Merge branch 'main' into dependabot/cargo/bots/glambot/cargo-99e5bc1966

Author: hyperpolymath

.github/workflows/actions.lock

@@ -15,17 +15,19 @@ workflows:
         - 'haskell-actions/setup@v2.12.0'
     '.github/workflows/codeql.yml':
         - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@v4.38.0'
+        - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
     '.github/workflows/dogfood-gate.yml':
         - 'actions/checkout@v7.0.1'
         - 'hyperpolymath/deed-ecosystem@main'
         - 'hyperpolymath/k9-ecosystem@main'
     '.github/workflows/e2e.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/governance.yml': []
+    '.github/workflows/governance.yml':
+        - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540'
     '.github/workflows/hypatia-dispatch-intake.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/hypatia-scan.yml': []
+    '.github/workflows/hypatia-scan.yml':
+        - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540'
     '.github/workflows/inbox-steward.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/instant-sync.yml':
@@ -35,7 +37,9 @@ workflows:
     '.github/workflows/learning-loop.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/upload-artifact@v7.0.1'
-    '.github/workflows/mirror.yml': []
+    '.github/workflows/lock-sync-gate.yml': []
+    '.github/workflows/mirror.yml':
+        - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd'
     '.github/workflows/pages.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/deploy-pages@v5.0.1'
@@ -44,27 +48,40 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'actions/upload-artifact@v7.0.1'
         - 'dtolnay/rust-toolchain@v1'
-        - 'swatinem/rust-cache@v2.9.2'
+        - 'Swatinem/rust-cache@v2.9.2'
     '.github/workflows/push-email-notify.yml':
         - 'hyperpolymath/smtp-notify-action@v0.3.0'
     '.github/workflows/repo-integrity-guard.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/rust.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/scorecard.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'actions/upload-artifact@v7.0.1'
-        - 'github/codeql-action@v4.37.8'
-        - 'ossf/scorecard-action@v2.4.4'
-    '.github/workflows/secret-scanner.yml': []
+        - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540'
+    '.github/workflows/secret-scanner.yml':
+        - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd'
     '.github/workflows/supervised-fleet-scan.yml':
         - 'actions/checkout@v7.0.1'
 dependencies:
+    'Swatinem/rust-cache@v2.9.2':
+        ref: 'v2.9.2'
+        commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
+        owner_id: 580492
+        repo_id: 298565987
+    'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
+        ref: '55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
     'actions/cache@v6.1.0':
         ref: 'v6.1.0'
         commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         owner_id: 44036562
         repo_id: 215566462
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
     'actions/checkout@v7.0.1':
         ref: 'v7.0.1'
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
@@ -85,6 +102,11 @@ dependencies:
         commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
         owner_id: 44036562
         repo_id: 192626254
+    'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
+        ref: '043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
     'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
         ref: 'v7.0.0'
         commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
@@ -102,11 +124,36 @@ dependencies:
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
+        ref: '6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
+        commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
+        owner_id: 1940490
+        repo_id: 260749683
     'dtolnay/rust-toolchain@v1':
         ref: 'v1'
         commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
         owner_id: 1940490
         repo_id: 260749683
+    'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
+        ref: '51f63319f592f97930c73d9c46184d20bd206393'
+        commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
+        owner_id: 26415196
+        repo_id: 297874902
+    'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
+        ref: '54075bcc5e249e4758d363f27d099f55d843f124'
+        commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
+        owner_id: 47606891
+        repo_id: 331103973
+    'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63':
+        ref: 'b96794f015dfd88f77b49b1c93e0fa7110f94c63'
+        commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
+        owner_id: 9919
+        repo_id: 259445878
+    'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938':
+        ref: 'cdf488f595d80d6e07e03d4674febd5ab45fa938'
+        commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938'
+        owner_id: 9919
+        repo_id: 259445878
     'github/codeql-action@v4.37.8':
         ref: 'v4.37.8'
         commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
@@ -137,6 +184,33 @@ dependencies:
         commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be'
         owner_id: 6759885
         repo_id: 1352485172
+    'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd':
+        ref: '571cc734cd69fb846032ec77a662aa8ee4fc32cd'
+        commit: 'sha1-571cc734cd69fb846032ec77a662aa8ee4fc32cd'
+        owner_id: 6759885
+        repo_id: 1116521501
+        uses:
+            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+            - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
+            - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
+    'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540':
+        ref: 'da2c748aad55c1a1dcba00b60fe4a35017bc6540'
+        commit: 'sha1-da2c748aad55c1a1dcba00b60fe4a35017bc6540'
+        owner_id: 6759885
+        repo_id: 1116521501
+        uses:
+            - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+            - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+            - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
+            - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
+            - 'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938'
+            - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
+    'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
+        ref: '2d1146689b8cda280b9bc96326124645441f03bc'
+        commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
+        owner_id: 67707773
+        repo_id: 421101922
     'ossf/scorecard-action@v2.4.4':
         ref: 'v2.4.4'
         commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
@@ -152,43 +226,8 @@ dependencies:
         commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
         owner_id: 580492
         repo_id: 298565987
-    'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
-        ref: 'v6.1.0'
-        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
-        owner_id: 44036562
-        repo_id: 215566462
-    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
-    'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
-        ref: 'v7.0.1'
-        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
-        owner_id: 44036562
-        repo_id: 192625955
-    'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
-        ref: 'stable'
-        commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
-        owner_id: 1940490
-        repo_id: 260749683
-    'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
-        ref: 'v3.0.0'
-        commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
-        owner_id: 26415196
-        repo_id: 297874902
-    'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
-        ref: 'v1.24.1'
-        commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
-        owner_id: 47606891
-        repo_id: 331103973
-    'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
-        ref: 'v2.4.4'
-        commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
-        owner_id: 67707773
-        repo_id: 421101922
     'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
-        ref: 'v0.10.0'
+        ref: 'e83874834305fe9a4a2997156cb26c5de65a8555'
         commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
         owner_id: 135788
         repo_id: 208510314

.github/workflows/lock-sync-gate.yml

@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Lock Sync Gate
+
+# Fails any pull request whose .github/workflows/actions.lock has drifted from
+# the workflow YAML. That drift is not cosmetic: GitHub refuses such a run at
+# startup, creating ZERO jobs, and reports only "This run likely failed because
+# of a workflow file issue." A single grouped Dependabot bump can take out most
+# of a repository's CI that way, because Dependabot rewrites `uses:` refs in the
+# YAML and cannot touch the lockfile. Measured across 200 repositories on
+# 2026-09-22: 39 had silently dead CI from exactly this cause.
+# See hyperpolymath/standards#968.
+#
+# This workflow deliberately carries NO `uses:` of its own. It checks out by
+# calling git in a `run:` step instead of using actions/checkout, so it has no
+# lockfile entry to go stale and is structurally immune to the very failure it
+# detects. Do not add a `uses:` to this file.
+#
+# There is also no `paths:` filter, on purpose: a filtered workflow never
+# reports on pull requests that miss the filter, which deadlocks any branch
+# ruleset that requires this check.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: lock-sync-gate-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lock-sync:
+    name: actions.lock is in sync with the workflow YAML
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out without actions/checkout
+        env:
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          # Authenticate the fetch. An anonymous clone works only for public
+          # repositories; this gate must also run on private ones. The header
+          # form is used rather than a token in the remote URL so the
+          # credential is never written into .git/config.
+          AUTH="AUTHORIZATION: basic $(printf 'x-access-token:%s' "${TOKEN}" | base64 -w0)"
+          git init -q .
+          git remote add origin "https://github.com/${REPO}.git"
+          git -c http.extraheader="${AUTH}" fetch -q --depth 1 origin "${SHA}"
+          git checkout -q FETCH_HEAD
+          echo "checked out ${SHA}"
+
+      - name: Verify lockfile synchronisation
+        run: |
+          set -euo pipefail
+          test -x scripts/check-lock-sync.sh \
+            || { echo "::error::scripts/check-lock-sync.sh missing or not executable"; exit 1; }
+          ./scripts/check-lock-sync.sh

bots/rhodibot/canon/pin.toml

@@ -10,14 +10,14 @@
 # reviewable commit.
 #
 # To re-pin: copy the new criteria file over `rsr-criteria-v2.a2ml`, update the
-# three version fields, the digest, and the `categories`, `criteria` and
+# version fields, the digest, and the `categories`, `criteria` and
 # `weight_sum` shape fields below, then run `cargo test`. The canon's own
 # arithmetic is re-checked on parse, so a half-copied file fails rather than
 # silently losing criteria.
 #
 # One discrepancy to be aware of, recorded rather than resolved here: the
-# release in `canon.lock` is 2.0.4 while the criteria file's own `[meta]
-# version` still reads 2.0.0-draft. Both are quoted below so the pin describes
+# release in `canon.lock` is 2.1.1 while the criteria file's own `[meta]
+# version` reads 2.1.0-draft. Both are quoted below so the pin describes
 # the artefact rather than a story about it. `canon.lock` also cannot be pinned
 # by commit: its `commit` field is still the all-zero placeholder with the
 # comment "fill at release".
@@ -26,17 +26,17 @@
 repo = "hyperpolymath/standards"
 path = "0-canon/rsr/rsr-criteria-v2.a2ml"
 slot = "criteria"
-canon_version = "2.0.4"
-criteria_version = "2.0.0-draft"
-released = "2026-09-17"
-pinned = "2026-09-19"
-sha256 = "37cb5f679b414f6ee99c6bb62c460fd5349ff7d50cc1dab25b1e1a8e8d3c7bb9"
+canon_version = "2.1.1"
+criteria_version = "2.1.0-draft"
+released = "2026-09-19"
+pinned = "2026-09-22"
+sha256 = "6a5aa8857bd0d0d58ef48827938ca17c251b6b854dacf59d306388d61694d82a"
 
 # The shape of the pinned revision, checked after parsing as well as by digest.
 # A rule set that silently shrinks is the failure mode that matters: these
 # numbers make shrinking a test failure rather than a quieter scorecard.
 categories = 11
-criteria = 74
+criteria = 78
 weight_sum = 88
 
 # The release's second artefact: the gate table. It says which capabilities a
@@ -49,10 +49,10 @@ weight_sum = 88
 repo = "hyperpolymath/standards"
 path = ".machine_readable/template-capability-gates.toml"
 slot = "gates"
-version = "0.2.0"
-released = "2026-09-17"
-pinned = "2026-09-19"
-sha256 = "b65ce75438c42d01bedf0325b9a97f1a575064866158b4340d7427fca911dd1b"
+version = "0.3.0"
+released = "2026-09-19"
+pinned = "2026-09-22"
+sha256 = "e70efd2f53c9445e30da4baf770366f04a4a84ffd844a01426e587e565b53e6a"
 
 # The shape of the pinned table. A vocabulary that shrank would leave profiles
 # declaring the lost words unparseable, and criteria gated on them permanently

bots/rhodibot/canon/rsr-criteria-v2.a2ml

@@ -18,13 +18,24 @@
 
 [meta]
 spec = "rhodium-standard-repositories"
-version = "2.0.0-draft"
+version = "2.1.0-draft"
 status = "draft"                 # draft | stable ; MUST NOT be cited as ratified until §Ratification passes
 supersedes = "1.0.0"
-date = "2026-07-03"
+date = "2026-09-19"
 authority = "RSR-SPEC-v2.adoc"
 normative-oracle = "hypatia:rsr-conformance"   # the ONE checker; all others are non-normative (see [oracle])
 dialect = "a2ml-record"          # dogfoods a2ml/RECORD-DIALECT-SPEC.adoc
+#
+# 2.1.0-draft (2026-09-19): ADDITIVE MINOR (rule-minor: may add criteria
+# or capability gates; must not make a previously-conforming repo
+# non-conforming at the same tier). Adds the julia-gated criteria
+# 5.2.3-5.2.6. Rationale: the capability vocabulary named `julia` with
+# no criteria to gate on, so a repo declaring `julia` + `library` was
+# scored with nothing language-shaped at all - the 33-repo .jl estate
+# was invisible to the oracle by construction. All four criteria gate
+# on `julia`, so no repo that does not declare `julia` has its
+# applicable set change: the MINOR's non-regression obligation holds
+# by the gate itself. Owner ruling 2026-09-19: approved.
 
 [versioning]
 # Fixes the v1.0 "immutable forever" model, which estate reality already broke.
@@ -167,6 +178,10 @@ criteria = [
   { id = "5.1.6", name = "no-node-npm",   desc = "No Node/npm/bun runtime deps (use Deno)",                       tier = "bronze", gate = "universal", detect = "cicd_rules/nodejs_detected",    template_ref = ".github/workflows/runtime-policy.yml" },
   { id = "5.2.1", name = "spark-ready",   desc = "Rust projects designed to admit SPARK/Ada modules",             tier = "rhodium", gate = "rust",     detect = "manual",                        template_ref = "-" },
   { id = "5.2.2", name = "proofs-clean",  desc = "No believe_me / sorry / Admitted in load-bearing proofs",       tier = "gold",   gate = "formal-proofs", detect = "proof_obligation/no_holes", template_ref = "verification/" },
+  { id = "5.2.3", name = "julia-package", desc = "Project.toml: stable uuid (derived or assigned, never regenerated), [compat] closure incl. the julia floor and bounds for every extra, licence consistent with LICENSE", tier = "silver", gate = "julia", detect = "rsr-conformance/julia_package", template_ref = "archetypes/julia-library/overlay/Project.toml.in" },
+  { id = "5.2.4", name = "julia-ci",      desc = "Julia CI workflow with a version matrix that includes the [compat] julia floor, running Pkg.test()", tier = "bronze", gate = "julia", detect = "rsr-conformance/julia_ci",     template_ref = "archetypes/julia-library/overlay/.github/workflows/julia-ci.yml.in" },
+  { id = "5.2.5", name = "julia-aqua",    desc = "Aqua in [extras]+[targets] and green in CI (package-shape / compat / ambiguity gate); Aqua.test_all failure blocks", tier = "gold",   gate = "julia", detect = "rsr-conformance/julia_aqua",   template_ref = "archetypes/julia-library/overlay/test/runtests.jl" },
+  { id = "5.2.6", name = "julia-docs",    desc = "Documenter build wired for a julia repo that declares docs-site (docs/Project.toml + docs/make.jl + docs/src/ + build workflow); declared docs-site without a build is a VESTIGIAL-class defect the gate must catch", tier = "silver", gate = "julia", detect = "rsr-conformance/julia_docs",   template_ref = "archetypes/julia-library/overlay/.github/workflows/julia-docs.yml.in" },
 ]
 
 [[category]]

bots/rhodibot/canon/template-capability-gates.toml

@@ -10,7 +10,7 @@
 # Arrays are kept single-line so the checker can parse them with grep.
 
 [meta]
-version = "0.2.0"
+version = "0.3.0"
 policy = "0-canon/TEMPLATE-APPLICABILITY-POLICY.adoc"
 
 [capabilities]
@@ -39,6 +39,14 @@ paths = ["README.adoc", "EXPLAINME.adoc|docs/EXPLAINME.adoc", "LICENSE", "SECURI
 "Cargo.lock" = "rust"
 "src/**/*.rs" = "rust"
 ".github/workflows/rust-ci.yml" = "rust"
+# Julia library modules (the julia-library archetype's overlay; the
+# #634 reference variant measured 2026-08-25: the language-specific
+# delta is exactly these files). test/ (singular) is the Julia
+# convention; rust uses tests/ and is ungated here by design.
+"Project.toml" = "julia"
+"test/" = "julia"
+".github/workflows/julia-ci.yml" = "julia"
+".github/workflows/julia-docs.yml" = "julia"
 "src/interface/ffi/" = "ffi"
 "abi.ipkg" = "abi"
 "src/interface/abi/|src/interface/Abi/" = "abi"