Estate rollout: CI foundations from rpa-elysium #145 (432-repository audit) #1261

Validated repair and rollout scope

Found while fixing hyperpolymath/rpa-elysium#144. Repair PR: hyperpolymath/rpa-elysium#145.

Audit and remediation details: https://github.com/hyperpolymath/rpa-elysium/blob/a26e8b7/docs/CI-CD-REPAIR.adoc

Full machine-readable inventory: https://github.com/hyperpolymath/rpa-elysium/blob/a26e8b7/docs/audits/ci-estate-2026-10-14.json

432 repositories accessible to the connection were inventoried across hyperpolymath, metadatastician, Invisible-Door-Studios and stuff-of-awe. 429 have workflows. 39 rows are partial/unexamined because of invalid YAML/refs/schema; they are NOT clean. Static flags are candidates, not proof that a required check fails in every repository.

Immediate, same-cause cohort

43 repositories (including rpa-elysium) pin governance to fad242d35291de1898242d6737ba02b74a59a2f2. In rpa-elysium this rejects the newer verifier findings despite repaired direct refs/closure. The compatibility commit c11c255e1b5546854e874d1486d61d6d5a4da29a (#1250, deliberately pinned v0.2.0) makes the shared lock gate pass. Migrate each consumer AND its complete immutable dependency graph together, not YAML alone.

Remaining 42 exact-pin consumers at scan time:

• hyperpolymath/absolute-zero
• hyperpolymath/anamnesis
• hyperpolymath/asdf-tool-plugins
• hyperpolymath/aspasia
• hyperpolymath/bebop-ffi
• hyperpolymath/blocky-writer
• hyperpolymath/cyo
• hyperpolymath/defiant
• hyperpolymath/dicti0nary-attack
• hyperpolymath/docmatrix
• hyperpolymath/echidnabot
• hyperpolymath/echo-types
• hyperpolymath/explicit-trust-plane
• hyperpolymath/filesoup
• hyperpolymath/im-docs
• hyperpolymath/kaldor-iiot
• hyperpolymath/laminar
• hyperpolymath/live-files
• hyperpolymath/metadata-grammar
• hyperpolymath/nextgen-typing
• hyperpolymath/nickel-augmentation
• hyperpolymath/panic-attack
• hyperpolymath/php-aegis
• hyperpolymath/polyglot-i18n
• hyperpolymath/preference-injector
• hyperpolymath/protocol-squisher
• hyperpolymath/reasonably-good-token-vault
• hyperpolymath/resource-record-fluctuator
• hyperpolymath/scripts
• hyperpolymath/snapcreate
• hyperpolymath/social-media-polygraph
• hyperpolymath/tree-navigator
• hyperpolymath/tropical-types
• hyperpolymath/twingate-helm-deploy
• hyperpolymath/unified-dataset-vocab
• hyperpolymath/universal-chat-extractor
• hyperpolymath/universal-extension-format
• hyperpolymath/universal-project-manager
• hyperpolymath/vcs-ircd
• hyperpolymath/voyage-enterprise-decision-system
• metadatastician/stapeln
• metadatastician/svalinn

Broader foundational rollout

• Migrate the YAML-structural sync checker and its 15 positive/negative controls through Standards and repin callers.
• Preserve existing reusable graph/restore job-level refs atomically during regeneration; run the additional update rollback/observational controls.
• Repair malformed/duplicate-key YAML before regeneration. Do not mark the 39 partial rows clean.
• Review the 263 repositories with direct lock drift, 128 missing locks, 7 with dangling edges, 229 header flags and 96 Deno-policy-text flags. Categories overlap; respect exemptions/actual required contexts.
• Keep SPDX ordering stable across generator updates.
• Upgrade async-trait only where Rust 1.99 reports its macro-generated double_must_use (upstream 0.1.92 fixes it). No lint suppression.
• Patch Wasmtime only where RUSTSEC-2026-0316 applies (36.0.16 is patched). No audit ignore.
• Run each repository's required checks, merge each reviewed fix, and verify its default-branch run before marking a target propagated.

This issue records pending rollout; it does NOT claim that other repository code has already changed. No estate rulesets were altered (Administration endpoint returned 403).

Additional upstream observation: trying governance at 80014df... introduced a failing JS runtimes — environment provisions Bun first checker BUILD (cargo install --locked --path tools/js-runtimes, exit 101, before provision ran). See rpa-elysium run 38601710876 job 115982322950. The narrower #1250 commit was selected rather than weakening that new gate; that independent build needs diagnosis before a wider HEAD upgrade.