chore(close-out): CI hardening + hexad proof + doc accuracy + 6a2 metadata (#122)

Follow-up close-out batch after #121. Four coherent commits:

### `ef1e235` — CI hardening (Hypatia `missing_timeout_minutes`)
Adds `timeout-minutes` to **27 `runs-on` jobs across 12 workflow files**
that lacked one; reusable-workflow-call jobs are correctly exempt
(GitHub rejects job-level `timeout-minutes` there). Purely additive (27
insertions, 0 deletions); all 19 workflow files still parse as YAML.
(The remaining Hypatia "unpinned_action" flags are either false
positives — `dtolnay`/`Swatinem` are already full-SHA-pinned — or the
policy-governed `standards/...@main` reusable workflow.)

### `b4fb18e` — flagged unwrap + a real proof
- `assay::assimilate`: replaced the Hypatia-flagged `source.unwrap()`
(CWE-754, though guarded) with a `let Some(source) = source else { … }`
that folds in the already-handled `None` branch. No behaviour change;
zero unwrap.
- `storage`: new proptest `hexad_json_roundtrip_is_identity`
(PROOF-PROGRAMME §3.1, **faithful form**). The gateway octad projection
is *lossy by design*, so the load-bearing integrity property is the
on-disk serde round-trip used by `write_*_hexad → load_hexad_dir`; this
proves it is the identity on the hexad JSON representation.

### `94aed04` — doc accuracy
`20 → 38` subcommands and `47 → 49` languages across CLAUDE.md /
EXPLAINME / README; `assay`/`assimilate`/`aggregate` added to the module
tree and CLI examples.

### `37e73ea` — 6a2 metadata
Completes `.machine_readable/6a2/` to the echidna/standards shape: new
`AGENTIC` / `NEUROSYM` / `PLAYBOOK` / `ANCHOR` (`clade=diagnostic`),
fleshed-out `META` / `ECOSYSTEM`; `STATE.a2ml` untouched.

## Tests
Full library suite green; the new proptest and the refactored
`assimilate` pass. Zero new warnings.

## Still open (not in this PR)
- Attestation-chain unforgeability proof (Idris2) — the second proof
"easy win".
- Contractile-layout reconciliation (three overlapping representations +
missing `INDEX.a2ml`) — pending location of the `CONTRACTILE-SPEC`.

https://claude.ai/code/session_01K2TJLeQSyz4tpydZ18aRcb

---
_Generated by [Claude
Code](https://claude.ai/code/session_01K2TJLeQSyz4tpydZ18aRcb)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-Static analysis and bug signature detection tool. Scans source code for weak points (unwrap/expect, unsafe blocks, panic sites, error handling gaps, command injection, unsafe deserialization, FFI boundaries, atom exhaustion, and more) across 47 programming languages.
+Static analysis and bug signature detection tool. Scans source code for weak points (unwrap/expect, unsafe blocks, panic sites, error handling gaps, command injection, unsafe deserialization, FFI boundaries, atom exhaustion, and more) across 49 programming languages.
 
 **Position in AmbientOps ecosystem**: Part of the hospital model, loosely affiliated. Sits alongside the Operating Room as a diagnostic tool for software health (while hardware-crash-team handles hardware health). Independent top-level repo, but feeds findings to the hospital's Records system via verisimdb.
 
