From 1c737a6bbb565ef3f483056bd712b3be38cca9e7 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 31 Aug 2026 13:39:11 +0100 Subject: [PATCH 1/2] docs(policy): retire dead TS/RS carve-outs; reframe affinescript-cli as npm front door MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirrors the SSOT change in hyperpolymath/hypatia#739 (cicd_rules path_allow_prefixes). Retired, each proven a no-op estate-wide: - avow-protocol/telegram-bot/** (TS + RS tables): the bot was rewritten in AffineScript — zero .ts/.res on avow-protocol main — so the PERMANENT rationale no longer described reality. - affinescript-deno-test/** (all four tables): the test harness self-hosted to 100% .affine (affinescript#735/#736), meeting the row's own unblock condition. - **/tsconfig.json (TS tooling row): dead entry — the rule matches *.ts, so a .json path could never reach the allowlist. affinescript-cli/** reframed from bootstrap shim to npm front door (permanent runtime-agnostic distribution shim), retained under the npm + JavaScript tables only. LANGUAGE-POLICY.adoc: same retirements in the four language blocks, new v1.5.0 amendment, and :revnumber: corrected (stale at 1.2.2 since v1.3.0). EXEMPTION-MECHANISMS.adoc: swapped the retired telegram carve-out for a stable vscode example in the .governance-allowlist illustration. Co-Authored-By: Claude Fable 5 --- .claude/CLAUDE.md | 14 +-- docs/EXEMPTION-MECHANISMS.adoc | 4 +- .../spec/LANGUAGE-POLICY.adoc | 86 +++++++++++++------ 3 files changed, 67 insertions(+), 37 deletions(-) diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index 5c1fd6b0..db2fc7dd 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -249,14 +249,14 @@ Existing pre-2026-04-30 `.ts`/`.tsx` outside these carve-outs is grandfathered w |---|---|---|---| | `**/*.d.ts` | declaration | FFI/library type definitions (headers, not implementation). | Never — declaration files are the boundary, not the code. | | `**/bindings/deno/**`, `**/bindings/typescript/**`, `**/bindings/ts/**` | interop target | We expose work to TS/Deno consumers without authoring TS as primary code path. Exemplar: `proven/bindings/deno/` (72 files — Idris2 ABI exposed as Deno-native module). Parallel to V-lang `v-cartridge`/`v-adapter`/`v-bindings`/`v-client` carve-out. | Never — these are consumer-facing bindings. | -| `avow-protocol/telegram-bot/avow-telegram-bot/**` | PERMANENT | Telegraf / node-telegram-bot-api are the canonical TS-native libraries for the Bot API; no AffineScript binding planned. | AffineScript Telegram-bot bindings (no scheduled issue). | -| `**/vite.config.ts`, `**/vitest.config.ts`, `**/tsup.config.ts`, `**/tsconfig.json` | tooling | Build orchestration, not application code. | When AffineScript ships native equivalents. | -| `affinescript-deno-test/**`, `affinescript-cli/**` | bootstrap shim | TS/JS shims used to bootstrap the AffineScript test runner / CLI. | When AffineScript self-hosts these. | +| `**/vite.config.ts`, `**/vitest.config.ts`, `**/tsup.config.ts` | tooling | Build orchestration, not application code. | When AffineScript ships native equivalents. | | `rescript/**`, `servers/**`, `repos-monorepo/**`, `linguist/**` | upstream fork | Not estate-authored — vendored upstream code (ReScript compiler, third-party MCP servers, mass aggregator, GitHub linguist with `samples/TypeScript/*.ts` as ML training fixtures). | Never — upstream fork. | | `hyperpolymath-archive/**` | archived | GitHub-archived repos cannot accept PRs; TS is dormant. | Never — archived. | | `**/deps/**` | vendored package-manager dep | Elixir Mix vendored-dep directory (also adopted by other tools). Exemplar: `tma-mark2/deps/phoenix_live_view/assets/js/phoenix_live_view/*.ts` ships Phoenix LiveView's authored TS. | Never — vendored upstream. | | `**/vscode/**` (covers `editors/vscode/`, `extensions/vscode/`, `clients/vscode/`) | editor-host extension | VSCode extension entry points target the `vscode` extension-host API. Five estate repos (`universal-language-server-plugin`, `reposystem`, `proof-burrower`, `phronesis`, `bofj-kitt`) have a single `vscode/extension.ts`. | **Capability SHIPPED, verified 2026-08-28** — `affinescript/stdlib/Vscode.affine` (58 `extern fn`), `VscodeLanguageClient.affine` (4), the JS host shim `packages/affine-vscode/mod.js`, and `affine-vscode-publish.yml`. The remaining blocker is migration effort, not capability. Track under campaign #239; retire this row when the five VSCode extensions are ported. | +Retired 2026-08-31: the `avow-protocol/telegram-bot/**` carve-out (the bot was rewritten in AffineScript — zero `.ts` on main, so the "PERMANENT" rationale no longer described reality); the `affinescript-deno-test/**` + `affinescript-cli/**` bootstrap-shim row (the test harness self-hosted to 100% `.affine` via affinescript#735/#736, and the cli is JS-only — see the npm/JavaScript tables below for its surviving front-door carve-out); and the `**/tsconfig.json` pattern (dead entry — the rule matches `*.ts`, so a `.json` path could never reach the allowlist). + Adding to this list requires explicit user approval and an unblock condition (except the structural classes above, which are estate-wide policy). The detection rule and its `path_allow_prefixes` field are the single source of truth; this table mirrors that for human readability. ### ReScript Exemptions (Approved) @@ -274,8 +274,8 @@ Existing pre-2026-05-25 `.res`/`.resi` outside these carve-outs is grandfathered | `**/deps/**`, `**/node_modules/**` | vendored package-manager dep | Mix-style vendored deps and Node-style node_modules. | Never — vendored upstream. | | `**/vscode/**` (covers `editors/vscode/`, `extensions/vscode/`, `clients/vscode/`) | editor-host extension | VSCode extension entry points target the `vscode` extension-host API. | When AffineScript ships the VSCode-extension API binding (top-50 roadmap, unshipped). | | `**/lib/js/**`, `**/lib/es6/**`, `**/lib/bs/**` | compiled output | bsc (the ReScript compiler) emits to these paths. They are not source. | Never — compiler output, not source. | -| `affinescript-deno-test/**`, `affinescript-cli/**` | bootstrap shim | Bootstrap the AffineScript toolchain itself. | When AffineScript self-hosts these. | -| `avow-protocol/telegram-bot/avow-telegram-bot/**` | PERMANENT | Mirrors TS Telegraf carve-out for any `.res` file in the same directory. | Never. | + +Retired 2026-08-31: the bootstrap-shim row (`affinescript-deno-test/**`, `affinescript-cli/**`) and the telegram-bot mirror row — both directories are 100% AffineScript on main and neither ever tracked a `.res` file, so removal changes no scan outcome. ### npm Exemptions (Approved) @@ -288,7 +288,7 @@ Migration substantially complete 2026-05-31 under umbrella `hyperpolymath/standa | `**/vscode/**` | VSCode extension host-required (segment) | VSCode extension toolchain runs under Node; lockfile is contractually required by the host. | When AffineScript ships the VSCode-extension API binding. | | `vscode-` substring (`vscode-extension/`, `editors/vscode-007/`, `vscode-a2ml`, `vscode-k9`, …) | VSCode-* extension repos / subdirs | Same VSCode host-required toolchain rationale; different path-segment shape than `/vscode/`. | When AffineScript ships the VSCode-extension API binding. | | `tree-sitter-` substring (`tree-sitter-a2ml`, `tree-sitter-k9`, `editors/tree-sitter-ephapax`, `tree-sitter-affinescript/`, …) | tree-sitter grammar npm-publish target | Class C consumer artifact — tree-sitter grammars ship via npm with `node-gyp` native binding because every consumer (Atom/Neovim/VSCode TextMate) links the native addon. | Never — npm-publishable consumer artifact with native binding. | -| `affinescript-deno-test/**`, `affinescript-cli/**` | bootstrap shim | Bootstrap the AffineScript toolchain itself. | When AffineScript self-hosts these. | +| `affinescript-cli/**` | npm front door | Permanent npm distribution shim for the AffineScript toolchain (downloads the pinned native binary, SHA-256-verifies, caches, execs). Deliberately runtime-agnostic JS; reframed 2026-08-31 from "bootstrap shim" — the shim is the front door, not scaffolding awaiting self-hosting. (`affinescript-deno-test/**` dropped the same day: the harness self-hosted to 100% `.affine`.) | Never — distribution boundary; an npm shim cannot be `.affine`. | | `rescript/**`, `servers/**`, `repos-monorepo/**`, `linguist/**` | upstream fork | Not estate-authored — vendored upstream code. | Never — upstream fork. | | `hyperpolymath-archive/**` | archived | Archived repos cannot accept PRs. | Never — archived. | | `**/deps/**`, `**/node_modules/**` | vendored package-manager dep | Vendored deps. | Never — vendored upstream. | @@ -307,7 +307,7 @@ Distinct from TS/RS policy: JavaScript is *allowed* where AffineScript cannot re |---|---|---|---| | `mcp-bridge/**`, `**/plugins/**` | host-required by ecosystem | MCP servers and plugin entry points where JS is the host contract (the host loads .js, not .affine). | When AS plugin-host bindings ship (top-50 roadmap). | | `**/*.config.js`, `**/*.config.cjs`, `**/*.config.mjs` | tooling configs | Build orchestration. | When AS ships native equivalents. | -| `affinescript-deno-test/**`, `affinescript-cli/**` | bootstrap shim | Bootstrap the AffineScript toolchain itself. | When AS self-hosts these. | +| `affinescript-cli/**` | npm front door | Permanent npm distribution shim for the AffineScript toolchain — same row as the npm table above; the cli's 4 JS files are the shim itself. (`affinescript-deno-test/**` dropped 2026-08-31: harness self-hosted to 100% `.affine`.) | Never — distribution boundary. | | `rescript/**`, `servers/**`, `repos-monorepo/**`, `linguist/**` | upstream fork | Not estate-authored — vendored upstream code (linguist samples are ML training data). | Never — upstream fork. | | `hyperpolymath-archive/**` | archived | Archived repos cannot accept PRs. | Never — archived. | | `**/deps/**`, `**/node_modules/**` | vendored package-manager dep | Vendored deps. | Never — vendored upstream. | diff --git a/docs/EXEMPTION-MECHANISMS.adoc b/docs/EXEMPTION-MECHANISMS.adoc index 075ea3a1..fdf03401 100644 --- a/docs/EXEMPTION-MECHANISMS.adoc +++ b/docs/EXEMPTION-MECHANISMS.adoc @@ -206,8 +206,8 @@ Optional plain-text file at the repo root. One glob per line. Lines starting with `#` are comments. Blank lines are ignored. ---- -# Telegram bot binding (no AffineScript binding planned) -avow-protocol/telegram-bot/avow-telegram-bot/** +# VSCode extension host code (blocked on AS extension-API binding) +editors/vscode/** # Bench harness fixtures test/perf/fixtures/*.ts diff --git a/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc b/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc index 02561686..7b5c6ae9 100644 --- a/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc +++ b/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc @@ -3,20 +3,20 @@ = RSR Language Policy :author: Jonathan D.A. Jewell (hyperpolymath) -:revnumber: 1.2.2 -:revdate: 2026-05-16 +:revnumber: 1.5.0 +:revdate: 2026-08-31 :toc: left :icons: font :source-repo: https://github.com/hyperpolymath/cccp [NOTE] ==== -*Version Status*: v1.2.2 — adds the Explicit-Escape Principle (every estate -default must offer a tool-honoured escape). v1.2.1 added the Naming Convention -(separator semantics, RFC 8552-grounded, scoped override for foreign/inverted -conventions). v1.2.0 codified the Interface & Architecture Law (ABI=Idris2, -API+FFI=Zig; strict typed boundaries; no gatekeeperless gateways). v1.1.0 -amended the allowed/banned lists 2026-04-10. See §Amendments for the full list. +*Version Status*: v1.5.0 — retires the telegram-bot, `affinescript-deno-test/` +and `tsconfig.json` carve-outs; reframes `affinescript-cli/` as the permanent +npm front door. v1.4.0 codified the ReScript/npm/Unnecessarily-JS Layer-1 +policy. v1.3.0 codified the TS → AffineScript migration state. v1.2.2 added +the Explicit-Escape Principle (every estate default must offer a tool-honoured +escape). See §Amendments for the full list. ==== == Terminology: "Rust" means "Rust/SPARK" @@ -131,31 +131,34 @@ NOTE: For full rationale and migration guides, see the link:{source-repo}[CCCP r (see project tracker `project_estate_ts_to_affinescript_2026_05_28.md`). Detection is the hypatia rule `cicd_rules/typescript_detected` (matches `*.ts`) - with `path_allow_prefixes` covering nine carve-out classes: + with `path_allow_prefixes` covering seven carve-out classes: (1) `*.d.ts` declaration files (FFI/library type definitions — these are headers, not implementation); (2) `*/bindings/deno/`, `*/bindings/typescript/`, `*/bindings/ts/` interop targets where we expose work to TS/Deno consumers without authoring TS as our primary code path (exemplar: `proven/bindings/deno/`); - (3) `avow-protocol/telegram-bot/avow-telegram-bot/**` — Telegraf - is the canonical TS-native Bot-API library, no AffineScript - binding planned (PERMANENT exemption); (4) tooling configs - (`vite.config.ts`, `vitest.config.ts`, `tsup.config.ts`, - `tsconfig.json`) — these are build orchestration, not application - code; (5) bootstrap shims (`affinescript-deno-test/`, `affinescript-cli/`) - — TS/JS that bootstraps the AS toolchain itself; - (6) upstream forks not estate-authored (`rescript/` ReScript + (3) tooling configs + (`vite.config.ts`, `vitest.config.ts`, `tsup.config.ts`) + — these are build orchestration, not application + code; + (4) upstream forks not estate-authored (`rescript/` ReScript compiler, `servers/` third-party MCP servers, `repos-monorepo/` mass aggregator, `linguist/` GitHub language classifier whose `samples/TypeScript/*.ts` are ML training fixtures); - (7) `hyperpolymath-archive/**` archived repos with dormant TS; - (8) `**/deps/**` Elixir Mix vendored package-manager directory + (5) `hyperpolymath-archive/**` archived repos with dormant TS; + (6) `**/deps/**` Elixir Mix vendored package-manager directory (exemplar: `tma-mark2/deps/phoenix_live_view/assets/js/phoenix_live_view/*.ts` ships Phoenix LiveView's authored TS, vendored as a hex-mix dep); - (9) `**/vscode/**` editor-host extensions (covers `editors/vscode/`, + (7) `**/vscode/**` editor-host extensions (covers `editors/vscode/`, `extensions/vscode/`, `clients/vscode/`) — five estate repos have a `vscode/extension.ts` blocked on AffineScript's VSCode-extension - API binding (top-50 roadmap, unshipped). Unsound gradual typing is + API binding (top-50 roadmap, unshipped). Retired 2026-08-31 (v1.5.0): + the telegram-bot PERMANENT carve-out (bot rewritten in AffineScript), + the `affinescript-deno-test/`/`affinescript-cli/` bootstrap-shim class + (harness self-hosted to `.affine`; the cli survives under the Node/JS + rules as the npm front door), and the dead `tsconfig.json` pattern + (the rule matches `*.ts`, so a `.json` path never reached the + allowlist). Unsound gradual typing is the underlying technical objection; AffineScript provides affine/linear types plus typed-wasm output. @@ -168,7 +171,7 @@ NOTE: For full rationale and migration guides, see the link:{source-repo}[CCCP r hyperpolymath/standards#252; STEPS #260/#264/#267/#269/#272/#276/#278/#279/#280). Detection: hypatia rules `cicd_rules/rescript_detected` (matches `*.res`) and `cicd_rules/rescript_interface_detected` (matches - `*.resi`) with `path_allow_prefixes` covering eight carve-out + `*.resi`) with `path_allow_prefixes` covering six carve-out classes: (1) `bsconfig.json`, `*.config.res` tooling configs; (2) `rescript/`, `servers/`, `repos-monorepo/`, `linguist/` @@ -179,10 +182,11 @@ NOTE: For full rationale and migration guides, see the link:{source-repo}[CCCP r (5) `**/vscode/**` editor-host extensions (blocked on AS VSCode-extension API binding); (6) `**/lib/js/**`, `**/lib/es6/**`, `**/lib/bs/**` bsc compilation - output (not source); - (7) `affinescript-deno-test/`, `affinescript-cli/` bootstrap shims; - (8) `avow-protocol/telegram-bot/avow-telegram-bot/**` Telegraf - carve-out (PERMANENT exemption mirror of TS class 3). + output (not source). + Retired 2026-08-31 (v1.5.0): the bootstrap-shim and telegram-bot + mirror classes — all three directories are 100% AffineScript on main + and none ever tracked a `.res` file, so removal changes no scan + outcome. Existing `.res` migrates to `.affine` directly (do not pass through ReScript-to-TS first). @@ -197,7 +201,10 @@ NOTE: For full rationale and migration guides, see the link:{source-repo}[CCCP r (1b) `vscode-` substring (extension repos/subdirs); (1c) `tree-sitter-` substring (grammar npm-publish targets, Class C consumer artefact with native binding); - (2) `affinescript-deno-test/`, `affinescript-cli/` bootstrap shims; + (2) `affinescript-cli/` npm front door — the permanent npm + distribution shim for the AffineScript toolchain (reframed + 2026-08-31 from "bootstrap shim"; `affinescript-deno-test/` dropped + the same day — harness self-hosted to `.affine`); (3) `rescript/`, `servers/`, `repos-monorepo/`, `linguist/` upstream forks; (4) `hyperpolymath-archive/**` archived repos; @@ -241,7 +248,9 @@ NOTE: For full rationale and migration guides, see the link:{source-repo}[CCCP r (1) `mcp-bridge/`, `**/plugins/**` host-required (JS is the host contract); (2) `**/*.config.{js,cjs,mjs}` tooling configs; - (3) `affinescript-deno-test/`, `affinescript-cli/` bootstrap shims; + (3) `affinescript-cli/` npm front door (permanent distribution shim; + `affinescript-deno-test/` dropped 2026-08-31 — harness self-hosted + to `.affine`); (4) `rescript/`, `servers/`, `repos-monorepo/`, `linguist/` upstream forks; (5) `hyperpolymath-archive/**` archived repos; @@ -566,6 +575,27 @@ not prose alone. == Amendments +=== v1.5.0 — 2026-08-31 (Jonathan D.A. Jewell) + +Retired three dead carve-outs, verified no-op estate-wide against every +location the hypatia `path_allow_prefixes` substrings could match: +(1) the `avow-protocol/telegram-bot/**` TS/RS "PERMANENT" exemption — +the bot was rewritten in AffineScript (zero `.ts`/`.res` on main), so +the "no AffineScript binding planned" rationale no longer described +reality; (2) the `affinescript-deno-test/**` bootstrap-shim exemption +across all four rules — the test harness self-hosted to 100% `.affine` +(affinescript#735/#736), meeting its own unblock condition; (3) the +`tsconfig.json` pattern in the TS tooling class — dead entry, since +`cicd_rules/typescript_detected` matches `*.ts` and a `.json` path can +never reach the allowlist. `affinescript-cli/**` was simultaneously +reframed from "bootstrap shim" to *npm front door* — a permanent +runtime-agnostic JS distribution shim (downloads the pinned native +binary, SHA-256-verifies, caches, execs) — retained under the Node/npm +and JavaScript rules only, and removed from the TS/ReScript rules it +never needed. SSOT change: hypatia#739; mirrors updated here and in +`.claude/CLAUDE.md`. Also corrected `:revnumber:`, stale at 1.2.2 +since v1.3.0. + === v1.4.0 — 2026-05-30 (Jonathan D.A. Jewell) Codified the *ReScript / npm / Unnecessarily-JavaScript Layer-1 policy From 09c541b2bdc68451c50ad9f736733e3cf7316934 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 31 Aug 2026 13:51:59 +0100 Subject: [PATCH 2/2] chore: regenerate REGISTRY.a2ml after spec edits The LANGUAGE-POLICY.adoc v1.5.0 bump and the two doc edits changed the source hashes the registry embeds, which failed 'Registry + topology in sync' directly and broke three scorecard pass-checks that run build-registry.sh --check (surfacing as the wave3 Self Test failure). Co-Authored-By: Claude Fable 5 --- .machine_readable/REGISTRY.a2ml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.machine_readable/REGISTRY.a2ml b/.machine_readable/REGISTRY.a2ml index c1d8390d..9db81ded 100644 --- a/.machine_readable/REGISTRY.a2ml +++ b/.machine_readable/REGISTRY.a2ml @@ -207,7 +207,7 @@ name = "RSR — Rhodium Standard Repositories" stream = "governance" home = "rhodium-standard-repositories/" canonical_doc = "rhodium-standard-repositories/README.adoc" -source_hash = "sha256:f9d32937c6d0541c82ada3d7c42cb7347fd4bbb3daa167b51b0cc420824918cc" +source_hash = "sha256:54e6aaf0c2df95ed896774bc267ab3139b2a4bf0f78e2a0d46e284150d054799" route = "the repository-compliance standard every repo is graded against" [[spec]]