fix: eradicate local flext, adopt canonical src layout, owner-first cutover

.beads/config.yaml

@@ -7,8 +7,8 @@
 # ledger_prefix is an optional distinct issue-prefix override.
 # Source: dolt server block = flext-infra config/codegen.yaml
 # toolchain.beads.server (machine-wide shared Dolt server facts).
-# Routing-only client config: this attached standalone owns no tracker state;
-# bd commands route to the shared ledger below. Local data is never written.
+# Owned ledger config: the workspace root owns this tracker; conform
+# initializes and verifies it against the pinned binary.
 issue-prefix: "mcb"
 
 # Dolt shared-server connection (machine-wide shared server on :3308).

.continue/rules/mcb.md

@@ -2,6 +2,7 @@
 name: MCB Project Rules
 globs: ["**/*.rs", "**/*.toml", "**/*.md"]
 ---
+
 <!-- generated by `make gen-agent-pointers`; source: AGENTS.md -->
 # MCB — Continue.dev Rules
 

.github/ISSUE_TEMPLATE/bug_report.md

@@ -13,10 +13,10 @@ A clear and concise description of what the bug is.
 **To Reproduce**
 Steps to reproduce the behavior:
 
-1.  Go to '...'
-2.  Click on '....'
-3.  Scroll down to '....'
-4.  See error
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
 
 **Expected behavior**
 A clear and concise description of what you expected to happen.
@@ -26,16 +26,16 @@ If applicable, add screenshots to help explain your problem.
 
 **Desktop (please complete the following information):**
 
--   OS: [e.g. iOS]
--   Browser [e.g. chrome, safari]
--   Version [e.g. 22]
+- OS: [e.g. iOS]
+- Browser [e.g. chrome, safari]
+- Version [e.g. 22]
 
 **Smartphone (please complete the following information):**
 
--   Device: [e.g. iPhone6]
--   OS: [e.g. iOS8.1]
--   Browser [e.g. stock browser, safari]
--   Version [e.g. 22]
+- Device: [e.g. iPhone6]
+- OS: [e.g. iOS8.1]
+- Browser [e.g. stock browser, safari]
+- Version [e.g. 22]
 
 **Additional context**
 Add any other context about the problem here.

.github/dependabot.yml

@@ -7,12 +7,6 @@ updates:
       interval: weekly
     open-pull-requests-limit: 5
     labels: [dependencies, github-actions]
-  - package-ecosystem: devcontainers
-    directory: /
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    labels: [dependencies, devcontainers]
 
   - package-ecosystem: pip
     directory: /

.github/workflows/ci-matrix.yml

@@ -44,6 +44,8 @@ jobs:
     # full project bootstrap at image-build time), then smoke the verb surface
     # inside the built container.
     runs-on: ubuntu-latest
+    env:
+      CI: Y
     strategy:
       fail-fast: false
       matrix:
@@ -78,6 +80,8 @@ jobs:
       CI: Y
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           submodules: false
           # No step needs authenticated git after checkout; persisting the
@@ -112,6 +116,8 @@ jobs:
       CI: Y
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           submodules: false
           # No step needs authenticated git after checkout; persisting the

.github/workflows/docs.yml

@@ -88,7 +88,7 @@ jobs:
           }
 
       # mro-o6h5 (agent: kimi) — include-hidden-files: .reports/ is a dot-dir and
-      # upload-artifact v4 skips hidden paths by default (artifact silently empty).
+      # upload-artifact skips hidden paths by default (artifact silently empty).
       - name: Upload docs reports on failure
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1

.gitignore

@@ -280,44 +280,6 @@ skill-create-output/
 .mcp.json
 CLAUDE.local.md
 
-# BLOCK: machine-local build/editor configuration.
-# These encode one workstation (linker, job counts, cache sizes, editor state)
-# and break every other environment when versioned. Keep them on disk, out of git.
-# Leading slash anchors each rule to the repository root, so test fixtures that
-# legitimately ship their own .cargo/ or editor files stay tracked.
-/.cargo/
-/.vscode/
-/.waza.yaml
-/opencode.jsonc
-
-# BLOCK: tool output. Reports are produced by a gate, never authored.
-# Regenerate with the owning make verb instead of committing a snapshot.
-*.sarif
-*violations*.txt
-build_err.txt
-clippy_output.txt
-validate_output.txt
-test_003_warnings.txt
-staged_files.txt
-pr[0-9]*_comments.txt
-coverage/
-
-# BLOCK: compiled and captured test artifacts
-*.rlib
-/data/vectors/
-/crates/mcb-providers/src/database/sqlite/test_file.txt
-
-# BLOCK: captured runtime logs. tests/mcb.<date> is server stdout, not a test.
-tests/mcb.[0-9]*
-
-# BLOCK: agent/session scratch
-tmp_*.txt
-.beads.gate.lock
-
-# BLOCK: parallel documentation tree. docs/ is the single documentation owner
-# (Law 4). context/ duplicated it and described dill/figment, removed by ADR-050/051.
-/context/
-
 # Tracked managed artifacts
 !.github/ci-template/
 !.github/ci-template/ci.yml
@@ -343,9 +305,33 @@ tmp_*.txt
 !.github/workflows/ci-matrix.yml
 !.github/workflows/ci.yml
 !.github/workflows/docs.yml
-!.github/workflows/release-binaries.yml
+!.github/workflows/release.yml
 !sgconfig.yml
+!.vscode/settings.json
 !LICENSE
 !config/
 !config/workspace.yaml
 !custom.mk
+
+# Project-local exceptions (config/workspace.yaml overlay)
+/.archive/
+/.cargo/
+/.vscode/
+/.waza.yaml
+/opencode.jsonc
+*.sarif
+*violations*.txt
+build_err.txt
+clippy_output.txt
+validate_output.txt
+test_003_warnings.txt
+staged_files.txt
+pr[0-9]*_comments.txt
+coverage/
+*.rlib
+/data/vectors/
+/crates/mcb-providers/src/database/sqlite/test_file.txt
+tests/mcb.[0-9]*
+tmp_*.txt
+.beads.gate.lock
+/context/

.markdownlintignore

@@ -13,3 +13,5 @@ tests/node_modules
 context/
 book/
 docs/superpowers/
+.serena/memories/
+crates/mcb-validate/tests/fixtures/rustlings/