fix(fleet): restore safe fixer and gate reproducible proof-stack builds

.claude/CLAUDE.md

@@ -72,11 +72,10 @@ Control    (report < 0.85)        →  Human review required
 ## Critical Invariants
 
 1. The seven canonical A2ML files (`STATE`, `META`, `ECOSYSTEM`,
-   `AGENTIC`, `NEUROSYM`, `PLAYBOOK`, `ANCHOR`) live directly under
-   `.machine_readable/`, per the `A2ML-REPO-TEMPLATE` in
-   `hyperpolymath/standards`. (Earlier versions of this CLAUDE.md
-   referenced a `.machine_readable/6scm/` subdir; that layout has been
-   retired.)
+   `AGENTIC`, `NEUROSYM`, `PLAYBOOK`, `ANCHOR`) live under
+   `.machine_readable/descriptiles/`, per the current estate-wide policy.
+   Earlier direct-under-`.machine_readable/`, `6scm/`, and `6a2/` layouts
+   are retired and must not be restored.
 2. All shell scripts validate untrusted input before use.
 3. No hardcoded secrets — use env vars with `${VAR:-}` defaults.
 4. Fix scripts must be idempotent (safe to run multiple times).

.github/workflows/actions.lock

@@ -10,6 +10,7 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'actions/configure-pages@v6.0.0'
         - 'actions/deploy-pages@v5.0.0'
+        - 'actions/download-artifact@v8.0.1'
         - 'actions/upload-pages-artifact@v5.0.0'
         - 'haskell-actions/setup@v2.12.0'
     '.github/workflows/codeql.yml':
@@ -50,7 +51,11 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/rust.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/scorecard.yml': []
+    '.github/workflows/scorecard.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'github/codeql-action@v4.37.8'
+        - 'ossf/scorecard-action@v2.4.4'
     '.github/workflows/secret-scanner.yml': []
     '.github/workflows/supervised-fleet-scan.yml':
         - 'actions/checkout@v7.0.1'
@@ -75,6 +80,11 @@ dependencies:
         commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
         owner_id: 44036562
         repo_id: 438112499
+    'actions/download-artifact@v8.0.1':
+        ref: 'v8.0.1'
+        commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+        owner_id: 44036562
+        repo_id: 192626254
     'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
         ref: 'v7.0.0'
         commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
@@ -122,6 +132,11 @@ dependencies:
         commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
         owner_id: 6759885
         repo_id: 1352485172
+    'ossf/scorecard-action@v2.4.4':
+        ref: 'v2.4.4'
+        commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
+        owner_id: 67707773
+        repo_id: 421101922
     'peter-evans/repository-dispatch@v4.0.1':
         ref: 'v4.0.1'
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'

.github/workflows/casket-pages.yml

@@ -1,42 +1,40 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
 name: GitHub Pages
 
 on:
   push:
     branches: [main, master]
+  pull_request:
   workflow_dispatch:
 
 permissions:
-  actions: read
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
-  group: "pages"
-  cancel-in-progress: false
+  group: "pages-${{ github.event_name }}-${{ github.ref }}"
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    name: Build Pages artifact
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Checkout casket-ssg
         uses: actions/checkout@v7.0.1
         with:
           repository: hyperpolymath/casket-ssg
+          ref: cec3c20d80ea1dc93660b69a4e7b38aa49f2a56b # standalone build; optional liblol bridge
           path: .casket-ssg
-
-      - name: Setup GHCup
-        uses: haskell-actions/setup@v2.12.0
-        with:
-          ghc-version: '9.8.2'
-          cabal-version: '3.10'
+          persist-credentials: false
 
       - name: Cache Cabal
         uses: actions/cache@v6.1.0
@@ -47,12 +45,28 @@
             .casket-ssg/dist-newstyle
           key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }}
 
+      # Explicitly allowed by repository policy; actions.lock pins its commit.
+      - name: Select tested Haskell toolchain
+        uses: haskell-actions/setup@v2.12.0
+        with:
+          ghc-version: '9.6.6'
+          cabal-version: '3.10.3.0'
+
+      - name: Prepare runner Haskell toolchain
+        run: |
+          set -euo pipefail
+          ghc --version
+          cabal --version
+          cabal update
+
       - name: Build casket-ssg
         working-directory: .casket-ssg
-        run: cabal build
+        run: cabal build --index-state=2026-09-06T00:00:00Z
 
       - name: Prepare site source
         shell: bash
+        env:
+          CONTENT_REF: ${{ github.event_name == 'pull_request' && github.sha || github.ref_name }}
         run: |
           set -euo pipefail
           rm -rf .site-src _site
@@ -67,9 +81,9 @@
             README_URL=""
 
             if [ -f README.md ]; then
-              README_URL="${REPO_URL}/blob/${{ github.ref_name }}/README.md"
+              README_URL="${REPO_URL}/blob/${CONTENT_REF}/README.md"
             elif [ -f README.adoc ]; then
-              README_URL="${REPO_URL}/blob/${{ github.ref_name }}/README.adoc"
+              README_URL="${REPO_URL}/blob/${CONTENT_REF}/README.adoc"
             fi
 
             {
@@ -87,7 +101,7 @@
                 echo "- README: [project README](${README_URL})"
               fi
               if [ -d docs ]; then
-                echo "- Docs directory: [docs/](${REPO_URL}/tree/${{ github.ref_name }}/docs)"
+                echo "- Docs directory: [docs/](${REPO_URL}/tree/${CONTENT_REF}/docs)"
               fi
               echo
               echo "Project-specific site content can be added later under site/."
@@ -97,7 +111,7 @@
       - name: Build site
         run: |
           mkdir -p _site
-          cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site
+          cd .casket-ssg && cabal run --index-state=2026-09-06T00:00:00Z casket-ssg -- build ../.site-src ../_site
           touch ../_site/.nojekyll
 
       - name: Setup Pages
@@ -108,13 +122,83 @@
         with:
           path: '_site'
 
+  preview:
+    name: Validate Pages artifact
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
+    needs: build
+    timeout-minutes: 10
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - name: Download Pages artifact
+        uses: actions/download-artifact@v8.0.1
+        with:
+          name: github-pages
+          path: .pages-preview
+
+      - name: Validate deployable artifact
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          artifact=".pages-preview/artifact.tar"
+          entries_file="${RUNNER_TEMP}/pages-preview-entries.txt"
+
+          if [ ! -s "${artifact}" ]; then
+            echo "::error::Pages artifact is absent or empty"
+            exit 1
+          fi
+
+          tar -tf "${artifact}" > "${entries_file}"
+
+          entry_count=0
+          has_index=0
+          while IFS= read -r entry; do
+            entry_count=$((entry_count + 1))
+            case "${entry}" in
+              /*|../*|*/../*|*/..)
+                echo "::error::Pages artifact contains an unsafe path: ${entry}"
+                exit 1
+                ;;
+              index.html|./index.html)
+                has_index=1
+                ;;
+            esac
+          done < "${entries_file}"
+
+          if [ "${entry_count}" -eq 0 ]; then
+            echo "::error::Pages artifact contains no files"
+            exit 1
+          fi
+
+          if [ "${has_index}" -ne 1 ]; then
+            echo "::error::Pages artifact contains no index.html"
+            exit 1
+          fi
+
+          {
+            echo "### Pages preview artifact"
+            echo
+            echo "- Files: ${entry_count}"
+            echo "- SHA-256: \`$(sha256sum "${artifact}" | awk '{print $1}')\`"
+            echo "- Production deployment: intentionally deferred until merge"
+          } >> "${GITHUB_STEP_SUMMARY}"
+
   deploy:
+    name: Deploy production Pages site
+    if: github.event_name != 'pull_request'
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: build
     timeout-minutes: 10
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     steps:
       - name: Deploy to GitHub Pages
         id: deployment

.github/workflows/governance.yml

@@ -34,4 +34,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-06-27
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 # main 2026-09-04

.github/workflows/label-triage.yml

@@ -46,6 +46,7 @@ permissions:
 jobs:
   triage:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Classify and label
         env:

.github/workflows/labels.yml

@@ -32,6 +32,7 @@ permissions:
 jobs:
   sync:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Apply canonical labels
         env:

.github/workflows/rust.yml

@@ -1,6 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
 name: Rust
 # Build + test + clippy gate for the three standalone Rust crates.
 # Added after a non-compiling crate (robot-repo-automaton) reached `main`
@@ -37,14 +36,48 @@
       - name: Ensure clippy + rustfmt components
         run: rustup component add clippy rustfmt
       - name: Build (all targets)
-        run: cargo build --all-targets --verbose
+        run: cargo build --locked --all-targets --verbose
       - name: Test
-        run: cargo test --verbose
+        run: cargo test --locked --verbose
       - name: Clippy (deny warnings)
-        run: cargo clippy --all-targets -- -D warnings
+        run: cargo clippy --locked --all-targets -- -D warnings
       - name: Rustfmt check (informational)
         # Pre-existing formatting drift is not yet gated; surfaced here so it
         # stays visible without blocking. Flip to a hard gate after a dedicated
         # `cargo fmt` pass lands.
         run: cargo fmt --check
         continue-on-error: true
+
+  dispatch-contracts:
+    name: Dispatch path and outcome contracts
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - run: bash scripts/tests/dispatch-paths.sh
+
+  gsbot:
+    name: GSBot build, tests and dependency security
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    defaults:
+      run:
+        working-directory: bots/gsbot
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install native TLS build dependencies
+        run: sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev
+      - name: Build and test SQLite services
+        run: cargo test --locked --all-targets
+      - name: Install dependency graph auditor
+        run: cargo install cargo-deny --version 0.20.2 --locked
+      - name: Audit enabled dependencies (no advisory exclusions)
+        # Poise's unmaintained derive macro is reported as maintenance debt;
+        # vulnerabilities, unsoundness and yanked crates remain blocking.
+        run: cargo deny --locked --config deny.toml check advisories --warn unmaintained