docs(nix-retirement): closure report + machine-readable record (#102 #103)

[hyperpolymath]

Refs standards#101 standards#102 standards#103.

Companion to the Wave-0 inventory worklist (spec/nix-retirement-inventory.adoc). The wave-time per-repo flake.nix vs (Guix manifest ∪ sealed-container) diff is now complete across Waves 1–14, and this PR adds the closure documentation that the owner can use to close the campaign issues.

What lands

• rhodium-standard-repositories/spec/nix-retirement-closure.adoc — human-readable closure report: aggregate result, REMOVE table, KEEP+DEP rule-3 annotations, over-called-REMOVE corrections, per-issue closure recommendations, scaffold-stub remediation pivot, verification discipline.
• .machine_readable/6a2/NIX-RETIREMENT.a2ml — structured record of the same, suitable for machine consumers / future agents.

Aggregate

outcome	count
pure-mirror → REMOVE (verified, PR'd)	1 (hyperpolymath/hypatia#289)
load-bearing → KEEP+DEP (rule-3 annotated, PR'd)	10 (007#12, boj-server#83, cyo#3, echidnabot#13, file-soup#37, game-server-admin#16, project-wharf#30, proof-of-work#61, tma-mark2#26, ubicity#54)
scaffold-stub guix.scm → KEEP+FLAG	~270
over-called REMOVE → demoted on verification	2 (proof-of-work, tma-mark2)

Pivot

The actual remaining estate-wide debt is scaffold-stub guix.scm, not Nix-mirror retirement. Recommend a separate tracker covering the ~270 KEEP+FLAG repos (populate / delete-both / convert-to-.guix-channel-only). Do NOT subsume under #102 — different gate, different ergonomics.

Closures (owner action)

The closure doc and the .a2ml carry a per-issue closure-recommendations table for #102, #103, and #106–#119. Per ISSUE-CLOSURE: bots do not self-close — this PR is Refs, never Closes.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 101 issues detected

Severity	Count
🔴 Critical	63
🟠 High	28
🟡 Medium	10

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence