docs: affirm state at 6baae4fbed7d310c0ea998485b5f6460839ac314

[hyperpolymath]

Summary

Adds AFFIRMATION.adoc for reasonably-good-token-vault (RGTV) at anchor 6baae4fbed7d310c0ea998485b5f6460839ac314, following hyperpolymath/standards docs/AFFIRMATION-STANDARD.adoc. Claude ran the checks at that anchor on 2026-10-07 and drafted the file. The owner affirms it with the signed commit in this PR, whose parent is the anchor.

The file's one-line characterisation: At 6baae4f, RGTV is an alpha, untested, non-post-quantum credential broker whose three crates compile, but whose broker binary aborts at startup on an axum 0.7 route under axum 0.8, so its documented quickstart cannot run.

Closes: none.

Type of change

• 🐛 Bug fix
• ✨ New feature
• 💥 Breaking change
• 🕳️ Soundness fix
• 📖 Documentation
• 🧹 Refactor / tech debt
• ⚡ Performance
• 🔧 Build / CI / tooling

📌 New pins

• Head SHA: 0e7bf3637e3fdaafa0aca92ffdc4a49dc9696af1. This is the owner's signed commit, the one CI runs on.
• Anchor: 6baae4fbed7d310c0ea998485b5f6460839ac314. It is the head's parent, and it was main when this PR opened.
• No action uses: SHAs, actions.lock entries, lockfiles or container digests are added or changed.

How has this been verified?

What I checked:

• git log -1 --format=%G? on the head printed G (the owner's SSH signing key). git rev-parse HEAD^ printed the anchor.
• The opener script refuses to open the PR unless git ls-remote shows main at the anchor and the branch at the head above. It did not refuse.
• asciidoctor -S safe --failure-level=WARN -o /dev/null AFFIRMATION.adoc returned rc=0 with no warnings. A planted out-of-sequence section in a scratch file returned rc=1, so the gate can fail.

What the file records (gathered at the anchor on 2026-10-07):

• just build rc=0. just check rc=0 (fmt and clippy -D warnings on broker and CLI). The worker builds for wasm32-unknown-unknown.
• The worker fails clippy with one error, needless_borrows_for_generic_args.
• target/release/vault-broker panics at src/main.rs:410:10 (exit 134). The route /v1/grants/:grant_id/redeem uses axum 0.7 syntax, which axum 0.8 rejects.
• cargo audit on the CLI reports RUSTSEC-2026-0285 (rustls 0.23.37, severity 5.3).
• There are no tests. Three must/trust gates pass by vacuity.

Checklist

• My commits are signed (git commit -S). The head is G.
• I ran the project's own checks/tests locally and they pass. Not ticked. There are no tests, and the worker fails clippy. Both facts are recorded in the file. This PR changes documentation only.
• New files carry the correct SPDX-License-Identifier. AFFIRMATION.adoc line 1 is CC-BY-SA-4.0 (prose). No existing file is touched.
• Docs are updated, and no public claim now overstates what the code does. The file refutes "vault-broker: axum HTTP server 100%" and names the README's known-unsafe gaps.
• I have not introduced a soundness hole. No code changed.

Notes for reviewers

Merge form: squash, and only while main is still at the anchor 6baae4fb.

• This repo requires linear history and does not allow merge commits.
• Under the AFFIRMATION-STANDARD v1.1 amendment (docs(affirmation): define the anchor for squash-only repositories standards#1212, open), a squash keeps the affirmation anchored when four things hold:
  1. this signed commit's parent is the anchor;
  2. the squash commit's first parent is the anchor;
  3. the two trees are equal;
  4. this commit stays retrievable at refs/pull/<N>/head.
• If main has moved, do not squash and do not press Update branch. Ask for a re-anchor instead. Never rebase.

Automerge is deliberately not armed.

• The one required check, scan / gitleaks, is not strict. An armed squash would therefore still fire after main moved past the anchor.
• This PR is held for the owner's merge.

After the merge, scripts/verify-affirmation-anchor.sh hyperpolymath/reasonably-good-token-vault <N> (from standards#1212) should print ANCHORED.

🤖 Generated with Claude Code

https://claude.ai/code/session_013omQK26s4uDjJMkdqNEvEG

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2def5959-2481-4163-b59f-7e922cfb393b

📥 Commits

Reviewing files that changed from the base of the PR and between 6baae4f and 0e7bf36.

📒 Files selected for processing (1)

• AFFIRMATION.adoc

 _______________________________________________________________________________
< FUZZY BUNNY: Finding Unresolved Zero-day Zingers, Bugs, Nasties, and Yuckies. >
 -------------------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}