fix(ci): resolve the safely-fixable code-scanning alerts (and one live Bun policy contradiction)

.claude/CLAUDE.md

@@ -15,7 +15,7 @@
 | **Bash/POSIX Shell** | Scripts, automation | Keep minimal |
 | **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Bun APIs |
 | **Nickel** | Configuration language | For complex configs |
-| **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm |
+| **Guile Scheme** | State/meta files | .machine_readable/descriptiles/STATE.a2ml, .machine_readable/descriptiles/META.a2ml, .machine_readable/descriptiles/ECOSYSTEM.a2ml |
 | **Julia** | Batch scripts, data processing | Per RSR |
 | **OCaml** | AffineScript compiler | Language-specific |
 | **Ada** | Safety-critical systems | Where required |

.github/workflows/guix-nix-policy.yml

@@ -5,7 +5,6 @@ on:
   push:
     branches: [main]
   pull_request:
-
 # Estate guardrail: scope push to default branches (PR fires once, not
 # push+PR) and cancel superseded runs. Safe — read-only PR check.
 concurrency:
@@ -21,13 +20,13 @@ jobs:
           # Check for package manager files
           HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null | head -1)
           HAS_NIX=$(find . -name "*.nix" 2>/dev/null | head -1)
-          
+
           # Block new package-lock.json, yarn.lock, Gemfile.lock, etc.
           NEW_LOCKS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E 'package-lock\.json|yarn\.lock|Gemfile\.lock|Pipfile\.lock|poetry\.lock|cargo\.lock' || true)
           if [ -n "$NEW_LOCKS" ]; then
             echo "⚠️ Lock files detected. Prefer Guix manifests for reproducibility."
           fi
-          
+
           # Prefer Guix, fallback to Nix
           if [ -n "$HAS_GUIX" ]; then
             echo "✅ Guix package management detected (primary)"
@@ -36,5 +35,8 @@ jobs:
           else
             echo "ℹ️ Consider adding guix.scm or flake.nix for reproducible builds"
           fi
-          
+
           echo "✅ Package policy check passed"
+    timeout-minutes: 15
+permissions:
+  contents: read

.github/workflows/hypatia-scan.yml

@@ -7,7 +7,6 @@
 # workflow is the repo's independent security scan. Same tool, two consumers.
 # See .github/workflows/README.adoc.
 name: Hypatia Security Scan
-
 on:
   push:
     branches: [main, master, develop]
@@ -16,15 +15,13 @@ on:
   schedule:
     - cron: '0 0 * * 0'
   workflow_dispatch:
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
-  actions: read      # required by the reusable workflow (staleness check reads workflow runs)
+  actions: read # required by the reusable workflow (staleness check reads workflow runs)
   contents: read
   security-events: write
-
 jobs:
   scan:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9

.github/workflows/instant-sync.yml

@@ -2,16 +2,13 @@
 # This workflow is managed by gh actions-lock.
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
-
 on:
   push:
     branches: [main, master]
   release:
     types: [published]
-
 permissions:
   contents: read
-
 jobs:
   dispatch:
     runs-on: ubuntu-latest
@@ -29,6 +26,6 @@ jobs:
               "sha": "${{ github.sha }}",
               "forges": ""
             }
-
       - name: Confirm
         run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"
+    timeout-minutes: 15

.github/workflows/jekyll-gh-pages.yml

@@ -2,21 +2,17 @@
 # This workflow is managed by gh actions-lock.
 # Sample workflow for building and deploying a Jekyll site to GitHub Pages
 name: Deploy Jekyll with GitHub Pages dependencies preinstalled
-
 on:
   # Runs on pushes targeting the default branch
   push:
     branches: ["main"]
-
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
-
 # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
 # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
 concurrency:
   group: "pages"
   cancel-in-progress: false
-
 jobs:
   # Build job
   build:
@@ -35,7 +31,7 @@ jobs:
           destination: ./_site
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v5.0.0
-
+    timeout-minutes: 15
   # Deployment job
   deploy:
     permissions:
@@ -50,3 +46,6 @@ jobs:
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@v5.0.1
+    timeout-minutes: 15
+permissions:
+  contents: read

.github/workflows/jekyll.yml

@@ -5,7 +5,6 @@ on:
   push:
     branches: [main]
   pull_request:
-
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -24,3 +23,6 @@ jobs:
           else
             echo "No Gemfile found, skipping Jekyll build"
           fi
+    timeout-minutes: 15
+permissions:
+  contents: read

.github/workflows/npm-bun-blocker.yml

@@ -5,24 +5,28 @@ on:
   push:
     branches: [main]
   pull_request:
-
 # Estate guardrail: scope push to default branches (PR fires once, not
 # push+PR) and cancel superseded runs. Safe — read-only PR check.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 jobs:
   check:
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@v7.0.1
-      - name: Block npm/bun
+      - name: Block npm/pnpm/yarn lockfiles
         run: |
-          if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then
-            echo "❌ npm/bun artifacts detected. Use  instead."
+          # Bun is tier 1 as of the 2026-08-26 owner ruling: package.json plus
+          # bun.lock are EXPECTED, not anti-patterns. Only the npm/pnpm/yarn
+          # lockfiles are rejected.
+          if [ -f "package-lock.json" ] || [ -f "pnpm-lock.yaml" ] || [ -f "yarn.lock" ]; then
+            echo "❌ npm/pnpm/yarn artifacts detected. Use Bun (package.json + bun.lock) instead."
             exit 1
           fi
-          echo "✅ No npm/bun violations"
+          echo "✅ No npm/pnpm/yarn violations"
+    timeout-minutes: 15
+permissions:
+  contents: read

.github/workflows/scorecard-enforcer.yml

@@ -2,38 +2,33 @@
 # This workflow is managed by gh actions-lock.
 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores
 name: OpenSSF Scorecard Enforcer
-
 on:
   push:
     branches: [main]
   schedule:
-    - cron: '0 6 * * 1'  # Weekly on Monday
+    - cron: '0 6 * * 1' # Weekly on Monday
   workflow_dispatch:
-
 jobs:
   scorecard:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       security-events: write
-      id-token: write  # For OIDC
+      id-token: write # For OIDC
     steps:
       - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-
       - name: Run Scorecard
         uses: ossf/scorecard-action@v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-
       - name: Upload SARIF
         uses: github/codeql-action/upload-sarif@main
         with:
           sarif_file: results.sarif
-
       - name: Check minimum score
         run: |
           # Parse score from results
@@ -48,22 +43,20 @@ jobs:
             echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE"
             exit 1
           fi
-
+    timeout-minutes: 15
   # Check specific high-priority items
   check-critical:
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@v7.0.1
-
       - name: Check SECURITY.md exists
         run: |
           if [ ! -f "SECURITY.md" ]; then
             echo "::error::SECURITY.md is required"
             exit 1
           fi
-
       - name: Check for pinned dependencies
         run: |
           # Check workflows for unpinned actions
@@ -72,3 +65,6 @@ jobs:
             echo "::warning::Found unpinned actions:"
             echo "$unpinned"
           fi
+    timeout-minutes: 15
+permissions:
+  contents: read

.github/workflows/scorecard.yml

@@ -1,19 +1,16 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: OSSF Scorecard
-
 on:
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch:
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
-  actions: read      # required by the reusable workflow (staleness check reads workflow runs)
+  actions: read # required by the reusable workflow (staleness check reads workflow runs)
   contents: read
-
 jobs:
   scorecard:
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9

.github/workflows/ts-blocker.yml

@@ -4,13 +4,11 @@ on:
   push:
     branches: [main]
   pull_request:
-
 # Estate guardrail: scope push to default branches (PR fires once, not
 # push+PR) and cancel superseded runs. Safe — read-only PR check.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-
 jobs:
   check:
     runs-on: ubuntu-latest
@@ -24,9 +22,12 @@ jobs:
           NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true)
 
           if [ -n "$NEW_TS" ] || [ -n "$NEW_JS" ]; then
-            echo "❌ New TS/JS files detected. Use  instead."
+            echo "❌ New TS/JS files detected. Use AffineScript instead."
             [ -n "$NEW_TS" ] && echo "$NEW_TS"
             [ -n "$NEW_JS" ] && echo "$NEW_JS"
             exit 1
           fi
           echo "✅  policy enforced"
+    timeout-minutes: 10
+permissions:
+  contents: read

ffi/zig/src/main.zig

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: MPL-2.0
+// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 // _PATHROOT FFI Implementation
 //
 // This module implements the C-compatible FFI declared in src/abi/Foreign.idr

src/abi/Foreign.idr

@@ -1,3 +1,5 @@
+-- SPDX-License-Identifier: MPL-2.0
+-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 ||| Foreign Function Interface Declarations
 |||
 ||| This module declares all C-compatible functions that will be

src/abi/Layout.idr

@@ -1,3 +1,5 @@
+-- SPDX-License-Identifier: MPL-2.0
+-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 ||| Memory Layout Proofs
 |||
 ||| This module provides formal proofs about memory layout, alignment,

src/abi/Types.idr

@@ -1,3 +1,5 @@
+-- SPDX-License-Identifier: MPL-2.0
+-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 ||| ABI Type Definitions Template
 |||
 ||| This module defines the Application Binary Interface (ABI) for this library.