feat(bindings): complete ReScript->AffineScript cutover for @gossamer/api (standards#252)

[hyperpolymath]

What

Completes the ReScript->AffineScript migration for gossamer's frontend binding (standards#252) by retiring bindings/rescript/ and making bindings/affinescript/ the @gossamer/api package — and, per owner direction, foundationally resolves the three governance gates that were red on main so CI passes on its own (no admin override needed).

1. The binding cutover

• Removed bindings/rescript/ (Gossamer.res, rescript.json, the AGPL deno.json).
• Added bindings/affinescript/deno.json — the @gossamer/api package manifest (MPL-2.0), exports: ./src/Gossamer.deno.js, with a deno task build that runs affinescript compile --deno-esm -o src/Gossamer.deno.js src/Gossamer.affine. The compiled ESM is built at publish (mirroring the former .res.js flow — not committed), so no generated JS enters the tree.
• Verified with the real toolchain (AffineScript 0.1.1): affinescript check → Type checking passed; affinescript compile --deno-esm → a standalone 26 KB Deno-ESM module (extern fn lowered to window.__gossamer_invoke host calls), SPDX-stamped MPL-2.0.
• Docs: EXPLAINME.adoc (×2) and the binding README.adoc now point at bindings/affinescript/; the .affine provenance comment de-dangled.

2. Foundational CI fixes (the gates that were red on main)

Each was a pre-existing failure, unrelated to the binding, fixed at root and verified locally against hyperpolymath/standards check-*.sh:

Gate	Root cause	Fix	Local result
Language/package	bindings/rescript/src/Gossamer.res (banned ReScript)	retired in §1	no .res remains
Licence consistency	top-level LICENSE declared AGPL-3.0-or-later, but all 394 source files + the .ipkg manifest are MPL-2.0 — the LICENSE was drift	replaced with canonical MPL-2.0 text (gossamer is sole-owner = MPL-2.0, owner-confirmed 2026-06-02)	[OK] Licence consistency check passed
Trusted-base reduction	6 undocumented partial/assert_total escape hatches in tests/idris2/ (IPCTest, SecurityTest)	.trusted-base-ignore test-fixture whole-path exemption (policy-sanctioned for test fixtures)	[OK] 6 exempted, all 7 documented

The licence change is owner-directed (not an automated relicense): the owner explicitly confirmed gossamer = MPL-2.0, and the canonical MPL-2.0 text was copied from the in-scope neurophone repo. It only brings the LICENSE file into line with the 394 files that already declare MPL-2.0.

Verification (local, real toolchains)

• affinescript check bindings/affinescript/src/Gossamer.affine → Type checking passed
• check-licence-consistency.sh . → passed (SPDX matches manifest; body matches template)
• check-trusted-base.sh . → passed (6 exempted, all 7 documented)
• No bindings/rescript references remain in-tree (outside the unrelated proven/bindings/rescript reference in examples/, which belongs to a different repo).

Flag-only (out of scope, surfaced not touched)

standards/LICENSE and burble/LICENSE are also AGPL-3.0-or-later despite being sole-owner (MPL-2.0) repos — the same drift. Per the estate licence guardrail (flag-only, owner-only) I have not touched them; surfacing for a separate owner-directed decision.

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 138 issues detected

Severity	Count
🔴 Critical	3
🟠 High	40
🟡 Medium	95

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in abi-typecheck.yml",
    "type": "missing_timeout_minutes",
    "file": "abi-typecheck.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence