From 5f6a383d94dc69d4da54c925cc293b6ece221466 Mon Sep 17 00:00:00 2001
From: neuron7xLab <neuron7x@ukr.net>
Date: Thu, 18 Jun 2026 23:30:48 +0300
Subject: [PATCH 1/2] fix(ci): black 26.x reformat physics_score + canonical
 markers (main green)

---
 src/geosync/research/__init__.py             |  2 ++
 src/geosync/research/transformer/__init__.py |  2 ++
 tools/physics_score.py                       | 15 ++++++++++++---
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/geosync/research/__init__.py b/src/geosync/research/__init__.py
index ec5280def..8edf0eaef 100644
--- a/src/geosync/research/__init__.py
+++ b/src/geosync/research/__init__.py
@@ -4,3 +4,5 @@
 
 This namespace is intentionally isolated from execution/runtime surfaces.
 """
+
+__CANONICAL__ = True
diff --git a/src/geosync/research/transformer/__init__.py b/src/geosync/research/transformer/__init__.py
index c16925dd6..f85cd17f2 100644
--- a/src/geosync/research/transformer/__init__.py
+++ b/src/geosync/research/transformer/__init__.py
@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: MIT
 """Research inference transformer contracts."""
 
+__CANONICAL__ = True
+
 from .contracts import ClaimTier, GeometryState, RegimeCertificate, ResearchInferenceArtifact
 
 __all__ = ["ClaimTier", "GeometryState", "RegimeCertificate", "ResearchInferenceArtifact"]
diff --git a/tools/physics_score.py b/tools/physics_score.py
index ccaa8f92b..89c018f37 100644
--- a/tools/physics_score.py
+++ b/tools/physics_score.py
@@ -159,7 +159,10 @@ def build_metrics() -> list[Metric]:
             ">= 90 for final rank",
             "R outside [0,1], invalid Phi/Kc, non-finite theta, silent repair",
             "PARTIAL_PASS_RUNTIME_REQUIRED",
-            ("tests/unit/physics/test_T1_kuramoto_ricci_boundary.py", "tests/physics/test_invariants.py"),
+            (
+                "tests/unit/physics/test_T1_kuramoto_ricci_boundary.py",
+                "tests/physics/test_invariants.py",
+            ),
         ),
         Metric(
             "S_falsifiability",
@@ -181,7 +184,10 @@ def build_metrics() -> list[Metric]:
             ">= 85 for final rank",
             "null model suite does not cover shuffled phases, ER graph, omega randomization",
             "PARTIAL_PASS_RUNTIME_REQUIRED" if null_test else "FAIL",
-            ("tests/physics/test_geosync_nulls.py", "artifacts/physics_validation/ricci_bridge_summary.json"),
+            (
+                "tests/physics/test_geosync_nulls.py",
+                "artifacts/physics_validation/ricci_bridge_summary.json",
+            ),
         ),
         Metric(
             "S_UQ",
@@ -203,7 +209,10 @@ def build_metrics() -> list[Metric]:
             ">= 85 for final rank",
             "artifact cannot be rerun from commit and command",
             "PARTIAL_PASS_CI_LOGS_REQUIRED" if manifest and reference_solver else "FAIL",
-            ("reproducibility/manifest.json", "reproducibility/reference_solvers/geosync_kuramoto_numpy.py"),
+            (
+                "reproducibility/manifest.json",
+                "reproducibility/reference_solvers/geosync_kuramoto_numpy.py",
+            ),
         ),
         Metric(
             "S_interface_contracts",

From bef3ac3aed1e8b7e4619008bfbb4f36f7d981711 Mon Sep 17 00:00:00 2001
From: neuron7xLab <neuron7x@ukr.net>
Date: Thu, 18 Jun 2026 23:35:31 +0300
Subject: [PATCH 2/2] fix(repo-policy): add permissions + SHA-pin actions in
 claim-governance-foundation.yml

#1210 added this workflow without a top-level permissions block (repo-policy
'Validate workflow policy invariants' fails repo-wide) and with unpinned @v6
actions. Add least-privilege 'permissions: contents: read' and pin checkout/
setup-python to repo-canonical SHAs.
---
 .github/workflows/claim-governance-foundation.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/claim-governance-foundation.yml b/.github/workflows/claim-governance-foundation.yml
index 4c829307c..af158860e 100644
--- a/.github/workflows/claim-governance-foundation.yml
+++ b/.github/workflows/claim-governance-foundation.yml
@@ -9,12 +9,15 @@ on:
       - "tests/ci/test_verify_claims.py"
       - ".github/workflows/claim-governance-foundation.yml"
 
+permissions:
+  contents: read
+
 jobs:
   governance-foundation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.0.0
         with:
           python-version: "3.12"
       - name: Install test runner