hyperpolymath · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -180,9 +180,6 @@ jobs:
     # for 24.04, and a runner that silently rolled to the next LTS would take that pin
     # with it. `runs-on` cannot read `env`, so this is a literal.
     runs-on: ubuntu-24.04
-    # Bound a hung toolchain install or test run. The full R/Julia suite normally
-    # completes well inside this budget; the GitHub default is six hours.
-    timeout-minutes: 60
     # The repository's root .Rprofile sources renv/activate.R, so R started from
     # the checkout auto-activates renv and rewrites the library paths. renv is a
     # local-development convenience; CI installs into the system library and
@@ -420,7 +417,7 @@ jobs:
         shell: bash
         run: |
           set +e
-          julia --project=. -t2 --compiled-modules=no test/runtests.jl numeric_policy exact_summaries high_precision derived_analyses validated_statistics 2>&1 | tee /tmp/validated-statistics-tests.log
+          julia --project=. -t2 --compiled-modules=no test/runtests.jl validated_statistics numeric_policy exact_summaries high_precision derived_analyses 2>&1 | tee /tmp/validated-statistics-tests.log
           # Preserve both exits immediately: a successful Julia run must not
           # hide a failed log write (e.g. a full runner filesystem).
           statuses=("${PIPESTATUS[@]}")

diff --git a/.github/workflows/doi.yml b/.github/workflows/doi.yml
@@ -42,7 +42,7 @@ jobs:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
           relevant=false
-          patterns=('src/core/doi.jl' 'docs/doi-publication.md' 'scripts/link-doi.sh' '.github/workflows/doi.yml')
+          patterns=('src/core/doi.jl' 'src/server/routes/doi.jl' 'test/unit/test_doi.jl' 'CITATION.cff' 'docs/doi-publication.md' 'scripts/link-doi.sh' '.github/workflows/doi.yml')
           changed="$RUNNER_TEMP/doi-changed-files"
           if ! git diff --no-renames --name-only -z "$BASE_SHA...HEAD" > "$changed"; then
             echo "ERROR: git diff $BASE_SHA...HEAD failed" >&2
@@ -67,21 +67,38 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Shell syntax check
         run: bash -n scripts/link-doi.sh
 
-      - name: YAML parse
-        run: python3 -c 'import yaml,sys; yaml.safe_load(open("docs/doi-publication.md"))' 2>/dev/null || true
+      - name: Citation metadata check
+        run: |
+          python3 - <<'PY'
+          from pathlib import Path
+          import sys
+
+          cff = Path("CITATION.cff").read_text(encoding="utf-8")
+          required_prefixes = ("cff-version:", "title:", "authors:", "license:")
+          missing = [p for p in required_prefixes if not any(line.startswith(p) for line in cff.splitlines())]
+          if missing:
+              sys.exit(f"CITATION.cff missing required top-level keys: {', '.join(missing)}")
+          PY
 
       - name: Receipt schema shape
         run: |
           python3 - <<'PY'
-          import json, sys
-          # A valid receipt carries these keys; this is a shape check only.
-          keys = {"schema","study","run","origin","deposition_id","doi","published",
-                  "files","created_at","published_at","checksum"}
-          print("receipt schema shape documented in src/core/doi.jl")
+          from pathlib import Path
+          import sys
+
+          source = Path("src/core/doi.jl").read_text(encoding="utf-8")
+          keys = ("schema", "study", "run", "origin", "deposition_id", "doi",
+                  "published", "files", "created_at", "published_at", "checksum")
+          missing = [k for k in keys if f'"{k}"' not in source and f":{k}" not in source]
+          if missing:
+              sys.exit(f"src/core/doi.jl missing receipt schema keys: {', '.join(missing)}")
+          print("verified DOI receipt schema keys in src/core/doi.jl")
           PY
 
   # Julia lifecycle and real-HTTP checks require a provisioned machine with the

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
@@ -60,9 +60,9 @@ jobs:
       contents: read
       pull-requests: read
     with:
-      # No K9 contracts are committed yet: report grey, never pretend that
-      # DEED syntax validation establishes K9 semantic conformance.
-      require-files: false
+      # Require the committed .machine_readable/contractiles/ K9 corpus across
+      # L0–L2; an accidentally emptied corpus or orange state fails closed.
+      require-files: true
       fail-on-indeterminate: true
 
   hypatia:
@@ -164,14 +164,21 @@ jobs:
 
   badges:
     name: Publish badges
-    needs: [deed, hypatia]
+    needs: [deed, k9, hypatia]
     if: ${{ always() && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
       contents: write
       actions: read
     steps:
+      - name: Download the K9 conformance grid
+        continue-on-error: true
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: k9-grid
+          path: k9-grid
+
       - name: Download the verdict grid
         continue-on-error: true
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
@@ -183,6 +190,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DEED_RESULT: ${{ needs.deed.result }}
+          K9_RESULT: ${{ needs.k9.result }}
         run: |
           set -euo pipefail
           # shields.io endpoint JSON, one file per lane, on an orphan branch
@@ -195,6 +203,14 @@ jobs:
             *)       msg=indeterminate; colour=orange ;;
           esac
           jq -n --arg m "$msg" --arg c "$colour" '{schemaVersion: 1, label: "DEED syntax", message: $m, color: $c}' > out/deed.json
+          if [ "$K9_RESULT" = "success" ] && [ -s k9-grid/badge.json ]; then
+            cp k9-grid/badge.json out/k9-grid.json
+          elif [ "$K9_RESULT" = "failure" ]; then
+            jq -n '{schemaVersion: 1, label: "K9 contracts", message: "failing", color: "red"}' > out/k9-grid.json
+          else
+            jq -n '{schemaVersion: 1, label: "K9 contracts", message: "indeterminate", color: "orange"}' > out/k9-grid.json
+          fi
+          [ -s k9-grid/report.json ] && cp k9-grid/report.json out/k9-grid.report.json
           if [ -s verdict-grid/badge.json ]; then
             cp verdict-grid/badge.json out/hypatia-grid.json
           else

diff --git a/.gitignore b/.gitignore
@@ -342,6 +342,8 @@ proofs/agda/_build/
 # Occupancy proof dependencies and reproduction logs
 /_build/
 
-# Fork governance: the gitbot-fleet enrolment manifest and report-backs are tracked.
+# Fork governance: the gitbot-fleet enrolment manifest, report-backs, and K9 contractiles are tracked.
 !.gitbot-fleet/
 !.gitbot-fleet/**
+!.machine_readable/
+!.machine_readable/**
diff --git a/.machine_readable/contractiles/intend/intend.k9.ncl b/.machine_readable/contractiles/intend/intend.k9.ncl
@@ -0,0 +1,69 @@
+K9!
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# intend.k9.ncl — Architectural commitments and north-star intent declarations
+# for the hyperpolymath/MetaManifold-WebUI fork. Evaluated at 'Yard (reporting
+# authority; non-gating drift reference).
+{
+  pedigree = {
+    schema_version = "1.0.0",
+    component_type = "contractile:intend",
+    contractile_verb = "intend",
+    semantics = "commitment-and-aspiration",
+    tier = 'Yard,
+    authority = 'reporting,
+    security = {
+      leash = 'Yard,
+      signature_required = false,
+      trust_level = "contract-eval-only",
+      allow_network = false,
+      allow_filesystem_write = false,
+      allow_subprocess = false,
+      capabilities = [],
+    },
+    metadata = {
+      name = "metamanifold-webui-intend",
+      version = "1.0.0",
+      description = "North-star commitments for exact ecological statistics, machine-checked Agda proofs, epistemic cladistic overlays, and clean upstream-candidate separation.",
+      author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
+    },
+    warnings = [
+      "Evaluated at Yard with reporting authority; records architectural intent without executing host commands.",
+    ],
+    side_effects = [],
+  },
+
+  config = {
+    commitments = [
+      {
+        id = "exact-count-aggregation",
+        area = "src/analysis/exact_summaries.jl",
+        status = "verified",
+        summary = "Aggregate amplicon counts with arbitrary-precision integers and rationals before controlled high-precision projection.",
+      },
+      {
+        id = "constructive-formal-proofs",
+        area = "proofs/agda/",
+        status = "verified",
+        summary = "Maintain machine-checked Agda proofs for Benjamini-Hochberg adjustment and TSS/RLE scaling invariants.",
+      },
+      {
+        id = "warranted-cladistic-overlays",
+        area = "src/analysis/clade_cumulus.jl",
+        status = "verified",
+        summary = "Keep CladeCumulus topology proposals support-warranted, immutable as sidecars, and invariant in tip-level Faith PD across reaggregation.",
+      },
+      {
+        id = "honest-fleet-evidence",
+        area = ".gitbot-fleet/enrolment.json",
+        status = "in_progress",
+        summary = "Surface genuine Hypatia, panic-attack, pons-asinorum, K9, and DEED verdicts while keeping unenrolled or unexecuted bot slots explicitly marked rather than fabricated.",
+      },
+    ],
+  },
+
+  validation = {
+    commitment_count_positive = std.array.length config.commitments >= 4,
+  },
+}
diff --git a/.machine_readable/contractiles/must/must.k9.ncl b/.machine_readable/contractiles/must/must.k9.ncl
@@ -0,0 +1,81 @@
+K9!
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# must.k9.ncl — Release-blocking invariant declarations for the
+# hyperpolymath/MetaManifold-WebUI fork. Evaluated at 'Yard (contract-eval-only);
+# verification commands run in dedicated CI jobs rather than inside this file.
+{
+  pedigree = {
+    schema_version = "1.0.0",
+    component_type = "contractile:must",
+    contractile_verb = "must",
+    semantics = "invariant-assertion",
+    tier = 'Yard,
+    authority = 'blocking,
+    security = {
+      leash = 'Yard,
+      signature_required = false,
+      trust_level = "contract-eval-only",
+      allow_network = false,
+      allow_filesystem_write = false,
+      allow_subprocess = false,
+      capabilities = [],
+    },
+    metadata = {
+      name = "metamanifold-webui-must",
+      version = "1.0.0",
+      description = "Release-blocking fork invariants for DEED/K9 governance, proof soundness, high-precision oracles, and upstream AGPL-3.0 preservation.",
+      author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
+    },
+    warnings = [
+      "Evaluated at Yard as typed configuration only; invariant scripts execute in pinned GitHub Actions steps.",
+    ],
+    side_effects = [],
+  },
+
+  config = {
+    repository = "hyperpolymath/MetaManifold-WebUI",
+    upstream_repository = "JoshuaJewell/MetaManifold-WebUI",
+    upstream_license = "AGPL-3.0-only",
+    fork_addition_license = "MPL-2.0",
+    invariants = [
+      {
+        id = "repo-deed-present",
+        target = "MetaManifold-WebUI_chora.deed",
+        check_command = "deed_lint.js MetaManifold-WebUI_chora.deed",
+        rationale = "Repository deed must remain syntactically and structurally valid.",
+      },
+      {
+        id = "governance-advisory-sarif-boundary",
+        target = "scripts/check-governance-contract.sh",
+        check_command = "bash scripts/check-governance-contract.sh",
+        rationale = "Pull-request Hypatia scans must publish verdict grids without creating blocking SARIF upload gates, and standards workflow pins must match.",
+      },
+      {
+        id = "agda-axiom-audit",
+        target = "proofs/tests/axiom-audit.sh",
+        check_command = "bash proofs/tests/axiom-audit.sh",
+        rationale = "Agda proofs must retain --safe --without-K with zero postulates or escape pragmas.",
+      },
+      {
+        id = "high-precision-reference-oracle",
+        target = "test/references/check_high_precision_references.py",
+        check_command = "python3 test/references/check_high_precision_references.py --check test/unit/test_high_precision.jl",
+        rationale = "Independent arbitrary-precision reference constants must match the Julia test suite.",
+      },
+      {
+        id = "upstream-license-untouched",
+        target = "LICENSE",
+        check_command = "test -s LICENSE && test -s CITATION.cff",
+        rationale = "Upstream AGPL-3.0-only LICENSE, CITATION.cff, and existing copyright headers are never rewritten on this fork.",
+      },
+    ],
+  },
+
+  validation = {
+    has_upstream_license = config.upstream_license == "AGPL-3.0-only",
+    has_fork_license = config.fork_addition_license == "MPL-2.0",
+    invariant_count_positive = std.array.length config.invariants >= 5,
+  },
+}
diff --git a/.machine_readable/contractiles/trust/trust.k9.ncl b/.machine_readable/contractiles/trust/trust.k9.ncl
@@ -0,0 +1,68 @@
+K9!
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# trust.k9.ncl — Security and data-integrity boundary declarations for the
+# hyperpolymath/MetaManifold-WebUI fork. Evaluated at 'Yard (contract-eval-only).
+{
+  pedigree = {
+    schema_version = "1.0.0",
+    component_type = "contractile:trust",
+    contractile_verb = "trust",
+    semantics = "boundary-verification",
+    tier = 'Yard,
+    authority = 'blocking,
+    security = {
+      leash = 'Yard,
+      signature_required = false,
+      trust_level = "contract-eval-only",
+      allow_network = false,
+      allow_filesystem_write = false,
+      allow_subprocess = false,
+      capabilities = [],
+    },
+    metadata = {
+      name = "metamanifold-webui-trust",
+      version = "1.0.0",
+      description = "Trust-boundary declarations covering strict I-JSON/JCS serialisation, HTTP JSON input validation, read-only DuckDB analysis access, and SHA-pinned workflows.",
+      author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
+    },
+    warnings = [
+      "Evaluated at Yard as typed configuration only; boundary tests run inside the CI workflow.",
+    ],
+    side_effects = [],
+  },
+
+  config = {
+    max_statistics_request_bytes = 16777216,
+    max_ieee754_safe_integer = 9007199254740991,
+    boundaries = [
+      {
+        id = "strict-ijson-jcs-wire-boundary",
+        surface = "src/core/canonical.jl",
+        rule = "Validated statistics and canonical responses enforce RFC 7493 I-JSON input parsing and RFC 8785 JCS deterministic output.",
+      },
+      {
+        id = "http-json-body-validation",
+        surface = "src/server/server.jl",
+        rule = "HTTP JSON route handlers reject malformed or non-object JSON payloads with HTTP 400 rather than throwing unhandled 500 exceptions, without mutating request byte buffers.",
+      },
+      {
+        id = "read-only-duckdb-analysis",
+        surface = "src/server/routes/duckdb_helpers.jl",
+        rule = "Analysis and validated-statistics routes open run DuckDB files in read-only mode and stream exact integer counts into BigInt accumulators.",
+      },
+      {
+        id = "immutable-ci-and-tool-pins",
+        surface = "test/unit/test_install_pins.jl",
+        rule = "Workflow actions and bioinformatics tool versions remain pinned and verified by unit tests.",
+      },
+    ],
+  },
+
+  validation = {
+    request_limit_positive = config.max_statistics_request_bytes > 0,
+    safe_integer_bound = config.max_ieee754_safe_integer == 9007199254740991,
+    boundary_count_positive = std.array.length config.boundaries >= 4,
+  },
+}
diff --git a/0-AI-MANIFEST.a2ml b/0-AI-MANIFEST.a2ml
@@ -29,4 +29,5 @@
     (history-scan ".github/workflows/secret-scanner.yml")
     (security-practices ".github/workflows/scorecard.yml")
     (fleet-enrolment ".gitbot-fleet/enrolment.json")
-    (scope "DEED syntax is not K9 semantic conformance. No K9 contracts are committed; the K9 corpus is grey, not a pass.")))
+    (contractiles ".machine_readable/contractiles/")
+    (scope "DEED syntax and K9 semantic conformance are validated separately: Yard-tier K9 contracts (must, trust, intend) are checked across L0-L2; L3 signatures remain outside CI.")))
diff --git a/MetaManifold-WebUI_chora.deed b/MetaManifold-WebUI_chora.deed
@@ -17,10 +17,11 @@
     :analysis "src/analysis/"
     :cladistics "docs/cladistics/"
     :proofs "proofs/"
+    :contractiles ".machine_readable/contractiles/"
     :enforcement ".github/workflows/")
   (status
     :evidence-source ".github/workflows/governance.yml"
-    :evidence-status "Fork governance lane only: DEED syntax, the K9 conformance grid (no contracts yet; grey corpus), and the Hypatia verdict grid with gitbot-fleet report-backs. Upstream owns the code and its CI; this deed describes the fork.")
+    :evidence-status "Fork governance lane: DEED syntax, K9 L0-L2 contract conformance (must, trust, intend at Yard tier; L3 signatures not verified in CI), and the Hypatia verdict grid with gitbot-fleet report-backs. Upstream owns the application code and its CI; this deed describes the fork.")
   (policies
     (licensing
       :initial-assignment "New files the fork authors carry MPL-2.0 with an SPDX header, as upstream CONTRIBUTING.md permits."

diff --git a/README.md b/README.md
@@ -9,6 +9,7 @@
 Fork governance (hyperpolymath/MetaManifold-WebUI only; nothing here is part of upstream):
 [![Governance (fork)](https://github.com/hyperpolymath/MetaManifold-WebUI/actions/workflows/governance.yml/badge.svg)](https://github.com/hyperpolymath/MetaManifold-WebUI/actions/workflows/governance.yml)
 [![DEED syntax](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fhyperpolymath%2FMetaManifold-WebUI%2Fgovernance-badges%2Fdeed.json)](MetaManifold-WebUI_chora.deed)
+[![K9 contracts](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fhyperpolymath%2FMetaManifold-WebUI%2Fgovernance-badges%2Fk9-grid.json)](.machine_readable/contractiles/)
 [![Hypatia grid](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fhyperpolymath%2FMetaManifold-WebUI%2Fgovernance-badges%2Fhypatia-grid.json)](https://github.com/hyperpolymath/standards/blob/main/docs/VERDICT-GRID-SPEC.adoc)
 The grid grades the worst finding each reporter has (purple critical, red high, yellow medium, blue minor, green clean), with a scanner that did not run in orange and a fleet member not enrolled for this repository in grey; enrolment is in `.gitbot-fleet/enrolment.json`.
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -40,4 +40,5 @@ PRs still require review and passing tests.
 
 A green workflow is not a claim that all security findings are resolved.
 Missing tools, inaccessible GitHub alert APIs, absent fleet report-backs and
-an empty K9 corpus must remain visible as missing or inapplicable evidence.
+unverified K9 L3 signatures must remain visible as missing or inapplicable
+evidence.