docs(exceptions): keep AppKit license proposal under unused ID

Update the draft proposal branch to current main and use EX-0013 because EX-0009 is now assigned to the merged GitFlow exception. Preserve all approved entries and the exact development-only uri-js scope; this does not approve or activate the proposal.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

exceptions/register.md

@@ -6,13 +6,17 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in
 | ID | Status | Requirements | Scope | Expires |
 | --- | --- | --- | --- | --- |
 | [EX-0001](#ex-0001) | Open | K22-REPO-20 (approval count), OSPS-QA-07.01 | All repositories | When a second maintainer joins; reviewed 2027-10-09 |
-| [EX-0002](#ex-0002) | Open | K22-REL-05 (Authenticode signing of Windows binaries) | Windows desktop apps (gclo, AppKit samples, future apps) | When the Azure Trusted Signing identity is validated, at the latest 2027-04-09 |
+| [EX-0002](#ex-0002) | Open (closed for gclo 2026-10-11) | K22-REL-05 (Authenticode signing of Windows binaries) | Windows desktop apps not yet on `sign: true` (AppKit samples, future apps) | When each app turns on `sign: true` in the shared release workflow, at the latest 2027-04-09 |
 | [EX-0003](#ex-0003) | Open | K22-DEP-02 (license allowlist) | gclo | Reviewed yearly, next on 2027-10-09 |
 | [EX-0004](#ex-0004) | Open | K22-CI-30, K22-REL-04 (shared release workflow) | gclo | When the shared reusable release workflow ships, at the latest 2027-04-09 |
 | [EX-0005](#ex-0005) | Open | K22-AI-10 (agents via PR only), K22-AI-11 (in part: unconfirmed pushes) | second-brain, nix, Praetor, Jellyfin | Reviewed yearly, next on 2027-10-10 |
 | [EX-0006](#ex-0006) | Open | K22-CI-16 (tag-only environment secrets) | standards | 2027-04-10; review 2027-01-10 |
 | [EX-0007](#ex-0007) | Closed | K22-REPO-12 (enrollment) | KofTwentyTwo/standards | Closed 2026-10-10 |
 | [EX-0008](#ex-0008) | Open | K22-CI-21 (HIGH dependency finding) | Website-Frontend, development-only braces 3.0.3 | 2026-11-10; review 2026-10-17 |
+| [EX-0009](#ex-0009) | Open | K22-REPO-20 (linear history), K22-REPO-22 (squash only) | Website-Backend, Website-Frontend, Munitor, cluster-gitops | Reviewed yearly, next on 2027-10-12 |
+| [EX-0010](#ex-0010) | Open | K22-CI-01, K22-CI-10 to K22-CI-24, K22-CI-30 (GitHub Actions gates and reusable workflows) | Website-Backend, Website-Frontend, Munitor | 2027-04-12; review 2027-01-12 |
+| [EX-0011](#ex-0011) | Open | K22-CODE-TS-01, K22-CODE-SH-02 (Kingsrook 3-space layout) | Website-Frontend (TypeScript), Munitor (shell) | 2027-04-12; review 2027-01-12 |
+| [EX-0012](#ex-0012) | Open | K22-CODE-TF-04 (state never committed), K22-CODE-TF-05 (no secrets in `.tfvars`) | Praetor | Reviewed yearly, next on 2027-10-12 |
 
 ## EX-0001
 
@@ -61,6 +65,13 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in
   EX-0004); releases before that have neither.
 - **Expires:** when the signing identity is validated and the shared release workflow
   signs Windows binaries; at the latest 2027-04-09.
+- **Closed for gclo:** 2026-10-11. The signing identity (Azure Artifact Signing account
+  `kof22signing`, Public Trust profile, publisher "James Maes") is validated and the
+  shared workflow signs on `sign: true` (standards#28/#29): gclo v1.0.2-beta.3,
+  v1.1.0-beta.1 and v1.1.0 ship Setup.exe, Update.exe and every exe/dll
+  Authenticode-signed (SHA-256, RFC 3161), verified with `signtool verify /pa /all` by
+  gclo's `verify-signatures` job and by hand (289 files, 0 failures). The exception
+  stays open only for Windows apps that have not turned `sign: true` on yet.
 - **Owner:** the maintainer.
 
 ## EX-0003
@@ -225,3 +236,139 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in
 - **Owner:** James Maes, repository maintainer.
 - **Review date:** 2026-10-17. Remove the consumer exception and close this entry once
   the affected dependency is replaced or patched.
+
+## EX-0009
+
+**GitFlow with merge commits for Munitor-released and GitOps repositories**
+
+- **Requirements:** `K22-REPO-20` (linear history on `main`) and `K22-REPO-22`
+  (squash-only merges).
+- **Scope:** `KofTwentyTwo/Website-Backend`, `KofTwentyTwo/Website-Frontend`,
+  `KofTwentyTwo/Munitor` (`develop` and `main`, `feature/*` and `hotfix/*` branches)
+  and `KofTwentyTwo/cluster-gitops` (`main`, merge commits).
+- **Reason:** these repositories run GitFlow with merge commits. In Website-Backend
+  and Website-Frontend, `feature/*` and `hotfix/*` branches (and `develop`
+  promotions) merge to `main`, which releases and deploys through Munitor, and a
+  `main` to `develop` back-merge follows. Munitor itself merges `feature/*` into
+  `develop`, `release/X.Y.Z` into `main`, back-merges `main` into `develop`, and a
+  `vX.Y.Z` tag publishes the orb. Squash
+  or rebase merges break the ancestry between `develop` and `main` that the pipeline
+  relies on. cluster-gitops keeps merge commits so each change set applied by ArgoCD
+  stays one reviewable unit next to the automated image-bump commits.
+- **Risk:** non-linear history is harder to bisect and to read, and a merge commit can
+  carry several commits that were never reviewed individually.
+- **Compensating controls:** every human change to the Website repositories and
+  Munitor reaches `main` through a pull request; repository rulesets require signed
+  commits and the CircleCI checks on `main` and `develop`. cluster-gitops (Internal
+  tier, no CI) requires signed commits and blocks deletion and force pushes on `main`;
+  the Munitor deploy step writes image bumps to it directly as GitHub-signed commits
+  (GraphQL `createCommitOnBranch`), with no bypass actor; release tags stay protected
+  (`K22-REPO-21`); merged branches are deleted.
+- **Expires:** reviewed yearly, next on 2027-10-12, or earlier if Munitor gains a
+  squash-compatible release mode.
+- **Owner:** the maintainer.
+
+## EX-0010
+
+**CircleCI instead of the GitHub Actions reusable workflows**
+
+- **Requirements:** `K22-CI-01` (required checks run by the reusable workflows),
+  `K22-CI-10` to `K22-CI-24` as written for GitHub Actions, and `K22-CI-30`
+  (releases built by the shared reusable release workflow).
+- **Scope:** `KofTwentyTwo/Website-Backend`, `KofTwentyTwo/Website-Frontend` and
+  `KofTwentyTwo/Munitor` (the CircleCI orb that builds, releases and deploys them).
+- **Reason:** these repositories build, publish container images and deploy to the
+  k8s-galaxy cluster through the Munitor CircleCI orb, which predates the reusable
+  GitHub Actions workflows and holds the deploy integration (image publishing,
+  cluster-gitops version bumps). Porting the pipeline is a separate project.
+- **Risk:** the gates are implemented per orb rather than by the audited reusable
+  workflows, so a gate can be missing or weaker than the standard (for example
+  CodeQL, zizmor, Scorecard and SLSA provenance have no CircleCI equivalent here).
+- **Compensating controls:** the CircleCI checks are required by the repository
+  rulesets (Website: `build-and-test`, `secrets-scan`, `sast-scan`; Munitor:
+  `orb-tools/lint`, `pack`, `review`, `test`); the orb runs the test suite, gitleaks and Trivy where configured;
+  GitHub-side controls still apply (secret scanning with push protection, Dependabot
+  alerts and security updates, code scanning default setup where available); orbs are
+  pinned to exact versions; signed commits are required.
+- **Expires:** 2027-04-12, or when the repositories move to the reusable workflows;
+  review 2027-01-12.
+- **Owner:** the maintainer.
+
+## EX-0011
+
+**Website-Frontend and Munitor keep 2-space formatting**
+
+- **Requirements:** `K22-CODE-TS-01` (Kingsrook layout through the KofTwentyTwo ESLint
+  configuration: 3-space indent, Allman braces) and `K22-CODE-SH-02` (3-space shell
+  indentation).
+- **Scope:** `KofTwentyTwo/Website-Frontend` TypeScript, JavaScript, CSS and JSON
+  sources; `KofTwentyTwo/Munitor` Bash scripts and templates.
+- **Reason:** the Next.js code base was written in the framework's default 2-space
+  layout and is formatted by Prettier 3 (with `prettier-plugin-tailwindcss`) plus
+  ESLint 9 with `eslint-config-next`, which the TypeScript profile does not use.
+  Munitor's 100+ orb scripts and templates use 2-space indentation. Reformatting
+  either is a large whitespace-only diff that triggers releases (a Website deploy or
+  a new orb version for every consumer) and obscures history.
+- **Risk:** inconsistent layout across KofTwentyTwo TypeScript code; no functional
+  risk.
+- **Compensating controls:** `.editorconfig` comes from the standard, with only the
+  indent size overridden for these file types and a comment citing this exception;
+  the existing lint, type and orb checks still gate CI.
+- **Expires:** 2027-04-12, or when the code base is reformatted and adopts
+  `configs/typescript/eslint.config.mjs` (Website-Frontend) and the orb scripts are
+  reformatted with shfmt (Munitor); review 2027-01-12.
+- **Owner:** the maintainer.
+
+## EX-0012
+
+**Praetor commits git-crypt-encrypted OpenTofu state and variable files**
+
+- **Requirements:** `K22-CODE-TF-04` (state is never committed; remote state with
+  locking and encryption) and `K22-CODE-TF-05` (no secrets in `.tfvars` files).
+- **Scope:** `KofTwentyTwo/Praetor` (Internal tier, private): the local-backend roots
+  under `terraform/` and `unifi/` (17 `*.tfstate*` files) and their 10 `*.tfvars`
+  files.
+- **Reason:** Praetor provisions the homelab that would host any remote state backend
+  (the cluster, the NAS and Infisical are themselves managed here), so a remote backend
+  creates a bootstrap dependency on the infrastructure it builds. Committed, encrypted
+  local state is the recovery path when that infrastructure is down.
+- **Risk:** state and variable files contain credentials; anyone holding the git-crypt
+  key or a decrypted clone can read them. Local state has no locking, so two
+  concurrent applies could corrupt it.
+- **Compensating controls:** `.gitattributes` encrypts every `*.tfstate*`, `*.tfvars*`,
+  kubeconfig, talosconfig and `*secret*` path with git-crypt (GPG key held by the
+  maintainer); `git-crypt status` reports no unencrypted secret files; the repository
+  is private; applies are human-gated by the maintainer in session (`EX-0005`), which
+  serializes them; secrets are moving into Infisical with `sensitive = true` outputs.
+- **Expires:** reviewed yearly, next on 2027-10-12, or when the roots move to an
+  encrypted remote backend.
+- **Owner:** the maintainer.
+
+## EX-0013
+
+**Proposed: AppKit ESLint's transitive BSD views license**
+
+- **Status:** Proposed; not effective until this register change is reviewed and merged.
+- **Requirement:** `K22-DEP-02`, enforced by the reusable PR license allowlist.
+- **Scope:** `KofTwentyTwo/AppKit` repository tooling only, `pkg:npm/uri-js@4.4.1`
+  from ESLint's Ajv dependency. It is development-only and ships in no AppKit package.
+- **Reason:** hosted dependency review reports `BSD-2-Clause AND BSD-2-Clause-Views`,
+  while npm metadata says `BSD-2-Clause`. The installed 4.4.1 LICENSE matches the
+  [upstream text](https://github.com/garycourt/uri-js/blob/master/LICENSE), including
+  the views sentence. [SPDX](https://spdx.org/licenses/BSD-2-Clause-Views.html)
+  describes this as BSD-2-Clause with the added views-and-conclusions sentence.
+  Keeping ESLint preserves required checks of repository JavaScript and review code.
+- **Risk:** the default automated license policy cannot accept this expression;
+  a manual decision could miss a license obligation. Source copyright, conditions,
+  disclaimer and views text must be preserved when redistributing this tool.
+- **Compensating controls:** retain the locked dependency and full license; after
+  approval, exempt only that exact package version from license review. Every other
+  license, all development/runtime vulnerability checks, package signature verification
+  and SCA remain enforced. No shipped dependency gains an exemption.
+- **Expires:** 2027-04-10, or when this dependency is removed or upgraded, whichever
+  comes first. Reassess the actual replacement version before extending the scope.
+- **Owner:** KofTwentyTwo maintainer. **Review date:** 2027-01-10.
+- **Evidence:** [AppKit #26](https://github.com/KofTwentyTwo/AppKit/issues/26) and
+  [failed dependency gate](https://github.com/KofTwentyTwo/AppKit/actions/runs/38093180805).
+
+Do not activate a caller exemption while this entry remains proposed.