diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 081b831..c1e3ccc 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,6 +18,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions: read-all
+  actions: read
 
 jobs:
   analyze:
@@ -40,12 +41,12 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v3.28.1
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v3.28.1
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/distro-matrix.yml b/.github/workflows/distro-matrix.yml
index 00cefa2..5e3f061 100644
--- a/.github/workflows/distro-matrix.yml
+++ b/.github/workflows/distro-matrix.yml
@@ -17,6 +17,7 @@ on:
         default: "all"
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml
index 0d0b946..bf4aa64 100644
--- a/.github/workflows/guix-nix-policy.yml
+++ b/.github/workflows/guix-nix-policy.yml
@@ -12,6 +12,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions: read-all
+  actions: read
 
 jobs:
   check:
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 7428a14..cc02c30 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -19,6 +19,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
   security-events: write
   pull-requests: write
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index 228dc43..0f86f6c 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -9,6 +9,7 @@ on:
     types: [published]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml
new file mode 100755
index 0000000..b602e97
--- /dev/null
+++ b/.github/workflows/main-estate-audit.yml
@@ -0,0 +1,91 @@
+name: Central Estate CI/CD Audit
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  estate-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Required Files Gate
+        uses: hyperpolymath/cicd-suite/actions/required-files-check@main
+        
+      - name: Code Hygiene Gate
+        uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@main
+        
+      - name: Manifest Validation Gate
+        uses: hyperpolymath/cicd-suite/actions/manifest-check@main
+        
+      - name: Idris2 ABI Purity Gate
+        uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@main
+        
+      - name: Zig Hexadeca API Gate
+        uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@main
+        
+      - name: Contractile Validation Gate
+        uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@main
+        
+      - name: Recipes Set Validation Gate
+        uses: hyperpolymath/cicd-suite/actions/recipes-set-check@main
+        
+      - name: Affirmation Document Gate
+        uses: hyperpolymath/cicd-suite/actions/affirmation-check@main
+        
+      - name: Academic Referencing Gate
+        uses: hyperpolymath/cicd-suite/actions/referencing-check@main
+        
+      - name: Semantic Audit Gate
+        uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@main
+        
+      - name: SPDX License Gate
+        uses: hyperpolymath/cicd-suite/actions/spdx-license-check@main
+        
+      - name: Proof Runner Gate
+        uses: hyperpolymath/cicd-suite/actions/proof-runner-check@main
+        
+      - name: PRAT Testing Gate
+        uses: hyperpolymath/cicd-suite/actions/prat-check@main
+        
+      - name: Panic Attack & Pons Gate
+        uses: hyperpolymath/cicd-suite/actions/custom-tools-check@main
+        
+      - name: WWW & Well-Known Compliance Gate
+        uses: hyperpolymath/cicd-suite/actions/www-compliance-check@main
+        
+      - name: BoJ Cartridge Validation Gate
+        uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@main
+        
+      - name: Formatting Validation Gate
+        uses: hyperpolymath/cicd-suite/actions/formatting-check@main
+        
+      - name: Accreditations & Badges Gate
+        uses: hyperpolymath/cicd-suite/actions/badges-check@main
+        
+      - name: Metrics Extraction Gate
+        uses: hyperpolymath/cicd-suite/actions/metrics-check@main
+        
+      - name: Linguist & Banned Languages Gate
+        uses: hyperpolymath/cicd-suite/actions/linguist-check@main
+        
+      - name: Test & Benchmarks Dashboard Gate
+        uses: hyperpolymath/cicd-suite/actions/tests-benches-check@main
+        
+      - name: Hosting & Site Status Gate
+        uses: hyperpolymath/cicd-suite/actions/hosting-check@main
+        
+      - name: Git-Sea Analytics Gate
+        uses: hyperpolymath/cicd-suite/actions/gitsea-check@main
+        
+      - name: Trust & Humans Validation Gate
+        uses: hyperpolymath/cicd-suite/actions/trust-humans-check@main
+        
+      - name: Are We UnAPI Gate (Secret Scanning)
+        uses: hyperpolymath/cicd-suite/actions/secrets-check@main
+        
+      - name: Reasonably Good Token Validation Gate
+        uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@main
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 81e9903..72824fb 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -7,9 +7,10 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
diff --git a/.github/workflows/npm-bun-blocker.yml b/.github/workflows/npm-bun-blocker.yml
index acbb3b6..79b6d9a 100644
--- a/.github/workflows/npm-bun-blocker.yml
+++ b/.github/workflows/npm-bun-blocker.yml
@@ -12,6 +12,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions: read-all
+  actions: read
 
 jobs:
   check:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index c78489a..0273437 100755
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -5,6 +5,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 0816771..ce036e2 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -7,6 +7,7 @@ name: Push email notification
 on:
   push: {}
 permissions:
+  actions: read
   contents: read
 jobs:
   notify:
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 7acb4b0..3bccf7e 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -13,6 +13,7 @@ concurrency:
 
