
+# The 6scm mirror duplicated the legacy Scheme (.scm) descriptor set into
+# .machine_readable/6scm/ so tools that only read Scheme had a copy. That
+# metadata has migrated to .machine_readable/6a2/ (A2ML / descriptiles), so
+# for most repos there are no .scm sources left to mirror.
+#
+# A validator that validates nothing must not report success. This script
+# therefore distinguishes three states LOUDLY (never a silent green):
+#
+#   1. Sources present  -> real diff check; fail on missing/out-of-sync mirror.
+#   2. No sources, no mirror -> OBSOLETE no-op: exit 0 with an explicit
+#      "retired" message (it does NOT claim "in sync").
+#   3. No sources, but an orphaned mirror with files -> DRIFT: fail loudly.
+#
+# See CANONICAL-NAMES.adoc (6a2/descriptiles supersedes the legacy set) and
+# standards Wave-0 "kill the false green" remediation.
+
 set -euo pipefail
 
+SCM_NAMES=(AGENTIC.scm ECOSYSTEM.scm META.scm NEUROSYM.scm PLAYBOOK.scm STATE.scm)
+MIRROR_DIR=".machine_readable/6scm"
+
+# Collect the sources that actually exist.
+sources=()
+for f in "${SCM_NAMES[@]}"; do
+  [ -f ".machine_readable/$f" ] && sources+=("$f")
+done
+
+# State 2/3: no sources to mirror — the mechanism is obsolete for this repo.
+if [ "${#sources[@]}" -eq 0 ]; then
+  orphans=0
+  if [ -d "$MIRROR_DIR" ]; then
+    while IFS= read -r _; do orphans=$((orphans + 1)); done \
+      < <(find "$MIRROR_DIR" -type f 2>/dev/null)
+  fi
+  if [ "$orphans" -gt 0 ]; then
+    echo "DRIFT: $MIRROR_DIR holds $orphans mirror file(s) but no .scm sources exist." >&2
+    echo "       The 6scm mirror is obsolete (metadata migrated to .machine_readable/6a2/)." >&2
+    echo "       Remove $MIRROR_DIR and retire the sync-6scm/check-6scm recipes." >&2
+    exit 1
+  fi
+  echo "OBSOLETE (no-op): no .scm sources; 6scm mirror retired (superseded by 6a2/descriptiles). Nothing to mirror."
+  exit 0
+fi
+
+# State 1: sources exist — the mirror must be present and byte-identical.
 missing=0
-for f in AGENTIC.scm ECOSYSTEM.scm META.scm NEUROSYM.scm PLAYBOOK.scm STATE.scm; do
+for f in "${sources[@]}"; do
   src=".machine_readable/$f"
-  dst=".machine_readable/6scm/$f"
-  if [ ! -f "$src" ]; then
-    continue
-  fi
+  dst="$MIRROR_DIR/$f"
   if [ ! -f "$dst" ]; then
     echo "Missing mirror: $dst" >&2
     missing=1
@@ -19,4 +63,7 @@ for f in AGENTIC.scm ECOSYSTEM.scm META.scm NEUROSYM.scm PLAYBOOK.scm STATE.scm;
   fi
 done
 
+if [ "$missing" -eq 0 ]; then
+  echo "6scm mirror in sync (${#sources[@]} source(s) verified)."
+fi
 exit $missing

audit-contractiles.sh

@@ -8,17 +8,28 @@ set -euo pipefail
 echo "═══════════════════════════════════════════════════════════════════════════════"
 echo "  Hyperpolymath Contractile System Audit"
 echo "  $(date '+%Y-%m-%d %H:%M:%S')"
-echo "════╕══════════════════════════════════════════════════════════════════════════════"
+echo "═══════════════════════════════════════════════════════════════════════════════"
 echo ""
 
-# Repositories to audit
-REPOS=(
-  "/var/mnt/eclipse/repos/burble"
-  "/var/mnt/eclipse/repos/panll"
-  "/var/mnt/eclipse/repos/nextgen-databases"
-  "/var/mnt/eclipse/repos/rescript"
-  "/var/mnt/eclipse/repos/standards"
-)
+# Repositories to audit.
+# Previously these were hardcoded to the owner's machine (/var/mnt/eclipse/...),
+# so the script could not run in CI or on any other host (Wave-0 fix). Supply
+# repos explicitly as positional args, or via $CONTRACTILE_AUDIT_REPOS
+# (colon-separated). With neither set, default to auditing THIS repo so a bare
+# invocation is still useful — and never silently audit zero repos.
+if [ "$#" -gt 0 ]; then
+  REPOS=("$@")
+elif [ -n "${CONTRACTILE_AUDIT_REPOS:-}" ]; then
+  IFS=':' read -r -a REPOS <<< "$CONTRACTILE_AUDIT_REPOS"
+else
+  SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  REPOS=("$SELF_DIR")
+fi
+
+if [ "${#REPOS[@]}" -eq 0 ]; then
+  echo "error: no repositories to audit (pass paths as args or set CONTRACTILE_AUDIT_REPOS)" >&2
+  exit 2
+fi
 
