@ahmed-g-gad/apothem 0.1.1

package/src/apothem/rules/persistent-conventions-vigilance.md

@@ -0,0 +1,61 @@
+---
+name: "persistent-conventions-vigilance"
+description: "Adhere to the harness ecosystem's conventions and proactively evolve its artifacts — per-artifact-class convention awareness (naming, layout, frontmatter shape), the five-step proactive-evolution cycle (detect → search → act → validate → retire), bidirectional cross-reference coherence, and ecosystem gap detection that surfaces a missing rule / skill / command / hook before it is needed. Implements CM-22."
+pathFilter: ""
+alwaysApply: true
+---
+
+<!-- SPDX-License-Identifier: MIT -->
+
+# Rule: Persistent Conventions Vigilance
+
+## Purpose
+
+Adhere to the harness ecosystem's conventions and proactively evolve artifacts as projects change.
+
+## Obligations
+
+### 1. Convention Awareness (Companion Sub-Rule Anchor)
+
+Before any non-trivial action, the agent MUST verify alignment with ecosystem conventions covering naming, directory structure, and per-artifact-class shape (skill, rule, command, hook, agent, plan, root config, settings, memory, MCP, narration). Full per-class checklist at `rules/persistent-conventions-vigilance-checklist.md` §1.
+
+### 2. Proactive Evolution
+
+The agent MUST continuously evaluate whether existing artifacts remain sufficient, running a five-step cycle: **Detect** recurrence (2+ instances or noted in memory) → **Search** skills / rules / commands / hooks / memory / MCP for overlap → **Act** (evolve in place when overlap exists; author new only when genuinely orthogonal) → **Validate** that cross-references resolve → **Retire** superseded artifacts with reference updates. Refinement is preferred over creation.
+
+### 3. Ecosystem Coherence
+
+Cross-references between CM-N / TM-N / rules / skills / commands MUST be bidirectional and accurate; naming MUST be identical across surfaces; every rule / skill / command MUST be registered in `CLAUDE.md` (no orphans). New artifacts MUST be verified against existing mandates, with resolution order documented when tension exists.
+
+### 4. Ecosystem Gap Detection (Companion Sub-Rule Anchor)
+
+Beyond refining existing artifacts (§2), the agent MUST identify when the ecosystem is MISSING an artifact that would add value. Common trigger: a pattern recurs 2+ times in the session or is noted in memory as recurring. Full artifact-class trigger catalog (agent / hook / rule / plugin / config-freshness / skill / command) at `rules/persistent-conventions-vigilance-checklist.md` §2.
+
+## Seriousness Scaling
+
+| Level | Conventions Behavior |
+| ----- | -------------------- |
+| EXPLORING | Naming + structure checks only — verify kebab-case and directory placement |
+| PERSONAL_USE | Full convention awareness; cross-references verified on create/modify; gap detection on request |
+| SHARED | Mandatory ecosystem coherence; proactive evolution + gap detection; cross-references enforced every change |
+| PUBLIC_LAUNCH | Full enforcement + proactive index maintenance + session-end gap sweep; violations block completion; cross-project audit |
+
+## Anti-Patterns
+
+- **DON'T** create a new artifact when an existing one covers the same concern — **BECAUSE** duplicates produce conflicting directives and fragment knowledge.
+- **DON'T** ignore naming conventions for "quick" one-off files — **BECAUSE** inconsistency compounds and makes discovery unreliable.
+- **DON'T** leave a new artifact unregistered in `CLAUDE.md` — **BECAUSE** orphans become invisible and unmaintained.
+- **DON'T** mix concerns across artifact types (e.g., skill content inside a rule) — **BECAUSE** it breaks the separation that keeps each type discoverable.
+- **DON'T** skip cross-reference verification after modifying an artifact — **BECAUSE** broken references propagate confusion and erode trust.
+
+## Enforcement
+
+Always-on at every seriousness level, scaling per the table above. Implements CM-22. Canonical specification for ecosystem conventions and artifact lifecycle.
+
+## Bindings (§0.j five-direction)
+
+- **Drives →** ● Every non-trivial ecosystem action's pre-flight convention check (§1 Convention Awareness). ● Every artifact-evolution decision (§2 Proactive Evolution — refine vs. create heuristic). ● Every gap-detection sweep (§4 Ecosystem Gap Detection — agent / hook / rule / plugin / config / skill / command classes). ● Every CHANGELOG / CLAUDE.md registry update on artifact lifecycle events. ◐ Cross-reference accuracy enforcement on every artifact change at SHARED+.
+- **Satisfies →** ● CM-22 (Conventions Vigilance — rule-delegated mandate). ● the rules registry row "Conventions Vigilance". ● `rules/persistent-conventions-vigilance.md` (the four-step Detect / Search / Act / Validate cycle).
+- **Established by ↑** ● CM-22. ● `rules/persistent-conventions-vigilance.md`. ● the hooks pipeline timeout-value canonical block (this rule's §1 cites the canonical column for hook-timeout values).
+- **Gated by ←** ● `CLAUDE.md` always-loaded preamble. ● `rules/operational-mandates.md` (CM-6 self-improvement gates artifact-evolution triggers).
+- **Cross-bound with ↔** ↔ `rules/persistent-conventions-vigilance-checklist.md` (path-filtered companion sub-rule carrying the §1 Convention Awareness checklist and the §4 Ecosystem Gap Detection artifact-class triggers). ↔ `rules/operational-mandates.md` (CM-6 self-improvement triggers artifact evolution; CM-22 specifies the lifecycle here). ↔ `rules/auto-memory.md` (memory feeds gap-detection per §4; gap-detection writes to memory per the §2 evolution cycle). ↔ `rules/context-management.md` (§2.5 phase-exit delegates artifact-evolution evaluation to this rule's §2 + §4). ↔ the artifact registries Registries (the canonical registry surface this rule maintains). ↔ `rules/dynamism.md` (sibling discipline; dynamism is a ratified ecosystem convention whose new surfaces feed §4 Ecosystem Gap Detection). ↔ `rules/sota-elevation.md` (sibling discipline; SOTA-gap detection feeds §4 ecosystem-gap-detection).

package/src/apothem/rules/plain-language.md

@@ -0,0 +1,56 @@
+---
+name: "plain-language"
+description: "User-facing apothem narrative reads as human-authored with zero process-tooling leak — a closed-set forbidden vocabulary (AI / agent / LLM / attestation / ratified / cutover-rehearsal / harness brand identifiers / plan-stage tokens) is eliminated from in-scope codebase-artifact surfaces; the product noun harness is a domain carve-out; dev-facing tech-spec, rule-tier, and per-harness materializer modules are out-of-scope process artifacts that retain their native vocabulary."
+pathFilter: ""
+alwaysApply: true
+---
+
+<!-- SPDX-License-Identifier: MIT -->
+
+# Rule: Plain-language — User-Facing Narrative Free of Process-Tooling Leak
+
+## Obligations
+
+User-facing surfaces MUST read as human-authored product copy. Process-tooling vocabulary belongs in rules, commands, plans, matchers, adapters, and developer-only surfaces — not README / docs / site copy. Human-authored copy flows as prose by default; a list earns its place only where the content is genuinely enumerable, per the prose-over-lists floor at `rules/code-craft-markdown.md` §2.1 — a bulleted stub where a sentence carries the meaning reads as machine-fragmented, not human-authored.
+
+### 1. Forbidden Vocabulary (closed set)
+
+Eliminate from in-scope surfaces — the set is exactly what `conformity/plain_language_grep.py` enforces, word-boundary case-insensitive:
+
+- **Mechanistic generics:** `AI`, `agent` (+ `agents`), `LLM` (+ `LLMs`), `attestation` (+ `attestations`).
+- **Process-tooling markers:** `ratified`, `cutover-rehearsal`.
+- **Harness brand identifiers:** `claude_code` / `claude-code`, `cursor`, `gemini`, `copilot`, `windsurf`, `codex`, `hermes`, `kimi_code` / `kimi-code`, `glm`.
+- **Plan-stage patterns:** numbered stage labels (`phase <N>`), stream labels (`stream <A-Z>`), zero-padded nested-stage tokens (`<NN><A-Z>`).
+
+### 2. Domain Carve-Outs
+
+Allowed: `Apothem`, `apothem`, `polygon`, `regular polygon`, `apothem distance`. The product noun `harness` / `harnesses` is allowed — apothem's central product domain, not a leak. The generic `agent` / `agents` clears ONLY as a directory or cohort-directory reference (`agents/`, or `agents` enumerated beside sibling cohort directories), never as a mechanistic prose noun.
+
+### 3. Boundary — In-Scope vs Out-of-Scope
+
+- **In-scope:** README files, docs / site copy, workflow names and step names, asset alt / ARIA text, commit messages, PR / issue templates, CHANGELOG entries, Pages copy.
+- **Out-of-scope:** `.apothem/plans/**`, `.plans/**`, rules, commands, matchers, adapter modules, materializers, and developer-only technical surfaces whose process vocabulary is load-bearing.
+
+### 4. Resolution Paths
+
+Resolve every finding by exactly one of: **rewrite** to natural product wording, **relocate** to an out-of-scope surface, or **carve-out citation** (a §2 domain term). Silent acceptance is non-conformant.
+
+## Disclosure surface
+
+Record each interception in the disclosure ledger per `rules/disclosure-ledger.md` as rewrite, relocate, or carve-out.
+
+## Mechanical enforcement
+
+`conformity/plain_language_grep.py` enforces §1 against §3 in-scope surfaces with the §2 carve-outs whitelisted.
+
+## Failure tells
+
+A user-facing sentence naming a mechanistic generic (`AI` / `agent` / `LLM`), a harness brand identifier, a plan stage, or a process marker (`ratified` / `attestation` / `cutover-rehearsal`) where natural product wording carries the meaning.
+
+## Bindings (§0.j five-direction)
+
+- **Drives →** Every in-scope user-facing surface emission in the apothem repo. The mechanical matcher at `conformity/plain_language_grep.py`. Every README / docs / workflow-name / asset-alt / PR-template / CHANGELOG / Pages-copy touch under §3 in-scope.
+- **Satisfies →** `CLAUDE.md` §CM-7 (Coherent Product — codebase-artifact-vs-process-artifact boundary). The apothem-scope plain-language mandate and product-artifact boundary ratification.
+- **Established by ↑** The plain-language sweep mandate (apothem-only). `CLAUDE.md` §CM-7. `rules/operational-mandates.md` §CM-7 (the inward-axis driver).
+- **Gated by ←** The §3 boundary (out-of-scope surfaces are exempt). The §2 carve-outs (domain vocabulary and repo's own name retained).
+- **Cross-bound with ↔** `rules/operational-mandates.md` (CM-7 codebase-coherence mandate this rule outward-projects). `rules/clean-room-generation.md` (Writing Protocol §2 produces narrative that naturally honors plain-language; this rule is the post-emission scan). `rules/disclosure-ledger.md` (M2 — plain-language interceptions land in the ledger). `rules/agent-capability-discipline.md` (plain-language-boundary surface — agent-capability prose stays out-of-scope while user-facing surfaces stay in-scope). `conformity/plain_language_grep.py` (the mechanical matcher operationalizing §1 against §3 with §2 carve-outs). `rules/own-voice-reimplementation.md` (sibling user-facing-vocabulary sweep on the same shipped surfaces this rule scans). `rules/freshness-facade.md` (sibling shipped-surface sweep — plain-language owns the mechanistic-vocabulary token-class, freshness-facade owns the freshness-narrative token-class; same scope, non-overlapping sets). `agents-md-convention.md` (the per-folder agent-facing guidance surface — an out-of-scope agent-facing process artifact whose process vocabulary is load-bearing, while the user-facing surfaces this rule scans stay in-scope).

package/src/apothem/rules/planning-techniques.md

@@ -0,0 +1,130 @@
+---
+name: "planning-techniques"
+description: "Nine planning-review techniques — each pairing a Detect signal, a verification Procedure, and the Anti-pattern it guards against: iteration-loop safety, campaign dependency ordering, clean-slate artifact conflict, identity-claim verification, asymmetric-fix propagation, blind-review value, added-task completeness, severity-count verification, and strict-gate remediation. Applied on detection across plan generation, review, audit, and execution. Implements CM-20 / CM-21."
+pathFilter: "**/.apothem/plans/**, **/.plans/**, **/commands/plan-*.md"
+alwaysApply: false
+---
+
+<!-- SPDX-License-Identifier: MIT -->
+
+# Rule: Planning Techniques Compendium
+
+## Purpose
+
+Consolidate nine planning review techniques into one reference. Each technique pairs a **Detect** signal (what surfaces it), a **Procedure** (the verification steps), and an **Anti-pattern** (the failure it guards against). Apply the matching technique on detection during plan generation, review, audit, and execution per the Seriousness-Scaling table and the §Decision Tree.
+
+## Obligations
+
+### 1. Iteration Loop Safety
+
+**Detect:** Plan-text patterns that mandate retry without naming a cap — "iterate until X passes", "re-run until gate met", "retry until success", "loop until convergence". Any retry mandate that names the success criterion but omits a maximum attempt count is in scope.
+**Procedure:** Verify three elements: (a) gate criterion — what must be met, (b) iteration cap — max attempts (e.g., 3), (c) retreat strategy — what happens if cap exhausted. The retreat must produce a usable outcome, not dead-end.
+**Anti-pattern:** Risk mitigations that restate the problem ("Mitigation: iterate until passed") are circular — flag immediately.
+
+### 2. Campaign Dependency Ordering
+
+**Detect:** Prose phrases like "X then Y then Z ordering", "must complete before", explicit campaign sequencing mandates.
+**Procedure:** (a) Extract prose-mandated execution sequence, (b) encode as strict prerequisite chain in dependency graph, (c) verify bidirectionally — topological order matches prose, (d) for each "Parallelizable with" declaration, confirm no sequential mandate exists.
+**Anti-pattern:** Deriving dependencies only from data-flow analysis misses semantic ordering constraints imposed by experimental design.
+
+### 3. Clean-Slate Artifact Conflict
+
+**Detect:** "delete", "empty", "wipe", or "clean slate" applied to a directory.
+**Procedure:** (a) Build artifact-path map — every phase's output paths, (b) for each destructive directory op, check if target is parent of any earlier artifact path, (c) resolve by relocating artifacts or narrowing wipe scope, (d) re-verify after resolution.
+**Anti-pattern:** Directory-scope wipes vs. file-scope outputs — the abstraction-level mismatch makes conflicts invisible to dependency analysis.
+
+### 4. Identity Claims Verification
+
+**Detect:** Superlatives ("highest", "fastest"), quantitative thresholds ("within 1%"), ordering assertions ("A always beats B") in success criteria.
+**Procedure:** (a) Extract all identity-level claims, (b) trace each to a specific pilot/validation task measuring the exact metric, (c) if none exists, add one to pilot phase, (d) ensure it gates downstream phases — no proceed on failure.
+**Anti-pattern:** Absorbing identity claims into success criteria without creating testable gate tasks leaves claims unverified until full-scale execution.
+
+### 5. Asymmetric Fix Application
+
+**Detect:** A revision fixes a finding in one phase but structurally similar phases share the same pattern.
+**Procedure:** (a) When applying a fix, identify all structurally similar phases, (b) apply the same fix to all of them, (c) verify propagation is complete — count affected phases before and after.
+**Anti-pattern:** Fixing only the cited phase when the pattern recurs across multiple phases creates inconsistency.
+
+### 6. Blind Review Value
+
+**Detect:** Incremental reviews converging on "no new findings" while structural gaps may persist.
+**Procedure:** (a) Conduct a blind re-audit without reading prior review results, (b) use novel audit dimensions not covered in prior reviews, (c) compare blind findings against prior findings to identify gaps.
+**Anti-pattern:** Incremental reviews anchor on prior findings — blind reviews break this anchoring bias.
+
+### 7. Added Task Completeness
+
+**Detect:** A revision adds a new task to a phase's task table.
+**Procedure:** (a) Navigate to the phase's Verification section, (b) add a corresponding checklist item verifying the new task's acceptance criteria, (c) treat task-table and verification-section as atomic pair — never update one without the other, (d) after all revisions, verify task-count vs. verification-item-count parity.
+**Anti-pattern:** Adding a task without updating verification creates a silent gap between acceptance criteria and phase verification.
+
+### 8. Severity Count Verification
+
+**Detect:** Summary text containing severity breakdowns (e.g., "2 MEDIUM, 3 LOW").
+**Procedure:** (a) After writing any summary with severity counts, navigate to the detailed findings table, (b) count entries by severity directly from the table, (c) compare against summary — the table is authoritative, (d) when synthesizing from multiple sources, reconcile categorization boundaries before tallying.
+**Anti-pattern:** Manually estimating severity counts from memory during synthesis introduces arithmetic errors that persist across reviews.
+
+### 9. Strict Gate Remediation
+
+**Detect:** Findings registries, scorecards, or handoff manifests that use PASS / CONDITIONAL language while one or more findings still have `status=open`.
+**Procedure:** (a) Count open findings from the registry, (b) require each finding to carry a concrete Fix Action and Remediation Class, (c) route mechanical findings to immediate fix, judgment findings to structured inquiry, and out-of-scope items to `*-maintenance`, (d) re-audit the touched loci, (e) block terminal handoff until open count is zero or every residual is explicitly operator-waived with rationale.
+**Anti-pattern:** Treating CONDITIONAL as a pass while open findings remain turns review into reporting-only ceremony and pushes unresolved defects into execution.
+
+**Severity ranking:** Techniques 1, 2, 4, and 9 are HIGH; 3, 5, 7, and 8 are MEDIUM; 6 is LOW.
+
+## Seriousness Scaling
+
+| Level | Techniques Application |
+| ----- | ---------------------- |
+| EXPLORING | Optional, on explicit user request — pipeline operates at reduced rigor by default |
+| PERSONAL_USE | Apply techniques 1 and 4 (iteration safety, identity claims). Others on detection |
+| SHARED | Apply all techniques on detection. Techniques 1, 2, 4, and 9 mandatory during `/plan-review` and `/plan-audit` |
+| PUBLIC_LAUNCH | All techniques mandatory. Blind Review (technique 6) required for every review cycle |
+
+## Decision Tree
+
+```mermaid
+%%{ init: { "theme": "neutral" } }%%
+%% verified: 2026-04-27 %%
+%% provenance: rules/planning-techniques.md §1-§9 (nine techniques) %%
+%% cross-reference: rules/planning-techniques.md severity ranking %%
+flowchart TD
+    Start[Plan review or generation surfaces a candidate concern] --> Q1{Retry mandate without iteration cap?}
+    Q1 -->|yes| T1[Technique 1 · Iteration Loop Safety · HIGH]
+    Q1 -->|no| Q2{Prose mandates execution sequence?}
+    Q2 -->|yes| T2[Technique 2 · Campaign Dependency Ordering · HIGH]
+    Q2 -->|no| Q3{Destructive op targets a parent of earlier outputs?}
+    Q3 -->|yes| T3[Technique 3 · Clean-Slate Artifact Conflict · MEDIUM]
+    Q3 -->|no| Q4{Superlatives or identity-level claims in success criteria?}
+    Q4 -->|yes| T4[Technique 4 · Identity Claims Verification · HIGH]
+    Q4 -->|no| Q5{Fix applied to one phase but pattern recurs in siblings?}
+    Q5 -->|yes| T5[Technique 5 · Asymmetric Fix Application · MEDIUM]
+    Q5 -->|no| Q6{Reviews converging on no-new-findings · structural gaps may persist?}
+    Q6 -->|yes| T6[Technique 6 · Blind Review Value · LOW]
+    Q6 -->|no| Q7{Revision adds task to phase task table?}
+    Q7 -->|yes| T7[Technique 7 · Added Task Completeness · MEDIUM]
+    Q7 -->|no| Q8{Summary contains severity counts?}
+    Q8 -->|yes| T8[Technique 8 · Severity Count Verification · MEDIUM]
+    Q8 -->|no| Q9{PASS or CONDITIONAL with open findings?}
+    Q9 -->|yes| T9[Technique 9 · Strict Gate Remediation · HIGH]
+    Q9 -->|no| Skip[No technique fires for this candidate]
+```
+
+## Anti-Patterns
+
+- **DON'T** apply techniques only to the flagged finding — **BECAUSE** structurally similar phases share the same vulnerability (technique 5: Asymmetric Fix Application).
+- **DON'T** treat iteration caps as optional guardrails — **BECAUSE** unbounded retry loops consume phases without producing usable outcomes (technique 1: Iteration Loop Safety).
+- **DON'T** derive dependencies only from data-flow analysis — **BECAUSE** semantic ordering constraints from experimental design are invisible to data-flow (technique 2: Campaign Dependency Ordering).
+- **DON'T** add tasks without updating the corresponding verification section — **BECAUSE** task-table and verification-section are an atomic pair; gaps between them create silent acceptance-criteria holes (technique 7: Added Task Completeness).
+- **DON'T** hand off with open findings hidden behind a CONDITIONAL scorecard — **BECAUSE** terminal gates are about unresolved defects, not only score labels (technique 9: Strict Gate Remediation).
+
+## Enforcement
+
+Path-filtered (`**/.apothem/plans/**`, `**/.plans/**`, `**/commands/plan-*.md`), scaling per the table above. Implements CM-20 (Pipeline Orchestration), CM-21 (Creative Quality). Canonical specification for planning review techniques.
+
+## Bindings (§0.j five-direction)
+
+- **Drives →** ● Every plan-pipeline review and audit surface (the nine techniques apply during `/plan-review` and `/plan-audit` cycles per the command contracts). ● Every plan revision's structural sweep (the asymmetric-fix-application technique fires when revisions land). ● Every plan-generate emission's identity-claims verification (technique 4 gates pilot-phase task creation). ● Every zero-open-finding terminal handoff (technique 9 blocks unresolved findings). ◐ The blind re-audit cadence at PUBLIC_LAUNCH (technique 6 mandatory at the highest seriousness tier).
+- **Satisfies →** ● CM-20 (Pipeline Orchestration) + CM-21 (Creative Quality — planning-technique facet per §7.2 facet delineation). ● the rules registry row "Planning Techniques".
+- **Established by ↑** ● CM-20 + CM-21. ● `rules/cognitive-identity.md` Cognitive Identity (Filter 2-4 ↔ ideation-techniques; this rule's nine techniques are the planning facet of the same creative discipline).
+- **Gated by ←** ● The path-filter (`**/.apothem/plans/**`, `**/.plans/**`, `**/commands/plan-*.md`) — this rule activates only on plan-pipeline artifact touches. ● `rules/cognitive-identity.md` Filter 1 + Filter 5 always-on baseline.
+- **Cross-bound with ↔** ↔ `rules/cognitive-identity.md` (the cognitive-filter sequence and the nine-technique catalog are sibling facets of CM-21). ↔ `rules/clean-room-generation.md` (third co-implementer of CM-21; planning-technique facet here, generation-methodology facet there). ↔ `commands/plan-review.md` + `commands/plan-audit.md` (review/audit workflows operationalize the nine techniques). ↔ `commands/plan-generate.md` + `commands/plan-execute.md` (techniques 1-4 fire during generate; techniques 5-9 fire during execute/review handoffs).

package/src/apothem/rules/pre-emission-gate-bars.md

@@ -0,0 +1,86 @@
+---
+name: "pre-emission-gate-bars"
+description: "Path-filtered companion rule carrying the full Fifteen-Bars table (M1–M15 detailed Check + Failure→action columns), the Attestation Schema YAML block, and the iteration-on-failure protocol declared at the parent `pre-emission-gate.md` rule's anchor; demand-loaded when the assistant edits any artifact whose emission triggers the fifteen-bar gate."
+pathFilter: "**/*.md, **/CLAUDE.md, **/rules/**, **/commands/**, **/skills/**, **/agents/**, **/docs/**"
+alwaysApply: false
+---
+
+<!-- SPDX-License-Identifier: MIT -->
+
+# Rule: Pre-Emission Gate — Fifteen-Bars Detail (Companion Sub-Rule)
+
+## Purpose
+
+Carry the executable detail of the fifteen-bar pre-emission gate the parent `rules/pre-emission-gate.md` anchors: the per-bar Check + Failure→action table, the Attestation Schema YAML block, and the iteration-on-failure protocol. Path-filtered — loads on any artifact-emission surface (Markdown, CLAUDE.md, rules, commands, skills, agents, docs) — so the parent's always-on payload stays lean while full bar-level fidelity lives at the demand-load surface. The parent retains the standing directive, the one-line bar list, the disclosure-surface paragraph, and the failure tells.
+
+## Obligations
+
+### 1. The Fifteen Bars — Full Detail
+
+Every emitted artifact passes each bar individually. Mechanical-fraction bars (M2, M5, M7, M8, M10, M13, M15) carry executable matchers at `conformity/*-grep.py`, run as `PreToolUse` hook checks orchestrated by `conformity/gate.py`. Reasoned bars (M1, M3, M6, M9, M11, M12, M14) are agent-evaluated and recorded in the attestation block.
+
+| # | Bar | Check (mechanical or reasoned) | Failure → action |
+|---|---|---|---|
+| 1 | M1 — Host agnosticism | Artifact's idioms match sibling-file idioms (formatter / linter / naming / layout). | Revise to match host conventions per `rules/host-discovery.md`. |
+| 2 | M2 — Editorial disclosure | Every amendment / extension / refinement is disclosed with cited rationale. | Add disclosure ledger per `rules/disclosure-ledger.md`. |
+| 3 | M3 — Ten dimensions | Each of the ten dimensions individually passes. | Revise on the failing dimension(s) per `rules/ten-dimension-check.md`. |
+| 4 | M4 — Self-application | Gate attestation block is present in the artifact's working trace. | Record attestation. |
+| 5 | M5 — Authority | No `<USER-CONFIRM:…>` placeholders remain unfilled. No invented personal / authoritative data. | Re-route to inquiry surface per `rules/authority-inquiry.md`. |
+| 6 | M6 — Expertise | Surfaced-gaps section is present where adjacent gaps exist; refinements cite rationale. | Surface gaps; cite per `rules/expertise-posture.md`. |
+| 7 | M7 — Option annotation | Every multi-option choice carries `**Recommended**` + specific rationale. | Annotate per `rules/option-annotation.md`. |
+| 8 | M8 — Definitiveness | Hedging vocabulary absent in prescriptive contexts; pre / post / failure conditions stated. | Promote hedging to conditionals; state contracts per `rules/definitiveness.md`. |
+| 9 | M9 — Visual leverage | Structural subject matter has a current-reality diagram with provenance + verification date. | Author / refresh diagram per `rules/visual-leverage.md`. |
+| 10 | M10 — Bidirectional binding | Substantive elements declare bindings; reciprocity is closed. | Close half-edges per `rules/bidirectional-binding.md`. |
+| 11 | M11 — Agile sprints | For non-trivial work: Sprint Goal + Backlog + DoR + DoD + Review + Retrospective populated. | Restructure as sprints per `rules/agile-sprints.md`. |
+| 12 | M12 — Phase reporting & layout | For multi-phase work: per-sub-phase reports + phase-level rollup; outputs at canonical layout. | Author rollup; relocate per `rules/canonical-layout.md`. |
+| 13 | M13 — Code craft | Code passes host's lint / format / type-check; why-not-what comments; no magic numbers / bare-except / commented-out blocks. | Revise per `rules/code-craft-python.md` and sibling per-language code-craft rules. |
+| 14 | M14 — Systemicity | New components declare upstream / downstream / peers / enforcers; indexed in host registries. | Declare; index per `rules/systemic-participation.md`. |
+| 15 | M15 — Production-ready | Code change ships with tests + docs + CHANGELOG entry + conformant commit + CI green. | Add missing surfaces per `rules/production-ready-prs.md`. |
+
+### 2. Attestation Schema
+
+The attestation is appended to the artifact's working trace (commit body, PR description, change ledger, dedicated `attestation.yml`):
+
+```yaml
+conformity-attestation:
+  artifact: <path-or-identifier>
+  ecosystem-version: <git-commit-sha-or-equivalent ratifying the rule set in force>
+  bars:
+    M1-host-agnosticism:        pass | n/a (with reason)
+    M2-editorial-disclosure:    pass | n/a
+    M3-ten-dimensions:          pass | n/a
+    M4-self-application:        pass
+    M5-authority:               pass
+    M6-expertise:               pass | n/a
+    M7-option-annotation:       pass | n/a (no option set)
+    M8-definitiveness:          pass
+    M9-visual-leverage:         pass | n/a (subject not structural)
+    M10-bidirectional-binding:  pass | n/a (subject not structural-multi-element)
+    M11-agile-sprints:          pass | n/a (trivial work)
+    M12-phase-layout:           pass | n/a (single-artifact emission)
+    M13-code-craft:             pass | n/a (not code)
+    M14-systemicity:            pass
+    M15-production-ready:       pass | n/a (no host-public-surface change)
+  surfaced-gaps: []
+  unresolved-inquiries: []
+  amendments-disclosed: []
+  date: <ISO-8601>
+```
+
+Every `n/a` is explicit and reasoned — never a silent skip. The `ecosystem-version` field anchors the attestation to a reproducible ecosystem state (the apothem source-repo commit when the gate ran), so a future audit can replay the gate against the same rule bodies.
+
+### 3. Iteration on failure
+
+A single bar failure blocks emission. Revise the artifact per the failing bar's "Failure → action" cell — which names the rule that owns the revision protocol — and re-run the gate. Iterate until every bar passes, then emit with the attestation recorded.
+
+## Enforcement
+
+Path-filtered (the seven glob patterns in this rule's `pathFilter` field), always-on at every seriousness level when in scope. Demand-loaded companion to `rules/pre-emission-gate.md`. The parent carries the standing directive, one-line bar list, disclosure-surface paragraph, and failure tells; this companion carries the bar-level table, the attestation YAML schema, and the iteration-on-failure protocol.
+
+## Bindings (§0.j five-direction)
+
+- **Drives →** ● The per-bar Check + Failure→action enforcement on every emitted artifact under the path-filter. ● The attestation YAML schema's appearance in every artifact's working trace. ● The iteration-on-failure protocol's revise-and-re-run loop.
+- **Satisfies →** ● the fifteen-mandate registry row **M4 — Self-Application** (companion-sub-rule materialization). ● the Pre-Emission Gate Attestation Schema. ● `rules/pre-emission-gate.md` anchor (the parent rule's pointer to this companion's full bar-level catalog).
+- **Established by ↑** ● `rules/pre-emission-gate.md` (parent-rule anchor). ● the Pre-Emission Gate. ● the Pre-Emission Gate Attestation Schema.
+- **Gated by ←** ● The path-filter (seven glob patterns) — this rule demand-loads only on emission-surface touches. ● `rules/pre-emission-gate.md` always-on baseline (parent rule's anchor must be live for the companion to demand-load coherently).
+- **Cross-bound with ↔** ↔ `rules/pre-emission-gate.md` (parent rule; anchor binds this companion). ↔ Every M-rule named in the gate's "Failure → action" column (`rules/host-discovery.md`, `rules/disclosure-ledger.md`, `rules/ten-dimension-check.md`, `rules/authority-inquiry.md`, `rules/expertise-posture.md`, `rules/option-annotation.md`, `rules/definitiveness.md`, `rules/visual-leverage.md`, `rules/bidirectional-binding.md`, `rules/agile-sprints.md`, `rules/canonical-layout.md`, `rules/code-craft-python.md` and sibling per-language code-craft rules, `rules/systemic-participation.md`, `rules/production-ready-prs.md`).

package/src/apothem/rules/pre-emission-gate.md

@@ -0,0 +1,54 @@
+---
+name: "pre-emission-gate"
+description: "Fifteen-bar pre-emission gate — every host-project artifact passes M1 through M15 before emission, with a recorded YAML attestation and explicit n/a reasoning where a bar does not apply."
+pathFilter: ""
+alwaysApply: true
+---
+
+<!-- SPDX-License-Identifier: MIT -->
+
+# Rule: Pre-Emission Gate — Fifteen-Bar Self-Application
+
+## What this rule enforces
+
+This rule binds **M4 — Self-Application: Every Artifact Passes the Same Bar Before Emission**. Every artifact the ecosystem emits in a host project — commit, diff, file, PR description, comment, response, doc page, diagram, test, example, migration script, config entry — MUST itself clear all fifteen mandates. Quality is a pre-emission concern, never a downstream "the user can revise it" concern. The bar is **fifteen**: the ten dimensions of M3 plus M5, M6, M7, M8, M9, M10, M11, M12, M13, M14, M15. An artifact that fails any single bar MUST be revised before it leaves the agent's hands.
+
+## Pre-conditions
+
+Applies before any meaningful-scope emission per the trivial-vs-non-trivial threshold. Trivial emissions (single-file edit ≤ 5 lines AND no public-API change AND no behavioral shift) run an abbreviated gate covering **M4** (attestation present) and **M5** (no `<USER-CONFIRM:…>` placeholders) only.
+
+## Required behavior
+
+### The Fifteen Bars (one-line summary)
+
+Each bar MUST pass individually before emission:
+
+- **M1** Host agnosticism · **M2** Editorial disclosure · **M3** Ten dimensions · **M4** Self-application · **M5** Authority · **M6** Expertise · **M7** Option annotation · **M8** Definitiveness · **M9** Visual leverage · **M10** Bidirectional binding · **M11** Agile sprints · **M12** Phase reporting & layout · **M13** Code craft · **M14** Systemicity · **M15** Production-ready.
+
+Mechanical-fraction bars (M2, M5, M7, M8, M10, M13, M15) carry executable matchers at `conformity/*-grep.py` orchestrated by `conformity/gate.py`; reasoned bars (M1, M3, M6, M9, M11, M12, M14) are agent-evaluated and recorded in the attestation.
+
+(Companion Sub-Rule Anchor) See `rules/pre-emission-gate-bars.md` §1 for the per-bar Check + Failure→action table.
+
+### Attestation Schema
+
+The attestation is appended to the artifact's working trace (commit body, PR description, change ledger, or a dedicated `attestation.yml`): one `pass | n/a (with reason)` line per bar, plus the `surfaced-gaps`, `unresolved-inquiries`, and `amendments-disclosed` arrays, an `artifact` identifier, an `ecosystem-version` SHA, and an ISO-8601 `date`. Every `n/a` MUST carry a reason — silent skips are non-conformant. (Companion Sub-Rule Anchor) See `rules/pre-emission-gate-bars.md` §2 for the YAML schema.
+
+### Iteration on failure
+
+A single bar failure blocks emission. Revise per that bar's "Failure → action" rule, then re-run the gate; repeat until every bar passes. (Companion Sub-Rule Anchor) See `rules/pre-emission-gate-bars.md` §3.
+
+## Disclosure surface
+
+The attestation block IS the disclosure surface. Surfaced gaps (M6), unresolved inquiries (M5), and disclosed amendments (M2) populate three named arrays; empty arrays are written explicitly (`surfaced-gaps: []`), never elided.
