Merge branch 'main' into findings-submissions

Author: hyperpolymath

.claude/CLAUDE.md

@@ -81,6 +81,24 @@ Control    (report < 0.85)        →  Human review required
 3. No hardcoded secrets — use env vars with `${VAR:-}` defaults.
 4. Fix scripts must be idempotent (safe to run multiple times).
 5. Confidence thresholds gate all automated actions.
+6. **`bots/<name>/` directories are THIN ADAPTERS, not homes for standalone
+   products.** Never vendor an entire external project (its own Cargo
+   workspace, analyzers, containers, deployment, docs) into a bot slot, and
+   never let a bot crate add a `path` dependency that escapes the repo. If a
+   capability deserves its own project, build it in its own repository and
+   depend on it externally. See [`bots/README.adoc`](../bots/README.adoc).
+   - **Disambiguation:** `sustainabot` (this fleet's eco/econ slot, kept as
+     `BotId::Sustainabot`) is **not** `OikosBot` and **not** `oikos`. A misfiled
+     full copy of OikosBot once lived in `bots/sustainabot/`; it was extracted to
+     `hyperpolymath/oikosbot` and the slot reset to a placeholder. `oikos` is a
+     separate DSL (`hyperpolymath/oikos-economics-accounting-dsl`).
+7. **Mark intentional mass-deletions.** The Repo Integrity Guard
+   (`.github/workflows/repo-integrity-guard.yml`) fails any change that deletes
+   more than `MAX_DELETIONS` (50) tracked files vs. base — it exists because
+   `main` was once silently gutted from 1777 files to 2. For a *deliberate*
+   large removal, include the literal marker `[mass-delete-ok]` in a commit
+   message in the range, **or** in the PR title/body. Never weaken the guard or
+   trim its critical-file list just to get a change through.
 
 ## Repo health
 

.github/workflows/boj-build.yml

@@ -10,7 +10,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository

.github/workflows/casket-pages.yml

@@ -21,10 +21,10 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
 
       - name: Checkout casket-ssg
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg

.github/workflows/codeql.yml

@@ -4,8 +4,10 @@ name: CodeQL Security Analysis
 on:
   push:
     branches: [main, master]
+  # No `branches:` filter — a required check whose workflow is branch-gated is
+  # never created on a non-matching base and blocks merge forever at
+  # "Expected — Waiting for status to be reported" (cf. affinescript#645).
   pull_request:
-    branches: [main, master]
   schedule:
     - cron: '0 6 1 * *'
 
@@ -41,7 +43,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3

.github/workflows/dogfood-gate.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check for A2ML files
         id: detect
@@ -88,7 +88,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check for K9 files
         id: detect
@@ -138,7 +138,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan for invisible characters
         id: lint
@@ -203,7 +203,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check for Groove manifest
         id: groove
@@ -264,7 +264,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Generate dogfooding scorecard
         run: |

.github/workflows/e2e.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install PyYAML (for workflow YAML validation)
         run: pip install pyyaml --quiet
       - name: Run E2E tests

.github/workflows/hypatia-dispatch-intake.yml

@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout gitbot-fleet
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           fetch-depth: 0
 

.github/workflows/hypatia-scan.yml

@@ -7,8 +7,10 @@ name: Hypatia Security Scan
 on:
   push:
     branches: [main, master, develop]
+  # No `branches:` filter — a required check whose workflow is branch-gated is
+  # never created on a non-matching base and blocks merge forever at
+  # "Expected — Waiting for status to be reported" (cf. affinescript#645).
   pull_request:
-    branches: [main, master]
   schedule:
     - cron: '0 0 * * 0'
   workflow_dispatch:
@@ -25,7 +27,7 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242
     secrets: inherit
     # Total caller-side wall-clock cap for the reusable. Matches
     # Hypatia's `missing_timeout_minutes` rule expectation. The scan is

.github/workflows/inbox-steward.yml

@@ -291,7 +291,7 @@ jobs:
 
     steps:
       - name: Checkout gitbot-fleet
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -380,7 +380,7 @@ jobs:
 
     steps:
       - name: Checkout gitbot-fleet
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Send dispatch to Hypatia
         env:

.github/workflows/learning-loop.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout gitbot-fleet
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           lfs: true  # shared-context/learning/*.jsonl is LFS-tracked (Item 60)