From 3702c48528a43d6e65d8d2c610cc30962300845f Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 26 Jul 2026 14:51:02 +0100
Subject: [PATCH 1/5] chore: estate-wide security compliance

---
 .github/workflows/architecture-enforcement.yml | 1 +
 .github/workflows/boj-build.yml                | 1 +
 .github/workflows/casket-pages.yml             | 1 +
 .github/workflows/cflite_batch.yml             | 1 +
 .github/workflows/cflite_pr.yml                | 1 +
 .github/workflows/chapel-ci.yml                | 1 +
 .github/workflows/clusterfuzzlite.yml          | 1 +
 .github/workflows/codeql.yml                   | 1 +
 .github/workflows/d-ci.yml                     | 1 +
 .github/workflows/dogfood-gate.yml             | 1 +
 .github/workflows/e2e.yml                      | 1 +
 .github/workflows/echidna-verify.yml           | 1 +
 .github/workflows/ffi-full-integration.yml     | 1 +
 .github/workflows/governance.yml               | 1 +
 .github/workflows/hypatia-scan.yml             | 1 +
 .github/workflows/idris2-ci.yml                | 1 +
 .github/workflows/instant-sync.yml             | 1 +
 .github/workflows/mirror.yml                   | 1 +
 .github/workflows/ocaml-ci.yml                 | 1 +
 .github/workflows/pages.yml                    | 1 +
 .github/workflows/publish-crates.yml           | 1 +
 .github/workflows/publish-ghcr.yml             | 1 +
 .github/workflows/publish-jsr.yml              | 1 +
 .github/workflows/publish-npm.yml              | 1 +
 .github/workflows/push-email-notify.yml        | 1 +
 .github/workflows/release.yml                  | 1 +
 .github/workflows/scorecard.yml                | 1 +
 .github/workflows/secret-scanner.yml           | 1 +
 .github/workflows/spark-theatre-gate.yml       | 1 +
 .github/workflows/trustfile.yml                | 1 +
 .github/workflows/zig-ffi.yml                  | 1 +
 31 files changed, 31 insertions(+)

diff --git a/.github/workflows/architecture-enforcement.yml b/.github/workflows/architecture-enforcement.yml
index a0ffd539..96b4e85e 100644
--- a/.github/workflows/architecture-enforcement.yml
+++ b/.github/workflows/architecture-enforcement.yml
@@ -8,6 +8,7 @@ on:
   push:
     branches: [main, develop]
 permissions:
+  actions: read
   contents: read
 # Cancel superseded runs on the same ref so a rapid sequence of pushes
 # to a feature branch does not pile up jobs against the Pro-plan 40-job
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index 3f87bb2d..7a5e7b82 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -7,6 +7,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 670f3959..0938eacc 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -7,6 +7,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml
index 5555a676..3a7ffa6a 100644
--- a/.github/workflows/cflite_batch.yml
+++ b/.github/workflows/cflite_batch.yml
@@ -3,6 +3,7 @@ name: ClusterFuzzLite Batch
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   schedule:
diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml
index 1507c6f3..2272aa64 100644
--- a/.github/workflows/cflite_pr.yml
+++ b/.github/workflows/cflite_pr.yml
@@ -3,6 +3,7 @@ name: ClusterFuzzLite PR
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   pull_request:
diff --git a/.github/workflows/chapel-ci.yml b/.github/workflows/chapel-ci.yml
index 57c249a4..55ea0697 100644
--- a/.github/workflows/chapel-ci.yml
+++ b/.github/workflows/chapel-ci.yml
@@ -24,6 +24,7 @@
 
 name: Chapel CI
 permissions:
+  actions: read
   contents: read
 on:
   push:
diff --git a/.github/workflows/clusterfuzzlite.yml b/.github/workflows/clusterfuzzlite.yml
index 49f366bc..dbf30706 100644
--- a/.github/workflows/clusterfuzzlite.yml
+++ b/.github/workflows/clusterfuzzlite.yml
@@ -22,6 +22,7 @@ on:
     - cron: '0 2 * * 0' # Sunday 02:00 UTC
   workflow_dispatch:
 permissions: read-all
+  actions: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 609b3926..9271c853 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -17,6 +17,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   analyze:
diff --git a/.github/workflows/d-ci.yml b/.github/workflows/d-ci.yml
index 868d7ac4..a1021189 100644
--- a/.github/workflows/d-ci.yml
+++ b/.github/workflows/d-ci.yml
@@ -8,6 +8,7 @@
 
