From 0c261f1255ba3c4b54172cb851c958d0c86be870 Mon Sep 17 00:00:00 2001
From: hyperpolymath <hyperpolymath@users.noreply.github.com>
Date: Tue, 22 Sep 2026 10:21:26 +0000
Subject: [PATCH] fix(main-red-round2): map drift repair + second asana ack
 (WH004 path)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- standards-map.toml: repair drift the map gate caught. #851 moved
  root .well-known/ to www/.well-known/ but the map still listed the
  root path (assertion 1) and never mapped www/ (assertion 2); the
  #947 squash added SECURITY.md, also unmapped. Replace the stale
  .well-known entry with www/ (migration wrapper note) + add
  SECURITY.md; entry_count 122 -> 123. All 5 assertions pass locally.
- .hypatia-baseline.json: 211 -> 212. The real scanner emits
  invalid_actions_lock TWICE (verified by running Hypatia locally):
  workflow_audit (file actions.lock, acked in the previous commit)
  and WH004 standalone (rule_module workflow_hardening, full path).
  Ack the second path; same root cause and exit criteria (#951).

Ratchet-exception: .hypatia-baseline.json — second ack for the same asana float-transitive, other emission path (#951).
---
 .hypatia-baseline.json |  9 +++++++++
 standards-map.toml     | 23 ++++++++++++++++++-----
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json
index 9c7481e2e..3cd5de9b8 100644
--- a/.hypatia-baseline.json
+++ b/.hypatia-baseline.json
@@ -1732,5 +1732,14 @@
   "note": "TRIAGED (round-2 fix-forward 2026-09-22): Hypatia workflow_audit fails the lock closed with transitive_dependencies_missing -- asana/push-signed-commits@d615 (immutable pin, ref v1.3) declares transitive actions/setup-python@v2, which floats upstream and can never be a lock key. gh-actions-lock v0.1.6 verify says valid:true on the same file; Hypatia is stricter than the authoritative tool. Exposure is upstream float only. Exit: Asana pins setup-python, we replace the action, or Hypatia downgrades float-transitives. #947 deleted the metadata to silence the scanner; round 2 restored it verbatim and acked honestly.",
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#951"
+ },
+ {
+  "severity": "high",
+  "rule_module": "workflow_hardening",
+  "type": "invalid_actions_lock",
+  "file": ".github/workflows/actions.lock",
+  "note": "TRIAGED (round-2 fix-forward 2026-09-22): second emission path of the same asana float-transitive as the workflow_audit ack (see #951). Hypatia emits invalid_actions_lock TWICE: workflow_audit/parse_actions_lock (file actions.lock) and WH004 standalone (rule_module workflow_hardening, full path). Both verified by running the real scanner locally. Same exit criteria as #951.",
+  "expires_at": "2026-12-22",
+  "tracking_issue": "hyperpolymath/standards#951"
  }
 ]
diff --git a/standards-map.toml b/standards-map.toml
index 89a667393..3797185c4 100644
--- a/standards-map.toml
+++ b/standards-map.toml
@@ -32,7 +32,7 @@
 [map]
 repo        = "hyperpolymath/standards"
 version     = "1.0.0"
-entry_count = 122
+entry_count = 123
 generated   = false   # hand-curated; the district index.adoc files ARE generated
 checked_by  = "scripts/check-standards-map.sh"
 
@@ -1517,17 +1517,30 @@ gate        = "canon-self-conformance"
 note        = "two canonical front doors (README.adoc human, 0-AI-MANIFEST.a2ml machine); every other doc is a thin pointer"
 
 [[entry]]
-from        = ".well-known"
-target      = ".well-known"
+from        = "www"
+target      = "www"
 district    = "root"
 kind        = "spine-mandated"
 files       = 4
 lifecycle   = "versioned"
 canonical   = false
 canon_slot  = ""
-canonical_doc = ".well-known/index.adoc"
+canonical_doc = ""
 gate        = "check-root-shape"
-note        = "must be at root because the spine's root-allow.txt requires it there"
+note        = "2026-09 (#851) migration wrapper: root .well-known/ moved to www/.well-known/ (its only content, 4 files). Replaces the stale .well-known entry (round 2). If a real site grows here, split the entry."
+
+[[entry]]
+from        = "SECURITY.md"
+target      = "SECURITY.md"
+district    = "root"
+kind        = "onramp"
+files       = 1
+lifecycle   = "versioned"
+canonical   = false
+canon_slot  = ""
+canonical_doc = ""
+gate        = ""
+note        = "GitHub security policy: supported versions (tip of main only) + private vulnerability reporting. Added 2026-09-22 (round 2 maps it)."
 
 [[entry]]
 from        = ".editorconfig"