fix(ci): repair manifest gates, canonical metadata and shared workflows

.envrc

@@ -12,15 +12,10 @@ if has guix && [ -f guix.scm ]; then
   use guix
 fi
 
-# Load Nix flake if flake.nix exists
-if has nix && [ -f flake.nix ]; then
-fi
-
 # Project environment variables
-export PROJECT_NAME="{{PROJECT_NAME}}"
+export PROJECT_NAME="fraying-model-computational-testbed"
 export RSR_TIER="infrastructure"
 # export DATABASE_URL="..."
-# export API_KEY="..."
 
 # Source .env if it exists (gitignored)
 dotenv_if_exists

.github/dependabot.yml

@@ -13,6 +13,7 @@ updates:
       actions:
         patterns:
           - "*"
+    open-pull-requests-limit: 2
 
   # Rust/Cargo
   - package-ecosystem: "cargo"
@@ -31,18 +32,21 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
 
   # Node.js/npm
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
 
   # Python/pip
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
 
   # Guix flakes
   - package-ecosystem: "guix"

.github/pull_request_template.md

@@ -29,9 +29,9 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 
 ### As Applicable
 
-- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed)
-- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations changed)
-- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions changed)
+- [ ] `.machine_readable/descriptiles/STATE.a2ml` updated (if project state changed)
+- [ ] `.machine_readable/descriptiles/ECOSYSTEM.a2ml` updated (if integrations changed)
+- [ ] `.machine_readable/descriptiles/META.a2ml` updated (if architectural decisions changed)
 - [ ] Documentation updated for user-facing changes
 - [ ] `TOPOLOGY.md` updated (if architecture changed)
 - [ ] `CHANGELOG` or release notes updated

.github/rulesets/Immutable-Tags.json

@@ -0,0 +1,18 @@
+{
+  "name": "Immutable-Tags",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~ALL"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "update"},
+    {"type": "required_signatures"}
+  ]
+}

.github/rulesets/Optimus-Branch.json

@@ -0,0 +1,44 @@
+{
+  "name": "Optimus-Branch",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_signatures"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 2,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_review_thread_resolution": true,
+        "require_extra_approval_for_unattributed_changes": true,
+        "required_reviewers": [],
+        "allowed_merge_methods": []
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": []
+      }
+    }
+  ]
+}

.github/workflows/e2e.yml → .github/workflow-templates/e2e.yml

@@ -22,13 +22,14 @@ on:
       - 'tests/**'
       - '.github/workflows/e2e.yml'
   pull_request:
-    branches: [main, master]
+    branches: ['**']
     paths:
       - 'src/**'
       - 'ffi/**'
       - 'tests/**'
   workflow_dispatch:
-permissions: read-all
+permissions:
+  contents: read
   actions: read
 concurrency:
   group: e2e-${{ github.ref }}
@@ -47,7 +48,7 @@ jobs:
 #     - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7  # stable
 #     - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2
 #     - run: cargo build --release
-#     - run: bash tests/e2e.sh
+#     - run: bash tests/templates/e2e.sh.template
 #       # OR: cargo test --test end_to_end -- --nocapture
 
 ## === ZIG FFI E2E ===
@@ -61,7 +62,7 @@ jobs:
 #       with:
 #         version: 0.15.0
 #     - run: cd ffi/zig && zig build test
-#     - run: bash tests/e2e.sh
+#     - run: bash tests/templates/e2e.sh.template
 
