fix(ci): honest validators + Hypatia baseline from full 195-finding triage (#399 #434 #435 #477 #381 #507) (#521)

Addresses the standards-local backlog **foundationally**: makes the
canon's
own validators/gates honest, then triages Hypatia's first completed run
(all 195 findings) into an honest baseline. Seven commits.

## ⚠️ The governance gate is RED on purpose — do NOT baseline it green

The triage found a **live, write-scoped credential** committed into this
public repo (an accidentally-pasted session transcript, one token, 40
occurrences, in `rhodium-standard-repositories/rhodium-pipeline/docs/
QUICKSTART.adoc`). The token value is **not** reproduced here or in any
commit — only the file is named (it is already in `main`).

These 40 findings are **deliberately left unbaselined**, so the
`validate-hypatia-baseline` gate stays red until the credential is dealt
with. **Prerequisite for a green gate = revoke the token at its
provider,
then purge it from the tree + history.** Suppressing it in the baseline
is
the one thing that must never happen — that would silence a
live-credential
alarm. A future maintainer must not "fix" this red by adding a baseline
entry for it.

## What's in the PR

**Validators stop flagging the canon's own files**
- `validate-k9.sh` (#434): `.k9` vs `.k9.ncl` are now distinct dialects.
  Nickel library/contractile modules (`base_k9.pedigree_schema & {…}`,
  `magic_number = "K9!"`) are first-class, not violations. Removed a
  brace-depth block tracker that skipped its own opening brace and could
not see `let`/`&` factoring. 96 → 45 errors, every survivor verified
real.
- `validate-a2ml.sh` (#435, option a): the file-level identity **error**
was never in the SPEC (identity is per-`@record`, §7); it flagged
465/1550
  canonical files. Now a lint **warning** against the real estate shapes
(`spec_id`, `[metadata]`/`[scorecard]`, `@abstract`), with design-tree /
template / AI-manifest exemptions (`INPUT_DESIGN_TREES`). 465 → 0
errors.
- Both: `GITHUB_OUTPUT` defaults to `/dev/null` (an unset var under `set
-u`
  aborted the script outside Actions).

**Baseline machinery made honest**
- Schema `type` pattern widened for the uppercase mnemonic codes
  `structural_drift`/`git_state`/`code_scanning_alerts` actually emit
  (`SD022`, `GS007`, `CSA001`) (#477).
- `apply-baseline.sh` now **enforces** that schema in jq. A workflow
comment
  claimed a job schema-checked the baseline; none did, and a malformed
  baseline would silently match nothing. Now it exits 2, naming each
  violation. Canary-tested both directions.

**Registry drift (#381)** — the pre-commit guard already exists;
verified it
catches drift (it caught this branch's own edits). Documented
`just hooks-install` + `just registry` in CONTRIBUTING.md.

**Dead `trufflehog:` job removed** from 6 nested product secret-scanner
templates (#507). Estate scope measured: only 3 *live* repos still carry
it
(ideas-to-alphas, polystack, QuantumCircuit.jl); 17 matched the
rationale
comment only.

**Workflow hygiene** — job timeouts on scorecard-enforcer +
signed-push-smoke;
removed `push-email-notify.yml` per the estate dual-use directive.

**`.hypatia-baseline.json`** — 118 entries from the full triage
(24-agent
triage → adversarial verify): 96 permanent false-positives (mirror
double-reports #378, guarded unwraps, bench `expect()`, XML-namespace
http
URIs, public credential-less CORS manifests, `.envrc` `{{placeholder}}`
exports, idiomatic CString FFI) + 22 tracked debt (expiry 2026-10-21 +
tracking issue: #254, #491–#496, #124, scorecard.yml reconciliation).
Adding the file activates the previously-skipped baseline job.

## Verification caveat

The baseline was filter-tested against the **last completed Hypatia
scan**
(195 findings), not re-run against this branch's HEAD — the Elixir
scanner
isn't buildable in this environment. The path-fidelity work (entries
mirror
Hypatia's own per-module `.file` shape) makes drift low-risk, but CI's
fresh
scan is the real check. Result of the local filter: **150 suppressed /
45
kept** (40 live-token + 5 findings this branch already fixes).

## Not fixed here (baselined + flagged, by design)
- A latent one-char Zig off-by-one in the ~230×-copied FFI shim — fix at
the
**source** template (boj-server `ffi/zig/src`) and re-propagate, not in
  this lone copy.
- A DOM-XSS in the avow demo — belongs with product eviction #492.

Refs #399 #178 #434 #435 #477 #381 #507

---------

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance-reusable.yml

@@ -273,9 +273,10 @@ jobs:
       #   1. `.hypatia-baseline.json` — array of acknowledged findings,
       #      shape mirrors the Hypatia findings themselves. Schema is
       #      `.machine_readable/hypatia-baseline.schema.json` in this
-      #      repo. The validate-baseline job above schema-checks this.
-      #      Added 2026-05-25 as part of the convergence on a single
-      #      exemption mechanism.
+      #      repo, enforced structurally by apply-baseline.sh itself
+      #      (jq mirror; a malformed baseline exits 2 instead of
+      #      silently matching nothing). Added 2026-05-25 as part of
+      #      the convergence on a single exemption mechanism.
       #   2. `.hypatia-ignore` flat-file — legacy single-rule-per-line
       #      format (`cicd_rules/banned_language_file:<relpath>`).
       #      Will be retired in a follow-up PR once .hypatia-baseline.json

.github/workflows/push-email-notify.yml

@@ -15,6 +15,7 @@ permissions:
 jobs:
   scorecard:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       security-events: write
       id-token: write  # For OIDC
@@ -39,6 +40,7 @@ jobs:
   check-score:
     needs: scorecard
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -61,6 +63,7 @@ jobs:
 
   check-critical:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 

.github/workflows/scorecard-enforcer.yml

@@ -13,6 +13,7 @@ permissions:
 jobs:
   smoke:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

.github/workflows/signed-push-smoke.yml

@@ -45,7 +45,7 @@ name = "A2ML — Attested Markup Language"
 stream = "foundation"
 home = "a2ml/"
 canonical_doc = "a2ml/README.adoc"
-source_hash = "sha256:7c51aab6fe43b04bc795647ae9b3d4813ca82f6182399c2987e17edfd50b36f5"
+source_hash = "sha256:11ffe50a8a15e22d800383589a947ca76a56d96d4f43f673b2d820ef64000436"
 route = "the typed/verified machine-readable document format"
 
 [[spec]]
@@ -54,7 +54,7 @@ name = "K9 Self-Validating Components"
 stream = "foundation"
 home = "k9-svc/"
 canonical_doc = "k9-svc/README.adoc"
-source_hash = "sha256:ddef46e42399af08488cea00f95515614f54cb1aea8b8990d4ef049e9f57f073"
+source_hash = "sha256:7b851b1bd94b5561059bff1a21ebff2618d2bb12aa811f1c3329a199cd1fa79b"
 route = "self-validating components with embedded contracts + deploy logic"
 
 [[spec]]
@@ -72,7 +72,7 @@ name = "META.a2ml spec"
 stream = "foundation"
 home = "meta-a2ml/"
 canonical_doc = "meta-a2ml/README.adoc"
-source_hash = "sha256:bd0f10114fb753377708b2fa07c5995a000060aa50472d02e067f890f005ab53"
+source_hash = "sha256:4b00ebf2fa1ab6aee46b67be34715b4198d4643ce2025c82882afda502d9c038"
 route = "architecture decisions / governance metadata format"
 
 [[spec]]
@@ -135,7 +135,7 @@ name = "0-AI Gatekeeper Protocol"
 stream = "protocol"
 home = "0-ai-gatekeeper-protocol/"
 canonical_doc = "0-ai-gatekeeper-protocol/README.adoc"
-source_hash = "sha256:264806b26e710c04adbe7db357f638fdef1bd24a1bae7be9d9d50742a1e535ea"
+source_hash = "sha256:00d9193c6bd4409e9c9928133d57a8b5afd93a26797e957fbb6d189707c241f6"
 route = "the AI-agent entry/gating protocol behind 0-AI-MANIFEST"
 
 [[spec]]
@@ -180,7 +180,7 @@ name = "Consent-Aware HTTP"
 stream = "protocol"
 home = "consent-aware-http/"
 canonical_doc = "consent-aware-http/README.adoc"
-source_hash = "sha256:92e1d1c0252a69b8812cf0fa48bf2178f7f246314b1238a6d98eea9ed99fdb40"
+source_hash = "sha256:7cb83ee0414539d8594b93a83ecf67fe5744b9f3d40b1f209946370dab423652"
 route = "consent headers / AI-usage boundaries for HTTP"
 
 [[spec]]
@@ -225,7 +225,7 @@ name = "RSR — Rhodium Standard Repositories"
 stream = "governance"
 home = "rhodium-standard-repositories/"
 canonical_doc = "rhodium-standard-repositories/README.adoc"
-source_hash = "sha256:02b75b57a41d213e4d3e7687e22252ba60bbef0923f75ebe18ef1a962c382f1e"
+source_hash = "sha256:fa0fcde2d5be8ed8e4c7067f2a309a3ce424f6fafc942b7a10981546844a971d"
 route = "the repository-compliance standard every repo is graded against"
 
 [[spec]]

.hypatia-baseline.json

@@ -28,9 +28,9 @@
           "pattern": "^[a-z][a-z0-9_]*$"
         },
         "type": {
-          "description": "Hypatia finding type within the rule module (e.g. `banned_language_file`, `obj_magic`, `deprecated_api`).",
+          "description": "Hypatia finding type within the rule module. Two shapes exist: lowercase snake_case (`banned_language_file`, `secret_detected`) and uppercase mnemonic codes emitted by structural_drift/git_state/code_scanning_alerts (`SD022`, `GS007`, `CSA001`). Entries must use the literal value the finding carries (standards#477).",
           "type": "string",
-          "pattern": "^[a-z][a-z0-9_]*$"
+          "pattern": "^([a-z][a-z0-9_]*|[A-Z]{2,3}[0-9]{3})$"
         },
         "file": {
           "description": "Repo-relative path to a single file the entry exempts. Mutually exclusive with `file_pattern`.",

.machine_readable/REGISTRY.a2ml

@@ -10,19 +10,6 @@ on:
 permissions: read-all
 
 jobs:
-  trufflehog:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
-        with:
-          fetch-depth: 0  # Full history for scanning
-
-      - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@116e7171542d2f1dad8810f00dcfacbe0b809183 # v3
-        with:
-          extra_args: --only-verified --fail
-
   gitleaks:
     runs-on: ubuntu-latest
     timeout-minutes: 20

.machine_readable/hypatia-baseline.schema.json

@@ -95,6 +95,28 @@ Look for issues labelled:
 
 ## Development Workflow
 
+### First: install the pre-commit guard
+
+```sh
+just hooks-install
+```
+
+This installs `hooks/pre-commit`, which catches the most common CI failure
+before it leaves your machine: **registry drift**. The spec registry
+(`.machine_readable/REGISTRY.a2ml`) records a content hash of every tracked
+file under a spec home, so *any* edit under one (including
+`.machine_readable/` itself) must be followed by:
+
+```sh
+just registry     # regenerates REGISTRY.a2ml + TOPOLOGY.md
+git add .machine_readable/REGISTRY.a2ml TOPOLOGY.md
+```
+
+If you skip this, the required "Registry + topology in sync" check fails —
+and because it is a required check, stale registry hashes on `main` block
+*every* open PR, not just yours (see #381). The hook fails the commit with
+the exact fix commands whenever the registry is stale.
+
 ### Branch Naming
 ```
 docs/short-description       # Documentation (P3)

0-ai-gatekeeper-protocol/.github/workflows/secret-scanner.yml

@@ -10,19 +10,6 @@ on:
 permissions: read-all
 
 jobs:
-  trufflehog:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
-        with:
-          fetch-depth: 0  # Full history for scanning
-
-      - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@116e7171542d2f1dad8810f00dcfacbe0b809183 # v3
-        with:
-          extra_args: --only-verified --fail
-
   gitleaks:
     runs-on: ubuntu-latest
     timeout-minutes: 20