@@ -19,7 +19,7 @@ Static analysis and bug signature detection tool. Scans source code for weak poi
 
 ```
 src/
-├── main.rs              # CLI entry point (clap) — 20 subcommands
+├── main.rs              # CLI entry point (clap) — 38 subcommands
 ├── lib.rs               # Library API
 ├── types.rs             # Core types (AssailReport, WeakPoint, etc.)
 ├── assail/              # Static analysis engine
@@ -55,6 +55,8 @@ src/
 ├── amuck/               # Mutation combinations
 ├── abduct/              # Isolation + time-skew
 ├── adjudicate/          # Campaign verdict aggregation
+├── aggregate/           # Fold external prover output into reports (BLAKE3-hashed, trust-tagged)
+├── assay/               # Proven-library substitution survey + assimilate swap
 ├── axial/               # Reaction observation
 ├── bridge/              # Patch Bridge — CVE mitigation lifecycle (feature: http)
 │   ├── mod.rs           # Triage orchestrator, core types (BridgeReport, AssessedCve)

.github/workflows/boj-build.yml

@@ -9,6 +9,7 @@ permissions:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

.github/workflows/cargo-audit.yml

@@ -16,6 +16,7 @@ jobs:
   audit:
     name: Cargo Audit
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout code
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

.github/workflows/casket-pages.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
@@ -109,6 +110,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/chapel-ci.yml

@@ -65,6 +65,7 @@ jobs:
   detect-relevant-changes:
     name: detect-relevant-changes
     runs-on: ubuntu-22.04
+    timeout-minutes: 10
     outputs:
       relevant: ${{ steps.f.outputs.relevant }}
     steps:
@@ -99,6 +100,7 @@ jobs:
     needs: detect-relevant-changes
     if: needs.detect-relevant-changes.outputs.relevant == 'true'
     runs-on: ubuntu-22.04
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install Chapel ${{ env.CHAPEL_VERSION }}
@@ -121,6 +123,7 @@ jobs:
     needs: [detect-relevant-changes, chapel-parse-check]
     if: needs.detect-relevant-changes.outputs.relevant == 'true'
     runs-on: ubuntu-22.04
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install Chapel ${{ env.CHAPEL_VERSION }}
@@ -151,6 +154,7 @@ jobs:
     needs: [detect-relevant-changes, chapel-build]
     if: needs.detect-relevant-changes.outputs.relevant == 'true'
     runs-on: ubuntu-22.04
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install Chapel ${{ env.CHAPEL_VERSION }}
@@ -175,6 +179,7 @@ jobs:
     needs: [detect-relevant-changes, chapel-build]
     if: needs.detect-relevant-changes.outputs.relevant == 'true'
     runs-on: ubuntu-22.04
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install Chapel ${{ env.CHAPEL_VERSION }}
@@ -211,6 +216,7 @@ jobs:
     needs: detect-relevant-changes
     if: needs.detect-relevant-changes.outputs.relevant == 'true'
     runs-on: ubuntu-22.04
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
@@ -231,6 +237,7 @@ jobs:
     needs: [detect-relevant-changes, chapel-build]
     if: needs.detect-relevant-changes.outputs.relevant == 'true'
     runs-on: ubuntu-22.04
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
@@ -417,6 +424,7 @@ jobs:
       - chapel-multilocale
     if: always()
     runs-on: ubuntu-22.04
+    timeout-minutes: 45
     steps:
       - name: Aggregate chapel-ci results
         env:

.github/workflows/codeql.yml

@@ -23,6 +23,7 @@ permissions:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
       security-events: write

.github/workflows/coverage.yml

@@ -14,6 +14,7 @@ jobs:
   coverage:
     name: Generate Coverage Report
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout code
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

.github/workflows/dependency-review.yml

@@ -13,6 +13,7 @@ jobs:
   review:
     name: Review Dependencies
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

.github/workflows/dogfood-gate.yml

@@ -22,6 +22,7 @@ jobs:
   a2ml-validate:
     name: Validate A2ML manifests
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -66,6 +67,7 @@ jobs:
   k9-validate:
     name: Validate K9 contracts
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -128,6 +130,7 @@ jobs:
   empty-lint:
     name: Empty-linter (invisible characters)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -192,6 +195,7 @@ jobs:
   groove-check:
     name: Groove manifest check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -250,6 +254,7 @@ jobs:
   dogfood-summary:
     name: Dogfooding compliance summary
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: [a2ml-validate, k9-validate, empty-lint, groove-check]
     if: always()
 

.github/workflows/instant-sync.yml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   dispatch:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Trigger Propagation
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3