fix(ci): complete PR #618 migration recovery

.github/workflows/changelog-reusable.yml

@@ -11,7 +11,7 @@
 # Caller example (auto-update CHANGELOG.md on every push to main):
 #   jobs:
 #     changelog:
-#       uses: hyperpolymath/standards/.github/workflows/changelog-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/changelog-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       permissions:
 #         contents: write
 #         pull-requests: write

.github/workflows/deno-ci-reusable.yml

@@ -24,7 +24,7 @@
 #
 #   jobs:
 #     deno-ci:
-#       uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 
 name: Deno CI (reusable)
 
@@ -72,36 +72,21 @@ jobs:
         id: detect
         run: |
           # `deno.json` (or its legacy `deno.jsonc`) is the canonical
-          # signal that this repo opts into Deno tooling. We also count
-          # raw .ts/.js files as a fallback for repos still mid-migration
-          # to deno.json. Either way, the per-step guards below honour
-          # any `include` / `exclude` scoping the consumer declared in
-          # deno.json.
+          # signal that this repo opts into Deno tooling. Do not infer a
+          # Deno project from generated or vendored .js/.mjs artefacts: a
+          # post-Deno repository may retain those outputs without owning
+          # them as a root lint/type-check scope.
           has_config=false
-          has_targets=false
-          has_tests=false
           if [ -f deno.json ] || [ -f deno.jsonc ]; then has_config=true; fi
-          if find . -path ./node_modules -prune -o -path ./.git -prune \
-              -o \( -name "*.ts" -o -name "*.tsx" -o -name "*.js" -o -name "*.jsx" -o -name "*.mjs" \) \
-              -type f -print 2>/dev/null | head -1 | grep -q .; then
-            has_targets=true
-          fi
-          if find . -path ./node_modules -prune -o -path ./.git -prune \
-              -o \( -name "*_test.ts" -o -name "*.test.ts" -o -name "*_test.js" -o -name "*.test.js" \) \
-              -type f -print 2>/dev/null | head -1 | grep -q .; then
-            has_tests=true
-          fi
           echo "has_config=$has_config"   >> "$GITHUB_OUTPUT"
-          echo "has_targets=$has_targets" >> "$GITHUB_OUTPUT"
-          echo "has_tests=$has_tests"     >> "$GITHUB_OUTPUT"
-          echo "deno-ci: config=$has_config targets=$has_targets tests=$has_tests"
+          echo "deno-ci: config=$has_config"
 
       - name: Deno lint
-        if: steps.detect.outputs.has_targets == 'true' || steps.detect.outputs.has_config == 'true'
+        if: steps.detect.outputs.has_config == 'true'
         run: deno lint
 
       - name: Deno fmt check
-        if: steps.detect.outputs.has_targets == 'true' || steps.detect.outputs.has_config == 'true'
+        if: steps.detect.outputs.has_config == 'true'
         run: deno fmt --check
 
       - name: Deno test (configured package)
@@ -112,28 +97,22 @@ jobs:
         if: steps.detect.outputs.has_config == 'true'
         run: deno test --allow-all --permit-no-files
 
-      - name: Deno test (configless fallback)
-        if: steps.detect.outputs.has_config == 'false' && steps.detect.outputs.has_tests == 'true'
-        run: deno test --allow-all --coverage=coverage
-
       - name: Deno type check
-        if: steps.detect.outputs.has_targets == 'true'
+        if: steps.detect.outputs.has_config == 'true'
         # Soft-pass: `deno check` exits non-zero on unresolved imports we
         # don't yet require contributors to vendor. We surface output for
         # diagnostics but don't fail the gate.
         run: |
-          if [ "${{ steps.detect.outputs.has_config }}" = "true" ] \
-             && deno task 2>/dev/null | grep -q '^ci:check'; then
+          if deno task 2>/dev/null | grep -q '^ci:check'; then
             deno task ci:check
           else
             deno check . || echo "::warning::deno check reported issues (non-blocking)."
           fi
 
       - name: Summary
         run: |
-          if [ "${{ steps.detect.outputs.has_config }}" = "false" ] \
-             && [ "${{ steps.detect.outputs.has_targets }}" = "false" ]; then
-            echo "deno-ci: no Deno targets detected — skipped all checks."
+          if [ "${{ steps.detect.outputs.has_config }}" = "false" ]; then
+            echo "deno-ci: no root Deno configuration detected — skipped all checks."
           else
             echo "deno-ci: passed (lint / fmt / type / test where applicable)."
           fi

.github/workflows/elixir-ci-reusable.yml

@@ -34,13 +34,13 @@
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #
 # With dialyzer + customised versions:
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       with:
 #         elixir-version: "1.18"
 #         enable_dialyzer: true
@@ -50,7 +50,7 @@
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       with:
 #         working_directory: server
 

.github/workflows/mirror.yml

@@ -13,5 +13,5 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
     secrets: inherit

.github/workflows/rust-ci-reusable.yml

@@ -20,13 +20,13 @@
 #
 #   jobs:
 #     rust-ci:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #
 # With audit + coverage enabled:
 #
 #   jobs:
 #     rust-ci:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       with:
 #         enable_audit: true
 #         enable_coverage: true
@@ -35,11 +35,11 @@
 #
 #   jobs:
 #     rust-ci-cli:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       with:
 #         working_directory: crates/cli
 #     rust-ci-server:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@70cdad0e95bb2366a9b2ae9789c0e377fef6e3ef
 #       with:
 #         working_directory: crates/server
 #

.github/workflows/self-test.yml

@@ -35,10 +35,14 @@
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      # PyYAML is required by the secret-scanner canary, which extracts the
-      # shipping step body from the reusable rather than testing a copy.
+      # PyYAML is required by the secret-scanner canary. The scorecard
+      # grounding tests execute the same checks as registry-verify, including
+      # checks that require ripgrep and xmllint.
       - name: Install test dependencies
-        run: python3 -m pip install --user --quiet pyyaml
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends ripgrep libxml2-utils
+          python3 -m pip install --user --quiet pyyaml
 
       - name: Run tests/*.sh and scripts/tests/*.sh
         run: |

.hypatia-baseline.json

@@ -898,5 +898,13 @@
     "note": "TEMPORARY AUTHORITY CONFLICT (2026-08-24): Hypatia says the 6a2 directory is retired, but standards' registry generator, topology generator, readiness rules, template capability gates, and canonical documentation still consume this path. Do not move normative files to satisfy one downstream rule before the authority sources agree.",
     "expires_at": "2026-09-30",
     "tracking_issue": "hyperpolymath/standards#399"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "structural_drift",
+    "type": "SD022",
+    "file_pattern": "docs/proofs/spec-templates/**/*.adoc",
+    "note": "FALSE POSITIVE CLASS (2026-08-24): these are cross-repository proof-spec templates. Their src/... examples describe the target repository named by each template, not directories asserted to exist inside standards. The Markdown-to-AsciiDoc migration made this established corpus newly visible to SD022.",
+    "tracking_issue": "hyperpolymath/standards#399"
   }
 ]

.machine_readable/REGISTRY.a2ml

@@ -45,7 +45,7 @@ name = "A2ML — Attested Markup Language"
 stream = "foundation"
 home = "a2ml/"
 canonical_doc = "a2ml/README.adoc"
-source_hash = "sha256:2a54c3194a4a055bbbd0006963eac0a3a5a2c1e0dff683196c8feca48f538f52"
+source_hash = "sha256:480aeca64a094b3f184dc5aa98c00abb60ebcae33b41038410f2a5ff88d19427"
 route = "the typed/verified machine-readable document format"
 
 [[spec]]
@@ -54,7 +54,7 @@ name = "K9 Self-Validating Components"
 stream = "foundation"
 home = "k9-svc/"
 canonical_doc = "k9-svc/README.adoc"
-source_hash = "sha256:5f0fab5714c30bf6a43845820a925d7b00d6727d17668061d3488ec093b0737d"
+source_hash = "sha256:1c750e457184efd404a92a3faec4989cc4e59fb54302d50040ff88711750a6e6"
 route = "self-validating components with embedded contracts + deploy logic"
 
 [[spec]]
@@ -135,7 +135,7 @@ name = "0-AI Gatekeeper Protocol"
 stream = "protocol"
 home = "0-ai-gatekeeper-protocol/"
 canonical_doc = "0-ai-gatekeeper-protocol/README.adoc"
-source_hash = "sha256:0c648b66962fa1c23ce74ed7d1e2e95163c143d5909d27f7ac8f310f29068cbf"
+source_hash = "sha256:9e77212dd6a6cc027345bfd9f71cf5bdda5c12d2424515c0d0b838700442cd25"
 route = "the AI-agent entry/gating protocol behind 0-AI-MANIFEST"
 
 [[spec]]
@@ -162,7 +162,7 @@ name = "AXEL Protocol"
 stream = "protocol"
 home = "axel-protocol/"
 canonical_doc = "axel-protocol/README.adoc"
-source_hash = "sha256:6e4dce291ecdc20481f681d810db838a658af09a93c67cfa051d9d4427a24877"
+source_hash = "sha256:678e7e99899809bfd3211a392ea718446bd80d1bed2650ee7bb090537c88dd21"
 route = "age-gating + explicit-content enforcement"
 
 [[spec]]

lol/proofs/theories/information_theory.agda

@@ -112,23 +112,27 @@ jensen-shannon p q =
 -- Classified as justified postulates, not proof debt.
 
 -- Entropy is non-negative (H ≥ 0 follows from -p·log(p) ≥ 0 for 0 ≤ p ≤ 1)
+-- AXIOM: justified theorem over IEEE-754 Float; proof requires a real-analysis model.
 postulate
   entropy-nonnegative : ∀ {n} (d : Distribution n) → entropy d ≥ 0.0
     where
       _≥_ : Float → Float → Set
 
 -- KL-divergence is non-negative (Gibbs' inequality / log-sum inequality)
+-- AXIOM: justified Gibbs inequality over Float; proof requires a real-analysis model.
 postulate
   kl-nonnegative : ∀ {n} (p q : Distribution n) → kl-divergence p q ≥ 0.0
     where
       _≥_ : Float → Float → Set
 
 -- Jensen-Shannon is symmetric (follows from symmetry of KL terms in the midpoint construction)
+-- AXIOM: justified by the symmetric midpoint construction and paired KL terms.
 postulate
   js-symmetric : ∀ {n} (p q : Distribution n) →
     jensen-shannon p q ≡ jensen-shannon q p
 
 -- Jensen-Shannon is bounded [0, 1] (Lin 1991; upper bound via Jensen's inequality)
+-- AXIOM: justified Lin bound over Float; proof requires a real-analysis model.
 postulate
   js-bounded : ∀ {n} (p q : Distribution n) →
     0.0 ≤ jensen-shannon p q × jensen-shannon p q ≤ 1.0