ci(deed): gate CI on .deed; leftover .a2ml fails

.github/CONTRIBUTING.md

@@ -6,7 +6,7 @@ how to set up a working tree, file useful bugs, and submit changes.
 
 For the language itself, start from [`README.adoc`](../README.adoc). For
 project state, blockers, and next-actions, see
-[`.machine_readable/descriptiles/STATE.a2ml`](../.machine_readable/descriptiles/STATE.a2ml).
+[`.machine_readable/descriptiles/STATE.deed`](../.machine_readable/descriptiles/STATE.deed).
 
 ’’’’’
 
@@ -47,7 +47,7 @@ Tested on OCaml 4.14.2 (the constraint in `dune-project` is `>=`
     ├── packages/            # Aggregate JS/TS/ binding packages
     ├── editors/             # Editor integrations
     ├── js/                  # `js_of_ocaml` playground (built into `playground.bc.js`)
-    ├── .machine_readable/   # Machine-readable metadata (`.a2ml`) — see 0-AI-MANIFEST.a2ml
+    ├── .machine_readable/   # Machine-readable metadata (`.deed`) — see 0-AI-MANIFEST.deed
     ├── .github/             # CI workflows, issue templates
     │   └── CONTRIBUTING.md  # This file
     ├── CODE_OF_CONDUCT.md
@@ -85,7 +85,7 @@ template](.github/ISSUE_TEMPLATE/bug_report.md) and include:
 ### Suggesting Features
 
 **Before suggesting:** 1. Skim [`docs/ROADMAP.adoc`](../docs/ROADMAP.adoc)
-and `.machine_readable/descriptiles/STATE.a2ml`. 2. Search existing
+and `.machine_readable/descriptiles/STATE.deed`. 2. Search existing
 issues and discussions.
 
 **When suggesting:** use the [feature request
@@ -150,7 +150,7 @@ dune runtest     # must be green
 dune fmt         # optional — auto-formats with ocamlformat
 ```
 
-The `methodology.a2ml` file lists the canonical gate set. CI will rerun
+The `methodology.deed` file lists the canonical gate set. CI will rerun
 `build` + `runtest` plus the security, lint, and policy workflows in
 `.github/workflows/`.
 

.github/workflows/actions.lock

@@ -21,6 +21,8 @@ workflows:
         - 'github/codeql-action@v4.38.0'
     '.github/workflows/coq-proof-gate.yml':
         - 'actions/checkout@v7.0.1'
+    '.github/workflows/deed-validate.yml':
+        - 'actions/checkout@v7.0.1'
     '.github/workflows/governance-baseline-impl.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/governance-baseline.yml': []

.github/workflows/ci.yml

@@ -108,11 +108,14 @@ jobs:
         if: ${{ !cancelled() }}
         # Single toolchain-free gate enforcing both halves of the doc-truthing
         # MONITOR: the presence invariants (DOC-04/05 — banner pointers, matrix
-        # primacy + anti-over-claim section, STATE.a2ml mirror keys) AND the
+        # primacy + anti-over-claim section, STATE.deed mirror keys) AND the
         # over-claim ratchet (DOC-08/09 — fails any NEW backend-breadth /
         # "production-ready" / stdlib-% phrase beyond tools/doc-overclaims.allow).
         # See tools/check-doc-truthing.sh.
         run: ./tools/check-doc-truthing.sh
+      - name: DEED manifest gate (A2ML retired)
+        if: ${{ !cancelled() }}
+        run: ./tools/check-deed-gates.sh
       - name: Soundness-ledger anti-staleness gate
         if: ${{ !cancelled() }}
         # docs/SOUNDNESS.adoc is the single source of truth for soundness-hole

.github/workflows/deed-validate.yml

@@ -0,0 +1,23 @@
+# This workflow is managed by gh actions-lock.
+# SPDX-License-Identifier: MPL-2.0
+# DEED manifest gate. A2ML is retired; leftover *.a2ml fails CI.
+name: "DEED Manifest Validation"
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  deed-validate:
+    name: Validate DEED manifests
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+      - name: Run DEED gates
+        run: ./tools/check-deed-gates.sh

0-AI-MANIFEST.deed

@@ -0,0 +1,37 @@
+# AI Assistant Instructions
+
+# Machine-Readable Metadata
+
+Project metadata and AI agent configuration files live under `.machine_readable/`. All metadata files use the `.deed` extension; the `.scm` extension is reserved for Guix (`guix.scm`, `.guix-channel`).
+
+## Core descriptiles metadata (`.machine_readable/descriptiles/`)
+
+- **STATE.deed** - Current project state, progress, blockers, next actions, session notes
+- **ECOSYSTEM.deed** - Position in ecosystem, relationships to sibling projects
+- **META.deed** - Architecture decisions, governance, development practices
+- **PLAYBOOK.deed** - Operational runbook, procedures, alerts
+- **AGENTIC.deed** - AI agent interaction patterns and constraints
+- **NEUROSYM.deed** - Neurosymbolic integration configuration
+
+## Top-level contractile files (`.machine_readable/`)
+
+- **ADJUST.contractile**, **INTENT.contractile**, **MUST.contractile**, **TRUST.contractile** - Trident-shape commitments
+- **CLADE.deed** - Phylogenetic context within the estate
+- **anchors/ANCHOR.deed** - Stable references for tooling
+
+## Agent guidance (`.machine_readable/agent_instructions/`)
+
+- **methodology.deed** - Required checks (dune build / dune runtest must pass; see for the full list)
+- **coverage.deed**, **debt.deed** - Tracked metrics
+- **README.adoc** - Human-readable summary of agent instructions
+
+**These files are the canonical source of truth for project metadata.**
+
+## Workflow
+
+1. Read `.machine_readable/descriptiles/*.deed` files at session start
+2. Check `STATE.deed` for current phase, blockers, next actions
+3. Follow patterns and constraints from `AGENTIC.deed`
+4. Follow methodology gates from `agent_instructions/methodology.deed`
+5. Update `STATE.deed` after completing work
