diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index e26d67bf..c4df9bd4 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -11,7 +11,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index a7d337f5..6b01a934 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -23,22 +23,22 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout casket-ssg
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
 
       - name: Setup GHCup
-        uses: haskell-actions/setup@v2.11.0
+        uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2.11.0
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
 
       - name: Cache Cabal
-        uses: actions/cache@v6.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cabal/packages
@@ -100,10 +100,10 @@ jobs:
           touch ../_site/.nojekyll
 
       - name: Setup Pages
-        uses: actions/configure-pages@v6.0.0
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5.0.0
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: '_site'
 
@@ -117,4 +117,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5.0.0
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 56487848..ed5ee72a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4.37.3
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 4f69d714..ec35cb82 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check for A2ML files
         id: detect
@@ -90,7 +90,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check for K9 files
         id: detect
@@ -140,7 +140,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Scan for invisible characters
         id: lint
@@ -205,7 +205,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check for Groove manifest
         id: groove
@@ -266,7 +266,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Generate dogfooding scorecard
         run: |
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 61508936..e13b361e 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7.0.1
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install PyYAML (for workflow YAML validation)
         run: pip install pyyaml --quiet
       - name: Run E2E tests
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index f786b538..d08939ee 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -33,4 +33,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 # main 2026-06-27
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 # main 2026-06-27
diff --git a/.github/workflows/hypatia-dispatch-intake.yml b/.github/workflows/hypatia-dispatch-intake.yml
index 5d815ee4..c4b6d769 100644
--- a/.github/workflows/hypatia-dispatch-intake.yml
+++ b/.github/workflows/hypatia-dispatch-intake.yml
@@ -23,7 +23,7 @@ jobs:
       contents: write  # push received events to the findings-submissions inbox branch
     steps:
       - name: Checkout gitbot-fleet
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 9f6c10c2..d461dc25 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -29,7 +29,7 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
     # Total caller-side wall-clock cap for the reusable. Matches
     # Hypatia's `missing_timeout_minutes` rule expectation. The scan is
diff --git a/.github/workflows/inbox-steward.yml b/.github/workflows/inbox-steward.yml
index 8a50aae2..a6d05831 100644
--- a/.github/workflows/inbox-steward.yml
+++ b/.github/workflows/inbox-steward.yml
@@ -289,7 +289,7 @@ jobs:
     
     steps:
       - name: Checkout gitbot-fleet
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -378,7 +378,7 @@ jobs:
     
     steps:
       - name: Checkout gitbot-fleet
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Send dispatch to Hypatia
         env:
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index bb1370c6..5e668843 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       - name: Trigger Propagation
         if: env.HAS_TOKEN == 'true'
-        uses: peter-evans/repository-dispatch@v4.0.1
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
           repository: hyperpolymath/.git-private-farm
diff --git a/.github/workflows/learning-loop.yml b/.github/workflows/learning-loop.yml
index ed5d7db2..c9d44f4c 100644
--- a/.github/workflows/learning-loop.yml
+++ b/.github/workflows/learning-loop.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout gitbot-fleet
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true  # shared-context/learning/*.jsonl is LFS-tracked (Item 60)
 
@@ -40,7 +40,7 @@ jobs:
 
       - name: Upload rule proposals
         if: always()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: rule-proposals
           path: shared-context/learning/rule-proposals/*.lgt
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 5a1be217..cba2656e 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -13,5 +13,5 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index c458477a..a1f8b2e5 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -21,9 +21,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
@@ -40,7 +40,7 @@ jobs:
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5.0.0
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: '_site'
   deploy:
@@ -53,4 +53,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5.0.0
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
diff --git a/.github/workflows/panicbot-sweep.yml b/.github/workflows/panicbot-sweep.yml
index 427fd189..a03250c2 100644
--- a/.github/workflows/panicbot-sweep.yml
+++ b/.github/workflows/panicbot-sweep.yml
@@ -40,15 +40,15 @@ jobs:
 
     steps:
       - name: Checkout gitbot-fleet
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
         with:
           toolchain: stable
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           workspaces: |
             bots/panicbot -> target
@@ -126,7 +126,7 @@ jobs:
 
       - name: Upload findings artifact
         if: always()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: panicbot-sweep-findings
           path: shared-context/findings/
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 20caab16..a0f90860 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}
diff --git a/.github/workflows/repo-integrity-guard.yml b/.github/workflows/repo-integrity-guard.yml
index a3ef87b6..dbd57e4b 100644
--- a/.github/workflows/repo-integrity-guard.yml
+++ b/.github/workflows/repo-integrity-guard.yml
@@ -36,7 +36,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout (full history)
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           lfs: true  # shared-context/learning/*.jsonl is LFS-tracked (Item 60)
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index b396c45c..5abe40fb 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -32,7 +32,7 @@ jobs:
       run:
         working-directory: ${{ matrix.crate }}
     steps:
-      - uses: actions/checkout@v7.0.1
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Ensure clippy + rustfmt components
         run: rustup component add clippy rustfmt
       - name: Build (all targets)
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index aa03a606..60eb7c75 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -14,5 +14,5 @@ jobs:
     permissions:
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 43c86b36..9c89649d 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -21,5 +21,5 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
diff --git a/.github/workflows/supervised-fleet-scan.yml b/.github/workflows/supervised-fleet-scan.yml
index 2f539938..e4531e52 100644
--- a/.github/workflows/supervised-fleet-scan.yml
+++ b/.github/workflows/supervised-fleet-scan.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout gitbot-fleet
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true  # shared-context/learning/*.jsonl is LFS-tracked (Item 60)
 
diff --git a/deploy-bot-fleet.k9.ncl b/deploy-bot-fleet.k9.ncl
index 6a87bbf0..e6c498e9 100644
--- a/deploy-bot-fleet.k9.ncl
+++ b/deploy-bot-fleet.k9.ncl
@@ -9,7 +9,9 @@ K9!
 leash = 'Hunt
 
 pedigree = {
-  name = "deploy-bot-fleet",
+    name = "deploy-bot-fleet.k9.ncl",
+    security = { leash = 'Yard },
+  
   schema_version = "1.0.0",
   component_type = "bot-fleet-deployment",
   author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
diff --git a/robot-repo-automaton/contractiles/self-validating/examples/ci-config.k9.ncl b/robot-repo-automaton/contractiles/self-validating/examples/ci-config.k9.ncl
index 528a102a..48343b53 100644
--- a/robot-repo-automaton/contractiles/self-validating/examples/ci-config.k9.ncl
+++ b/robot-repo-automaton/contractiles/self-validating/examples/ci-config.k9.ncl
@@ -6,7 +6,9 @@ K9!
 
 {
   pedigree = {
-    name = "ci-config",  # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
+    name = "ci-config.k9.ncl",
+    security = { leash = 'Yard },
+      # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
     schema_version = "1.0.0",
     component_type = "ci-configuration",
     security = {
@@ -17,7 +19,7 @@ K9!
       allow_subprocess = false,
     },
     metadata = {
-      name = "ci-config",
+      
       version = "1.0.0",
       description = "CI/CD configuration with runtime validation",
       author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
@@ -49,21 +51,21 @@ K9!
     # Workflow steps with validation
     steps = [
       {
-        name = "Checkout",
+        
         action = "actions/checkout@v4",
         # Version must be SHA-pinned for security
         sha | String | std.string.NonEmpty = "b4ffde65f46336ab88eb53be808477a3936bae11",
       },
       {
-        name = "Build",
+        
         run = "just build",
       },
       {
-        name = "Test",
+        
         run = "just test",
       },
       {
-        name = "Lint",
+        
         run = "just lint",
       },
     ],
@@ -88,15 +90,15 @@ K9!
 
       scanners = [
         {
-          name = "CodeQL",
+          
           languages = ["rust", "javascript"],
         },
         {
-          name = "OSSF Scorecard",
+          
           enabled = true,
         },
         {
-          name = "TruffleHog",
+          
           scan_for = "secrets",
         },
       ],
diff --git a/robot-repo-automaton/contractiles/self-validating/examples/project-metadata.k9.ncl b/robot-repo-automaton/contractiles/self-validating/examples/project-metadata.k9.ncl
index 110a195e..22505615 100644
--- a/robot-repo-automaton/contractiles/self-validating/examples/project-metadata.k9.ncl
+++ b/robot-repo-automaton/contractiles/self-validating/examples/project-metadata.k9.ncl
@@ -6,7 +6,9 @@ K9!
 
 {
   pedigree = {
-    name = "project-metadata",  # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
+    name = "project-metadata.k9.ncl",
+    security = { leash = 'Yard },
+      # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
     schema_version = "1.0.0",
     component_type = "project-metadata",
     security = {
@@ -17,7 +19,7 @@ K9!
       allow_subprocess = false,
     },
     metadata = {
-      name = "project-metadata",
+      
       version = "1.0.0",
       description = "Pure data configuration for project metadata",
       author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
@@ -26,7 +28,7 @@ K9!
 
   # Project configuration
   project = {
-    name = "my-project",
+    
     version = "0.1.0",
     description = "A project following Rhodium Standard Repositories",
 
@@ -36,7 +38,7 @@ K9!
     },
 
     author = {
-      name = "Jonathan D.A. Jewell",
+      
       email = "j.d.a.jewell@open.ac.uk",
       organization = "The Open University",
     },
diff --git a/robot-repo-automaton/contractiles/self-validating/examples/setup-repo.k9.ncl b/robot-repo-automaton/contractiles/self-validating/examples/setup-repo.k9.ncl
index 1acb2184..00cd1147 100644
--- a/robot-repo-automaton/contractiles/self-validating/examples/setup-repo.k9.ncl
+++ b/robot-repo-automaton/contractiles/self-validating/examples/setup-repo.k9.ncl
@@ -6,7 +6,9 @@ K9!
 
 {
   pedigree = {
-    name = "setup-repo",  # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
+    name = "setup-repo.k9.ncl",
+    security = { leash = 'Yard },
+      # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
     schema_version = "1.0.0",
     component_type = "repository-setup",
     security = {
@@ -18,7 +20,7 @@ K9!
       signature_required = true,
     },
     metadata = {
-      name = "setup-repo",
+      
       version = "1.0.0",
       description = "Automated repository setup with RSR standards",
       author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
diff --git a/robot-repo-automaton/contractiles/self-validating/template-hunt.k9.ncl b/robot-repo-automaton/contractiles/self-validating/template-hunt.k9.ncl
index 4b5801e0..cc953253 100644
--- a/robot-repo-automaton/contractiles/self-validating/template-hunt.k9.ncl
+++ b/robot-repo-automaton/contractiles/self-validating/template-hunt.k9.ncl
@@ -6,7 +6,9 @@ K9!
 
 {
   pedigree = {
-    name = "template-hunt",  # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
+    name = "template-hunt.k9.ncl",
+    security = { leash = 'Yard },
+      # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
     schema_version = "1.0.0",
     component_type = "TODO: describe component type (e.g., 'deployment', 'setup-script')",
     security = {
@@ -18,7 +20,7 @@ K9!
       signature_required = true,
     },
     metadata = {
-      name = "TODO: component-name",
+      
       version = "1.0.0",
       description = "TODO: Detailed description of what this component does",
       author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
diff --git a/robot-repo-automaton/contractiles/self-validating/template-kennel.k9.ncl b/robot-repo-automaton/contractiles/self-validating/template-kennel.k9.ncl
index 46c76c9d..e3b9da72 100644
--- a/robot-repo-automaton/contractiles/self-validating/template-kennel.k9.ncl
+++ b/robot-repo-automaton/contractiles/self-validating/template-kennel.k9.ncl
@@ -6,7 +6,9 @@ K9!
 
 {
   pedigree = {
-    name = "template-kennel",  # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
+    name = "template-kennel.k9.ncl",
+    security = { leash = 'Yard },
+      # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
     schema_version = "1.0.0",
     component_type = "TODO: describe component type (e.g., 'build-config', 'metadata')",
     security = {
@@ -17,7 +19,7 @@ K9!
       allow_subprocess = false,
     },
     metadata = {
-      name = "TODO: component-name",
+      
       version = "1.0.0",
       description = "TODO: Brief description of what this component contains",
       author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
diff --git a/robot-repo-automaton/contractiles/self-validating/template-yard.k9.ncl b/robot-repo-automaton/contractiles/self-validating/template-yard.k9.ncl
index af95484b..60a3374d 100644
--- a/robot-repo-automaton/contractiles/self-validating/template-yard.k9.ncl
+++ b/robot-repo-automaton/contractiles/self-validating/template-yard.k9.ncl
@@ -6,7 +6,9 @@ K9!
 
 {
   pedigree = {
-    name = "template-yard",  # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
+    name = "template-yard.k9.ncl",
+    security = { leash = 'Yard },
+      # K9 pedigree identity (first field: validator brace-tracking needs it before nested blocks)
     schema_version = "1.0.0",
     component_type = "TODO: describe component type (e.g., 'validated-config', 'schema')",
     security = {
@@ -17,7 +19,7 @@ K9!
       allow_subprocess = false,
     },
     metadata = {
-      name = "TODO: component-name",
+      
       version = "1.0.0",
       description = "TODO: Brief description with validation details",
       author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",