diff --git a/.github/workflows/architecture-enforcement.yml b/.github/workflows/architecture-enforcement.yml
index a0ffd539..96b4e85e 100644
--- a/.github/workflows/architecture-enforcement.yml
+++ b/.github/workflows/architecture-enforcement.yml
@@ -8,6 +8,7 @@ on:
   push:
     branches: [main, develop]
 permissions:
+  actions: read
   contents: read
 # Cancel superseded runs on the same ref so a rapid sequence of pushes
 # to a feature branch does not pile up jobs against the Pro-plan 40-job
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index 3f87bb2d..7a5e7b82 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -7,6 +7,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 670f3959..0938eacc 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -7,6 +7,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml
index 5555a676..3a7ffa6a 100644
--- a/.github/workflows/cflite_batch.yml
+++ b/.github/workflows/cflite_batch.yml
@@ -3,6 +3,7 @@ name: ClusterFuzzLite Batch
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   schedule:
diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml
index 1507c6f3..2272aa64 100644
--- a/.github/workflows/cflite_pr.yml
+++ b/.github/workflows/cflite_pr.yml
@@ -3,6 +3,7 @@ name: ClusterFuzzLite PR
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   pull_request:
diff --git a/.github/workflows/chapel-ci.yml b/.github/workflows/chapel-ci.yml
index 57c249a4..55ea0697 100644
--- a/.github/workflows/chapel-ci.yml
+++ b/.github/workflows/chapel-ci.yml
@@ -24,6 +24,7 @@
 
 name: Chapel CI
 permissions:
+  actions: read
   contents: read
 on:
   push:
diff --git a/.github/workflows/clusterfuzzlite.yml b/.github/workflows/clusterfuzzlite.yml
index 49f366bc..dbf30706 100644
--- a/.github/workflows/clusterfuzzlite.yml
+++ b/.github/workflows/clusterfuzzlite.yml
@@ -22,6 +22,7 @@ on:
     - cron: '0 2 * * 0' # Sunday 02:00 UTC
   workflow_dispatch:
 permissions: read-all
+  actions: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 609b3926..9271c853 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -17,6 +17,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   analyze:
diff --git a/.github/workflows/d-ci.yml b/.github/workflows/d-ci.yml
index 868d7ac4..a1021189 100644
--- a/.github/workflows/d-ci.yml
+++ b/.github/workflows/d-ci.yml
@@ -8,6 +8,7 @@
 
 name: D CI
 permissions:
+  actions: read
   contents: read
 on:
   push:
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 9663536e..5d433913 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -13,6 +13,7 @@ on:
   push:
     branches: [main, master]
 permissions:
+  actions: read
   contents: read
 jobs:
   # ---------------------------------------------------------------------------
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 75a45e36..f65350db 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -27,6 +27,7 @@ on:
       - 'bindings/**'
   workflow_dispatch:
 permissions: read-all
+  actions: read
 concurrency:
   group: e2e-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/echidna-verify.yml b/.github/workflows/echidna-verify.yml
index 3cd7ef57..0ba5b1c0 100644
--- a/.github/workflows/echidna-verify.yml
+++ b/.github/workflows/echidna-verify.yml
@@ -37,6 +37,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   agda-lol:
diff --git a/.github/workflows/ffi-full-integration.yml b/.github/workflows/ffi-full-integration.yml
index 2d8f3c2d..e8487f65 100644
--- a/.github/workflows/ffi-full-integration.yml
+++ b/.github/workflows/ffi-full-integration.yml
@@ -5,6 +5,7 @@ name: FFI Full Integration
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   push:
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 8776de07..966a16e9 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 9dde27ac..556e8e0b 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -11,6 +11,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 
diff --git a/.github/workflows/idris2-ci.yml b/.github/workflows/idris2-ci.yml
index 26b153d6..ad82d55b 100644
--- a/.github/workflows/idris2-ci.yml
+++ b/.github/workflows/idris2-ci.yml
@@ -3,6 +3,7 @@ name: Idris 2 CI
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   push:
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index fc339ac7..88ea4014 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -10,6 +10,7 @@ on:
   release:
     types: [published]
 permissions:
+  actions: read
   contents: read
 jobs:
   dispatch:
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 0c0d01a2..e1f3ee20 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -7,6 +7,7 @@ on:
     branches: [main]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   mirror:
diff --git a/.github/workflows/ocaml-ci.yml b/.github/workflows/ocaml-ci.yml
index efbb6ef6..7a46fab6 100644
--- a/.github/workflows/ocaml-ci.yml
+++ b/.github/workflows/ocaml-ci.yml
