docs(estate): #229 foundation — post-#228 re-audit, RS inventory, canonical map by hyperpolymath · Pull Request #248 · hyperpolymath/affinescript

hyperpolymath · 2026-05-19T16:10:23Z

#229 foundation — post-#228 re-audit + language-grounded canonical map

Refs #229 (not Closes — multi-repo, sequenced, human-gated; the per-repo
port PRs follow). The front-loaded foundation, analogous to #239 for the
spine.

Re-audit (authoritative)

Oracle = main with #241/ADR-014 (parse-equivalent to int01-178-xmod:
zero lib/+bin/ delta). Same cached corpus as the pre-#228 baseline —
only the oracle changed (controlled).

Class	n
PASS	552
DRIFT-SYNTAX	491
TYPE-ONLY	133
total	1176

Zero class-delta vs the superseded #231 postfix → #241 reproduces ADR-014
parse behaviour exactly. This is the post-#228 baseline of record.

Honest scope correction

DRIFT-SYNTAX (491) is not the #229 workload — most estate DRIFT is
non-RS syntax drift, out of #229's contract. True RS scope =
~84 files / 12 repos; burble (32) + idaptik-dlc-vm (28) = 71%. The
four *_gui.affine single-file repos are pure List(X) (Tier-1 quick wins).

Canonical map — derived language-side, every form cited

Tier 1 mechanical: array<T>→[T], option/result→Option[T]/Result[T,E],
List(X)→[X], open Mod→use Mod::*;, type rec→type
(parser.mly:486/394/172, prelude.affine:19-21, traits.affine:89).
Tier 2 semantic redesign: mutable-field, (~x) labelled,
Belt./Js. — per-case, no blind codemod.
Tier 3 escalated language-side (the LANG: type/effect grammar has no module-qualified path — Pkg.Type/Pkg.Effect unrepresentable (estate-wide port blocker; ADR-014) #228 bidirectional-evidence
discipline): %%raw → ESC-01: AffineScript has no raw/FFI escape — %%raw port target (Refs 229) #245, JSON.t → ESC-02: no stdlib JSON type — JSON.t port target (Refs 229) #246, Dict.t → ESC-03: no stdlib Map/Dict type — Dict.t port target (Refs 229, 160/162) #247.
Tier 4 cross-unit gate: import X as Y parses + alias registers
(resolve.ml:787-797) but qualified-value calls hit the INT-01 INT-01: cross-module WASM import emission (substrate) #178 gap
(resolve.ml:719/797) ⇒ idaptik-dlc-vm (28 files) is gated on
INT-01 INT-01: cross-module WASM import emission (substrate) #178; burble + the List(X) quick wins are not.

Adds

tools/estate-rs-audit/ — audit.sh + rs-inventory.sh + repo list +
captured data (results.post228.tsv, rs-inventory.tsv) + README. The
durable, SHA-attributable in-repo home the prior /tmp harness lacked.
docs/RESCRIPT-ELIMINATION.adoc — the authoritative ESTATE: total ReScript-surface elimination from all .affine (committed goal; blocked-on #228) #229 ledger.
TECH-DEBT CORE-03 truthed (feat(parser)!: ADR-014 — module-qualified type/effect paths (Refs #228) #241 merged; re-audit done; ledger ptr).
ECOSYSTEM see-also cross-link.

Verification

No compiler/build input changed (only docs/*.adoc, tools/estate-rs-audit/*,
data TSV). dune build clean; the 270 gate is unaffected by construction.
Escalations filed live: #245 / #246 / #247.

🤖 Generated with Claude Code

github-actions · 2026-05-19T16:11:29Z

🔍 Hypatia Security Scan

Findings: 44 issues detected

Severity	Count
🔴 Critical	12
🟠 High	21
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
    "type": "banned",
    "file": "AI.a2ml",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Superseded by 0-AI-MANIFEST.a2ml",
    "type": "banned",
    "file": "AI.djot",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/lib/compile.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/lib/runner.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

+  grep -qE -- '\bimport\b.*\bas\b'        "$f" && hits+=("import-as")
+  grep -qE -- '\bBelt\.|\bJs\.|\bRescript' "$f" && hits+=("rs-stdlib")
+  grep -qE -- '->[[:space:]]*[A-Za-z].*=>|\b->\b' "$f" && true  # fn-type arrows are valid AS; skip
+  ( IFS=,; echo "${hits[*]:-}" )


Oracle-peeled the four allegedly "quick-win" *_gui.affine files. Findings, all compiler-verified, folded back into RESCRIPT-ELIMINATION.adoc before #248 merges (soundness-first; the foundation must be correct): 1. Record sigil is the DOMINANT estate blocker and was NOT in #229's named construct set. spec.md:414-421 prescribes the exact rewrite: expression- /pattern-position record literal `{`->`#{` (typed `T #{…}`); leave struct/type decl bodies. Oracle: bare `{x:1}` / `M{x:1}` / `M(x:1)` all parse-error; `Type #{…}` is the form. Added as the lead Tier-1 row. 2. Angle-brackets are NOT RS surface. Oracle: `Option<Int>` passes — both `<>` and `[ ]` type-application parse. The RS tell is the lowercase type name, not the brackets. Tier-1 row corrected (was an overclaim). 3. The text-scan inventory is a lower-bound triage signal, not the true per-file inventory: the oracle stops at the first parse error, so deeper RS layers are invisible until earlier ones go (the *_gui files scan as "List(X) only" but also need `#{` beneath). Added an explicit WARNING. 4. Scanner false positive: `mutable-field` matched a comment in panll/.../wizard.affine. panll carries no listed RS construct; its real fault is an enum trailing comma (not a #229 construct). panll reclassified OUT of #229 (scope now ~83 files / 11 repos). 5. No trivial single-construct quick wins exist — even one-RS-flagged files are multi-layer; per-repo plan + Tier-4 wording corrected. docs-only; dune build clean; 270 gate unaffected by construction. Refs #229. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-19T16:20:00Z

🔍 Hypatia Security Scan

Findings: 44 issues detected

Severity	Count
🔴 Critical	12
🟠 High	21
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
    "type": "banned",
    "file": "AI.a2ml",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Superseded by 0-AI-MANIFEST.a2ml",
    "type": "banned",
    "file": "AI.djot",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/lib/compile.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/lib/runner.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

…onical map (Refs #229) #228/ADR-014 landed on main (#241), unblocking #229 step 2. This is the front-loaded #229 foundation (the #239-analogue for the estate-port arm): authoritative re-audit + true scope + language-grounded canonical map + escalations + the campaign reproducer. Re-audit (oracle = main w/ #241; same cached corpus = controlled): 552 PASS / 491 DRIFT-SYNTAX / 133 TYPE-ONLY over 1176 .affine. Zero class-delta vs the superseded #231 postfix (#241 reproduces ADR-014 parse behaviour exactly). Honest scope correction: DRIFT-SYNTAX (491) is NOT the workload. Most estate DRIFT is non-RS syntax drift, out of #229's contract. True RS scope = ~84 files / 12 repos (burble 32 + idaptik-dlc-vm 28 = 71%). Canonical RS->AffineScript map, derived language-side (grammar/spec/stdlib, each form cited), in four tiers: - Tier 1 mechanical: array<T>->[T], option/result-><Option|Result>[..], List(X)->[X], open Mod->use Mod::*;, type rec->type (parser.mly:486/394/172, prelude.affine:19-21, traits.affine:89). - Tier 2 semantic redesign: mutable-field, labelled (~x), Belt/Js stdlib. - Tier 3 escalated language-side (the #228 bidirectional-evidence discipline): %%raw -> #245, JSON.t -> #246, Dict.t -> #247. - Tier 4 cross-unit gate: import X as Y parses + alias registers (resolve.ml:787-797) but qualified-value calls hit the INT-01 #178 gap (resolve.ml:719/797) => idaptik-dlc-vm's 28-file port is gated on INT-01 #178; burble + the List(X) quick wins are not. Adds: - tools/estate-rs-audit/ — audit.sh + rs-inventory.sh + repo list + captured data (results.post228.tsv, rs-inventory.tsv) + README. The durable in-repo home the prior /tmp harness lacked. - docs/RESCRIPT-ELIMINATION.adoc — authoritative #229 ledger. - TECH-DEBT CORE-03 truthed (#241 merged; re-audit done; ledger ptr). - ECOSYSTEM see-also cross-link. No compiler/build input changed (docs + tools + data only); dune build clean; 270 gate unaffected by construction. Refs #229 (not Closes — multi-repo, sequenced, human-gated; per-repo port PRs follow). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Oracle-peeled the four allegedly "quick-win" *_gui.affine files. Findings, all compiler-verified, folded back into RESCRIPT-ELIMINATION.adoc before #248 merges (soundness-first; the foundation must be correct): 1. Record sigil is the DOMINANT estate blocker and was NOT in #229's named construct set. spec.md:414-421 prescribes the exact rewrite: expression- /pattern-position record literal `{`->`#{` (typed `T #{…}`); leave struct/type decl bodies. Oracle: bare `{x:1}` / `M{x:1}` / `M(x:1)` all parse-error; `Type #{…}` is the form. Added as the lead Tier-1 row. 2. Angle-brackets are NOT RS surface. Oracle: `Option<Int>` passes — both `<>` and `[ ]` type-application parse. The RS tell is the lowercase type name, not the brackets. Tier-1 row corrected (was an overclaim). 3. The text-scan inventory is a lower-bound triage signal, not the true per-file inventory: the oracle stops at the first parse error, so deeper RS layers are invisible until earlier ones go (the *_gui files scan as "List(X) only" but also need `#{` beneath). Added an explicit WARNING. 4. Scanner false positive: `mutable-field` matched a comment in panll/.../wizard.affine. panll carries no listed RS construct; its real fault is an enum trailing comma (not a #229 construct). panll reclassified OUT of #229 (scope now ~83 files / 11 repos). 5. No trivial single-construct quick wins exist — even one-RS-flagged files are multi-layer; per-repo plan + Tier-4 wording corrected. docs-only; dune build clean; 270 gate unaffected by construction. Refs #229. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hyperpolymath · 2026-05-19T17:12:00Z

