From 265e8bb2b8d00e40bcdbc9866c364d4b119a7d8c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 8 Jun 2026 10:36:21 +0000
Subject: [PATCH 1/2] chore(ci)(deps): bump actions/checkout from 4 to 6

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/agent-runner-docker.yml  |  2 +-
 .github/workflows/auto-merge-ready-prs.yml |  2 +-
 .github/workflows/brain-seal-refresh.yml   |  2 +-
 .github/workflows/build-paper.yml          |  2 +-
 .github/workflows/build-vivado-image.yml   |  2 +-
 .github/workflows/check-now-freshness.yml  |  2 +-
 .github/workflows/coq-kernel.yml           |  2 +-
 .github/workflows/coq-proofs.yml           |  2 +-
 .github/workflows/deploy-api.yml           |  4 ++--
 .github/workflows/fpga-build.yml           | 14 +++++++-------
 .github/workflows/l1-traceability.yml      |  2 +-
 .github/workflows/notebook-gate.yml        |  2 +-
 .github/workflows/notebook-sync.yml        |  8 ++++----
 .github/workflows/now-sync-gate.yml        |  2 +-
 .github/workflows/phi-loop-ci.yml          |  2 +-
 .github/workflows/pr-dashboard.yml         |  2 +-
 .github/workflows/release.yml              |  8 ++++----
 .github/workflows/rings-rust.yml           |  4 ++--
 .github/workflows/sandbox-docker.yml       |  2 +-
 .github/workflows/schema-validation.yml    |  2 +-
 .github/workflows/seal-coverage.yml        |  2 +-
 .github/workflows/secret-scan.yml          |  2 +-
 .github/workflows/vivado-synth.yml         |  2 +-
 .github/workflows/zenodo-publish.yml       |  2 +-
 24 files changed, 38 insertions(+), 38 deletions(-)

diff --git a/.github/workflows/agent-runner-docker.yml b/.github/workflows/agent-runner-docker.yml
index 143d96be2..dbe3f11bf 100644
--- a/.github/workflows/agent-runner-docker.yml
+++ b/.github/workflows/agent-runner-docker.yml
@@ -19,7 +19,7 @@ jobs:
   build-and-push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
diff --git a/.github/workflows/auto-merge-ready-prs.yml b/.github/workflows/auto-merge-ready-prs.yml
index 9b97b6fc1..75910ec7e 100644
--- a/.github/workflows/auto-merge-ready-prs.yml
+++ b/.github/workflows/auto-merge-ready-prs.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Find ready PRs
         id: find-ready
diff --git a/.github/workflows/brain-seal-refresh.yml b/.github/workflows/brain-seal-refresh.yml
index 799977569..28a07ed3d 100644
--- a/.github/workflows/brain-seal-refresh.yml
+++ b/.github/workflows/brain-seal-refresh.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Run experience aggregation
         run: |
diff --git a/.github/workflows/build-paper.yml b/.github/workflows/build-paper.yml
index 0fd0633d4..cac6ceda4 100644
--- a/.github/workflows/build-paper.yml
+++ b/.github/workflows/build-paper.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install LaTeX dependencies
         run: |
diff --git a/.github/workflows/build-vivado-image.yml b/.github/workflows/build-vivado-image.yml
index 28dcf97a2..f7cc01394 100644
--- a/.github/workflows/build-vivado-image.yml
+++ b/.github/workflows/build-vivado-image.yml
@@ -39,7 +39,7 @@ jobs:
           remove-codeql: 'true'
           remove-docker-images: 'true'
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Download Vivado installer from release asset
         env:
diff --git a/.github/workflows/check-now-freshness.yml b/.github/workflows/check-now-freshness.yml
index 9f5812f44..6d2ddd8c3 100644
--- a/.github/workflows/check-now-freshness.yml
+++ b/.github/workflows/check-now-freshness.yml
@@ -8,7 +8,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Check freshness
         run: |
diff --git a/.github/workflows/coq-kernel.yml b/.github/workflows/coq-kernel.yml
index f973b6265..acd850c33 100644
--- a/.github/workflows/coq-kernel.yml
+++ b/.github/workflows/coq-kernel.yml
@@ -16,7 +16,7 @@ jobs:
     container:
       image: coqorg/coq:8.19-ocaml-4.14-flambda
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Flocq (opam)
         run: |
diff --git a/.github/workflows/coq-proofs.yml b/.github/workflows/coq-proofs.yml
index a613338dc..be79f0640 100644
--- a/.github/workflows/coq-proofs.yml
+++ b/.github/workflows/coq-proofs.yml
@@ -17,7 +17,7 @@ jobs:
       image: coqorg/coq:8.19-ocaml-4.14-flambda
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Coq Interval
         run: |
diff --git a/.github/workflows/deploy-api.yml b/.github/workflows/deploy-api.yml
index c9a4ebad7..c2f641b72 100644
--- a/.github/workflows/deploy-api.yml
+++ b/.github/workflows/deploy-api.yml
@@ -19,7 +19,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           node-version: '22'
@@ -34,7 +34,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
diff --git a/.github/workflows/fpga-build.yml b/.github/workflows/fpga-build.yml
index b5144c058..1be52266f 100644
--- a/.github/workflows/fpga-build.yml
+++ b/.github/workflows/fpga-build.yml
@@ -25,7 +25,7 @@ jobs:
   fpga-smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -80,7 +80,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -141,7 +141,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -250,7 +250,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -295,7 +295,7 @@ jobs:
     needs: fpga-synthesis
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -411,7 +411,7 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -480,7 +480,7 @@ jobs:
     needs: fpga-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/l1-traceability.yml b/.github/workflows/l1-traceability.yml
index c23a4ea69..eddbf13ea 100644
--- a/.github/workflows/l1-traceability.yml
+++ b/.github/workflows/l1-traceability.yml
@@ -23,7 +23,7 @@ jobs:
 
       - name: Checkout repository
         if: env.IS_BOT != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/notebook-gate.yml b/.github/workflows/notebook-gate.yml
index 80d1eb3eb..23bcebd6b 100644
--- a/.github/workflows/notebook-gate.yml
+++ b/.github/workflows/notebook-gate.yml
@@ -21,7 +21,7 @@ jobs:
     name: 🔒 NotebookLM notebook required
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Check for .notebook_id
         id: check
diff --git a/.github/workflows/notebook-sync.yml b/.github/workflows/notebook-sync.yml
index 1124f3a0d..cda037f72 100644
--- a/.github/workflows/notebook-sync.yml
+++ b/.github/workflows/notebook-sync.yml
@@ -46,7 +46,7 @@ jobs:
       event_type: ${{ steps.event_type.outputs.type }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Extract issue info
         id: issue
@@ -120,7 +120,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -238,7 +238,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Check if activity.md changed
         id: check
@@ -270,7 +270,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5
diff --git a/.github/workflows/now-sync-gate.yml b/.github/workflows/now-sync-gate.yml
index b58eddad0..ba9b850a0 100644
--- a/.github/workflows/now-sync-gate.yml
+++ b/.github/workflows/now-sync-gate.yml
@@ -21,7 +21,7 @@ jobs:
         run: |
           echo "Trusted bot PR -- gate passes as no-op. Closes 1031."
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         if: env.IS_BOT != 'true'
         with:
           fetch-depth: 0
diff --git a/.github/workflows/phi-loop-ci.yml b/.github/workflows/phi-loop-ci.yml
index 52f183d84..e9f28e956 100644
--- a/.github/workflows/phi-loop-ci.yml
+++ b/.github/workflows/phi-loop-ci.yml
@@ -8,7 +8,7 @@ jobs:
   phi-loop-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: PHI Loop identity check
         run: |
diff --git a/.github/workflows/pr-dashboard.yml b/.github/workflows/pr-dashboard.yml
index ed9fcd5ec..d2a00fd08 100644
--- a/.github/workflows/pr-dashboard.yml
+++ b/.github/workflows/pr-dashboard.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get PR status
         id: pr-status
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4a59fe8c5..8e49d7363 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -84,7 +84,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -112,7 +112,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Rust
         uses: actions-rs/toolchain@v1
@@ -157,7 +157,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/rings-rust.yml b/.github/workflows/rings-rust.yml
index aaf8209ab..56841d27b 100644
--- a/.github/workflows/rings-rust.yml
+++ b/.github/workflows/rings-rust.yml
@@ -41,7 +41,7 @@ jobs:
       count: ${{ steps.gen.outputs.count }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Generate matrix
         id: gen
         run: |
@@ -65,7 +65,7 @@ jobs:
       matrix: ${{ fromJSON(needs.discover.outputs.matrix) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Show toolchain
         run: |
diff --git a/.github/workflows/sandbox-docker.yml b/.github/workflows/sandbox-docker.yml
index 5ed4da1bf..7944f1688 100644
--- a/.github/workflows/sandbox-docker.yml
+++ b/.github/workflows/sandbox-docker.yml
@@ -19,7 +19,7 @@ jobs:
   build-and-push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
diff --git a/.github/workflows/schema-validation.yml b/.github/workflows/schema-validation.yml
index 27f769530..e6a998ad6 100644
--- a/.github/workflows/schema-validation.yml
+++ b/.github/workflows/schema-validation.yml
@@ -8,7 +8,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Validate schemas
         run: |
diff --git a/.github/workflows/seal-coverage.yml b/.github/workflows/seal-coverage.yml
index 6a3af4a03..8c168eefc 100644
--- a/.github/workflows/seal-coverage.yml
+++ b/.github/workflows/seal-coverage.yml
@@ -10,7 +10,7 @@ jobs:
   coverage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Run coverage
         run: |
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 6a0b7ed96..bed134feb 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -16,7 +16,7 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Block Solana keypair files anywhere in the tree
         run: |
diff --git a/.github/workflows/vivado-synth.yml b/.github/workflows/vivado-synth.yml
index 0f6c5ae9f..304845969 100644
--- a/.github/workflows/vivado-synth.yml
+++ b/.github/workflows/vivado-synth.yml
@@ -64,7 +64,7 @@ jobs:
           remove-haskell: 'true'
           remove-codeql: 'true'
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/zenodo-publish.yml b/.github/workflows/zenodo-publish.yml
index ed4dd2518..038db5f22 100644
--- a/.github/workflows/zenodo-publish.yml
+++ b/.github/workflows/zenodo-publish.yml
@@ -8,7 +8,7 @@ jobs:
   zenodo:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Upload to Zenodo
         uses: megasanjay/upload-to-zenodo@v2.0.1

