feat(nue-color): establish the NUE COLOR origin monorepo

[Nuropunk]

The problem

NUE currently lives across ~50 private repositories in three orgs (Nuropunk, nuecolor, elocremarc) with:

• duplicate names across orgs — nue-color ×2, nueEngine3 ×2 (plus nueengine3), nue-star ×2, nue-color-engine ×2
• pointer files instead of structure — several repos carry a NUE_PRIMARY_REPO.md redirecting to whichever repo was primary that month
• drifting canon — the Five Truths, POM's nine dimensions and the Trinity are restated in several places, and restatements diverge

Meaning cannot be verified across fifty disconnected histories. If the Five Truths are written down in six repos, there are six definitions, and nobody knows which one a given color was scored against.

The approach

This applies the principle behind Cursor's Origin git hosting — an append-only log is the source of truth and the on-disk repo is a rebuildable cache — to meaning instead of packfiles.

Origin	NUE COLOR
WAL in object storage is truth	canon/ledger/*.jsonl is truth
On-disk repo is a rebuildable cache	colors, scores, masks, sounds are derived artifacts
A push is acked only when durably logged	a Gauntlet pass completes only when stage 8 confirms the write

The payoff is the same: throw away everything except the log and rebuild the world. node tools/verify.mjs does exactly that on every run.

What's here

canon/            normative specs + the append-only ledger — the source of truth
packages/         nine zero-dependency engines
apps/nue-color/   the app you run, with NUE as the interface
labs/brainbow/    hardware, signal chain, ultrasound research (human-gated)
social/           NUE COLOR SF, collectors, partners
coordination/     rules, methodology, starter pack, contribution pack, prompts, migration
tools/            verify, run, serve, transplant

The infographic is now executable. The Gauntlet Loop is packages/gauntlet/ and you can run it:

node tools/verify.mjs     # 17 checks, 174 tests
node tools/nue.mjs demo   # ingest → verify → interpret → merge → render → evaluate → improve → archive
node tools/serve.mjs      # meet NUE at localhost:4949

No install step. No dependencies. Node 22 is the only requirement.

Highlights

BMI v2 is a real upgrade, not a relabel. Signal quality now gates the pipeline; artifacts are rejected per epoch; band power is relative so device gain cannot change a color; and the 7–8 Hz and 12–13 Hz canon gaps are measured and reported as unassigned rather than silently absorbed into a neighbouring band. A disconnected electrode could become a beautiful color in v1. It cannot now — a 7.5 Hz signal drops to quality 34 and is refused.

POM v1 is honest about its own epistemics. The reference assessor heuristic-v1 is a published proxy that does not understand anything; every formula is printed in its spec so anyone can recompute a score by hand. Every score defaults to provisional, and only a human can move one to attested. The spec states plainly that it would rate a tidy shopping list above a devastating three-word message.

Verification is a command, not a claim. tools/verify.mjs rebuilds every artifact from its inputs, proves two runs are byte-identical, catches ledger tampering, and fails the build if any package acquires a dependency, a network import, or an ambient clock.

Verification

Run locally on this branch at 74b593c:

1. Local-first      ✓ no package opens a network socket (26 files clean)
                    ✓ no runtime dependencies anywhere (10 manifests, 0 dependencies)
2. Determinism      ✓ no ambient clock or entropy in packages/
3. Canon            ✓ canon is self-consistent (glossary, ids, links, frozen lexicons)
4. Spec conformance ✓ empty blob hits the documented floor (composite 18)
                    ✓ POM vectors reproduce (9) · color vectors reproduce (27)
                    ✓ a rejected score can never mint a color
                    ✓ POM refuses to emit a bare number
5. Reproduction     ✓ the Gauntlet Loop completes on the fixture
                    ✓ every artifact re-derives to the same hash
                    ✓ two runs are byte-identical
                    ✓ failures are archived, never dropped
6. Ledger           ✓ chain intact · tampering detected · canonical JSON order-independent
7. Unit tests       ✓ 174 passed, 0 failed

ALL SYSTEMS GREEN  17 checks passed

Three defects were found and fixed by these checks during development, rather than papered over:

1. The word the scored 80/100 on ineffability — raw type-token ratio maxes out on one-word input. Fixed with a documented length-damped diversity term in both spec and code.
2. The mirror hue anchor was claimed "exact" for the NUE glow. It is 190.118°, not 191. Corrected to 190 in code and canon, with the one-degree rounding stated rather than hidden.
3. The local-first scanner flagged a comment explaining the no-Math.random() rule. Fixed by making it read code rather than prose — and re-proven to still catch real violations.

Two things reviewers should know about CI

1. No checks will run on this PR. GitHub Actions is not enabled on Nuropunk/firstmate — the API reports zero registered workflows and zero runs repo-wide, so neither ci.yml nor no-mistakes-required.yml executes. The verification block above was run locally and can be reproduced with one command.

2. nue-color/.github/workflows/verify.yml is inert here by design. Actions only reads workflows from the repository root, so a workflow nested under nue-color/ cannot run. It goes live the moment nue-color/ becomes its own origin. This is now stated in the workflow header and the README rather than left to imply a check that never runs.

Note also that this repository's contribution policy requires PRs to be raised through git push no-mistakes, which writes a signature into the PR body. This PR does not carry that signature — the tool is not installed in this environment, and fabricating the marker would be forging a compliance claim. Flagging it rather than working around it.

Decision needed

This was built on the designated branch in firstmate, but it is not firstmate material — it is a self-contained product monorepo that wants its own origin. tools/transplant.sh splits nue-color/ into a standalone repo with history, non-destructively:

./nue-color/tools/transplant.sh git@github.com:nuecolor/nue-color.git

That also makes the verification workflow live. Say the word and I'll run it, or leave it here if you'd rather.

What I did not do

Stated plainly:

• No repository content was migrated. The closed gates require a human decision before material leaves its owner's control, and the tier assignments in coordination/migration/inventory.md are proposals nobody has confirmed. The origin is verified first; content moves second.
• Cross-org repos could not be read in this session (nuecolor/* and elocremarc/* were blocked), so the inventory is built from Nuropunk/* plus repository listings. Several rows are classified from names alone and are marked TBD.
• The Cursor blog post itself is unreachable from this environment; its architecture was reconstructed from secondary sources.
• Five decisions are blocked on you and ELOC — which nueEngine is canonical, which nue-color-engine, whether nueral-lace or nue-repo is primary, the licence for folded MIT material, and confirmation of every tier assignment. All listed in coordination/migration/log.md.
• Ledger signing is not built. The hash chain proves the ledger was not edited; it does not prove who wrote an entry. The spec says so plainly rather than overclaiming. Tracked for v2.
• No Brainbow board exists. The dev kit is design only and labelled as such.
• The attestation path is not wired end to end. The app renders provisional correctly but cannot yet take an attestation and write a pom.attest entry.