Rebased onto current main (clean — no conflicts after #253/#254 landed). Lone red is the pre-existing ReScript #229 baseline this PR itself inventories. Human-gate override explicitly authorized by the repo owner (@hyperpolymath) in-session 2026-05-19 — admin-merging despite the DOC-governance human-gate on Refs-#229 docs PRs, per that explicit instruction.

github-actions · 2026-05-19T17:12:51Z

🔍 Hypatia Security Scan

Findings: 44 issues detected

Severity	Count
🔴 Critical	12
🟠 High	21
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
    "type": "banned",
    "file": "AI.a2ml",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Superseded by 0-AI-MANIFEST.a2ml",
    "type": "banned",
    "file": "AI.djot",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/lib/compile.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/lib/runner.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

…273) stdlib/json.affine: pure, target-agnostic, self-contained JSON value type + combinators — pub type Json = JNull | JBool | JInt | JFloat | JString | JArray([Json]) | JObject([(String,Json)]) plus encode_*/decode_*/get_field/escape_string/stringify. `module json;`, uses prelude + string only; no host dependency. The #229 JSON.t target ports to json::Json. String->Json parse is deliberately NOT a hand-rolled stdlib parser: per ADR-018 the host bridge is typed extern, and the spine note in stdlib/Http.affine puts the parse at the Http response boundary (Response.json) where the host fetch result crosses in — tracked there. Recovered from the stranded feat/stdlib-json-echidna63 draft (that branch's full diff is destructive — deletes #248 estate-rs-audit data + wit/; only the json.affine FILE is sound). Extracted, validated on current main: main check json.affine -> Type checking passed; the #136 stdlib AOT gate auto-discovered it (AOT json.affine OK); full gate 278 -> 279, zero regression. Refs #161 #246 #229 (not Closes — #161 also tracks the Http-boundary parse bridge). Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-advanced-security Bot found potential problems May 19, 2026

View reviewed changes

hyperpolymath and others added 2 commits May 19, 2026 18:11

hyperpolymath force-pushed the estate-229-reaudit branch from d4c0f58 to 4e7ba5a Compare May 19, 2026 17:12

hyperpolymath merged commit a6e8886 into main May 19, 2026

hyperpolymath deleted the estate-229-reaudit branch May 19, 2026 17:12

hyperpolymath mentioned this pull request May 19, 2026

docs(estate): #229 ledger — record-sigil correction + string ++ (post-ports) #259

Merged

Navigation Menu

Uh oh!

docs(estate): #229 foundation — post-#228 re-audit, RS inventory, canonical map - #248

docs(estate): #229 foundation — post-#228 re-audit, RS inventory, canonical map#248
hyperpolymath merged 2 commits into
mainfrom
estate-229-reaudit

hyperpolymath commented May 19, 2026

github-actions Bot commented May 19, 2026

github-actions Bot commented May 19, 2026

hyperpolymath commented May 19, 2026

github-actions Bot commented May 19, 2026

Labels

2 participants

Uh oh!

Conversation

hyperpolymath commented May 19, 2026

#229 foundation — post-#228 re-audit + language-grounded canonical map

Re-audit (authoritative)

Honest scope correction

Canonical map — derived language-side, every form cited

Adds

Verification

github-actions Bot commented May 19, 2026

🔍 Hypatia Security Scan

github-actions Bot commented May 19, 2026

🔍 Hypatia Security Scan

hyperpolymath commented May 19, 2026

github-actions Bot commented May 19, 2026

🔍 Hypatia Security Scan

Labels

2 participants