 name: D CI
 permissions:
+  actions: read
   contents: read
 on:
   push:
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 9663536e..5d433913 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -13,6 +13,7 @@ on:
   push:
     branches: [main, master]
 permissions:
+  actions: read
   contents: read
 jobs:
   # ---------------------------------------------------------------------------
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 75a45e36..f65350db 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -27,6 +27,7 @@ on:
       - 'bindings/**'
   workflow_dispatch:
 permissions: read-all
+  actions: read
 concurrency:
   group: e2e-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/echidna-verify.yml b/.github/workflows/echidna-verify.yml
index 3cd7ef57..0ba5b1c0 100644
--- a/.github/workflows/echidna-verify.yml
+++ b/.github/workflows/echidna-verify.yml
@@ -37,6 +37,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   agda-lol:
diff --git a/.github/workflows/ffi-full-integration.yml b/.github/workflows/ffi-full-integration.yml
index 2d8f3c2d..e8487f65 100644
--- a/.github/workflows/ffi-full-integration.yml
+++ b/.github/workflows/ffi-full-integration.yml
@@ -5,6 +5,7 @@ name: FFI Full Integration
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   push:
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 8776de07..966a16e9 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 9dde27ac..556e8e0b 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -11,6 +11,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 
diff --git a/.github/workflows/idris2-ci.yml b/.github/workflows/idris2-ci.yml
index 26b153d6..ad82d55b 100644
--- a/.github/workflows/idris2-ci.yml
+++ b/.github/workflows/idris2-ci.yml
@@ -3,6 +3,7 @@ name: Idris 2 CI
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   push:
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index fc339ac7..88ea4014 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -10,6 +10,7 @@ on:
   release:
     types: [published]
 permissions:
+  actions: read
   contents: read
 jobs:
   dispatch:
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 0c0d01a2..e1f3ee20 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -7,6 +7,7 @@ on:
     branches: [main]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   mirror:
diff --git a/.github/workflows/ocaml-ci.yml b/.github/workflows/ocaml-ci.yml
index efbb6ef6..7a46fab6 100644
--- a/.github/workflows/ocaml-ci.yml
+++ b/.github/workflows/ocaml-ci.yml
@@ -8,6 +8,7 @@
 
 name: OCaml CI
 permissions:
+  actions: read
   contents: read
 on:
   push:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index c78489a6..02734375 100755
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -5,6 +5,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml
index 6f64ea76..c8b37aab 100644
--- a/.github/workflows/publish-crates.yml
+++ b/.github/workflows/publish-crates.yml
@@ -13,6 +13,7 @@ on:
         default: 'true'
         type: boolean
 permissions:
+  actions: read
   contents: read
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
diff --git a/.github/workflows/publish-ghcr.yml b/.github/workflows/publish-ghcr.yml
index ebc18cd3..88989da0 100644
--- a/.github/workflows/publish-ghcr.yml
+++ b/.github/workflows/publish-ghcr.yml
@@ -8,6 +8,7 @@ on:
     types: [published]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   packages: write
 jobs:
diff --git a/.github/workflows/publish-jsr.yml b/.github/workflows/publish-jsr.yml
index 3cdbb369..4ab58c87 100644
--- a/.github/workflows/publish-jsr.yml
+++ b/.github/workflows/publish-jsr.yml
@@ -15,6 +15,7 @@ on:
         default: 'true'
         type: boolean
 permissions:
+  actions: read
   contents: read
 jobs:
   publish:
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 86cb6d45..780297f3 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -24,6 +24,7 @@ on:
           - javascript
           - typescript
 permissions:
+  actions: read
   contents: read
 jobs:
   publish-javascript:
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 4b4e754b..112afd18 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -7,6 +7,7 @@ name: Push email notification
 on:
   push: {}
 permissions:
+  actions: read
   contents: read
 jobs:
   notify:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 92b38071..14a7c460 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,6 +29,7 @@ on:
         default: true
         type: boolean
 permissions:
+  actions: read
   contents: read
 jobs:
   validate:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b97e2cbc..cede40a4 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 9abbb333..5b6a2b67 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -10,6 +10,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   scan:
diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml
index 7004b5b2..12d40f7f 100644
--- a/.github/workflows/spark-theatre-gate.yml
+++ b/.github/workflows/spark-theatre-gate.yml
@@ -11,6 +11,7 @@ on:
   push:
     branches: [main, master]
 permissions:
+  actions: read
   contents: read
 jobs:
   spark-theatre-gate:
diff --git a/.github/workflows/trustfile.yml b/.github/workflows/trustfile.yml
index 41238386..1366960e 100644
--- a/.github/workflows/trustfile.yml
+++ b/.github/workflows/trustfile.yml
@@ -16,6 +16,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/zig-ffi.yml b/.github/workflows/zig-ffi.yml
index bdcf13e7..33c1ab21 100644
--- a/.github/workflows/zig-ffi.yml
+++ b/.github/workflows/zig-ffi.yml
@@ -3,6 +3,7 @@ name: Zig FFI Build
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 permissions:
+  actions: read
   contents: read
 on:
   push:

From cca034120a779cda8ccc356fb9ee740aec626830 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 26 Jul 2026 15:11:08 +0100
Subject: [PATCH 2/5] chore: remove duplicate GOVERNANCE files, keep
 GOVERNANCE.md

---
 GOVERNANCE.adoc | 162 ------------------------------------------------
 1 file changed, 162 deletions(-)
 delete mode 100644 GOVERNANCE.adoc

diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc
deleted file mode 100644
index e41020d3..00000000
--- a/GOVERNANCE.adoc
+++ /dev/null
@@ -1,162 +0,0 @@
-// SPDX-License-Identifier: CC-BY-SA-4.0
-// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-= Governance Model
-:toc: preamble
-
-This document describes the governance model for this repository.
-
-== Overview
-
-This repository follows a **Sole Maintainer Governance Model**:
-
-* Single maintainer (@hyperpolymath) has full authority over the project
-* All contributions are welcome and reviewed by the maintainer
-* Decisions are made transparently through GitHub issues and discussions
-* The project adheres to the hyperpolymath estate policies where applicable
-
-== Core Principles
-
-[cols="1,2"]
-|===
-| Principle | Description
-
-| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input
-
-| **Meritocracy** | Contributions are judged on technical merit, not contributor identity
-
-| **Transparency** | All significant decisions are documented publicly
-
-| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary
-
-| **Open Contribution** | Anyone can contribute via fork and pull request
-
-|===
-
-== Roles and Permissions
-
-[cols="1,2,2"]
-|===
-| Role | Permissions | Assignment
-
-| **Maintainer** | Write access, merge rights, admin | @hyperpolymath
-| **Contributors** | Read access, fork, submit PRs | All GitHub users
-| **Users** | Use the software, report issues | All GitHub users
-
-|===
-
-== Decision Making Framework
-
-=== Routine Decisions
-
-* Bug fixes
-* Documentation improvements
-* Minor feature additions
-* Dependency updates
-
-**Process**: Maintainer reviews and merges PRs that meet quality standards.
-
-=== Significant Changes
-
-* New major features
-* API changes
-* Architecture modifications
-* Breaking changes
-
-**Process**:
-. Open issue describing the change
-. Discuss with community (minimum 72 hours)
-. Maintainer makes final decision
-. Document rationale in issue/PR
-
-=== Structural Decisions
-
-* Repository purpose/renaming
-* License changes
-* Ownership transfer
-* Deprecation/archival
-
-**Process**: 
-. Extended discussion (minimum 1 week)
-. Maintainer makes final decision
-. Document in CHANGELOG and governance docs
-
-== Contribution Lifecycle
-
-[cols="1,2"]
-|===
-| Stage | Process
-
-| **Ideation** | Open issue, discuss feasibility
-
-| **Development** | Fork, implement, test thoroughly
-
-| **Review** | Submit PR, maintainer reviews within 7 days
-
-| **Merge** | Maintainer merges or requests changes
-
-| **Release** | Maintainer publishes according to project conventions
-
-|===
-
-== Conflict Resolution
-
-In case of disagreements:
-
-. Discuss in the relevant GitHub issue or PR
-. Provide technical justification for positions
-. Maintainer mediates and makes final decision
-. Decision is documented and can be revisited later
-
-== Project Policies
-
-This repository adheres to hyperpolymath estate-wide policies:
-
-* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc)
-* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md
-* **Security**: Follows hyperpolymath SECURITY.md
-* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions
-
-== Repository-Specific Conventions
-
-[cols="1,2"]
-|===
-| Convention | Description
-
-| **Signing** | All commits must be signed (SSH or GPG)
-
-| **SPDX Headers** | All source files must have SPDX license identifiers
-
-| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root
-
-| **Machine Readable** | META.a2ml in .machine_readable/6a2/
-
-| **CI/CD** | GitHub Actions workflows in .github/workflows/
-
-|===
-
-== Governance Evolution
-
-As the project grows, this governance model may evolve:
-
-* **Adding Co-Maintainers**: When contribution volume warrants it
-* **Forming a Team**: For complex multi-maintainer projects
-* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories)
-
-Changes to this document require the same process as Significant Changes above.
-
-== See Also
-
-* link:MAINTAINERS.adoc[Maintainers]
-* link:CODE_OF_CONDUCT.md[Code of Conduct]
-* link:CONTRIBUTING.adoc[Contributing Guide]
-* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy]
-* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)]
-
-== Changelog
-
-[cols="1,1,1"]
-|===
-| Date | Change | By
-
-| 2026-06-07 | Initial governance model established | @hyperpolymath
-|===

