From 422b39db3c366dde3deab0ba3edb14fe1fe6f1ba Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 24 Aug 2026 12:45:35 +0100
Subject: [PATCH] fix(ci): align recovery gates after migration

Ratchet-exception: add narrow, expiring baselines for the 6a2 authority conflict and cross-repository proof-template path false positives; tracked by standards#399.
---
 .github/workflows/changelog-reusable.yml    |  2 +-
 .github/workflows/deno-ci-reusable.yml      | 45 ++++++---------------
 .github/workflows/elixir-ci-reusable.yml    |  6 +--
 .github/workflows/mirror.yml                |  2 +-
 .github/workflows/rust-ci-reusable.yml      |  8 ++--
 .github/workflows/self-test.yml             | 10 +++--
 .hypatia-baseline.json                      |  8 ++++
 .machine_readable/REGISTRY.a2ml             |  8 ++--
 lol/proofs/theories/information_theory.agda |  4 ++
 9 files changed, 44 insertions(+), 49 deletions(-)

diff --git a/.github/workflows/changelog-reusable.yml b/.github/workflows/changelog-reusable.yml
index 7b81573e..b1e05ad0 100644
--- a/.github/workflows/changelog-reusable.yml
+++ b/.github/workflows/changelog-reusable.yml
@@ -11,7 +11,7 @@
 # Caller example (auto-update CHANGELOG.md on every push to main):
 #   jobs:
 #     changelog:
-#       uses: hyperpolymath/standards/.github/workflows/changelog-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/changelog-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       permissions:
 #         contents: write
 #         pull-requests: write
diff --git a/.github/workflows/deno-ci-reusable.yml b/.github/workflows/deno-ci-reusable.yml
index e8824f2e..ebcc3b44 100644
--- a/.github/workflows/deno-ci-reusable.yml
+++ b/.github/workflows/deno-ci-reusable.yml
@@ -24,7 +24,7 @@
 #
 #   jobs:
 #     deno-ci:
-#       uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 
 name: Deno CI (reusable)
 
@@ -72,36 +72,21 @@ jobs:
         id: detect
         run: |
           # `deno.json` (or its legacy `deno.jsonc`) is the canonical
-          # signal that this repo opts into Deno tooling. We also count
-          # raw .ts/.js files as a fallback for repos still mid-migration
-          # to deno.json. Either way, the per-step guards below honour
-          # any `include` / `exclude` scoping the consumer declared in
-          # deno.json.
+          # signal that this repo opts into Deno tooling. Do not infer a
+          # Deno project from generated or vendored .js/.mjs artefacts: a
+          # post-Deno repository may retain those outputs without owning
+          # them as a root lint/type-check scope.
           has_config=false
-          has_targets=false
-          has_tests=false
           if [ -f deno.json ] || [ -f deno.jsonc ]; then has_config=true; fi
-          if find . -path ./node_modules -prune -o -path ./.git -prune \
-              -o \( -name "*.ts" -o -name "*.tsx" -o -name "*.js" -o -name "*.jsx" -o -name "*.mjs" \) \
-              -type f -print 2>/dev/null | head -1 | grep -q .; then
-            has_targets=true
-          fi
-          if find . -path ./node_modules -prune -o -path ./.git -prune \
-              -o \( -name "*_test.ts" -o -name "*.test.ts" -o -name "*_test.js" -o -name "*.test.js" \) \
-              -type f -print 2>/dev/null | head -1 | grep -q .; then
-            has_tests=true
-          fi
           echo "has_config=$has_config"   >> "$GITHUB_OUTPUT"
-          echo "has_targets=$has_targets" >> "$GITHUB_OUTPUT"
-          echo "has_tests=$has_tests"     >> "$GITHUB_OUTPUT"
-          echo "deno-ci: config=$has_config targets=$has_targets tests=$has_tests"
+          echo "deno-ci: config=$has_config"
 
       - name: Deno lint
-        if: steps.detect.outputs.has_targets == 'true' || steps.detect.outputs.has_config == 'true'
+        if: steps.detect.outputs.has_config == 'true'
         run: deno lint
 
       - name: Deno fmt check
-        if: steps.detect.outputs.has_targets == 'true' || steps.detect.outputs.has_config == 'true'
+        if: steps.detect.outputs.has_config == 'true'
         run: deno fmt --check
 
       - name: Deno test (configured package)
@@ -112,18 +97,13 @@ jobs:
         if: steps.detect.outputs.has_config == 'true'
         run: deno test --allow-all --permit-no-files
 
-      - name: Deno test (configless fallback)
-        if: steps.detect.outputs.has_config == 'false' && steps.detect.outputs.has_tests == 'true'
-        run: deno test --allow-all --coverage=coverage
-
       - name: Deno type check
-        if: steps.detect.outputs.has_targets == 'true'
+        if: steps.detect.outputs.has_config == 'true'
         # Soft-pass: `deno check` exits non-zero on unresolved imports we
         # don't yet require contributors to vendor. We surface output for
         # diagnostics but don't fail the gate.
         run: |
-          if [ "${{ steps.detect.outputs.has_config }}" = "true" ] \
-             && deno task 2>/dev/null | grep -q '^ci:check'; then
+          if deno task 2>/dev/null | grep -q '^ci:check'; then
             deno task ci:check
           else
             deno check . || echo "::warning::deno check reported issues (non-blocking)."
@@ -131,9 +111,8 @@ jobs:
 
       - name: Summary
         run: |
-          if [ "${{ steps.detect.outputs.has_config }}" = "false" ] \
-             && [ "${{ steps.detect.outputs.has_targets }}" = "false" ]; then
-            echo "deno-ci: no Deno targets detected — skipped all checks."
+          if [ "${{ steps.detect.outputs.has_config }}" = "false" ]; then
+            echo "deno-ci: no root Deno configuration detected — skipped all checks."
           else
             echo "deno-ci: passed (lint / fmt / type / test where applicable)."
           fi
diff --git a/.github/workflows/elixir-ci-reusable.yml b/.github/workflows/elixir-ci-reusable.yml
index 893dbd25..b4540b9a 100644
--- a/.github/workflows/elixir-ci-reusable.yml
+++ b/.github/workflows/elixir-ci-reusable.yml
@@ -34,13 +34,13 @@
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #
 # With dialyzer + customised versions:
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       with:
 #         elixir-version: "1.18"
 #         enable_dialyzer: true
@@ -50,7 +50,7 @@
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       with:
 #         working_directory: server
 
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index b191eb58..fdd50e59 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -13,5 +13,5 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
     secrets: inherit
diff --git a/.github/workflows/rust-ci-reusable.yml b/.github/workflows/rust-ci-reusable.yml
index aa4de903..085f7771 100644
--- a/.github/workflows/rust-ci-reusable.yml
+++ b/.github/workflows/rust-ci-reusable.yml
@@ -20,13 +20,13 @@
 #
 #   jobs:
 #     rust-ci:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #
 # With audit + coverage enabled:
 #
 #   jobs:
 #     rust-ci:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       with:
 #         enable_audit: true
 #         enable_coverage: true
@@ -35,11 +35,11 @@
 #
 #   jobs:
 #     rust-ci-cli:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       with:
 #         working_directory: crates/cli
 #     rust-ci-server:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       with:
 #         working_directory: crates/server
 #
diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml
index b56135ae..7df80804 100644
--- a/.github/workflows/self-test.yml
+++ b/.github/workflows/self-test.yml
@@ -35,10 +35,14 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      # PyYAML is required by the secret-scanner canary, which extracts the
-      # shipping step body from the reusable rather than testing a copy.
+      # PyYAML is required by the secret-scanner canary. The scorecard
+      # grounding tests execute the same checks as registry-verify, including
+      # checks that require ripgrep and xmllint.
       - name: Install test dependencies
-        run: python3 -m pip install --user --quiet pyyaml
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends ripgrep libxml2-utils
+          python3 -m pip install --user --quiet pyyaml
 
       - name: Run tests/*.sh and scripts/tests/*.sh
         run: |
diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json
index f8f5280b..50d9444a 100644
--- a/.hypatia-baseline.json
+++ b/.hypatia-baseline.json
@@ -898,5 +898,13 @@
     "note": "TEMPORARY AUTHORITY CONFLICT (2026-08-24): Hypatia says the 6a2 directory is retired, but standards' registry generator, topology generator, readiness rules, template capability gates, and canonical documentation still consume this path. Do not move normative files to satisfy one downstream rule before the authority sources agree.",
     "expires_at": "2026-09-30",
     "tracking_issue": "hyperpolymath/standards#399"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "structural_drift",
+    "type": "SD022",
+    "file_pattern": "docs/proofs/spec-templates/**/*.adoc",
+    "note": "FALSE POSITIVE CLASS (2026-08-24): these are cross-repository proof-spec templates. Their src/... examples describe the target repository named by each template, not directories asserted to exist inside standards. The Markdown-to-AsciiDoc migration made this established corpus newly visible to SD022.",
+    "tracking_issue": "hyperpolymath/standards#399"
   }
 ]
diff --git a/.machine_readable/REGISTRY.a2ml b/.machine_readable/REGISTRY.a2ml
index b783a941..a1b73d83 100644
--- a/.machine_readable/REGISTRY.a2ml
+++ b/.machine_readable/REGISTRY.a2ml
@@ -45,7 +45,7 @@ name = "A2ML — Attested Markup Language"
 stream = "foundation"
 home = "a2ml/"
 canonical_doc = "a2ml/README.adoc"
-source_hash = "sha256:2a54c3194a4a055bbbd0006963eac0a3a5a2c1e0dff683196c8feca48f538f52"
+source_hash = "sha256:480aeca64a094b3f184dc5aa98c00abb60ebcae33b41038410f2a5ff88d19427"
 route = "the typed/verified machine-readable document format"
 
 [[spec]]
@@ -54,7 +54,7 @@ name = "K9 Self-Validating Components"
 stream = "foundation"
 home = "k9-svc/"
 canonical_doc = "k9-svc/README.adoc"
-source_hash = "sha256:5f0fab5714c30bf6a43845820a925d7b00d6727d17668061d3488ec093b0737d"
+source_hash = "sha256:1c750e457184efd404a92a3faec4989cc4e59fb54302d50040ff88711750a6e6"
 route = "self-validating components with embedded contracts + deploy logic"
 
 [[spec]]
@@ -135,7 +135,7 @@ name = "0-AI Gatekeeper Protocol"
 stream = "protocol"
 home = "0-ai-gatekeeper-protocol/"
 canonical_doc = "0-ai-gatekeeper-protocol/README.adoc"
-source_hash = "sha256:0c648b66962fa1c23ce74ed7d1e2e95163c143d5909d27f7ac8f310f29068cbf"
+source_hash = "sha256:9e77212dd6a6cc027345bfd9f71cf5bdda5c12d2424515c0d0b838700442cd25"
 route = "the AI-agent entry/gating protocol behind 0-AI-MANIFEST"
 
 [[spec]]
@@ -162,7 +162,7 @@ name = "AXEL Protocol"
 stream = "protocol"
 home = "axel-protocol/"
 canonical_doc = "axel-protocol/README.adoc"
-source_hash = "sha256:6e4dce291ecdc20481f681d810db838a658af09a93c67cfa051d9d4427a24877"
+source_hash = "sha256:678e7e99899809bfd3211a392ea718446bd80d1bed2650ee7bb090537c88dd21"
 route = "age-gating + explicit-content enforcement"
 
 [[spec]]
diff --git a/lol/proofs/theories/information_theory.agda b/lol/proofs/theories/information_theory.agda
index b4921c11..54c1281e 100644
--- a/lol/proofs/theories/information_theory.agda
+++ b/lol/proofs/theories/information_theory.agda
@@ -112,23 +112,27 @@ jensen-shannon p q =
 -- Classified as justified postulates, not proof debt.
 
 -- Entropy is non-negative (H ≥ 0 follows from -p·log(p) ≥ 0 for 0 ≤ p ≤ 1)
+-- AXIOM: justified theorem over IEEE-754 Float; proof requires a real-analysis model.
 postulate
   entropy-nonnegative : ∀ {n} (d : Distribution n) → entropy d ≥ 0.0
     where
       _≥_ : Float → Float → Set
 
 -- KL-divergence is non-negative (Gibbs' inequality / log-sum inequality)
+-- AXIOM: justified Gibbs inequality over Float; proof requires a real-analysis model.
 postulate
   kl-nonnegative : ∀ {n} (p q : Distribution n) → kl-divergence p q ≥ 0.0
     where
       _≥_ : Float → Float → Set
 
 -- Jensen-Shannon is symmetric (follows from symmetry of KL terms in the midpoint construction)
+-- AXIOM: justified by the symmetric midpoint construction and paired KL terms.
 postulate
   js-symmetric : ∀ {n} (p q : Distribution n) →
     jensen-shannon p q ≡ jensen-shannon q p
 
 -- Jensen-Shannon is bounded [0, 1] (Lin 1991; upper bound via Jensen's inequality)
+-- AXIOM: justified Lin bound over Float; proof requires a real-analysis model.
 postulate
   js-bounded : ∀ {n} (p q : Distribution n) →
     0.0 ≤ jensen-shannon p q × jensen-shannon p q ≤ 1.0