M0+M1+M2: workspace, engine skeleton, T0 catalogue + falsifier gate

.github/workflows/main-estate-audit.yml

@@ -1,92 +1,12 @@
-# SPDX-License-Identifier: MPL-2.0
 name: Central Estate CI/CD Audit
 
 on:
   push:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  workflow_call:
 
 jobs:
-  estate-audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7.0.1
-
-      - name: Required Files Gate
-        uses: hyperpolymath/cicd-suite/actions/required-files-check@main
-
-      - name: Code Hygiene Gate
-        uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@main
-
-      - name: Manifest Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/manifest-check@main
-
-      - name: Idris2 ABI Purity Gate
-        uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@main
-
-      - name: Zig Hexadeca API Gate
-        uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@main
-
-      - name: Contractile Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@main
-
-      - name: Recipes Set Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/recipes-set-check@main
-
-      - name: Affirmation Document Gate
-        uses: hyperpolymath/cicd-suite/actions/affirmation-check@main
-
-      - name: Academic Referencing Gate
-        uses: hyperpolymath/cicd-suite/actions/referencing-check@main
-
-      - name: Semantic Audit Gate
-        uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@main
-
-      - name: SPDX License Gate
-        uses: hyperpolymath/cicd-suite/actions/spdx-license-check@main
-
-      - name: Proof Runner Gate
-        uses: hyperpolymath/cicd-suite/actions/proof-runner-check@main
-
-      - name: PRAT Testing Gate
-        uses: hyperpolymath/cicd-suite/actions/prat-check@main
-
-      - name: Panic Attack & Pons Gate
-        uses: hyperpolymath/cicd-suite/actions/custom-tools-check@main
-
-      - name: WWW & Well-Known Compliance Gate
-        uses: hyperpolymath/cicd-suite/actions/www-compliance-check@main
-
-      - name: BoJ Cartridge Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@main
-
-      - name: Formatting Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/formatting-check@main
-
-      - name: Accreditations & Badges Gate
-        uses: hyperpolymath/cicd-suite/actions/badges-check@main
-
-      - name: Metrics Extraction Gate
-        uses: hyperpolymath/cicd-suite/actions/metrics-check@main
-
-      - name: Linguist & Banned Languages Gate
-        uses: hyperpolymath/cicd-suite/actions/linguist-check@main
-
-      - name: Test & Benchmarks Dashboard Gate
-        uses: hyperpolymath/cicd-suite/actions/tests-benches-check@main
-
-      - name: Hosting & Site Status Gate
-        uses: hyperpolymath/cicd-suite/actions/hosting-check@main
-
-      - name: Git-Sea Analytics Gate
-        uses: hyperpolymath/cicd-suite/actions/gitsea-check@main
-
-      - name: Trust & Humans Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/trust-humans-check@main
-
-      - name: Are We UnAPI Gate (Secret Scanning)
-        uses: hyperpolymath/cicd-suite/actions/secrets-check@main
-
-      - name: Reasonably Good Token Validation Gate
-        uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@main
+  call-estate-audit:
+    uses: hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@feat/cicd-workflow-call

.github/workflows/rust-ci.yml

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: MPL-2.0
+name: rust-ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - name: fmt
+        run: cargo fmt --check
+      - name: clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings
+        env:
+          RUSTFLAGS: "-D warnings"
+      - name: test
+        run: cargo test --workspace

.github/workflows/scorecard.yml

@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Scorecard
+
+on:
+  schedule:
+    - cron: "0 0 * * 0"
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+  id-token: write
+
+jobs:
+  scorecard:
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@1f3eef621985b2dd0e7e2d3ac265c0f0ba6b0a78

.github/workflows/secret-scanner.yml

@@ -16,5 +16,5 @@ permissions:
   contents: read
 jobs:
   secret-scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@1f3eef621985b2dd0e7e2d3ac265c0f0ba6b0a78
     secrets: inherit

.gitignore

@@ -1,5 +1,90 @@
 /target
 **/*.rs.bk
-Cargo.lock
+# Cargo.lock  # kept: pons-cli builds a binary, so the lockfile is committed
 .DS_Store
 *.log
+# SPDX-License-Identifier: MPL-2.0
+# RSR-compliant .gitignore
+
+# OS & Editor
+Thumbs.db
+*.swp
+*.swo
+*~
+.idea/
+.vscode/
+# Build (unanchored to match nested monorepo paths)
+target/
+_build/
+/build/
+/dist/
+/out/
+zig-out/
+zig-cache/
+.zig-cache/
+# Dependencies
+/node_modules/
+/vendor/
+/deps/
+/.elixir_ls/
+# Rust
+# Cargo.lock  # Keep for binaries
+# Elixir
+/cover/
+/doc/
+*.ez
+erl_crash.dump
+# Julia
+*.jl.cov
+*.jl.mem
+/Manifest.toml
+# ReScript
+/lib/bs/
+/.bsb.lock
+# Python (SaltStack only)
+__pycache__/
+*.py[cod]
+.venv/
+# Ada/SPARK
+*.ali
+/obj/
+/bin/
+# Haskell
+/.stack-work/
+/dist-newstyle/
+# Chapel
+*.chpl.tmp.*
+# Secrets
+.env
+.env.*
+*.pem
+*.key
+secrets/
+# Test/Coverage
+/coverage/
+htmlcov/
+# Logs
+/logs/
+# Machine-readable locks
+.machine_readable/.locks/
+# Temp
+/tmp/
+*.tmp
+*.bak
+# ReScript/OCaml compiler artifacts
+*.cmt
+*.cmti
+*.cmi
+# asdf version manager
+.tool-versions
+# Rust build artefacts (innervation tools)
+inline-annotations/extractor/target/
+k9-coordination-protocol/tools/k9-init/target/
+hooks/playbook-to-recipe/target/
+inline-annotations/extractor/Cargo.lock
+k9-coordination-protocol/tools/k9-init/Cargo.lock
+hooks/playbook-to-recipe/Cargo.lock
+.verisimdb/ecosystem-ingest/target/
+.verisimdb/ecosystem-ingest/Cargo.lock
+# Backup/scratch files (never commit)
+*.backup