@@ -8,6 +8,7 @@
 
 name: OCaml CI
 permissions:
+  actions: read
   contents: read
 on:
   push:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index c78489a6..02734375 100755
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -5,6 +5,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml
index 6f64ea76..c8b37aab 100644
--- a/.github/workflows/publish-crates.yml
+++ b/.github/workflows/publish-crates.yml
@@ -13,6 +13,7 @@ on:
         default: 'true'
         type: boolean
 permissions:
+  actions: read
   contents: read
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
diff --git a/.github/workflows/publish-ghcr.yml b/.github/workflows/publish-ghcr.yml
index ebc18cd3..88989da0 100644
--- a/.github/workflows/publish-ghcr.yml
+++ b/.github/workflows/publish-ghcr.yml
@@ -8,6 +8,7 @@ on:
     types: [published]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   packages: write
 jobs:
diff --git a/.github/workflows/publish-jsr.yml b/.github/workflows/publish-jsr.yml
index 3cdbb369..4ab58c87 100644
--- a/.github/workflows/publish-jsr.yml
+++ b/.github/workflows/publish-jsr.yml
@@ -15,6 +15,7 @@ on:
         default: 'true'
         type: boolean
 permissions:
+  actions: read
   contents: read
 jobs:
   publish:
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 86cb6d45..780297f3 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -24,6 +24,7 @@ on:
           - javascript
           - typescript
 permissions:
+  actions: read
   contents: read
 jobs:
   publish-javascript:
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 4b4e754b..112afd18 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -7,6 +7,7 @@ name: Push email notification
 on:
   push: {}
 permissions:
+  actions: read
   contents: read
 jobs:
   notify:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 92b38071..14a7c460 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,6 +29,7 @@ on:
         default: true
         type: boolean
 permissions:
+  actions: read
   contents: read
 jobs:
   validate:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b97e2cbc..cede40a4 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 9abbb333..5b6a2b67 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -10,6 +10,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   scan:
diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml
index 7004b5b2..12d40f7f 100644
--- a/.github/workflows/spark-theatre-gate.yml
+++ b/.github/workflows/spark-theatre-gate.yml
@@ -11,6 +11,7 @@ on:
   push:
     branches: [main, master]
 permissions:
+  actions: read
   contents: read
 jobs:
   spark-theatre-gate:
diff --git a/.github/workflows/trustfile.yml b/.github/workflows/trustfile.yml
index 41238386..1366960e 100644
--- a/.github/workflows/trustfile.yml
+++ b/.github/workflows/trustfile.yml
@@ -16,6 +16,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/zig-ffi.yml b/.github/workflows/zig-ffi.yml
index bdcf13e7..33c1ab21 100644
--- a/.github/workflows/zig-ffi.yml
+++ b/.github/workflows/zig-ffi.yml
@@ -3,6 +3,7 @@ name: Zig FFI Build
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   push:
diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc
deleted file mode 100644
index e41020d3..00000000
--- a/GOVERNANCE.adoc
+++ /dev/null
@@ -1,162 +0,0 @@
-// SPDX-License-Identifier: CC-BY-SA-4.0
-// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-= Governance Model
-:toc: preamble
-
-This document describes the governance model for this repository.
-
-== Overview
-
-This repository follows a **Sole Maintainer Governance Model**:
-
-* Single maintainer (@hyperpolymath) has full authority over the project
-* All contributions are welcome and reviewed by the maintainer
-* Decisions are made transparently through GitHub issues and discussions
-* The project adheres to the hyperpolymath estate policies where applicable
-
-== Core Principles
-
-[cols="1,2"]
-|===
-| Principle | Description
-
-| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input
-
-| **Meritocracy** | Contributions are judged on technical merit, not contributor identity
-
-| **Transparency** | All significant decisions are documented publicly
-
-| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary
-
-| **Open Contribution** | Anyone can contribute via fork and pull request
-
-|===
-
-== Roles and Permissions
-
-[cols="1,2,2"]
-|===
-| Role | Permissions | Assignment
-
-| **Maintainer** | Write access, merge rights, admin | @hyperpolymath
-| **Contributors** | Read access, fork, submit PRs | All GitHub users
-| **Users** | Use the software, report issues | All GitHub users
-
-|===
-
-== Decision Making Framework
-
-=== Routine Decisions
-
-* Bug fixes
-* Documentation improvements
-* Minor feature additions
-* Dependency updates
-
-**Process**: Maintainer reviews and merges PRs that meet quality standards.
-
-=== Significant Changes
-
-* New major features
-* API changes
-* Architecture modifications
-* Breaking changes
-
-**Process**:
-. Open issue describing the change
-. Discuss with community (minimum 72 hours)
-. Maintainer makes final decision
-. Document rationale in issue/PR
-
-=== Structural Decisions
-
-* Repository purpose/renaming
-* License changes
-* Ownership transfer
-* Deprecation/archival
-
-**Process**: 
-. Extended discussion (minimum 1 week)
-. Maintainer makes final decision
-. Document in CHANGELOG and governance docs
-
-== Contribution Lifecycle
-
-[cols="1,2"]
-|===
-| Stage | Process
-
-| **Ideation** | Open issue, discuss feasibility
-
-| **Development** | Fork, implement, test thoroughly
-
-| **Review** | Submit PR, maintainer reviews within 7 days
-
-| **Merge** | Maintainer merges or requests changes
-
-| **Release** | Maintainer publishes according to project conventions
-
-|===
-
-== Conflict Resolution
-
-In case of disagreements:
-
-. Discuss in the relevant GitHub issue or PR
-. Provide technical justification for positions
-. Maintainer mediates and makes final decision
-. Decision is documented and can be revisited later
-
-== Project Policies
-
-This repository adheres to hyperpolymath estate-wide policies:
-
-* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc)
-* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md
-* **Security**: Follows hyperpolymath SECURITY.md
-* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions
-
-== Repository-Specific Conventions
-
-[cols="1,2"]
-|===
-| Convention | Description
-
-| **Signing** | All commits must be signed (SSH or GPG)
-
-| **SPDX Headers** | All source files must have SPDX license identifiers
-
-| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root
-
-| **Machine Readable** | META.a2ml in .machine_readable/6a2/
-
-| **CI/CD** | GitHub Actions workflows in .github/workflows/
-
-|===
-
-== Governance Evolution
-
-As the project grows, this governance model may evolve:
-
-* **Adding Co-Maintainers**: When contribution volume warrants it
-* **Forming a Team**: For complex multi-maintainer projects
-* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories)
-
-Changes to this document require the same process as Significant Changes above.
-
-== See Also
-
-* link:MAINTAINERS.adoc[Maintainers]
-* link:CODE_OF_CONDUCT.md[Code of Conduct]
-* link:CONTRIBUTING.adoc[Contributing Guide]
-* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy]
-* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)]
-
-== Changelog
-
-[cols="1,1,1"]
-|===
-| Date | Change | By
-
-| 2026-06-07 | Initial governance model established | @hyperpolymath
-|===
diff --git a/guix.scm b/guix.scm
deleted file mode 100644
index addc1378..00000000
--- a/guix.scm
+++ /dev/null
@@ -1,30 +0,0 @@
-;; SPDX-License-Identifier: MPL-2.0
-;; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)
-;;
-;; Guix development environment for proven.
-;; Usage: guix shell -D -f guix.scm
-
-(use-modules (guix packages)
-             (guix build-system gnu)
-             (gnu packages idris)
-             (gnu packages zig)
-             (gnu packages rust)
-             (gnu packages crates-io)
-             (gnu packages pkg-config))
-
-(package
-  (name "proven")
-  (version "0.1.0")
-  (source #f)
-  (build-system gnu-build-system)
-  (native-inputs
-   (list idris2
-         zig
-         rust
-         rust-cargo
-         pkg-config))
-  (synopsis "Formally verified safety via Idris2")
-  (description
-   "Proven provides formally verified safety primitives using Idris2
-dependent types, with Zig FFI bindings and Rust integration.")
-  (license #f))