ci: 6 self-contained workflows, the SonarQube token guard and the SPDX lint rule, after the estate template

.github/GOVERNANCE.md

@@ -46,7 +46,7 @@ release schedules, contributor access, and community standards.
 - ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`.
 - ADRs provide a historical record of why decisions were made and what alternatives
   were considered.
-- See `.machine_readable/6a2/META.a2ml` for the machine-readable ADR index.
+- See `.machine_readable/descriptiles/META.a2ml` for the machine-readable ADR index.
 
 ---
 

.github/pull_request_template.md

@@ -29,9 +29,9 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 
 ### As Applicable
 
-- [ ] `.machine_readable/6a2/STATE.a2ml` updated (if project state changed)
-- [ ] `.machine_readable/6a2/ECOSYSTEM.a2ml` updated (if integrations changed)
-- [ ] `.machine_readable/6a2/META.a2ml` updated (if architectural decisions changed)
+- [ ] `.machine_readable/descriptiles/STATE.a2ml` updated (if project state changed)
+- [ ] `.machine_readable/descriptiles/ECOSYSTEM.a2ml` updated (if integrations changed)
+- [ ] `.machine_readable/descriptiles/META.a2ml` updated (if architectural decisions changed)
 - [ ] Documentation updated for user-facing changes
 - [ ] `TOPOLOGY.md` updated (if architecture changed)
 - [ ] `CHANGELOG` or release notes updated

.github/workflows/README.adoc

@@ -18,15 +18,28 @@ either loses real function — keep both.
 
 == Secret scanning is single-sourced
 
-`secret-scanner.yml` calls the standards reusable (gitleaks + a Rust-secrets
-check). An inline TruffleHog job was removed: the reusable deliberately retired
-TruffleHog as redundant with gitleaks, so re-adding it was duplicated work, not
-extra coverage.
+`secret-scanner.yml` runs three inline jobs: gitleaks (with the estate
+baseline from the standards repository at a pinned commit), a Rust-secrets
+check and a shell-secrets check. An inline TruffleHog job was removed earlier:
+the estate retired TruffleHog as redundant with gitleaks, so re-adding it was
+duplicated work, not extra coverage.
+
+== Six workflows are self-contained, not reusable callers
+
+`secret-scanner.yml`, `governance.yml`, `hypatia-scan.yml`, `rust-ci.yml`,
+`mirror.yml` and `scorecard.yml` follow the workflows of the estate template
+(`hyperpolymath/rsr-template-repo`). Earlier each one called a reusable
+workflow of the standards repository. Those calls did not start: each run
+failed with no job. A job-level call to a remote reusable workflow is also
+outside what `gh actions-lock` records. Each `uses:` in these six files is now
+a step-level action with a record in `actions.lock`.
 
 == SAST tools are complementary, not redundant
 
 * `codeql.yml` — CodeQL (matrix defaults to `actions`; every repo has workflows).
 * `sonarqube.yml` — SonarCloud (shell / JS surface; see `sonar-project.properties`).
+  With no `SONAR_TOKEN` secret, the job says that the scan is not configured
+  and passes. The SonarCloud app still analyses each pull request.
 * `static-analysis-gate.yml` — panic-attack + Hypatia gate (see above).
 
 Each targets a different language/surface; together they cover what no single

.github/workflows/actions.lock

@@ -18,15 +18,22 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/estate-rules.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/governance.yml': []
+    '.github/workflows/governance.yml':
+        - 'actions/checkout@v7.0.1'
     '.github/workflows/guix-policy.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/hypatia-scan.yml': []
+    '.github/workflows/hypatia-scan.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
+        - 'github/codeql-action@v4.39.2'
     '.github/workflows/instant-sync.yml':
         - 'peter-evans/repository-dispatch@v4.0.1'
     '.github/workflows/label-triage.yml': []
     '.github/workflows/labels.yml': []
-    '.github/workflows/mirror.yml': []
+    '.github/workflows/mirror.yml':
+        - 'actions/checkout@v7.0.1'
     '.github/workflows/openssf-compliance.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/pages.yml':
@@ -35,7 +42,7 @@ workflows:
         - 'actions/configure-pages@v6.0.0'
         - 'actions/deploy-pages@v5.0.1'
         - 'actions/upload-pages-artifact@v5.0.0'
-        - 'haskell-actions/setup@v2.12.0'
+        - 'haskell-actions/setup@v2.12.1'
     '.github/workflows/proofs.yml':
         - 'actions/cache@v6.1.0'
         - 'actions/checkout@v7.0.1'
@@ -53,9 +60,14 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/runtime-policy.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/rust-ci.yml': []
-    '.github/workflows/scorecard.yml': []
-    '.github/workflows/secret-scanner.yml': []
+    '.github/workflows/rust-ci.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/scorecard.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.39.2'
+        - 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e'
+    '.github/workflows/secret-scanner.yml':
+        - 'actions/checkout@v7.0.1'
     '.github/workflows/security-policy.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/sonarqube.yml':
@@ -135,6 +147,11 @@ dependencies:
         commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
         owner_id: 26415196
         repo_id: 297874902
+    'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
+        ref: 'v1.24.1'
+        commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
+        owner_id: 47606891
+        repo_id: 331103973
     'erlef/setup-beam@v1.24.1':
         ref: 'v1.24.1'
         commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
@@ -145,16 +162,21 @@ dependencies:
         commit: 'sha1-1fc58d04a4d4374f921bdac573c3811c240f9c26'
         owner_id: 9919
         repo_id: 259445878
-    'haskell-actions/setup@v2.12.0':
-        ref: 'v2.12.0'
-        commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
+    'haskell-actions/setup@v2.12.1':
+        ref: 'v2.12.1'
+        commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
         owner_id: 75048950
         repo_id: 623796603
     'hyperpolymath/smtp-notify-action@v0.5.1':
         ref: 'v0.5.1'
         commit: 'sha1-e384daf6167a7a7567642d6a62060106244d2413'
         owner_id: 6759885
         repo_id: 1352485172
+    'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e':
+        ref: 'v2.5.0'
+        commit: 'sha1-fa7117db83c52d787ae5a89f350999701505d78e'
+        owner_id: 67707773
+        repo_id: 421101922
     'peter-evans/repository-dispatch@v4.0.1':
         ref: 'v4.0.1'
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'

.github/workflows/boj-build.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 #
 # OPTIONAL: BoJ Server Build Trigger
 # This workflow notifies a BoJ Server instance when code is pushed.
@@ -27,7 +27,7 @@
         uses: actions/checkout@v7.0.1
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         env:
           BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }}
           REPO_NAME: ${{ github.repository }}
           BRANCH_NAME: ${{ github.ref_name }}
         run: |

.github/workflows/codeql.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 on:
   push:

.github/workflows/container-build.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: container build
 on:
   pull_request:

.github/workflows/dependabot-automerge.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 #
 # dependabot-automerge.yml — enable GitHub's native auto-merge on
 # Dependabot pull requests that match a declared severity / ecosystem

.github/workflows/dogfood-gate.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate

.github/workflows/e2e.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # RSR Standard E2E + Aspect + Benchmark Workflow Template
@@ -63,8 +63,7 @@ jobs:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: dtolnay/rust-toolchain@stable
 #     - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2
@@ -77,12 +76,10 @@ steps:
 #   name: E2E — FFI Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406  # v2.2.1
-#
-with:
+#       with:
 #         version: 0.15.1
 #     - run: cd ffi/zig && zig build test
 #     - run: bash tests/e2e.sh
@@ -92,12 +89,10 @@ with:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93  # v1.24.0
-#
-with:
+#       with:
 #         otp-version: '27.0'
 #         elixir-version: '1.17'
 #     - run: mix deps.get && mix compile --warnings-as-errors
@@ -108,12 +103,10 @@ with:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
-#
-with:
+#       with:
 #         deno-version: v2.x
 #     - run: deno install --node-modules-dir=auto
 #     - run: deno task res:build  # ReScript compile
@@ -124,25 +117,21 @@ with:
 #   name: Playwright — ${{ matrix.project }}
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 20
-#
-strategy:
+#   strategy:
 #     fail-fast: false
 #     matrix:
 #       project: [chromium-1080p, firefox-1080p, webkit-1080p]
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
-#
-with:
+#       with:
 #         deno-version: v2.x
 #     - run: deno install --node-modules-dir=auto
 #     - run: npx playwright install --with-deps
 #     - run: npx playwright test --project=${{ matrix.project }}
 #     - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
 #       if: failure()
-#
-with:
+#       with:
 #         name: playwright-traces-${{ matrix.project }}
 #         path: test-results/**/trace.zip
 #         retention-days: 7
@@ -152,12 +141,10 @@ with:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553  # v2.11.0
-#
-with:
+#       with:
 #         ghc-version: '9.6'
 #         cabal-version: '3.10'
 #     - run: cabal build all
@@ -171,8 +158,7 @@ with:
 #   name: Aspect — Architectural Invariants
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 10
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - run: bash tests/aspect_tests.sh
 
@@ -184,16 +170,14 @@ steps:
 #   name: Bench — Performance Regression
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: dtolnay/rust-toolchain@stable
 #     - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2
 #     - run: cargo bench 2>&1 | tee /tmp/bench-results.txt
 #     - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
 #       if: always()
-#
-with:
+#       with:
 #         name: benchmark-results
 #         path: /tmp/bench-results.txt
 #         retention-days: 30
@@ -203,12 +187,10 @@ with:
 #   name: Bench — Performance Regression
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406  # v2.2.1
-#
-with:
+#       with:
 #         version: 0.15.1
 #     - run: cd ffi/zig && zig build bench
 
@@ -219,8 +201,7 @@ with:
 #   name: Readiness — Grade D/C/B
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 10
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: dtolnay/rust-toolchain@stable
 #     - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2

.github/workflows/estate-rules.yml

@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Estate Rules — enforces hyperpolymath estate-wide conventions: