Keep DB content out of the coordination repo + resite runbook

[hyperpolymath]

Problem

nextgen-databases documents itself as a thin coordination repo — EXPLAINME.adoc and 0-AI-MANIFEST.a2ml both say "no implementation code lives here" — but it physically contains ~16,000 files of full database implementations (verisimdb/, lithoglyph/, nqc/, typeql-experimental/, quandledb/, verisim-core/, verisim-modular-experiment/), committed as plain directories.

There was no top-level guardrail (no root CLAUDE.md/AGENTS.md/.claude/), and the only AI entry point policed SCM-file placement only. So LLMs landing here naturally edit/add per-database content in place instead of in each database's own repo.

This PR — Prevention (stops the drift, lands now)

• CLAUDE.md / AGENTS.md (new) — blunt coordination-only instructions for agents.
• REGISTRY.adoc (new) — authoritative map of each database/query-language → its own repo.
• 0-AI-MANIFEST.a2ml — new top invariant "Coordination only — no implementation"; fixed the <!-- CUSTOMIZE --> structure placeholder and satellite list.
• .machine_readable/6a2/AGENTIC.a2ml — extended [agent-constraints] with the no-DB-implementation rule.
• CONTRIBUTING.md — replaced the inaccurate single-project tree with the real structure + a "what belongs here vs. a database repo" section.
• .github/workflows/placement-guard.yml (new) — CI gate that fails a PR/push adding files outside the coordination allowlist; legacy DB dirs are grandfathered (warn) until extracted.
• .claude/settings.json + .claude/hooks/block-db-writes.sh (new) — local PreToolUse hook that blocks creating new per-database files and names the correct destination repo (verified locally; allows edits to existing files during the transition).

Deferred — Remediation (resite, executed later)

• docs/migration/RESITE-DATABASES-TO-OWN-REPOS.adoc (new) — history-preserving extraction runbook, source→destination mapping, and the open decisions.
• scripts/resite/extract-subdir.sh (new) — git filter-repo helper (review-only; does not push).

The actual extraction (moving content to other repos, creating lithoglyph/glyphbase/gnpl/nqc, history rewrites) is not in this PR — it needs GitHub scope beyond nextgen-databases and a few open decisions resolved.

Open decisions (see runbook / registry)

• typeql-experimental → standalone vcl-ut, or fold into verisimdb?
• verisim-core → own repo, or fold into verisimdb?
• verisim-modular-experiment (research-only) → research repo, or documented exception?
• gnpl name + un-nesting gql-dt now vs. later (deep storage coupling).
• New-repo visibility; existing-repo empty-vs-populated; submodules vs. registry-only references.

Verification done

• Pre-write hook: blocks new verisimdb//glyphbase/ files (with correct destination), allows README.adoc edits, new coordination docs, research dir, and non-write tools.
• CI guard: classifies all 8 new files as ALLOW (no self-flagging), flags a hypothetical newdb/schema.sql as misplaced, warns on grandfathered dirs.
• sh -n clean on both scripts; settings.json valid JSON.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W8DXRHQRBgxwSdDz8om287

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 261 issues detected

Severity	Count
🔴 Critical	40
🟠 High	120
🟡 Medium	101

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "missing_timeout_minutes",
    "file": "instant-sync.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[github-actions]

🔍 Hypatia Security Scan

Findings: 260 issues detected

Severity	Count
🔴 Critical	40
🟠 High	120
🟡 Medium	100

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "missing_timeout_minutes",
    "file": "instant-sync.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence