chore: fill derivable placeholders, drop false ARCHITECTURE, surface the rest

.github/CODEOWNERS

@@ -1,12 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# CODEOWNERS - Define code review assignments
-# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-
-# Default owners for everything
-* @hyperpolymath
-
-# Security-sensitive files require explicit review
-SECURITY.md @hyperpolymath
-.github/workflows/ @hyperpolymath
-Trustfile.a2ml @hyperpolymath
-.machine_readable/ @hyperpolymath
+# Solo-maintained hyperpolymath repo: no owner lines by policy.
+# See hyperpolymath/standards CODEOWNERS-POLICY.adoc (Rule 1).
+# Sole-maintainer review is moot; SPDX headers carry attribution.

.machine_readable/contractiles/Justfile

@@ -385,8 +385,8 @@ container-init:
     read -rp "Primary port [8080]: " _PORT
     PORT="${_PORT:-8080}"
 
-    read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY
-    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}"
+    read -rp "Container registry [ghcr.io/${OWNER:-hyperpolymath}]: " _REGISTRY
+    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-hyperpolymath}}"
 
     echo ""
     echo "  Service: $SERVICE_NAME"
@@ -601,7 +601,7 @@ test-matrix suite="unit" verbosity="normal" parallel="true":
     @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}"
 
 # Container matrix: [build|run|push|shell|scan] x [registry] x [tag]
-container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest":
+container-matrix action="build" registry="ghcr.io/hyperpolymath" tag="latest":
     @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}"
 
 # CI matrix: [lint|test|build|security|all] x [quick|full]

.machine_readable/contractiles/dust/Dustfile.a2ml

@@ -56,7 +56,7 @@ clean too.
 - description: No references to rsr-template-repo in generic template files
 - run: test -z "$(grep -r 'rsr-template-repo' machine-readable-design/ 2>/dev/null)"
 - severity: warning
-- notes: Generic templates should use {{PROJECT_NAME}} or similar placeholders
+- notes: Generic templates should use Scaffoldia or similar placeholders
 
 ### version-sync-checked
 - description: Version in canonical-directory-structure matches .machine_readable/contractiles

0-AI-MANIFEST.a2ml

@@ -32,3 +32,20 @@ items = [
   { agent = "GEMINI", task = "estate audits, cross-repo sweeps, long-context triage, pattern detection" },
   { agent = "VIBE", task = "UI/frontend, PanLL panels, ReScript components, theming, rapid prototyping" },
 ]
+
+<!-- BEGIN requires-initialisation -->
+
+## PRIORITY ACTION — this repository is not fully initialised
+
+20 substitution token(s) still have no value. **Read
+`REQUIRES_INITIALISATION.md` in the repository root before doing anything
+else here** — it lists every outstanding token, what it means, and which
+files it belongs in.
+
+Do not fabricate values for them, and do not delete the sections that
+contain them to quiet a gate. They are unfilled because they need a
+decision, not because they were overlooked. Resolve what you legitimately
+can, leave the rest, and delete `REQUIRES_INITIALISATION.md` only when
+nothing outstanding remains.
+
+<!-- END requires-initialisation -->

Justfile

@@ -329,8 +329,8 @@ container-init:
     read -rp "Primary port [8080]: " _PORT
     PORT="${_PORT:-8080}"
 
-    read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY
-    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}"
+    read -rp "Container registry [ghcr.io/${OWNER:-hyperpolymath}]: " _REGISTRY
+    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-hyperpolymath}}"
 
     echo ""
     echo "  Service: $SERVICE_NAME"
@@ -545,7 +545,7 @@ test-matrix suite="unit" verbosity="normal" parallel="true":
     @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}"
 
 # Container matrix: [build|run|push|shell|scan] x [registry] x [tag]
-container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest":
+container-matrix action="build" registry="ghcr.io/hyperpolymath" tag="latest":
     @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}"
 
 # CI matrix: [lint|test|build|security|all] x [quick|full]

REQUIRES_INITIALISATION.md

@@ -0,0 +1,207 @@
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+
+# REQUIRES INITIALISATION
+
+**This repository is not finished being set up.** 20 substitution token(s) across 19 file(s) still have no value.
+
+## Why this is not already done
+
+This repo was created from `hyperpolymath/rsr-template-repo`. The mint
+(`just repo-init`) fills every token that has a single mechanical answer —
+owner, repo, author, dates, licence, branch — and it has done so here.
+
+The tokens below are the ones it *deliberately cannot* answer. They need a
+decision or a fact that exists only in your head: what this project is for,
+what command builds it, which port the service listens on, whether a PGP key
+is held at all. The template's own token vocabulary says as much — you cannot
+sensibly answer "required invariants" in a thirty-second bootstrap.
+
+They were left **visibly unfilled on purpose**. The alternatives were both
+worse: inventing plausible values would put confident falsehoods into a
+security policy and an architecture document, and silently deleting the
+sections would hide the fact that a decision is owed. A visible gap is
+honest; a fabricated answer is not.
+
+## Do not delete this file until every item below is resolved
+
+This file is the only marker that the work is outstanding. Deleting it early
+does not finish the setup, it just conceals it — and the next person or agent
+to arrive will reasonably assume the repo is complete.
+
+- **If you are a person:** delete this file yourself once the last item is done.
+- **If you are an agent:** resolve what you legitimately can, leave the rest,
+  and delete this file only when no token below remains anywhere in the tree.
+  Do not delete it to make a gate go green.
+
+Re-running the estate top-up tool will remove this file automatically once
+nothing is outstanding, so the safest way to finish is to fix the tokens and
+let the check confirm it.
+
+## What is needed, and where it goes
+
+### `{{ARGS}}`
+
+Arguments for the justfile recipe this appears in.
+
+Appears in:
+
+- `.machine_readable/contractiles/Justfile`
+- `Justfile`
+- `machine-readable-design/harvested-registry/gitbot/fleet-bot.ncl`
+- `machine-readable-design/harvested-registry/haskell/stack-library.ncl`
+- `machine-readable-design/harvested-registry/rescript/deno-app.ncl`
+
+### `{{BACKUP_POINT_1}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{BACKUP_POINT_2}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{ESCALATION_STEP_1}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{ESCALATION_STEP_2}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{ESCALATION_STEP_3}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{EXPECTED_AUTHOR}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/Trustfile.a2ml`
+
+### `{{LICENSE}}`
+
+SPDX identifier for this repo's licence.
+
+Appears in:
+
+- `container/Containerfile`
+- `container/manifest.toml`
+
+### `{{MAIN_FUNCTION}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/Intentfile.a2ml`
+
+### `{{OPENSSF_PROJECT_ID}}`
+
+OpenSSF project ID, same registration.
+
+Appears in:
+
+- `docs/governance/TEMPLATE-STANDARDS-AUDIT.adoc`
+
+### `{{PORT}}`
+
+Port the container service listens on.
+
+Appears in:
+
+- `container/Containerfile`
+- `container/compose.toml`
+- `container/deploy.k9.ncl`
+- `container/entrypoint.sh`
+- `container/manifest.toml`
+- `container/vordr.toml`
+
+### `{{PROJECT_DESCRIPTION}}`
+
+One-line description, matching the forge description.
+
+Appears in:
+
+- `container/Containerfile`
+- `container/manifest.toml`
+
+### `{{REGISTRY}}`
+
+Container registry to publish to.
+
+Appears in:
+
+- `.machine_readable/configs/stapeln.toml`
+- `container/compose.toml`
+- `container/ct-build.sh`
+- `container/deploy.k9.ncl`
+
+### `{{SCENARIO_1_NAME}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{SCENARIO_1_ROLLBACK_PROCEDURE}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{SCENARIO_2_NAME}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{SCENARIO_2_ROLLBACK_PROCEDURE}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/bust/Bustfile.a2ml`
+
+### `{{SERVICE_NAME}}`
+
+Container service name.
+
+Appears in:
+
+- `.machine_readable/configs/selur-compose.toml`
+- `.machine_readable/configs/stapeln.toml`
+- `container/.gatekeeper.yaml`
+- `container/Containerfile`
+- `container/compose.toml`
+- `container/ct-build.sh`
+- `container/deploy.k9.ncl`
+- `container/entrypoint.sh`
+- `container/manifest.toml`
+- `container/vordr.toml`
+
+### `{{TARGET_AUDIENCE}}`
+
+Appears in:
+
+- `machine-readable-design/canonical-directory-structure/Intentfile.a2ml`
+
+### `{{VERSION}}`
+
+Version/tag for the container image.
+
+Appears in:
+
+- `container/deploy.k9.ncl`
+- `container/manifest.toml`
+- `container/vordr.toml`
+
+---
+
+Generated by the estate top-up pass. Rationale and the governing rulings are
+in `hyperpolymath/standards`; the token vocabulary is
+`.machine_readable/ai/PLACEHOLDERS.adoc` in `rsr-template-repo`.

container/.gatekeeper.yaml

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 #
-# Svalinn gatekeeper policy for {{PROJECT_NAME}}
+# Svalinn gatekeeper policy for Scaffoldia
 #
 # Controls which operations are permitted through the edge gateway.
 # This template provides moderate security defaults — not wide-open test

container/Containerfile

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-# {{PROJECT_NAME}} Container Image
+# Scaffoldia Container Image
 #
 # Multi-stage build template for Chainguard Wolfi base images.
 # Customise the builder stage for your language and copy the
@@ -69,13 +69,13 @@ COPY . .
 FROM cgr.dev/chainguard/wolfi-base:latest
 
 # OCI image labels (compatible with cerro-torre .ctp bundle metadata)
-LABEL org.opencontainers.image.title="{{PROJECT_NAME}}" \
+LABEL org.opencontainers.image.title="Scaffoldia" \
       org.opencontainers.image.description="{{PROJECT_DESCRIPTION}}" \
-      org.opencontainers.image.url="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \
-      org.opencontainers.image.source="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \
-      org.opencontainers.image.vendor="{{OWNER}}" \
+      org.opencontainers.image.url="https://github.com/hyperpolymath/scaffoldia" \
+      org.opencontainers.image.source="https://github.com/hyperpolymath/scaffoldia" \
+      org.opencontainers.image.vendor="hyperpolymath" \
       org.opencontainers.image.licenses="{{LICENSE}}" \
-      org.opencontainers.image.authors="{{AUTHOR}} <{{AUTHOR_EMAIL}}>" \
+      org.opencontainers.image.authors="Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>" \
       dev.cerrotorre.manifest="container/manifest.toml" \
       dev.cerrotorre.gatekeeper="container/.gatekeeper.yaml" \
       dev.stapeln.compose="container/compose.toml"

container/README.adoc

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: CC-BY-SA-4.0
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-= {{PROJECT_NAME}} Container Templates
+= Scaffoldia Container Templates
 :toc: left
 :toclevels: 3
 :sectnums:

container/compose.toml

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 #
-# {{PROJECT_NAME}} selur-compose configuration
+# Scaffoldia selur-compose configuration
 #
 # Orchestrates the container stack as verified container bundles (.ctp).
 # Uses selur zero-copy IPC between services on the same host.

container/ct-build.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: MPL-2.0
 #
-# {{PROJECT_NAME}} — Cerro Torre build, sign, and verify pipeline
+# Scaffoldia — Cerro Torre build, sign, and verify pipeline
 #
 # Builds the container image, packages it as a verified .ctp bundle,
 # signs it with Ed25519, and verifies the result. Gracefully degrades
@@ -46,7 +46,7 @@ IMAGE_NAME="{{SERVICE_NAME}}"
 FULL_IMAGE="${CT_REGISTRY}/${IMAGE_NAME}:${CT_TAG}"
 CTP_FILE="${SCRIPT_DIR}/${IMAGE_NAME}-${CT_TAG}.ctp"
 
-echo "=== {{PROJECT_NAME}} Cerro Torre Build Pipeline ==="
+echo "=== Scaffoldia Cerro Torre Build Pipeline ==="
 echo "  Image:  ${FULL_IMAGE}"
 echo "  Key:    ${CT_KEY_ID}"
 echo "  Bundle: ${CTP_FILE}"

container/deploy.k9.ncl

@@ -1,6 +1,6 @@
 K9!
 # SPDX-License-Identifier: MPL-2.0
-# deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level)
+# deploy.k9.ncl — Scaffoldia deployment component (Hunt level)
 #
 # k9-svc deployment specification with full pedigree (L1-L5).
 # Security Level: 'Hunt (requires cryptographic handshake for execution).
@@ -23,7 +23,7 @@ let component_pedigree = {
     version = "{{VERSION}}",
     breed = "application/vnd.k9+nickel",
     magic_number = "K9!",
-    description = "{{PROJECT_NAME}} deployment component (Hunt level)",
+    description = "Scaffoldia deployment component (Hunt level)",
   },
 
   # ─────────────────────────────────────────────────────────────

container/entrypoint.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # SPDX-License-Identifier: MPL-2.0
-# {{PROJECT_NAME}} container entrypoint
+# Scaffoldia container entrypoint
 #
 # Handles signal propagation, startup logging, and health check
 # preparation before exec-ing into the main application process.