feat(registry): index AffineScript external specs as verified pointers

Fold the AffineScript v2 standards (.affine / .affex / .affmap) into the
estate's authoritative generated registry (.machine_readable/REGISTRY.a2ml
+ scripts/build-registry.sh + HYP-S006) instead of a parallel registry —
owner decision 2026-06-03.

These specs are language-coupled: their SSOT is hyperpolymath/affinescript,
not this repo. The registry holds a verified POINTER, never a copy, so the
normative text is never duplicated (SSOT preserved).

- scripts/build-registry.sh: add an EXTERNAL_SPECS table + emission path for
  kind="external" entries (spec_kind, owning_repo, canonical_url, version_pin,
  source_hash, source_hash_algo, conformance_level, last_synced, sync_status,
  media_type, lineage; format_version for .affex, tracked independently of the
  language version_pin per owner directive). source_hash is RECORDED (sentinel
  PENDING-FIRST-SYNC until upstream lands) and emitted verbatim — the offline
  generator never fetches, so --check stays deterministic. Populates the
  reserved `language` stream with affine/affex/affmap.
- .machine_readable/REGISTRY.a2ml + TOPOLOGY.md: regenerated (28 local + 3
  external = 31 specs; language stream now rendered).
- hypatia-rules/registry-staleness.a2ml (HYP-S006): extend to verify external
  pointers by re-fetching canonical_url (the network-side check the offline
  generator and registry-verify.yml can't do); reject md5/sha1; treat the
  sentinel as awaiting-upstream, not drift; cap external re-pin to :review
  (owner decision, not an auto-regen).
- REGISTRY.adoc: document the external-pointer entry shape + .affcite note.

No duplicate HYP-S006 and no parallel top-level REGISTRY.a2ml: this extends
main's system rather than competing with it. Workflow CI fixes moved to a
separate PR (#363).

Author: claude

.machine_readable/REGISTRY.a2ml

@@ -7,16 +7,20 @@
 # Regenerate with:  bash scripts/build-registry.sh   (or: just registry)
 # Source of truth:  the SPECS table in scripts/build-registry.sh + the file tree.
 #
-# Each entry's `source_hash` is a sha256 over `git ls-files -s <home>`, so it
-# changes whenever any tracked file under the spec's home changes. Hypatia rule
-# HYP-S006 (hypatia-rules/registry-staleness.a2ml) recomputes these and emits a
+# LOCAL entries: `source_hash` is a sha256 over `git ls-files -s <home>`, so it
+# changes whenever any tracked file under the spec's home changes.
+# EXTERNAL entries (kind = "external"): a verified POINTER to a spec whose SSOT
+# lives in another repo. `source_hash` is RECORDED (sentinel PENDING-FIRST-SYNC
+# until upstream lands), not computed locally — the offline generator emits it
+# verbatim. Hypatia rule HYP-S006 (hypatia-rules/registry-staleness.a2ml)
+# recomputes LOCAL hashes and re-fetches EXTERNAL canonical_urls, emitting a
 # `doc.drift` finding (strategy :review) when a recorded hash goes stale.
 
 [registry]
 version = "1.0.0"
 generator = "scripts/build-registry.sh"
-hash_algorithm = "sha256(git ls-files -s <home>)"
-entry_count = 28
+hash_algorithm = "sha256(git ls-files -s <home>)  # local; external: recorded pin"
+entry_count = 31
 
 [registry.streams]
 foundation  = "A2ML format family + K9 + contractiles (Stream 1)"
@@ -278,4 +282,59 @@ canonical_doc = "a2ml-templates/STATE.a2ml.v2.spec.adoc"
 source_hash = "sha256:5105bc72621b6214f1adecdf33a1dadf62d1d2b0afd0c2c6a48bbc5e24e9a454"
 route = "copy-in templates for the 7 A2ML files"
 
+[[spec]]
+id = "affine-spec"
+name = "AffineScript .affine (faces / source documents)"
+stream = "language"
+kind = "external"
+spec_kind = "language-coupled"
+owning_repo = "hyperpolymath/affinescript"
+canonical_url = "https://github.com/hyperpolymath/affinescript/blob/main/spec/affine.adoc"
+version_pin = "v2.0.0"
+source_hash = "PENDING-FIRST-SYNC"
+source_hash_algo = "sha256"
+conformance_level = "draft"
+last_synced = "never"
+sync_status = "awaiting-upstream"
+media_type = "application/vnd.affinescript.affine"
+lineage = "affinescript:affine@2"
+route = "faces, canonical-lowering invariant, canonical islands, idiom packs, mimicry bindings, project face policy"
+
+[[spec]]
+id = "affex-manifest"
+name = "AffineScript .affex (face-interop manifest)"
+stream = "language"
+kind = "external"
+spec_kind = "language-coupled"
+owning_repo = "hyperpolymath/affinescript"
+canonical_url = "https://github.com/hyperpolymath/affinescript/blob/main/spec/affex.adoc"
+version_pin = "v2.0.0"
+source_hash = "PENDING-FIRST-SYNC"
+source_hash_algo = "sha256"
+conformance_level = "draft"
+last_synced = "never"
+sync_status = "awaiting-upstream"
+media_type = "application/vnd.affinescript.affex"
+lineage = "affinescript:affex@2"
+route = "derived regenerable manifest; declaration heads not full bodies; format_version bumps independently"
+format_version = "2"  # tracked independently of version_pin
+
+[[spec]]
+id = "affmap-provenance"
+name = "AffineScript .affmap (provenance)"
+stream = "language"
+kind = "external"
+spec_kind = "language-coupled"
+owning_repo = "hyperpolymath/affinescript"
+canonical_url = "https://github.com/hyperpolymath/affinescript/blob/main/spec/affmap.adoc"
+version_pin = "v2.0.0"
+source_hash = "PENDING-FIRST-SYNC"
+source_hash_algo = "sha256"
+conformance_level = "draft"
+last_synced = "never"
+sync_status = "awaiting-upstream"
+media_type = "application/vnd.affinescript.affmap"
+lineage = "affinescript:affmap@2"
+route = "provenance format; own pointer for independent staleness tracking"
+
 ### End of REGISTRY.a2ml

REGISTRY.adoc

@@ -39,13 +39,48 @@ The registry is *honest by construction*: the generator only emits a spec
 whose `home` directory actually exists, and reports a missing home to stderr
 rather than inventing one.
 
+=== External pointers (specs whose SSOT lives in another repo)
+
+Some specs are *language/service-coupled*: their source-of-truth deliberately
+lives in another repo whose release cadence this monorepo must not own. The
+clearest example is the AffineScript v2 standards — `.affine` (faces / source
+documents), `.affex` (face-interop manifest) and `.affmap` (provenance) — whose
+SSOT is `hyperpolymath/affinescript`. For these the registry holds a *verified
+pointer, never a copy*; duplicating the normative text would create two sources
+of truth and guarantee drift.
+
+External entries carry `kind = "external"` and, in place of a local `home`:
+
+[cols="1,3", options="header"]
+|===
+| Field | Meaning
+
+| `spec_kind` | `language-coupled` or `service-coupled`.
+| `owning_repo` | The repo that authors + versions the spec.
+| `canonical_url` | The upstream source-of-truth document (what HYP-S006 fetches).
+| `version_pin` | The upstream version/tag this pointer is pinned to.
+| `source_hash` | The *recorded* upstream hash, or the sentinel `PENDING-FIRST-SYNC` until upstream lands. NEVER fabricated; NEVER fetched at generation time.
+| `source_hash_algo` | `sha256` (md5/sha1 are rejected as unverified).
+| `media_type` / `lineage` | Provenance fields, consistent with the lineage convention.
+| `format_version` | Only for regenerable artefacts (e.g. `.affex`) whose format version is tracked *independently* of `version_pin`.
+|===
+
+Because the generator is offline and deterministic, an external entry's
+`source_hash` is *recorded* in the `EXTERNAL_SPECS` table in the generator and
+emitted verbatim, so `--check` stays a pure function of the committed tree. The
+network-side verification (re-fetching `canonical_url`) is HYP-S006's job, and
+re-pinning a pointer is capped to `:review` — an owner decision, never an
+auto-regen. (`.affcite.a2ml` is a CodeCite-profile A2ML artefact in the
+AffineScript repo, not a separate registry pointer.)
+
 == How `source_hash` works (and why it catches drift)
 
 `git ls-files -s <home>` lists every tracked file under a home together with
 its blob SHA and path. Hashing that listing yields a fingerprint that changes
 whenever *any* tracked file under the spec changes — content, addition, or
 removal. Recording it in the registry means a later recompute can prove
-whether a spec has moved underneath its documentation.
+whether a spec has moved underneath its documentation. (For external pointers,
+the recorded hash is instead checked against a fresh fetch of `canonical_url`.)
 
 == Regenerating (the generator)
 

TOPOLOGY.md

@@ -9,7 +9,7 @@
 > It cannot freeze: every regeneration re-reads ground truth. Do not edit by hand.
 
 - **Phase:** active   |  **Maturity:** experimental   |  **STATE last-updated:** 2026-06-02T18:00:00Z
-- **Registry entries:** 28 specs across 6 streams
+- **Registry entries:** 31 specs across 6 streams
 - **Front door:** human → [README.adoc](README.adoc); machine → [0-AI-MANIFEST.a2ml](0-AI-MANIFEST.a2ml)
 - **Registry:** [.machine_readable/REGISTRY.a2ml](.machine_readable/REGISTRY.a2ml) (index + source hashes) · prose: [REGISTRY.adoc](REGISTRY.adoc)
 
@@ -30,6 +30,14 @@
 | PLAYBOOK.a2ml spec | [`playbook-a2ml/`](playbook-a2ml/) | executable operational runbooks |
 | ANCHOR.a2ml spec | [`anchor-a2ml/`](anchor-a2ml/) | project-recalibration intervention format |
 
+### Language — AffineScript + language policy (Stream 2)
+
+| Spec | Home | If you want… |
+|---|---|---|
+| AffineScript .affine (faces / source documents) | [`hyperpolymath/affinescript`](https://github.com/hyperpolymath/affinescript/blob/main/spec/affine.adoc) `@ v2.0.0` ⇗ | faces, canonical-lowering invariant, canonical islands, idiom packs, mimicry bindings, project face policy |
+| AffineScript .affex (face-interop manifest) | [`hyperpolymath/affinescript`](https://github.com/hyperpolymath/affinescript/blob/main/spec/affex.adoc) `@ v2.0.0` ⇗ | derived regenerable manifest; declaration heads not full bodies; format_version bumps independently |
+| AffineScript .affmap (provenance) | [`hyperpolymath/affinescript`](https://github.com/hyperpolymath/affinescript/blob/main/spec/affmap.adoc) `@ v2.0.0` ⇗ | provenance format; own pointer for independent staleness tracking |
+
 ### Protocols
 
 | Spec | Home | If you want… |

hypatia-rules/registry-staleness.a2ml

@@ -1,10 +1,17 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 # HYP-S006 — Registry Staleness / Doc Drift
 # Detects when the verifiable spec registry (.machine_readable/REGISTRY.a2ml)
-# no longer matches the file tree, or when DERIVED docs (TOPOLOGY.md) were
+# no longer matches ground truth, or when DERIVED docs (TOPOLOGY.md) were
 # hand-edited away from their generated form. Drift becomes a routed finding
 # the moment it lands — not something noticed 60 days later.
 #
+# Covers BOTH registry entry shapes:
+#   * LOCAL specs    — recorded source_hash vs a fresh git-ls-files compute.
+#   * EXTERNAL specs (kind="external") — verified pointers to specs whose SSOT
+#     lives in another repo (e.g. AffineScript .affine/.affex/.affmap). The
+#     recorded source_hash is checked against a fresh fetch of canonical_url;
+#     re-pinning is capped to :review (owner decision, not an auto-regen).
+#
 # Companion to scripts/build-registry.sh (the generator) and
 # .github/workflows/registry-verify.yml (the in-repo --check gate). This rule
 # is the estate-side half: it lets Hypatia surface the same drift across the
@@ -13,7 +20,7 @@
 @rule(version="1.0"):
 id: HYP-S006
 name: "Registry staleness / doc drift"
-description: "Alert when a spec's recorded source_hash in REGISTRY.a2ml no longer matches a fresh compute, or a DERIVED doc (TOPOLOGY.md) drifted from its generator"
+description: "Alert when a spec's recorded source_hash in REGISTRY.a2ml no longer matches a fresh compute (local) or a fresh fetch of canonical_url (external pointer), or a DERIVED doc (TOPOLOGY.md) drifted from its generator"
 severity: medium
 category: StandardsCompliance
 auto_fixable: true
@@ -33,23 +40,60 @@ find:
 @end
 
 @logic(engine="built-in"):
-# Recompute each spec's source_hash the same way the generator does
-# (sha256 over `git ls-files -s <home>`) and compare to the recorded value.
+# Two entry shapes share one registry:
+#   * LOCAL  (no `kind`)        — recompute sha256 over `git ls-files -s <home>`
+#                                 exactly as the generator does, compare to the
+#                                 recorded value.
+#   * EXTERNAL (kind="external")— a verified pointer to a spec whose SSOT is
+#                                 another repo. Re-fetch canonical_url and
+#                                 recompute with source_hash_algo (sha256+;
+#                                 md5/sha1 are rejected as UNVERIFIED), compare
+#                                 to the recorded source_hash. This is the
+#                                 network-side check the offline generator and
+#                                 the in-repo registry-verify.yml cannot do.
 steps:
   - parse_registry: ".machine_readable/REGISTRY.a2ml"
     extract:
       - key: "home"
         as: home
+      - key: "kind"
+        as: kind
+      - key: "canonical_url"
+        as: canonical_url
+      - key: "source_hash_algo"
+        as: algo
+      - key: "sync_status"
+        as: sync_status
       - key: "source_hash"
         as: recorded_hash
-  - for_each_spec:
+  # --- LOCAL specs -------------------------------------------------------
+  - for_each_spec where "kind != external":
       recompute: "sha256(git ls-files -s ${home})"
       compare_to: recorded_hash
       emit_if: "recompute != recorded_hash"
         finding_kind: registry-hash-stale
-  - check_home_exists:
+  - check_home_exists where "kind != external":
       emit_if: "home directory absent"
       finding_kind: registry-dead-home
+  # --- EXTERNAL specs (verified pointers; SSOT in another repo) ----------
+  - reject_weak_algo where "kind == external":
+      emit_if: "algo in [md5, sha1]"        # security policy: no MD5/SHA1
+      finding_kind: registry-weak-algo
+  - for_each_spec where "kind == external && recorded_hash != 'PENDING-FIRST-SYNC'":
+      fetch: canonical_url
+      recompute: "${algo}(fetched_content)"
+      compare_to: recorded_hash
+      emit_if: "recompute != recorded_hash"
+        finding_kind: registry-pointer-stale
+  - for_each_spec where "kind == external && recorded_hash == 'PENDING-FIRST-SYNC'":
+      # Not drift — upstream has not landed yet. Surface as info, and as a
+      # low finding only once it has sat unsynced beyond the grace window.
+      fetch: canonical_url
+      emit_if: "fetch succeeds"
+        finding_kind: registry-pointer-ready      # ready for first sync (info)
+      emit_if: "still PENDING beyond ${stale_after_days}d"
+        finding_kind: registry-pointer-unsynced   # low
+  # --- DERIVED docs ------------------------------------------------------
   - check_derived_docs:
       command: "bash scripts/build-registry.sh --check"
       emit_if: "non-zero exit"
@@ -76,14 +120,18 @@ strategy_caps:
   - when: "finding_kind == registry-dead-home"
     cap: review
     reason: "A missing home is a structural change, not a regen — needs human triage"
+  - when: "finding_kind in [registry-pointer-stale, registry-pointer-unsynced, registry-weak-algo]"
+    cap: review
+    reason: "External pointers reference another repo's SSOT — re-pinning version_pin/source_hash is an owner decision, never an auto-regen (rebuild-registry cannot recompute a cross-repo hash offline)."
 @end
 
 @action:
 emit_signal: doc.drift
 message_template: >-
-  Registry drift: {finding_kind} for spec '{id}' (home={home}).
-  Recorded {recorded_hash}, recompute differs. Run 'just registry' to
-  regenerate, or triage if the home moved. ({age_days}d since generated)
+  Registry drift: {finding_kind} for spec '{id}' (home={home} url={canonical_url}).
+  Recorded {recorded_hash}, fresh compute/fetch differs. For LOCAL drift run
+  'just registry' to regenerate; for EXTERNAL pointers re-pin is an owner
+  decision (capped :review). ({age_days}d since generated)
 recipe: rebuild-registry
 severity_escalates_at: 60
 halt_on_violation: false