Detect retired descriptile CI policy and preserve fleet repair routing

.github/workflows/bridge-gate.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>

.github/workflows/build-gossamer-gui.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Build the Hypatia GUI wasm artifact from the Ephapax/Gossamer sources.

.github/workflows/ci-health-sweep.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Owner: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>

.github/workflows/ci.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Main CI workflow for hypatia

.github/workflows/clusterfuzzlite.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Consolidated workflow (behaviour-preserving merge).

.github/workflows/codeql.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis

.github/workflows/dependabot-automerge.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 #

.github/workflows/dogfood-gate.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>

.github/workflows/estate-rescan.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Hypatia Estate Rescan — refresh verisimdb-data/scans with current truth

.github/workflows/governance.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: PMPL-1.0-or-later
 # This workflow is managed by gh actions-lock.
 name: Governance

.github/workflows/hypatia-remediation-sweep.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Hypatia Remediation Sweep — fleet-wide proactive scan

.github/workflows/hypatia-scan.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: PMPL-1.0-or-later
 # This workflow is managed by gh actions-lock.
 name: Hypatia Security Scan

.github/workflows/inbox-steward-intake.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Inbox Steward Intake — Process reports from gitbot-fleet inbox-steward

.github/workflows/label-triage.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Label Triage
 

.github/workflows/labels.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Labels
 

.github/workflows/language-blockers.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Consolidated workflow (behaviour-preserving merge).

.github/workflows/merge-orchestrate.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>

.github/workflows/mirror.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Mirror to Git Forges

.github/workflows/pages.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: GitHub Pages (Ddraig SSG)

.github/workflows/push-email-notify.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Dormant push-email notification. ARMED by setting the repo variable

.github/workflows/quality.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Consolidated workflow (behaviour-preserving merge).

.github/workflows/release.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Consolidated workflow (behaviour-preserving merge).

.github/workflows/roadmap-sync.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Centralized roadmap sweeper: adds recently-touched issues & PRs from every

.github/workflows/rust.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Consolidated workflow (behaviour-preserving merge).

.github/workflows/scorecard.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: PMPL-1.0-or-later
 # This workflow is managed by gh actions-lock.
 name: OSSF Scorecard

.github/workflows/secret-scanner.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Secret Scanner

.github/workflows/security-policy.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Consolidated workflow (behaviour-preserving merge).

.github/workflows/tests.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Consolidated workflow (behaviour-preserving merge).

.github/workflows/verify-proofs.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Consolidated workflow (behaviour-preserving merge).

data/verisim/recipes/recipe-retired-descriptile-policy.json

@@ -0,0 +1,16 @@
+{
+  "id": "recipe-retired-descriptile-policy",
+  "name": "Align CI descriptile checks with the canonical tree",
+  "description": "Repair the policy reference only after the canonical descriptile exists; never recreate retired copies.",
+  "triangle_tier": "eliminate",
+  "pattern_ids": ["SD024", "structural_drift/SD024"],
+  "target_categories": ["RetiredDescriptilePolicy"],
+  "languages": ["yaml", "shell", "bash", "just"],
+  "confidence": 0.95,
+  "auto_fixable": true,
+  "fix_script": "fix-retired-descriptile-policy.sh",
+  "action": "replace",
+  "formally_proven": false,
+  "successful_fixes": 0,
+  "failed_fixes": 0
+}

lib/hypatia/cli.ex

@@ -791,6 +791,7 @@ defmodule Hypatia.CLI do
                   reason: f.reason,
                   action: to_string(f.action)
                 }
+                |> Map.merge(Map.take(f, [:line, :category, :recipe_id, :fix_script, :target]))
               end)
 
             results ++ normalized

lib/rules/structural_drift.ex

@@ -745,7 +745,8 @@ defmodule Hypatia.Rules.StructuralDrift do
         sd013_path_specific_gitignore(repo_path) ++
         sd014_safedom_example_dialect(repo_path) ++
         sd022_stale_path_after_rename(repo_path) ++
-        sd023_state_a2ml_divergence(repo_path)
+        sd023_state_a2ml_divergence(repo_path) ++
+        sd024_retired_descriptile_policy(repo_path)
 
     needs_intensive = Enum.any?(findings, & &1[:trigger_intensive])
     needs_alert = Enum.any?(findings, & &1[:alert_user])
@@ -762,6 +763,73 @@ defmodule Hypatia.Rules.StructuralDrift do
 
   # ─── Helpers ───────────────────────────────────────────────────────────
 
+  @doc """
+  SD024: Detect executable policy that requires descriptiles in retired paths.
+
+  A canonical tree can never satisfy such a check and SD004 simultaneously.
+  Report the policy file for reference repair; do not suggest recreating the
+  retired file. Documentation and commented examples are outside this rule.
+  """
+  def sd024_retired_descriptile_policy(repo_path) do
+    files =
+      Path.wildcard(Path.join(repo_path, ".github/workflows/*.{yml,yaml}")) ++
+        Path.wildcard(Path.join(repo_path, "scripts/*.sh")) ++
+        Path.wildcard(Path.join(repo_path, ".githooks/*.sh")) ++
+        Enum.map(["Justfile", "justfile"], &Path.join(repo_path, &1))
+
+    Enum.flat_map(files, fn file ->
+      case File.read(file) do
+        {:ok, content} ->
+          content
+          |> String.split("\n")
+          |> Enum.with_index(1)
+          |> Enum.flat_map(fn {line, number} ->
+            legacy =
+              ~r/\.machine_readable\/(?:6a2\/)?(?:STATE|META|ECOSYSTEM|AGENTIC|NEUROSYM|PLAYBOOK|ANCHOR)\.a2ml/
+
+            # Quoted examples are prose, but quoted literal paths and shell
+            # command substitutions still participate in executable checks.
+            code =
+              Regex.replace(~r/"(?:\\.|[^"\\])*"|'[^']*'/, line, fn quoted ->
+                value = String.slice(quoted, 1, String.length(quoted) - 2)
+
+                if Regex.match?(~r/^#{legacy.source}$/, value) or
+                     (String.starts_with?(quoted, "\"") and
+                        (String.contains?(value, "$(") or String.contains?(value, "`"))) do
+                  value
+                else
+                  " "
+                end
+              end)
+
+            if not String.starts_with?(String.trim_leading(line), "#") and
+                 Regex.match?(~r/(?:\s-f\s|\s-e\s|check_file\s)/, code) and
+                 Regex.match?(legacy, code) do
+              [
+                %{
+                  rule: "SD024",
+                  file: Path.relative_to(file, repo_path),
+                  line: number,
+                  severity: :high,
+                  reason:
+                    "CI policy requires a retired descriptile path; align the check with .machine_readable/descriptiles/",
+                  category: "RetiredDescriptilePolicy",
+                  action: :update_reference,
+                  recipe_id: "recipe-retired-descriptile-policy",
+                  fix_script: "fix-retired-descriptile-policy.sh"
+                }
+              ]
+            else
+              []
+            end
+          end)
+
+        {:error, _} ->
+          []
+      end
+    end)
+  end
+
   defp group_by_severity(findings) do
     findings
     |> Enum.group_by(& &1.severity)

test/retired_descriptile_policy_test.exs

@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: MPL-2.0
+defmodule Hypatia.RetiredDescriptilePolicyTest do
+  use ExUnit.Case, async: true
+  alias Hypatia.Rules.StructuralDrift
+
+  test "detects the contradictory check and routes reference repair" do
+    repo =
+      Path.join(System.tmp_dir!(), "descriptile-policy-#{System.unique_integer([:positive])}")
+
+    File.mkdir_p!(Path.join(repo, ".github/workflows"))
+    on_exit(fn -> File.rm_rf!(repo) end)
+    file = Path.join(repo, ".github/workflows/compliance.yml")
+    File.write!(file, "run: |\n  if [ ! -f .machine_readable/STATE.a2ml ]; then exit 1; fi\n")
+    [finding] = StructuralDrift.sd024_retired_descriptile_policy(repo)
+    assert finding.rule == "SD024"
+    assert finding.line == 2
+    assert finding.action == :update_reference
+    assert finding.fix_script == "fix-retired-descriptile-policy.sh"
+
+    normalized =
+      Hypatia.CLI.collect_findings(repo, [:structural_drift])
+      |> Enum.find(&(&1.type == "SD024"))
+
+    assert normalized.category == "RetiredDescriptilePolicy"
+    assert normalized.recipe_id == "recipe-retired-descriptile-policy"
+    assert normalized.fix_script == "fix-retired-descriptile-policy.sh"
+    assert normalized.line == 2
+
+    File.write!(
+      file,
+      "run: |\n  if [ ! -f .machine_readable/descriptiles/STATE.a2ml ]; then exit 1; fi\n"
+    )
+
+    assert StructuralDrift.sd024_retired_descriptile_policy(repo) == []
+    File.write!(file, "# if [ ! -f .machine_readable/6a2/STATE.a2ml ]; then exit 1; fi\n")
+    assert StructuralDrift.sd024_retired_descriptile_policy(repo) == []
+
+    for prose <- [
+          ~s(echo "test -f .machine_readable/STATE.a2ml"),
+          ~s(printf '%s' 'check_file .machine_readable/META.a2ml')
+        ] do
+      File.write!(file, "run: |\n  #{prose}\n")
+      assert StructuralDrift.sd024_retired_descriptile_policy(repo) == []
+    end
+
+    for command <- [
+          ~s(test -f ".machine_readable/STATE.a2ml"),
+          ~s(test -e '.machine_readable/6a2/META.a2ml'),
+          ~s(check_file '.machine_readable/AGENTIC.a2ml')
+        ] do
+      File.write!(file, "run: |\n  #{command}\n")
+      assert [%{rule: "SD024"}] = StructuralDrift.sd024_retired_descriptile_policy(repo)
+    end
+  end
+end