feat(catalog): configurable cartridges root + canonical schema + category field sweep

[hyperpolymath]

Summary

Three changes that prepare boj-server to consume cartridges from the new hyperpolymath/boj-server-cartridges repository on demand instead of bundling them in-tree:

1. Configurable cartridges root

elixir/lib/boj_rest/application.ex gains a fallback chain:

Application env (:boj_rest, :cartridges_root)
  → BOJ_CARTRIDGES_PATH environment variable
  → default "./cartridges" (preserves historical bundled behaviour)

Operators wanting on-demand fetch set BOJ_CARTRIDGES_PATH to their local cache (e.g. ~/.boj/cartridges/) and arrange for tray to populate it. No runtime change unless the env var is set.

2. Canonical schema mirror

schemas/cartridge-v1.json is replaced with a vendored copy of the canonical schema filed as standards#200 — which expands the original -mcp-only name regex to admit the full BoJ server-role taxonomy: (mcp|lsp|dap|bsp|debug|format|lint|build|nesy|agentic|fleet), and adds category, states, source fields. schemas/SCHEMA-MIRROR.md documents the mirror discipline + the pending SHA-pinning ceremony (executes once standards#200 merges).

3. category field sweep on 125 cartridge manifests

The new schema makes category required. Mechanical sweep assigns:

• "category": "template" (1: gossamer-mcp)
• "category": "cross-cutting" (11: agent-mcp, claude-agents-power-mcp, claude-ai-mcp, local-coord-mcp, model-router-mcp, nesy-mcp, ml-mcp, fleet-mcp, boj-health, dap-mcp, bsp-mcp)
• "category": "domain" (113)

Matches the taxonomy ratified in boj-server-cartridges ADR-001.

Deferred to follow-up PRs

• tray → boj-server-cartridges on-demand fetch wiring (tray has the cartridge-source subscription concept already in tray/src/main.rs / server.rs; needs default registry configured).
• BojRest.Catalog reload-without-restart.
• Strict SHA-pin of local schema mirror to a specific standards commit + sha256 (pending standards#200 merge).

Test plan

• All 125 cartridge manifests gain category field at correct value
• Schema admits all 11 canonical role suffixes
• BOJ_CARTRIDGES_PATH=/foo bin/boj-server would read from /foo (manual trace)
• Default behaviour unchanged when neither Application env nor BOJ_CARTRIDGES_PATH set
• CI green
• Validate all 125 manifests against the new schema (follow-up; tooling TBD)

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 151 issues detected

Severity	Count
🔴 Critical	18
🟠 High	124
🟡 Medium	9

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/main.d.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/boj-server/boj-server/src/abi/Boj/SafeHTTP.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[github-actions]

🏁 path-claims bench

Commit 0ac68fb

Numbers

path-claims bench  (node v22.22.3)

  scenario                                              iters       ms        ns/op          ops/s
  --------------------------------------------------------------------------------------------------------------
  register: 10 active claims, 3 new paths               50000 iters    181 ms      3.63 µs/op    275.4k ops/s
  register: 100 active claims, 3 new paths              20000 iters    326 ms     16.34 µs/op     61.2k ops/s
  register: 1000 active claims, 3 new paths              5000 iters    954 ms    190.94 µs/op      5.2k ops/s
  register: 100 active claims, 20 new paths              5000 iters    375 ms     75.15 µs/op     13.3k ops/s

  pathsOverlap: deep diverge at segment 4             1000000 iters    154 ms     154.1 ns/op     6.49M ops/s
  pathsOverlap: short prefix match                    1000000 iters    133 ms     133.2 ns/op     7.51M ops/s

  refresh (existing claim)                             100000 iters     10 ms     109.6 ns/op     9.13M ops/s
  list (100 active claims)                              50000 iters    277 ms      5.55 µs/op    180.0k ops/s

  (Bench numbers depend on host; use deltas across commits, not absolute values.)

Host-dependent — compare deltas across commits, not absolute values.