feat(rsr-certifier): BoJ-first 3-tier compliance in the VS Code extension

[hyperpolymath]

Rewires the AffineScript VS Code extension from CLI-only (honest placeholders) to a real three-tier compliance resolver, and brings the vendored runtime adapter up to the current compiler contract.

Tiers (BoJ-first — boj-server is the canonical provider for tooling surfaces; standalone rsr LSP/CLI are fallbacks):

1. PRIMARY — BoJ reposystem-mcp tool reposystem_run_audit via in-process JSON POST to boj-server (httpPostJson, affinescript#210). Configurable rsr.bojEndpoint/rsr.repoName; default http://127.0.0.1:7700/cartridge/reposystem-mcp/invoke.
2. FALLBACK — standalone rsr LSP via languageClientSendRequest "workspace/executeCommand" cmd rsr.checkCompliance (the method the server actually answers), settled with the #205 thenable primitives (#199 closure callback + thenableResultJson), fields read via jsonField (affinescript#211).
3. LAST RESORT — rsr CLI (always-reachable floor; never worse than before).

Cascades on error/empty/unusable payload. Kills all four dishonest placeholders (top note, webview, status-bar tier, faked-silver badge). Command registration migrated to the #199 function-value ABI.

affine-vscode-adapter.cjs is now vendored byte-for-byte from affinescript packages/affine-vscode/mod.js (MIT header to match this subtree) — the contract-matched runtime (post-#199 closure-pointer + #205 + #210 + #211). The prior hand-port predated #199 (stale wrapHandler, no async surface); verified strict superset — zero externs lost, 4 gained, so no regression.

README: corrected the LSP Methods table — it documented custom rsr/* requests the server never implemented; now lists the real workspace/executeCommand commands + diagnostics.

Not wired: withProgress — withProgressNotification is declared in stdlib but has no wasm/Node runtime impl yet (calling it would fault); tracked follow-up, does not affect tier correctness.

Verification: compiles clean (resolve/typecheck/borrow/codegen) with the affinescript main compiler incl. #210/#211; out/extension.cjs regenerated; adapter confirmed to bind every imported extern; index.cjs wiring unchanged. Live-VS-Code-host runtime behaviour is not exercised here (no host available) — the CLI tier guarantees the extension is never worse than before.

This is the PR-5d-B pilot: the first real consumer of #205, which surfaced three genuine ABI gaps now resolved at source (httpPostJson #210, jsonField #211, withProgressNotification impl tracked).

Refs hyperpolymath/affinescript#103 hyperpolymath/affinescript#199 hyperpolymath/affinescript#205

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 101 issues detected

Severity	Count
🔴 Critical	63
🟠 High	28
🟡 Medium	10

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence