Repair retired descriptile CI references with canonical-file safeguards

.claude/CLAUDE.md

@@ -72,11 +72,10 @@ Control    (report < 0.85)        →  Human review required
 ## Critical Invariants
 
 1. The seven canonical A2ML files (`STATE`, `META`, `ECOSYSTEM`,
-   `AGENTIC`, `NEUROSYM`, `PLAYBOOK`, `ANCHOR`) live directly under
-   `.machine_readable/`, per the `A2ML-REPO-TEMPLATE` in
-   `hyperpolymath/standards`. (Earlier versions of this CLAUDE.md
-   referenced a `.machine_readable/6scm/` subdir; that layout has been
-   retired.)
+   `AGENTIC`, `NEUROSYM`, `PLAYBOOK`, `ANCHOR`) live under
+   `.machine_readable/descriptiles/`, per the current estate-wide policy.
+   Earlier direct-under-`.machine_readable/`, `6scm/`, and `6a2/` layouts
+   are retired and must not be restored.
 2. All shell scripts validate untrusted input before use.
 3. No hardcoded secrets — use env vars with `${VAR:-}` defaults.
 4. Fix scripts must be idempotent (safe to run multiple times).

.github/workflows/actions.lock

@@ -10,14 +10,15 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'actions/configure-pages@v6.0.0'
         - 'actions/deploy-pages@v5.0.0'
+        - 'actions/download-artifact@v8.0.1'
         - 'actions/upload-pages-artifact@v5.0.0'
         - 'haskell-actions/setup@v2.12.0'
     '.github/workflows/codeql.yml':
         - 'actions/checkout@v7.0.1'
         - 'github/codeql-action@v4.37.8'
     '.github/workflows/dogfood-gate.yml':
         - 'actions/checkout@v7.0.1'
-        - 'hyperpolymath/a2ml-ecosystem@main'
+        - 'hyperpolymath/deed-ecosystem@main'
         - 'hyperpolymath/k9-ecosystem@main'
     '.github/workflows/e2e.yml':
         - 'actions/checkout@v7.0.1'
@@ -50,7 +51,11 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/rust.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/scorecard.yml': []
+    '.github/workflows/scorecard.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'github/codeql-action@v4.37.8'
+        - 'ossf/scorecard-action@v2.4.4'
     '.github/workflows/secret-scanner.yml': []
     '.github/workflows/supervised-fleet-scan.yml':
         - 'actions/checkout@v7.0.1'
@@ -75,6 +80,11 @@ dependencies:
         commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
         owner_id: 44036562
         repo_id: 438112499
+    'actions/download-artifact@v8.0.1':
+        ref: 'v8.0.1'
+        commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+        owner_id: 44036562
+        repo_id: 192626254
     'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
         ref: 'v7.0.0'
         commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
@@ -107,21 +117,26 @@ dependencies:
         commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
         owner_id: 75048950
         repo_id: 623796603
-    'hyperpolymath/a2ml-ecosystem@main':
+    'hyperpolymath/deed-ecosystem@main':
         ref: 'main'
-        commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79'
+        commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d'
         owner_id: 6759885
         repo_id: 1275649586
     'hyperpolymath/k9-ecosystem@main':
         ref: 'main'
-        commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562'
+        commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb'
         owner_id: 6759885
         repo_id: 1275650185
     'hyperpolymath/smtp-notify-action@v0.2.0':
         ref: 'v0.2.0'
         commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
         owner_id: 6759885
         repo_id: 1352485172
+    'ossf/scorecard-action@v2.4.4':
+        ref: 'v2.4.4'
+        commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
+        owner_id: 67707773
+        repo_id: 421101922
     'peter-evans/repository-dispatch@v4.0.1':
         ref: 'v4.0.1'
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'

.github/workflows/boj-build.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.

.github/workflows/casket-pages.yml

@@ -1,42 +1,41 @@
-# SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: GitHub Pages
 
 on:
   push:
     branches: [main, master]
+  pull_request:
   workflow_dispatch:
 
 permissions:
-  actions: read
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
-  group: "pages"
-  cancel-in-progress: false
+  group: "pages-${{ github.event_name }}-${{ github.ref }}"
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    name: Build Pages artifact
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Checkout casket-ssg
         uses: actions/checkout@v7.0.1
         with:
           repository: hyperpolymath/casket-ssg
+          ref: cec3c20d80ea1dc93660b69a4e7b38aa49f2a56b # standalone build; optional liblol bridge
           path: .casket-ssg
-
-      - name: Setup GHCup
-        uses: haskell-actions/setup@v2.12.0
-        with:
-          ghc-version: '9.8.2'
-          cabal-version: '3.10'
+          persist-credentials: false
 
       - name: Cache Cabal
         uses: actions/cache@v6.1.0
@@ -47,12 +46,28 @@ jobs:
             .casket-ssg/dist-newstyle
           key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }}
 
+      # Explicitly allowed by repository policy; actions.lock pins its commit.
+      - name: Select tested Haskell toolchain
+        uses: haskell-actions/setup@v2.12.0
+        with:
+          ghc-version: '9.6.6'
+          cabal-version: '3.10.3.0'
+
+      - name: Prepare runner Haskell toolchain
+        run: |
+          set -euo pipefail
+          ghc --version
+          cabal --version
+          cabal update
+
       - name: Build casket-ssg
         working-directory: .casket-ssg
-        run: cabal build
+        run: cabal build --index-state=2026-09-06T00:00:00Z
 
