fix(ci): grant callers the "actions: read" their reusables request

.github/workflows/changelog.yml

@@ -9,6 +9,11 @@ on:
       - 'CHANGELOG.md'
 
 permissions:
+  # Required: the reusable this calls requests `actions: read`. A caller that
+  # declares `permissions:` at all gets `none` for every key it omits, so
+  # leaving this out makes GitHub reject the run at startup_failure with zero
+  # jobs and no log — "requesting 'actions: read', but is only allowed 'actions: none'".
+  actions: read
   contents: write
   pull-requests: write
 

.github/workflows/readme-derive.yml

@@ -19,6 +19,11 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  # Required: the reusable this calls requests `actions: read`. A caller that
+  # declares `permissions:` at all gets `none` for every key it omits, so
+  # leaving this out makes GitHub reject the run at startup_failure with zero
+  # jobs and no log — "requesting 'actions: read', but is only allowed 'actions: none'".
+  actions: read
   contents: write
 
 jobs:

.machine_readable/REGISTRY.a2ml

@@ -45,7 +45,7 @@ name = "A2ML — Attested Markup Language"
 stream = "foundation"
 home = "a2ml/"
 canonical_doc = "a2ml/README.adoc"
-source_hash = "sha256:a79bce448d650dabd8d831212880b4814da1d1f6583de0ad2d39875c5a1fbecf"
+source_hash = "sha256:0a1d767bef0a5eb5c9483598d92d12d998e7544a71ee1683be6938bdf346cd66"
 route = "the typed/verified machine-readable document format"
 
 [[spec]]
@@ -54,7 +54,7 @@ name = "K9 Self-Validating Components"
 stream = "foundation"
 home = "k9-svc/"
 canonical_doc = "k9-svc/README.adoc"
-source_hash = "sha256:6bcd9a401b27600886129a8b644746fff23e4633b51936b965f51238afb9fa04"
+source_hash = "sha256:47567d4bd1b00ffc3ab42cdea886519373a31814be8471893255472ec1989d81"
 route = "self-validating components with embedded contracts + deploy logic"
 
 [[spec]]
@@ -72,7 +72,7 @@ name = "META.a2ml spec"
 stream = "foundation"
 home = "meta-a2ml/"
 canonical_doc = "meta-a2ml/README.adoc"
-source_hash = "sha256:2818a77ee141782f336b43f2266783691064b775deb33ea768c1560268375835"
+source_hash = "sha256:bd3936fa6ba46443167950d983749e4b130373183f3d647aa60aebde7789bede"
 route = "architecture decisions / governance metadata format"
 
 [[spec]]
@@ -81,7 +81,7 @@ name = "STATE.a2ml spec"
 stream = "foundation"
 home = "state-a2ml/"
 canonical_doc = "state-a2ml/README.adoc"
-source_hash = "sha256:b610769df9d0119793f830208be964c97894242c987c3a9791856d06f7b24f29"
+source_hash = "sha256:8ec140f16e80e96a53c8365df6c06fea50bf2625f84e4ddaa306e5d10721af18"
 route = "project-state metadata format (drives this registry's topology)"
 
 [[spec]]
@@ -90,7 +90,7 @@ name = "ECOSYSTEM.a2ml spec"
 stream = "foundation"
 home = "ecosystem-a2ml/"
 canonical_doc = "ecosystem-a2ml/README.adoc"
-source_hash = "sha256:a0d9c7728e32a36d4eaa0ddf22bb2fc7b60a85e9b50d267673e1abb2e2ef94c9"
+source_hash = "sha256:7fbd11721e97bd85f8200db8a75267be4d7347f82ad0226e9b1296c92d47f9f2"
 route = "ecosystem-positioning metadata format"
 
 [[spec]]
@@ -99,7 +99,7 @@ name = "AGENTIC.a2ml spec"
 stream = "foundation"
 home = "agentic-a2ml/"
 canonical_doc = "agentic-a2ml/README.adoc"
-source_hash = "sha256:b95623f7df243aed2c791c327790cfc4d28fc61a3163625ac6c41e85d8c0f83e"
+source_hash = "sha256:025e72fc7cbddeeb4e92b3d1aedd74e812f164644dd9ecd26010e4ff26a74c3a"
 route = "AI-agent operational gating / entropy budgets"
 
 [[spec]]
@@ -108,7 +108,7 @@ name = "NEUROSYM.a2ml spec"
 stream = "foundation"
 home = "neurosym-a2ml/"
 canonical_doc = "neurosym-a2ml/README.adoc"
-source_hash = "sha256:be62099578501b961a948d2218e4ab07ee2b575d8affd03724df493fb63d2e8e"
+source_hash = "sha256:753f11a288d6402296a6dc2fc69c0cca986e164d6319b7b789e159995816ec61"
 route = "symbolic semantics / proof obligations"
 
 [[spec]]
@@ -117,7 +117,7 @@ name = "PLAYBOOK.a2ml spec"
 stream = "foundation"
 home = "playbook-a2ml/"
 canonical_doc = "playbook-a2ml/README.adoc"
-source_hash = "sha256:eb5a05e3853039b03e1f2376a1711365e2b9f657befe55fbfb4aa6d87a5d9eb3"
+source_hash = "sha256:fa6ca3574c64d2c03851fee9a0b5ab28b16eb81ce605690f95571640a577b218"
 route = "executable operational runbooks"
 
 [[spec]]
@@ -126,7 +126,7 @@ name = "ANCHOR.a2ml spec"
 stream = "foundation"
 home = "anchor-a2ml/"
 canonical_doc = "anchor-a2ml/README.adoc"
-source_hash = "sha256:3948f88c03367bd21992dd068b6ea4d0a9c86a98ea6a51567eaff4990df9a70a"
+source_hash = "sha256:d33c7ff6c44dc734eb8fd05bd5c7491176da20237b0a5d8212df25471e6b2765"
 route = "project-recalibration intervention format"
 
 [[spec]]
@@ -162,7 +162,7 @@ name = "AXEL Protocol"
 stream = "protocol"
 home = "axel-protocol/"
 canonical_doc = "axel-protocol/README.adoc"
-source_hash = "sha256:b0b7c07f4d63aa11557fa53d289010826bd5d84cb48489ee1f708af5d9c639dc"
+source_hash = "sha256:e5107e43de348a9aecb9991e33bf066fefcc2b4738925140ea91a2fde627c56d"
 route = "age-gating + explicit-content enforcement"
 
 [[spec]]
@@ -180,7 +180,7 @@ name = "ARG — Adoption Readiness Grades"
 stream = "readiness"
 home = "adoption-readiness-grades/"
 canonical_doc = "adoption-readiness-grades/README.adoc"
-source_hash = "sha256:8943491cf3991b8c6fd5a53bd83657c63978592510cbe79996b4034ab34ae40d"
+source_hash = "sha256:89999392cd908835ea7aa0e8ccbdefbdeacab7bc012c4f040aadc811f9caf587"
 route = "per-language adoption-maturity profile templates"
 
 [[spec]]
@@ -189,7 +189,7 @@ name = "FRG — Foundations Readiness Grades"
 stream = "readiness"
 home = "foundations-readiness-grades/"
 canonical_doc = "foundations-readiness-grades/README.adoc"
-source_hash = "sha256:af968fdd30947f20898895497dcba7b40850e84d35b5b384ef6d0e509ab6afbd"
+source_hash = "sha256:e8cd80df1620ee6cb95a68758c7c51a6406ebbd46cb60e4c8e83cc5d771fa83e"
 route = "per-language foundational-maturity profile templates"
 
 [[spec]]
@@ -198,7 +198,7 @@ name = "CRG — Component Readiness Grades"
 stream = "readiness"
 home = "component-readiness-grades/"
 canonical_doc = "component-readiness-grades/README.adoc"
-source_hash = "sha256:30a65855c396c43955d3abf77623ecec5932347c9ff83b6ab510b99176acec83"
+source_hash = "sha256:a101418a64260691a18f696cd388f6a254a46b73ae680c6e3d1cf46788a3d7a2"
 route = "the X..A grading system for components"
 
 [[spec]]
@@ -207,7 +207,7 @@ name = "TRG — Toolchain Readiness Grades"
 stream = "readiness"
 home = "toolchain-readiness-grades/"
 canonical_doc = "toolchain-readiness-grades/README.adoc"
-source_hash = "sha256:6290b871c14e8e15ebc07602400bf49deba27724b70dced8e0c0ed7e44859fe5"
+source_hash = "sha256:9f88c4e947226a0c53a419458949533eb84c2d7e8a343cb2d547ccca880939b6"
 route = "per-toolchain readiness profile templates"
 
 [[spec]]
@@ -243,7 +243,7 @@ name = "ENSAID Config"
 stream = "governance"
 home = "ensaid-config/"
 canonical_doc = "ensaid-config/README.adoc"
-source_hash = "sha256:1a5b75d3459b63bf7f3ced7eb8b7e7372c08c3b1d6fbaac6da98d008250d9020"
+source_hash = "sha256:c56e9784c957b9bd29704d41cbf7d88b1495789e0ad1c628de42abe900d319ef"
 route = "the ensaid configuration standard"
 
 [[spec]]
@@ -288,7 +288,7 @@ name = "A2ML Templates"
 stream = "integration"
 home = "a2ml-templates/"
 canonical_doc = "a2ml-templates/STATE.a2ml.v2.spec.adoc"
-source_hash = "sha256:1cd30a08f73b51804af7adb3862c20983b97d30542cc7ff2a653fec4ff4e0063"
+source_hash = "sha256:ff30b8e1e7c5d4dcf12d17789e40064b632c92bca3d8c2f891f109dc9157dc4a"
 route = "copy-in templates for the 7 A2ML files"
 
 [[spec]]

.machine_readable/scorecards/0-ai-gatekeeper-protocol.scorecard.a2ml

@@ -32,6 +32,7 @@ id = "M3"
 text = "The repository's own machine-readable state MUST accurately reflect this repository (not stale template boilerplate), since the manifest itself declares 'No stale metadata' as a Core Invariant."
 system = "none"
 status = "fail"
+check = "true"
 effects = "/home/user/standards/0-ai-gatekeeper-protocol/.machine_readable/6a2/STATE.a2ml declares project = \"rsr-template-repo\" (name = \"Rsr Template Repo\", completion-percentage = 5, generic scaffolding actions like 'Define project scope and objectives'), i.e. it is an un-edited template copy, not this repo's actual state — directly violating the protocol's own 'no stale metadata' invariant it asks every other repo to uphold. Any agent trusting STATE.a2ml for context (as the manifest's own Session Startup Checklist instructs) would be misled about project identity/status, undermining the protocol's core value proposition."
 
 [[must]]