From 1b53b174e6326330e93e11c5a91a6deea2e0c173 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 1 Sep 2026 15:23:14 +0100
Subject: [PATCH 1/2] fix(ci): unbreak must-gates and the Justfile parse
 collision

Two independent defects made the quality-gates workflow structurally
unable to pass on any PR or push:

1. Justfile parse death: 'import? "contractile.just"' merges recipe
   namespaces, and contractile.just:60 already defines trust-verify
   (license/secrets/container aggregate). The root Justfile's
   trust-verify redefinition killed every 'just' invocation at parse
   time, so 'just test-all' never ran a single test in CI. Renamed the
   root recipe to trust-manifest-verify and repointed ci-gate + README.

2. md->adoc rot: all six components renamed SECURITY.md to
   SECURITY.adoc, but run-must-gates.sh still required SECURITY.md
   (x3) and generate-manifest.sh still hashed it, so the must-gates
   job could never go green.

Verified locally end-to-end: run-must-gates.sh prints 'all must gates
passed', verify-manifest.sh exits 0, just --evaluate exits 0, and
'just test-all' passes with zero failures underneath.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Justfile                           | 6 ++++--
 README.adoc                        | 2 +-
 scripts/run-must-gates.sh          | 6 +++---
 scripts/trust/generate-manifest.sh | 2 +-
 4 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/Justfile b/Justfile
index 5eb35b4..56defd6 100644
--- a/Justfile
+++ b/Justfile
@@ -73,7 +73,9 @@ trust-generate:
     ./scripts/trust/generate-manifest.sh
 
 # Verify trust manifests for all components
-trust-verify:
+# (named trust-manifest-verify: contractile.just already defines trust-verify,
+#  and a duplicate recipe name kills every `just` invocation at parse time)
+trust-manifest-verify:
     ./scripts/trust/verify-manifest.sh
 
 # Sign trust manifests (minisign or gpg required)
@@ -85,7 +87,7 @@ trust-rotate:
     ./scripts/trust/rotate-trustfile.sh
 
 # Full CI-equivalent local gate
-ci-gate: must-all trust-verify test-all
+ci-gate: must-all trust-manifest-verify test-all
 
 # Run panic-attacker pre-commit scan
 assail:
diff --git a/README.adoc b/README.adoc
index 9cb3bed..79d26d1 100644
--- a/README.adoc
+++ b/README.adoc
@@ -60,7 +60,7 @@ just build-vext
 just must-all
 just bench-vexometer
 just trust-generate
-just trust-verify
+just trust-manifest-verify
 just test-all
 just ci-gate
 just build-all
diff --git a/scripts/run-must-gates.sh b/scripts/run-must-gates.sh
index 8354a20..16867ad 100755
--- a/scripts/run-must-gates.sh
+++ b/scripts/run-must-gates.sh
@@ -21,17 +21,17 @@ for component in "${components[@]}"; do
   test -f "$mustfile"
   test -f "$component_dir/README.adoc"
   test -f "$component_dir/ROADMAP.adoc"
-  test -f "$component_dir/SECURITY.md"
+  test -f "$component_dir/SECURITY.adoc"
   test -f "$component_dir/contractiles/trust/Trustfile.a2ml"
   test -f "$manifest"
 
-  rg -n "security@|security/advisories/new" "$component_dir/SECURITY.md" >/dev/null
+  rg -n "security@|security/advisories/new" "$component_dir/SECURITY.adoc" >/dev/null
   (cd "$component_dir" && sha256sum -c .trust/trust-manifest.sha256 >/dev/null)
 
   files=(
     "$component_dir/README.adoc"
     "$component_dir/ROADMAP.adoc"
-    "$component_dir/SECURITY.md"
+    "$component_dir/SECURITY.adoc"
   )
 
   if [[ -f "$component_dir/RSR_OUTLINE.adoc" ]]; then
diff --git a/scripts/trust/generate-manifest.sh b/scripts/trust/generate-manifest.sh
index 3d2574c..c942ab0 100755
--- a/scripts/trust/generate-manifest.sh
+++ b/scripts/trust/generate-manifest.sh
@@ -29,7 +29,7 @@ for component in "${components[@]}"; do
   inputs=(
     "README.adoc"
     "ROADMAP.adoc"
-    "SECURITY.md"
+    "SECURITY.adoc"
     "contractiles/must/Mustfile"
     "contractiles/trust/Trustfile.a2ml"
   )

