Post-carve-out: no Hypatia scanner, membership-integrity expects 5 nonexistent repos, ~730 files fail governance-validation

[hyperpolymath]

The k9-svc carve-out (standards#491) has moved ~1,850 files into this repo across #33 and #34. Three pre-existing conditions here are now load-bearing that were not before. None were caused by the carve-out; all are made materially worse by it.

1. No Hypatia scanner, and no baseline

This repo has no hypatia workflow and no .hypatia-baseline.json (gh api .../contents/.hypatia-baseline.json → 404).

In standards, 18 baseline entries covering the imported files were pruned as part of the removal PR — their targets no longer exist there. Those files now live here, so the tracked debt they represented is not baselined; it is unscanned. Among the pruned entries: bindings/rust/src/parser.rs, lsp/src/{main,diagnostics}.rs, k9-sign/install.sh, six .envrc files.

The debt did not disappear. It stopped being visible.

2. membership-integrity demands five repositories that do not exist

The check fails on every PR with errors of this shape:

membership error: .gitmodules members/implementations/k9-rs url is '', expected 'https://github.com/hyperpolymath/k9-rs.git'
membership error: members/implementations/k9-rs is not a pinned submodule gitlink

Verified live:

expected submodule	repo exists?
hyperpolymath/k9-rs	404
hyperpolymath/k9_ex	404
hyperpolymath/k9_gleam	404
hyperpolymath/k9-deno	404
hyperpolymath/k9-haskell	404

There is also no .gitmodules on main at all. So this check has never passed and cannot pass as written.

This is a genuine architectural fork in the road, and it is an owner decision:

• (a) the repo is a superproject of submodules — then five repos must be minted and the code re-homed into them, and feat: absorb the k9-svc implementation from standards (#491 additive half) #33 landed in the wrong shape; or
• (b) the repo is a monorepo of sibling directories — which is what rs/, ex/, deno/, gleam/, haskell/ actually are today — in which case membership-integrity encodes an abandoned design and should be retired or rewritten.

The carve-out assumed (b). Nothing was verified against (a).

3. governance-validation fails on ~730 imported .a2ml files

##[error]Missing SPDX-License-Identifier in first 10 lines, plus Attestation block found but missing proof/signature/hash fields and Missing required identity field.

Distribution of the validated files, by directory:

123  validate-action/     123  haskell/     123  deno/
112  rs/                  106  pandoc/      106  editors/
 21  gleam/                16  showcase/

These are all #33-imported directories. ⚠️ Note the estate rule in LICENCE-POLICY.adoc A2: an agent may author new files with correct SPDX from birth, but may not relicense or bulk-edit licence headers on existing files. So this is not a job for a blind sweep — it needs an owner ruling on what those files' SPDX should say before anything touches them.

Suggested order

1. Owner rules on (a) vs (b) above — everything else depends on it.
2. If (b): retire or rewrite membership-integrity.
3. Wire a Hypatia workflow + mint a baseline, seeded from the 18 entries pruned in the standards removal PR.
4. Only then decide the SPDX question, under A2.