diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cf70835..315cbe0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -21,7 +21,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6 # renovate: pin
+      - uses: actions/checkout@v7 # renovate: pin
 
       # TS packages
       - uses: actions/setup-node@v6 # renovate: pin
@@ -200,7 +200,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6 # renovate: pin
+      - uses: actions/checkout@v7 # renovate: pin
 
       - name: Generate CycloneDX SBOM (repository scope)
         uses: anchore/sbom-action@v0 # renovate: pin
@@ -236,7 +236,7 @@ jobs:
       contents: read
       id-token: write   # required for npm provenance via OIDC
     steps:
-      - uses: actions/checkout@v6 # renovate: pin
+      - uses: actions/checkout@v7 # renovate: pin
 
       - uses: actions/setup-node@v6 # renovate: pin
         with:
@@ -330,7 +330,7 @@ jobs:
           - eep-mcp-bridge-python
           - eep-middleware-python
     steps:
-      - uses: actions/checkout@v6 # renovate: pin
+      - uses: actions/checkout@v7 # renovate: pin
 
       - uses: actions/setup-python@v6 # renovate: pin
         with:
@@ -410,7 +410,7 @@ jobs:
       contents: write    # required for Release creation
       id-token: write    # required for sigstore/cosign keyless signing
     steps:
-      - uses: actions/checkout@v6 # renovate: pin
+      - uses: actions/checkout@v7 # renovate: pin
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5cc8ae7..748df63 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,7 +10,7 @@ jobs:
   dependency-policy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -69,7 +69,7 @@ jobs:
       run:
         working-directory: tests
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -82,7 +82,7 @@ jobs:
       run:
         working-directory: packages/@eep-dev/validator
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -95,7 +95,7 @@ jobs:
       run:
         working-directory: packages/@eep-dev/signer
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -108,7 +108,7 @@ jobs:
       run:
         working-directory: packages/@eep-dev/gates
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -121,7 +121,7 @@ jobs:
       run:
         working-directory: packages/@eep-dev/compliance-cli
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -135,7 +135,7 @@ jobs:
       run:
         working-directory: packages/@eep-dev/discovery
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -148,7 +148,7 @@ jobs:
       run:
         working-directory: packages/@eep-dev/mcp-bridge
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -166,7 +166,7 @@ jobs:
       run:
         working-directory: packages/@eep-dev/setup-cli
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -179,7 +179,7 @@ jobs:
       run:
         working-directory: packages/@eep-dev/agent-adopt
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -202,7 +202,7 @@ jobs:
       run:
         working-directory: packages/@eep-dev/middleware
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -222,7 +222,7 @@ jobs:
       run:
         working-directory: packages/eep-signer-python
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
@@ -235,7 +235,7 @@ jobs:
       run:
         working-directory: packages/eep-validator-python
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
@@ -248,7 +248,7 @@ jobs:
       run:
         working-directory: packages/eep-gates-python
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
@@ -261,7 +261,7 @@ jobs:
       run:
         working-directory: packages/eep-compliance-cli-python
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
@@ -274,7 +274,7 @@ jobs:
       run:
         working-directory: packages/eep-discovery-python
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
@@ -287,7 +287,7 @@ jobs:
       run:
         working-directory: packages/eep-mcp-bridge-python
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
@@ -300,7 +300,7 @@ jobs:
       run:
         working-directory: packages/eep-middleware-python
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
@@ -314,7 +314,7 @@ jobs:
   test-cross-impl:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -378,7 +378,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v6 # renovate: pin
+      - uses: actions/checkout@v7 # renovate: pin
         with:
           fetch-depth: 0
 
@@ -410,7 +410,7 @@ jobs:
     name: Schema types drift gate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6 # renovate: pin
+      - uses: actions/checkout@v7 # renovate: pin
 
       - uses: actions/setup-node@v6 # renovate: pin
         with: