diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index 67e5afc..a7aea83 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -17,4 +17,5 @@ jobs:
           curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
         continue-on-error: true
 permissions:
+  actions: read
   contents: read
diff --git a/.github/workflows/bridge-forbidden-phrases.yml b/.github/workflows/bridge-forbidden-phrases.yml
index aa55e67..c7b5e35 100644
--- a/.github/workflows/bridge-forbidden-phrases.yml
+++ b/.github/workflows/bridge-forbidden-phrases.yml
@@ -24,6 +24,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   check:
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 7b224d7..e052667 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -7,6 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml
index e9607d5..47ac11c 100644
--- a/.github/workflows/cflite_batch.yml
+++ b/.github/workflows/cflite_batch.yml
@@ -13,6 +13,7 @@ on:
   workflow_dispatch:  # Manual trigger
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml
index 326d6be..5f2a453 100644
--- a/.github/workflows/cflite_pr.yml
+++ b/.github/workflows/cflite_pr.yml
@@ -14,6 +14,7 @@ on:
       - '.clusterfuzzlite/**'
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e86d383..37f857d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,6 +18,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/compilation_tests.yml b/.github/workflows/compilation_tests.yml
index a538435..dc0d384 100644
--- a/.github/workflows/compilation_tests.yml
+++ b/.github/workflows/compilation_tests.yml
@@ -21,6 +21,7 @@ on:
       - '.github/workflows/compilation_tests.yml'
 
 permissions:
+  actions: read
   contents: read
 
 env:
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 9a0ae57..68feb3c 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -13,6 +13,7 @@ on:
     branches: [main, master]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/echidna-validation.yml b/.github/workflows/echidna-validation.yml
index d72f70c..d6273b9 100644
--- a/.github/workflows/echidna-validation.yml
+++ b/.github/workflows/echidna-validation.yml
@@ -18,6 +18,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml
index e99ef4b..06cc89c 100644
--- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml
+++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml
@@ -12,6 +12,7 @@
 # For more information about SLSA and how it improves the supply-chain, visit slsa.dev.
 
 permissions:
+  actions: read
   contents: read
 
 name: SLSA generic generator
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 94d34b4..c5bdea1 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -27,6 +27,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 91ac7e8..1e94274 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -18,6 +18,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
   # security-events: write serves two purposes (write implies read):
   #   1. read — lets the built-in GITHUB_TOKEN query this repo's own
diff --git a/.github/workflows/idris-verification.yml b/.github/workflows/idris-verification.yml
index 986f341..889f3af 100644
--- a/.github/workflows/idris-verification.yml
+++ b/.github/workflows/idris-verification.yml
@@ -26,6 +26,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index f216ca5..21b45e7 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -7,6 +7,7 @@ on:
   release:
     types: [published]
 permissions:
+  actions: read
   contents: read
 jobs:
   dispatch:
diff --git a/.github/workflows/lean-verification.yml b/.github/workflows/lean-verification.yml
index 64e82de..da02968 100644
--- a/.github/workflows/lean-verification.yml
+++ b/.github/workflows/lean-verification.yml
@@ -16,6 +16,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 6bd847d..c3fc68a 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -5,6 +5,7 @@ on:
     branches: [main]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   mirror:
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 6677406..23e8281 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -7,6 +7,7 @@ name: Push email notification
 on:
   push: {}
 permissions:
+  actions: read
   contents: read
 jobs:
   notify:
diff --git a/.github/workflows/rust-cli.yml b/.github/workflows/rust-cli.yml
index 5304cc7..5b671d7 100644
--- a/.github/workflows/rust-cli.yml
+++ b/.github/workflows/rust-cli.yml
@@ -13,6 +13,7 @@ on:
       - 'proofs/lean4/**'
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ec68608..20ad236 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -9,6 +9,7 @@ on:
     branches: [main]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 0e8471d..ce1f8eb 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -8,6 +8,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   scan:
diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml
index 75d00a4..20eb8b3 100644
--- a/.github/workflows/validation.yml
+++ b/.github/workflows/validation.yml
@@ -8,6 +8,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 67b6a82..9ad08b3 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -11,6 +11,7 @@ on:
       - '.github/workflows/**'
 
 permissions: read-all
+  actions: read
 
 jobs:
   lint-workflows:
diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc
index ca63b0c..7c61295 100644
--- a/CHANGELOG.adoc
+++ b/CHANGELOG.adoc
@@ -209,7 +209,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   * 105 Markdown · 70 Rust · 44 AsciiDoc · 22 Zig+C+H · 11 Elixir · 10 Idris2 + LICENSE + anchor taxonomy
 
 ==== Documentation
-- RSR-template gap fill: 188 `{{project}}` / `{{PROJECT}}` / `{{BUILD_CMD}}` placeholders replaced across 10 files (PR #59)
+- RSR-template gap fill: 188 `{{project}}` / `valence-shell` / `BUILD_CMD` placeholders replaced across 10 files (PR #59)
 - Anchor taxonomy migration: `.machine_readable/anchors/ANCHOR.a2ml` → `.machine_readable/6a2/anchor/ANCHOR.a2ml` + `0-AI-MANIFEST.a2ml` + `README.adoc` (PR #102)
 - ROADMAP refreshed with landed-PR cross-refs (M2 + M3 + M4 sweep, PR #68)
 - Wiki bootstrapped (Home + Session-Log-2026-06-01)
diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc
deleted file mode 100644
index 1e35e4f..0000000
--- a/GOVERNANCE.adoc
+++ /dev/null
@@ -1,296 +0,0 @@
-// SPDX-License-Identifier: CC-BY-SA-4.0
-// Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-= Governance Model
-:toc:
-:toclevels: 2
-
-== Overview
-
-Valence Shell follows a **Tri-Perimeter Governance Model** aligned with the TPCF (Tri-Perimeter Contribution Framework).
-
-== Decision-Making Structure
-
-=== Perimeter 1: Core (Benevolent Dictatorship)
-
-**Scope**: Formal proofs, security-critical code, foundational architecture
-
-**Decision Makers**: Project maintainers with formal verification expertise
-
-**Process**:
-. Proposal via RFC (Request for Comments)
-. Technical review by all core maintainers
-. Proof verification
-. Consensus required (all maintainers must approve)
-. Implementation with tests
-. Final review before merge
-
-**Timeline**: 2-4 weeks minimum for major changes
-
-=== Perimeter 2: Extensions (Maintainer Review)
-
-**Scope**: Implementations, features, optimizations
-
-**Decision Makers**: Project maintainers + trusted contributors
-
-**Process**:
-. Feature proposal via GitHub/GitLab issue
-. Design discussion
-. Implementation by contributor
-. Code review by at least 1 maintainer
-. CI/CD must pass
-. Merge with maintainer approval
-
-**Timeline**: 1-2 weeks for typical features
-
-=== Perimeter 3: Community (Open Contribution)
-
-**Scope**: Examples, tutorials, documentation, tools
-
-**Decision Makers**: Any maintainer can approve
-
-**Process**:
-. Submit pull/merge request
-. Self-document the contribution
-. Basic tests pass
-. Quick review by any maintainer
-. Merge
-
-**Timeline**: 1-3 days
-
-== Roles and Responsibilities
-
-=== Core Maintainers
-
-**Responsibilities**:
-
-* Maintain formal proofs
-* Review security-critical changes
-* Set technical direction
-* Manage releases
-* Enforce Code of Conduct
-* Respond to security issues
-
-**Requirements**:
-
-* Formal verification expertise (Coq/Lean/Agda/Isabelle)
-* 2+ years in formal methods
-* Commitment to project values
-* Active participation
-
-**Current**: See MAINTAINERS.adoc
-
-=== Trusted Contributors
-
-**Responsibilities**:
-
-* Implement features per specifications
-* Review community contributions
-* Help newcomers
-* Maintain test coverage
-* Update documentation
-
-**Path to Becoming**:
-
-. 5+ quality contributions to Perimeter 3
-. Demonstrate understanding of formal specifications
-. Follow coding standards
-. Help community members
-. Nomination by core maintainer
-. Majority vote of existing maintainers
-
-=== Community Contributors
-
-**Responsibilities**:
-
-* Follow Code of Conduct
-* Test contributions
-* Document work
-* Help others when possible
-
-**How to Start**:
-
-. Read CONTRIBUTING.md
-. Find `good-first-issue` tag
-. Submit PR to Perimeter 3
-. Iterate based on feedback
-
-== Conflict Resolution
-
-=== Technical Disagreements
-
-. Discussion in GitHub/GitLab issue
-. Present evidence (benchmarks, formal proofs, citations)
-. Seek consensus
-. If no consensus: Core maintainers vote
-. Benevolent dictator (project lead) breaks ties
-. Document decision rationale
-
-=== Interpersonal Conflicts
-
-. Follow CODE_OF_CONDUCT.md
-. Private discussion first
-. Escalate to maintainers if needed
-. Formal Code of Conduct process
-. Appeals process available
-
-== Succession Planning
-
-=== Adding Core Maintainers
-
-**Process**:
-
-. Nomination by existing core maintainer
-. Must have:
-   - Formal verification expertise
-   - 1+ year as trusted contributor
-   - Significant proof contributions
-   - Community respect
-. Discussion period (2 weeks)
-. **Consensus vote** (all core maintainers must approve)
-. Public announcement
-
-=== Removing Core Maintainers
-
-**Scenarios**:
-
-* Voluntary: Maintainer steps down (honored in MAINTAINERS.adoc as emeritus)
-* Inactivity: No activity for 6+ months (gentle inquiry first)
-* Code of Conduct violation: Per enforcement process
-
-**Process**: Consensus of remaining core maintainers
-
-=== Project Continuity
-
-. All knowledge documented (not in heads)
-. Proofs are self-documenting
-. Regular succession planning discussions
-. Bus factor mitigation (train multiple maintainers)
-. Emergency contact: See SECURITY.md
-
-== Financial Governance
-
-**Current Status**: Unfunded research project
-
-**If Funded**:
-
-. Transparent budgeting
-. Quarterly financial reports
-. OpenCollective or similar (public ledger)
-. Spending decisions: Core maintainers consensus
-. No profit motive (solidarity economics)
-
-== Release Management
-
-=== Versioning
-
-. **Semantic Versioning 2.0**
-. Major.Minor.Patch (e.g., 0.5.0)
-. Pre-1.0: Research prototype
-. 1.0+: Production-ready (after extraction gap closed)
-
-=== Release Process
-
-. Version bump in CHANGELOG.adoc
-. Tag commit: `git tag -a v0.x.x`
-. CI/CD runs full verification
-. All proofs must compile
-. All tests must pass
-. Security audit (for major versions)
-. Announce on GitHub/GitLab
-. Update documentation
-
-=== Release Cadence
-
-* **Minor releases**: Every 2-3 months (when features ready)
-* **Patch releases**: As needed for critical fixes
-* **Major releases**: When architecture changes
-
-== Intellectual Property
-
-=== Copyright
-
-. Contributors retain copyright
-. License: Palimpsest-MPL 1.0 or later (see LICENSE)
-. No copyright assignment required
-. Attribution preserved (Palimpsest requirement)
-
-=== Patents
-
-. No patent trolling
-. If contributor holds patents on contributed code, grant royalty-free license
-. Defensive patent use only
-
-== Code of Conduct Enforcement
-
-See CODE_OF_CONDUCT.md for full details.
-
-**Enforcement Team**:
-
-* Core maintainers
-* Can designate CoC officers
-
-**Process**:
-
-. Report received (confidential)
-. Investigation (1-2 weeks)
-. Decision: Correction, Warning, Temporary Ban, Permanent Ban
-. Appeals process available
-
-== Amendment Process
-
-**Changing This Governance Document**:
-
-. Proposal via GitHub/GitLab issue
-. Discussion period (4 weeks minimum)
-. Consensus of core maintainers
-. Update GOVERNANCE.adoc
-. Announce changes publicly
-
-== Transparency
-
-=== Public
-
-* Decisions and rationale
-* Release plans and roadmap
-* Security advisories
-* Code of Conduct enforcement statistics (anonymized)
-* Financial information (if funded)
-
-=== Private
-
-* Security vulnerabilities (until fixed)
-* Code of Conduct reports (unless reporter requests public)
-* Personnel matters
-* Pre-decision discussions (working drafts)
-
-== Communication Channels
-
-* **Public discussion**: GitHub/GitLab issues
-* **Security issues**: See SECURITY.md
-* **Code of Conduct**: See CODE_OF_CONDUCT.md
-* **General email**: See MAINTAINERS.adoc
-
-== Values and Principles
-
-. **Formal correctness** over speed
-. **Mathematical guarantees** over testing alone
-. **Transparency** over secrecy
-. **Community** over ego
-. **Documentation** over oral tradition
-. **Reproducibility** over "works on my machine"
-. **Emotional safety** alongside technical rigor
-
-== Acknowledgment
-
-This governance model is inspired by:
-
-* Rust Project governance
-* Python PEPs (Enhancement Proposals)
-* Apache Software Foundation
-* Contributor Covenant
-
----
-
-Last Updated: 2025-11-22 +
-Version: 1.0 +
-Maintainer: See MAINTAINERS.adoc