From b47ec4e9b4649b9751948560041a6879cf802489 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 5 Aug 2026 02:03:59 +0100
Subject: [PATCH 01/10] fix(gates): make the red gates able to fail, retier the
 one that should not be red
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Five checks here carry the 🔴 Gate: prefix and have never failed in
71-102 runs each. Reading them explains why, and splits them two ways.

THREE WERE FAKE — same template as haec (the files differ only in
action-pin style), so the same fixes apply:

- 🔴 Gate: Guix-only package policy had NO exit path at all. A foreign
  lock file printed a warning and passed.
- 🔴 Gate: Security policy present failed on secrets only. Weak crypto
  (MD5/SHA1) and plaintext HTTP printed a warning and passed.
- 🔴 Gate: Code quality had continue-on-error on the EditorConfig step.

ONE WAS MISLABELLED RATHER THAN BROKEN — 🔴 Gate: Static analysis cannot
fail three separate ways (skips when its tools are absent, pipes findings
through || true, and carries continue-on-error). Two honest resolutions
existed: make it able to fail, or stop calling it a gate. The second is
correct here — panic-attack has a known false-positive problem
(panic-attack#171), much of it firing on tests and benches rather than
shipping code, so blocking merges on it would teach people to route
around the gate. Retiered to 🟡 CHECK:.

Its header claimed 'Required by branch protection rules'. It is in no
ruleset — verified against the API before renaming, since renaming a
genuinely-required context strands it as a phantom that blocks every PR.
The false comment is corrected.

The skip-on-missing-tool paths stay (advisory now) but are no longer
silent: ::notice:: does not surface on the checks board, so an absent
scanner looked identical to a clean scan. They are ::warning:: and the
step summary says DID NOT RUN — absence of evidence, not evidence of
absence.

ONE WAS ALREADY HONEST — 🔴 Gate: Trope conformance accumulates fail=1
and exits with it. Never failing was clean code, not a broken gate. It
needed proof, not repair.

Per standards R10, scripts/test-gate-falsifiability.sh plants
deliberately-wrong input and asserts each gate REJECTS it. Canaries 5
and 6 run the REAL tests/check-vocabulary.sh against a doctored copy of
the tree rather than re-encoding its logic — a canary that reimplements
the gate proves only that it agrees with itself. Canary 6 runs the same
gate on a pristine copy, which both guards against a suite that always
fires and proves the fixture copy is complete: were it missing a file
the gate reads, canary 5 would pass for the wrong reason.

EXPECT RED. These gates passed because they could not fail; some of what
they now catch will be real and long-standing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/guix-nix-policy.yml      |  10 +-
 .github/workflows/quality.yml              |   3 +-
 .github/workflows/security-policy.yml      |   6 +-
 .github/workflows/static-analysis-gate.yml |  28 +++--
 scripts/test-gate-falsifiability.sh        | 119 +++++++++++++++++++++
 5 files changed, 154 insertions(+), 12 deletions(-)
 create mode 100755 scripts/test-gate-falsifiability.sh

diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml
index ac7d094..a60559a 100644
--- a/.github/workflows/guix-nix-policy.yml
+++ b/.github/workflows/guix-nix-policy.yml
@@ -23,6 +23,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Enforce Guix primary / Nix fallback
         run: |
+          FAILED=false
           # Check for package manager files
           HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null | head -1)
           HAS_NIX=$(find . -name "*.nix" 2>/dev/null | head -1)
@@ -30,7 +31,9 @@ jobs:
           # Block new package-lock.json, yarn.lock, Gemfile.lock, etc.
           NEW_LOCKS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E 'package-lock\.json|yarn\.lock|Gemfile\.lock|Pipfile\.lock|poetry\.lock|cargo\.lock' || true)
           if [ -n "$NEW_LOCKS" ]; then
-            echo "⚠️ Lock files detected. Prefer Guix manifests for reproducibility."
+            echo "❌ Foreign lock files added — this repo is Guix-only:"
+            echo "$NEW_LOCKS"
+            FAILED=true
           fi
 
           # Prefer Guix, fallback to Nix
@@ -42,4 +45,9 @@ jobs:
             echo "ℹ️ Consider adding guix.scm or flake.nix for reproducible builds"
           fi
 
+          if [ "$FAILED" = true ]; then
+            echo "Guix-only package policy violated — see above."
+            exit 1
+          fi
+
           echo "✅ Package policy check passed"
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index d74f357..cfe8e60 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -41,7 +41,8 @@ jobs:
           find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
       - name: EditorConfig check
         uses: editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c # v2.2.0
-        continue-on-error: true
+      - name: Gate falsifiability canaries (R10)
+        run: bash scripts/test-gate-falsifiability.sh
   docs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml
index 3263442..0ca7bf6 100644
--- a/.github/workflows/security-policy.yml
+++ b/.github/workflows/security-policy.yml
@@ -28,15 +28,17 @@ jobs:
           # Block MD5/SHA1 for security (allow for checksums/caching)
           WEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)
           if [ -n "$WEAK_CRYPTO" ]; then
-            echo "⚠️ Weak crypto (MD5/SHA1) detected. Use SHA256+ for security:"
+            echo "❌ Weak crypto (MD5/SHA1) detected. Use SHA256+ for security:"
             echo "$WEAK_CRYPTO"
+            FAILED=true
           fi
 
           # Block HTTP URLs (except localhost)
           HTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)
           if [ -n "$HTTP_URLS" ]; then
-            echo "⚠️ HTTP URLs found. Use HTTPS:"
+            echo "❌ HTTP URLs found. Use HTTPS:"
             echo "$HTTP_URLS"
+            FAILED=true
           fi
 
           # Block hardcoded secrets patterns
diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml
index 54f156f..27938de 100644
--- a/.github/workflows/static-analysis-gate.yml
+++ b/.github/workflows/static-analysis-gate.yml
@@ -1,7 +1,19 @@
 # SPDX-License-Identifier: MPL-2.0
-# Static Analysis Gate — Required by branch protection rules.
+# Static analysis — advisory CHECK, deliberately NOT a blocking gate.
+#
 # Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning.
-name: "🔴 Gate: Static analysis"
+#
+# Tier: 🟡 CHECK. It was labelled 🔴 Gate for 99 runs and never once failed,
+# because it cannot: it skips when its tools are absent, pipes findings through
+# `|| true`, and carries continue-on-error. Two honest resolutions existed —
+# make it able to fail, or stop calling it a gate. The second is correct here:
+# panic-attack has a known false-positive problem (panic-attack#171), much of it
+# firing on tests and benches rather than shipping code, so blocking merges on
+# it would train people to bypass the gate. Advisory is what it actually is.
+#
+# It was also NOT in any ruleset despite the old header claiming otherwise, so
+# renaming it cannot strand a required context.
+name: "🟡 CHECK: Static analysis"
 on:
   pull_request:
     branches: ['**']
@@ -32,7 +44,7 @@ jobs:
             chmod +x /usr/local/bin/panic-attack
             echo "installed=true" >> "$GITHUB_OUTPUT"
           else
-            echo "::notice::panic-attack binary not available — skipping assail"
+            echo "::warning::panic-attack binary NOT AVAILABLE — assail DID NOT RUN. Empty findings below mean "not scanned", not "clean"."
             echo "installed=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Run panic-attack assail
@@ -94,7 +106,7 @@ jobs:
           echo "[]" > panic-attack-findings.json
           echo "## panic-attack assail" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY"
+          echo "**DID NOT RUN** — panic-attack was not available in this environment. The empty result is absence of evidence, not evidence of absence." >> "$GITHUB_STEP_SUMMARY"
       - name: Upload panic-attack findings
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -139,7 +151,7 @@ jobs:
             fi
             echo "ready=true" >> "$GITHUB_OUTPUT"
           else
-            echo "::notice::Hypatia scanner not available — skipping scan"
+            echo "::warning::Hypatia scanner NOT AVAILABLE — scan DID NOT RUN. Empty findings below mean "not scanned", not "clean"."
             echo "ready=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Run Hypatia scan
@@ -198,7 +210,7 @@ jobs:
           echo "[]" > hypatia-findings.json
           echo "## Hypatia Scan" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY"
+          echo "**DID NOT RUN** — the Hypatia scanner was not available in this environment. The empty result is absence of evidence, not evidence of absence." >> "$GITHUB_STEP_SUMMARY"
       - name: Upload hypatia findings
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -231,7 +243,7 @@ jobs:
             chmod +x /usr/local/bin/panic-attack
             echo "installed=true" >> "$GITHUB_OUTPUT"
           else
-            echo "::notice::panic-attack binary not available — skipping Patch Bridge"
+            echo "::warning::panic-attack binary NOT AVAILABLE — Patch Bridge DID NOT RUN. An empty CVE report below means "not triaged", not "no CVEs"."
             echo "installed=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Run Patch Bridge triage
@@ -279,7 +291,7 @@ jobs:
           echo '{"cves":[],"mitigated":0,"unmitigable":0,"concatenative":0,"informational":0}' > bridge-report.json
           echo "## Patch Bridge CVE Triage" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY"
+          echo "**DID NOT RUN** — panic-attack was not available in this environment. The empty result is absence of evidence, not evidence of absence." >> "$GITHUB_STEP_SUMMARY"
       - name: Upload bridge report
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
diff --git a/scripts/test-gate-falsifiability.sh b/scripts/test-gate-falsifiability.sh
new file mode 100755
index 0000000..b501f09
--- /dev/null
+++ b/scripts/test-gate-falsifiability.sh
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# Canonical-wrongness fixtures for this repo's 🔴 GATE checks
+# (standards docs/language-testing-standards.md R10).
+#
+# A gate that has never failed is indistinguishable from a gate that CANNOT
+# fail. These canaries settle the question: each plants a deliberately-wrong
+# input, runs the gate's own logic against it, and asserts the gate REJECTS it.
+# The pass condition is inverted — green here means "the bad thing was
+# correctly caught".
+#
+# Nothing is planted in the real tree; every canary works in a temp directory
+# and cleans up after itself.
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+PASS=0; FAIL=0
+ok()  { echo "PASS $*"; PASS=$((PASS+1)); }
+bad() { echo "FAIL $*"; FAIL=$((FAIL+1)); }
+
+scratch() { mktemp -d "${TMPDIR:-/tmp}/tpw-canary.XXXXXX"; }
+
+# --- canary 1: weak crypto must be rejected -------------------------------
+c1() {
+  local d; d=$(scratch); trap 'rm -rf "$d"' RETURN
+  printf 'fn h() { md5(x) }\n' > "$d/lib.rs"
+  local hit
+  hit=$(cd "$d" && grep -rE 'md5\(|sha1\(' --include="*.rs" . 2>/dev/null \
+        | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)
+  if [ -n "$hit" ]; then ok "weak crypto (md5) is detected"
+  else bad "weak crypto NOT detected — the security gate is blind to it"; fi
+}
+
+# --- canary 2: plaintext HTTP must be rejected ----------------------------
+# NOTE: the fixture host must avoid every exclusion term the gate applies
+# (localhost, 127.0.0.1, example, test, spec). The first version of this canary
+# used example.net and did not fire — the fixture was not actually wrong, which
+# is the exact failure R10 exists to catch. Kept as a caution.
+c2() {
+  local d; d=$(scratch); trap 'rm -rf "$d"' RETURN
+  printf 'const u = "http://data.internal.invalid/x";\n' > "$d/app.rs"
+  local hit
+  hit=$(cd "$d" && grep -rE 'http://[^l][^o][^c]' --include="*.rs" . 2>/dev/null \
+        | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)
+  if [ -n "$hit" ]; then ok "plaintext HTTP is detected"
+  else bad "plaintext HTTP NOT detected — the security gate is blind to it"; fi
+}
+
+# --- canary 3: hardcoded secrets must be rejected -------------------------
+c3() {
+  local d; d=$(scratch); trap 'rm -rf "$d"' RETURN
+  printf 'let api_key = "AAAABBBBCCCCDDDDEEEEFFFFGGGG1234";\n' > "$d/cfg.rs"
+  local hit
+  hit=$(cd "$d" && grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' \
+        --include="*.rs" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)
+  if [ -n "$hit" ]; then ok "hardcoded secret is detected"
+  else bad "hardcoded secret NOT detected — the security gate is blind to it"; fi
+}
+
+# --- canary 4: a foreign lock file must be rejected -----------------------
+c4() {
+  local hit
+  hit=$(printf 'package-lock.json\nsrc/main.rs\n' \
+        | grep -E 'package-lock\.json|yarn\.lock|Gemfile\.lock|Pipfile\.lock|poetry\.lock|cargo\.lock' || true)
+  if [ -n "$hit" ]; then ok "foreign lock file is detected"
+  else bad "foreign lock file NOT detected — the Guix-only gate is blind to it"; fi
+}
+
+# --- canaries 5+6: the trope-conformance gate, run for real ---------------
+# check-vocabulary.sh derives its ROOT from its own location, so a copy of the
+# tree in a temp directory exercises the REAL gate rather than a reimplementation
+# of it. That matters: a canary that re-encodes the gate's logic proves only that
+# the canary agrees with itself.
+tree_copy() {
+  local d="$1"
+  mkdir -p "$d/tests" "$d/vocabulary" "$d/assets"
+  cp "$ROOT/tests/check-vocabulary.sh"                 "$d/tests/"
+  cp "$ROOT"/vocabulary/p-*.adoc                       "$d/vocabulary/"
+  cp "$ROOT/assets/particularity-trainer.html"         "$d/assets/"
+  cp "$ROOT/assets/trope-particularity-map.svg"        "$d/assets/"
+  cp "$ROOT/README.adoc"                               "$d/"
+}
+
+c5() {
+  local d; d=$(scratch); trap 'rm -rf "$d"' RETURN
+  tree_copy "$d"
+  rm -f "$d/vocabulary/p-fusing.adoc"       # nine effects become eight
+  if bash "$d/tests/check-vocabulary.sh" >/dev/null 2>&1; then
+    bad "a missing vocabulary entry was ACCEPTED — the trope gate cannot fail"
+  else
+    ok "trope conformance rejects a missing vocabulary entry"
+  fi
+}
+
+# --- canary 7 (control): clean input must NOT be rejected -----------------
+# Guards the opposite error: a canary suite that always fires proves nothing.
+# Running the real gate on a pristine copy also proves tree_copy is complete —
+# if it were missing a file the gate reads, canary 5 would "pass" for the wrong
+# reason.
+c6() {
+  local d; d=$(scratch); trap 'rm -rf "$d"' RETURN
+  tree_copy "$d"
+  if bash "$d/tests/check-vocabulary.sh" >/dev/null 2>&1; then
+    ok "trope conformance accepts the unmodified tree (fixture copy is complete)"
+  else
+    bad "trope conformance rejected a pristine tree — canary 5 proves nothing"
+  fi
+}
+
+c1; c2; c3; c4; c5; c6
+echo
+if [ "$FAIL" -gt 0 ]; then
+  echo "gate falsifiability canaries: $PASS/$((PASS+FAIL)) — FAILED"
+  echo "A gate whose canary does not fire cannot fail, and is not a gate."
+  exit 1
+fi
+echo "gate falsifiability canaries: $PASS/$PASS"

From 42b3575ab6f43b423ab452fa90d1a613058a33bd Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 5 Aug 2026 02:09:32 +0100
Subject: [PATCH 02/10] =?UTF-8?q?fix(canaries):=20drop=20the=20RETURN=20tr?=
 =?UTF-8?q?ap=20=E2=80=94=20it=20fired=20again=20with=20$d=20out=20of=20sc?=
 =?UTF-8?q?ope?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`trap ... RETURN` set inside a bash function installs a GLOBAL return trap,
not one scoped to that function. Each canary overwrote the previous one, and
the last one survived to fire on the next function return — where $d no longer
exists, so `set -u` aborted the suite.

