k9: deploy template render, Hunt capability grant, push-time K9 lane, K9-aware layout docs

.github/workflows/actions.lock

@@ -21,6 +21,7 @@ workflows:
     '.github/workflows/dogfood-gate.yml':
         - 'actions/checkout@v7.0.1'
         - 'hyperpolymath/deed-ecosystem@main'
+        - 'metadatastician/standards@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8'
     '.github/workflows/e2e.yml':
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@v1'

.github/workflows/dogfood-gate.yml

@@ -14,7 +14,7 @@
     branches: [main, master]
 
 permissions:
   actions: read
   contents: read
 
 jobs:
@@ -63,11 +63,24 @@
             echo "Scanned **${MANIFEST_COUNT}** .a2ml/.deed manifest(s). See step output for details." >> "$GITHUB_STEP_SUMMARY"
           fi
 
-  # K9 contract validation moved to fork-governance.yml, which runs the
-  # canonical K9-DEED conformance lane (metadatastician/standards
-  # k9-conformance.yml, contract v1.0.0) and reports it in the PR comment.
-  # The k9-ecosystem validate-action that ran here rejected the `K9!`
-  # envelope the contract requires, so the two could not both pass.
+  # ---------------------------------------------------------------------------
+  # Job 2: K9-DEED conformance on pushes to main/master
+  # ---------------------------------------------------------------------------
+  # The canonical lane (metadatastician/standards k9-conformance.yml, contract
+  # v1.0.0). Pull requests run it in fork-governance.yml, which reports it in
+  # the PR comment, so it runs here on push only: a PR does not check twice,
+  # and a direct push to main is still checked. It replaces the k9-ecosystem
+  # validate-action, which rejected the `K9!` envelope the contract requires.
+  k9-conformance:
+    name: K9-DEED conformance (push)
+    if: github.event_name == 'push'
+    uses: metadatastician/standards/.github/workflows/k9-conformance.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      require-files: true
+      fail-on-indeterminate: false
 
   # ---------------------------------------------------------------------------
   # Job 3: Empty-linter — invisible character detection

.machine_readable/svc/k9/template-hunt.k9.ncl.in

@@ -27,6 +27,13 @@ K9!
       allow_filesystem_write = true,
       allow_subprocess = true,
       signature_required = true,
+      # Default-deny (K9-S007): each flag above must be granted here. Drop the
+      # ones the component does not need, together with their flags.
+      capabilities = [
+        "net.fetch",      # allow_network
+        "fs.write",       # allow_filesystem_write
+        "process.spawn",  # allow_subprocess
+      ],
     },
     metadata = {
       name = "TODO: component-name",
@@ -45,6 +52,12 @@ K9!
       "TODO: List what commands this executes",
       "TODO: List what network access this requires",
     ],
+    # Ed25519, presence only (K9-S009). Signing (step 6 below) adds
+    # payload_hash and signature; verification is K9-C001 (L3).
+    signature = {
+      algorithm = "Ed25519",
+      key_id = "TODO: signing-key-id",
+    },
   },
 
   # Configuration with contracts (Yard-level validation)

layouts/README.adoc

@@ -54,18 +54,31 @@ The `pedigree-layout.ncl` schema enforces:
 
 == Validating a Preset
 
+Each preset is a K9 component: line 1 is the `K9!` envelope, which is not
+Nickel, so the `nickel` CLI cannot read the file directly. Validate it with
+the K9 validator, or evaluate the Nickel body (everything after line 1) from
+inside `layouts/` so the `./pedigree-layout.ncl` import resolves:
+
 [source,bash]
 ----
-nickel typecheck layouts/logic-and-proofs.k9.ncl
-nickel export layouts/logic-and-proofs.k9.ncl --format json
+# K9 contract v1.0.0 conformance (envelope, pedigree, and a body typecheck)
+k9-validate.sh --strict --layer L2 layouts/logic-and-proofs.k9.ncl
+
+# Evaluate the preset against pedigree-layout.ncl's contracts
+cd layouts
+tail -n +2 logic-and-proofs.k9.ncl | nickel typecheck
+tail -n +2 logic-and-proofs.k9.ncl | nickel export --format json
 ----
 
+`k9-validate.sh` is standards' `1-formats/k9/tools/k9-validate.sh`; CI runs
+it on every PR through the K9-DEED conformance lane.
+
 == Creating a Custom Layout
 
 . Copy an existing preset
 . Modify pane sizes (must sum to 100)
 . Change panel visibility and prover priority
-. Run `nickel typecheck` to validate
+. Validate it as above (`k9-validate.sh`, then `nickel export` on the body)
 
 Community-contributed presets are welcome — submit a PR with your `.k9.ncl`
 file and it will be validated against the pedigree schema automatically.

panel-clades/Justfile

@@ -529,6 +529,26 @@ container-init:
         fi
     done
 
+    # The k9-svc deploy component ships as a template (deploy.k9.ncl.in): a
+    # file with brace tokens is not a K9 component. Render it once nothing is
+    # left to fill (init fills PROJECT_NAME and VERSION), so the K9 lane
+    # validates the real thing. The bracket spellings keep just from reading
+    # the token pattern as an interpolation.
+    DEPLOY_IN="container/deploy.k9.ncl.in"
+    DEPLOY_OUT="${DEPLOY_IN%.in}"
+    if [ -f "$DEPLOY_IN" ]; then
+        LEFT=$(grep -oE '[{][{][A-Za-z_]+[}][}]' "$DEPLOY_IN" | sort -u | tr '\n' ' ' || true)
+        if [ -n "$LEFT" ]; then
+            echo "Kept $DEPLOY_IN: unfilled tokens ${LEFT}remain."
+            echo "  Run 'just init', then 'just container-init' again to render it."
+        elif [ -e "$DEPLOY_OUT" ]; then
+            echo "Kept $DEPLOY_IN: $DEPLOY_OUT already exists, so it was not overwritten."
+        else
+            mv "$DEPLOY_IN" "$DEPLOY_OUT"
+            echo "Rendered $DEPLOY_OUT (K9 component, contract v1.0.0)."
+        fi
+    fi
+
     echo "Container templates initialised."
     echo ""
     echo "Next steps:"

panel-clades/container/README.adoc

@@ -60,9 +60,11 @@ All files use `container` tokens that are replaced by `just container-init`
   crash detection, resource thresholds, and log output.
 
 | `deploy.k9.ncl.in`
-| **k9-svc** deployment component at Hunt trust level. Full pedigree
-  (L1--L5), environment configs (dev/staging/prod), container
-  configuration, and rolling deployment strategy.
+| **k9-svc** deployment component template at Hunt trust level (K9
+  contract v1.0.0): pedigree with capability grant, side effects and a
+  signature block, environment configs (dev/staging/prod), container
+  configuration, and rolling deployment strategy. `just container-init`
+  renders it to `deploy.k9.ncl`.
 
 | `0-AI-MANIFEST.a2ml`
 | AI-readable manifest describing the container directory, file
@@ -154,8 +156,9 @@ For k9-svc managed deployments:
 
 [source,bash]
 ----
-# Validate the deployment component
-nickel typecheck container/deploy.k9.ncl  # after rendering deploy.k9.ncl.in
+# `just container-init` renders deploy.k9.ncl.in to deploy.k9.ncl once
+# `just init` and it have filled every placeholder. Then validate it:
+k9-validate.sh --strict --layer L2 container/deploy.k9.ncl
 
 # Deploy (requires Hunt-level authorisation)
 k9-svc deploy container/deploy.k9.ncl --env production