Merge branch 'main' into feat/secret-scanning

Author: hyperpolymath

.github/dependabot.yml

@@ -44,8 +44,8 @@ updates:
     schedule:
       interval: "weekly"
 
-  # Nix flakes
-  - package-ecosystem: "nix"
+  # Guix flakes
+  - package-ecosystem: "guix"
     directory: "/"
     schedule:
       interval: "weekly"

.github/workflows/codeql.yml

@@ -33,13 +33,13 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

.github/workflows/governance.yml

@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329

.github/workflows/hypatia-scan.yml

@@ -17,4 +17,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329

.github/workflows/push-email-notify.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@12335b969ae3fb71bee5f2c6b829744261aec34c # pinned
+        uses: dawidd6/action-send-mail@0bbdab096651ee93f37ec02383e088183d41ff0b # pinned
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}

.machine_readable/6a2/META.a2ml

@@ -22,7 +22,7 @@ author = "Jonathan D.A. Jewell (hyperpolymath)"
 build-tool = "just"
 container-runtime = "podman"
 ci-platform = "github-actions"
-package-manager = "guix"  # guix | nix | cargo | mix
+package-manager = "guix"  # guix | guix | cargo | mix
 
 [maintenance-axes]
 scoping-first = true
@@ -46,7 +46,7 @@ perfective-source = "axis-1 honest state after corrective/adaptive updates"
 [axis-3-audit-rules]
 audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"
 compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"
-drift-risk-example = "single exception broadening into policy violation (e.g. ReScript->TypeScript spread)"
+drift-risk-example = "single exception broadening into policy violation (e.g. AffineScript->TypeScript spread)"
 effects-evidence = "benchmark execution/results and maintainer status dialogue/review"
 
 [design-rationale]

.machine_readable/6a2/PLAYBOOK.a2ml

@@ -63,7 +63,7 @@ enforcement-workflow = ".github/workflows/estate-rules.yml"
 # .github/             CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/
 # .machine_readable/   AI manifests (0.1-AI-MANIFEST.a2ml), 6a2/ checkpoints,
 #                      contractiles/, configs/, anchors/, policies/, scripts/, svc/
-# build/               contractile.just, flake.nix, guix.scm, Containerfile,
+# build/               contractile.just, flake.guix, guix.scm, Containerfile,
 #                      just/*.just (Justfile section imports)
 # docs/                onboarding/, status/, architecture/, governance/  (all .adoc)
 # session/             dispatch.sh, custom-checks.k9, local-hooks.sh
@@ -103,7 +103,7 @@ enforcement-workflow = ".github/workflows/estate-rules.yml"
 #   build/just/groove.just     Groove protocol setup (after zig removed)
 #
 # Daily-use recipes (BUILD, TEST, LINT, RUN, DEPS, DOCS, CONTAINER, CI,
-# SECURITY, STATE, GUIX/NIX, MATRIX, VERSION CONTROL, UTILITIES, SESSION)
+# SECURITY, STATE, GUIX/GUIX, MATRIX, VERSION CONTROL, UTILITIES, SESSION)
 # stay in the root Justfile where users expect to find them.
 
 # === 5-PR cleanup pattern ===

CHANGELOG.md

@@ -22,7 +22,7 @@ this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - feat(safety): owner allowlist + two-tier menu with clearer item names (#1)
 - feat(script_manager): incorporate 3 hyperpolymath estate batch scripts as Elixir rules
-- feat(ui): add ReScript-TEA Cadre router with HAR/script API bridge
+- feat(ui): add AffineScript-TEA Cadre router with HAR/script API bridge
 - feat(crg): add crg-grade and crg-badge justfile recipes
 
 ### Fixed

docs/reports/audit/audit-2026-04-15-post.md

@@ -24,7 +24,7 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 - System command execution in lib/script_manager/dependency_fixer.ex
 - System command execution in lib/script_manager/toolchain_linker.ex
 - Hardcoded /tmp/ path without mktemp in scripts/update_repos.sh
-- flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in flake.nix
+- flake.guix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in flake.guix
 - Hardcoded /tmp/ path without mktemp in launchers/git-scripts-launcher.sh
 - DOM manipulation (innerHTML/document.write) in ui/dist/assets/index-98F1FyxW.js
 - 1 HTTP (non-HTTPS) URLs in ui/dist/assets/index-98F1FyxW.js