Estate audit — Waves 5 + 6: per-language testing standard, canonical-names guard, DYADT residual fix (#459)

Two cohesive commits closing out the estate audit-and-optimization
program (umbrella #460). Both fully tested; generated artifacts in sync.

## Commit 1 — Wave 5: per-language testing depth

You flagged this directly: the estate's only per-language testing
*depth* was a single Julia guide from **2024** (no MUST/SHOULD,
Rust+Julia only) next to a **byte-identical duplicate**.

- `language-testing-standards.md` → **v2.0.0**: RFC-2119 requirements
**R1–R9** mapped to the CRG test taxonomy; an anti-theatre rule (no
`continue-on-error` on a MUST check; coverage reported-with-artifact,
not asserted).
- `templates/language-testing-guide-TEMPLATE.md`: the skeleton every
guide follows — requirement-mapping table (tool or **visible** `none`),
tools, SHA-pinned CI, and a **mandatory honest "Known gaps"** section.
- `affinescript-testing-guide.md`: your primary language, previously
with **zero** testing standard — authored honestly (most SHOULD rows are
tracked gaps; R3 notes `affinescript-verify.yml` is advisory). SSOT
migrates to `hyperpolymath/affinescript` prospectively.
- `scripts/check-language-guide.sh` (wired into `just validate`) +
`wave5-language-guides-test.sh` (7/7). Deleted the duplicate snapshot.

## Commit 2 — Wave 6: guard, DYADT residual fix, licence record

- **DYADT residual (#461):** an adversarial review confirmed 16 bypasses
in the Wave-4 verifier; 15 were fixed in #458, and this closes the last
— an always-matching `contains:` regex (`.*`, `^`, `$`, …) no longer
confirms vacuously (`unverifiable trivial-pattern`). Spec pins the
`contains:` dialect to POSIX ERE; conformance vector + assertion added
(10 vectors, 15 assertions).
- **Canonical-names guard** (`check-canonical-names.sh`): blocks
*reintroduction* of the deprecated names (`6a2`→descriptiles,
`agent_instructions`→bot_directives) in **added** diff lines only
(chartered bulk migration untouched). Wired into `just validate` + the
pre-commit hook; `wave6-canonical-names-test.sh` (4/4).
- **`audits/licence-flags-2026-07.adoc`**: flag-only record — the whole
program made no SPDX edits and no auto licence PRs; DYADT treats licence
claims as `manual-only` end to end.

## Verification

All six wave suites pass; DYADT conformance 10/10 + dogfood
all-confirmed; registry + scorecard dashboard in sync.

## Program status (umbrella #460)

Waves 0/1/3/4 + hardening **merged** (#453, #454, #457, #458). This
lands Waves 5 + 6. Remaining estate-wide work is chartered: #461
(verifier residual — **fixed here**), #462 (DYADT production verifier),
#463 (per-language guides completion).

Licence rows `manual-only` throughout (flag-only policy).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/REGISTRY.a2ml

@@ -234,7 +234,7 @@ name = "DYADT — Did-You-Actually-Do-That"
 stream = "governance"
 home = "did-you-actually-do-that/"
 canonical_doc = "did-you-actually-do-that/README.adoc"
-source_hash = "sha256:2ae635b9ede51e76781cb7c171108f2a4505b0aae9ac97fb05c910915141eb2a"
+source_hash = "sha256:453bf00d0dfac71576b5e7b4068fb8987abc3337d4bc3bf75c081e0332ae1dff"
 route = "post-action agent-claim verification (Tier 4 accountability)"
 
 [[spec]]

Justfile

@@ -85,12 +85,24 @@ dyadt-conformance:
 dyadt-test:
     @bash scripts/tests/wave4-dyadt-test.sh
 
+# Structural lint for per-language testing guides (required sections + R1..R9)
+language-guides-check:
+    @bash scripts/check-language-guide.sh
+
+# Block reintroduction of deprecated names (6a2, agent_instructions) in new diff
+canonical-names-check base="origin/main":
+    @bash scripts/check-canonical-names.sh "{{base}}"
+
 # Aggregate compliance gate: registry drift is the HARD gate (registry-check,
 # a hard dep). The RSR self-audit is INFORMATIONAL — a monorepo is not expected
 # to score Gold — but a *broken* audit (exit 4 / unexpected) must fail loudly
 # rather than pass silently under a blanket `|| true` (Wave-0 false-green fix).
 validate: registry-check
     @echo "=== validate: registry drift (HARD GATE) — passed as a dependency above ==="
+    @echo "=== validate: per-language testing guides (structural, HARD GATE) ==="
+    @bash scripts/check-language-guide.sh
+    @echo "=== validate: canonical-names reintroduction guard (vs origin/main) ==="
+    @bash scripts/check-canonical-names.sh origin/main || bash scripts/check-canonical-names.sh HEAD
     @echo "=== validate: RSR self-audit (INFORMATIONAL grade; errors fail loudly) ==="
     @bash scripts/rsr-selfaudit.sh .
     @echo "=== validate: done ==="

audits/licence-flags-2026-07.adoc

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= Licence Flags — Estate Audit & Optimization (2026-07)
+:icons: font
+
+[.lead]
+Flag-only record for the estate audit-and-optimization program (umbrella
+`hyperpolymath/standards#460`). Per the Manual-Only licence policy
+(`.claude/CLAUDE.md`), this program made **no** licence/SPDX edits and generated
+**no** automated licence-change PRs. This document records that discipline and
+flags — for owner review only — anything licence-adjacent that surfaced.
+
+== Discipline upheld
+
+* No SPDX headers were added, changed, or swept in any wave (0, 1, 3, 4, 5, 6).
+* New files created by the program carry the SPDX identifier matching the
+  repo's classification at birth (authoring, not relicensing): scripts →
+  `MPL-2.0`, prose/specs → `CC-BY-SA-4.0`. This is consistent with the estate
+  policy that new files may carry the correct SPDX from birth.
+* The DYADT verifier (`did-you-actually-do-that/`) treats any licence/SPDX claim
+  as `manual-only` end to end — it returns `unverifiable`, never auto-`confirmed`,
+  and the consequence ledger's confirmation rate is explicitly unaffected by
+  licence verdicts. The Manual-Only policy is preserved *by construction* in the
+  new tooling.
+
+== Flags for owner review (no action taken)
+
+None of the following were edited; they are surfaced for the owner to rule on.
+
+[cols="1,3", options="header"]
+|===
+| Location | Observation (flag-only)
+
+| `rhodium-standard-repositories/rsr-audit.sh`
+| Header carries a dual `SPDX-License-Identifier: MPL-2.0 AND Palimpsest-0.8`.
+  Palimpsest is a carve-out family; whether this file should carry a
+  Palimpsest component is an owner ruling, not an audit action. Left untouched.
+
+| `SECURITY-ADVISORIES.adoc`
+| A standing deferred `rand < 0.9.3` advisory is recorded. Not a licence matter,
+  but flagged alongside release hygiene: renew with an expiry date or bump.
+  (Tracked under the umbrella's release-hygiene item.)
+|===
+
+== No sweep, no auto-PR
+
+This program did not run, and must not be read as licensing, any bulk SPDX
+normalisation. Licence drift findings remain FLAG-ONLY and owner-gated, per the
+neurophone#99 precedent and the estate licence-policy umbrella.

did-you-actually-do-that/spec/CLAIM-FORMAT.adoc

@@ -106,6 +106,16 @@ A verifier MUST reject (`unverifiable`) a claim whose `verifier` is not listed
 as compatible with its `claim_class` in VERIFICATION-PROTOCOL — an
 agent MUST NOT be able to choose a weaker verifier than the claim class warrants.
 
+=== `contains:` regex dialect (normative)
+
+The `contains:<regex>` predicate uses **POSIX Extended Regular Expressions
+(ERE)**, matched case-sensitively against the whole file (`grep -E`). A pattern
+that contains no literal character — i.e. is trivially always-matching (`.*`,
+`.`, `^`, `$`, `.+`, and the like) — is NOT evidence and MUST be rejected as
+`unverifiable` (reason `trivial-pattern`); it would otherwise confirm any
+non-empty file. `stdout-contains:<s>` is a fixed-string (non-regex) substring
+match.
+
 == Honesty constraints (normative)
 
 . A claim's verdict MUST be derived from primary evidence re-collected by the

did-you-actually-do-that/spec/conformance/always-match.a2ml

@@ -0,0 +1,10 @@
+[claims]
+schema = "dyadt/claim@1"
+actor = "conformance"
+[[claim]]
+id = "C1"
+claim_class = "file-changed"
+statement = "a vacuous always-matching contains pattern"
+target = "README.adoc"
+expect = "contains:.*"
+verifier = "git-diff"

did-you-actually-do-that/spec/conformance/always-match.expected

@@ -0,0 +1 @@
+C1 unverifiable

hooks/pre-commit

@@ -91,6 +91,17 @@ if [ -f scripts/build-registry.sh ]; then
     fi
 fi
 
+# Canonical-names guard: block reintroduction of the deprecated names listed in
+# CANONICAL-NAMES.adoc within the staged diff. Only added lines are checked, so
+# not-yet-migrated existing occurrences do not trip it.
+if [ -f scripts/check-canonical-names.sh ]; then
+    if ! bash scripts/check-canonical-names.sh HEAD >/dev/null 2>&1; then
+        echo -e "${RED}✗ Deprecated name reintroduced (see CANONICAL-NAMES.adoc):${NC}"
+        bash scripts/check-canonical-names.sh HEAD 2>&1 | grep '❌' || true
+        ERRORS=$((ERRORS + 1))
+    fi
+fi
+
 # Final result
 echo ""
 if [ $ERRORS -gt 0 ]; then

scripts/check-canonical-names.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# check-canonical-names.sh — block REINTRODUCTION of deprecated names.
+#
+# CANONICAL-NAMES.adoc (owner mandate 2026-06-30) deprecates:
+#   * 6a2                -> descriptiles
+#   * agent_instructions -> bot_directives
+# The bulk migration of existing occurrences is chartered separately; this guard
+# stops NEW occurrences from landing in the meantime. It inspects only the
+# ADDED lines of a diff (grandfathered existing text is untouched), so it can be
+# wired into pre-commit and CI without tripping on the not-yet-migrated files.
+#
+# Usage: check-canonical-names.sh [base-ref]
+#   base-ref default: origin/main (CI) then HEAD (pre-commit staged diff).
+# Exit: 0 no new deprecated tokens · 1 a deprecated token was added · 2 usage
+
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+BASE="${1:-}"
+if [ -z "$BASE" ]; then
+  if git rev-parse --verify -q origin/main >/dev/null 2>&1; then BASE="origin/main"; else BASE="HEAD"; fi
+fi
+
+# Deprecated token -> canonical replacement (for the error message).
+declare -A REPL=( ["6a2"]="descriptiles" ["agent_instructions"]="bot_directives" )
+
+# Files that legitimately NAME the deprecated tokens (the mandate itself, this
+# guard, migration/charter docs). Excluded from the check.
+is_excluded() {
+  case "$1" in
+    CANONICAL-NAMES.adoc|scripts/check-canonical-names.sh|scripts/tests/*|\
+    *MIGRATION*|*migration*|*CHANGELOG*|*/6a2/*|.machine_readable/6a2/*) return 0 ;;
+  esac
+  return 1
+}
+
+# Added lines in the working diff vs BASE, per file.
+added_diff() { git diff "$BASE" -- . 2>/dev/null; }
+
+rc=0
+current_file=""
+while IFS= read -r line; do
+  case "$line" in
+    "+++ b/"*) current_file="${line#+++ b/}" ;;
+    "+"*)
+      is_excluded "$current_file" && continue
+      body="${line#+}"
+      # Skip a line that is DESCRIBING the deprecation rather than using the old
+      # name — it also mentions the canonical replacement or the mandate itself
+      # (e.g. tooling comments, this guard's own wiring, docs about the rename).
+      if printf '%s' "$body" | grep -Eqi 'deprecat|canonical|reintroduc|descriptiles|bot_directives'; then
+        continue
+      fi
+      for tok in "${!REPL[@]}"; do
+        # word-ish boundary so e.g. 'v6a2ml' style false hits are limited
+        if printf '%s' "$body" | grep -Eq "(^|[^A-Za-z0-9])$tok([^A-Za-z0-9]|$)"; then
+          echo "❌ $current_file: reintroduces deprecated '$tok' — use '${REPL[$tok]}' (CANONICAL-NAMES.adoc)"
+          echo "   + $body"
+          rc=1
+        fi
+      done ;;
+  esac
+done < <(added_diff)
+
+if [ "$rc" -eq 0 ]; then
+  echo "✅ no deprecated names reintroduced (vs $BASE)"
+fi
+exit $rc

scripts/check-language-guide.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# check-language-guide.sh — structural lint for per-language testing guides.
+#
+# Every guide built from templates/language-testing-guide-TEMPLATE.md MUST carry
+# the required sections and the R1–R9 requirement-mapping table. A guide that
+# silently omits a section (e.g. "Known gaps") is a false-completeness hole —
+# this fails loudly instead.
+#
+# Usage: check-language-guide.sh [guide.md ...]
+#   With no args, checks every standards/*-testing-guide.md.
+# Exit: 0 all valid · 1 a guide is missing a required section
+
+set -uo pipefail
+
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+
+REQUIRED_SECTIONS=(
+  "## Requirement mapping"
+  "## Tools"
+  "## Recommended CI pipeline"
+  "## Best practices"
+  "## Known gaps"
+  "## Resources"
+)
+
+check_one() { # file
+  local f="$1" rc=0 sec
+  if [ ! -f "$f" ]; then echo "  ❌ $f: not found"; return 1; fi
+  for sec in "${REQUIRED_SECTIONS[@]}"; do
+    grep -Fqx "$sec" "$f" || { echo "  ❌ $(basename "$f"): missing section '$sec'"; rc=1; }
+  done
+  # The requirement mapping MUST reference the R1..R9 rows (at least R1 and R9).
+  grep -Eq '\bR1\b' "$f" && grep -Eq '\bR9\b' "$f" || { echo "  ❌ $(basename "$f"): requirement mapping does not reference R1..R9"; rc=1; }
+  # A SPDX header is required.
+  head -3 "$f" | grep -q 'SPDX-License-Identifier' || { echo "  ❌ $(basename "$f"): missing SPDX header"; rc=1; }
+  [ "$rc" -eq 0 ] && echo "  ✅ $(basename "$f")"
+  return $rc
+}
+
+if [ "$#" -gt 0 ]; then
+  files=("$@")
+else
+  mapfile -t files < <(ls "$ROOT"/standards/*-testing-guide.md 2>/dev/null)
+fi
+
+if [ "${#files[@]}" -eq 0 ]; then
+  echo "no language testing guides found (standards/*-testing-guide.md)"; exit 0
+fi
+
+rc=0
+echo "Language testing guides:"
+for f in "${files[@]}"; do check_one "$f" || rc=1; done
+exit $rc

scripts/tests/wave4-dyadt-test.sh

@@ -166,6 +166,16 @@ target = "echo marker >&2; true"
 expect = "stdout-contains:marker"
 verifier = "command-transcript"'
 [[ "$(reason_of "$TMP/se.a2ml" C1)" == REFUTED* ]] && ok "stderr does not satisfy stdout-contains" || bad "stderr false-confirmed stdout claim"
+# an always-matching contains: regex is not evidence (#461)
+mk am.a2ml '[claims]
+[[claim]]
+id = "C1"
+claim_class = "file-changed"
+target = "README.adoc"
+expect = "contains:.*"
+verifier = "git-diff"'
+[[ "$(reason_of "$TMP/am.a2ml" C1)" == unverifiable*trivial-pattern ]] && ok "always-matching contains: -> unverifiable" || bad "always-match pattern confirmed vacuously"
+
 # licence claim phrased only in the statement is still manual-only
 mk lic.a2ml '[claims]
 [[claim]]