fix: repair contractiles templates and add root Dustfile

- Fix SPDX typo PLMP-1.0-or-later → PMPL-1.0-or-later in
  contractiles/dust/Dustfile, contractiles/lust/Intentfile,
  contractiles/must/Mustfile
- Replace domain-specific template residue in Dustfile (kubectl/log-replay/
  dustify) with generic rollback/deprecation starter content
- Replace deployment-domain content in lust/Intentfile (trust-engine/
  control-plane/introspection) with generic project-agnostic future intents
- Update must/Mustfile template with proper REPLACE placeholders, realistic
  checks (tests-pass, format-ok, spdx-headers, no-template-residue), and
  note that failing tests block grade D
- Add root-level Dustfile for the standards repo itself (was missing; root
  Mustfile existed but Dustfile did not)
- Regenerate contractile.just from current A2ML sources via
  contractile gen-just --dir contractiles (now reflects Intentfile.a2ml,
  Trustfile.a2ml, and K9 components; plain Dustfile/Mustfile templates
  don't generate recipes as they are not A2ML format)
- Add k9-coordination-protocol/ — reference implementation for the Testing
  and Benchmarking Taxonomy (79 tests, CRG grade C)
- Extend TESTING-TAXONOMY.adoc with Appendix C documenting the reference
  implementation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

Dustfile

@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Dustfile — Standards repo recovery and rollback
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+
+version: 1
+
+recovery:
+  source:
+    - name: source-rollback
+      description: "Revert all source changes to the last commit."
+      rollback: "git checkout HEAD -- ."
+      notes: "Use when a bad spec or template edit lands before review."
+
+  generated:
+    - name: regen-contractile-just
+      description: "Re-derive contractile.just from the contractiles/ template set."
+      handler: "contractile gen-just --dir contractiles"
+      notes: "Regenerate after any change to Dustfile, Mustfile, Trustfile.a2ml, or Intentfile.a2ml."
+
+  templates:
+    - name: template-rollback
+      description: "Roll back a specific contractile template to its last known-good revision."
+      rollback: "git checkout HEAD~1 -- contractiles/"
+      notes: "Use when a template update introduces an SPDX typo or template residue regression."
+
+deprecation:
+  - name: lust-intentfile-legacy
+    what: "contractiles/lust/Intentfile (plain-text compatibility form)"
+    since: "v1.0.0"
+    remove-by: "v2.0.0"
+    migration: "Use contractiles/intend/Intentfile.a2ml (canonical A2ML form) for all new repos."
+    notes: "lust/ is kept only while repos that copied the old template still exist in the estate."

contractile.just

@@ -4,60 +4,27 @@
 #
 # SPDX-License-Identifier: PMPL-1.0-or-later
 
-# === DUST (Recovery & Rollback) ===
-# Source: Dustfile.a2ml
-
-# List available dust recovery actions
-dust-status:
-    @echo '  dust-source-rollback: Revert all source changes to last commit [rollback]'
-
-# Revert all source changes to last commit
-dust-source-rollback:
-    @echo 'Executing rollback for source-rollback'
-    git checkout HEAD -- .
-
-
 # === INTEND (Declared Future Intent) ===
 # Source: Intentfile.a2ml
 
 # Display declared future intents
 intend-list:
     @echo '=== Declared Intent ==='
     @echo ''
-    @echo 'Features:'
+    @echo 'Purpose:'
     @echo ''
-    @echo 'Quality:'
-
-
-# === MUST (Physical State Checks) ===
-# Source: Mustfile.a2ml
-
-# Run all must checks
-must-check: must-license-present must-readme-present must-spdx-headers must-no-banned-files
-    @echo 'All must checks passed'
-
-# LICENSE file must exist
-must-license-present:
-    test -f LICENSE
-
-# README must exist
-must-readme-present:
-    test -f README.adoc || test -f README.md
-
-# Source files should have SPDX license headers
-must-spdx-headers:
-    find . -name '*.rs' -o -name '*.res' -o -name '*.gleam' | head -20 | xargs -r grep -L 'SPDX-License-Identifier' | wc -l | grep -q '^0$'
-
-# No Dockerfiles or Makefiles
-must-no-banned-files:
-    test ! -f Dockerfile && test ! -f Makefile
+    @echo 'Anti-Purpose:'
+    @echo '  - A fork or wrapper around another tool'
+    @echo '  - A monorepo (unless explicitly structured as one)'
+    @echo ''
+    @echo 'If In Doubt:'
 
 
 # === TRUST (Integrity & Provenance Verification) ===
 # Source: Trustfile.a2ml
 
 # Run all trust verifications
-trust-verify: trust-license-content trust-no-secrets-committed trust-container-images-pinned
+trust-verify: trust-license-content trust-no-secrets-committed
     @echo 'All trust verifications passed'
 
 # LICENSE contains expected SPDX identifier
@@ -68,8 +35,30 @@ trust-license-content:
 trust-no-secrets-committed:
     test ! -f .env && test ! -f credentials.json && test ! -f .env.local
 
-# Containerfile base images use pinned digests
-trust-container-images-pinned:
-    test ! -f Containerfile || grep -q '@sha256:' Containerfile
 
+# === K9 Components ===
+
+# K9 component: contractiles/k9/examples/ci-config.k9.ncl
+k9-ci-config:
+    contractile k9 run contractiles/k9/examples/ci-config.k9.ncl
+
+# K9 component: contractiles/k9/examples/project-metadata.k9.ncl
+k9-project-metadata:
+    contractile k9 run contractiles/k9/examples/project-metadata.k9.ncl
+
+# K9 component: contractiles/k9/examples/setup-repo.k9.ncl
+k9-setup-repo:
+    contractile k9 run contractiles/k9/examples/setup-repo.k9.ncl
+
+# K9 component: contractiles/k9/template-hunt.k9.ncl
+k9-template-hunt:
+    contractile k9 run contractiles/k9/template-hunt.k9.ncl
+
+# K9 component: contractiles/k9/template-kennel.k9.ncl
+k9-template-kennel:
+    contractile k9 run contractiles/k9/template-kennel.k9.ncl
+
+# K9 component: contractiles/k9/template-yard.k9.ncl
+k9-template-yard:
+    contractile k9 run contractiles/k9/template-yard.k9.ncl
 

contractiles/dust/Dustfile

@@ -1,29 +1,33 @@
-# SPDX-License-Identifier: PLMP-1.0-or-later
-# Dustfile template - recovery and rollback semantics
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Dustfile — recovery, rollback, and deprecation semantics (template)
+# Fill in: replace placeholder paths and commands with real repo paths.
+# See: standards/contractiles/CANONICAL-TEMPLATES.adoc
 
 version: 1
 
 recovery:
-  logs:
-    - name: decision-log
-      path: logs/decisions.json
-      reversible: true
-      handler: "log-replay --reverse logs/decisions.json"
+  source:
+    - name: source-rollback
+      description: "Revert all source changes to the last commit."
+      rollback: "git checkout HEAD -- ."
+      notes: "Use when a bad patch lands and local tests break before merge."
 
-  policy:
-    - name: policy-rollback
-      path: policy/policy.ncl
-      rollback: "git checkout HEAD~1 -- policy/policy.ncl"
-      notes: "Rollback policy to the previous known-good revision."
+  generated:
+    - name: regen-outputs
+      description: "Re-derive all generated artefacts (headers, bindings, machine-readable outputs) from source of truth."
+      handler: "just gen"
+      notes: "Covers auto-generated C headers, A2ML outputs, and any derived files."
 
-  gateway:
-    - name: bad-deployment
-      event: "deploy.failure"
-      undo: "kubectl rollout undo deployment/gateway"
-      notes: "Undo a failed deployment while preserving audit logs."
+  config:
+    - name: config-rollback
+      path: "REPLACE-WITH-REAL-CONFIG-PATH"
+      rollback: "git checkout HEAD~1 -- REPLACE-WITH-REAL-CONFIG-PATH"
+      notes: "Roll back a specific config or policy file without disturbing the rest of the tree."
 
-  dust-events:
-    - name: decision-log-to-dust
-      source: logs/decisions.json
-      transform: "dustify --input logs/decisions.json --output logs/dust-events.json"
-      notes: "Map gateway decision logs into reversible dust events."
+deprecation:
+  - name: example-deprecated-surface
+    what: "REPLACE with the real API, module, or command being retired."
+    since: "vX.Y.Z"
+    remove-by: "vX+1.0.0"
+    migration: "See ROADMAP.adoc or CHANGELOG for the replacement."
+    notes: "Remove this entry once the deprecated surface is gone and the remove-by version ships."

contractiles/lust/Intentfile

@@ -1,21 +1,25 @@
-# SPDX-License-Identifier: PLMP-1.0-or-later
-# Intentfile template - declared future intent
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Intentfile (plain-text compatibility form) — declared future intent (template)
+# Fill in: replace each section with real near-term plans for THIS repo.
+# Prefer the A2ML form (contractiles/intend/Intentfile.a2ml) for new repos.
+# See: standards/contractiles/CANONICAL-TEMPLATES.adoc
 
 version: 1
 
 future:
-  trust-engine:
-    - "Integrate hardware-backed key management."
-    - "Support node attestation for deployments."
+  features:
+    - "REPLACE with specific planned features — be concrete, not aspirational."
+    - "Each entry should map to a real roadmap item or tracked issue."
 
-  control-plane:
-    - "Move to GitOps-backed configuration promotion."
-    - "Add canary and staged rollout support."
+  quality:
+    - "Increase test coverage to cover all public-facing surfaces."
+    - "Ensure all justfile recipes pass in CI without manual intervention."
+    - "All declared tests and benches must pass before grade D can be claimed."
 
-  pipeline:
-    - "Adopt Nickel (or your DSL) as the primary policy language."
-    - "Automate policy promotion from dev to prod with signed artifacts."
+  documentation:
+    - "Annotate all public modules: purpose, boundary, and invariants per directory."
+    - "Ensure EXPLAINME.adoc is present and accurately describes the scope."
+    - "Remove all template residue — no placeholder content should survive into production."
 
-  introspection:
-    - "Expose decision latency and policy evaluation metrics."
-    - "Add tracing for end-to-end request decisions."
+  deprecations:
+    - "REPLACE with real planned removals: what is being retired, since when, and by when."

contractiles/must/Mustfile

@@ -1,35 +1,37 @@
-# SPDX-License-Identifier: PLMP-1.0-or-later
-# Mustfile - declarative state contract (template)
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Mustfile — declarative state contract (template)
+# Fill in: replace placeholder checks with real invariants for THIS repo.
 # See: https://github.com/hyperpolymath/mustfile
+# See: standards/contractiles/CANONICAL-TEMPLATES.adoc
 
 version: 1
 
 metadata:
-  name: project-state-contract
-  spec: v0.0.1
-  description: "Invariant checks for config, policy, gateway, logs, and schema."
-
-parameters:
-  gateway_port: "8080"
-  schema_version: "v0.0.1"
+  name: "REPLACE-WITH-REPO-NAME"
+  spec: v1.0.0
+  description: "REPLACE with a real description of what this contract guards."
 
 checks:
-  - name: config-valid
-    description: "config/service.yaml must be valid."
-    run: "yq -e '.' config/service.yaml >/dev/null"
+  - name: tests-pass
+    description: "All declared tests must pass. Failing tests block grade D."
+    run: "just test"
+
+  - name: format-ok
+    description: "Source must be correctly formatted per repo style."
+    run: "just fmt"
 
-  - name: policy-compiles
-    description: "policy/policy.ncl must compile."
-    run: "nickel check policy/policy.ncl"
+  - name: license-present
+    description: "LICENSE file must exist."
+    run: "test -f LICENSE"
 
-  - name: gateway-exposes-port
-    description: "Service must expose the configured port."
-    run: "bash -uc 'ss -lnt | rg \":${GATEWAY_PORT:-8080}\"'"
+  - name: readme-present
+    description: "README.adoc (or README.md) must exist."
+    run: "test -f README.adoc || test -f README.md"
 
-  - name: logs-are-json
-    description: "Logs must be JSON."
-    run: "bash -uc 'rg --files -g \"*.json\" logs | xargs -r jq -e .'"
+  - name: spdx-headers-present
+    description: "Source files must carry SPDX-License-Identifier headers."
+    run: "bash -uc '! rg --files . | xargs -r grep -rL SPDX-License-Identifier | rg -v \".gitkeep|.lock|LICENSE|NOTICE\" | head -1 | rg .'"
 
-  - name: schema-version-matches
-    description: "Schema must match version spec."
-    run: "bash -uc 'rg -n \"${SCHEMA_VERSION:-v0.0.1}\" schema'"
+  - name: no-template-residue
+    description: "No placeholder text from the contractiles template must remain."
+    run: "bash -uc '! rg -rn \"REPLACE-WITH|PLMP-1.0-or-later\" --type-not binary . | rg .'"