fix(ci): cure startup_failure cluster + true-up README claims

.github/workflows/boj-build.yml

@@ -1,5 +1,5 @@
-# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 name: BoJ Server Build Trigger
 on:
   push:

.github/workflows/casket-pages.yml

@@ -1,5 +1,5 @@
-# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 name: GitHub Pages
 on:
   push:

.github/workflows/codeql.yml

@@ -1,5 +1,5 @@
-# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 name: CodeQL Security Analysis
 
 on:

.github/workflows/echidna-validation.yml

@@ -1,5 +1,5 @@
-# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 name: ECHIDNA Validation
 on:
   push:

.github/workflows/gitbot-fleet.yml

@@ -1,5 +1,5 @@
-# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 name: Gitbot Fleet
 on:
   push:

.github/workflows/governance.yml

@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49

.github/workflows/hypatia-scan.yml

@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49

.github/workflows/instant-sync.yml

@@ -1,5 +1,5 @@
-# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 on:
@@ -11,6 +11,10 @@ permissions:
   contents: read
 jobs:
   dispatch:
+    # Dormant: FARM_DISPATCH_TOKEN was retired in the 2026-06-30 credential
+    # rebuild. Re-arm by setting the repo variable INSTANT_SYNC_ENABLED=true
+    # once the replacement fine-grained dispatch PAT is in place.
+    if: ${{ vars.INSTANT_SYNC_ENABLED == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:

.github/workflows/mirror.yml

@@ -1,5 +1,5 @@
-# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 name: Mirror to Git Forges
 on:
   push:
@@ -9,6 +9,5 @@ permissions:
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
-    timeout-minutes: 10
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49
     secrets: inherit

.github/workflows/nif-build.yml

@@ -1,5 +1,5 @@
-# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # Compile the opsm_pq_nif Rust NIF and run :requires_nif tests.
 # Separate from the main Elixir test job so NIF compilation doesn't
 # block the standard unit test suite.

.github/workflows/scorecard.yml

@@ -8,9 +8,14 @@ on:
     - cron: '0 4 * * *'
   workflow_dispatch:
 
+# The called reusable workflow needs security-events/id-token beyond the
+# default; a reusable job cannot escalate past the caller's grant, so the
+# run dies at startup ("startup_failure", 0 jobs) unless granted here.
 permissions:
   contents: read
+  security-events: write
+  id-token: write
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49

.github/workflows/secret-scanner.yml

@@ -1,5 +1,5 @@
-# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
+# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 name: Secret Scanner
 on:
   pull_request:
@@ -12,8 +12,7 @@ permissions:
   contents: read
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
-    timeout-minutes: 10
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49
     secrets: inherit
   trufflehog:
     runs-on: ubuntu-latest
@@ -22,6 +21,6 @@ jobs:
         with:
           fetch-depth: 0
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@30d5bb91af1a771378349dbbb0c82129392acf70 # v3.95.6
         with:
           extra_args: --only-verified --fail

README.adoc

@@ -7,30 +7,30 @@
 :toclevels: 3
 
 image:https://img.shields.io/badge/Status-v2.0.0-success?style=flat[v2.0.0]
-image:https://img.shields.io/badge/Registries-101-blue?style=flat[101 Registries]
+image:https://img.shields.io/badge/Registries-114-blue?style=flat[114 Registries]
 image:https://img.shields.io/badge/Elixir-Inside-4e2a8e?style=flat&logo=elixir[Elixir Inside]
 image:https://img.shields.io/badge/Rust-NIF-orange?style=flat&logo=rust[Rust NIF]
 image:https://img.shields.io/badge/License-MPL--2.0-blue.svg[License: MPL-2.0,link="https://www.mozilla.org/MPL/2.0/"]
-image:https://img.shields.io/badge/Tests-547%20%2B%2040%20props-success?style=flat[Tests Passing]
+image:https://img.shields.io/badge/Tests-824%20%2B%2068%20props-success?style=flat[Tests Passing]
 
-**A federated, universal package manager with 101 registry adapters, post-quantum cryptography, SLSA Level 3 compliance, PubGrub dependency resolution, sustainability scoring, and formal verification.**
+**A federated, universal package manager with 114 registry adapters, post-quantum cryptography, SLSA Level 3 compliance, PubGrub dependency resolution, sustainability scoring, and a formally modelled core.**
 
-*Latest: March 8, 2026 | Version: 2.0.0 | 547 core tests + 40 property tests + 49 integration tests*
+*Latest: July 1, 2026 | Version: 2.0.0 | 824 tests + 68 property tests (integration + E2E included)*
 
 toc::[]
 
 == What is OPSM?
 
