From ba6698894d3846bc64f08914cdc2fe79d360fb8b Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 21 Sep 2026 10:54:57 +0000
Subject: [PATCH 1/3] fix(ci): pin tree-sitter tarball SHA256 and force HTTPS

Sonar S6506 (C security on new code): curl -fsSL allowed insecure
redirects. Match scripts/install-bun.sh: --proto =https, SHA256 check,
install into RUNNER_TEMP and GITHUB_PATH (no sudo).
---
 scripts/install-tree-sitter-cli.sh | 32 +++++++++++++++++-------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/scripts/install-tree-sitter-cli.sh b/scripts/install-tree-sitter-cli.sh
index 998d74dc..0af984f9 100755
--- a/scripts/install-tree-sitter-cli.sh
+++ b/scripts/install-tree-sitter-cli.sh
@@ -5,11 +5,12 @@
 # Used by CI instead of `npm install -g --ignore-scripts tree-sitter-cli`:
 # that package's binary is fetched in a postinstall script, so
 # --ignore-scripts (Sonar S6505) leaves `tree-sitter` missing (ENOENT).
-# A release tarball has no lifecycle scripts.
 set -euo pipefail
 
 VER="${TREE_SITTER_CLI_VERSION:-0.25.0}"
-DEST="${TREE_SITTER_CLI_DEST:-/usr/local/bin/tree-sitter}"
+# tree-sitter-linux-x64.gz from
+# https://github.com/tree-sitter/tree-sitter/releases/tag/v0.25.0
+SHA256="${TREE_SITTER_LINUX_X64_SHA256:-d7b68a7a79459c0c23e062f719fe90781ed284a4fb172756e217ca08ea86b8d3}"
 
 arch="$(uname -m)"
 case "$arch" in
@@ -22,17 +23,20 @@ case "$arch" in
 esac
 
 url="https://github.com/tree-sitter/tree-sitter/releases/download/v${VER}/tree-sitter-linux-${ts_arch}.gz"
-tmp="$(mktemp)"
-trap 'rm -f "$tmp"' EXIT
-curl -fsSL "$url" | gunzip > "$tmp"
-chmod +x "$tmp"
+workdir="${RUNNER_TEMP:-$(mktemp -d)}"
+archive="${workdir}/tree-sitter-linux-${ts_arch}.gz"
+bin_dir="${workdir}/tree-sitter-cli"
+mkdir -p "$bin_dir"
 
-if [ -w "$(dirname "$DEST")" ]; then
-  mv "$tmp" "$DEST"
-  trap - EXIT
-else
-  sudo mv "$tmp" "$DEST"
-  trap - EXIT
-fi
+curl --fail --location --retry 3 --proto "=https" \
+  --output "$archive" \
+  "$url"
+printf '%s  %s\n' "$SHA256" "$archive" | sha256sum --check --strict
+gunzip -c "$archive" > "${bin_dir}/tree-sitter"
+chmod +x "${bin_dir}/tree-sitter"
 
-"$DEST" --version
+if [[ -n "${GITHUB_PATH:-}" ]]; then
+  printf '%s\n' "$bin_dir" >> "$GITHUB_PATH"
+fi
+export PATH="${bin_dir}:${PATH}"
+tree-sitter --version

From abf7c568002df1b4e891697d65198baa662f4c47 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 21 Sep 2026 11:04:39 +0000
Subject: [PATCH 2/3] ci(deed): gate CI on .deed; leftover .a2ml is a hard fail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A2ML is retired (standards #837). Machine-readable manifests are
renamed .a2ml → .deed. Repo deed affinescript_chora.deed is the
s-expression DEED grammar. tools/check-deed-gates.sh +
deed-validate.yml + the ci.yml build job refuse STATE.a2ml /
a2ml-validate / leftover *.a2ml. check-doc-truthing reads STATE.deed.