 # Contractile types to check
 # `lust` deprecated 2026-04-18 — wishes absorbed into intend/Intentfile.a2ml

hooks/install.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# install.sh — install this repo's git hooks into .git/hooks/.
+#
+# The hooks in hooks/ (pre-commit language-policy + registry-drift guard, SPDX,
+# SHA-pin and permission validators) only run if they are present in
+# .git/hooks/. Nothing installed them automatically, so their guards were
+# effectively optional (a contributor had to know to `cp` them). This installer
+# wires them once. Idempotent; safe to re-run.
+#
+# Usage:  bash hooks/install.sh            (install / refresh)
+#         just hooks-install               (same, via recipe)
+#
+# It installs a thin .git/hooks/pre-commit that execs hooks/pre-commit from the
+# work tree, so the tracked hook stays the single source of truth and updates
+# take effect without re-installing.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+GITDIR="$(git -C "$ROOT" rev-parse --git-dir 2>/dev/null || true)"
+if [ -z "$GITDIR" ]; then
+  echo "error: not a git repository: $ROOT" >&2
+  exit 1
+fi
+# Normalise to an absolute path (git-dir may be relative to ROOT).
+case "$GITDIR" in
+  /*) : ;;
+  *)  GITDIR="$ROOT/$GITDIR" ;;
+esac
+
+HOOKDIR="$GITDIR/hooks"
+mkdir -p "$HOOKDIR"
+
+installed=0
+for src in "$ROOT"/hooks/pre-commit; do
+  [ -f "$src" ] || continue
+  name="$(basename "$src")"
+  dst="$HOOKDIR/$name"
+  cat > "$dst" <<EOF
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Auto-installed by hooks/install.sh — execs the tracked hook so the work-tree
+# copy stays the single source of truth. Do not edit; edit hooks/$name instead.
+exec "\$(git rev-parse --show-toplevel)/hooks/$name" "\$@"
+EOF
+  chmod +x "$dst"
+  echo "installed: $dst -> hooks/$name"
+  installed=$((installed + 1))
+done
+
+if [ "$installed" -eq 0 ]; then
+  echo "error: no hooks found to install under $ROOT/hooks/" >&2
+  exit 1
+fi
+echo "✅ $installed hook(s) installed into $HOOKDIR"

rhodium-standard-repositories/rsr-audit.sh

@@ -30,8 +30,34 @@ RSR_FREEZE_DATE="2025-12-27"
 # Configuration
 # =============================================================================
 
-REPO_PATH="${1:-.}"
-OUTPUT_FORMAT="${2:-text}"
+# Argument parsing (standards#387).
+# Historically the second positional arg was read verbatim as the format, so the
+# DOCUMENTED `--format json` form silently fell through to the text default while
+# only the bare positional `text|json|html` worked. Accept both now, and reject
+# an unknown format loudly (exit 4) instead of silently defaulting.
+REPO_PATH="."
+OUTPUT_FORMAT="text"
+_repo_seen=0
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --format=*)
+            OUTPUT_FORMAT="${1#*=}"; shift ;;
+        --format)
+            OUTPUT_FORMAT="${2:-}"; shift 2 || { echo "error: --format needs a value" >&2; exit 4; } ;;
+        text|json|html)
+            # Backward-compatible bare positional format (e.g. Justfile passes `. text`).
+            OUTPUT_FORMAT="$1"; shift ;;
+        -*)
+            echo "error: unknown option: $1" >&2; exit 4 ;;
+        *)
+            if [[ $_repo_seen -eq 0 ]]; then REPO_PATH="$1"; _repo_seen=1; shift
+            else echo "error: unexpected argument: $1" >&2; exit 4; fi ;;
+    esac
+done
+case "$OUTPUT_FORMAT" in
+    text|json|html) ;;
+    *) echo "error: invalid --format '$OUTPUT_FORMAT' (want: text|json|html)" >&2; exit 4 ;;
+esac
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Compliance thresholds