From 9a7d6edfbf458e8351d762b7c213d6f58de017b4 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 1 Sep 2026 15:23:14 +0100
Subject: [PATCH 2/2] chore(trust): regenerate all six stale trust manifests

Every manifest was frozen at generated_at=2026-02-28 with all 42
entries failing (SECURITY.md renamed to .adoc plus stale checksums).
Regenerated with the repo's own scripts/trust/generate-manifest.sh
after the .adoc fix in the previous commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 lazy-eliminator/.trust/trust-manifest.sha256     | 16 ++++++++--------
 satellite-template/.trust/trust-manifest.sha256  | 16 ++++++++--------
 .../.trust/trust-manifest.sha256                 | 16 ++++++++--------
 vexometer/.trust/trust-manifest.sha256           | 16 ++++++++--------
 vext-email-gateway/.trust/trust-manifest.sha256  | 16 ++++++++--------
 vext/.trust/trust-manifest.sha256                | 16 ++++++++--------
 6 files changed, 48 insertions(+), 48 deletions(-)

diff --git a/lazy-eliminator/.trust/trust-manifest.sha256 b/lazy-eliminator/.trust/trust-manifest.sha256
index dfe992b..94678d2 100644
--- a/lazy-eliminator/.trust/trust-manifest.sha256
+++ b/lazy-eliminator/.trust/trust-manifest.sha256
@@ -1,10 +1,10 @@
 # trust-manifest v1
 # component=lazy-eliminator
-# generated_at=2026-02-28T12:04:27Z
-3b8fad7f7498e8a6c181a31103d8b2874819c8ef084ca084e19a3f4f78d4cd2c  README.adoc
-d6b8fac6dbc900613d4b057a60fae06aebb231ba5eab4df3621fc9fca84bc59d  ROADMAP.adoc
-e2d71893a4d97bf9d80c28de79b6711f62c1111c8f689b318db424356f30cee1  SECURITY.md
-2fa5078b7dea0cb7eddff51f004c466b5f65e02c3239e6ebcc41206bd7f66736  contractiles/must/Mustfile
-75ced95c129eae454ab4004ef74f1440d9b889b80f23a8817fb1d0e67309cf7a  contractiles/trust/Trustfile.a2ml
-88b0c15e6d195902016025f702e63af995cb28c4332902efc29cb72fb0c46846  RSR_OUTLINE.adoc
-3168779c30423a3deeace9ca926028b2752a3873739c62016b64608cf935a6cb  docs/CITATIONS.adoc
+# generated_at=2026-09-01T14:22:53Z
+339d25795fa89149354d4101c533492f0e5bbe39fc953ac02be17a225f2fd270  README.adoc
+6772e621da4e50257728886f568bd652b8e9c58a02aec325112e57def73da46a  ROADMAP.adoc
+504199ed09a9acbd183fe9c37a8330ec254f33f5612e0f36f2f5e7be170a57ff  SECURITY.adoc
+530ba7ca220c8eaee794a163672469e9733dd8cb97c5bd6311d5ca15a3685e99  contractiles/must/Mustfile
+7160652fb94fa8d7eab9e4f4824f05c09d94ab9c53976929537d8811d339a3a0  contractiles/trust/Trustfile.a2ml
+50540c1ae91c38110cdf41195578865cdef278838be38f11d2fa108ecc1d60e7  RSR_OUTLINE.adoc
+2eb1dac8104669453d9cd1b2df7faf2ba20f6ca184300b4a936d560622471621  docs/CITATIONS.adoc
diff --git a/satellite-template/.trust/trust-manifest.sha256 b/satellite-template/.trust/trust-manifest.sha256
index a6aab4e..27fe34e 100644
--- a/satellite-template/.trust/trust-manifest.sha256
+++ b/satellite-template/.trust/trust-manifest.sha256
@@ -1,10 +1,10 @@
 # trust-manifest v1
 # component=satellite-template
-# generated_at=2026-02-28T12:04:27Z
-ac3496cf7ea8d0361967b03bb48e2b75298cd3087f5bd2e8c636d363dd79b4ae  README.adoc
-165f3686ef9f24fe24b5093c2def812c5bec3e0edd30cf758509145f413de93b  ROADMAP.adoc
-7040d5de9d9fbaa7d3319c10dc546e32c69b2dee66c702ad01c196df55b6ac06  SECURITY.md
-5252195ad39601e613ba3638c20ba0ad19bf0d545e855a18a2653d62e1e2e24d  contractiles/must/Mustfile
-fdded8ed9d5aee991ef2c5ab4ba9044564dbdd85d32a1478d45db6a35e5672ef  contractiles/trust/Trustfile.a2ml
-e6c29a99d1225f6437395abdf193949624c20516b2115215c7ef929ec6be649b  RSR_OUTLINE.adoc
-67068babc6554ea4c26dd85c6449b17fcb43b63ee068444b05e29bf6cd7b9c5c  docs/CITATIONS.adoc
+# generated_at=2026-09-01T14:22:53Z
+e90437cd512f3ac6824b42e733394bc69dfa4bcab046d779842bc876e11f870e  README.adoc
+5a62f5611eecfafa43d931b4d7e0917fa1b0f0275fdfd74c61415ab635e72805  ROADMAP.adoc
+38ccfdc1a04c12616acfb030522358383702184480f52507a5f72fccccbe76b9  SECURITY.adoc
+4f54a64f50a9dddbf221f2cdbd813de81dfe7fdc8f2294e41d97289519779b0e  contractiles/must/Mustfile
+22c57f0f73d846a48cf15c6914bbdf468380fe8a37b26985932d194da34a3bf7  contractiles/trust/Trustfile.a2ml
+42af19ba9672876f46f7344251ce8576212e072b18390fdd3aa676a1ba68dc42  RSR_OUTLINE.adoc
+6632bebb331345982388dad27ee07542e9a7ebe4d60cb4792f4e30a041928049  docs/CITATIONS.adoc
diff --git a/vexometer-satellites/.trust/trust-manifest.sha256 b/vexometer-satellites/.trust/trust-manifest.sha256
index acf42b0..756baea 100644
--- a/vexometer-satellites/.trust/trust-manifest.sha256
+++ b/vexometer-satellites/.trust/trust-manifest.sha256
@@ -1,10 +1,10 @@
 # trust-manifest v1
 # component=vexometer-satellites
-# generated_at=2026-02-28T12:04:27Z
-41c865b627f0ec6969449a34f61e3b7b2256485b6d143210dc36fb7e6981781f  README.adoc
-dd255956f022784f7582c2ff203b6716074a4b0e39f6ab0f863ff19b8c3cef42  ROADMAP.adoc
-a2cdd7866b149367b64256d410d379ef2c8baeec5cb0c4f398fb4325f8906a1e  SECURITY.md
-d6946fc22c5f6f3d1cbe5c6b0c3a6d6ce24493e839c4d3b9a22e6059a64b5e7b  contractiles/must/Mustfile
-10c8d62b79fb30aeca7d57914b0ab6c14497a9365bbc7f9c79a697553d206d56  contractiles/trust/Trustfile.a2ml
-64f5225513bbe79096b6389e1525e192c591d0733150ebca2054c6bd2258db00  RSR_OUTLINE.adoc
-a665330bee0288a8fd228a8bf59c399b202eb96849985ede37cfcaf32dcf8ba9  docs/CITATIONS.adoc
+# generated_at=2026-09-01T14:22:53Z
+98d61be30094cc5832901ad0ee4c6c443dfe5ff73ca9b9dc5cc2aa0491a12fc9  README.adoc
+1aa88e3ef6646aeb9209093c8719198e7d8101773ae02c270664bfc1e299c0a0  ROADMAP.adoc
+1e36494d91d91559cdf1b4937173e14342e00291319ab1ccb75ce56410978fb8  SECURITY.adoc
+d1f96168c1500cdd3a753ce8e31af5b7cdcb21d6474e2956b7c6f6d31f020d41  contractiles/must/Mustfile
+c431753af3d9ada759b3b89b7f34ff83cc1f27478e0bdefd9608c69d8dc83526  contractiles/trust/Trustfile.a2ml
+b7d81cab79159aa4d8dc3b375e4aca7b45ef3130d374b4234f5f6d2ce89e9667  RSR_OUTLINE.adoc
+2c910784857765919315fbb9a580e974cf5d0e6d3fff3c0187bd764ba799df6a  docs/CITATIONS.adoc
diff --git a/vexometer/.trust/trust-manifest.sha256 b/vexometer/.trust/trust-manifest.sha256
index 0c0ac51..d52aeee 100644
--- a/vexometer/.trust/trust-manifest.sha256
+++ b/vexometer/.trust/trust-manifest.sha256
@@ -1,10 +1,10 @@
 # trust-manifest v1
 # component=vexometer
-# generated_at=2026-02-28T12:04:27Z
-68003e4942c67225689352bee9d356b7e0b3b273c3cbfc59136c04c2e2c110b3  README.adoc
-a9f502358da9f95e1f20d6c3eb73257cd02be8213ff475cd3dd8d4dc16db1b78  ROADMAP.adoc
-4cb6b1c0f826e1744622b87d0a53929136e3c03469f68790694f757470bba008  SECURITY.md
-16b90fc5e2b3864387a8b2cad593a7fcbc53565d8111772fd16e0c51d5c22e2c  contractiles/must/Mustfile
-3d799a2f3c1753039eb6a60ed84eee21c1312ac97e17a9952cf409a0c3c2b832  contractiles/trust/Trustfile.a2ml
-621b7fdbdc48f41c90504524869202e0125222d2430cf7b5a89ac136cc38bc89  RSR_OUTLINE.adoc
-aed11c30533d2149ec5e8042acea588cd92d8487befd5caecee5181b977e1cef  docs/CITATIONS.adoc
+# generated_at=2026-09-01T14:22:52Z
+33d01034c9291410bad3c4ad057d92b031a7601fbe58cb98c382efd51d65639e  README.adoc
+730ed75dec35cb49730d2fb2e472f3e7752644ce7ccadee6b377e6b6c8cdda70  ROADMAP.adoc
+f4358bff9ed297a634d7cef1d5efcc059de238d3bf6a73abd11f9e7910785d61  SECURITY.adoc
+29db6e0287244a2668bc3a143c8b81a54a9ae762b98cd9683ee4c7b203a1cb8e  contractiles/must/Mustfile
+5f5e879cc11595c1f4228c41f3bbde5177584316d60f695211b7812b8de0565e  contractiles/trust/Trustfile.a2ml
+3d4f9ee78b526a6a417bf0cd51a32ff8e156279a80e31ade369161b3a5136844  RSR_OUTLINE.adoc
+2db573d850fc0c599b20d290a0e6cade9854bf0b3bcd76d8d9322b07f77ad6f8  docs/CITATIONS.adoc
diff --git a/vext-email-gateway/.trust/trust-manifest.sha256 b/vext-email-gateway/.trust/trust-manifest.sha256
index 2633134..f55262c 100644
--- a/vext-email-gateway/.trust/trust-manifest.sha256
+++ b/vext-email-gateway/.trust/trust-manifest.sha256
@@ -1,10 +1,10 @@
 # trust-manifest v1
 # component=vext-email-gateway
-# generated_at=2026-02-28T12:04:27Z
-42a8ecf678af0a843951abaf578701c3c4d63b921efccfc5ad5c05fd45d9a130  README.adoc
-cb5071ddba9ec3d23f4023cc0d3a2d0db695f7647035ba9d80fd114506948ce9  ROADMAP.adoc
-4a1c42c39d76199d1f1126d4de83b35fd0e0fadbee3e939d857c7410d4ce7c59  SECURITY.md
-f45c079bf6d69d63b6f2f650102d5c5d672ba2c644228be7c4b425ae9b3387a3  contractiles/must/Mustfile
-ec6317f4b5e8ebf54f2b6dc3bd77409c9c509b679d8ffaf092618e705a0a82d8  contractiles/trust/Trustfile.a2ml
-f3d8bb41f63a88a383028c9bd6d80be1a843905dfa7ca169f6f8e6190d788f73  RSR_OUTLINE.adoc
-3944e4c6756a3f72873cefbc146ae847c6ccf9f9bcb4d168bf38255e07d9065b  docs/CITATIONS.adoc
+# generated_at=2026-09-01T14:22:52Z
+0a89e3a89fa118fcb5833e485500900299bb5abce8955c25ab05e249a952ddf8  README.adoc
+7d719f633a950e111d76d0d8cc297cc18704a858a3cb40900adce7456362e283  ROADMAP.adoc
+1dea9d1375b2dfe806d795edef96d4e4e5465234ddb523c448033eea49ff0d91  SECURITY.adoc
+cf2c0a7507d11c87a441bb0fe6d42679640a6fb351c576405c71135d9c7d103c  contractiles/must/Mustfile
+37dd1771e66bfd80abb4b8af93d118f58bfe88d3cdb6da9bcc7f2eeab8e5174e  contractiles/trust/Trustfile.a2ml
+10e55df8662170ec24344ebe3193b46ca723278567cec1be76d784d73bfbaf99  RSR_OUTLINE.adoc
+46962d07275f8323676c4fcd8179220e70267d274e2f3261125431d5f1eea511  docs/CITATIONS.adoc
diff --git a/vext/.trust/trust-manifest.sha256 b/vext/.trust/trust-manifest.sha256
index 9024959..bba5305 100644
--- a/vext/.trust/trust-manifest.sha256
+++ b/vext/.trust/trust-manifest.sha256
@@ -1,10 +1,10 @@
 # trust-manifest v1
 # component=vext
-# generated_at=2026-02-28T12:04:27Z
-a56f374e7075c27def4fded35207b07af400c61ddd5fbf0e92793b80bd046b2c  README.adoc
-790fd6b69ba9d9622f8903bd9dd3c430fa4e96cd0b2ac34eba38a1c38afbcf56  ROADMAP.adoc
-7c8bc3111109b1d64a544dee8a37d8f17081bab30b8ebf1cf2b1ddd429340237  SECURITY.md
-d3f64ccea0d8df2d24010c93c427d53587be3b8a519df939b1440913de04e5b6  contractiles/must/Mustfile
-34dad29f8b4738fc99e0cbfd0226ef6981cc35fe73e27e44c325c98f0d3457c1  contractiles/trust/Trustfile.a2ml
-6eb0f220728c2441d12de897edaa55b1400423a40af2d057f393e0b91f2c8ba1  RSR_OUTLINE.adoc
-6541c29e32e42fe09f8249f0b97621fa30f73c0bae318646d557e2cac86ffd74  docs/CITATIONS.adoc
+# generated_at=2026-09-01T14:22:52Z
+2e36c7c5522a306c38b5a69246abe25a6662963085ae68c8a70f9a7736412383  README.adoc
+59afd091f80638f64eb4028cea7252b8e1030165e4e826059e5a05940c092daa  ROADMAP.adoc
+ddfd1260b0c4a0cf3c812fb8278892a7ea3c784cde40aeff1b34529d1bade9ca  SECURITY.adoc
+309e397802d6c9ba2548576f6bd999b6803eb6f1127b4671f955eeb356d480c7  contractiles/must/Mustfile
+64dac543db4768b1425b68762ae4b02501dab7b03c0e87ad153ee7a237420b66  contractiles/trust/Trustfile.a2ml
+d9c9872426ee285c6c9ecf80bdcddbd109272a67b28ddfc43710c7dbae753a66  RSR_OUTLINE.adoc
+41d7687263da0fb50258cf32e90397156b0e0cb2cea43eebf47bba8ae16dcd21  docs/CITATIONS.adoc