fix(ci): cure 18 of the 19 pre-existing check failures that kept every hypatia PR red

.github/workflows/actions.lock

@@ -67,7 +67,7 @@ workflows:
         - 'actions/upload-artifact@v7.0.1'
         - 'actions/upload-pages-artifact@v5.0.0'
         - 'dtolnay/rust-toolchain@master'
-        - 'editorconfig-checker/action-editorconfig-checker@v2.2.0'
+        - 'editorconfig-checker/action-editorconfig-checker@v3.0.0'
         - 'ruby/setup-ruby@v1.321.0'
     '.github/workflows/release.yml':
         - 'actions/attest-build-provenance@v4.2.2'
@@ -254,9 +254,9 @@ dependencies:
         commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
         owner_id: 1940490
         repo_id: 260749683
-    'editorconfig-checker/action-editorconfig-checker@v2.2.0':
-        ref: 'v2.2.0'
-        commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c'
+    'editorconfig-checker/action-editorconfig-checker@v3.0.0':
+        ref: 'v3.0.0'
+        commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
         owner_id: 26415196
         repo_id: 297874902
     'erlef/setup-beam@v1.24.1':
@@ -301,9 +301,14 @@ dependencies:
         repo_id: 1275649586
     'hyperpolymath/k9-ecosystem@main':
         ref: 'main'
-        commit: 'sha1-3f250fba42e432c7ff47b48f59525bec3357136b'
+        commit: 'sha1-c74f04c77a36247a813493945e803178b93d170f'
         owner_id: 6759885
         repo_id: 1275650185
+    'hyperpolymath/smtp-notify-action@v0.2.0':
+        ref: 'v0.2.0'
+        commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
+        owner_id: 6759885
+        repo_id: 1352485172
     'ruby/setup-ruby@v1.321.0':
         ref: 'v1.321.0'
         commit: 'sha1-95ef2b042f9d7a56d8268cba8559e2842e2ad01b'

.github/workflows/dogfood-gate.yml

@@ -106,6 +106,23 @@ jobs:
             echo "::warning::Found $CONFIG_COUNT config files but no K9 contracts. Run k9iser to generate contracts."
           fi
 
+      # QUARANTINE PIN -- see .github/workflows/actions.lock.
+      # This action is referenced at the MOVING `@main` ref, so the lockfile is
+      # what actually selects the commit. k9-ecosystem main (3f250fba,
+      # 2026-08-28) carries a dangling symlink:
+      #   editors/vscode/container/.gatekeeper.yaml
+      #     -> ../../../../_shared/container/.gatekeeper.yaml
+      # which is one `..` too many and escapes the repository; no `_shared/`
+      # directory exists. GitHub extracts the WHOLE action repo during
+      # "Prepare all required actions", BEFORE any step `if:` is evaluated, so
+      # the unresolvable link killed this job at setup regardless of how many
+      # K9 files the caller had, and the `k9_count > 0` guard below could not
+      # protect it:
+      #   ##[error]Could not find file '.../editors/vscode/container/.gatekeeper.yaml'
+      # The lockfile therefore pins @main back to c74f04c7 (2026-08-24), the
+      # last commit whose tree contains no symlinks at all. Restore the pin to
+      # main HEAD once k9-ecosystem carries _shared/container/.gatekeeper.yaml
+      # across, or replaces its two symlinks with real files.
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
         uses: hyperpolymath/k9-ecosystem/validate-action@main

.github/workflows/quality.yml

@@ -336,7 +336,7 @@ jobs:
           find . -type f -size +1M -not -path "./.git/*" | head -10
 
       - name: EditorConfig check
-        uses: editorconfig-checker/action-editorconfig-checker@v2.2.0
+        uses: editorconfig-checker/action-editorconfig-checker@v3.0.0
 
   docs:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -5,7 +5,16 @@
 name: Release & Container
 
 on:
-  push: null
+  # Was `push: null`, which fires on EVERY branch push. The release
+  # pipeline then ran on feature branches, where `${GITHUB_REF#refs/tags/v}`
+  # cannot strip its prefix and returns the ref VERBATIM -- so the archive
+  # name became `hypatia-refs/heads/<branch>-<target>.tar.gz`, whose
+  # embedded slashes are directories that do not exist, and tar died with
+  # `Cannot write: Broken pipe` on all five targets. Releases are cut from
+  # tags, so the trigger now says so.
+  push:
+    tags:
+      - 'v*'
   workflow_dispatch:
     inputs:
       version:
@@ -48,8 +57,14 @@ jobs:
         run: |
           if [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${{ inputs.version }}" ]]; then
             VERSION="${{ inputs.version }}"
-          else
+          elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then
             VERSION="${GITHUB_REF#refs/tags/v}"
+          else
+            # `${VAR#prefix}` returns VAR UNCHANGED when the prefix is absent.
+            # Relying on it to parse a tag meant a non-tag ref silently became
+            # the version string. Fail loudly instead of building a nonsense name.
+            echo "::error::Release requires a refs/tags/v* ref or an explicit version input; got '$GITHUB_REF'"
+            exit 1
           fi
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 

.github/workflows/security-policy.yml

@@ -98,6 +98,36 @@ jobs:
           head: HEAD
           extra_args: --only-verified
 
+      # `.gitleaks.toml` carries `[extend] path = ".gitleaks-estate.toml"`, and
+      # gitleaks resolves that against the PROCESS CWD. Only standards'
+      # secret-scanner-reusable.yml staged that file, so these two hand-rolled
+      # jobs died before scanning a single byte:
+      #   FTL failed to load extended config ... no such file or directory
+      # the action then crashed on the results.sarif it never wrote, and the
+      # audit summary reported a CRASHED SCANNER as "possible secrets in
+      # repository" -- a fake red in the worst possible direction for a
+      # security gate. Pinned to the same standards sha that
+      # .github/workflows/secret-scanner.yml already consumes.
+      - name: Fetch estate gitleaks baseline
+        uses: actions/checkout@v7.0.1
+        with:
+          repository: hyperpolymath/standards
+          ref: 571cc734cd69fb846032ec77a662aa8ee4fc32cd
+          path: .standards-gitleaks
+          sparse-checkout: |
+            config/gitleaks/estate-baseline.toml
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+
+      - name: Stage estate gitleaks baseline
+        run: |
+          set -euo pipefail
+          cp .standards-gitleaks/config/gitleaks/estate-baseline.toml .gitleaks-estate.toml
+          # Delete the tooling checkout BEFORE scanning, or the scan walks
+          # standards' own tree and reports ITS files as hypatia's.
+          rm -rf .standards-gitleaks
+          test -s .gitleaks-estate.toml
+
       - name: Gitleaks Secret Scan
         uses: gitleaks/gitleaks-action@v3.0.0
         env:
@@ -147,20 +177,20 @@ jobs:
           toolchain: stable
 
       - name: Install cargo-cyclonedx
-        run: cargo install cargo-cyclonedx --locked
+        run: cargo install cargo-cyclonedx --locked --version 0.5.9
 
       - name: Generate CycloneDX SBOM
         run: |
-          cargo cyclonedx --format json --output-cdx rust-sbom.cdx.json
-          cargo cyclonedx --format xml --output-cdx rust-sbom.cdx.xml
+          cargo cyclonedx --format json --override-filename rust-sbom.cdx
+          cargo cyclonedx --format xml --override-filename rust-sbom.cdx
 
       - name: Upload SBOM artifacts
         uses: actions/upload-artifact@v7.0.1
         with:
           name: rust-sbom
           path: |
-            rust-sbom.cdx.json
-            rust-sbom.cdx.xml
+            **/rust-sbom.cdx.json
+            **/rust-sbom.cdx.xml
           retention-days: 90
 
   # ============================================================================
@@ -477,6 +507,36 @@ jobs:
           EOF
           fi
 
+      # `.gitleaks.toml` carries `[extend] path = ".gitleaks-estate.toml"`, and
+      # gitleaks resolves that against the PROCESS CWD. Only standards'
+      # secret-scanner-reusable.yml staged that file, so these two hand-rolled
+      # jobs died before scanning a single byte:
+      #   FTL failed to load extended config ... no such file or directory
+      # the action then crashed on the results.sarif it never wrote, and the
+      # audit summary reported a CRASHED SCANNER as "possible secrets in
+      # repository" -- a fake red in the worst possible direction for a
+      # security gate. Pinned to the same standards sha that
+      # .github/workflows/secret-scanner.yml already consumes.
+      - name: Fetch estate gitleaks baseline
+        uses: actions/checkout@v7.0.1
+        with:
+          repository: hyperpolymath/standards
+          ref: 571cc734cd69fb846032ec77a662aa8ee4fc32cd
+          path: .standards-gitleaks
+          sparse-checkout: |
+            config/gitleaks/estate-baseline.toml
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+
+      - name: Stage estate gitleaks baseline
+        run: |
+          set -euo pipefail
+          cp .standards-gitleaks/config/gitleaks/estate-baseline.toml .gitleaks-estate.toml
+          # Delete the tooling checkout BEFORE scanning, or the scan walks
+          # standards' own tree and reports ITS files as hypatia's.
+          rm -rf .standards-gitleaks
+          test -s .gitleaks-estate.toml
+
       - name: Run Gitleaks
         uses: gitleaks/gitleaks-action@v3.0.0
         env:
@@ -623,21 +683,21 @@ jobs:
           toolchain: stable
 
       - name: Install cargo-cyclonedx
-        run: cargo install cargo-cyclonedx --locked
+        run: cargo install cargo-cyclonedx --locked --version 0.5.9
 
       - name: Generate Rust SBOM
         run: |
-          cargo cyclonedx --format json --output-cdx sbom-rust.cdx.json || true
-          cargo cyclonedx --format xml --output-cdx sbom-rust.cdx.xml || true
+          cargo cyclonedx --format json --override-filename sbom-rust.cdx || true
+          cargo cyclonedx --format xml --override-filename sbom-rust.cdx || true
 
 
       - name: Upload SBOM artifacts
         uses: actions/upload-artifact@v7.0.1
         with:
           name: sbom
           path: |
-            sbom-rust.cdx.json
-            sbom-rust.cdx.xml
+            **/sbom-rust.cdx.json
+            **/sbom-rust.cdx.xml
           retention-days: 90
 
   # ============================================================================

.github/workflows/tests.yml

@@ -86,15 +86,26 @@ jobs:
 
       - name: E2E — Scan fixture repo
         run: |
+          rm -rf /tmp/test-repo
           mkdir -p /tmp/test-repo/.github/workflows /tmp/test-repo/src
+          # The Rust CLI opens the target with git2 (Repository::open,
+          # cli/src/commands/mod.rs:38) and exits 1 on a plain directory.
+          # The fixture was only ever mkdir'd, so this step could never have
+          # passed -- the wrong binary name (exit 127) masked it. No commit
+          # is needed; an empty repository is enough.
+          git init -q /tmp/test-repo
           echo 'name: CI' > /tmp/test-repo/.github/workflows/ci.yml
           echo 'on: push' >> /tmp/test-repo/.github/workflows/ci.yml
           echo 'jobs:' >> /tmp/test-repo/.github/workflows/ci.yml
           echo '  build:' >> /tmp/test-repo/.github/workflows/ci.yml
           echo '    runs-on: ubuntu-latest' >> /tmp/test-repo/.github/workflows/ci.yml
           echo '    steps:' >> /tmp/test-repo/.github/workflows/ci.yml
           echo '      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2' >> /tmp/test-repo/.github/workflows/ci.yml
-          ./target/release/hypatia scan /tmp/test-repo 2>&1
+          # The workspace binary is `hyper` (cli/Cargo.toml [[bin]] name),
+          # not `hypatia` -- the crate is `hypatia-cli`. Invoking the crate
+          # name gave `No such file or directory` and exit 127, which reads
+          # like a missing build rather than a wrong filename.
+          ./target/release/hyper scan /tmp/test-repo 2>&1
           echo "PASS: Rust CLI scan completed"
 
   aspect-tests:

0-AI-MANIFEST.a2ml

@@ -21,7 +21,7 @@
      seambot, finishbot, panicbot) via the safety triangle pipeline
      (Eliminate > Substitute > Control). 8 neural networks on a shared
      blackboard, VCL queries over verisim-data, Bayesian confidence updating,
-     and 33 Elixir rule modules for pattern detection.")
+     and 35 Elixir rule modules for pattern detection.")
 
   ;; ===================================================================
   ;; CONTEXT TIERS
@@ -62,7 +62,7 @@
     (description "Safety triangle pipeline with neural dispatch")
     (layers
       (elixir-pipeline "lib/"                "133 modules — pattern analysis, dispatch, learning")
-      (rules           "lib/rules/"          "33 rule modules; catalogue at docs/rules/catalogue.md")
+      (rules           "lib/rules/"          "35 rule modules; catalogue at docs/rules/catalogue.adoc")
       (neural          "lib/neural/"         "8 networks on a blackboard + coordinator GenServer")
       (vcl             "lib/vcl/"            "VCL parser, file executor, query cache, federation")
       (merge-orch      "lib/merge_orchestration/" "12 modules — leases, ledger, ticker")

README.adoc

@@ -19,8 +19,8 @@ toc::[]
 *Hypatia* is the CI/CD governance scanner for the hyperpolymath estate (~400 repositories).
 It combines:
 
-* *Symbolic reasoning* — 33 Elixir rule modules producing fast, deterministic findings
-  (link:docs/rules/catalogue.md[full rule catalogue])
+* *Symbolic reasoning* — 35 Elixir rule modules producing fast, deterministic findings
+  (link:docs/rules/catalogue.adoc[full rule catalogue])
 * *Neural learning* — 8 networks on a shared blackboard, learning which fixes actually stick
 * *Bayesian confidence* — every recipe carries a Beta-distributed confidence updated from real
   outcomes, which gates whether a fix is applied automatically, proposed as a PR, or merely reported
@@ -68,7 +68,7 @@ PatternRegistry ──> TriangleRouter ──> FleetDispatcher ──> DispatchM
 [cols="1,3"]
 |===
 | `lib/` | 133 Elixir modules — pipeline, rules, VCL, neural, safety, web, merge orchestration
-| `lib/rules/` | 33 rule modules; see link:docs/rules/catalogue.md[the catalogue]
+| `lib/rules/` | 35 rule modules; see link:docs/rules/catalogue.adoc[the catalogue]
 | `lib/neural/` | 8 networks + blackboard, coordinator, persistence, rebalancer
 | `lib/vcl/` | VCL query layer over verisim-data: parser, file executor, cache, federation
 | `lib/merge_orchestration/` | 12 modules — leases, ledger, ticker
@@ -141,7 +141,7 @@ by any dispatch path, and the CI blockage currently stopping the Rust lane.
 == Documentation
 
 * link:docs/README.adoc[docs/README.adoc] — the documentation index
-* link:docs/rules/catalogue.md[Rule catalogue] — every rule module and ID family
+* link:docs/rules/catalogue.adoc[Rule catalogue] — every rule module and ID family
 * link:docs/DEBT-REGISTER.md[Debt register] — what is broken and what is not gated
 * https://github.com/hyperpolymath/hypatia/wiki[Wiki] — getting started, architecture, operations, FAQ
 * link:PALIMPSEST.adoc[Palimpsest Philosophy] — philosophical underpinnings