 ## === ELIXIR E2E ===
 # e2e:

.github/workflows/actions.lock

@@ -0,0 +1,137 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/boj-build.yml':
+        - 'actions/checkout@v6.0.2'
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@v6.0.2'
+        - 'github/codeql-action@v4.34.0'
+    '.github/workflows/dependabot-automerge.yml':
+        - 'dependabot/fetch-metadata@v2.2.0'
+    '.github/workflows/dogfood-gate.yml':
+        - 'actions/checkout@v4.3.1'
+        - 'hyperpolymath/deed-ecosystem@main'
+        - 'hyperpolymath/k9-ecosystem@main'
+    '.github/workflows/instant-sync.yml':
+        - 'peter-evans/repository-dispatch@v4.0.1'
+    '.github/workflows/main-estate-audit.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'hyperpolymath/cicd-suite@main'
+    '.github/workflows/mirror.yml':
+        - 'actions/checkout@v6.0.2'
+        - 'dtolnay/rust-toolchain@master'
+        - 'webfactory/ssh-agent@v0.9.1'
+    '.github/workflows/openssf-compliance.yml':
+        - 'actions/checkout@v4.3.1'
+    '.github/workflows/push-email-notify.yml':
+        - 'hyperpolymath/smtp-notify-action@v0.2.0'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v6.0.2'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'softprops/action-gh-release@v2.5.0'
+    '.github/workflows/repository-validation.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/rhodibot.yml':
+        - 'actions/checkout@v4.3.1'
+    '.github/workflows/static-analysis-gate.yml':
+        - 'actions/checkout@v6.0.2'
+        - 'actions/download-artifact@v4.1.8'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'erlef/setup-beam@v1.20.4'
+dependencies:
+    'actions/checkout@v4.3.1':
+        ref: 'v4.3.1'
+        commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v6.0.2':
+        ref: 'v6.0.2'
+        commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v4.1.8':
+        ref: 'v4.1.8'
+        commit: 'sha1-fa0a91b85d4f404e444e00e005971372dc801d16'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'dependabot/fetch-metadata@v2.2.0':
+        ref: 'v2.2.0'
+        commit: 'sha1-dbb049abf0d677abbd7f7eee0375145b417fdd34'
+        owner_id: 27347476
+        repo_id: 371068214
+    'dtolnay/rust-toolchain@master':
+        ref: 'master'
+        commit: 'sha1-efa25f7f19611383d5b0ccf2d1c8914531636bf9'
+        owner_id: 1940490
+        repo_id: 260749683
+    'erlef/setup-beam@v1.20.4':
+        ref: 'v1.20.4'
+        commit: 'sha1-e6d7c94229049569db56a7ad5a540c051a010af9'
+        owner_id: 47606891
+        repo_id: 331103973
+    'github/codeql-action@v4.34.0':
+        ref: 'v4.34.0'
+        commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745'
+        owner_id: 9919
+        repo_id: 259445878
+    'hyperpolymath/cicd-suite@main':
+        ref: 'main'
+        commit: 'sha1-0405f138caa8e9ac10bc181f3b46224bbdcda693'
+        owner_id: 6759885
+        repo_id: 1326697643
+        uses:
+            - 'hyperpolymath/deed-ecosystem@f7a40a4d5cc82b2e73f861119baa6818d77a448d'
+            - 'hyperpolymath/deed-ecosystem@main'
+            - 'hyperpolymath/k9-ecosystem@main'
+    'hyperpolymath/deed-ecosystem@f7a40a4d5cc82b2e73f861119baa6818d77a448d':
+        ref: 'main'
+        commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d'
+        owner_id: 6759885
+        repo_id: 1275649586
+    'hyperpolymath/deed-ecosystem@main':
+        ref: 'main'
+        commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d'
+        owner_id: 6759885
+        repo_id: 1275649586
+    'hyperpolymath/k9-ecosystem@main':
+        ref: 'main'
+        commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb'
+        owner_id: 6759885
+        repo_id: 1275650185
+    'hyperpolymath/smtp-notify-action@v0.2.0':
+        ref: 'v0.2.0'
+        commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
+        owner_id: 6759885
+        repo_id: 1352485172
+    'peter-evans/repository-dispatch@v4.0.1':
+        ref: 'v4.0.1'
+        commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
+        owner_id: 18365890
+        repo_id: 220359305
+    'softprops/action-gh-release@v2.5.0':
+        ref: 'v2.5.0'
+        commit: 'sha1-a06a81a03ee405af7f2048a818ed3f03bbf83c7b'
+        owner_id: 2242
+        repo_id: 204253808
+    'webfactory/ssh-agent@v0.9.1':
+        ref: 'v0.9.1'
+        commit: 'sha1-a6f90b1f127823b31d4d4a8d96047790581349bd'
+        owner_id: 135788
+        repo_id: 208510314

.github/workflows/boj-build.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
@@ -21,10 +22,10 @@
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         env:
           BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }}
           REPO_NAME: ${{ github.repository }}
           BRANCH_NAME: ${{ github.ref_name }}
         run: |

.github/workflows/codeql.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
@@ -6,7 +7,7 @@ on:
   push:
     branches: [main, master]
   pull_request:
-    branches: [main, master]
+    branches: ['**']
   schedule:
     - cron: '0 6 * * 1'
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
@@ -34,13 +35,13 @@ jobs:
             build-mode: none
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
+        uses: github/codeql-action/init@v4.34.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
+        uses: github/codeql-action/analyze@v4.34.0
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/dependabot-automerge.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
@@ -48,15 +49,15 @@
 jobs:
   automerge:
     # Only run for PRs actually authored by Dependabot.
-    if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]'
+    if: github.actor_id == '49699333' && github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - name: Fetch Dependabot metadata
         id: meta
-        uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0
+        uses: dependabot/fetch-metadata@v2.2.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
       # --- Policy gate -------------------------------------------------------
       # Outputs from fetch-metadata we care about:
       #   update-type      → version-update:semver-{patch,minor,major}