 
 permissions: read-all
+  actions: read
 
 jobs:
   lint:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9d8d2e8..235ed4e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,7 @@ on:
       - 'v*'
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml
deleted file mode 100644
index 72cef5a..0000000
--- a/.github/workflows/rsr-antipattern.yml
+++ /dev/null
@@ -1,194 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# RSR Anti-Pattern CI Check
-# SPDX-License-Identifier: MPL-2.0
-#
-# Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm
-# Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme
-
-name: RSR Anti-Pattern Check
-
-on:
-  push:
-    branches: [main, master, develop]
-  pull_request:
-    branches: [main, master, develop]
-
-
-permissions:
-  contents: read
-
-jobs:
-  antipattern-check:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - name: Check for TypeScript
-        run: |
-          python3 << 'PYEOF'
-          import re, sys, pathlib
-
-          # Universal allowlist — bridges and conventions that need no per-repo declaration.
-          # Implemented as explicit string predicates rather than glob patterns so that
-          # top-level directories (e.g. tests/foo.ts) are matched the same as nested ones,
-          # which fnmatch's * cannot do reliably.
-          DIR_NAMES_ALLOWED = {
-              'bindings', 'tests', 'test', 'scripts',
-              'mcp-adapter', 'cli', 'vendor', 'examples', 'ffi',
-              'node_modules', 'benchmarks',
-          }
-
-          def builtin_allowed(p):
-              # `p` is a posix-style path with no leading ./
-              # 1. Type declaration files
-              if p.endswith('.d.ts'):
-                  return True
-              # 2. Canonical Deno entrypoint filenames
-              base = p.rsplit('/', 1)[-1]
-              if base == 'mod.ts':
-                  return True
-              # 3. LSP server files (filename suffixes)
-              if base in ('lsp-server.ts', 'lsp_server.ts', 'lsp.ts') or base.endswith('-lsp.ts'):
-                  return True
-              # 4. Benchmark files (filename suffixes)
-              if base.endswith('.bench.ts') or base.endswith('_bench.ts'):
-                  return True
-              # 5. Any directory segment (excluding basename) matches an allowed dir
-              segs = p.split('/')
-              for s in segs[:-1]:
-                  if s in DIR_NAMES_ALLOWED:
-                      return True
-                  # vscode-anything or anything-vscode
-                  if 'vscode' in s:
-                      return True
-                  # deno-named subprojects
-                  if s.startswith('deno-'):
-                      return True
-              return False
-
-          # Per-repo exemptions parsed from .claude/CLAUDE.md "TypeScript Exemptions" table.
-          # This is the documented single source of truth: adding one row here unblocks CI.
-          # Glob characters: '*' and '**' both mean "any chars including /". This loose
-          # interpretation matches user intent when an exemption row reads, e.g.,
-          # `affinescript-deno-test/*.ts` (covering nested files too).
-          def glob_to_regex(g):
-              out = []
-              for c in g.lstrip('./'):
-                  if c == '*': out.append('.*')
-                  elif c == '?': out.append('.')
-                  elif c in '.+(){}[]|^$\\': out.append(re.escape(c))
-                  else: out.append(c)
-              return re.compile('^' + ''.join(out) + '$')
-
-          exemption_patterns = []
-          claude_md = pathlib.Path('.claude/CLAUDE.md')
-          if claude_md.exists():
-              in_table = False
-              for line in claude_md.read_text(encoding='utf-8').splitlines():
-                  if re.search(r'TypeScript [Ee]xemptions', line):
-                      in_table = True
-                      continue
-                  if in_table and line.startswith(('### ', '## ', '# ')):
-                      break
-                  if in_table and line.startswith('|'):
-                      m = re.match(r'\|\s*`([^`]+)`', line)
-                      if m:
-                          exemption_patterns.append((m.group(1), glob_to_regex(m.group(1))))
-
-          def exempt(p):
-              for raw, regex in exemption_patterns:
-                  if regex.match(p):
-                      return True
-                  # Also allow exact-path matches and prefix matches for paths
-                  # ending in `/`
-                  if p == raw.lstrip('./'):
-                      return True
-                  if raw.endswith('/') and p.startswith(raw.lstrip('./')):
-                      return True
-              return False
-
-          # Find all .ts and .tsx files (excluding common dot-dirs that find normally skips)
-          found = []
-          for ext in ('ts', 'tsx'):
-              for p in pathlib.Path('.').rglob(f'*.{ext}'):
-                  parts = p.parts
-                  if any(part.startswith('.') and part not in ('.', '..') for part in parts):
-                      continue
-                  found.append(p.as_posix().lstrip('./'))
-
-          bad = sorted(f for f in found if not (builtin_allowed(f) or exempt(f)))
-          if bad:
-              print("❌ TypeScript files detected outside the allowlist.\n")
-              for f in bad:
-                  print(f"  {f}")
-              print()
-              print("To resolve, choose one:")
-              print("  (a) migrate the file to AffineScript")
-              print("      (see Human_Programming_Guide.adoc 'Migrating from -script Languages')")
-              print("  (b) move to an allowlisted bridge path")
-              print("      (bindings/, tests/, test/, scripts/, benchmarks/, mcp-adapter/,")
-              print("       *vscode*/, cli/, deno-*/, vendor/, examples/, ffi/)")
-              print("  (c) add an entry to the 'TypeScript Exemptions' table in .claude/CLAUDE.md")
-              print("      with rationale + unblock condition")
-              if exemption_patterns:
-                  print(f"\n(Currently {len(exemption_patterns)} exemption(s) parsed from .claude/CLAUDE.md.)")
-              sys.exit(1)
-          print(f"✅ No TypeScript files outside allowlist ({len(exemption_patterns)} per-repo exemption(s) parsed).")
-          PYEOF
-
-      - name: Check for Go
-        run: |
-          if find . -name "*.go" | grep -q .; then
-            echo "❌ Go files detected - use Rust/WASM instead"
-            find . -name "*.go"
-            exit 1
-          fi
-          echo "✅ No Go files"
-
-      - name: Check for Python (non-SaltStack)
-        run: |
-          PY_FILES=$(find . -name "*.py" | grep -v salt | grep -v _states | grep -v _modules | grep -v pillar | grep -v venv | grep -v __pycache__ || true)
-          if [ -n "$PY_FILES" ]; then
-            echo "❌ Python files detected - only allowed for SaltStack"
-            echo "$PY_FILES"
-            exit 1
-          fi
-          echo "✅ No non-SaltStack Python files"
-
-      - name: Check for npm lockfiles
-        run: |
-          if [ -f "package-lock.json" ] || [ -f "yarn.lock" ]; then
-            echo "❌ npm/yarn lockfile detected - use Deno instead"
-            exit 1
-          fi
-          echo "✅ No npm lockfiles"
-
-      - name: Check for tsconfig
-        run: |
-          if [ -f "tsconfig.json" ]; then
-            echo "❌ tsconfig.json detected - use ReScript instead"
-            exit 1
-          fi
-          echo "✅ No tsconfig.json"
-
-      - name: Verify Deno presence (if package.json exists)
-        run: |
-          if [ -f "package.json" ]; then
-            if [ ! -f "deno.json" ] && [ ! -f "deno.jsonc" ]; then
-              echo "⚠️ Warning: package.json without deno.json - migration recommended"
-            fi
-          fi
-          echo "✅ Deno configuration check complete"
-
-      - name: Summary
-        run: |
-          echo "╔════════════════════════════════════════════════════════════╗"
-          echo "║           RSR Anti-Pattern Check Passed ✅                 ║"
-          echo "║                                                            ║"
-          echo "║  Allowed: ReScript, Deno, WASM, Rust, OCaml, Haskell,     ║"
-          echo "║           Guile/Scheme, SaltStack (Python)                 ║"
-          echo "║                                                            ║"
-          echo "║  Blocked: TypeScript, Go, npm, Python (non-Salt)          ║"
-          echo "╚════════════════════════════════════════════════════════════╝"
diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
index 6ed0444..761c446 100644
--- a/.github/workflows/scorecard-enforcer.yml
+++ b/.github/workflows/scorecard-enforcer.yml
@@ -18,6 +18,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 64ac2ac..f0c8699 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -9,6 +9,7 @@ on:
     branches: [main]
 
 permissions: read-all
+  actions: read
 
 jobs:
   analysis:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 9ed74ef..010c16d 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -11,6 +11,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
@@ -19,5 +20,5 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
\ No newline at end of file
diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml
index 54860dc..b6cece2 100644
--- a/.github/workflows/security-policy.yml
+++ b/.github/workflows/security-policy.yml
@@ -12,6 +12,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions: read-all
+  actions: read
 
 jobs:
   check:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b163825..b318bb0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -8,6 +8,7 @@ on:
     branches: [ main, develop ]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/ts-blocker.yml b/.github/workflows/ts-blocker.yml
index 90119e7..133f10d 100644
--- a/.github/workflows/ts-blocker.yml
+++ b/.github/workflows/ts-blocker.yml
@@ -12,6 +12,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions: read-all
+  actions: read
 
 jobs:
   check:
diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml
index 5c9fe19..883b80b 100644
--- a/.github/workflows/wellknown-enforcement.yml
+++ b/.github/workflows/wellknown-enforcement.yml
@@ -16,6 +16,7 @@ on:
 
 
 permissions: read-all
+  actions: read
 
 jobs:
   validate:
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index f355fc3..d7d5a40 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -13,6 +13,7 @@ on:
   workflow_dispatch:
 
 permissions: read-all
+  actions: read
 
 jobs:
   lint-workflows:
diff --git a/.gitignore b/.gitignore
index cc9fc67..0b05d1f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -85,3 +85,14 @@ deps/
 .cache/
 build/
 dist/
+*.db
+*.db-journal
+*.db-shm
+*.db-wal
+.claude/
+.editorconfig
+/exports/*.json
+/exports/*.lgt
+ai-cli-crash-capture/
+composer/*.beam
+composer/build/