docs: cartridge scaffolder + Phase 2b session (humans + machines)

[hyperpolymath]

Summary

Documents the 2026-05-20 session that shipped the cartridge scaffolder (standards#89 Phase 2b). Two parallel surfaces — humans and machines — so both onboarding readers and automation tooling stay current.

Humans

• README.adoc — new cartridge row in the Iseriser CLI subcommands table (next to generate / abi-verify / abi-emit-manifest), plus a paragraph cross-referencing standards#89 (Phase 2b) and standards#91 (the gating dependency for estate-wide fan-out).
• CHANGELOG.adoc and CHANGELOG.md — 2026-05-20 entries under [Unreleased] covering this session's PRs:
  • Added: PR feat(cartridge): scaffolder for boj-server cartridge skeletons (standards#89 Phase 2b) #24 (cartridge scaffolder, 13 files, ADR-0006 + transaction gate + 4-protocol adapter, end-to-end verified).
  • Changed: PR revert(scaffold): drop wrong-place adapter emission (standards#90) #23 (revert wrong-place adapter emission added in feat(scaffold): add unified-gated-adapter + SSE + *-regen.yml (standards#89 sub-issue 1) #12) + PR fix(cartridge): emit depends = base, contrib to match pilot convention #25 (depends = base, contrib correction).

Machines

• .machine_readable/6a2/STATE.a2ml:
  • last-updated: 2026-04-04 → 2026-05-20
  • phase: phase-1-complete → phase-2b-complete
  • maturity: experimental → alpha
  • completion-percentage: 48 → 62
  • New [capabilities] block enumerating the 8 shipped CLI subcommands
  • New [recent-prs] block listing this session's three PRs
  • [route-to-mvp], [blockers-and-issues], [critical-next-actions] refreshed to current truth

Net diff

 .machine_readable/6a2/STATE.a2ml | 38 +++++++++++++++++++++++---
 CHANGELOG.adoc                   |  8 ++++++
 CHANGELOG.md                     |  9 ++++++
 README.adoc                      | 13 ++++++++-
 4 files changed, 64 insertions(+), 13 deletions(-)

Verification

• cargo build clean (docs-only change but checked)
• cargo test: 57 unit + 9 integration green

Refs hyperpolymath/standards#89, #90

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 20 issues detected

Severity	Count
🔴 Critical	2
🟠 High	5
🟡 Medium	13

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/upload-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/download-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
    "type": "codeql_language_matrix_mismatch",
    "file": "codeql.yml",
    "action": "switch_codeql_matrix_to_actions",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/iseriser/iseriser/src/abi/zig_ffi_parser.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/iseriser/iseriser/src/abi/idris_emitter.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (13 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/iseriser/iseriser/src/codegen/cartridge.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (3 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/iseriser/iseriser/src/codegen/scaffold.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence