ci: repair the checks that fail on main (workflow lint, K9 contracts, descriptile location)

.github/GOVERNANCE.md

@@ -46,7 +46,7 @@ release schedules, contributor access, and community standards.
 - ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`.
 - ADRs provide a historical record of why decisions were made and what alternatives
   were considered.
-- See `.machine_readable/6a2/META.a2ml` for the machine-readable ADR index.
+- See `.machine_readable/descriptiles/META.a2ml` for the machine-readable ADR index.
 
 ---
 

.github/pull_request_template.md

@@ -29,9 +29,9 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 
 ### As Applicable
 
-- [ ] `.machine_readable/6a2/STATE.a2ml` updated (if project state changed)
-- [ ] `.machine_readable/6a2/ECOSYSTEM.a2ml` updated (if integrations changed)
-- [ ] `.machine_readable/6a2/META.a2ml` updated (if architectural decisions changed)
+- [ ] `.machine_readable/descriptiles/STATE.a2ml` updated (if project state changed)
+- [ ] `.machine_readable/descriptiles/ECOSYSTEM.a2ml` updated (if integrations changed)
+- [ ] `.machine_readable/descriptiles/META.a2ml` updated (if architectural decisions changed)
 - [ ] Documentation updated for user-facing changes
 - [ ] `TOPOLOGY.md` updated (if architecture changed)
 - [ ] `CHANGELOG` or release notes updated

.github/workflows/actions.lock

@@ -35,7 +35,7 @@ workflows:
         - 'actions/configure-pages@v6.0.0'
         - 'actions/deploy-pages@v5.0.1'
         - 'actions/upload-pages-artifact@v5.0.0'
-        - 'haskell-actions/setup@v2.12.0'
+        - 'haskell-actions/setup@v2.12.1'
     '.github/workflows/proofs.yml':
         - 'actions/cache@v6.1.0'
         - 'actions/checkout@v7.0.1'
@@ -145,9 +145,9 @@ dependencies:
         commit: 'sha1-1fc58d04a4d4374f921bdac573c3811c240f9c26'
         owner_id: 9919
         repo_id: 259445878
-    'haskell-actions/setup@v2.12.0':
-        ref: 'v2.12.0'
-        commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
+    'haskell-actions/setup@v2.12.1':
+        ref: 'v2.12.1'
+        commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
         owner_id: 75048950
         repo_id: 623796603
     'hyperpolymath/smtp-notify-action@v0.5.1':

.github/workflows/boj-build.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 #
 # OPTIONAL: BoJ Server Build Trigger
 # This workflow notifies a BoJ Server instance when code is pushed.
@@ -27,7 +27,7 @@
         uses: actions/checkout@v7.0.1
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         env:
           BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }}
           REPO_NAME: ${{ github.repository }}
           BRANCH_NAME: ${{ github.ref_name }}
         run: |

.github/workflows/codeql.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 on:
   push:

.github/workflows/container-build.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: container build
 on:
   pull_request:

.github/workflows/dependabot-automerge.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 #
 # dependabot-automerge.yml — enable GitHub's native auto-merge on
 # Dependabot pull requests that match a declared severity / ecosystem

.github/workflows/dogfood-gate.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate

.github/workflows/e2e.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # RSR Standard E2E + Aspect + Benchmark Workflow Template
@@ -63,8 +63,7 @@ jobs:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: dtolnay/rust-toolchain@stable
 #     - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2
@@ -77,12 +76,10 @@ steps:
 #   name: E2E — FFI Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406  # v2.2.1
-#
-with:
+#       with:
 #         version: 0.15.1
 #     - run: cd ffi/zig && zig build test
 #     - run: bash tests/e2e.sh
@@ -92,12 +89,10 @@ with:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93  # v1.24.0
-#
-with:
+#       with:
 #         otp-version: '27.0'
 #         elixir-version: '1.17'
 #     - run: mix deps.get && mix compile --warnings-as-errors
@@ -108,12 +103,10 @@ with:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
-#
-with:
+#       with:
 #         deno-version: v2.x
 #     - run: deno install --node-modules-dir=auto
 #     - run: deno task res:build  # ReScript compile
@@ -124,25 +117,21 @@ with:
 #   name: Playwright — ${{ matrix.project }}
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 20
-#
-strategy:
+#   strategy:
 #     fail-fast: false
 #     matrix:
 #       project: [chromium-1080p, firefox-1080p, webkit-1080p]
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
-#
-with:
+#       with:
 #         deno-version: v2.x
 #     - run: deno install --node-modules-dir=auto
 #     - run: npx playwright install --with-deps
 #     - run: npx playwright test --project=${{ matrix.project }}
 #     - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
 #       if: failure()
-#
-with:
+#       with:
 #         name: playwright-traces-${{ matrix.project }}
 #         path: test-results/**/trace.zip
 #         retention-days: 7
@@ -152,12 +141,10 @@ with:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553  # v2.11.0
-#
-with:
+#       with:
 #         ghc-version: '9.6'
 #         cabal-version: '3.10'
 #     - run: cabal build all
@@ -171,8 +158,7 @@ with:
 #   name: Aspect — Architectural Invariants
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 10
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - run: bash tests/aspect_tests.sh
 
@@ -184,16 +170,14 @@ steps:
 #   name: Bench — Performance Regression
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: dtolnay/rust-toolchain@stable
 #     - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2
 #     - run: cargo bench 2>&1 | tee /tmp/bench-results.txt
 #     - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
 #       if: always()
-#
-with:
+#       with:
 #         name: benchmark-results
 #         path: /tmp/bench-results.txt
 #         retention-days: 30
@@ -203,12 +187,10 @@ with:
 #   name: Bench — Performance Regression
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406  # v2.2.1
-#
-with:
+#       with:
 #         version: 0.15.1
 #     - run: cd ffi/zig && zig build bench
 
@@ -219,8 +201,7 @@ with:
 #   name: Readiness — Grade D/C/B
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 10
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: dtolnay/rust-toolchain@stable
 #     - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2

.github/workflows/estate-rules.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Estate Rules — enforces hyperpolymath estate-wide conventions:

.github/workflows/governance.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Governance
 
 on:

.github/workflows/guix-policy.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Guix Package Policy
 on:
   push:

.github/workflows/hypatia-scan.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 #
 # Standalone Hypatia security scan (push / PR / weekly). This is NOT a duplicate
 # of the `hypatia-scan` job in `static-analysis-gate.yml`: that job exists to

.github/workflows/instant-sync.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 on:
@@ -22,7 +22,7 @@
       - name: Gate on secret presence
         id: gate
         env:
           FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
         run: |
           if [ -n "${FARM_DISPATCH_TOKEN}" ]; then
             echo "present=true" >> "$GITHUB_OUTPUT"

.github/workflows/label-triage.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Label Triage
 
 # Classify newly-filed issues against the estate label taxonomy.

.github/workflows/labels.yml

@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Labels
 
 # Applies the canonical estate label set from .github/labels.json.

.github/workflows/mirror.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Mirror to Git Forges
 on:
   push:

.github/workflows/openssf-compliance.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # OpenSSF Best Practices compliance gate — blocks PRs and pushes that lack
 # required files or still contain unfilled placeholder tokens.
 name: OpenSSF Compliance
@@ -73,11 +73,11 @@ jobs:
             exit 1
           fi
 
-          if [ ! -f ".machine_readable/6a2/STATE.a2ml" ]; then
-            echo "::error::.machine_readable/6a2/STATE.a2ml is required"
+          if [ ! -f ".machine_readable/descriptiles/STATE.a2ml" ]; then
+            echo "::error::.machine_readable/descriptiles/STATE.a2ml is required"
             exit 1
           fi
-          echo ".machine_readable/6a2/STATE.a2ml: OK"
+          echo ".machine_readable/descriptiles/STATE.a2ml: OK"
       - name: Check CHANGELOG exists
         run: |
           if [ ! -f "CHANGELOG.md" ] && [ ! -f "CHANGELOG.adoc" ] && [ ! -f "CHANGES.md" ]; then
@@ -93,8 +93,8 @@ jobs:
           # Collect all required files that exist
           for f in SECURITY.md SECURITY.adoc .github/SECURITY.md LICENSE LICENSE.txt \
                    CONTRIBUTING.md CONTRIBUTING.adoc README.md README.adoc \
-                   .machine_readable/6a2/STATE.a2ml .machine_readable/6a2/META.a2ml \
-                   .machine_readable/6a2/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do
+                   .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml \
+                   .machine_readable/descriptiles/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do
             [ -f "$f" ] && REQUIRED_FILES="$REQUIRED_FILES $f"
           done
 

.github/workflows/pages.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # GitHub Pages via casket-ssg (hyperpolymath's pure-Haskell static site generator).
 # Replaces the orphan one-off Pages deployment with a reproducible build.
 name: GitHub Pages

.github/workflows/proofs.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Proof gate: the same scripts/check-proofs.sh a developer runs locally.
 # Hermetic by construction — elan comes from a version-pinned release tarball
 # with a checksum, the Lean toolchain from the committed lean-toolchain file,

.github/workflows/push-email-notify.yml

@@ -1,6 +1,6 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Dormant push-email notification. ARMED by setting the repo variable
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
 # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
@@ -43,7 +43,7 @@
       - name: Send push notification email
         uses: hyperpolymath/smtp-notify-action@v0.5.1
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}
           secure: true
           username: ${{ secrets.SMTP_USER }}

.github/workflows/quality.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Code Quality
 on:
   push:
@@ -25,7 +25,7 @@
       contents: read
     steps:
       - uses: actions/checkout@v7.0.1
       - name: Check file permissions
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       - name: Check TODO/FIXME
@@ -35,7 +35,7 @@
       - name: Check for large files
         run: |
           find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
       - name: EditorConfig check
         uses: editorconfig-checker/action-editorconfig-checker@v3.0.0
         continue-on-error: true
   docs:

.github/workflows/release.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Release workflow — triggered by version tags (v*).