---
 .github/CONTRIBUTING.md                       |  8 +--
 .github/workflows/ci.yml                      |  5 +-
 .github/workflows/deed-validate.yml           | 22 ++++++
 .machine_readable/{CLADE.a2ml => CLADE.deed}  |  0
 .../{coverage.a2ml => coverage.deed}          |  0
 .../{debt.a2ml => debt.deed}                  |  0
 .../{methodology.a2ml => methodology.deed}    |  0
 .../anchors/{ANCHOR.a2ml => ANCHOR.deed}      |  0
 .../{Adjustfile.a2ml => Adjustfile.deed}      |  0
 .../{Intentfile.a2ml => Intentfile.deed}      |  0
 .../{AGENTIC.a2ml => AGENTIC.deed}            |  0
 .../{ECOSYSTEM.a2ml => ECOSYSTEM.deed}        |  0
 .../descriptiles/{META.a2ml => META.deed}     |  0
 .../{NEUROSYM.a2ml => NEUROSYM.deed}          |  0
 .../{PLAYBOOK.a2ml => PLAYBOOK.deed}          |  0
 .../descriptiles/{STATE.a2ml => STATE.deed}   |  0
 .../{verisimdb.a2ml => verisimdb.deed}        |  0
 .../{vexometer.a2ml => vexometer.deed}        |  0
 ... => 2026-05-27-borrow-deferred-items.deed} |  0
 ... => 2026-07-29-proof-gate-and-rescue.deed} |  0
 0-AI-MANIFEST.a2ml                            | 37 ----------
 0-AI-MANIFEST.deed                            | 37 ++++++++++
 CHANGELOG.adoc                                |  4 ++
 ....runbook.a2ml => affinescript.runbook.deed |  0
 affinescript_chora.deed                       | 17 +++++
 ...tions.a2ml => assail-classifications.deed} |  0
 ...RN-AUDIT.a2ml => STDLIB-EXTERN-AUDIT.deed} |  0
 docs/ci/required-checks.adoc                  |  2 +-
 .../{AI.a2ml => AI.deed}                      |  0
 ...> BINDINGS-STDLIB-CODEGEN-2026-05-31.deed} |  0
 ...PED-WASM-LEVEL-10-CLOSURE-2026-04-19.deed} |  0
 ...ml => TYPED-WASM-COORDINATION-LEDGER.deed} |  0
 ...TERFACE.a2ml => TYPED-WASM-INTERFACE.deed} |  0
 ...M-ROADMAP.a2ml => TYPED-WASM-ROADMAP.deed} |  0
 .../{PANIC-ATTACK.a2ml => PANIC-ATTACK.deed}  |  0
 docs/standards/{TESTING.a2ml => TESTING.deed} |  0
 justfile                                      |  3 +-
 tools/check-deed-gates.sh                     | 68 +++++++++++++++++++
 tools/check-doc-truthing.sh                   |  8 +--
 39 files changed, 163 insertions(+), 48 deletions(-)
 create mode 100644 .github/workflows/deed-validate.yml
 rename .machine_readable/{CLADE.a2ml => CLADE.deed} (100%)
 rename .machine_readable/agent_instructions/{coverage.a2ml => coverage.deed} (100%)
 rename .machine_readable/agent_instructions/{debt.a2ml => debt.deed} (100%)
 rename .machine_readable/agent_instructions/{methodology.a2ml => methodology.deed} (100%)
 rename .machine_readable/anchors/{ANCHOR.a2ml => ANCHOR.deed} (100%)
 rename .machine_readable/contractiles/adjust/{Adjustfile.a2ml => Adjustfile.deed} (100%)
 rename .machine_readable/contractiles/intend/{Intentfile.a2ml => Intentfile.deed} (100%)
 rename .machine_readable/descriptiles/{AGENTIC.a2ml => AGENTIC.deed} (100%)
 rename .machine_readable/descriptiles/{ECOSYSTEM.a2ml => ECOSYSTEM.deed} (100%)
 rename .machine_readable/descriptiles/{META.a2ml => META.deed} (100%)
 rename .machine_readable/descriptiles/{NEUROSYM.a2ml => NEUROSYM.deed} (100%)
 rename .machine_readable/descriptiles/{PLAYBOOK.a2ml => PLAYBOOK.deed} (100%)
 rename .machine_readable/descriptiles/{STATE.a2ml => STATE.deed} (100%)
 rename .machine_readable/integrations/{verisimdb.a2ml => verisimdb.deed} (100%)
 rename .machine_readable/integrations/{vexometer.a2ml => vexometer.deed} (100%)
 rename .machine_readable/sessions/{2026-05-27-borrow-deferred-items.a2ml => 2026-05-27-borrow-deferred-items.deed} (100%)
 rename .machine_readable/sessions/{2026-07-29-proof-gate-and-rescue.a2ml => 2026-07-29-proof-gate-and-rescue.deed} (100%)
 delete mode 100644 0-AI-MANIFEST.a2ml
 create mode 100644 0-AI-MANIFEST.deed
 rename affinescript.runbook.a2ml => affinescript.runbook.deed (100%)
 create mode 100644 affinescript_chora.deed
 rename audits/{assail-classifications.a2ml => assail-classifications.deed} (100%)
 rename docs/{STDLIB-EXTERN-AUDIT.a2ml => STDLIB-EXTERN-AUDIT.deed} (100%)
 rename docs/guides/frontier-programming-practices/{AI.a2ml => AI.deed} (100%)
 rename docs/history/{BINDINGS-STDLIB-CODEGEN-2026-05-31.a2ml => BINDINGS-STDLIB-CODEGEN-2026-05-31.deed} (100%)
 rename docs/history/{TYPED-WASM-LEVEL-10-CLOSURE-2026-04-19.a2ml => TYPED-WASM-LEVEL-10-CLOSURE-2026-04-19.deed} (100%)
 rename docs/specs/{TYPED-WASM-COORDINATION-LEDGER.a2ml => TYPED-WASM-COORDINATION-LEDGER.deed} (100%)
 rename docs/specs/{TYPED-WASM-INTERFACE.a2ml => TYPED-WASM-INTERFACE.deed} (100%)
 rename docs/specs/{TYPED-WASM-ROADMAP.a2ml => TYPED-WASM-ROADMAP.deed} (100%)
 rename docs/standards/{PANIC-ATTACK.a2ml => PANIC-ATTACK.deed} (100%)
 rename docs/standards/{TESTING.a2ml => TESTING.deed} (100%)
 create mode 100755 tools/check-deed-gates.sh

diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 54a81906..6f264a17 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -6,7 +6,7 @@ how to set up a working tree, file useful bugs, and submit changes.
 
 For the language itself, start from [`README.adoc`](../README.adoc). For
 project state, blockers, and next-actions, see
-[`.machine_readable/descriptiles/STATE.a2ml`](../.machine_readable/descriptiles/STATE.a2ml).
+[`.machine_readable/descriptiles/STATE.deed`](../.machine_readable/descriptiles/STATE.deed).
 
 ’’’’’
 
@@ -47,7 +47,7 @@ Tested on OCaml 4.14.2 (the constraint in `dune-project` is `>=`
     ├── packages/            # Aggregate JS/TS/ binding packages
     ├── editors/             # Editor integrations
     ├── js/                  # `js_of_ocaml` playground (built into `playground.bc.js`)
-    ├── .machine_readable/   # Machine-readable metadata (`.a2ml`) — see 0-AI-MANIFEST.a2ml
+    ├── .machine_readable/   # Machine-readable metadata (`.deed`) — see 0-AI-MANIFEST.deed
     ├── .github/             # CI workflows, issue templates
     │   └── CONTRIBUTING.md  # This file
     ├── CODE_OF_CONDUCT.md
@@ -85,7 +85,7 @@ template](.github/ISSUE_TEMPLATE/bug_report.md) and include:
 ### Suggesting Features
 
 **Before suggesting:** 1. Skim [`docs/ROADMAP.adoc`](../docs/ROADMAP.adoc)
-and `.machine_readable/descriptiles/STATE.a2ml`. 2. Search existing
+and `.machine_readable/descriptiles/STATE.deed`. 2. Search existing
 issues and discussions.
 
 **When suggesting:** use the [feature request
@@ -150,7 +150,7 @@ dune runtest     # must be green
 dune fmt         # optional — auto-formats with ocamlformat
 ```
 
-The `methodology.a2ml` file lists the canonical gate set. CI will rerun
+The `methodology.deed` file lists the canonical gate set. CI will rerun
 `build` + `runtest` plus the security, lint, and policy workflows in
 `.github/workflows/`.
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ead9b5ba..bcf570b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,11 +108,14 @@ jobs:
         if: ${{ !cancelled() }}
         # Single toolchain-free gate enforcing both halves of the doc-truthing
         # MONITOR: the presence invariants (DOC-04/05 — banner pointers, matrix
-        # primacy + anti-over-claim section, STATE.a2ml mirror keys) AND the
+        # primacy + anti-over-claim section, STATE.deed mirror keys) AND the
         # over-claim ratchet (DOC-08/09 — fails any NEW backend-breadth /
         # "production-ready" / stdlib-% phrase beyond tools/doc-overclaims.allow).
         # See tools/check-doc-truthing.sh.
         run: ./tools/check-doc-truthing.sh
+      - name: DEED manifest gate (A2ML retired)
+        if: ${{ !cancelled() }}
+        run: ./tools/check-deed-gates.sh
       - name: Soundness-ledger anti-staleness gate
         if: ${{ !cancelled() }}
         # docs/SOUNDNESS.adoc is the single source of truth for soundness-hole
diff --git a/.github/workflows/deed-validate.yml b/.github/workflows/deed-validate.yml
new file mode 100644
index 00000000..1ad7f10a
--- /dev/null
+++ b/.github/workflows/deed-validate.yml
@@ -0,0 +1,22 @@
+# This workflow is managed by gh actions-lock.
+# SPDX-License-Identifier: MPL-2.0
+# DEED manifest gate. A2ML is retired; leftover *.a2ml fails CI.
+name: "DEED Manifest Validation"
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions: read-all
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  deed-validate:
+    name: Validate DEED manifests
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+      - name: Run DEED gates
+        run: ./tools/check-deed-gates.sh
diff --git a/.machine_readable/CLADE.a2ml b/.machine_readable/CLADE.deed
similarity index 100%
rename from .machine_readable/CLADE.a2ml
rename to .machine_readable/CLADE.deed
diff --git a/.machine_readable/agent_instructions/coverage.a2ml b/.machine_readable/agent_instructions/coverage.deed
similarity index 100%
rename from .machine_readable/agent_instructions/coverage.a2ml
rename to .machine_readable/agent_instructions/coverage.deed
diff --git a/.machine_readable/agent_instructions/debt.a2ml b/.machine_readable/agent_instructions/debt.deed
similarity index 100%
rename from .machine_readable/agent_instructions/debt.a2ml
rename to .machine_readable/agent_instructions/debt.deed
diff --git a/.machine_readable/agent_instructions/methodology.a2ml b/.machine_readable/agent_instructions/methodology.deed
similarity index 100%
rename from .machine_readable/agent_instructions/methodology.a2ml
rename to .machine_readable/agent_instructions/methodology.deed
diff --git a/.machine_readable/anchors/ANCHOR.a2ml b/.machine_readable/anchors/ANCHOR.deed
similarity index 100%
rename from .machine_readable/anchors/ANCHOR.a2ml
rename to .machine_readable/anchors/ANCHOR.deed
diff --git a/.machine_readable/contractiles/adjust/Adjustfile.a2ml b/.machine_readable/contractiles/adjust/Adjustfile.deed
similarity index 100%
rename from .machine_readable/contractiles/adjust/Adjustfile.a2ml
rename to .machine_readable/contractiles/adjust/Adjustfile.deed
diff --git a/.machine_readable/contractiles/intend/Intentfile.a2ml b/.machine_readable/contractiles/intend/Intentfile.deed
similarity index 100%
rename from .machine_readable/contractiles/intend/Intentfile.a2ml
rename to .machine_readable/contractiles/intend/Intentfile.deed
diff --git a/.machine_readable/descriptiles/AGENTIC.a2ml b/.machine_readable/descriptiles/AGENTIC.deed
similarity index 100%
rename from .machine_readable/descriptiles/AGENTIC.a2ml
rename to .machine_readable/descriptiles/AGENTIC.deed
diff --git a/.machine_readable/descriptiles/ECOSYSTEM.a2ml b/.machine_readable/descriptiles/ECOSYSTEM.deed
similarity index 100%
rename from .machine_readable/descriptiles/ECOSYSTEM.a2ml
rename to .machine_readable/descriptiles/ECOSYSTEM.deed
diff --git a/.machine_readable/descriptiles/META.a2ml b/.machine_readable/descriptiles/META.deed
similarity index 100%
rename from .machine_readable/descriptiles/META.a2ml
rename to .machine_readable/descriptiles/META.deed
diff --git a/.machine_readable/descriptiles/NEUROSYM.a2ml b/.machine_readable/descriptiles/NEUROSYM.deed
similarity index 100%
rename from .machine_readable/descriptiles/NEUROSYM.a2ml
rename to .machine_readable/descriptiles/NEUROSYM.deed
diff --git a/.machine_readable/descriptiles/PLAYBOOK.a2ml b/.machine_readable/descriptiles/PLAYBOOK.deed
similarity index 100%
rename from .machine_readable/descriptiles/PLAYBOOK.a2ml
rename to .machine_readable/descriptiles/PLAYBOOK.deed
diff --git a/.machine_readable/descriptiles/STATE.a2ml b/.machine_readable/descriptiles/STATE.deed
similarity index 100%
rename from .machine_readable/descriptiles/STATE.a2ml
rename to .machine_readable/descriptiles/STATE.deed
diff --git a/.machine_readable/integrations/verisimdb.a2ml b/.machine_readable/integrations/verisimdb.deed
similarity index 100%
rename from .machine_readable/integrations/verisimdb.a2ml
rename to .machine_readable/integrations/verisimdb.deed
diff --git a/.machine_readable/integrations/vexometer.a2ml b/.machine_readable/integrations/vexometer.deed
similarity index 100%
rename from .machine_readable/integrations/vexometer.a2ml
rename to .machine_readable/integrations/vexometer.deed
diff --git a/.machine_readable/sessions/2026-05-27-borrow-deferred-items.a2ml b/.machine_readable/sessions/2026-05-27-borrow-deferred-items.deed
similarity index 100%
rename from .machine_readable/sessions/2026-05-27-borrow-deferred-items.a2ml
rename to .machine_readable/sessions/2026-05-27-borrow-deferred-items.deed
diff --git a/.machine_readable/sessions/2026-07-29-proof-gate-and-rescue.a2ml b/.machine_readable/sessions/2026-07-29-proof-gate-and-rescue.deed
similarity index 100%
rename from .machine_readable/sessions/2026-07-29-proof-gate-and-rescue.a2ml
rename to .machine_readable/sessions/2026-07-29-proof-gate-and-rescue.deed
diff --git a/0-AI-MANIFEST.a2ml b/0-AI-MANIFEST.a2ml
deleted file mode 100644
index c361cad3..00000000
--- a/0-AI-MANIFEST.a2ml
+++ /dev/null
@@ -1,37 +0,0 @@
-# AI Assistant Instructions
-
-# Machine-Readable Metadata
-
-Project metadata and AI agent configuration files live under `.machine_readable/`. All metadata files use the `.a2ml` extension; the `.scm` extension is reserved for Guix (`guix.scm`, `.guix-channel`).
