feat(cartridges): canonicalise BoJ cartridge format in standards/

[hyperpolymath]

Summary

Adds the canonical cartridge format specification + JSON schema as a new top-level standards/cartridges/ directory, plus ADR-002 ratifying standards as the canonical home with boj-server's local schema becoming a SHA-pinned mirror.

This is the foundational PR for an estate-wide initiative to (1) extract the 125 cartridges currently bundled in boj-server/cartridges/ into a new hyperpolymath/boj-server-cartridges repo with on-demand fetch, and (2) expand cartridge coverage beyond MCP into LSP/DAP/BSP/Format/Lint/Build/NeSy/Agentic/Fleet roles (using polystack's archived LSP code as the seed for the LSP halves).

Files

• standards/cartridges/CARTRIDGE-FORMAT.adoc — prose spec
• standards/cartridges/cartridge-v1.json — JSON Schema (canonical URL https://hyperpolymath.dev/standards/cartridges/cartridge-v1.json)
• standards/cartridges/0.2-AI-MANIFEST.a2ml — directory manifest
• standards/docs/decisions/ADR-002-cartridge-format-canonical-home.adoc — decision record

Key schema changes vs prior boj-server schema

• Drops the -mcp-only name restriction. Cartridges may end in any canonical role suffix: (mcp|lsp|dap|bsp|debug|format|lint|build|nesy|agentic|fleet).
• Adds required category (domain | cross-cutting | template).
• Adds optional states (per panll v0.3.0) and source (registry + path + sha256).
• Absorbs panll/src/abi/cartridge-schema.json v0.3.0's broader protocol set.

Companion / follow-up PRs (this session)

• boj-server: replace its local schema with SHA-pinned mirror + add category field to 125 cartridges (mechanical sweep)
• Create hyperpolymath/boj-server-cartridges repo + populate with copies (PR 2 in plan)
• Cartridge minter tool (PR 3)
• Catalog refactor for on-demand fetch (PR 4)
• boj-server: remove cartridges/ dir (PR 5)
• polystack 12 LSP halves → new cartridges (PR 6)
• fleet-mcp redesign from poly-orchestrator-lsp (PR 7)

Test plan

• Schema is self-consistent JSON
• All commit GPG-signed
• CI green
• No code paths consume this spec yet; additive only

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 118 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence