From 86de7161c6144e8f4c9a4178e1ec4d3af41fad25 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 17 Jun 2026 04:27:35 +0100
Subject: [PATCH] chore(wp5): remove template-only files; rewrite RSR_OUTLINE
 as snifs outline
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

D-a (partial): delete setup.sh — a template bootstrap script that curls
rsr-template-repo and hands off to the phantom `just setup` recipe; nothing
in the repo references it.

D-d: delete docs/QUICKSTART.adoc (a "clone the template + just init" stub
that duplicates the root QUICKSTART-{DEV,MAINTAINER,USER}.adoc trio) and
.machine_readable/ai/PLACEHOLDERS.adoc (the file the init recipe literally
`rm`s after bootstrap). Repoint docs/0.1-AI-MANIFEST.a2ml quickstart pointer
to ../QUICKSTART-USER.adoc.

Rewrite docs/RSR_OUTLINE.adoc: was a self-description of rsr-template-repo
(title "RSR Template Repository", a PMPL/Palimpsest badge, the template's own
structure). Now a real snifs structural map — dual track, top-level layout,
load-bearing recipes, verification — pointing to README/EXPLAINME/AFFIRMATION
and PROOF-STATUS rather than restating drift-prone counts.

NOTE: scripts/validate-template.sh (the other half of the D-a vote) is HELD —
it is wired into benches/template_bench.sh, tests/e2e/template_instantiation_test.sh,
TEST-NEEDS.md and the Dustfile exit-condition, so it is not a standalone
delete. Re-surfacing to the owner before touching it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .machine_readable/ai/PLACEHOLDERS.adoc | 144 -----------
 docs/0.1-AI-MANIFEST.a2ml              |   2 +-
 docs/QUICKSTART.adoc                   |  26 --
 docs/RSR_OUTLINE.adoc                  | 338 ++++++-------------------
 setup.sh                               | 278 --------------------
 5 files changed, 76 insertions(+), 712 deletions(-)
 delete mode 100644 .machine_readable/ai/PLACEHOLDERS.adoc
 delete mode 100644 docs/QUICKSTART.adoc
 delete mode 100755 setup.sh

diff --git a/.machine_readable/ai/PLACEHOLDERS.adoc b/.machine_readable/ai/PLACEHOLDERS.adoc
deleted file mode 100644
index 0164467..0000000
--- a/.machine_readable/ai/PLACEHOLDERS.adoc
+++ /dev/null
@@ -1,144 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-= Template Placeholders
-# Template Placeholders
-
-All placeholders in this template follow the `{{PLACEHOLDER}}` pattern.
-After cloning, replace them with your project-specific values.
-
-## Recommended: Interactive Bootstrap
-
-```bash
-just init
-```
-
-This interactively prompts for all values, replaces every placeholder,
-validates the result, and runs k9-svc checks if available.
-
-## Manual Replace
-
-```bash
-# If you prefer manual replacement (run from repo root)
-
-sed -i 's/{{AUTHOR}}/Jane Doe/g' $(grep -rl '{{AUTHOR}}' .)
-sed -i 's/{{AUTHOR_EMAIL}}/jane@example.org/g' $(grep -rl '{{AUTHOR_EMAIL}}' .)
-sed -i 's/hyperpolymath/my-org/g' $(grep -rl 'hyperpolymath' .)
-sed -i 's/{{PROJECT_NAME}}/my-project/g' $(grep -rl '{{PROJECT_NAME}}' .)
-sed -i 's/{{PROJECT}}/MY_PROJECT/g' $(grep -rl '{{PROJECT}}' .)
-sed -i 's/{{project}}/my_project/g' $(grep -rl '{{project}}' .)
-sed -i 's/snif/my-project/g' $(grep -rl 'snif' .)
-sed -i 's/github.com/github.com/g' $(grep -rl 'github.com' .)
-sed -i "s/{{CURRENT_YEAR}}/$(date +%Y)/g" $(grep -rl '{{CURRENT_YEAR}}' .)
-sed -i "s/{{CURRENT_DATE}}/$(date +%Y-%m-%d)/g" $(grep -rl '{{CURRENT_DATE}}' .)
-```
-
-## Placeholder Reference
-
-### Author & Copyright
-
-| Placeholder | Description | Example | Files |
-|---|---|---|---|
-| `{{AUTHOR}}` | Full legal name | `Jane Doe` | SPDX headers (all files), MAINTAINERS.md, .mailmap, .reuse/dep5, docs/AI-CONVENTIONS.md |
-| `{{AUTHOR_EMAIL}}` | Primary contact email | `jane@example.org` | SPDX headers (all files), .mailmap, .reuse/dep5, .well-known/humans.txt |
-| `{{AUTHOR_EMAIL_ALT}}` | Previous/secondary email (for .mailmap) | `old@example.com` | .mailmap |
-| `{{AUTHOR_ORG}}` | Author's organization/affiliation | `Acme University` | project-metadata.k9.ncl |
-| `{{AUTHOR_LAST}}` | Author surname (for citations) | `Doe` | docs/CITATIONS.adoc |
-| `{{AUTHOR_FIRST}}` | Author first name (for citations) | `Jane` | docs/CITATIONS.adoc |
-| `{{AUTHOR_INITIALS}}` | Author initials (for citations) | `J.` | docs/CITATIONS.adoc |
-
-### Project Identity
-
-| Placeholder | Description | Example | Files |
-|---|---|---|---|
-| `{{PROJECT_NAME}}` | Human-readable project name | `My Project` | SECURITY.md, CODE_OF_CONDUCT.md, TOPOLOGY.md, STATE.a2ml, Justfile, GOVERNANCE.md, MAINTAINERS.md, flake.nix, devcontainer.json |
-| `{{PROJECT_DESCRIPTION}}` | One-line description | `A tool for X` | flake.nix |
-| `{{PROJECT}}` | Uppercase identifier (for Idris2 modules, C macros) | `MY_PROJECT` | ABI-FFI-README.md, src/interface/abi/*.idr, src/interface/ffi/*.zig |
-| `{{project}}` | Lowercase identifier (for C symbols, filenames) | `my_project` | ABI-FFI-README.md, src/interface/ffi/*.zig |
-| `snif` | Repository name (slug) | `my-project` | CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, cliff.toml |
-| `hyperpolymath` | GitHub/GitLab org or username | `my-org` | SPDX headers, CONTRIBUTING.md, SECURITY.md, GOVERNANCE.md, MAINTAINERS.md, CODEOWNERS, mirror.yml, cliff.toml |
-| `github.com` | Git forge domain | `github.com` | CONTRIBUTING.md |
-
-### Dates
-
-| Placeholder | Description | Example | Files |
-|---|---|---|---|
-| `{{CURRENT_YEAR}}` | Current year | `2026` | SPDX headers (all files), GOVERNANCE.md, MAINTAINERS.md |
-| `{{CURRENT_DATE}}` | Current date (ISO) | `2026-02-14` | STATE.a2ml, MAINTAINERS.md |
-| `{{DATE}}` | Last updated date | `2026-02-14` | TOPOLOGY.md, THREAT-MODEL.md |
-
-### Contact & Security
-
-| Placeholder | Description | Example | Files |
-|---|---|---|---|
-| `{{SECURITY_EMAIL}}` | Security contact email | `security@example.org` | SECURITY.md |
-| `{{PGP_FINGERPRINT}}` | 40-char PGP fingerprint | `ABCD 1234 ...` | SECURITY.md |
-| `{{PGP_KEY_URL}}` | URL to public PGP key | `https://keys.openpgp.org/...` | SECURITY.md |
-| `{{WEBSITE}}` | Project website | `https://example.org` | SECURITY.md |
-| `{{CONDUCT_EMAIL}}` | Conduct reports email | `conduct@example.org` | CODE_OF_CONDUCT.md |
-| `{{CONDUCT_TEAM}}` | Conduct committee name | `Code of Conduct Committee` | CODE_OF_CONDUCT.md |
-| `{{RESPONSE_TIME}}` | SLA for initial response | `48 hours` | CODE_OF_CONDUCT.md |
-
-### Git
-
-| Placeholder | Description | Example | Files |
-|---|---|---|---|
-| `{{MAIN_BRANCH}}` | Main branch name | `main` | CONTRIBUTING.md |
-
-### Build
-
-| Placeholder | Description | Example | Files |
-|---|---|---|---|
-| `{{LICENSE}}` | License name | `MPL-2.0` | ABI-FFI-README.md |
-| `{{PROJECT_PURPOSE}}` | One-line project description | `FFI bridges between languages` | STATE.a2ml |
-
-### AI Manifest
-
-| Placeholder | Description | Example | Files |
-|---|---|---|---|
-| `[YOUR-REPO-NAME]` | Repository name | `my-project` | 0-AI-MANIFEST.a2ml |
-| `[DATE]` | Creation date | `2026-02-14` | 0-AI-MANIFEST.a2ml |
-| `[YOUR-NAME/ORG]` | Maintainer name | `hyperpolymath` | 0-AI-MANIFEST.a2ml |
-
-### AI Installation Guide
-
-| Marker | Description | Files |
-|---|---|---|
-| `[TODO-AI-INSTALL]` | Unfilled section in AI installation guide | `docs/AI_INSTALLATION_GUIDE.adoc`, `docs/AI-INSTALL-README-SECTION.adoc`, `README.adoc` |
-
-These are **not** standard `{{PLACEHOLDER}}` markers -- they are TODO markers
-that must be replaced with project-specific content before release. They mark
-sections where the developer (or AI) must fill in:
-
-- What questions the AI should ask the user
-- Exact prerequisite check and install commands
-- Privacy notice specific to this project
-- Complete installation command block
-- Credential setup instructions (URLs, scopes, env vars)
-- Verification commands and expected output
-- Error handling table
-- Example conversation
-
-**finishbot checks:** `just validate-ai-install` verifies no `[TODO-AI-INSTALL]` markers remain.
-
-## Deletion Markers
-
-Some files contain deletion instructions:
-
-| Marker | Meaning | File |
-|---|---|---|
-| `{{~ ... ~}}` | Delete this entire line after reading | ABI-FFI-README.md (line 1) |
-
-## Verification
-
-After replacing all placeholders, verify none remain:
-
-```bash
-grep -rn '{{' . --include='*.md' --include='*.adoc' --include='*.a2ml' \
-  --include='*.scm' --include='*.idr' --include='*.zig' --include='*.res' \
-  --include='Justfile' --include='*.nix' --include='*.toml' --include='*.yml' \
-  --include='*.yaml' --include='*.hs' --include='*.ncl' --include='*.txt' \
-  --include='*.json' --include='Containerfile' --include='dep5' \
-  | grep -v 'PLACEHOLDERS.md' | grep -v 'node_modules'
-```
-
-If the above command produces no output, all placeholders have been replaced.
diff --git a/docs/0.1-AI-MANIFEST.a2ml b/docs/0.1-AI-MANIFEST.a2ml
index 7f79301..8377b31 100644
--- a/docs/0.1-AI-MANIFEST.a2ml
+++ b/docs/0.1-AI-MANIFEST.a2ml
@@ -13,7 +13,7 @@ description: |
   subdirectories.
 
 canonical_locations:
-  quickstart: "QUICKSTART.adoc"
+  quickstart: "../QUICKSTART-USER.adoc"
   state_visualizer: "STATE-VISUALIZER.adoc"
   governance: "governance/"
   architecture: "architecture/"
diff --git a/docs/QUICKSTART.adoc b/docs/QUICKSTART.adoc
deleted file mode 100644
index 013bf34..0000000
--- a/docs/QUICKSTART.adoc
+++ /dev/null
@@ -1,26 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-= Quickstart
-:toc: preamble
-
-Get up and running in 60 seconds.
-
-== Prerequisites
-
-* Git 2.40+
-* just (command runner)
-* Your language toolchain (see Justfile for details)
-
-== From Template (New Project)
-
-[source,bash]
-----
-git clone https://github.com/hyperpolymath/rsr-template-repo my-project
-cd my-project
-rm -rf .git && git init -b main
-just init       # interactive placeholder replacement
-----
-
-== Project Structure
-
-See README.adoc in the root for the Dual-Track architecture summary.
diff --git a/docs/RSR_OUTLINE.adoc b/docs/RSR_OUTLINE.adoc
index 43a113f..67af5c5 100644
--- a/docs/RSR_OUTLINE.adoc
+++ b/docs/RSR_OUTLINE.adoc
@@ -1,292 +1,104 @@
 // SPDX-License-Identifier: MPL-2.0
-// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-= RSR Template Repository
-
-image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"]
-:toc:
+// Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+= snifs — Repository Outline
+:toc: left
+:toclevels: 3
 :sectnums:
 
-// Badges
-image:https://img.shields.io/badge/RSR-Infrastructure-cd7f32[RSR Infrastructure]
-image:https://img.shields.io/badge/Phase-Maintenance-brightgreen[Phase]
-image:https://img.shields.io/badge/Guix-Primary-purple?logo=gnu[Guix]
-
-== Overview
-
-**The canonical template for RSR (Rhodium Standard Repository) projects.**
-
-This repository provides the standardized structure, configuration, and tooling for all RSR-compliant repos. Use it to:
+A map of how this repository is laid out and where each concern lives.
+For *what* snifs is and *why*, read `README.adoc` then `EXPLAINME.adoc`.
+For the honest, dated state-of-the-proofs snapshot, read `AFFIRMATION.adoc`.
 
-* Bootstrap new projects with RSR compliance
-* Reference the standard directory structure
-* Copy configuration templates (Justfile, STATE.a2ml, etc.)
-
-== Quick Start
-
-[source,bash]
-----
-# Clone the template
-git clone https://github.com/hyperpolymath/RSR-template-repo my-project
-cd my-project
+== What snifs is
 
-# Remove template git history
-rm -rf .git
-git init
+*SNIF = Safer NIF.* Native code (Zig today; Rust wired) is compiled to
+`wasm32-freestanding` with `-OReleaseSafe` and run under `wasmtime` via
+`wasmex`. A guest trap becomes a catchable `{:error, reason}` and the BEAM
+survives. snifs is a *research + reference* repository — the architecture
+paper, a working BEAM/WASM implementation, and machine-checked proofs — not
+an installable end-user application.
 
-# Interactive bootstrap — replaces all placeholders
-just init
+It is one realized point on the `cleave` dial (the safe middle detent), not
+"the cleave".
 
-# Enter development environment
-guix shell -D -f guix.scm
+== Dual track
 
-# Validate compliance
-just validate-rsr
-----
-
-== What's Included
-
-[cols="1,3"]
+[cols="1,4", options="header"]
 |===
-|File/Directory |Purpose
-
-|`.editorconfig`
-|Editor configuration (indent, charset)
-
-|`.gitignore`
-|Standard ignore patterns
-
-|`.gitattributes`
-|Line endings, diff drivers, binary detection
-
-|`.guix-channel`
-|Guix channel definition
-
-|`.well-known/`
-|RFC-compliant metadata (security.txt, ai.txt, humans.txt)
-
-|`.machine_readable/`
-|All machine-readable content: state files (6 a2ml), `bot_directives/`, `contractiles/`
-
-|`docs/`
-|Documentation directory
-
-|`guix.scm`
-|Guix package definition
-
-|`Justfile`
-|Task runner with 40+ recipes
-
-|`Containerfile`
-|Container build (Wolfi base, Podman)
-
-|`LICENSE`
-|MPL-2.0 (Palimpsest MPL)
-
-|`EXHIBIT-A-ETHICAL-USE.txt`
-|Ethical use guidelines (LICENSE Exhibit A)
-
-|`EXHIBIT-B-QUANTUM-SAFE.txt`
-|Quantum-safe provenance spec (LICENSE Exhibit B)
-
-|`README.adoc`
-|Project overview
-
-|`TOPOLOGY.md`
-|Architecture diagram and completion dashboard
-
-|`PLACEHOLDERS.md`
-|Template variable reference and replacement guide
-
-|`0-AI-MANIFEST.a2ml`
-|Universal AI agent entry point
-
-|`AI.a2ml`
-|Claude-specific instructions
-
-|`src/abi/`
-|Idris2 ABI definitions (Types, Layout, Foreign)
+| Track | What lives there
 
-|`ffi/zig/`
-|Zig FFI implementation
+| Implementation
+| The Zig guests (`zig/`), the Rust guest (`rust/`, `rust-guest/`), the
+  Elixir host + demo (`demo/`), the built artifacts (`priv/*.wasm`), and the
+  evaluation harness (`benches/`).
 
-|`generated/abi/`
-|Auto-generated C headers from Idris2 ABI
+| Assurance
+| The formal proofs and the conformance/behaviour gates (`verification/`),
+  plus the interface definitions that the proofs and the guests must agree on
+  (`src/interface/`).
 |===
 
-== Justfile Features
-
-The template Justfile provides:
-
-* **Combinatoric matrix recipes** for build, test, container, CI
-* **Cookbook generation**: `just cookbook` -> `docs/just-cookbook.adoc`
-* **Man page generation**: `just man` -> `docs/man/project.1`
-* **RSR validation**: `just validate-rsr`
-* **STATE.a2ml management**: `just state-touch`, `just state-phase`
-* **Container support**: `just container-build`, `just container-push`
-* **CI matrix**: `just ci-matrix [stage] [depth]`
-
-=== Key Recipes
-
-[source,bash]
-----
-just                # Show all recipes
-just help <recipe>  # Detailed help
-just info           # Project info
-just combinations   # Show matrix options
-
-just build          # Build (debug)
-just test           # Run tests
-just quality        # Format + lint + test
-just ci             # Full CI pipeline
-
-just validate       # RSR + STATE validation
-just docs           # Generate all docs
-just cookbook        # Generate Justfile docs
-
-just guix-shell     # Guix dev environment
-just container-build # Build container
-----
-
-== Directory Structure
-
-[source]
-----
-project/
-├── .editorconfig              # Editor settings
-├── .gitignore                 # Git ignore
-├── .gitattributes             # Line endings, diff drivers
-├── .guix-channel              # Guix channel
-├── .well-known/               # RFC metadata
-│   ├── ai.txt
-│   ├── humans.txt
-│   └── security.txt
-├── .machine_readable/         # ALL machine-readable content
-│   ├── STATE.a2ml             # Project state, progress, blockers
-│   ├── META.a2ml              # Architecture decisions, governance
-│   ├── ECOSYSTEM.a2ml         # Ecosystem position, relationships
-│   ├── AGENTIC.a2ml           # AI agent interaction patterns
-│   ├── NEUROSYM.a2ml          # Neurosymbolic integration config
-│   ├── PLAYBOOK.a2ml          # Operational runbook
-│   ├── bot_directives/        # Per-bot rules and constraints
-│   └── contractiles/          # Policy enforcement contracts
-│       ├── k9/                # Security levels (Kennel/Yard/Hunt)
-│       ├── dust/Dustfile      # Recovery and rollback
-│       ├── lust/Intentfile    # Future intent declarations
-│       ├── must/Mustfile      # Invariant checks
-│       └── trust/Trustfile.hs # Cryptographic verification
-├── docs/                      # Documentation
-│   ├── CITATIONS.adoc
-│   ├── TOPOLOGY-GUIDE.adoc
-│   ├── generated/
-│   └── man/
-├── src/abi/                   # Idris2 ABI definitions
-│   ├── Types.idr
-│   ├── Layout.idr
-│   └── Foreign.idr
-├── ffi/zig/                   # Zig FFI implementation
-│   ├── build.zig
-│   ├── src/main.zig
-│   └── test/integration_test.zig
-├── generated/abi/             # Auto-generated C headers
-├── examples/                  # Example code
-├── guix.scm                   # Guix package
-├── Justfile                   # Task runner
-├── Containerfile              # Container build
-├── LICENSE                    # MPL-2.0
-├── EXHIBIT-A-ETHICAL-USE.txt  # Ethical use guidelines
-├── EXHIBIT-B-QUANTUM-SAFE.txt # Quantum-safe provenance
-├── README.adoc                # Overview
-├── TOPOLOGY.md                # Architecture + completion
-├── PLACEHOLDERS.md            # Template variable guide
-├── 0-AI-MANIFEST.a2ml         # Universal AI entry point
-└── AI.a2ml                    # Claude-specific instructions
-----
-
-== RSR Compliance
-
-=== Language Tiers
-
-* **Tier 1** (Gold): Rust, Elixir, Zig, Ada, Haskell, ReScript, Gleam
-* **Tier 2** (Silver): Nickel, Guile Scheme, Nix, Idris2, OCaml
-* **Infrastructure**: Guix channels, derivations, Julia batch scripts
-
-=== Required Files
-
-* `.editorconfig`
-* `.gitignore`
-* `Justfile`
-* `README.adoc`
-* `LICENSE` (MPL-2.0)
-* `.machine_readable/STATE.a2ml`
-* `.well-known/security.txt`
-* `.well-known/ai.txt`
-* `.well-known/humans.txt`
-* `guix.scm` OR `flake.nix`
-
-=== Prohibited
-
-* Python outside `salt/` directory
-* TypeScript/JavaScript (use ReScript)
-* CUE (use Guile/Nickel)
-* `Dockerfile` (use `Containerfile`)
-* npm, Bun, pnpm, yarn (use Deno)
-* Go (use Rust)
-
-== STATE.a2ml
-
-The STATE.a2ml file tracks project state:
+== Top-level layout
 
 [source]
 ----
-# STATE — Project State Checkpoint
-# Format: a2ml (AI-readable markup)
-
-project: v-graphql
-version: 0.1.0
-last-updated: 2026-02-14
-status: active
-
-phase: implementation
-maturity: beta
-
-ecosystem:
-  part-of: RSR Framework
-  depends-on: []
-
-milestones:
-  - name: Initial setup
-    completion: 100
-  - name: Core implementation
-    completion: 0
+snifs/
+├── zig/                  Zig guests — src/{safe_nif,buffer_abi}.zig, build.zig
+├── rust/ rust-guest/     Rust guest path (wired)
+├── demo/                 Elixir host + ExUnit tests (wasmex consumer)
+├── benches/              SNIF evaluation harness (snif_eval.sh, assert_safer.py)
+├── priv/                 Built *.wasm artifacts (gitignored build output)
+├── src/                  Interface, core, contracts, aspects, bridges, errors
+│   └── interface/        Idris2 ABI (Abi/) + Zig FFI bridge
+├── verification/         Proofs, conformance tools, fuzzing, safety case
+│   ├── proofs/           idris2/ lean4/ agda/ (+ coq/ tlaplus/ scaffold)
+│   └── tools/            abi_conformance.py (interface-drift gate)
+├── container/            Containerfile + compose (Podman / Wolfi)
+├── docs/                 Documentation hub (see docs/0.1-AI-MANIFEST.a2ml)
+│   └── whitepapers/academic/snif.tex   The published, DOI'd paper
+├── .machine_readable/    6a2 state, contractiles, bot_directives, configs
+├── Justfile              Task runner (just --list is the source of truth)
+├── Containerfile         Container build (checked at repo root by CI)
+├── CITATION.cff          Canonical citation record
+└── README.adoc EXPLAINME.adoc AFFIRMATION.adoc AUDIT.adoc ROADMAP.adoc
 ----
 
-== Badge Schema
+== Key recipes
 
-Generate badges from STATE.a2ml:
+`just --list` is the only authoritative recipe list. The load-bearing ones:
 
 [source,bash]
 ----
-just badges standard
+just build-wasm        # Compile the Zig guests to wasm32-freestanding
+just test-demo         # Build wasm, then run the Elixir ExUnit suite
+just eval              # SNIF evaluation + the "is it actually Safer?" assertions
+just proof-check-all   # Idris2 + Lean4 + the Agda safety bridge + danger scan
+just abi-conformance   # Gate the built .wasm exports against the Idris2 ABI model
+just paper             # Rebuild the PDF paper (docs/whitepapers/academic)
+just assail            # panic-attacker pre-commit security scan
 ----
 
-See `docs/BADGE_SCHEMA.adoc` for the full badge taxonomy.
-
-== Ecosystem Integration
-
-This template is part of:
+== Verification
 
-* **STATE.a2ml Ecosystem**: Conversation checkpoints
-* **RSR Framework**: Repository standards
-* **Consent-Aware-HTTP**: .well-known compliance
-* **Hypatia**: Neurosymbolic security scanning
-* **gitbot-fleet**: Bot orchestration
+The proof inventory and its honest gaps live in `PROOF-STATUS.md` /
+`PROOF-NEEDS.md`; the test matrix in `TEST-NEEDS.md`. `abi-conformance` is a
+required check on `main` — the built `.wasm` exports must match the
+formally-verified Idris2 ABI model, so the proof cannot silently diverge from
+the shipped artifact.
 
-== License
+== RSR compliance
 
-SPDX-License-Identifier: MPL-2.0
+snifs follows the Rhodium Standard Repository layout (machine-readable state
+under `.machine_readable/`, `.well-known/` metadata, AI manifests per
+directory, contractile contracts). The canonical standard lives in
+https://github.com/hyperpolymath/standards[hyperpolymath/standards]; this
+file is the repo-local structural map, not the standard itself.
 
-== Links
+== See also
 
-* https://github.com/hyperpolymath/elegant-STATE[elegant-STATE] - STATE tooling
-* https://github.com/hyperpolymath/conative-gating[conative-gating] - Policy enforcement
-* https://rhodium.sh[Rhodium Standard] - RSR documentation
+* `README.adoc` — overview and entry point
+* `EXPLAINME.adoc` — architecture and design rationale
+* `AFFIRMATION.adoc` — dated, signed, ground-truthed state snapshot
+* `docs/whitepapers/academic/snif.tex` — the published paper
+* `CITATION.cff` — how to cite snifs
diff --git a/setup.sh b/setup.sh
deleted file mode 100755
index 24c7e5e..0000000
--- a/setup.sh
+++ /dev/null
@@ -1,278 +0,0 @@
-#!/bin/sh
-# SPDX-License-Identifier: MPL-2.0
-# setup.sh — Universal setup script for rsr-template-repo
-#
-# Detects your shell, platform, and installs prerequisites.
-# Then hands off to `just setup` for project-specific configuration.
-#
-# Usage:
-#   curl -fsSL https://raw.githubusercontent.com/hyperpolymath/rsr-template-repo/main/setup.sh | sh
-#   # or after cloning:
-#   ./setup.sh
-#
-# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)
-
-set -eu
-
-# ── Colours (safe — uses symbols too per ADJUST contractile) ──
-if [ -t 1 ] && command -v tput >/dev/null 2>&1; then
-    RED=$(tput setaf 1 2>/dev/null || true)
-    GREEN=$(tput setaf 2 2>/dev/null || true)
-    YELLOW=$(tput setaf 3 2>/dev/null || true)
-    CYAN=$(tput setaf 6 2>/dev/null || true)
-    BOLD=$(tput bold 2>/dev/null || true)
-    RESET=$(tput sgr0 2>/dev/null || true)
-else
-    RED="" GREEN="" YELLOW="" CYAN="" BOLD="" RESET=""
-fi
-
-ok()   { printf "  %s[OK]%s   %s\n" "$GREEN" "$RESET" "$1"; }
-fail() { printf "  %s[FAIL]%s %s\n" "$RED" "$RESET" "$1"; }
-warn() { printf "  %s[WARN]%s %s\n" "$YELLOW" "$RESET" "$1"; }
-info() { printf "  %s[INFO]%s %s\n" "$CYAN" "$RESET" "$1"; }
-
-# ── Shell Detection ──
-detect_shell() {
-    # Check the actual running shell, not just $SHELL
-    CURRENT_SHELL="unknown"
-
-    if [ -n "${BASH_VERSION:-}" ]; then CURRENT_SHELL="bash"
-    elif [ -n "${ZSH_VERSION:-}" ]; then CURRENT_SHELL="zsh"
-    elif [ -n "${FISH_VERSION:-}" ]; then CURRENT_SHELL="fish"
-    elif [ -n "${KSH_VERSION:-}" ]; then CURRENT_SHELL="ksh"
-    # Check by process name for shells that don't set version vars
-    elif command -v ps >/dev/null 2>&1; then
-        SHELL_PROC=$(ps -p $$ -o comm= 2>/dev/null || echo "unknown")
-        case "$SHELL_PROC" in
-            *dash*)    CURRENT_SHELL="dash" ;;
-            *tcsh*)    CURRENT_SHELL="tcsh" ;;
-            *csh*)     CURRENT_SHELL="csh" ;;
-            *elvish*)  CURRENT_SHELL="elvish" ;;
-            *nu*)      CURRENT_SHELL="nushell" ;;
-            *oil*|*osh*) CURRENT_SHELL="oil" ;;
-            *xonsh*)   CURRENT_SHELL="xonsh" ;;
-            *murex*)   CURRENT_SHELL="murex" ;;
-            *ion*)     CURRENT_SHELL="ion" ;;
-            *hilbish*) CURRENT_SHELL="hilbish" ;;
-            *oh*)      CURRENT_SHELL="oh" ;;
-            *vsh*)     CURRENT_SHELL="vsh" ;;
-            *pwsh*|*powershell*) CURRENT_SHELL="powershell" ;;
-        esac
-    fi
-
-    # Fallback: check $SHELL env var
-    if [ "$CURRENT_SHELL" = "unknown" ] && [ -n "${SHELL:-}" ]; then
-        case "$SHELL" in
-            */bash)  CURRENT_SHELL="bash" ;;
-            */zsh)   CURRENT_SHELL="zsh" ;;
-            */fish)  CURRENT_SHELL="fish" ;;
-            */dash)  CURRENT_SHELL="dash" ;;
-            */ksh*)  CURRENT_SHELL="ksh" ;;
-            */tcsh)  CURRENT_SHELL="tcsh" ;;
-            */csh)   CURRENT_SHELL="csh" ;;
-            */vsh)   CURRENT_SHELL="vsh" ;;
-        esac
-    fi
-
-    printf "%s" "$CURRENT_SHELL"
-}
-
-# ── Platform Detection ──
-detect_platform() {
-    OS="unknown"
-    DISTRO="unknown"
-    PKG_MGR="unknown"
-    ARCH=$(uname -m 2>/dev/null || echo "unknown")
-
-    case "$(uname -s 2>/dev/null)" in
-        Linux*)
-            OS="linux"
-            if [ -f /etc/os-release ]; then
-                DISTRO=$(. /etc/os-release && echo "$ID")
-            elif [ -f /etc/redhat-release ]; then
-                DISTRO="rhel"
-            elif [ -f /etc/debian_version ]; then
-                DISTRO="debian"
-            fi
-            # Detect package manager
-            if command -v dnf >/dev/null 2>&1; then PKG_MGR="dnf"
-            elif command -v apt-get >/dev/null 2>&1; then PKG_MGR="apt"
-            elif command -v pacman >/dev/null 2>&1; then PKG_MGR="pacman"
-            elif command -v apk >/dev/null 2>&1; then PKG_MGR="apk"
-            elif command -v zypper >/dev/null 2>&1; then PKG_MGR="zypper"
-            elif command -v rpm-ostree >/dev/null 2>&1; then PKG_MGR="rpm-ostree"
-            elif command -v guix >/dev/null 2>&1; then PKG_MGR="guix"
-            elif command -v nix >/dev/null 2>&1; then PKG_MGR="nix"
-            fi
-            ;;
-        Darwin*)
-            OS="macos"
-            DISTRO="macos"
-            if command -v brew >/dev/null 2>&1; then PKG_MGR="brew"
-            elif command -v port >/dev/null 2>&1; then PKG_MGR="macports"
-            fi
-            ;;
-        CYGWIN*|MINGW*|MSYS*)
-            OS="windows"
-            DISTRO="msys"
-            if command -v winget >/dev/null 2>&1; then PKG_MGR="winget"
-            elif command -v scoop >/dev/null 2>&1; then PKG_MGR="scoop"
-            elif command -v choco >/dev/null 2>&1; then PKG_MGR="choco"
-            fi
-            ;;
-        FreeBSD*)
-            OS="freebsd"
-            DISTRO="freebsd"
-            PKG_MGR="pkg"
-            ;;
-    esac
-}
-
-# ── Install just ──
-install_just() {
-    if command -v just >/dev/null 2>&1; then
-        ok "just already installed: $(just --version 2>/dev/null | head -1)"
-        return 0
-    fi
-
-    info "Installing just (task runner)..."
-
-    case "$PKG_MGR" in
-        dnf)        sudo dnf install -y just ;;
-        apt)        sudo apt-get install -y just 2>/dev/null || {
-                        # just not in older apt repos — use installer
-                        curl -fsSL https://just.systems/install.sh | bash -s -- --to /usr/local/bin
-                    } ;;
-        pacman)     sudo pacman -S --noconfirm just ;;
-        apk)        sudo apk add just ;;
-        brew)       brew install just ;;
-        scoop)      scoop install just ;;
-        winget)     winget install Casey.Just ;;
-        rpm-ostree) sudo rpm-ostree install just ;;
-        guix)       guix install just ;;
-        nix)        nix-env -iA nixpkgs.just ;;
-        *)
-            info "Using just installer script..."
-            curl -fsSL https://just.systems/install.sh | bash -s -- --to /usr/local/bin
-            ;;
-    esac
-
-    if command -v just >/dev/null 2>&1; then
-        ok "just installed: $(just --version 2>/dev/null | head -1)"
-    else
-        fail "Could not install just. Install manually: https://just.systems/"
-        return 1
-    fi
-}
-
-# ── Main ──
-main() {
-    printf "%s=== rsr-template-repo Setup ===%s\n\n" "$BOLD" "$RESET"
-
-    # Detect environment
-    SHELL_NAME=$(detect_shell)
-    detect_platform
-
-    info "Shell:    $SHELL_NAME"
-    info "Platform: $OS ($DISTRO)"
-    info "Arch:     $ARCH"
-    info "Packages: $PKG_MGR"
-    printf "\n"
-
-    # Warn about exotic shells
-    case "$SHELL_NAME" in
-        vsh)
-            info "Valence Shell detected — experimental support"
-            info "Falling back to POSIX sh for setup, vsh for post-setup"
-            ;;
-        nushell|elvish|murex|ion|hilbish|oil|xonsh|oh)
-            info "$SHELL_NAME detected — using POSIX sh for setup"
-            ;;
-    esac
-
-    # Step 1: Install just
-    printf "%sStep 1: Install task runner%s\n" "$BOLD" "$RESET"
-    install_just || { fail "Cannot proceed without just"; exit 1; }
-    printf "\n"
-
-    # Step 2: Check if we're in the repo directory
-    if [ ! -f "Justfile" ] && [ ! -f "justfile" ]; then
-        warn "Not in a repo directory (no Justfile found)"
-        info "Clone first: git clone https://github.com/hyperpolymath/rsr-template-repo.git"
-        info "Then: cd rsr-template-repo && ./setup.sh"
-        exit 1
-    fi
-
-    # Step 3: Run just setup
-    printf "%sStep 2: Project setup%s\n" "$BOLD" "$RESET"
-    if just --list 2>/dev/null | grep -q "^setup "; then
-        just setup
-    elif just --list 2>/dev/null | grep -q "^setup-dev "; then
-        just setup-dev
-    else
-        warn "No 'setup' recipe in Justfile — running 'just doctor' instead"
-        just doctor 2>/dev/null || true
-    fi
-    printf "\n"
-
-    # Step 4: Post-install security snapshot
-    printf "%sStep 3: Security snapshot%s\n" "$BOLD" "$RESET"
-    if command -v firewall-cmd >/dev/null 2>&1; then
-        if firewall-cmd --state 2>/dev/null | grep -q running; then
-            ok "Firewall: firewalld active"
-        else
-            warn "Firewall: firewalld installed but not running"
-            info "  Enable: sudo systemctl enable --now firewalld"
-        fi
-    elif command -v ufw >/dev/null 2>&1; then
-        if ufw status 2>/dev/null | grep -q "Status: active"; then
-            ok "Firewall: ufw active"
-        else
-            warn "Firewall: ufw installed but not active"
-            info "  Enable: sudo ufw enable"
-        fi
-    else
-        warn "Firewall: none detected"
-        case "$PKG_MGR" in
-            dnf|rpm-ostree) info "  Install: sudo dnf install firewalld && sudo systemctl enable --now firewalld" ;;
-            apt) info "  Install: sudo apt install ufw && sudo ufw enable" ;;
-            *) info "  Install a firewall for your platform" ;;
-        esac
-    fi
-
-    if command -v getenforce >/dev/null 2>&1; then
-        SE_STATUS=$(getenforce 2>/dev/null || echo "unknown")
-        case "$SE_STATUS" in
-            Enforcing) ok "SELinux: Enforcing" ;;
-            Permissive) warn "SELinux: Permissive (recommend Enforcing: sudo setenforce 1)" ;;
-            *) warn "SELinux: $SE_STATUS" ;;
-        esac
-    fi
-
-    # Write report
-    REPORT_FILE="INSTALL-SECURITY-REPORT.adoc"
-    {
-        printf "// SPDX-License-Identifier: MPL-2.0\n"
-        printf "= Install Security Report\n"
-        printf ":date: %s\n\n" "$(date -Iseconds 2>/dev/null || date)"
-        printf "== Platform\n"
-        printf "* OS: %s (%s)\n" "$OS" "$DISTRO"
-        printf "* Arch: %s\n" "$ARCH"
-        printf "* Package manager: %s\n" "$PKG_MGR"
-        printf "* Shell: %s\n\n" "$SHELL_NAME"
-        printf "== Security Status\n"
-        printf "Run \`just doctor\` for full diagnostic.\n"
-    } > "$REPORT_FILE"
-    info "Security report: $REPORT_FILE"
-    printf "\n"
-
-    # Done
-    printf "%s=== Setup Complete ===%s\n\n" "${BOLD}${GREEN}" "$RESET"
-    printf "Next steps:\n"
-    printf "  just doctor     — verify everything works\n"
-    printf "  just tour       — guided tour of the project\n"
-    printf "  just build      — build the project\n"
-    printf "  just help-me    — get help if stuck\n"
-}
-
-main "$@"