From 3674add54e6ae73020a7ece08f60f4027a756e6f Mon Sep 17 00:00:00 2001
From: gHashTag <admin@t27.ai>
Date: Sun, 14 Jun 2026 13:22:06 +0000
Subject: [PATCH 2/2] ci: run container jobs as root for checkout@v6 EACCES fix

coq-kernel, coq-proofs, rings-rust container blocks get options: --user root
so actions/checkout@v6 (Node 24) can write _temp save_state files.

Closes #1031
---
 .github/workflows/coq-kernel.yml | 1 +
 .github/workflows/coq-proofs.yml | 1 +
 .github/workflows/rings-rust.yml | 1 +
 docs/NOW.md                      | 7 +++++++
 4 files changed, 10 insertions(+)

diff --git a/.github/workflows/coq-kernel.yml b/.github/workflows/coq-kernel.yml
index acd850c33..4dcbadc53 100644
--- a/.github/workflows/coq-kernel.yml
+++ b/.github/workflows/coq-kernel.yml
@@ -15,6 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: coqorg/coq:8.19-ocaml-4.14-flambda
+      options: --user root
     steps:
       - uses: actions/checkout@v6
 
diff --git a/.github/workflows/coq-proofs.yml b/.github/workflows/coq-proofs.yml
index be79f0640..3368629fc 100644
--- a/.github/workflows/coq-proofs.yml
+++ b/.github/workflows/coq-proofs.yml
@@ -15,6 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: coqorg/coq:8.19-ocaml-4.14-flambda
+      options: --user root
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
diff --git a/.github/workflows/rings-rust.yml b/.github/workflows/rings-rust.yml
index 56841d27b..a5b96aa7a 100644
--- a/.github/workflows/rings-rust.yml
+++ b/.github/workflows/rings-rust.yml
@@ -59,6 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: rust:1.83-bookworm
+      options: --user root
     continue-on-error: true
     strategy:
       fail-fast: false
diff --git a/docs/NOW.md b/docs/NOW.md
index 50e4d249e..03e2d90e0 100644
--- a/docs/NOW.md
+++ b/docs/NOW.md
@@ -2,6 +2,13 @@
 
 Last updated: 2026-06-14
 
+## ci-checkout6-container-root -- fix checkout@v6 EACCES inside container jobs (Closes #1031)
+
+- **WHERE** (CI only): `.github/workflows/coq-kernel.yml`, `.github/workflows/coq-proofs.yml`, `.github/workflows/rings-rust.yml`. Added `options: --user root` to each `container:` block. `actions/checkout@v6` runs on Node 24; inside container jobs the runner-injected `_temp/_runner_file_commands/save_state_*` files are root-owned but the action ran as a non-root container user, so the Post-checkout `save_state` failed with `EACCES: permission denied`, failing the job. Running the container as root lets the action write those state files. `vivado-synth.yml` already had `options: --user 0`; `build-vivado-image.yml` has no real container job. No source/specs/codegen/conformance/`gen/` touched.
+- **Why**: completes the actions/checkout 4->6 bump (#1044). Required gates unaffected; container build/proof jobs (coq, rings-rust) no longer fail on the EACCES Post step. Human PRs remain fully gated. L6/L5 untouched; L4 not applicable (workflow YAML). Closes #1031.
+- **Anchor**: phi^2 + phi^-2 = 3
+
+
 ## conformance: catalog-count CI gate + WP-18 corpus-integrity gate + P3109 4-param cross-walk (this PR)
 
 - **WHAT**: the count-drift follow-up to #1064. The #1064 parser fix landed; this PR adds the CI guards that keep the catalog count and the conformance corpus honest going forward, plus the P3109 re-anchor docs. Per the repo constitution (L2 GENERATION), gen/ is DERIVED and is NOT hand-committed here; the count-gate regenerates fresh against the SSOT instead of diffing committed gen/.