From 8a4df48bc1c7a0e000ba6172f77d121bc39f77f9 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 24 Jun 2026 16:36:13 +0100
Subject: [PATCH] feat(autolinks): canonical estate autolink registry (source
 of truth)

Single source of truth for GitHub custom autolinks, reconciled estate-wide by
the farm sweep + inherited via the template (per-repo feature, no org default).
A=RUSTSEC/GHSA/CVE/RFC, ADR=per-repo decision records, PROV=hub (trial),
CLADE=<binomial> (pending the gv-clade-index Worker route + domain).
---
 .machine_readable/autolinks.a2ml | 66 ++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 .machine_readable/autolinks.a2ml

diff --git a/.machine_readable/autolinks.a2ml b/.machine_readable/autolinks.a2ml
new file mode 100644
index 00000000..d01edf14
--- /dev/null
+++ b/.machine_readable/autolinks.a2ml
@@ -0,0 +1,66 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# autolinks.a2ml — canonical estate-wide GitHub custom-autolink registry.
+# SINGLE SOURCE OF TRUTH. GitHub custom autolinks are per-repo (no org-level
+# setting), so the farm sweep reconciles every repo's autolinks to match this
+# (idempotent: GET -> delete-stale -> create-missing) and the repo template
+# references it so new repos inherit it. Built-in `owner/repo#123` already
+# covers cross-repo refs; custom autolinks only match `PREFIX+id`, never words.
+#
+# Fields: key_prefix (trigger), url_template (<num> = text after prefix),
+#   alnum (true: letters/digits/hyphens in <num>; false: digits only),
+#   scope ("estate" = same url everywhere | "per-repo" = {repo} substituted),
+#   note (rationale / status).
+
+version = "1.0.0"
+
+# ---- A. Security & standards vocabulary (estate-wide, pure win) ----
+[[autolink]]
+key_prefix = "RUSTSEC-"
+url_template = "https://rustsec.org/advisories/RUSTSEC-<num>.html"
+alnum = true
+scope = "estate"
+
+[[autolink]]
+key_prefix = "GHSA-"
+url_template = "https://github.com/advisories/GHSA-<num>"
+alnum = true
+scope = "estate"
+
+[[autolink]]
+key_prefix = "CVE-"
+url_template = "https://nvd.nist.gov/vuln/detail/CVE-<num>"
+alnum = true
+scope = "estate"
+
+[[autolink]]
+key_prefix = "RFC-"
+url_template = "https://www.rfc-editor.org/rfc/rfc<num>.html"
+alnum = false
+scope = "estate"
+
+# ---- ADR (per-repo: each repo's ADR-<n> links to ITS OWN decision records) ----
+[[autolink]]
+key_prefix = "ADR-"
+url_template = "https://github.com/hyperpolymath/{repo}/blob/main/docs/decisions/ADR-<num>.adoc"
+alnum = false
+scope = "per-repo"
+
+# ---- PROV (hub shorthand — kept on trial; trivially removable) ----
+[[autolink]]
+key_prefix = "PROV-"
+url_template = "https://github.com/hyperpolymath/proven/issues/<num>"
+alnum = false
+scope = "estate"
+
+# ---- CLADE (the centerpiece: <binomial> = genus-species[-subspecies]) ----
+# PENDING: a gv-clade-index Worker route that resolves a binomial (e.g. /c/:binomial)
+# + the Worker's public domain. url_template below is provisional until confirmed;
+# the sweep will skip CLADE- until status="ready".
+[[autolink]]
+key_prefix = "CLADE-"
+url_template = "https://CLADE-WORKER-DOMAIN/c/<num>"
+alnum = true
+scope = "estate"
+status = "pending-worker-route"