[campaign] standards carve-out: evict products/impls, keep the canon (spec + policy + registry + template) #479

Umbrella tracker for restoring standards to a canon repo — normative specs, policies, generated registries, and templates-as-spec — by evicting the products, implementations, and vendored copies that the 2026-02-08 monorepo absorption pulled in. Derived from a fresh architecture audit (2026-07). The mechanism already exists: the registry's kind = "external" pointer + HYP-S006 drift check, so each eviction flips a LOCAL entry to a hash-verified EXTERNAL pointer — nothing downstream breaks.

Guardrails: licence-adjacent items are flag-only / owner-decision per the Manual-Only licence policy — never swept here. No deletion by access-recency: "delete" below means move-to-docs/archive/ unless noted.

Charter — what STAYS when done

Normative spec text (RFC-2119) + grammars/schemas + conformance vectors · profiles & templates-as-spec · the generated REGISTRY.a2ml/TOPOLOGY.md · policies (licence, CODEOWNERS, remote-url, tooling-integrity, template-applicability) · the readiness-grade rubrics (CRG/TRG/ARG/FRG) · the HYP-S rule definitions.

Evict — product/implementation → home (each via a hash-pinned EXTERNAL registry pointer)

• a2ml/ (2,018 files: compiler, LSP, 5 bindings, website w/ CNAME+ads.txt) → hyperpolymath/a2ml. Keep the record/markup spec + profiles/ + templates in standards. (Its nested CI has been dead since absorption — GitHub only runs root workflows.)
• k9-svc/ (1,915 files: bindings, editors, LSP, pandoc, site, benchmarks) → hyperpolymath/k9-ecosystem (its own site copy already says this is the architecture). Keep SPEC.adoc + invariants + conformance vectors.
• k9-svc/actions/validate/ → hyperpolymath/k9-validate-action (exists) — duplicate of an executable CI action.
• avow-protocol/, axel-protocol/, consent-aware-http/ implementations (websites, DNS zones, compiled .res.js) → their existing same-name repos. Keep only PROTOCOL/THREAT-MODEL/charter spec text (or an external pointer).
• 0-ai-gatekeeper-protocol/mcp-repo-guardian/ → hyperpolymath/mcp-repo-guardian (exists); repo-guardian-fs/ → its own repo.
• rhodium-standard-repositories/satellites/ (964 vendored files, 11 repos) → their canonical repos (named in the stale .gitmodules); then delete the lying .gitmodules.
• rhodium-standard-repositories/{templates,contractiles,examples}/ → hyperpolymath/rsr-template-repo (doctrine names it THE operationalisation; two template sources = guaranteed drift).
• rhodium-pipeline/, ux-test-harness/, batch-rollout scripts → own repo / gitbot-fleet (estate-ops tooling, not spec).
• lol/ (corpus crawler) → its own repo.

Data out of spec dirs → registry/data store

• Grade data (AUDIT-FINDINGS-2026-05-28, ESTATE-AUDIT-BASELINE, per-dir session reports) → docs/archive/ or a new estate-audits repo; live grades → verisim-data. (Rubrics stay; grades-of-specific-repos are data.)
• PORT-REGISTRY.md assignments → verisim-data (derive from repo configs); keep only the uniqueness rule as policy.
• SATELLITES.a2ml → retire; it duplicates the generated registry without hash verification.

Delete / archive (scaffold junk & point-in-time reports at the canon root)

• stapeln.toml, contractile.just (stale generated output), audit-contractiles.sh, SECURITY_TRAINING_SUMMARY.md, the confusingly-nested standards/ subdir, session detritus (*-COMPLETE*.md, *SESSION_SUMMARY*, DEPLOYMENT-SUCCESS.md), RSR's stale root CLAUDE.md.

⚠️ Licence-flag items — OWNER decision, flag-only (do NOT sweep)

• toolchain-readiness-grades/references/007/ — 24 verbatim audits of the All-Rights-Reserved 007 repo sitting in a public canon repo → back to hyperpolymath/007. Licence exposure — surface to owner.
• PALIMPSEST.adoc full narrative → palimpsest-license repo, leave a one-paragraph pointer (only the three carve-out repos should "talk about" Palimpsest).

After-eviction hygiene (prevents recurrence)

• Add the review-tier "implementation-inside-canon" detector (fires when a registry LOCAL home contains Cargo.toml/deno.json/Containerfile/CNAME).
• Session-detritus auto-archiver fix-script.

Ordering: evict via external pointer + regenerate REGISTRY.a2ml in the same PR each time (so registry-verify proves nothing dangles). Sequence the biggest wins first (a2ml/, k9-svc/, satellites/). Child issues can be split per bullet.

Filed from the architecture audit; happy to split into per-eviction child issues on request.