feat: adopt contractile system

Scaffolded via contractile init with Physical State checks,
integrity verifications, source rollback, and roadmap tracking.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

contractile.just

@@ -0,0 +1,75 @@
+# Auto-generated by: contractile gen-just
+# Source directory: contractiles
+# Re-generate with: contractile gen-just --dir contractiles
+#
+# SPDX-License-Identifier: PMPL-1.0-or-later
+
+# === DUST (Recovery & Rollback) ===
+# Source: Dustfile.a2ml
+
+# List available dust recovery actions
+dust-status:
+    @echo '  dust-source-rollback: Revert all source changes to last commit [rollback]'
+
+# Revert all source changes to last commit
+dust-source-rollback:
+    @echo 'Executing rollback for source-rollback'
+    git checkout HEAD -- .
+
+
+# === INTEND (Declared Future Intent) ===
+# Source: Intentfile.a2ml
+
+# Display declared future intents
+intend-list:
+    @echo '=== Declared Intent ==='
+    @echo ''
+    @echo 'Features:'
+    @echo ''
+    @echo 'Quality:'
+
+
+# === MUST (Physical State Checks) ===
+# Source: Mustfile.a2ml
+
+# Run all must checks
+must-check: must-license-present must-readme-present must-spdx-headers must-no-banned-files
+    @echo 'All must checks passed'
+
+# LICENSE file must exist
+must-license-present:
+    test -f LICENSE
+
+# README must exist
+must-readme-present:
+    test -f README.adoc || test -f README.md
+
+# Source files should have SPDX license headers
+must-spdx-headers:
+    find . -name '*.rs' -o -name '*.res' -o -name '*.gleam' | head -20 | xargs -r grep -L 'SPDX-License-Identifier' | wc -l | grep -q '^0$'
+
+# No Dockerfiles or Makefiles
+must-no-banned-files:
+    test ! -f Dockerfile && test ! -f Makefile
+
+
+# === TRUST (Integrity & Provenance Verification) ===
+# Source: Trustfile.a2ml
+
+# Run all trust verifications
+trust-verify: trust-license-content trust-no-secrets-committed trust-container-images-pinned
+    @echo 'All trust verifications passed'
+
+# LICENSE contains expected SPDX identifier
+trust-license-content:
+    grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE
+
+# No .env or credential files in repo
+trust-no-secrets-committed:
+    test ! -f .env && test ! -f credentials.json && test ! -f .env.local
+
+# Containerfile base images use pinned digests
+trust-container-images-pinned:
+    test ! -f Containerfile || grep -q '@sha256:' Containerfile
+
+

contractiles/dust/Dustfile.a2ml

@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Dustfile (A2ML Canonical)
+
+@abstract:
+Recovery and rollback paths for php-aegis.
+Declares how to undo significant state changes.
+@end
+
+@requires:
+- section: Source
+@end
+
+## Source
+
+### source-rollback
+- description: Revert all source changes to last commit
+- rollback: git checkout HEAD -- .
+- blast_radius: file
+- precondition: git stash
+- notes: Stashes uncommitted work before reverting

contractiles/lust/Intentfile.a2ml

@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Intentfile (A2ML Canonical)
+
+@abstract:
+Declared future intent for php-aegis.
+@end
+
+@requires:
+- section: Features
+- section: Quality
+@end
+
+## Features
+
+### initial-release
+- description: Ship v1.0.0
+- status: in-progress
+- priority: critical
+
+## Quality
+
+### test-coverage
+- description: Achieve meaningful test coverage
+- status: declared
+- priority: medium

contractiles/must/Mustfile.a2ml

@@ -0,0 +1,33 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Mustfile (A2ML Canonical)
+
+@abstract:
+Physical State contract for php-aegis.
+Declares what must be true about this project's files and configuration.
+@end
+
+@requires:
+- section: Checks
+@end
+
+## Checks
+
+### license-present
+- description: LICENSE file must exist
+- run: test -f LICENSE
+- severity: critical
+
+### readme-present
+- description: README must exist
+- run: test -f README.adoc || test -f README.md
+- severity: critical
+
+### spdx-headers
+- description: Source files should have SPDX license headers
+- run: find . -name '*.rs' -o -name '*.res' -o -name '*.gleam' | head -20 | xargs -r grep -L 'SPDX-License-Identifier' | wc -l | grep -q '^0$'
+- severity: warning
+
+### no-banned-files
+- description: No Dockerfiles or Makefiles
+- run: test ! -f Dockerfile && test ! -f Makefile
+- severity: critical

contractiles/trust/Trustfile.a2ml

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Trustfile (A2ML Canonical)
+
+@abstract:
+Integrity and provenance verification for php-aegis.
+@end
+
+@requires:
+- section: Verifications
+@end
+
+## Verifications
+
+### license-content
+- description: LICENSE contains expected SPDX identifier
+- command: grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE
+- severity: warning
+
+### no-secrets-committed
+- description: No .env or credential files in repo
+- command: test ! -f .env && test ! -f credentials.json && test ! -f .env.local
+- severity: critical
+
+### container-images-pinned
+- description: Containerfile base images use pinned digests
+- command: test ! -f Containerfile || grep -q '@sha256:' Containerfile
+- severity: warning