+
+## Failure tells
+
+A commit that breaks the host's lint. A PR description with a dead link. A doc page citing a phantom URL. A diagram describing a flow the code does not implement. An attestation marked `pass` while a checked condition demonstrably fails. A bar marked `n/a` with no reason. An attestation missing the `date` or `ecosystem-version` field. A `pass` attestation on an artifact a mechanical `conformity/*-grep.py` flags as failing.
+
+## Bindings (§0.j five-direction)
+
+- **Drives →** Every host-project artifact emission across every ecosystem surface (the gate is the literal last step before emission). The mechanical-fraction enforcement at `conformity/*-grep.py` orchestrated by `conformity/gate.py`. The gate-attestation requirement at every `commands/*.md` Step N closing emission. The gate-attestation block at every `agents/*.md` return format.
+- **Satisfies →** the fifteen-mandate registry row **M4 — Self-Application**. the Pre-Emission Gate (this rule is the canonical operationalization). the Pre-Emission Gate Attestation Schema.
+- **Established by ↑** the fifteen-mandate registry (ratifies M4). the Pre-Emission Gate (the gate table this rule mirrors at full body bar). the Pre-Emission Gate attestation schema (the attestation schema this rule reproduces).
+- **Gated by ←** The §8.1 trivial-vs-non-trivial threshold (trivial emissions run the abbreviated gate). `CLAUDE.md` always-loaded preamble.
+- **Cross-bound with ↔** `rules/pre-emission-gate-bars.md` (path-filtered companion sub-rule carrying the full Fifteen-Bars table, the Attestation Schema YAML block, and the iteration-on-failure protocol). Every M-rule named in the gate's "Failure → action" column (`rules/host-discovery.md`, `rules/disclosure-ledger.md`, `rules/ten-dimension-check.md`, `rules/authority-inquiry.md`, `rules/expertise-posture.md`, `rules/option-annotation.md`, `rules/definitiveness.md`, `rules/visual-leverage.md`, `rules/bidirectional-binding.md`, `rules/agile-sprints.md`, `rules/canonical-layout.md`, `rules/code-craft-python.md` and sibling per-language code-craft rules, `rules/systemic-participation.md`, `rules/production-ready-prs.md`). `rules/operational-mandates.md` §CM-1 Critical Evaluation × §CM-7 Coherent Product (M4 is the composite outward-projection form of these two CM-N mandates). `rules/dynamism.md` (bar 8 fires the `static-version-grep` matcher and consumes its verdict). `rules/recommend-next-step.md` (M4 — block presence is a gated bar at terminal-surface emission). `rules/token-efficiency-rewrite.md` (bar inspection of L3 anchor-diff zero-drift and L2-preservation attestation). `rules/agnostic-posture.md` (under the host-agnostic posture the gate's bars surface as advisories, not blocks). `rules/determinism.md` (the gate consumes the determinism matcher's verdict on byte-stable materialized outputs). `rules/session-closure.md` (M4 — the formal session close's verification-attestation element is the session-scale analog of the gate's per-bar attestation; a close's "checked" column mirrors the gate's bar attestation at the session boundary).

package/src/apothem/rules/production-ready-prs-surfaces.md

@@ -0,0 +1,162 @@
+---
+name: "production-ready-prs-surfaces"
+description: "Path-filtered companion to `rules/production-ready-prs.md` carrying the operational depth of M15: the seven visibility surfaces, the supply-chain posture catalog, the release-engineering invariants, the commit-message convention (with the human-only authorship clause), the CI-green discipline, and the modern-project-surface specification. Demand-loaded when the assistant edits any visibility-surface artifact (README / CHANGELOG / CONTRIBUTING / LICENSE / SECURITY / `.github/**` / install / update / uninstall scripts)."
+pathFilter: "**/README.md, **/CHANGELOG.md, **/CONTRIBUTING.md, **/LICENSE, **/.github/**, **/install.*, **/update.*, **/uninstall.*, **/CODEOWNERS, **/SECURITY.md, **/SUPPORT.md"
+alwaysApply: false
+---
+
+<!-- SPDX-License-Identifier: MIT -->
+
+# Rule: Production-Ready Visibility Surfaces & Modern Project Surface (Companion Sub-Rule)
+
+## Purpose
+
+Specify the catalog surfaces and the modern-project-surface specification that the parent rule `rules/production-ready-prs.md` cites at its anchor lines. This companion is path-filtered: it loads when the assistant edits any of the visibility-surface artifact classes (README, CHANGELOG, CONTRIBUTING, LICENSE, SECURITY, SUPPORT, CODEOWNERS, `.github/**`, install / update / uninstall scripts). The parent rule remains the canonical home for the same-change-set discipline (§1), the gap-surfacing summary (§5), and the disclosure-surface / failure-tells / bindings; this companion carries the moved sections (§2, §3, §4, §6, §7, §8.1–§8.7).
+
+## Obligations
+
+### 1. The Seven Visibility Surfaces
+
+The seven visibility surfaces of a production-ready artifact set, applied to the host project:
+
+| Surface | Question the surface answers | Where it lives in the host |
+|---|---|---|
+| **What-is-this** | What does this project do, in one sentence I can read on landing? | `README.md` opening paragraph; `pyproject.toml` `description` field; documentation site landing page |
+| **How-to-install / use** | How do I install / get started / run my first example? | `README.md` Quick Start section; `INSTALL.md`; documentation site Installation page |
+| **Is-it-alive** | Is this project actively developed? Is the build passing? | CI status badges in `README.md`; recent commits in git log; CHANGELOG `[Unreleased]` section freshness |
+| **Is-it-safe** | What's the license? Is there a security policy? What versions are supported? | `LICENSE` file; `SECURITY.md`; `SUPPORT.md`; supported-versions table in README |
+| **How-to-contribute** | How do I report a bug, propose a feature, submit a PR? | `CONTRIBUTING.md`; `CODE_OF_CONDUCT.md`; issue templates at `.github/ISSUE_TEMPLATE/`; PR template at `.github/pull_request_template.md` |
+| **Can-I-trust** | License clear? CHANGELOG maintained? Release signing ratified? CI green? Tests exist? | All-of-above must align: LICENSE present, CHANGELOG up-to-date, release signing where required, CI green, test coverage above the host's ratified threshold |
+| **What-changed-and-when** | What changed in this version? When? Why? | `CHANGELOG.md`; release notes at the host's release surface; clean git history |
+
+Where the host already operates these surfaces, the agent honors them — every change keeps them current. Where the host lacks a surface, the agent **MUST NOT unilaterally install** it: surface the gap as a finding per `rules/authority-inquiry.md` with the recommended option per `rules/option-annotation.md`.
+
+### 2. Supply-Chain Posture Preservation (M13.8 reinforced)
+
+Every change MUST preserve the host's supply-chain posture:
+
+- **No new unpinned dependency.** New production dependencies are pinned per the host's ratified policy (`==X.Y.Z` for Python production; `^X.Y.Z` for libraries; equivalent elsewhere). Library projects MAY use ranges in `pyproject.toml` per host convention; production projects pin.
+- **No secret literal.** No API key, token, password, private key, or certificate committed to source. The `secret-leak-grep` matcher at `conformity/secret_leak_grep.py` operationalizes the check.
+- **No permission escalation.** CI workflow permission scopes MUST NOT widen without explicit justification; existing minimum-scope `permissions:` blocks are preserved.
+- **Pinned actions.** GitHub Actions `uses:` references are pinned to commit SHAs (with version-tag comments) per the host's ratified policy. The `unpinned-action-grep` matcher at `conformity/unpinned_action_grep.py` operationalizes the check.
+- **No unsigned release artifact** where the host's release policy requires signing (Sigstore cosign, GPG, SLSA provenance).
+
+### 3. Release-Engineering Invariants
+
+- **Versioning scheme honored.** The host's ratified scheme (semver, calver, custom) is preserved across every change. Breaking changes increment MAJOR (semver) or signal incompatibility per the host's convention.
+- **Tag-to-version consistency.** Git tags MUST match the version declared in the host's manifest (`pyproject.toml`, `package.json`, `Cargo.toml`, `go.mod` module-major-version suffix). A tag with no matching manifest version-bump is a violation.
+- **Tag signing where ratified.** When the host's release policy requires GPG-signed tags, the tag is signed.
+- **Current-version public facade.** Release-facing repositories expose the current version as the single visible public story: one current release tag, one release entry, one package per registry surface, current deployment records, and no public narrative referencing superseded release work or internal planning history. Publication follows green local validation and release-readiness workflows.
+
+### 4. Commit-Message Discipline
+
+Every commit message honors the host's ratified convention, discovered per `rules/host-discovery.md`:
+
+- **Conventional Commits.** When sibling commits use `<type>(<scope>): <summary>` with types from `{feat, fix, chore, docs, refactor, test, perf, ci, build, style, revert}`, the new commit follows the same shape.
+- **Host-specific format.** When `CONTRIBUTING.md` documents a project convention (e.g., `[CATEGORY] <summary>`, ticket-prefix `JIRA-1234: <summary>`), the new commit follows it.
+- **Subject line length.** Under the host's ratified limit (commonly 50 / 72 / 80 chars per `.gitmessage` template or sibling commits).
+- **Body discipline.** The body explains the **why**, not just the **what**, wraps at the host's ratified column (commonly 72 / 80), and references issue trackers per the host's pattern.
+- **Co-author attribution.** A `Co-Authored-By:` trailer is added only when the change is genuinely co-authored by **another human contributor**, per the host's pattern.
+- **Human-only authorship.** Every authorship surface of every git artifact — commit subject, commit body, `Author:` field, `Co-Authored-By:` trailer, `Signed-off-by:` trailer, branch name, tag name, tag annotation, stash name, git-notes body, PR title, PR description — names **human contributors only**. The agent **MUST NOT** add itself, the underlying language model, the runtime / harness / IDE / extension / vendor, or any other automated tool to any of those surfaces. Forbidden patterns include but are not limited to: `Co-Authored-By: Claude …`, `Co-Authored-By: GPT …`, `Co-Authored-By: Copilot …`, `Co-Authored-By: Cursor …`, `Co-Authored-By: <any-LLM-name> …`, `Co-Authored-By: <noreply@*-vendor.com>`, body narrative like "generated with X" / "co-authored by an AI" / "with assistance from `<agent>`" / "🤖 Generated with …", and any subject-line marker signalling agent authorship. **Why.** Co-authorship trailers carry legal and audit weight — joint authorship for licensing, code-review attribution, contribution metrics, downstream provenance, supply-chain attestation. Naming a non-human misrepresents the authorship graph, pollutes contributor analytics, and creates ambiguity in licensing-derived works. The sole authorship git resolves at commit time is the operator's own identity; the agent is the instrument the operator wields, not a co-author of record. A change-set that seems to need non-human attribution is a process failure resolved out-of-band (release notes, project docs, the PR description's tooling section), never inside git authorship metadata.
+
+### 5. CI-Green Discipline
+
+The change-set MUST be **CI-green** before the change is complete:
+
+- **Lint / format / type-check / test** — the host's full quality matrix passes. Lint findings are not deferred; type-check failures are not suppressed without justification; test failures are not skipped absent an explicit `@pytest.mark.skip` / equivalent annotation citing the reason.
+- **Coverage** — where the host enforces a threshold, the change-set holds coverage at or above it.
+- **Security scans** — CodeQL, Bandit, Trivy, gitleaks (where configured) report no new HIGH-severity findings.
+- **Build** — the host's build artifact (sdist + wheel for Python; `npm pack` for Node; `cargo build` for Rust) succeeds.
+- **Documentation build** — a Fumadocs / Docusaurus / Sphinx / equivalent docs build (where present) is clean.
+
+A CI failure is **diagnosed and fixed in the same change-set**, never deferred. Marking a CI failure flaky without diagnosis is itself a finding.
+
+### 6. Modern Project Surface
+
+Every host project — and apothem itself, by self-application — ships a **modern project surface** that any operator can install, update, and uninstall in seconds without reading the source. It has six required components.
+
+#### 6.1 Multi-OS Install Scripts
+
+Paired install scripts at the repository root, one per supported shell family:
+
+| Script | Hosts | Run-from-network form |
+|---|---|---|
+| `scripts/installer/install.sh` | macOS, Linux, WSL2, BSD, Termux, ChromeOS Linux container | `curl -fsSL <raw>/install.sh \| bash` |
+| `scripts/installer/install.ps1` | Windows PowerShell 5.1+, PowerShell 7+ on any platform | `irm <raw>/install.ps1 \| iex` |
+
+Both scripts MUST be **idempotent** (re-running on an existing checkout fast-forwards rather than failing or duplicating), **prerequisite-checked** (refuse to run when required tooling is missing), and **environment-configurable** (install destination, remote URL, target ref, skip flags). Each emits a clear next-steps banner on success. A project targeting one shell family declares the limitation explicitly in its README; silent omission is non-conformant.
+
+#### 6.2 Multi-OS Update / Auto-Update Path
+
+Every host project supports update via at least one of three paths: idempotent re-run of the install script; a dedicated `scripts/installer/update.sh` + `scripts/installer/update.ps1` pair; or an auto-update tool (CLI or scheduled task) that reports upstream commits and optionally fast-forwards.
+
+The auto-update tool MUST be **read-only by default** — a single invocation MUST NOT mutate the working tree without an explicit `--apply` / `-Apply` flag. A silently-mutating integration is non-conformant per M5 authority-inquiry: a silent fast-forward is silent override of the operator's working state.
+
+#### 6.3 Multi-OS Uninstall Path
+
+Paired uninstall scripts at the repository root: `scripts/installer/uninstall.sh` and `scripts/installer/uninstall.ps1`. Each script MUST:
+
+- **Confirm with the operator** before any destructive action (interactive prompt unless `--yes` / `-Yes`).
+- **Preserve operator state** — back up targets before removal, or delegate to a CLI that already backs up managed replacements; permanent deletion requires an explicit documented path.
+- **Refuse unsafe targets** (`$HOME`, `/`, an empty path, a directory failing the project's sentinel-file check).
+- **Clean up companion install state** (editable Python install, shell-profile environment-variable references) per the host's ratified install footprint.
+
+#### 6.4 Logo Asset
+
+Every host project ships a logo at the canonical location `assets/logo.svg`:
+
+- **SVG-first** (scalable, version-controllable, themable). A raster fallback at `assets/logo.png` (256×256) is acceptable; SVG is preferred.
+- **Wired into the README header** via a centered `<p align="center"><img src="assets/logo.svg" ...></p>` block as the first content element.
+- **Wired into the documentation site** via the host docs framework's logo hook.
+- **Accessible** — the `<img>` carries an `alt` attribute; the SVG carries `<title>` and `<desc>` elements.
+
+A project that has not yet authored a logo declares the absence in its README rather than leaving the header silent; the absence is a gap-surfacing per the parent rule's §5.
+
+#### 6.5 Modern README Header — MAXIMAL Pattern
+
+Every host project's `README.md` opens with the **MAXIMAL centered-header pattern** per `rules/sota-elevation.md` (the SOTA floor for OSS distribution projects):
+
+1. **Centered logo** per §6.4 — `<p align="center"><img src="assets/logo.svg" ...></p>` as the first content element.
+2. **Centered project title** — `<h1 align="center">`.
+3. **Centered one-sentence tagline** — `<p align="center"><em>`.
+4. **Centered badge row** covering the **closed-set of 8 header-link classes**:
+   1. **Build** — CI status (e.g., GitHub Actions build badge per workflow).
+   2. **License** — SPDX-form license badge (MIT / Apache-2.0 / etc.).
+   3. **Version** — PyPI / npm / crates.io / equivalent registry version badge, dynamic per `rules/dynamism.md`.
+   4. **Coverage** — Codecov / Coveralls / equivalent line+branch threshold badge (≥ 80% where the host has ratified a threshold).
+   5. **OSSF Scorecard** — Scorecard.dev badge for supply-chain posture.
+   6. **Community** — Discord / Slack / chat-channel badge linking the live community.
+   7. **Docs** — documentation-site link badge (Read the Docs / Fumadocs / equivalent).
+   8. **Downloads** — PyPI / npm / crates.io downloads-per-month badge (dynamic per `rules/dynamism.md`).
+5. **Centered nav strip** linking to `Install` / `Quick tour` / `Documentation` / `Changelog` / `Contributing` (and optionally `Community` / `Sponsors`).
+6. **Horizontal rule** separating the header from the body.
+
+**Rich-content surface (also MAXIMAL).** Following the header, the README MUST carry:
+
+- **Animated demo or feature screenshot** near the top — a short GIF / SVG / WebP showing the core value-proposition in under 10 seconds, positioned immediately after the horizontal rule.
+- **Feature matrix** — a compact table of primary capabilities surfacing SOTA differentiators relative to the named-exemplar cohort at `rules/sota-elevation-exemplars.md` §2.
+- **Quick Start ≤ 3 commands** — install / configure / first-run as three shell lines or fewer; operators MUST reach a working first run without scrolling past Quick Start.
+- **Dedicated sections** — `## Install` (with the §6.6 sub-paths) + `## Updating` + `## Uninstalling` + (where applicable) `## Auto-update`, each carrying concrete invocations.
+- **Community + Support** at the tail — community-channel link + sponsorship / funding (where a `.github/FUNDING.yml` exists) + Showcase / Users + Blog / RSS.
+
+The centering uses inline HTML inside Markdown — the GitHub-rendered conventional pattern, not a custom convention. A project shipping below this MAXIMAL floor is non-conformant against M15 + `rules/sota-elevation.md`; the gap surfaces as a finding per §5.
+
+#### 6.6 Installation Guide
+
+Every README carries an `## Install` section with at least three sub-paths: a **one-shot installer** (the curl / iwr-piped command for both shell families, in a two-row table), a **manual install** (`git clone` + dependency-install + verification, for operators who decline pipe-to-shell), and a **verify the install** sub-path (the post-install verification commands). Plus `## Updating`, `## Uninstalling`, and (where applicable) `## Auto-update` subsections with concrete invocations.
+
+#### 6.7 Self-Application Surface
+
+Apothem itself ships every component above: `scripts/installer/install.{sh,ps1}` + `scripts/installer/update.{sh,ps1}` + `scripts/installer/uninstall.{sh,ps1}`, `scripts/dev/auto_update.py` (read-only check; `--apply` to fast-forward), `assets/logo.svg` (hexagonal three-layer architecture mark), and the README's modern header + Install / Updating / Uninstalling / Auto-update sections.
+
+## Enforcement
+
+Path-filtered (the eleven glob patterns in this rule's `pathFilter` field), demand-loaded companion to `rules/production-ready-prs.md`. The parent rule retains the same-change-set discipline (§1), the gap-surfacing summary (§5), the disclosure surface, the failure tells, and the bindings; this companion carries the visibility-surface catalog, the supply-chain table, the release-engineering invariants, the commit-message convention detail, the CI-green catalog, and the modern-project-surface specification. Together the parent and companion constitute the canonical specification for **M15 — Production-Ready Discipline on Host-Project Artifacts**.
+
+## Bindings (§0.j five-direction)
+
+- **Drives →** ● Every visibility-surface artifact emission across every host project (README / CHANGELOG / CONTRIBUTING / LICENSE / SECURITY / SUPPORT / CODEOWNERS / `.github/**` / install / update / uninstall scripts). ● The seven visibility surfaces' continuous maintenance across the host's lifecycle. ● The modern-project-surface ratifications at every install / update / uninstall / logo / README-header touch. ● The commit-message human-only-authorship clause at every git-write touch.
+- **Satisfies →** ● the fifteen-mandate registry row **M15 — Production-Ready** (companion sub-rule scope). ● `rules/production-ready-prs.md` anchor lines pointing here for the moved sections.
+- **Established by ↑** ● `rules/production-ready-prs.md` (parent-rule anchor). ● the fifteen-mandate registry (ratifies M15). ● Keep-a-Changelog convention (the upstream changelog standard). ● Conventional Commits specification (the upstream commit-message convention).
+- **Gated by ←** ● The path-filter (the eleven glob patterns) — this rule demand-loads only on visibility-surface artifact touches. ● `rules/production-ready-prs.md` always-on baseline (parent rule's anchor lines must be live for the companion to demand-load coherently).
+- **Cross-bound with ↔** ↔ `rules/production-ready-prs.md` (parent rule; anchor lines bind this companion). ↔ `rules/authority-inquiry.md` (M5 — visibility-gap inquiries route through the canonical channel). ↔ `rules/option-annotation.md` (M7 — every visibility-gap inquiry's option set carries the Recommended marker plus concrete-driver rationale). ↔ `rules/host-discovery.md` (M1 — commit-message convention, action-pinning policy, release-signing requirement all discovered). ↔ `rules/disclosure-ledger.md` (M2 — production-ready outcomes recorded in the ledger). ↔ `rules/sota-elevation.md` (production-ready surfaces are the floor; SOTA lifts the ceiling on those same surfaces).