       - name: Prepare site source
         shell: bash
+        env:
+          CONTENT_REF: ${{ github.event_name == 'pull_request' && github.sha || github.ref_name }}
         run: |
           set -euo pipefail
           rm -rf .site-src _site
@@ -67,9 +82,9 @@ jobs:
             README_URL=""
 
             if [ -f README.md ]; then
-              README_URL="${REPO_URL}/blob/${{ github.ref_name }}/README.md"
+              README_URL="${REPO_URL}/blob/${CONTENT_REF}/README.md"
             elif [ -f README.adoc ]; then
-              README_URL="${REPO_URL}/blob/${{ github.ref_name }}/README.adoc"
+              README_URL="${REPO_URL}/blob/${CONTENT_REF}/README.adoc"
             fi
 
             {
@@ -87,7 +102,7 @@ jobs:
                 echo "- README: [project README](${README_URL})"
               fi
               if [ -d docs ]; then
-                echo "- Docs directory: [docs/](${REPO_URL}/tree/${{ github.ref_name }}/docs)"
+                echo "- Docs directory: [docs/](${REPO_URL}/tree/${CONTENT_REF}/docs)"
               fi
               echo
               echo "Project-specific site content can be added later under site/."
@@ -97,7 +112,7 @@ jobs:
       - name: Build site
         run: |
           mkdir -p _site
-          cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site
+          cd .casket-ssg && cabal run --index-state=2026-09-06T00:00:00Z casket-ssg -- build ../.site-src ../_site
           touch ../_site/.nojekyll
 
       - name: Setup Pages
@@ -108,13 +123,83 @@ jobs:
         with:
           path: '_site'
 
+  preview:
+    name: Validate Pages artifact
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
+    needs: build
+    timeout-minutes: 10
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - name: Download Pages artifact
+        uses: actions/download-artifact@v8.0.1
+        with:
+          name: github-pages
+          path: .pages-preview
+
+      - name: Validate deployable artifact
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          artifact=".pages-preview/artifact.tar"
+          entries_file="${RUNNER_TEMP}/pages-preview-entries.txt"
+
+          if [ ! -s "${artifact}" ]; then
+            echo "::error::Pages artifact is absent or empty"
+            exit 1
+          fi
+
+          tar -tf "${artifact}" > "${entries_file}"
+
+          entry_count=0
+          has_index=0
+          while IFS= read -r entry; do
+            entry_count=$((entry_count + 1))
+            case "${entry}" in
+              /*|../*|*/../*|*/..)
+                echo "::error::Pages artifact contains an unsafe path: ${entry}"
+                exit 1
+                ;;
+              index.html|./index.html)
+                has_index=1
+                ;;
+            esac
+          done < "${entries_file}"
+
+          if [ "${entry_count}" -eq 0 ]; then
+            echo "::error::Pages artifact contains no files"
+            exit 1
+          fi
+
+          if [ "${has_index}" -ne 1 ]; then
+            echo "::error::Pages artifact contains no index.html"
+            exit 1
+          fi
+
+          {
+            echo "### Pages preview artifact"
+            echo
+            echo "- Files: ${entry_count}"
+            echo "- SHA-256: \`$(sha256sum "${artifact}" | awk '{print $1}')\`"
+            echo "- Production deployment: intentionally deferred until merge"
+          } >> "${GITHUB_STEP_SUMMARY}"
+
   deploy:
+    name: Deploy production Pages site
+    if: github.event_name != 'pull_request'
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: build
     timeout-minutes: 10
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     steps:
       - name: Deploy to GitHub Pages
         id: deployment

.github/workflows/codeql.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.

.github/workflows/dogfood-gate.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
@@ -46,7 +47,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-ecosystem/validate-action@main
+        uses: hyperpolymath/deed-ecosystem/validate-action@main
         with:
           path: '.'
           strict: 'false'

.github/workflows/e2e.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
@@ -21,3 +22,5 @@ jobs:
         run: pip install pyyaml --quiet
       - name: Run E2E tests
         run: bash tests/e2e.sh
+      - name: Verify canonical descriptile policy repair
+        run: bash tests/retired-descriptile-policy-test.sh

.github/workflows/governance.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
@@ -34,4 +35,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-06-27
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540

.github/workflows/hypatia-dispatch-intake.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.

.github/workflows/hypatia-scan.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
@@ -30,7 +31,7 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
     secrets: inherit
     # Total caller-side wall-clock cap for the reusable. Matches
     # Hypatia's `missing_timeout_minutes` rule expectation. The scan is

.github/workflows/inbox-steward.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.

.github/workflows/instant-sync.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.

.github/workflows/label-triage.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Label Triage
 
@@ -46,6 +47,7 @@
 jobs:
   triage:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Classify and label
         env:

.github/workflows/labels.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Labels
 
@@ -32,6 +33,7 @@
 jobs:
   sync:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Apply canonical labels
         env:

.github/workflows/learning-loop.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.

.github/workflows/mirror.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.