… GS007, CSA001)

structural_drift, git_state and code_scanning_alerts emit uppercase
mnemonic codes as the finding `type`; the schema's lowercase-only pattern
made every such finding unbaselineable (38 SD022 + 54 CSA on this repo
alone). Pattern widened to exactly the two observed shapes — lowercase
snake_case or 2-3 uppercase letters + 3 digits — verified against all 24
distinct type values in the current Hypatia run plus GS007.

Refs #477

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

#381)

The pre-commit registry guard (#381 option 1) already exists in
hooks/pre-commit and was live-verified both ways on this branch: it
caught a planted canary edit AND this branch's own schema/validator
edits (exit 1 with fix commands), and passes on a clean tree. This
commit resyncs REGISTRY.a2ml for those edits and closes the remaining
gap — option 3, documenting `just hooks-install` + `just registry` in
CONTRIBUTING.md so the workflow is discoverable before the first red PR.

Refs #381

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

governance-reusable.yml carried a comment claiming the validate-baseline
job "schema-checks" .hypatia-baseline.json; no step anywhere did, and
apply-baseline.sh listed ajv as an "optional" dependency it never
invoked. A malformed baseline (typo'd key, wrong severity string) would
silently match nothing — the exact silent-suppression class the gate
exists to prevent.

apply-baseline.sh now structurally validates every baseline in jq,
mirroring hypatia-baseline.schema.json: required keys, file XOR
file_pattern, closed key set, severity enums, rule_module/type/
expires_at/tracking_issue shapes. Malformed baselines exit 2 (invalid
input) with each violation named. Canary-tested both directions: a
valid entry with the new uppercase mnemonic type (SD022) passes; a
six-violation adversarial fixture is rejected naming all six. The
workflow comment now states what actually happens.

Refs #477 #399

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…et-scanner templates (#507)

The canon retired inline TruffleHog as redundant to the pinned gitleaks
gate (secret-scanner-reusable.yml documents the rationale), but six
nested product copies still carried the dead job. They are inert as
workflows today (Actions only reads the root .github/workflows) — but
they are exactly the files that go live the day each product evicts to
its own repo (#490-#496), so the rot ships unless the template is fixed
at source: 0-ai-gatekeeper-protocol, a2ml, consent-aware-http, lol,
meta-a2ml, rhodium-standard-repositories.

Estate scope for #507, measured 2026-07-21 (gh code search, default
branches): only 3 LIVE repos carry the dead job — ideas-to-alphas
(startup_failure), polystack (failure), QuantumCircuit.jl (failure);
17 more matched on the canonical rationale *comment* only (no action);
julia-ecosystem has 10 inert nested per-package copies (+ .gitlab-ci.yml
twins, live if GitLab-mirrored); rsr-template-how-to's copies are
deliberate teaching specimens under specimen/automation-quarantine/.

Refs #507

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

 FIX_NOW class)

- scorecard-enforcer.yml: timeout-minutes on all 3 jobs (15/10/10);
  signed-push-smoke.yml: timeout-minutes 10 — clears 4 of the 5
  workflow_audit missing_timeout_minutes findings from the first
  completed Hypatia run.
- push-email-notify.yml deleted (the 5th): estate directive is to
  remove the broken push-email workflow everywhere except 007,
  robodog-defensive-systems-lab and defensive-multiplicity; standards
  is not an exception. Deletion also clears its missing-timeout finding.

Refs #399

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…195 findings (#399)

Every finding from Hypatia's first completed run on standards main was
triaged and adversarially verified (24-agent workflow, per-finding
read + refute pass). 118 baseline entries:
  - 96 permanent FALSE_POSITIVE: mirror double-reports (#378), guarded
    unwraps, bench expect(), XML-namespace http:// URIs, public
    credential-less CORS manifests, .envrc {{placeholder}} exports,
    idiomatic CString FFI as_ptr, doc-only historical dir references.
  - 22 TRACKED DEBT with expires_at 2026-10-21 + tracking issue: real
    issues owned elsewhere (TS->AffineScript #254, product evictions
    #491/#492/#494/#496, third-party #493, proof debt #124, the
    scorecard.yml naming reconciliation).

Deliberately NOT baselined (the gate stays honest):
  - The 40 secret_detected findings in
    rhodium-standard-repositories/rhodium-pipeline/docs/QUICKSTART.adoc
    are 40 occurrences of ONE live GitLab PAT (see PR body — needs owner
    revocation, NOT suppression). The baseline leaves these blocking on
    purpose; the governance gate is RED until the token is revoked +
    purged. Suppressing a live credential is the one thing a baseline
    must never do.
  - 5 findings this branch already FIXES (job timeouts + push-email
    removal) — they clear on rescan; baselining a fixed finding would
    be dishonest.

Path fidelity: entries mirror Hypatia's own `.file` shape per module
(basenames for workflow_audit, repo-relative elsewhere) — matching the
agent-resolved paths instead silently suppressed nothing. The baseline
now validates against hypatia-baseline.schema.json (enforced by
apply-baseline.sh) and was filter-tested against the real findings:
150 suppressed, 45 kept (40 live-token + 5 fixed).

Adding this file activates the previously-skipped validate-hypatia-
baseline job on standards itself (has_baseline gate).

Refs #399 #178

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>