 OPSM is the **first universal package manager** that combines:
 
-1. **101 Registry Adapters** - npm, Hex, Crates, PyPI, RubyGems, Go, Pub, Hackage, NuGet, Maven, and 91 more ecosystems
+1. **114 Registry Adapters** - npm, Hex, Crates, PyPI, RubyGems, Go, Pub, Hackage, NuGet, Maven, and 104 more (roughly ten of these target planned registries for hyperpolymath's own languages and currently resolve via git fallback)
 2. **Post-Quantum Cryptography** - Hybrid Ed25519+Dilithium5 signatures, Kyber-1024 KEM, SPHINCS+ (Rust NIF)
 3. **SLSA Level 3 Compliance** - Provenance generation, signature verification, policy enforcement
 4. **PubGrub Dependency Resolver** - Semver, PEP 440, Go MVS support with ETS caching
 5. **Trust Pipeline** - multi-microservice verification (checky-monkey, palimpsest-license, oikos)
 6. **Container Security** - 3 Rust services (svalinn, selur, vordr)
 7. **Sustainability Scoring** - Oikos-based real package-level analysis integrated into resolver
-8. **Formal Verification** - Proven library (SSRF/DoS prevention via property-based testing)
+8. **Formal Methods** - totality-checked Idris2 ABI model plus the proven library (SSRF/DoS prevention via property-based testing); full correctness proofs are tracked in link:PROOF-NEEDS.md[PROOF-NEEDS.md]
 9. **Federation-First** - Event propagation, distributed architecture, cross-registry search
 10. **Human-Assisted Discovery** - 3 agentic agents for obscure language packages
 
@@ -40,10 +40,11 @@ OPSM is the **first universal package manager** that combines:
 
 == OPSM UI
 
-OPSM has a dedicated UI spec and shell in the `opsm-ui` repo. The UI uses the OPSM
-CLI for dry-runs, backend capability detection, and apply actions.
+OPSM has a dedicated UI spec and shell in the in-repo link:opsm-ui/[`opsm-ui/`] directory
+(a Rust TUI plus web-UI specs). The UI uses the OPSM CLI for dry-runs, backend
+capability detection, and apply actions.
 
-See: link:docs/OPSM-UI.adoc[OPSM UI Integration] | link:docs/OPSM-API.adoc[OPSM Local API] | https://github.com/hyperpolymath/opsm-ui
+See: link:docs/OPSM-UI.adoc[OPSM UI Integration] | link:docs/OPSM-API.adoc[OPSM Local API]
 
 == Gitbot Fleet
 
@@ -84,7 +85,7 @@ OPSM v1.1.0 introduces a comprehensive container security pipeline with 4 dedica
 == Current Status (v2.0.0)
 
 **Core:**
-- ✅ **101 registry adapters** across all major ecosystems (npm, Hex, Crates, PyPI, RubyGems, Go, Pub, Hackage, NuGet, Maven, and 91 more)
+- ✅ **114 registry adapters** across all major ecosystems (npm, Hex, Crates, PyPI, RubyGems, Go, Pub, Hackage, NuGet, Maven, and 104 more; ~10 are planned registries served via git fallback)
 - ✅ **PubGrub dependency resolver** with semver, PEP 440, and Go MVS support
 - ✅ **ETS-based registry cache** with TTL for resolver performance
 - ✅ **Version constraint engine**: caret, tilde, wildcard, comparison, AND/OR combinators
@@ -108,13 +109,13 @@ OPSM v1.1.0 introduces a comprehensive container security pipeline with 4 dedica
 - ✅ **Manifest conversion**: 10 formats (package.json, Cargo.toml, mix.exs, pyproject.toml, pubspec.yaml, go.mod, Gemfile, opsm.toml, .ipkg, .ncl)
 - ✅ **Git clone/build/run pipeline**: 15 build systems, SSRF-safe, ref pinning
 - ✅ **System PM querying**: dpkg, rpm, pacman, brew, nix, flatpak, snap, guix
-- ✅ **547 core tests + 40 properties + 49 integration tests**
+- ✅ **824 tests + 68 properties** (unit, integration, E2E, security and concurrency aspects)
 
 **See:** link:CRYPTO-INTEGRATION-COMPLETE.md[Crypto Integration Report] | link:RELEASE-v1.0.0.md[v1.0.0 Release Notes] | link:docs/v2.0-PLAN.md[Roadmap] | link:docs/CLI-FEATURE-COMPARISON.md[CLI Comparison]
 
 == Supported Ecosystems
 
-OPSM supports **101 registry adapters** across all major ecosystems:
+OPSM supports **114 registry adapters** across all major ecosystems:
 
 [cols="2,3"]
 |===
@@ -268,7 +269,7 @@ opsm audit https://github.com/owner/repo
              │                                 │
     ┌────────▼─────────┐              ┌───────▼──────────┐
     │  Registry Layer  │              │  Trust Pipeline   │
-    │  (8 adapters)    │              │  (5 services)     │
+    │  (114 adapters)  │              │  (3 services)     │
     └────────┬─────────┘              └───────┬──────────┘
              │                                 │
     ┌────────▼─────────────────────────────────▼──────────┐
@@ -279,7 +280,7 @@ opsm audit https://github.com/owner/repo
     └─────────────────────────────────────────────────────┘
 ----
 
-=== Registry Adapters (101 Ecosystems)
+=== Registry Adapters (114 Ecosystems)
 
 Each registry adapter implements a common interface:
 
@@ -443,7 +444,7 @@ odds-and-sods-package-manager/
 │   │       ├── events.ex            # Federation events
 │   │       ├── har_queue.ex         # HAR queue manager
 │   │       ├── errors.ex            # Error classification
-│   │       ├── registries/          # 8 registry adapters
+│   │       ├── registries/          # 114 registry adapters
 │   │       │   ├── npm.ex
 │   │       │   ├── hex.ex
 │   │       │   ├── crates.ex