It only stayed hidden here because every canary is invoked from top level. The
sibling suite on trope-checker calls its canaries from a wrapper function and
died immediately, which is how this surfaced.

Replaced with explicit cleanup after the value under test is captured. The
suite now exits 0 with every canary firing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 scripts/test-gate-falsifiability.sh | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/scripts/test-gate-falsifiability.sh b/scripts/test-gate-falsifiability.sh
index b501f09..af90179 100755
--- a/scripts/test-gate-falsifiability.sh
+++ b/scripts/test-gate-falsifiability.sh
@@ -24,11 +24,12 @@ scratch() { mktemp -d "${TMPDIR:-/tmp}/tpw-canary.XXXXXX"; }
 
 # --- canary 1: weak crypto must be rejected -------------------------------
 c1() {
-  local d; d=$(scratch); trap 'rm -rf "$d"' RETURN
+  local d; d=$(scratch)
   printf 'fn h() { md5(x) }\n' > "$d/lib.rs"
   local hit
   hit=$(cd "$d" && grep -rE 'md5\(|sha1\(' --include="*.rs" . 2>/dev/null \
         | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)
+  rm -rf "$d"
   if [ -n "$hit" ]; then ok "weak crypto (md5) is detected"
   else bad "weak crypto NOT detected — the security gate is blind to it"; fi
 }
@@ -39,22 +40,24 @@ c1() {
 # used example.net and did not fire — the fixture was not actually wrong, which
 # is the exact failure R10 exists to catch. Kept as a caution.
 c2() {
-  local d; d=$(scratch); trap 'rm -rf "$d"' RETURN
+  local d; d=$(scratch)
   printf 'const u = "http://data.internal.invalid/x";\n' > "$d/app.rs"
   local hit
   hit=$(cd "$d" && grep -rE 'http://[^l][^o][^c]' --include="*.rs" . 2>/dev/null \
         | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)
+  rm -rf "$d"
   if [ -n "$hit" ]; then ok "plaintext HTTP is detected"
   else bad "plaintext HTTP NOT detected — the security gate is blind to it"; fi
 }
 
 # --- canary 3: hardcoded secrets must be rejected -------------------------
 c3() {
-  local d; d=$(scratch); trap 'rm -rf "$d"' RETURN
+  local d; d=$(scratch)
   printf 'let api_key = "AAAABBBBCCCCDDDDEEEEFFFFGGGG1234";\n' > "$d/cfg.rs"
   local hit
   hit=$(cd "$d" && grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' \
         --include="*.rs" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)
+  rm -rf "$d"
   if [ -n "$hit" ]; then ok "hardcoded secret is detected"
   else bad "hardcoded secret NOT detected — the security gate is blind to it"; fi
 }
@@ -84,10 +87,13 @@ tree_copy() {
 }
 
 c5() {
-  local d; d=$(scratch); trap 'rm -rf "$d"' RETURN
+  local d; d=$(scratch)
   tree_copy "$d"
   rm -f "$d/vocabulary/p-fusing.adoc"       # nine effects become eight
-  if bash "$d/tests/check-vocabulary.sh" >/dev/null 2>&1; then
+  local rc=0
+  bash "$d/tests/check-vocabulary.sh" >/dev/null 2>&1 || rc=$?
+  rm -rf "$d"
+  if [ "$rc" -eq 0 ]; then
     bad "a missing vocabulary entry was ACCEPTED — the trope gate cannot fail"
   else
     ok "trope conformance rejects a missing vocabulary entry"
@@ -100,9 +106,12 @@ c5() {
 # if it were missing a file the gate reads, canary 5 would "pass" for the wrong
 # reason.
 c6() {
-  local d; d=$(scratch); trap 'rm -rf "$d"' RETURN
+  local d; d=$(scratch)
   tree_copy "$d"
-  if bash "$d/tests/check-vocabulary.sh" >/dev/null 2>&1; then
+  local rc=0
+  bash "$d/tests/check-vocabulary.sh" >/dev/null 2>&1 || rc=$?
+  rm -rf "$d"
+  if [ "$rc" -eq 0 ]; then
     ok "trope conformance accepts the unmodified tree (fixture copy is complete)"
   else
     bad "trope conformance rejected a pristine tree — canary 5 proves nothing"

From a0777c2722dba0f8e2cf0f8ad0397acf92c738bc Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 5 Aug 2026 02:13:36 +0100
Subject: [PATCH 03/10] =?UTF-8?q?fix(ci):=20add=20actions.lock=20=E2=80=94?=
 =?UTF-8?q?=20every=20workflow=20was=20startup=5Ffailure?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Opening PR #45 revealed the repo is repo-wide dead: all 20 workflows
returned startup_failure in 0s, so the only check that ran was
SonarCloud. Workflow-lockfile enforcement is active on this account and
this repo had no .github/workflows/actions.lock; haec and trope-checker
have one and their workflows run.

Generated with `gh actions-lock`, which also normalised the inline SHA
pins to tag refs recorded in the lockfile. My gate edits survive that
rewrite unchanged.

This matters beyond unblocking the PR: startup_failure is NOT counted by
the API's ?status=failure query, so a repo whose CI never starts is
indistinguishable from one whose gates always pass. quality.yml here has
86 startup_failure against 14 success in its last 100 runs, going back to
June — so '102 runs, zero failures' substantially over-stated how much
that particular gate had actually been exercised. The other three gates
in this PR are unaffected: security-policy, guix-nix-policy and
static-analysis-gate each ran successfully 95-98 times out of 100. They
really did run, and really never failed, because they could not.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/actions.lock              | 126 ++++++++++++++++++++
 .github/workflows/boj-build.yml             |   3 +-
 .github/workflows/codeql.yml                |   7 +-
 .github/workflows/dependabot-automerge.yml  |   3 +-
 .github/workflows/dogfood-gate.yml          |  13 +-
 .github/workflows/estate-rules.yml          |   3 +-
 .github/workflows/governance.yml            |   1 +
 .github/workflows/guix-nix-policy.yml       |   3 +-
 .github/workflows/hypatia-scan.yml          |   1 +
 .github/workflows/instant-sync.yml          |   3 +-
 .github/workflows/mirror.yml                |   1 +
 .github/workflows/openssf-compliance.yml    |   3 +-
 .github/workflows/pages.yml                 |   6 +-
 .github/workflows/push-email-notify.yml     |   3 +-
 .github/workflows/quality.yml               |   9 +-
 .github/workflows/release.yml               |  11 +-
 .github/workflows/rhodibot.yml              |   3 +-
 .github/workflows/rsr-antipattern.yml       |   1 +
 .github/workflows/runtime-policy.yml        |   3 +-
 .github/workflows/rust-ci.yml               |   1 +
 .github/workflows/scorecard.yml             |   1 +
 .github/workflows/secret-scanner.yml        |   1 +
 .github/workflows/security-policy.yml       |   3 +-
 .github/workflows/static-analysis-gate.yml  |  23 ++--
 .github/workflows/trope-check.yml           |   3 +-
 .github/workflows/wellknown-enforcement.yml |   3 +-
 .github/workflows/workflow-linter.yml       |   3 +-
 27 files changed, 197 insertions(+), 44 deletions(-)
 create mode 100644 .github/workflows/actions.lock

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 0000000..2f5e11c
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,126 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/boj-build.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.37.4'
+    '.github/workflows/dependabot-automerge.yml':
+        - 'dependabot/fetch-metadata@v3.1.0'
+    '.github/workflows/dogfood-gate.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/estate-rules.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/guix-nix-policy.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/instant-sync.yml':
+        - 'peter-evans/repository-dispatch@v4.0.1'
+    '.github/workflows/openssf-compliance.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/pages.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/deploy-pages@v5.0.0'
+        - 'actions/upload-pages-artifact@v5.0.0'
+    '.github/workflows/push-email-notify.yml':
+        - 'dawidd6/action-send-mail@v3.12.0'
+    '.github/workflows/quality.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'editorconfig-checker/action-editorconfig-checker@v2.2.0'
+        - 'trufflesecurity/trufflehog@v3.96.0'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'softprops/action-gh-release@v3.0.2'
+    '.github/workflows/rhodibot.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/runtime-policy.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/security-policy.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/static-analysis-gate.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'erlef/setup-beam@v1.24.1'
+    '.github/workflows/trope-check.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/wellknown-enforcement.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/workflow-linter.yml':
+        - 'actions/checkout@v7.0.1'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/deploy-pages@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
+        owner_id: 44036562
+        repo_id: 438112499
+    'actions/download-artifact@v8.0.1':
+        ref: 'v8.0.1'
+        commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
+        ref: 'v7.0.0'
+        commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-pages-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'dawidd6/action-send-mail@v3.12.0':
+        ref: 'v3.12.0'
+        commit: 'sha1-2e600f3776677e493bf0da7aaec39a586d19a5ed'
+        owner_id: 9713907
+        repo_id: 222439721
+    'dependabot/fetch-metadata@v3.1.0':
+        ref: 'v3.1.0'
+        commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98'
+        owner_id: 27347476
+        repo_id: 371068214
+    'editorconfig-checker/action-editorconfig-checker@v2.2.0':
+        ref: 'v2.2.0'
+        commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c'
+        owner_id: 26415196
+        repo_id: 297874902
+    'erlef/setup-beam@v1.24.1':
+        ref: 'v1.24.1'
+        commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
+        owner_id: 47606891
+        repo_id: 331103973
+    'github/codeql-action@v4.37.4':
+        ref: 'v4.37.4'
+        commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38'
+        owner_id: 9919
+        repo_id: 259445878
+    'peter-evans/repository-dispatch@v4.0.1':
+        ref: 'v4.0.1'
+        commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
+        owner_id: 18365890
+        repo_id: 220359305
+    'softprops/action-gh-release@v3.0.2':
+        ref: 'v3.0.2'
+        commit: 'sha1-3d0d9888cb7fd7b750713d6e236d1fcb99157228'
+        owner_id: 2242
+        repo_id: 204253808
+    'trufflesecurity/trufflehog@v3.96.0':
+        ref: 'v3.96.0'
+        commit: 'sha1-6f3c981e7b77f235fd2702dd74af25fc4b72bf11'
+        owner_id: 79229934
+        repo_id: 77726177
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index 3761093..33ebd26 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 #
 # OPTIONAL: BoJ Server Build Trigger
@@ -19,7 +20,7 @@ jobs:
     if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         env:
           BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 08dcae7..7722bd1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: "🟡 Check: CodeQL security analysis"
 on:
@@ -30,13 +31,13 @@ jobs:
             build-mode: none
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3.28.1
+        uses: github/codeql-action/init@v4.37.4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3.28.1
+        uses: github/codeql-action/analyze@v4.37.4
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index c2ada47..ba85aee 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 #
 # dependabot-automerge.yml — enable GitHub's native auto-merge on
@@ -51,7 +52,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: meta
-        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        uses: dependabot/fetch-metadata@v3.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
       # --- Policy gate -------------------------------------------------------
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 54d3eb5..42bcde2 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
@@ -26,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Check for A2ML files
         id: detect
@@ -67,7 +68,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Check for K9 files
         id: detect
@@ -113,7 +114,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Scan for invisible characters
         id: lint
@@ -178,7 +179,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Check for Groove manifest
         id: groove
@@ -237,7 +238,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Check and validate eclexiaiser manifest
         id: eclex
@@ -288,7 +289,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Generate dogfooding scorecard
         run: |
diff --git a/.github/workflows/estate-rules.yml b/.github/workflows/estate-rules.yml
index 188f428..b6a73a0 100644
--- a/.github/workflows/estate-rules.yml
+++ b/.github/workflows/estate-rules.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
@@ -22,7 +23,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Root shape allowlist
         run: bash scripts/check-root-shape.sh .
       - name: AsciiDoc by default (no .md under docs/)
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 72fe9b6..911f3dd 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: "🟡 Check: Governance metadata"
 
diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml
index a60559a..21dc4a1 100644
--- a/.github/workflows/guix-nix-policy.yml
+++ b/.github/workflows/guix-nix-policy.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: "🔴 Gate: Guix-only package policy"
 on:
@@ -20,7 +21,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
       - name: Enforce Guix primary / Nix fallback
         run: |
           FAILED=false
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 2abb40c..684d3a5 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: "🟡 Check: Hypatia baseline security scan"
 
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index c458353..3c325ac 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: "⚙ Auto: Instant sync"
@@ -29,7 +30,7 @@ jobs:
           fi
       - name: Trigger Propagation
         if: steps.gate.outputs.present == 'true'
-        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
+        uses: peter-evans/repository-dispatch@v4.0.1
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
           repository: hyperpolymath/.git-private-farm
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index acb9eb1..c1463e2 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: "⚙ Auto: Mirror to forges"
 on:
diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml
index c64a23e..240dbd6 100644
--- a/.github/workflows/openssf-compliance.yml
+++ b/.github/workflows/openssf-compliance.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # OpenSSF Best Practices compliance gate — blocks PRs and pushes that lack
 # required files or still contain unfilled placeholder tokens.
@@ -17,7 +18,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - name: Check SECURITY.md exists and has substance
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index bec6d98..93ada6c 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -1,3 +1,5 @@
+# This workflow is managed by gh actions-lock.
+
 name: GitHub Pages (Ddraig SSG)
 on:
   push:
@@ -37,7 +39,7 @@ jobs:
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
           path: '_site'
   deploy:
@@ -50,4 +52,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@v5.0.0
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 3421edd..0160dc2 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Dormant push-email notification. ARMED by setting the repo variable
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
@@ -15,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@2e600f3776677e493bf0da7aaec39a586d19a5ed # pinned
+        uses: dawidd6/action-send-mail@v3.12.0
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index cfe8e60..29f66f3 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: "🔴 Gate: Code quality (fmt/lint/test)"
 on:
@@ -21,12 +22,12 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
       - name: Check file permissions
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11 # v3.93.3
+        uses: trufflesecurity/trufflehog@v3.96.0
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}
@@ -40,7 +41,7 @@ jobs:
         run: |
           find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
       - name: EditorConfig check
-        uses: editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c # v2.2.0
+        uses: editorconfig-checker/action-editorconfig-checker@v2.2.0
       - name: Gate falsifiability canaries (R10)
         run: bash scripts/test-gate-falsifiability.sh
   docs:
@@ -49,7 +50,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
       - name: Check documentation
         run: |
           MISSING=""
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5362cdb..29db8fb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
@@ -19,7 +20,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
       - name: Detect project type and build
         id: build
         run: |
@@ -80,7 +81,7 @@ jobs:
       changelog: ${{ steps.cliff.outputs.content }}
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       - name: Extract version from tag
@@ -105,7 +106,7 @@ jobs:
         run: |
           git cliff --output CHANGELOG.md
       - name: Upload updated CHANGELOG.md
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: changelog
           path: CHANGELOG.md
@@ -118,14 +119,14 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
       # TODO: Download build artifacts if uploading to the release
       # - uses: actions/download-artifact@v4
       #   with:
       #     name: release-artifacts
       #     path: artifacts/
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2
+        uses: softprops/action-gh-release@v3.0.2
         with:
           body: ${{ needs.changelog.outputs.changelog }}
           draft: false
diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml
index bb9fdb0..ff7345c 100644
--- a/.github/workflows/rhodibot.yml
+++ b/.github/workflows/rhodibot.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # rhodibot.yml — AUDIT MODE (report-only)
 #
@@ -21,7 +22,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
       - name: Rhodibot — AUDIT (detect + log; NO mutation, NO PR)
diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml
index 96184c5..8e8f317 100644
--- a/.github/workflows/rsr-antipattern.yml
+++ b/.github/workflows/rsr-antipattern.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # RSR Anti-Pattern Check - Uses reusable workflow from standards
 
diff --git a/.github/workflows/runtime-policy.yml b/.github/workflows/runtime-policy.yml
index 8727561..950aa8a 100644
--- a/.github/workflows/runtime-policy.yml
+++ b/.github/workflows/runtime-policy.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Runtime and package-manager policy check.
 #
@@ -36,7 +37,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
 
       - name: Report runtime tier and reject mixed toolchains
         run: |
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 825cac8..e370e5b 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Rust CI — thin wrapper calling the shared estate reusable in
 # hyperpolymath/standards. Configure once, propagate everywhere.
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 7c96fda..5c0f1d5 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: "⚪ Advisory: OpenSSF Scorecard (score)"
 
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index b3394ad..ba74a2f 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: "🔴 Gate: Secret scan"
 on:
diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml
index 0ca7bf6..9c3f65a 100644
--- a/.github/workflows/security-policy.yml
+++ b/.github/workflows/security-policy.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: "🔴 Gate: Security policy present"
 on:
@@ -20,7 +21,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
       - name: Security checks
         run: |
           FAILED=false
diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml
index 27938de..3f2b6d9 100644
--- a/.github/workflows/static-analysis-gate.yml
+++ b/.github/workflows/static-analysis-gate.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Static analysis — advisory CHECK, deliberately NOT a blocking gate.
 #
@@ -31,7 +32,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       - name: Install panic-attack (if available)
@@ -108,7 +109,7 @@ jobs:
           echo "" >> "$GITHUB_STEP_SUMMARY"
           echo "**DID NOT RUN** — panic-attack was not available in this environment. The empty result is absence of evidence, not evidence of absence." >> "$GITHUB_STEP_SUMMARY"
       - name: Upload panic-attack findings
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: panic-attack-findings
           path: panic-attack-findings.json
@@ -127,13 +128,13 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       - name: Setup Elixir for Hypatia scanner
         id: beam
         continue-on-error: true
-        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.18.2
+        uses: erlef/setup-beam@v1.24.1
         with:
           elixir-version: '1.19.4'
           otp-version: '28.3'
@@ -212,7 +213,7 @@ jobs:
           echo "" >> "$GITHUB_STEP_SUMMARY"
           echo "**DID NOT RUN** — the Hypatia scanner was not available in this environment. The empty result is absence of evidence, not evidence of absence." >> "$GITHUB_STEP_SUMMARY"
       - name: Upload hypatia findings
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: hypatia-findings
           path: hypatia-findings.json
@@ -231,7 +232,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       - name: Install panic-attack (if available)
@@ -293,7 +294,7 @@ jobs:
           echo "" >> "$GITHUB_STEP_SUMMARY"
           echo "**DID NOT RUN** — panic-attack was not available in this environment. The empty result is absence of evidence, not evidence of absence." >> "$GITHUB_STEP_SUMMARY"
       - name: Upload bridge report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: bridge-report
           path: bridge-report.json
@@ -315,17 +316,17 @@ jobs:
     if: always()
     steps:
       - name: Download panic-attack findings
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4
+        uses: actions/download-artifact@v8.0.1
         with:
           name: panic-attack-findings
           path: findings/
       - name: Download hypatia findings
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4
+        uses: actions/download-artifact@v8.0.1
         with:
           name: hypatia-findings
           path: findings/
       - name: Download bridge report
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4
+        uses: actions/download-artifact@v8.0.1
         with:
           name: bridge-report
           path: findings/
@@ -385,7 +386,7 @@ jobs:
           echo "medium=$MEDIUM"     >> "$GITHUB_OUTPUT"
           echo "low=$LOW"           >> "$GITHUB_OUTPUT"
       - name: Upload unified findings (fleet scanner picks these up)
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: unified-findings
           path: findings/unified-findings.json
diff --git a/.github/workflows/trope-check.yml b/.github/workflows/trope-check.yml
index 1aa1a10..dd88c7b 100644
--- a/.github/workflows/trope-check.yml
+++ b/.github/workflows/trope-check.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
@@ -14,6 +15,6 @@ jobs:
   nine-effects-consistent:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
       - name: Nine effects consistent (vocabulary / trainer / map / README)
         run: bash tests/check-vocabulary.sh
diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml
index 0b7e9af..cc57b7a 100644
--- a/.github/workflows/wellknown-enforcement.yml
+++ b/.github/workflows/wellknown-enforcement.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: "🔴 Gate: .well-known / RFC 9116"
 on:
@@ -22,7 +23,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
       - name: RFC 9116 security.txt validation
         run: |
           SECTXT=""
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index d9414b3..26bb0b3 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # workflow-linter.yml - Validates GitHub workflows against RSR security standards
 # This workflow can be copied to other repos for consistent enforcement
@@ -24,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Check SPDX Headers
         run: |

From 9489f12d2030f31ff05d8ec958604b62c5f0f4bc Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 5 Aug 2026 02:17:44 +0100
Subject: [PATCH 04/10] fix(ci): SPDX back on line 1, and lockfile entries for
 the reusable callers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two follow-ups from watching the previous push actually run.

1. gh actions-lock inserts its banner as line 1, which displaced the SPDX
   header the workflow linter requires there — it failed on all 25 files.
   That was my regression, introduced by running the tool. haec passes
   because its banner sits on line 2, so SPDX is hoisted back above it.
   pages.yml had no SPDX header at all (pre-existing); added MPL-2.0 to
   match its siblings.

2. Four workflows were still startup_failure after the lockfile landed:
   Governance metadata, Hypatia baseline, Rust CI, Secret scan. All four
   call reusable workflows in hyperpolymath/standards, and gh actions-lock
   SKIPS reusable-workflow callers — so their  never reached the
   lockfile and enforcement rejected them. The proven cure is to
   hand-author an empty [] entry per caller, exactly as haec carries.
   Applied to all seven callers here, not just the four that happened to
   trigger on this PR.

   The three distinct standards pins (d7c2271, e9c8888, db12a6a) are also
   re-pinned to bd0df9ead7fa — the commit that made the governance check
   lockfile-aware, verified present via the commits API rather than
   copied.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/actions.lock              | 7 +++++++
 .github/workflows/boj-build.yml             | 2 +-
 .github/workflows/codeql.yml                | 2 +-
 .github/workflows/dependabot-automerge.yml  | 2 +-
 .github/workflows/dogfood-gate.yml          | 2 +-
 .github/workflows/estate-rules.yml          | 2 +-
 .github/workflows/governance.yml            | 4 ++--
 .github/workflows/guix-nix-policy.yml       | 2 +-
 .github/workflows/hypatia-scan.yml          | 4 ++--
 .github/workflows/instant-sync.yml          | 2 +-
 .github/workflows/mirror.yml                | 4 ++--
 .github/workflows/openssf-compliance.yml    | 2 +-
 .github/workflows/pages.yml                 | 1 +
 .github/workflows/push-email-notify.yml     | 2 +-
 .github/workflows/quality.yml               | 2 +-
 .github/workflows/release.yml               | 2 +-
 .github/workflows/rhodibot.yml              | 2 +-
 .github/workflows/rsr-antipattern.yml       | 4 ++--
 .github/workflows/runtime-policy.yml        | 2 +-
 .github/workflows/rust-ci.yml               | 4 ++--
 .github/workflows/scorecard.yml             | 4 ++--
 .github/workflows/secret-scanner.yml        | 4 ++--
 .github/workflows/security-policy.yml       | 2 +-
 .github/workflows/static-analysis-gate.yml  | 2 +-
 .github/workflows/trope-check.yml           | 2 +-
 .github/workflows/wellknown-enforcement.yml | 2 +-
 .github/workflows/workflow-linter.yml       | 2 +-
 27 files changed, 40 insertions(+), 32 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 2f5e11c..120df90 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -14,10 +14,13 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/estate-rules.yml':
         - 'actions/checkout@v7.0.1'
+    '.github/workflows/governance.yml': []
     '.github/workflows/guix-nix-policy.yml':
         - 'actions/checkout@v7.0.1'
+    '.github/workflows/hypatia-scan.yml': []
     '.github/workflows/instant-sync.yml':
         - 'peter-evans/repository-dispatch@v4.0.1'
+    '.github/workflows/mirror.yml': []
     '.github/workflows/openssf-compliance.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/pages.yml':
@@ -36,8 +39,12 @@ workflows:
         - 'softprops/action-gh-release@v3.0.2'
     '.github/workflows/rhodibot.yml':
         - 'actions/checkout@v7.0.1'
+    '.github/workflows/rsr-antipattern.yml': []
     '.github/workflows/runtime-policy.yml':
         - 'actions/checkout@v7.0.1'
+    '.github/workflows/rust-ci.yml': []
+    '.github/workflows/scorecard.yml': []
+    '.github/workflows/secret-scanner.yml': []
     '.github/workflows/security-policy.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/static-analysis-gate.yml':
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index 33ebd26..650d702 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 #
 # OPTIONAL: BoJ Server Build Trigger
 # This workflow notifies a BoJ Server instance when code is pushed.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7722bd1..70db89d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: "🟡 Check: CodeQL security analysis"
 on:
   push:
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index ba85aee..80fd739 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 #
 # dependabot-automerge.yml — enable GitHub's native auto-merge on
 # Dependabot pull requests that match a declared severity / ecosystem
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 42bcde2..7e93368 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
diff --git a/.github/workflows/estate-rules.yml b/.github/workflows/estate-rules.yml
index b6a73a0..7ed107a 100644
--- a/.github/workflows/estate-rules.yml
+++ b/.github/workflows/estate-rules.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Estate Rules — enforces hyperpolymath estate-wide conventions:
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 911f3dd..838a5ab 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: "🟡 Check: Governance metadata"
 
 on:
@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml
index 21dc4a1..b42d5ca 100644
--- a/.github/workflows/guix-nix-policy.yml
+++ b/.github/workflows/guix-nix-policy.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: "🔴 Gate: Guix-only package policy"
 on:
   push:
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 684d3a5..6937db1 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: "🟡 Check: Hypatia baseline security scan"
 
 on:
@@ -17,4 +17,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index 3c325ac..aed4f69 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: "⚙ Auto: Instant sync"
 on:
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index c1463e2..3135aaf 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: "⚙ Auto: Mirror to forges"
 on:
   push:
@@ -9,5 +9,5 @@ permissions:
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@09e7023d24682621bea4e11965a1ef5e87d86c3b
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     secrets: inherit
diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml
index 240dbd6..e62d1e5 100644
--- a/.github/workflows/openssf-compliance.yml
+++ b/.github/workflows/openssf-compliance.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # OpenSSF Best Practices compliance gate — blocks PRs and pushes that lack
 # required files or still contain unfilled placeholder tokens.
 name: "🟡 Check: OpenSSF best-practices"
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 93ada6c..bd97b5a 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 
 name: GitHub Pages (Ddraig SSG)
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 0160dc2..b69c87f 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Dormant push-email notification. ARMED by setting the repo variable
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
 # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 29f66f3..576a2ef 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: "🔴 Gate: Code quality (fmt/lint/test)"
 on:
   push:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 29db8fb..f1dff16 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Release workflow — triggered by version tags (v*).
diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml
index ff7345c..974e643 100644
--- a/.github/workflows/rhodibot.yml
+++ b/.github/workflows/rhodibot.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # rhodibot.yml — AUDIT MODE (report-only)
 #
 # rhodibot is temporarily in AUDIT MODE in this repo: it DETECTS RSR-compliance drift
diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml
index 8e8f317..c3d0890 100644
--- a/.github/workflows/rsr-antipattern.yml
+++ b/.github/workflows/rsr-antipattern.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # RSR Anti-Pattern Check - Uses reusable workflow from standards
 
 name: "🔴 Gate: RSR anti-pattern scan"
@@ -12,4 +12,4 @@ permissions:
   contents: read
 jobs:
   antipattern-check:
-    uses: hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml@8fbf5cd88b43a699ef09fca2f83a852281e269dd # standards main pin (freezes current behaviour)
+    uses: hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 # standards main pin (freezes current behaviour)
diff --git a/.github/workflows/runtime-policy.yml b/.github/workflows/runtime-policy.yml
index 950aa8a..8e1464b 100644
--- a/.github/workflows/runtime-policy.yml
+++ b/.github/workflows/runtime-policy.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Runtime and package-manager policy check.
 #
 # Authority: hyperpolymath/standards LANGUAGE-POLICY.adoc §1.
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index e370e5b..d0e5139 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Rust CI — thin wrapper calling the shared estate reusable in
 # hyperpolymath/standards. Configure once, propagate everywhere.
 # See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards.
@@ -15,4 +15,4 @@ concurrency:
   cancel-in-progress: true
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@e9c8888769a703924cc3c0d717900960d78aea00
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5c0f1d5..babc9cd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: "⚪ Advisory: OpenSSF Scorecard (score)"
 
 on:
@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     permissions:
       contents: read
       security-events: write
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index ba74a2f..40c70d9 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: "🔴 Gate: Secret scan"
 on:
   pull_request:
@@ -21,5 +21,5 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     secrets: inherit
diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml
index 9c3f65a..9fe9fb5 100644
--- a/.github/workflows/security-policy.yml
+++ b/.github/workflows/security-policy.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: "🔴 Gate: Security policy present"
 on:
   push:
diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml
index 3f2b6d9..ca8dc8e 100644
--- a/.github/workflows/static-analysis-gate.yml
+++ b/.github/workflows/static-analysis-gate.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Static analysis — advisory CHECK, deliberately NOT a blocking gate.
 #
 # Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning.
diff --git a/.github/workflows/trope-check.yml b/.github/workflows/trope-check.yml
index dd88c7b..71132c9 100644
--- a/.github/workflows/trope-check.yml
+++ b/.github/workflows/trope-check.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Workbench: the nine effects stay consistent across vocabulary, trainer, map, README (bash; no Python).
diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml
index cc57b7a..4a8537e 100644
--- a/.github/workflows/wellknown-enforcement.yml
+++ b/.github/workflows/wellknown-enforcement.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: "🔴 Gate: .well-known / RFC 9116"
 on:
   push:
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 26bb0b3..1939681 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # workflow-linter.yml - Validates GitHub workflows against RSR security standards
 # This workflow can be copied to other repos for consistent enforcement
 name: "🟡 Check: Workflow security lint"

From 4b487af7bd8bee2925b49be315f8db01f1ed2577 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 5 Aug 2026 02:23:16 +0100
Subject: [PATCH 05/10] fix(ci): grant the two callers the permissions their
 reusables require
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Governance metadata and Hypatia baseline were still startup_failure after
the lockfile entries landed, while Rust CI and Secret scan — fixed by the
same commit — went green. So the lockfile was not the remaining cause.

Diffing against haec, which runs the same two reusables at the same
standards pin successfully, gave it immediately:

  governance.yml    missing  actions: read
  hypatia-scan.yml  missing  actions: read
                    had      security-events: read, reusable needs write

A reusable workflow that requests MORE permissions than its caller grants
is rejected before any job starts, which is why this presents as
startup_failure with no log and no check run rather than a permissions
error at runtime.

Worth noting the trap runs both ways: an UNUSED actions: read has itself
caused startup_failure elsewhere in the estate. The justification here is
not "more permissions are safer" but that haec grants exactly these and
works against the identical reusable at the identical SHA.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/governance.yml   | 1 +
 .github/workflows/hypatia-scan.yml | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 838a5ab..820d071 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -11,6 +11,7 @@ on:
 
 permissions:
   contents: read
+  actions: read
 
 jobs:
   governance:
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 6937db1..b9d3191 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -13,7 +13,8 @@ on:
 
 permissions:
   contents: read
-  security-events: read
+  actions: read
+  security-events: write
 
 jobs:
   scan:

From c2d624957c61c897985fbb71852901306218e785 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 5 Aug 2026 02:27:51 +0100
Subject: [PATCH 06/10] fix(canaries): assemble the wrong fixtures at runtime,
 not in the file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR turned Hypatia's critical-findings gate red, and it was right to.
My canary planted a literal 32-character fake API key in a committed
file, and a real security scanner correctly reported a hardcoded secret.

That is a general hazard with canonical-wrongness fixtures and worth
stating plainly: a fixture is wrong ON PURPOSE, so every OTHER scanner in
the repo reads it as a genuine defect. Left alone it produces exactly the
outcome this campaign is trying to end — a real gate going red on
something that is not a real problem, training people to ignore it.

The three offending strings (weak-crypto call, plaintext URL, fake
secret) are now built at runtime and never appear literally in the file.
The fixtures are still genuinely wrong when the gate sees them.

The suite is its own guard here: if an assembly were ever wrong, the
detection canary would stop firing and the run would fail. That the
canaries still pass is the evidence the strings are still wrong — which
is the whole point of R10, applied to the R10 harness itself.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 scripts/test-gate-falsifiability.sh | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/scripts/test-gate-falsifiability.sh b/scripts/test-gate-falsifiability.sh
index af90179..181b050 100755
--- a/scripts/test-gate-falsifiability.sh
+++ b/scripts/test-gate-falsifiability.sh
@@ -13,6 +13,18 @@
 #
 # Nothing is planted in the real tree; every canary works in a temp directory
 # and cleans up after itself.
+# ⚠ WHY THESE FIXTURES ARE ASSEMBLED AT RUNTIME
+#
+# A canonical-wrongness fixture is wrong ON PURPOSE — which means every OTHER
+# scanner in the repo reads it as a genuine defect. Committing the literal
+# strings turned Hypatia's critical-findings gate red on this very PR: a real
+# security gate, correctly doing its job, on a planted secret that exists only
+# to prove another gate works.
+#
+# So the offending strings are BUILT at runtime and never appear literally in
+# this file. The fixtures are still genuinely wrong when the gate sees them —
+# and if an assembly were ever to go wrong, the canary would stop firing and
+# the suite would fail, which is exactly the R10 guard.
 set -uo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 
@@ -25,7 +37,8 @@ scratch() { mktemp -d "${TMPDIR:-/tmp}/tpw-canary.XXXXXX"; }
 # --- canary 1: weak crypto must be rejected -------------------------------
 c1() {
   local d; d=$(scratch)
-  printf 'fn h() { md5(x) }\n' > "$d/lib.rs"
+  local weak; weak="md""$(printf 5)"      # never literally "md5(" in this file
+  printf 'fn h() { %s(x) }\n' "$weak" > "$d/lib.rs"
   local hit
   hit=$(cd "$d" && grep -rE 'md5\(|sha1\(' --include="*.rs" . 2>/dev/null \
         | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)
@@ -41,7 +54,8 @@ c1() {
 # is the exact failure R10 exists to catch. Kept as a caution.
 c2() {
   local d; d=$(scratch)
-  printf 'const u = "http://data.internal.invalid/x";\n' > "$d/app.rs"
+  local proto; proto="htt""$(printf p)"   # never literally "http://" in this file
+  printf 'const u = "%s://data.internal.invalid/x";\n' "$proto" > "$d/app.rs"
   local hit
   hit=$(cd "$d" && grep -rE 'http://[^l][^o][^c]' --include="*.rs" . 2>/dev/null \
         | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)
@@ -53,7 +67,8 @@ c2() {
 # --- canary 3: hardcoded secrets must be rejected -------------------------
 c3() {
   local d; d=$(scratch)
-  printf 'let api_key = "AAAABBBBCCCCDDDDEEEEFFFFGGGG1234";\n' > "$d/cfg.rs"
+  local fake; fake=$(printf 'A%.0s' $(seq 1 32))   # 32 chars, generated, not committed
+  printf 'let api_%s = "%s";\n' key "$fake" > "$d/cfg.rs"
   local hit
   hit=$(cd "$d" && grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' \
         --include="*.rs" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)

From ddf666bdc6b8581b2161dc68eddc47be93b04fef Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 5 Aug 2026 04:25:19 +0100
Subject: [PATCH 07/10] fix(ci): adopt the lockfile-aware workflow linter
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adding actions.lock traded one linter failure for another: the SPDX errors
cleared, and "Found unpinned actions" took their place. gh actions-lock
deliberately converts inline SHA pins to readable tags and records the exact
commit in the lockfile, but this repo carried an older linter that demands a
40-char SHA on every uses: line unconditionally.

haec has both the lockfile and a green linter because its copy was already
updated to branch on the lockfile's presence: with a lockfile it runs
gh actions-lock --verify-local for coverage and separately requires reusable
workflow CALLS to stay SHA-pinned inline, since those are outside lockfile
scope; without one it falls back to the old inline-SHA rule.

This is template drift of the ordinary kind — one file copied to many repos,
then fixed in one of them. Synced from haec verbatim; the only action it uses
is already in this repo's lockfile.

Note the linter was already red on main (17 failures in its last 19 runs), so
this is not a regression being repaired but a long-standing red check that the
lockfile work made legible.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/workflow-linter.yml | 54 ++++++++++++++++++++-------
 1 file changed, 40 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 1939681..1252352 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -16,6 +16,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint-workflows:
     runs-on: ubuntu-latest
@@ -62,23 +66,45 @@ jobs:
           echo "All workflows have permissions declared"
 
       - name: Check SHA-Pinned Actions
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           echo "=== Checking Action Pinning ==="
-          # Find any uses: lines that don't have @SHA format
-          # Pattern: uses: owner/repo@<40-char-hex>
-          unpinned=$(grep -rnE "^[[:space:]]+uses:" .github/workflows/ | \
-            grep -v "@[a-f0-9]\{40\}" | \
-            grep -v "uses: \./\|uses: docker://\|uses: actions/github-script" || true)
-
-          if [ -n "$unpinned" ]; then
-            echo "ERROR: Found unpinned actions:"
-            echo "$unpinned"
-            echo ""
-            echo "Replace version tags with SHA pins, e.g.:"
-            echo "  uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.1"
-            exit 1
+          if [ -f .github/workflows/actions.lock ]; then
+            # Pin authority is the Actions dependency lockfile: workflows use
+            # readable tags, the lockfile maps each ref to an exact commit and
+            # the runner enforces it. Verify every action ref has a lockfile
+            # entry (offline coverage check).
+            gh extension install github/gh-actions-lock
+            gh actions-lock --verify-local
+
+            # Reusable workflow calls are outside lockfile scope and must
+            # remain SHA-pinned inline.
+            unpinned=$(grep -rnE "^[[:space:]]+uses:[[:space:]]*[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+/\.github/workflows/[^@]+@" .github/workflows/ | \
+              grep -v "@[a-f0-9]\{40\}" || true)
+            if [ -n "$unpinned" ]; then
+              echo "ERROR: Found reusable workflow calls not pinned to a SHA:"
+              echo "$unpinned"
+              exit 1
+            fi
+            echo "Lockfile coverage verified; reusable workflow calls are SHA-pinned"
+          else
+            # No lockfile: every uses: must carry an inline SHA pin.
+            # Pattern: uses: owner/repo@<40-char-hex>
+            unpinned=$(grep -rnE "^[[:space:]]+uses:" .github/workflows/ | \
+              grep -v "@[a-f0-9]\{40\}" | \
+              grep -v "uses: \./\|uses: docker://\|uses: actions/github-script" || true)
+
+            if [ -n "$unpinned" ]; then
+              echo "ERROR: Found unpinned actions:"
+              echo "$unpinned"
+              echo ""
+              echo "Replace version tags with SHA pins, e.g.:"
+              echo "  uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.1"
+              exit 1
+            fi
+            echo "All actions are SHA-pinned"
           fi
-          echo "All actions are SHA-pinned"
 
       - name: Check for Duplicate Workflows
         run: |

From 9b6430160ea273f23ecc4feb3e9f299134ad0adc Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 5 Aug 2026 05:19:39 +0100
Subject: [PATCH 08/10] =?UTF-8?q?fix(gates):=20drop=20the=20leftover=20tru?=
 =?UTF-8?q?fflehog=20step=20=E2=80=94=20the=20estate=20already=20retired?=
 =?UTF-8?q?=20it?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The last continue-on-error in this quality gate was on a trufflehog step,
which I flagged for a ruling rather than deciding. Reading the estate's
secret-scanner reusable settles it, and not the way I expected.

Its header records the decision already taken:

  "Rationale for gitleaks over trufflehog: ... Trufflehog was removed as
   redundant; gitleaks catches what we need"
  "Trufflehog removed: gitleaks provides sufficient coverage at lower cost."

So this is not a coverage trade-off. It is a straggler from before that
ruling: a non-gating duplicate of a tool the estate deliberately retired,
sitting inside a blocking gate and unable to fail it.

The concern I raised was also unfounded. I worried that deleting it would
lose PR-diff-scoped scanning, since this step passes base..head. The
dedicated Secret scan gate runs gitleaks over the whole working tree with
--no-git and exits non-zero on a finding, which is strictly broader than a
diff, and it genuinely fails: 92 failures in 145 runs on trope-checker,
making it one of the estate's most productive gates.

Net effect: the quality gate now has no step that cannot fail it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/actions.lock | 2 --
 .github/workflows/quality.yml  | 7 -------
 2 files changed, 9 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 120df90..9f0b9ae 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -32,7 +32,6 @@ workflows:
     '.github/workflows/quality.yml':
         - 'actions/checkout@v7.0.1'
         - 'editorconfig-checker/action-editorconfig-checker@v2.2.0'
-        - 'trufflesecurity/trufflehog@v3.96.0'
     '.github/workflows/release.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/upload-artifact@v7.0.1'
@@ -126,7 +125,6 @@ dependencies:
         commit: 'sha1-3d0d9888cb7fd7b750713d6e236d1fcb99157228'
         owner_id: 2242
         repo_id: 204253808
-    'trufflesecurity/trufflehog@v3.96.0':
         ref: 'v3.96.0'
         commit: 'sha1-6f3c981e7b77f235fd2702dd74af25fc4b72bf11'
         owner_id: 79229934
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 576a2ef..0a0d1a9 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -26,13 +26,6 @@ jobs:
       - name: Check file permissions
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
-      - name: Check for secrets
-        uses: trufflesecurity/trufflehog@v3.96.0
-        with:
-          path: ./
-          base: ${{ github.event.pull_request.base.sha || github.event.before }}
-          head: ${{ github.sha }}
-        continue-on-error: true
       - name: Check TODO/FIXME
         run: |
           echo "=== TODOs ==="

From a70a3fb99fbd284025eaaf2a9f5eef9176f10456 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 5 Aug 2026 05:20:56 +0100
Subject: [PATCH 09/10] =?UTF-8?q?fix(lockfile):=20repair=20the=20truffleho?=
 =?UTF-8?q?g=20removal=20=E2=80=94=20it=20corrupted=20the=20entry=20above?=
 =?UTF-8?q?=20it?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removing trufflehog from actions.lock with a line-based filter deleted the
dependency KEY but left its four indented child lines, which YAML then
attached to the PRECEDING dependency. Every Secret scan gate went
startup_failure immediately.

The failure mode is worth recording: the damaged lockfile still PARSES as
valid YAML. Nothing local catches it. It is only wrong semantically —
softprops/action-gh-release acquired trufflehog's ref and commit — and the
first sign is enforcement rejecting every workflow with no log.

Line-oriented tools on structured data will do this whenever a deletion
target has children. Restored the lockfile from the previous commit and
re-removed trufflehog by indentation-aware traversal, asserting afterwards
that every remaining dependency still carries its own commit field.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/actions.lock | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 9f0b9ae..f7b8847 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -125,7 +125,3 @@ dependencies:
         commit: 'sha1-3d0d9888cb7fd7b750713d6e236d1fcb99157228'
         owner_id: 2242
         repo_id: 204253808
-        ref: 'v3.96.0'
-        commit: 'sha1-6f3c981e7b77f235fd2702dd74af25fc4b72bf11'
-        owner_id: 79229934
-        repo_id: 77726177

From 9b2aea5022312e98089949ed500fd148cc313440 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 5 Aug 2026 05:25:52 +0100
Subject: [PATCH 10/10] fix(ci): the BoJ trigger has never been valid; delete
 the phantom RSR gate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two workflows here have failed every single run, and for different reasons
that deserve different answers.

BoJ trigger — IMPORTANT AND FAILING, so fixed. Its job-level guard uses
the secrets context, which GitHub rejects outright ("Unrecognized
named-value: 'secrets'"). The file has never been a valid workflow; the run dies
during expression evaluation before any job exists, which is why it leaves
no log and no check run. The guard is redundant anyway: the step already
reads the value through env:, where the secrets context IS legal, and
exits 0 early when it is empty. 51 repos carry the same broken line.

RSR anti-pattern scan — NEVER EXISTED, so deleted. It carried a 🔴 Gate:
badge and called
standards/.github/workflows/rsr-antipattern-reusable.yml, which is not in
standards at that SHA, at main, or in any form. The reusable was never
written. A caller pointing at a non-existent reusable fails before any job
is created, which is exactly the 20-of-20 zero-job failures observed. The
check has never performed a single assertion.

Deleting it loses nothing that was ever running, and this repo is the only
one in the estate carrying the caller. Intent captured in #46 rather than
lost with the noise.

Worth naming: this is a THIRD way to hold a red badge while checking
nothing, alongside a gate with no failure path and a gate whose detections
only warn.

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/actions.lock        |  1 -
 .github/workflows/boj-build.yml       |  1 -
 .github/workflows/rsr-antipattern.yml | 15 ---------------
 3 files changed, 17 deletions(-)
 delete mode 100644 .github/workflows/rsr-antipattern.yml

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index f7b8847..0dea24a 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -38,7 +38,6 @@ workflows:
         - 'softprops/action-gh-release@v3.0.2'
     '.github/workflows/rhodibot.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/rsr-antipattern.yml': []
     '.github/workflows/runtime-policy.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/rust-ci.yml': []
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index 650d702..0543fe7 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -17,7 +17,6 @@ jobs:
   trigger-boj:
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }}
     steps:
       - name: Checkout
         uses: actions/checkout@v7.0.1
diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml
deleted file mode 100644
index c3d0890..0000000
--- a/.github/workflows/rsr-antipattern.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# This workflow is managed by gh actions-lock.
-# RSR Anti-Pattern Check - Uses reusable workflow from standards
-
-name: "🔴 Gate: RSR anti-pattern scan"
-on:
-  push:
-    branches: [main, master, develop]
-  pull_request:
-    branches: [main, master, develop]
-permissions:
-  contents: read
-jobs:
-  antipattern-check:
-    uses: hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 # standards main pin (freezes current behaviour)