chore(ci)!: exit Ruby; Pages builds on Bun/Node, adapters are the exc…

.editorconfig

@@ -11,6 +11,8 @@ insert_final_newline = true
 trim_trailing_whitespace = true
 [*.md]
 trim_trailing_whitespace = false
+[*.{js,mjs,cjs}]
+indent_size = 2
 [*.adoc]
 [*.rs]
 indent_size = 4

.gitattributes

@@ -7,6 +7,8 @@
 *.ex    text eol=lf diff=elixir
 *.exs   text eol=lf diff=elixir
 *.jl    text eol=lf
+*.mjs   text eol=lf
+*.js    text eol=lf
 *.res   text eol=lf
 *.resi  text eol=lf
 *.ada   text eol=lf diff=ada

.github/dependabot.yml

@@ -14,6 +14,16 @@ updates:
         patterns:
           - "*"
     open-pull-requests-limit: 2
+    # Ruby is a banned language for this estate, so Ruby tooling is not a
+    # dependency we maintain — the correct response to a `ruby/setup-ruby` bump
+    # is to delete the action, not to bump it. Ignoring these two keeps
+    # Dependabot from spending a slot (open-pull-requests-limit: 2) on a PR that
+    # policy requires closing, in this repo and in any repo still carrying the
+    # retired Jekyll Pages workflow while the estate-wide exit completes.
+    # See docs/decisions/ADR-0002-ruby-banned-except-adapters.adoc.
+    ignore:
+      - dependency-name: "ruby/setup-ruby"
+      - dependency-name: "actions/jekyll-build-pages"
 
   # Rust/Cargo
   - package-ecosystem: "cargo"

.github/workflows/actions.lock

@@ -22,21 +22,14 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/instant-sync.yml':
         - 'peter-evans/repository-dispatch@v4.0.1'
-    '.github/workflows/jekyll-gh-pages.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'actions/configure-pages@v6.0.0'
-        - 'actions/deploy-pages@v5.0.1'
-        - 'actions/jekyll-build-pages@v1.0.13'
-        - 'actions/upload-pages-artifact@v5.0.0'
-    '.github/workflows/jekyll.yml':
+    '.github/workflows/label-triage.yml': []
+    '.github/workflows/labels.yml': []
+    '.github/workflows/mirror.yml': []
+    '.github/workflows/pages.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/configure-pages@v6.0.0'
         - 'actions/deploy-pages@v5.0.1'
         - 'actions/upload-pages-artifact@v5.0.0'
-        - 'ruby/setup-ruby@v1.321.0'
-    '.github/workflows/label-triage.yml': []
-    '.github/workflows/labels.yml': []
-    '.github/workflows/mirror.yml': []
     '.github/workflows/push-email-notify.yml':
         - 'hyperpolymath/smtp-notify-action@v0.3.0'
     '.github/workflows/quality.yml':
@@ -72,11 +65,6 @@ dependencies:
         commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
         owner_id: 44036562
         repo_id: 438112499
-    'actions/jekyll-build-pages@v1.0.13':
-        ref: 'v1.0.13'
-        commit: 'sha1-44a6e6beabd48582f863aeeb6cb2151cc1716697'
-        owner_id: 44036562
-        repo_id: 438323626
     'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
         ref: 'v7.0.0'
         commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
@@ -124,8 +112,3 @@ dependencies:
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
         owner_id: 18365890
         repo_id: 220359305
-    'ruby/setup-ruby@v1.321.0':
-        ref: 'v1.321.0'
-        commit: 'sha1-95ef2b042f9d7a56d8268cba8559e2842e2ad01b'
-        owner_id: 210414
-        repo_id: 231208785

.github/workflows/pages.yml

@@ -0,0 +1,117 @@
+# SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
+#
+# Pages deploy for verisimdb-data — Ruby-free by policy.
+#
+# Replaces two retired workflows, both of which put Ruby on the critical path:
+#   * jekyll.yml           — ruby/setup-ruby + `bundle exec jekyll build`. It had no
+#                            Gemfile to bundle against and failed with startup_failure
+#                            on every push to main (last observed 2026-09-21).
+#   * jekyll-gh-pages.yml  — actions/jekyll-build-pages, a container whose only job is
+#                            to run Jekyll (Ruby). It published the whole repository tree.
+#
+# The build is now scripts/build-site.mjs, run under Bun (tier 1 per LANGUAGE-POLICY §1)
+# with a Node >= 18 fallback. Zero dependencies, so no lockfile and no package-manager
+# tier to reconcile with runtime-policy.yml. Publish surface is the allowlist in
+# site.json. Ruby is banned for this estate; see docs/decisions/ADR-0002.
+name: Deploy Pages site
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "index.json"
+      - "scans/**"
+      - "dispatch/**"
+      - "outcomes/**"
+      - "patterns/**"
+      - "recipes/**"
+      - "health/**"
+      - "policy/**"
+      - "docs/**"
+      - "www/**"
+      - "README.adoc"
+      - "LICENSE"
+      - "site.json"
+      - "scripts/build-site.mjs"
+      - ".github/workflows/pages.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+
+      - name: Setup Pages
+        id: pages
+        uses: actions/configure-pages@v6.0.0
+
+      - name: Build site and prove reproducibility
+        env:
+          BASE_PATH: ${{ steps.pages.outputs.base_path }}
+        run: |
+          set -euo pipefail
+          if command -v bun >/dev/null 2>&1; then
+            runtime="bun run"
+          else
+            runtime="node"
+          fi
+          echo "build runtime: $runtime (Bun tier 1; Node >= 18 is the preinstalled fallback)"
+          $runtime scripts/build-site.mjs --baseurl "$BASE_PATH" | tee /tmp/build-1.log
+          rm -rf _site
+          $runtime scripts/build-site.mjs --baseurl "$BASE_PATH" | tee /tmp/build-2.log
+          first=$(sed -n 's/.*\(sha256=[0-9a-f]\{64\}\).*/\1/p' /tmp/build-1.log | head -1)
+          second=$(sed -n 's/.*\(sha256=[0-9a-f]\{64\}\).*/\1/p' /tmp/build-2.log | head -1)
+          if [ -z "$first" ] || [ "$first" != "$second" ]; then
+            echo "::error::site build is not reproducible ($first vs $second)"
+            exit 1
+          fi
+          echo "reproducible site build: $first"
+
+      - name: Guard the machine-readable root
+        run: |
+          set -euo pipefail
+          # '/' on this site is an API endpoint: GitHub Pages serves index.json as the
+          # directory index, and a root index.html would take that over and change the
+          # content type consumers see. The human hub lives at /hub/ instead.
+          if [ -e _site/index.html ]; then
+            echo "::error::refusing to publish _site/index.html; '/' must serve index.json"
+            exit 1
+          fi
+          for required in index.json .well-known/security.txt; do
+            if [ ! -f "_site/$required" ]; then
+              echo "::error::required published path missing from the build: $required"
+              exit 1
+            fi
+          done
+          echo "publish surface OK ($(find _site -type f | wc -l | tr -d ' ') files)"
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v5.0.0
+        with:
+          path: _site
+          # upload-pages-artifact strips dot-entries by default (its tar runs
+          # --exclude=.[^/]*), which silently removes .well-known/ and .nojekyll.
+          include-hidden-files: true
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v5.0.1