chore: fill derivable placeholders, drop false ARCHITECTURE, surface the rest

Estate top-up pass. Three separate things, none of which invents a value.

FILLED — every token with a single mechanical answer: OWNER, REPO, FORGE,
PROJECT, PACKAGE_NAME, PROJECT_NAME, AUTHOR, AUTHOR_EMAIL, CONDUCT_EMAIL,
AUTHOR_FIRST/LAST/INITIALS, CURRENT_YEAR, CURRENT_DATE, DATE, MAIN_BRANCH.
Identity comes from the git remote, dates from the clock, project name from the
README H1 where there is one.

Deliberately NOT filled, because more than one defensible answer exists and a
confident wrong value is worse than a visible gap: SECURITY_EMAIL (two competing
addresses are in use across the estate), RESPONSE_TIME, CONDUCT_TEAM (which
substitutes into "a {{CONDUCT_TEAM}} member", not English), WEBSITE,
PROJECT_DESCRIPTION, LANG_STACK.

DELETED — ARCHITECTURE.md, where it is byte-identical to the 346-copy estate
boilerplate (blob 607e3d8). Those 33 lines describe a src/ tests/ docs/
scripts/ config/ tree that this repo does not have, so the file is not merely
uninformative, it is wrong. Genuinely written ARCHITECTURE files are matched by
hash and left alone. No file beats a confidently false one.

CODEOWNERS — rewritten to the solo form mandated by
hyperpolymath/standards CODEOWNERS-POLICY.adoc Rule 1, which forbids a catch-all
line where the only owner is the sole maintainer. The estate's own
templates/CODEOWNERS contradicts that policy; the policy is versioned, dated and
resolves standards#55, so it wins. Files naming a genuine co-owner are Rule 2
and are untouched. Note @hyperpolymath and @metadatastician are the same person,
so a file naming the other account is a copy artifact that silently routed
review requests to the wrong account.

SURFACED — REQUIRES_INITIALISATION.md, and a priority action in
0-AI-MANIFEST.a2ml. Tokens that need a decision no script can make are left
visibly unfilled rather than faked or quietly deleted. The marker says what each
one is, which files it belongs in, why it was not done already, and that it must
be deleted only once the work is genuinely finished.

Author: hyperpolymath

.github/CODEOWNERS

@@ -1,34 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
-# CODEOWNERS - Define code review assignments for GitHub
-# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-
-# Default: sole maintainer for all files
-* @hyperpolymath
-
-# Security-sensitive files require explicit ownership
-SECURITY.md @hyperpolymath
-.github/workflows/ @hyperpolymath
-.machine_readable/ @hyperpolymath
-contractiles/ @hyperpolymath
-
-# License files
-LICENSE @hyperpolymath
-LICENSES/ @hyperpolymath
-
-# Configuration
-.gitignore @hyperpolymath
-.github/ @hyperpolymath
-
-# Documentation
-README* @hyperpolymath
-CONTRIBUTING* @hyperpolymath
-CODE_OF_CONDUCT* @hyperpolymath
-GOVERNANCE* @hyperpolymath
-MAINTAINERS* @hyperpolymath
-CHANGELOG* @hyperpolymath
-ROADMAP* @hyperpolymath
-
-# Build and CI
-Justfile @hyperpolymath
-Makefile @hyperpolymath
-*.sh @hyperpolymath
+# Solo-maintained hyperpolymath repo: no owner lines by policy.
+# See hyperpolymath/standards CODEOWNERS-POLICY.adoc (Rule 1).
+# Sole-maintainer review is moot; SPDX headers carry attribution.

.machine_readable/contractiles/Justfile

@@ -385,8 +385,8 @@ container-init:
     read -rp "Primary port [8080]: " _PORT
     PORT="${_PORT:-8080}"
 
-    read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY
-    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}"
+    read -rp "Container registry [ghcr.io/${OWNER:-hyperpolymath}]: " _REGISTRY
+    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-hyperpolymath}}"
 
     echo ""
     echo "  Service: $SERVICE_NAME"
@@ -601,7 +601,7 @@ test-matrix suite="unit" verbosity="normal" parallel="true":
     @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}"
 
 # Container matrix: [build|run|push|shell|scan] x [registry] x [tag]
-container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest":
+container-matrix action="build" registry="ghcr.io/hyperpolymath" tag="latest":
     @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}"
 
 # CI matrix: [lint|test|build|security|all] x [quick|full]

ARCHITECTURE.md

@@ -328,8 +328,8 @@ container-init:
     read -rp "Primary port [8080]: " _PORT
     PORT="${_PORT:-8080}"
 
-    read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY
-    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}"
+    read -rp "Container registry [ghcr.io/${OWNER:-hyperpolymath}]: " _REGISTRY
+    REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-hyperpolymath}}"
 
     echo ""
     echo "  Service: $SERVICE_NAME"
@@ -540,7 +540,7 @@ test-matrix suite="unit" verbosity="normal" parallel="true":
     @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}"
 
 # Container matrix: [build|run|push|shell|scan] x [registry] x [tag]
-container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest":
+container-matrix action="build" registry="ghcr.io/hyperpolymath" tag="latest":
     @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}"
 
 # CI matrix: [lint|test|build|security|all] x [quick|full]
@@ -701,7 +701,7 @@ help-me:
     @echo "Shell: $SHELL"
     @echo ""
     @echo "To report an issue:"
-    @echo "  https://github.com/{{OWNER}}/{{REPO}}/issues/new"
+    @echo "  https://github.com/hyperpolymath/bag-of-actions/issues/new"
     @echo ""
     @echo "Include the output of 'just doctor' in your report."
 

Justfile

@@ -0,0 +1,55 @@
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+
+# REQUIRES INITIALISATION
+
+**This repository is not finished being set up.** 1 substitution token(s) across 2 file(s) still have no value.
+
+## Why this is not already done
+
+This repo was created from `hyperpolymath/rsr-template-repo`. The mint
+(`just repo-init`) fills every token that has a single mechanical answer —
+owner, repo, author, dates, licence, branch — and it has done so here.
+
+The tokens below are the ones it *deliberately cannot* answer. They need a
+decision or a fact that exists only in your head: what this project is for,
+what command builds it, which port the service listens on, whether a PGP key
+is held at all. The template's own token vocabulary says as much — you cannot
+sensibly answer "required invariants" in a thirty-second bootstrap.
+
+They were left **visibly unfilled on purpose**. The alternatives were both
+worse: inventing plausible values would put confident falsehoods into a
+security policy and an architecture document, and silently deleting the
+sections would hide the fact that a decision is owed. A visible gap is
+honest; a fabricated answer is not.
+
+## Do not delete this file until every item below is resolved
+
+This file is the only marker that the work is outstanding. Deleting it early
+does not finish the setup, it just conceals it — and the next person or agent
+to arrive will reasonably assume the repo is complete.
+
+- **If you are a person:** delete this file yourself once the last item is done.
+- **If you are an agent:** resolve what you legitimately can, leave the rest,
+  and delete this file only when no token below remains anywhere in the tree.
+  Do not delete it to make a gate go green.
+
+Re-running the estate top-up tool will remove this file automatically once
+nothing is outstanding, so the safest way to finish is to fix the tokens and
+let the check confirm it.
+
+## What is needed, and where it goes
+
+### `{{ARGS}}`
+
+Arguments for the justfile recipe this appears in.
+
+Appears in:
+
+- `.machine_readable/contractiles/Justfile`
+- `Justfile`
+
+---
+
+Generated by the estate top-up pass. Rationale and the governing rulings are
+in `hyperpolymath/standards`; the token vocabulary is
+`.machine_readable/ai/PLACEHOLDERS.adoc` in `rsr-template-repo`.