diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..6b2574f
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,50 @@
+# SPDX-License-Identifier: MPL-2.0
+# Analyses the GitHub Actions workflows in this repo. This is a Julia
+# package registry: source content is TOML and the only executable
+# surface is the workflows themselves -- so `language: actions` is the
+# matrix that produces meaningful SAST results (closing the
+# `scorecard/StaticAnalysis` nominal-SAST finding).
+name: CodeQL Security Analysis
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  schedule:
+    - cron: '0 6 * * 1'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
+        with:
+          category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 4bb50e9..5e89144 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
new file mode 100644
index 0000000..4880045
--- /dev/null
+++ b/.github/workflows/mirror.yml
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: MPL-2.0-or-later
+name: Mirror to Git Forges
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  mirror:
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260
+    secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 0000000..e40bd25
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Scorecards supply-chain security
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '23 4 * * 1'
+  push:
+    branches: [main]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260
+    secrets: inherit
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
new file mode 100644
index 0000000..9bdf984
--- /dev/null
+++ b/.github/workflows/secret-scanner.yml
@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: MPL-2.0-or-later
+name: Secret Scanner
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260
+    secrets: inherit
diff --git a/.machine_readable/STATE.a2ml b/.machine_readable/STATE.a2ml
deleted file mode 100644
index 9260711..0000000
--- a/.machine_readable/STATE.a2ml
+++ /dev/null
@@ -1,38 +0,0 @@
-; SPDX-License-Identifier: PMPL-1.0-or-later
-; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
-
-(state
-  (metadata
-    (version "1.0")
-    (updated "2026-04-04")
-    (crg-grade "C"))
-
-  (project-context
-    (name "HyperpolymathRegistry")
-    (type "julia-package-registry")
-    (purpose "Custom Julia package registry for all hyperpolymath Julia packages")
-    (status "stable"))
-
-  (current-position
-    (completion-percentage 95)
-    (recent-achievement "Implemented CRG Grade C test suite")
-    (test-status "all-passing")
-    (package-count 50))
-
-  (route-to-mvp
-    (phases
-      (("Phase 1" "Registry infrastructure setup" "COMPLETE"))
-      (("Phase 2" "Package registration (50+ packages)" "COMPLETE"))
-      (("Phase 3" "Test coverage to Grade C" "COMPLETE"))))
-
-  (blockers-and-issues
-    (active-blockers ())
-    (resolved-issues
-      ("Test coverage added" "2026-04-04")))
-
-  (critical-next-actions
-    (next "Monitor package submissions")
-    (next "Maintain registry compatibility with Julia package manager"))
-
-  (session-history
-    (("2026-04-04" "Added CRG C test suite (20 tests, all passing)"))))