fix(ci): restore baseline validation gates

.github/workflows/dogfood-gate.yml

@@ -30,6 +30,24 @@ jobs:
           if [ "$COUNT" -eq 0 ]; then
             echo "::warning::No .a2ml manifest files found. Every RSR repo should have 0-AI-MANIFEST.a2ml"
           fi
+      - name: Prove A2ML validator rejects an invalid manifest
+        run: |
+          set -euo pipefail
+          control_dir=$(mktemp -d "$RUNNER_TEMP/a2ml-negative-control.XXXXXX")
+          trap 'rm -rf "$control_dir"' EXIT
+          touch "$control_dir/invalid.a2ml"
+
+          if output=$(INPUT_PATH="$control_dir" bash .githooks/validate-a2ml.sh 2>&1); then
+            echo "::error::A2ML validator accepted an empty manifest"
+            exit 1
+          fi
+          if ! grep -q 'Missing required identity field' <<< "$output"; then
+            echo "::error::A2ML validator failed for an unexpected reason"
+            printf '%s\n' "$output"
+            exit 1
+          fi
+
+          echo "A2ML negative control rejected as expected"
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
         run: bash .githooks/validate-a2ml.sh

.github/workflows/secret-scanner.yml

@@ -13,5 +13,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@5b5dab9fb89c0ab7187ddc334d8995bd24392e41
     secrets: inherit

.hypatia-baseline.json

@@ -5,78 +5,78 @@
     "type": "banned_language_file",
     "file_pattern": "rescript-ecosystem/**",
     "note": "rescript-ecosystem is a vendor/upstream collection of ReScript libraries and forks; migration to AffineScript tracked in estate migration plan.",
-    "tracking_issue": "https://github.com/hyperpolymath/developer-ecosystem/issues/pending"
+    "tracking_issue": "hyperpolymath/developer-ecosystem#111"
   },
   {
     "severity": "high",
     "rule_module": "cicd_rules",
     "type": "banned_language_file",
     "file_pattern": "affinescript-ecosystem/rattlescript/**",
     "note": "rattlescript contains affine-res bridge package (AffineScript<->ReScript interop layer); .res files are the bridge source, not new ReScript.",
-    "tracking_issue": "https://github.com/hyperpolymath/developer-ecosystem/issues/pending"
+    "tracking_issue": "hyperpolymath/developer-ecosystem#111"
   },
   {
     "severity": "high",
     "rule_module": "cicd_rules",
     "type": "banned_language_file",
     "file_pattern": "cadre-router/**",
     "note": "cadre-router is a ReScript library (router primitives); pending migration to AffineScript.",
-    "tracking_issue": "https://github.com/hyperpolymath/developer-ecosystem/issues/pending"
+    "tracking_issue": "hyperpolymath/developer-ecosystem#111"
   },
   {
     "severity": "high",
     "rule_module": "cicd_rules",
     "type": "banned_language_file",
     "file_pattern": "cadre-tea-router/**",
     "note": "cadre-tea-router is a ReScript TEA router; pending migration to AffineScript.",
-    "tracking_issue": "https://github.com/hyperpolymath/developer-ecosystem/issues/pending"
+    "tracking_issue": "hyperpolymath/developer-ecosystem#111"
   },
   {
     "severity": "high",
     "rule_module": "cicd_rules",
     "type": "banned_language_file",
     "file_pattern": "coq-ecosystem/**",
     "note": "coq-ecosystem/coq-jr contains upstream jsCoq demo .res files; vendored upstream, not estate-authored.",
-    "tracking_issue": "https://github.com/hyperpolymath/developer-ecosystem/issues/pending"
+    "tracking_issue": "hyperpolymath/developer-ecosystem#111"
   },
   {
     "severity": "high",
     "rule_module": "cicd_rules",
     "type": "banned_language_file",
     "file_pattern": "deno-ecosystem/**",
     "note": "deno-ecosystem/projects contains pre-migration ReScript projects; migration tracked in estate plan.",
-    "tracking_issue": "https://github.com/hyperpolymath/developer-ecosystem/issues/pending"
+    "tracking_issue": "hyperpolymath/developer-ecosystem#111"
   },
   {
     "severity": "high",
     "rule_module": "cicd_rules",
     "type": "banned_language_file",
     "file": "iser-tools/julianiser/examples/data-pipeline/pipeline.py",
     "note": "Translation target fixture: Python source used to demonstrate julianiser Python-to-Julia translation patterns. This file exists to be translated AWAY from Python, not as functional Python code.",
-    "tracking_issue": "https://github.com/hyperpolymath/developer-ecosystem/issues/pending"
+    "tracking_issue": "hyperpolymath/developer-ecosystem#111"
   },
   {
     "severity": "high",
     "rule_module": "cicd_rules",
     "type": "banned_language_file",
     "file_pattern": "czech-file-knife/cfk-ios/**",
     "note": "cfk-ios is the iOS File Provider Extension for czech-file-knife; requires Swift for NSFileProviderReplicatedExtension (no Tauri/Dioxus equivalent for this specific iOS API).",
-    "tracking_issue": "https://github.com/hyperpolymath/developer-ecosystem/issues/pending"
+    "tracking_issue": "hyperpolymath/developer-ecosystem#111"
   },
   {
     "severity": "high",
     "rule_module": "cicd_rules",
     "type": "banned_language_file",
     "file_pattern": "synapse/examples/swift/**",
     "note": "synapse/examples/swift/ contains auto-generated Swift output from the synapse code generator; this is generated example output, not hand-written Swift.",
-    "tracking_issue": "https://github.com/hyperpolymath/developer-ecosystem/issues/pending"
+    "tracking_issue": "hyperpolymath/developer-ecosystem#111"
   },
   {
     "severity": "high",
     "rule_module": "cicd_rules",
     "type": "banned_language_file",
     "file_pattern": "v-ecosystem/**",
     "note": "v-ecosystem/ is the documented V-lang R&D carve-out (estate-wide policy 2026-04-10). V-lang code (including v.mod manifests) is permitted here as this is the Zig migration target zone. V-lang migration COMPLETED 2026-05-28 across 16 PRs for all non-v-ecosystem paths.",
-    "tracking_issue": "https://github.com/hyperpolymath/developer-ecosystem/issues/pending"
+    "tracking_issue": "hyperpolymath/developer-ecosystem#111"
   }
 ]

audits/assail-classifications.a2ml

@@ -1,4 +1,8 @@
 %A2ML
+# SPDX-License-Identifier: MPL-2.0
+name: assail-classifications
+version: "1.0.0"
+
 - suppression:
     file: 'dnfinition/src/data_layer/lib/dnfinition/mirror/list_manager.ex'
     rule: 'AtomExhaustion'