+6. Sync to database: `~/sync-language-tracker.sh`

CHANGELOG.adoc

@@ -23,6 +23,10 @@ kept so existing scripts fail loudly (Refs #56)
 
 ==== Added
 
+* CI gates on `.deed` (DEED grammar). Leftover `.a2ml` is a hard fail.
+`tools/check-deed-gates.sh` + `.github/workflows/deed-validate.yml`.
+Machine-readable manifests renamed `.a2ml` → `.deed`. Repo deed:
+`affinescript_chora.deed` (Refs standards #837)
 * Aspirational idaptik StartupError fixture compiles with real syntax
 (`use Console::{log}`, `use Dom::{…}`, tuple-list attrs and
 `#{ bg: … }` records) on `--bun-esm` (Refs #56)

affinescript_chora.deed

@@ -0,0 +1,17 @@
+;; SPDX-License-Identifier: MPL-2.0
+;;
+;; Repo deed for affinescript. DEED (s-expression, application/vnd.deed)
+;; owns the manifest grammar; A2ML is retired (standards #837 / #64).
+;; CI gates on this file and on *.deed — leftover *.a2ml is a hard fail.
+(repo-deed
+  :schema-version "1.0.0"
+  :canonical-name "affinescript"
+  :beholding-chora #u5"estate/chora"
+  :repo-uuid #u5"github.com/hyperpolymath/affinescript"
+  (manifest
+    :version "0.1.1"
+    :project "affinescript"
+    :purpose "AffineScript compiler — linear/affine typed language with wasm and Bun-ESM backends."
+    :authoritative-status-doc "docs/CAPABILITY-MATRIX.adoc"
+    :state-mirror ".machine_readable/descriptiles/STATE.deed"
+    :estate "AsciiDoc + .deed; not .a2ml"))

docs/ci/required-checks.adoc

@@ -7,7 +7,7 @@
 ====
 *Sketch / operational note* (seeded 2026-06-21). Captures a CI failure class
 that blocked merges across the estate and the rule that prevents it. Pairs with
-the machine entry in `.machine_readable/descriptiles/PLAYBOOK.a2ml` (`[ci-required-checks]`).
+the machine entry in `.machine_readable/descriptiles/PLAYBOOK.deed` (`[ci-required-checks]`).
 ====
 
 toc::[]

justfile

@@ -92,12 +92,13 @@ check: lint test guard
 #  - Issue #35 Phase 3: fails if extension.ts reappears under
 #    editors/vscode/src or any face's vscode extension dir.
 #  - Issue #176 (DOC-01..09): the unified doc-truthing guard — fails if the
-#    status-doc banners / matrix primacy / STATE.a2ml mirror keys re-drift,
+#    status-doc banners / matrix primacy / STATE.deed mirror keys re-drift,
 #    OR if a NEW backend-breadth / "production-ready" / stdlib-% over-claim
 #    appears beyond the frozen baseline.
 guard:
     ./tools/check-no-extension-ts.sh
     ./tools/check-doc-truthing.sh
+    ./tools/check-deed-gates.sh
     ./tools/check-soundness-ledger.sh
     ./tools/check-capability-anchors.sh
 

scripts/install-tree-sitter-cli.sh

@@ -5,11 +5,12 @@
 # Used by CI instead of `npm install -g --ignore-scripts tree-sitter-cli`:
 # that package's binary is fetched in a postinstall script, so
 # --ignore-scripts (Sonar S6505) leaves `tree-sitter` missing (ENOENT).
-# A release tarball has no lifecycle scripts.
 set -euo pipefail
 
 VER="${TREE_SITTER_CLI_VERSION:-0.25.0}"
-DEST="${TREE_SITTER_CLI_DEST:-/usr/local/bin/tree-sitter}"
+# tree-sitter-linux-x64.gz from
+# https://github.com/tree-sitter/tree-sitter/releases/tag/v0.25.0
+SHA256="${TREE_SITTER_LINUX_X64_SHA256:-d7b68a7a79459c0c23e062f719fe90781ed284a4fb172756e217ca08ea86b8d3}"
 
 arch="$(uname -m)"
 case "$arch" in
@@ -22,17 +23,20 @@ case "$arch" in
 esac
 
 url="https://github.com/tree-sitter/tree-sitter/releases/download/v${VER}/tree-sitter-linux-${ts_arch}.gz"
-tmp="$(mktemp)"
-trap 'rm -f "$tmp"' EXIT
-curl -fsSL "$url" | gunzip > "$tmp"
-chmod +x "$tmp"
+workdir="${RUNNER_TEMP:-$(mktemp -d)}"
+archive="${workdir}/tree-sitter-linux-${ts_arch}.gz"
+bin_dir="${workdir}/tree-sitter-cli"
+mkdir -p "$bin_dir"
 
-if [ -w "$(dirname "$DEST")" ]; then
-  mv "$tmp" "$DEST"
-  trap - EXIT
-else
-  sudo mv "$tmp" "$DEST"
-  trap - EXIT
-fi
+curl --fail --location --retry 3 --proto "=https" \
+  --output "$archive" \
+  "$url"
+printf '%s  %s\n' "$SHA256" "$archive" | sha256sum --check --strict
+gunzip -c "$archive" > "${bin_dir}/tree-sitter"
+chmod +x "${bin_dir}/tree-sitter"
 
-"$DEST" --version
+if [[ -n "${GITHUB_PATH:-}" ]]; then
+  printf '%s\n' "$bin_dir" >> "$GITHUB_PATH"
+fi
+export PATH="${bin_dir}:${PATH}"
+tree-sitter --version

tools/check-deed-gates.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# CI gate: DEED owns the manifest grammar. A2ML is retired.
+# Fails if any *.a2ml remains, if the repo deed is missing, or if
+# in-repo gates still key off STATE.a2ml / a2ml-validate.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+fail=0
+note() { printf '%s\n' "$*" >&2; }
+
+leftover="$(find . -name '*.a2ml' -not -path './.git/*' -print | LC_ALL=C sort || true)"
+if [[ -n "$leftover" ]]; then
+  note "ERROR: leftover .a2ml files — A2ML is retired; rename to .deed:"
+  printf '%s\n' "$leftover" | sed 's/^/  /' >&2
+  fail=1
+fi
+
+deed_count="$(find . \( -name '*.deed' \) -not -path './.git/*' | wc -l | tr -d ' ')"
+if [[ "$deed_count" -eq 0 ]]; then
+  note "ERROR: no .deed manifests found. Author DEED, not A2ML."
+  fail=1
+fi
+
+if [[ ! -f affinescript_chora.deed ]]; then
+  note "ERROR: missing repo deed affinescript_chora.deed"
+  fail=1
+else
+  if ! grep -q '(repo-deed' affinescript_chora.deed; then
+    note "ERROR: affinescript_chora.deed is not a DEED s-expression (expected (repo-deed ...))"
+    fail=1
+  fi
+  if ! grep -q ':schema-version' affinescript_chora.deed; then
+    note "ERROR: affinescript_chora.deed missing :schema-version"
+    fail=1
+  fi
+fi
+
+state=".machine_readable/descriptiles/STATE.deed"
+if [[ ! -f "$state" ]]; then
+  note "ERROR: missing $state (DOC-05 mirror; not STATE.a2ml)"
+  fail=1
+else
+  for key in authoritative-status-doc drift-flag; do
+    if ! grep -q "$key" "$state"; then
+      note "ERROR: $state lost the '$key' key"
+      fail=1
+    fi
+  done
+fi
+
+# In-repo gates must not still require the dead extension.
+if grep -nE 'STATE\.a2ml|a2ml-validate|0-AI-MANIFEST\.a2ml' \
+    tools/check-doc-truthing.sh \
+    .github/workflows/*.yml justfile 2>/dev/null; then
+  note "ERROR: CI/tools still gate on .a2ml paths — point them at .deed"
+  fail=1
+fi
+
+if [[ "$fail" -ne 0 ]]; then
+  note ""
+  note "DEED gate failed. Manifest grammar is .deed (standards 1-formats/deed/)."
+  note "A2ML is not a CI format."
+  exit 1
+fi
+
+echo "OK: DEED gates — ${deed_count} .deed file(s), no leftover .a2ml, repo deed present."

tools/check-doc-truthing.sh

@@ -18,7 +18,7 @@
 # check-doc-overclaims.sh — into one script with no overlap):
 #
 #   Presence invariants (DOC-04/05) — fails if any banner pointer, the matrix's
-#   self-declaration, the anti-over-claim section, or the STATE.a2ml mirror keys
+#   self-declaration, the anti-over-claim section, or the STATE.deed mirror keys
 #   are removed. This deliberately checks *presence of the correction*, not a
 #   phrase blocklist: "production-ready" legitimately appears inside the
 #   negating banners and future-roadmap sections, so a naive grep over the
@@ -67,7 +67,7 @@ BANNERED_DOCS=(
 
 # The machine-readable mirror (DOC-05): it follows the matrix, it does not
 # lead. These keys assert that contract in-band.
-STATE_FILE=".machine_readable/descriptiles/STATE.a2ml"
+STATE_FILE=".machine_readable/descriptiles/STATE.deed"
 STATE_KEYS=(
   "authoritative-status-doc"
   "drift-flag"
@@ -168,15 +168,15 @@ for stem in "${BANNERED_DOCS[@]}"; do
   fi
 done
 
-# --- 3. STATE.a2ml still declares itself a mirror, not a leader (DOC-05) -----
+# --- 3. STATE.deed still declares itself a mirror, not a leader (DOC-05) -----
 if [ ! -f "$STATE_FILE" ]; then
   note "ERROR: machine-readable state file is missing: $STATE_FILE"
   fail=1
 else
   for key in "${STATE_KEYS[@]}"; do
     if ! grep -q "$key" "$STATE_FILE"; then
       note "ERROR: $STATE_FILE lost the '$key' key."
-      note "       DOC-05 requires STATE.a2ml to flag that it MIRRORS the"
+      note "       DOC-05 requires STATE.deed to flag that it MIRRORS the"
       note "       capability matrix and does not lead it (issue #176)."
       fail=1
     fi