diff --git a/.github/workflows/claim-governance-foundation.yml b/.github/workflows/claim-governance-foundation.yml
index 4c829307c..af158860e 100644
--- a/.github/workflows/claim-governance-foundation.yml
+++ b/.github/workflows/claim-governance-foundation.yml
@@ -9,12 +9,15 @@ on:
       - "tests/ci/test_verify_claims.py"
       - ".github/workflows/claim-governance-foundation.yml"
 
+permissions:
+  contents: read
+
 jobs:
   governance-foundation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.0.0
         with:
           python-version: "3.12"
       - name: Install test runner
diff --git a/src/geosync/research/__init__.py b/src/geosync/research/__init__.py
index ec5280def..8edf0eaef 100644
--- a/src/geosync/research/__init__.py
+++ b/src/geosync/research/__init__.py
@@ -4,3 +4,5 @@
 
 This namespace is intentionally isolated from execution/runtime surfaces.
 """
+
+__CANONICAL__ = True
diff --git a/src/geosync/research/transformer/__init__.py b/src/geosync/research/transformer/__init__.py
index c16925dd6..f85cd17f2 100644
--- a/src/geosync/research/transformer/__init__.py
+++ b/src/geosync/research/transformer/__init__.py
@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: MIT
 """Research inference transformer contracts."""
 
+__CANONICAL__ = True
+
 from .contracts import ClaimTier, GeometryState, RegimeCertificate, ResearchInferenceArtifact
 
 __all__ = ["ClaimTier", "GeometryState", "RegimeCertificate", "ResearchInferenceArtifact"]
diff --git a/tools/physics_score.py b/tools/physics_score.py
index ccaa8f92b..89c018f37 100644
--- a/tools/physics_score.py
+++ b/tools/physics_score.py
@@ -159,7 +159,10 @@ def build_metrics() -> list[Metric]:
             ">= 90 for final rank",
             "R outside [0,1], invalid Phi/Kc, non-finite theta, silent repair",
             "PARTIAL_PASS_RUNTIME_REQUIRED",
-            ("tests/unit/physics/test_T1_kuramoto_ricci_boundary.py", "tests/physics/test_invariants.py"),
+            (
+                "tests/unit/physics/test_T1_kuramoto_ricci_boundary.py",
+                "tests/physics/test_invariants.py",
+            ),
         ),
         Metric(
             "S_falsifiability",
@@ -181,7 +184,10 @@ def build_metrics() -> list[Metric]:
             ">= 85 for final rank",
             "null model suite does not cover shuffled phases, ER graph, omega randomization",
             "PARTIAL_PASS_RUNTIME_REQUIRED" if null_test else "FAIL",
-            ("tests/physics/test_geosync_nulls.py", "artifacts/physics_validation/ricci_bridge_summary.json"),
+            (
+                "tests/physics/test_geosync_nulls.py",
+                "artifacts/physics_validation/ricci_bridge_summary.json",
+            ),
         ),
         Metric(
             "S_UQ",
@@ -203,7 +209,10 @@ def build_metrics() -> list[Metric]:
             ">= 85 for final rank",
             "artifact cannot be rerun from commit and command",
             "PARTIAL_PASS_CI_LOGS_REQUIRED" if manifest and reference_solver else "FAIL",
-            ("reproducibility/manifest.json", "reproducibility/reference_solvers/geosync_kuramoto_numpy.py"),
+            (
+                "reproducibility/manifest.json",
+                "reproducibility/reference_solvers/geosync_kuramoto_numpy.py",
+            ),
         ),
         Metric(
             "S_interface_contracts",