feat(fix-scripts): repair the three workflow-pin defect classes; re-pin this repo's standards callers

.github/workflows/actions.lock

@@ -10,7 +10,7 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'actions/configure-pages@v6.0.0'
         - 'actions/deploy-pages@v5.0.1'
-        - 'actions/download-artifact@v8.0.1'
+        - 'actions/download-artifact@v8.0.2'
         - 'actions/upload-pages-artifact@v5.0.0'
         - 'haskell-actions/setup@v2.12.1'
     '.github/workflows/codeql.yml':
@@ -23,11 +23,11 @@ workflows:
     '.github/workflows/e2e.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/governance.yml':
-        - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540'
+        - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
     '.github/workflows/hypatia-dispatch-intake.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/hypatia-scan.yml':
-        - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540'
+        - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
     '.github/workflows/inbox-steward.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/instant-sync.yml':
@@ -36,17 +36,17 @@ workflows:
     '.github/workflows/labels.yml': []
     '.github/workflows/learning-loop.yml':
         - 'actions/checkout@v7.0.1'
-        - 'actions/upload-artifact@v7.0.1'
+        - 'actions/upload-artifact@v7.0.2'
     '.github/workflows/lock-sync-gate.yml': []
     '.github/workflows/mirror.yml':
-        - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd'
+        - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
     '.github/workflows/pages.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/deploy-pages@v5.0.1'
         - 'actions/upload-pages-artifact@v5.0.0'
     '.github/workflows/panicbot-sweep.yml':
         - 'actions/checkout@v7.0.1'
-        - 'actions/upload-artifact@v7.0.1'
+        - 'actions/upload-artifact@v7.0.2'
         - 'dtolnay/rust-toolchain@v1'
         - 'swatinem/rust-cache@v2.9.2'
     '.github/workflows/push-email-notify.yml':
@@ -56,16 +56,16 @@ workflows:
     '.github/workflows/rust.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/scorecard.yml':
-        - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540'
+        - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
     '.github/workflows/secret-scanner.yml':
-        - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd'
+        - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
     '.github/workflows/supervised-fleet-scan.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/vendored-bot-drift.yml':
         - 'actions/checkout@v7.0.1'
 dependencies:
     'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
-        ref: '55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        ref: 'v6.1.0'
         commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         owner_id: 44036562
         repo_id: 215566462
@@ -75,7 +75,7 @@ dependencies:
         owner_id: 44036562
         repo_id: 215566462
     'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
-        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        ref: 'v7.0.1'
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
         owner_id: 44036562
         repo_id: 197814629
@@ -94,24 +94,24 @@ dependencies:
         commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
         owner_id: 44036562
         repo_id: 438112499
-    'actions/download-artifact@v8.0.1':
-        ref: 'v8.0.1'
-        commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+    'actions/download-artifact@v8.0.2':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
         owner_id: 44036562
         repo_id: 192626254
-    'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
-        ref: '043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
-        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
-        owner_id: 44036562
-        repo_id: 192625955
     'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
         ref: 'v7.0.0'
         commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
         owner_id: 44036562
         repo_id: 192625955
-    'actions/upload-artifact@v7.0.1':
-        ref: 'v7.0.1'
-        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+    'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
         owner_id: 44036562
         repo_id: 192625955
     'actions/upload-pages-artifact@v5.0.0':
@@ -121,9 +121,14 @@ dependencies:
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
-    'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
-        ref: '6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
-        commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
+    'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
+        ref: 'v2.0.5'
+        commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        owner_id: 42048915
+        repo_id: 356423100
+    'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f':
+        ref: 'v1'
+        commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f'
         owner_id: 1940490
         repo_id: 260749683
     'dtolnay/rust-toolchain@v1':
@@ -132,18 +137,18 @@ dependencies:
         owner_id: 1940490
         repo_id: 260749683
     'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
-        ref: '51f63319f592f97930c73d9c46184d20bd206393'
+        ref: 'v3.0.0'
         commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
         owner_id: 26415196
         repo_id: 297874902
     'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
-        ref: '54075bcc5e249e4758d363f27d099f55d843f124'
+        ref: 'v1.24.1'
         commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
         owner_id: 47606891
         repo_id: 331103973
-    'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938':
-        ref: 'cdf488f595d80d6e07e03d4674febd5ab45fa938'
-        commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938'
+    'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63':
+        ref: 'v4.38.0'
+        commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
         owner_id: 9919
         repo_id: 259445878
     'github/codeql-action@v4.38.2':
@@ -171,33 +176,33 @@ dependencies:
         commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
         owner_id: 6759885
         repo_id: 1352485172
-    'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd':
-        ref: '571cc734cd69fb846032ec77a662aa8ee4fc32cd'
-        commit: 'sha1-571cc734cd69fb846032ec77a662aa8ee4fc32cd'
-        owner_id: 6759885
-        repo_id: 1116521501
-        uses:
-            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
-            - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
-            - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
-    'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540':
-        ref: 'da2c748aad55c1a1dcba00b60fe4a35017bc6540'
-        commit: 'sha1-da2c748aad55c1a1dcba00b60fe4a35017bc6540'
+    'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66':
+        ref: '75bd5994470661a099df562d6d5ad2fe744dbd66'
+        commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66'
         owner_id: 6759885
         repo_id: 1116521501
         uses:
             - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
             - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
-            - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+            - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+            - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+            - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f'
             - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
             - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
-            - 'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938'
+            - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
             - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
+            - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
+            - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
     'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
-        ref: '2d1146689b8cda280b9bc96326124645441f03bc'
+        ref: 'v2.4.4'
         commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
         owner_id: 67707773
         repo_id: 421101922
+    'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
+        ref: 'v2.2.0'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635
     'peter-evans/repository-dispatch@v4.0.1':
         ref: 'v4.0.1'
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
@@ -209,7 +214,7 @@ dependencies:
         owner_id: 580492
         repo_id: 298565987
     'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
-        ref: 'e83874834305fe9a4a2997156cb26c5de65a8555'
+        ref: 'v0.10.0'
         commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
         owner_id: 135788
         repo_id: 208510314

.github/workflows/governance.yml

@@ -35,7 +35,7 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
     permissions:
       actions: read
       contents: read

.github/workflows/hypatia-scan.yml

@@ -31,8 +31,10 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
-    secrets: inherit
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
+    # hypatia-scan-reusable declares one secret; pass that one, not everything.
+    secrets:
+      HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}
     # Total caller-side wall-clock cap for the reusable. Matches
     # Hypatia's `missing_timeout_minutes` rule expectation. The scan is
     # typically ~3 min; the cap leaves headroom for slow estate builds.

.github/workflows/mirror.yml

@@ -15,8 +15,17 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
-    secrets: inherit
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
+    # mirror-reusable declares exactly these seven forge keys and forbids
+    # `secrets: inherit`; pass them by name.
+    secrets:
+      GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
+      BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
+      CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }}
+      SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }}
+      DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }}
+      GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }}
+      RADICLE_KEY: ${{ secrets.RADICLE_KEY }}
     permissions:
       actions: read
       contents: read

.github/workflows/rust.yml

@@ -65,12 +65,11 @@ jobs:
         run: cargo test --locked --verbose
       - name: Clippy (deny warnings)
         run: cargo clippy --locked --all-targets -- -D warnings
-      - name: Rustfmt check (informational)
-        # Pre-existing formatting drift is not yet gated; surfaced here so it
-        # stays visible without blocking. Flip to a hard gate after a dedicated
-        # `cargo fmt` pass lands.
+      - name: Rustfmt check
+        # A hard gate since 2026-10-19: all four matrix crates were measured
+        # rustfmt-clean, so `continue-on-error` (hypatia RE005, a silent
+        # green) no longer buys anything.
         run: cargo fmt --check
-        continue-on-error: true
 
   dispatch-contracts:
     name: Dispatch path and outcome contracts
@@ -83,6 +82,8 @@ jobs:
         with:
           persist-credentials: false
       - run: bash scripts/tests/dispatch-paths.sh
+      - name: Workflow-pin fix scripts keep their contracts
+        run: bash scripts/tests/fix-workflow-pins.sh
 
   gsbot:
     name: GSBot build, tests and dependency security

.github/workflows/scorecard.yml

@@ -18,4 +18,4 @@ jobs:
       contents: read
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66

.github/workflows/secret-scanner.yml

@@ -24,5 +24,5 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
-    secrets: inherit
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
+    # secret-scanner-reusable declares no caller secret, so none is passed.

.gitleaksignore

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: MPL-2.0
+# gitleaks fingerprints (commit:file:rule:line) of historical false positives.
+# Each is a documented placeholder, not a credential; the sustainabot file no
+# longer exists (deleted in ded43d0) and the seambot literal is `ghs_xxx…`.
+d1d8e1db885c6bf15833d413cdae42a5710d7ff4:bots/seambot/tests/github_integration.rs:github-app-token:154
+37db42f48f7f85f2558a57e3f6643a62f39da2bc:bots/seambot/tests/github_integration.rs:github-app-token:154
+f1b3dc853aa9c13e47fde308681c4a1e0bb58eb1:bots/seambot/tests/github_integration.rs:github-app-token:154
+d1d8e1db885c6bf15833d413cdae42a5710d7ff4:bots/sustainabot/docs/GITHUB_APP_SETUP.md:private-key:89
+37db42f48f7f85f2558a57e3f6643a62f39da2bc:bots/sustainabot/docs/GITHUB_APP_SETUP.md:private-key:89
+f1b3dc853aa9c13e47fde308681c4a1e0bb58eb1:bots/sustainabot/docs/GITHUB_APP_SETUP.md:private-key:89

.machine_readable/descriptiles/AGENTIC.a2ml

@@ -35,6 +35,24 @@ allow-silent-skip = false
 require-rerun-after-fix = true
 release-claim-requires-hard-pass = true
 
+[workflow-pin-remediation]
+# The fleet's half of the pin-propagation architecture
+#   hypatia (detection) -> gitbot-fleet (this: actuation) -> .git-private-farm (propagation)
+# Three fix scripts, one contract test (scripts/tests/fix-workflow-pins.sh, run
+# by rust.yml), and two data files that carry the SAME facts hypatia detects
+# on, so detection and repair cannot drift apart:
+#   scripts/fix-rust-toolchain-input.sh   WF026  SHA-pinned dtolnay/rust-toolchain with no toolchain: input
+#   scripts/fix-stale-reusable-pin.sh     WF027, PIN-003, WF016  a caller pinned at a reusable revision the estate has MEASURED dead
+#   scripts/fix-lock-self-sha-refs.sh     PI006  actions.lock record whose ref is its own SHA (GitHub: "invalid lockfile pin")
+#   scripts/lib/stale-reusable-pins.tsv   the dead revisions and the one replacement each moves to
+#   scripts/lib/action-ref-tags.tsv       the tag that resolves to each commit the estate pins by SHA
+may-rewrite-reusable-pins = true           # only to a replacement the table names; never "newest"
+may-rewrite-actions-lock = true            # SHA substitution and ref:tag only; nested uses: lists are never recomputed here
+may-choose-replacement-sha = false         # a human picks it against standards/scripts/lock-selfcheck.sh and records it in the table
+may-run-network-lookups = true             # git ls-remote --tags for a tag the map lacks; --offline disables it
+must-report-unresolved = true              # a self-SHA record with no tag is reported and left, never guessed (exit 1)
+must-be-idempotent = true                  # every script's second run is byte-identical; the contract test asserts it
+
 [automation-hooks]
 # on-enter: Read 0-AI-MANIFEST.a2ml, then .machine_readable/descriptiles/STATE.a2ml
 # on-exit: Update .machine_readable/descriptiles/STATE.a2ml with session outcomes

fleet-coordinator.sh

@@ -632,15 +632,17 @@ EOF
     fi
 }
 
-create_rule_approval_pr() {
+create_rule_approval_pr() (
     local rule_file="$1"
     local rule_type="$2"
     local observations="$3"
 
     log_bot "hypatia" "Creating rule approval PR for $rule_type..."
 
     # Clone hypatia repo to temp directory
-    local hypatia_dir="/tmp/hypatia-rule-pr-$$"
+    local hypatia_dir
+    hypatia_dir="$(mktemp -d)"
+    trap 'rm -rf "$hypatia_dir"' EXIT
     git clone https://github.com/hyperpolymath/hypatia.git "$hypatia_dir" 2>/dev/null
 
     cd "$hypatia_dir"
@@ -680,7 +682,6 @@ COMMIT_EOF
     git push origin "$branch_name" 2>/dev/null || {
         log_warn "Failed to push rule PR branch"
         cd - > /dev/null
-        rm -rf "$hypatia_dir"
         return 1
     }
 
@@ -734,8 +735,7 @@ PR_BODY
     fi
 
     cd - > /dev/null
-    rm -rf "$hypatia_dir"
-}
+)
 
 deploy_bots() {
     log_error "BLOCKED: deployment readiness is not verified; deployment is quarantined. See docs/AUTOMATION-QUARANTINE.adoc."

robot-repo-automaton/templates/skeleton/Justfile

@@ -150,7 +150,7 @@ e2e:
     @echo "Running E2E tests..."
     # TODO: Replace with your E2E test command. Examples:
     #   bash tests/e2e.sh                    # Shell-based E2E
-    #   npx playwright test                  # Browser E2E
+    #   bunx playwright test                 # Browser E2E
     #   mix test test/integration/e2e_test.exs  # Elixir E2E
     #   cargo test --test end_to_end         # Rust E2E
     @echo "E2E tests passed!"

run-fleet.sh

@@ -379,7 +379,7 @@ cmd_fix() {
                     innerhtml_assignment|*innerHTML*)        registry_key="XSS" ;;
                     rust_unwrap|unwrap_without_check|*unwrap*) registry_key="PanicPath" ;;
                     wildcard_cors|*cors*)                    registry_key="CORSWildcard" ;;
-                    eval_in_shell|*eval*)                    registry_key="DynamicCodeExecution" ;;
+                    eval_in_shell|*eval*)                    registry_key="DynamicCodeExecution" ;;  # hypatia: allow content_patterns/eval_in_shell -- detector or message text naming eval in target files; this line does not run eval
                     hardcoded_tmp|*tmp_path*)                registry_key="UncheckedAllocation" ;;
                     *sql_inject*|*parameteriz*)              registry_key="SQLInjection" ;;
                     *shell_inject*|*shell_quot*)             registry_key="ShellInjection" ;;