-
-## Core descriptiles metadata (`.machine_readable/descriptiles/`)
-
-- **STATE.a2ml** - Current project state, progress, blockers, next actions, session notes
-- **ECOSYSTEM.a2ml** - Position in ecosystem, relationships to sibling projects
-- **META.a2ml** - Architecture decisions, governance, development practices
-- **PLAYBOOK.a2ml** - Operational runbook, procedures, alerts
-- **AGENTIC.a2ml** - AI agent interaction patterns and constraints
-- **NEUROSYM.a2ml** - Neurosymbolic integration configuration
-
-## Top-level contractile files (`.machine_readable/`)
-
-- **ADJUST.contractile**, **INTENT.contractile**, **MUST.contractile**, **TRUST.contractile** - Trident-shape commitments
-- **CLADE.a2ml** - Phylogenetic context within the estate
-- **anchors/ANCHOR.a2ml** - Stable references for tooling
-
-## Agent guidance (`.machine_readable/agent_instructions/`)
-
-- **methodology.a2ml** - Required checks (dune build / dune runtest must pass; see for the full list)
-- **coverage.a2ml**, **debt.a2ml** - Tracked metrics
-- **README.adoc** - Human-readable summary of agent instructions
-
-**These files are the canonical source of truth for project metadata.**
-
-## Workflow
-
-1. Read `.machine_readable/descriptiles/*.a2ml` files at session start
-2. Check `STATE.a2ml` for current phase, blockers, next actions
-3. Follow patterns and constraints from `AGENTIC.a2ml`
-4. Follow methodology gates from `agent_instructions/methodology.a2ml`
-5. Update `STATE.a2ml` after completing work
-6. Sync to database: `~/sync-language-tracker.sh`
diff --git a/0-AI-MANIFEST.deed b/0-AI-MANIFEST.deed
new file mode 100644
index 00000000..297331e5
--- /dev/null
+++ b/0-AI-MANIFEST.deed
@@ -0,0 +1,37 @@
+# AI Assistant Instructions
+
+# Machine-Readable Metadata
+
+Project metadata and AI agent configuration files live under `.machine_readable/`. All metadata files use the `.deed` extension; the `.scm` extension is reserved for Guix (`guix.scm`, `.guix-channel`).
+
+## Core descriptiles metadata (`.machine_readable/descriptiles/`)
+
+- **STATE.deed** - Current project state, progress, blockers, next actions, session notes
+- **ECOSYSTEM.deed** - Position in ecosystem, relationships to sibling projects
+- **META.deed** - Architecture decisions, governance, development practices
+- **PLAYBOOK.deed** - Operational runbook, procedures, alerts
+- **AGENTIC.deed** - AI agent interaction patterns and constraints
+- **NEUROSYM.deed** - Neurosymbolic integration configuration
+
+## Top-level contractile files (`.machine_readable/`)
+
+- **ADJUST.contractile**, **INTENT.contractile**, **MUST.contractile**, **TRUST.contractile** - Trident-shape commitments
+- **CLADE.deed** - Phylogenetic context within the estate
+- **anchors/ANCHOR.deed** - Stable references for tooling
+
+## Agent guidance (`.machine_readable/agent_instructions/`)
+
+- **methodology.deed** - Required checks (dune build / dune runtest must pass; see for the full list)
+- **coverage.deed**, **debt.deed** - Tracked metrics
+- **README.adoc** - Human-readable summary of agent instructions
+
+**These files are the canonical source of truth for project metadata.**
+
+## Workflow
+
+1. Read `.machine_readable/descriptiles/*.deed` files at session start
+2. Check `STATE.deed` for current phase, blockers, next actions
+3. Follow patterns and constraints from `AGENTIC.deed`
+4. Follow methodology gates from `agent_instructions/methodology.deed`
+5. Update `STATE.deed` after completing work
+6. Sync to database: `~/sync-language-tracker.sh`
diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc
index 6cbf3377..68b90600 100644
--- a/CHANGELOG.adoc
+++ b/CHANGELOG.adoc
@@ -23,6 +23,10 @@ kept so existing scripts fail loudly (Refs #56)
 
 ==== Added
 
+* CI gates on `.deed` (DEED grammar). Leftover `.a2ml` is a hard fail.
+`tools/check-deed-gates.sh` + `.github/workflows/deed-validate.yml`.
+Machine-readable manifests renamed `.a2ml` → `.deed`. Repo deed:
+`affinescript_chora.deed` (Refs standards #837)
 * Aspirational idaptik StartupError fixture compiles with real syntax
 (`use Console::{log}`, `use Dom::{…}`, tuple-list attrs and
 `#{ bg: … }` records) on `--bun-esm` (Refs #56)
diff --git a/affinescript.runbook.a2ml b/affinescript.runbook.deed
similarity index 100%
rename from affinescript.runbook.a2ml
rename to affinescript.runbook.deed
diff --git a/affinescript_chora.deed b/affinescript_chora.deed
new file mode 100644
index 00000000..eb3fbb7c
--- /dev/null
+++ b/affinescript_chora.deed
@@ -0,0 +1,17 @@
+;; SPDX-License-Identifier: MPL-2.0
+;;
+;; Repo deed for affinescript. DEED (s-expression, application/vnd.deed)
+;; owns the manifest grammar; A2ML is retired (standards #837 / #64).
+;; CI gates on this file and on *.deed — leftover *.a2ml is a hard fail.
+(repo-deed
+  :schema-version "1.0.0"
+  :canonical-name "affinescript"
+  :beholding-chora #u5"estate/chora"
+  :repo-uuid #u5"github.com/hyperpolymath/affinescript"
+  (manifest
+    :version "0.1.1"
+    :project "affinescript"
+    :purpose "AffineScript compiler — linear/affine typed language with wasm and Bun-ESM backends."
+    :authoritative-status-doc "docs/CAPABILITY-MATRIX.adoc"
+    :state-mirror ".machine_readable/descriptiles/STATE.deed"
+    :estate "AsciiDoc + .deed; not .a2ml"))
diff --git a/audits/assail-classifications.a2ml b/audits/assail-classifications.deed
similarity index 100%
rename from audits/assail-classifications.a2ml
rename to audits/assail-classifications.deed
diff --git a/docs/STDLIB-EXTERN-AUDIT.a2ml b/docs/STDLIB-EXTERN-AUDIT.deed
similarity index 100%
rename from docs/STDLIB-EXTERN-AUDIT.a2ml
rename to docs/STDLIB-EXTERN-AUDIT.deed
diff --git a/docs/ci/required-checks.adoc b/docs/ci/required-checks.adoc
index aebf271f..b639783d 100644
--- a/docs/ci/required-checks.adoc
+++ b/docs/ci/required-checks.adoc
@@ -7,7 +7,7 @@
 ====
 *Sketch / operational note* (seeded 2026-06-21). Captures a CI failure class
 that blocked merges across the estate and the rule that prevents it. Pairs with
-the machine entry in `.machine_readable/descriptiles/PLAYBOOK.a2ml` (`[ci-required-checks]`).
+the machine entry in `.machine_readable/descriptiles/PLAYBOOK.deed` (`[ci-required-checks]`).
 ====
 
 toc::[]
diff --git a/docs/guides/frontier-programming-practices/AI.a2ml b/docs/guides/frontier-programming-practices/AI.deed
similarity index 100%
rename from docs/guides/frontier-programming-practices/AI.a2ml
rename to docs/guides/frontier-programming-practices/AI.deed
diff --git a/docs/history/BINDINGS-STDLIB-CODEGEN-2026-05-31.a2ml b/docs/history/BINDINGS-STDLIB-CODEGEN-2026-05-31.deed
similarity index 100%
rename from docs/history/BINDINGS-STDLIB-CODEGEN-2026-05-31.a2ml
rename to docs/history/BINDINGS-STDLIB-CODEGEN-2026-05-31.deed
diff --git a/docs/history/TYPED-WASM-LEVEL-10-CLOSURE-2026-04-19.a2ml b/docs/history/TYPED-WASM-LEVEL-10-CLOSURE-2026-04-19.deed
similarity index 100%
rename from docs/history/TYPED-WASM-LEVEL-10-CLOSURE-2026-04-19.a2ml
rename to docs/history/TYPED-WASM-LEVEL-10-CLOSURE-2026-04-19.deed
diff --git a/docs/specs/TYPED-WASM-COORDINATION-LEDGER.a2ml b/docs/specs/TYPED-WASM-COORDINATION-LEDGER.deed
similarity index 100%
rename from docs/specs/TYPED-WASM-COORDINATION-LEDGER.a2ml
rename to docs/specs/TYPED-WASM-COORDINATION-LEDGER.deed
diff --git a/docs/specs/TYPED-WASM-INTERFACE.a2ml b/docs/specs/TYPED-WASM-INTERFACE.deed
similarity index 100%
rename from docs/specs/TYPED-WASM-INTERFACE.a2ml
rename to docs/specs/TYPED-WASM-INTERFACE.deed
diff --git a/docs/specs/TYPED-WASM-ROADMAP.a2ml b/docs/specs/TYPED-WASM-ROADMAP.deed
similarity index 100%
rename from docs/specs/TYPED-WASM-ROADMAP.a2ml
rename to docs/specs/TYPED-WASM-ROADMAP.deed
diff --git a/docs/standards/PANIC-ATTACK.a2ml b/docs/standards/PANIC-ATTACK.deed
similarity index 100%
rename from docs/standards/PANIC-ATTACK.a2ml
rename to docs/standards/PANIC-ATTACK.deed
diff --git a/docs/standards/TESTING.a2ml b/docs/standards/TESTING.deed
similarity index 100%
rename from docs/standards/TESTING.a2ml
rename to docs/standards/TESTING.deed
diff --git a/justfile b/justfile
index e823641f..4d7e94e5 100644
--- a/justfile
+++ b/justfile
@@ -92,12 +92,13 @@ check: lint test guard
 #  - Issue #35 Phase 3: fails if extension.ts reappears under
 #    editors/vscode/src or any face's vscode extension dir.
 #  - Issue #176 (DOC-01..09): the unified doc-truthing guard — fails if the
-#    status-doc banners / matrix primacy / STATE.a2ml mirror keys re-drift,
+#    status-doc banners / matrix primacy / STATE.deed mirror keys re-drift,
 #    OR if a NEW backend-breadth / "production-ready" / stdlib-% over-claim
 #    appears beyond the frozen baseline.
 guard:
     ./tools/check-no-extension-ts.sh
     ./tools/check-doc-truthing.sh
+    ./tools/check-deed-gates.sh
     ./tools/check-soundness-ledger.sh
     ./tools/check-capability-anchors.sh
 
diff --git a/tools/check-deed-gates.sh b/tools/check-deed-gates.sh
new file mode 100755
index 00000000..00e17a21
--- /dev/null
+++ b/tools/check-deed-gates.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# CI gate: DEED owns the manifest grammar. A2ML is retired.
+# Fails if any *.a2ml remains, if the repo deed is missing, or if
+# in-repo gates still key off STATE.a2ml / a2ml-validate.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+fail=0
+note() { printf '%s\n' "$*" >&2; }
+
+leftover="$(find . -name '*.a2ml' -not -path './.git/*' -print | LC_ALL=C sort || true)"
+if [[ -n "$leftover" ]]; then
+  note "ERROR: leftover .a2ml files — A2ML is retired; rename to .deed:"
+  printf '%s\n' "$leftover" | sed 's/^/  /' >&2
+  fail=1
+fi
+
+deed_count="$(find . \( -name '*.deed' \) -not -path './.git/*' | wc -l | tr -d ' ')"
+if [[ "$deed_count" -eq 0 ]]; then
+  note "ERROR: no .deed manifests found. Author DEED, not A2ML."
+  fail=1
+fi
+
+if [[ ! -f affinescript_chora.deed ]]; then
+  note "ERROR: missing repo deed affinescript_chora.deed"
+  fail=1
+else
+  if ! grep -q '(repo-deed' affinescript_chora.deed; then
+    note "ERROR: affinescript_chora.deed is not a DEED s-expression (expected (repo-deed ...))"
+    fail=1
+  fi
+  if ! grep -q ':schema-version' affinescript_chora.deed; then
+    note "ERROR: affinescript_chora.deed missing :schema-version"
+    fail=1
+  fi
+fi
+
+state=".machine_readable/descriptiles/STATE.deed"
+if [[ ! -f "$state" ]]; then
+  note "ERROR: missing $state (DOC-05 mirror; not STATE.a2ml)"
+  fail=1
+else
+  for key in authoritative-status-doc drift-flag; do
+    if ! grep -q "$key" "$state"; then
+      note "ERROR: $state lost the '$key' key"
+      fail=1
+    fi
+  done
+fi
+
+# In-repo gates must not still require the dead extension.
+if grep -nE 'STATE\.a2ml|a2ml-validate|0-AI-MANIFEST\.a2ml' \
+    tools/check-doc-truthing.sh \
+    .github/workflows/*.yml justfile 2>/dev/null; then
+  note "ERROR: CI/tools still gate on .a2ml paths — point them at .deed"
+  fail=1
+fi
+
+if [[ "$fail" -ne 0 ]]; then
+  note ""
+  note "DEED gate failed. Manifest grammar is .deed (standards 1-formats/deed/)."
+  note "A2ML is not a CI format."
+  exit 1
+fi
+
+echo "OK: DEED gates — ${deed_count} .deed file(s), no leftover .a2ml, repo deed present."
diff --git a/tools/check-doc-truthing.sh b/tools/check-doc-truthing.sh
index 705235a5..b4d86e00 100755
--- a/tools/check-doc-truthing.sh
+++ b/tools/check-doc-truthing.sh
@@ -18,7 +18,7 @@
 # check-doc-overclaims.sh — into one script with no overlap):
 #
 #   Presence invariants (DOC-04/05) — fails if any banner pointer, the matrix's
-#   self-declaration, the anti-over-claim section, or the STATE.a2ml mirror keys
+#   self-declaration, the anti-over-claim section, or the STATE.deed mirror keys
 #   are removed. This deliberately checks *presence of the correction*, not a
 #   phrase blocklist: "production-ready" legitimately appears inside the
 #   negating banners and future-roadmap sections, so a naive grep over the
@@ -67,7 +67,7 @@ BANNERED_DOCS=(
 
 # The machine-readable mirror (DOC-05): it follows the matrix, it does not
 # lead. These keys assert that contract in-band.
-STATE_FILE=".machine_readable/descriptiles/STATE.a2ml"
+STATE_FILE=".machine_readable/descriptiles/STATE.deed"
 STATE_KEYS=(
   "authoritative-status-doc"
   "drift-flag"
@@ -168,7 +168,7 @@ for stem in "${BANNERED_DOCS[@]}"; do
   fi
 done
 
-# --- 3. STATE.a2ml still declares itself a mirror, not a leader (DOC-05) -----
+# --- 3. STATE.deed still declares itself a mirror, not a leader (DOC-05) -----
 if [ ! -f "$STATE_FILE" ]; then
   note "ERROR: machine-readable state file is missing: $STATE_FILE"
   fail=1
@@ -176,7 +176,7 @@ else
   for key in "${STATE_KEYS[@]}"; do
     if ! grep -q "$key" "$STATE_FILE"; then
       note "ERROR: $STATE_FILE lost the '$key' key."
-      note "       DOC-05 requires STATE.a2ml to flag that it MIRRORS the"
+      note "       DOC-05 requires STATE.deed to flag that it MIRRORS the"
       note "       capability matrix and does not lead it (issue #176)."
       fail=1
     fi

From 9c1c75f9d2b7ef216c7a3e6806aac38968912b68 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 21 Sep 2026 11:07:18 +0000
Subject: [PATCH 3/3] ci(deed): pin deed-validate in actions.lock; contents:
 read

Sonar githubactions:S8234 rejects permissions: read-all on new
workflow files. actions-lock startup-fails workflows that are not
listed, so deed-validate.yml is registered with checkout@v7.0.1.
---
 .github/workflows/actions.lock      | 2 ++
 .github/workflows/deed-validate.yml | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index fbae6bf5..660e56ee 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -21,6 +21,8 @@ workflows:
         - 'github/codeql-action@v4.38.0'
     '.github/workflows/coq-proof-gate.yml':
         - 'actions/checkout@v7.0.1'
+    '.github/workflows/deed-validate.yml':
+        - 'actions/checkout@v7.0.1'
     '.github/workflows/governance-baseline-impl.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/governance-baseline.yml': []
diff --git a/.github/workflows/deed-validate.yml b/.github/workflows/deed-validate.yml
index 1ad7f10a..85ce11f0 100644
--- a/.github/workflows/deed-validate.yml
+++ b/.github/workflows/deed-validate.yml
@@ -6,7 +6,8 @@ on:
   pull_request:
   push:
     branches: [main]
-permissions: read-all
+permissions:
+  contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true