From 720f5e6d413cc427db46efde3053f06bd64b653d Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 26 Jul 2026 16:04:22 +0100
Subject: [PATCH 3/5] chore: update guix.scm from squisher-corpus

---
 guix.scm | 32 ++++++++++----------------------
 1 file changed, 10 insertions(+), 22 deletions(-)

diff --git a/guix.scm b/guix.scm
index addc1378..c6dd7be8 100644
--- a/guix.scm
+++ b/guix.scm
@@ -1,30 +1,18 @@
-;; SPDX-License-Identifier: MPL-2.0
-;; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)
-;;
-;; Guix development environment for proven.
-;; Usage: guix shell -D -f guix.scm
+; SPDX-License-Identifier: MPL-2.0
+;; guix.scm — GNU Guix package definition for squisher-corpus
+;; Usage: guix shell -f guix.scm
 
 (use-modules (guix packages)
              (guix build-system gnu)
-             (gnu packages idris)
-             (gnu packages zig)
-             (gnu packages rust)
-             (gnu packages crates-io)
-             (gnu packages pkg-config))
+             (guix licenses))
 
 (package
-  (name "proven")
+  (name "squisher-corpus")
   (version "0.1.0")
   (source #f)
   (build-system gnu-build-system)
-  (native-inputs
-   (list idris2
-         zig
-         rust
-         rust-cargo
-         pkg-config))
-  (synopsis "Formally verified safety via Idris2")
-  (description
-   "Proven provides formally verified safety primitives using Idris2
-dependent types, with Zig FFI bindings and Rust integration.")
-  (license #f))
+  (synopsis "squisher-corpus")
+  (description "squisher-corpus — part of the hyperpolymath ecosystem.")
+  (home-page "https://github.com/hyperpolymath/squisher-corpus")
+  (license ((@@ (guix licenses) license) "PMPL-1.0-or-later"
+             "https://github.com/hyperpolymath/palimpsest-license")))

From b819caf5ef3c8dc22e7a0ff8d8110637879c76d4 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 13 Aug 2026 01:44:50 +0100
Subject: [PATCH 4/5] fix(ci): remove erroneous squisher-corpus guix.scm
 placeholder

Part of estate-wide standards#426 remediation - cleanup.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
---
 guix.scm | 18 ------------------
 1 file changed, 18 deletions(-)
 delete mode 100644 guix.scm

diff --git a/guix.scm b/guix.scm
deleted file mode 100644
index c6dd7be8..00000000
--- a/guix.scm
+++ /dev/null
@@ -1,18 +0,0 @@
-; SPDX-License-Identifier: MPL-2.0
-;; guix.scm — GNU Guix package definition for squisher-corpus
-;; Usage: guix shell -f guix.scm
-
-(use-modules (guix packages)
-             (guix build-system gnu)
-             (guix licenses))
-
-(package
-  (name "squisher-corpus")
-  (version "0.1.0")
-  (source #f)
-  (build-system gnu-build-system)
-  (synopsis "squisher-corpus")
-  (description "squisher-corpus — part of the hyperpolymath ecosystem.")
-  (home-page "https://github.com/hyperpolymath/squisher-corpus")
-  (license ((@@ (guix licenses) license) "PMPL-1.0-or-later"
-             "https://github.com/hyperpolymath/palimpsest-license")))

From ed591015a9832a52071b40b743f8a2e303e65b1b Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 13 Aug 2026 03:48:47 +0100
Subject: [PATCH 5/5] fix(ci): update reusable workflow SHAs to
 @7fdc2705df74b4e352d2a1cde3e87a5923fdf329

Part of estate-wide standards#426 remediation - Batch 11 SHA update.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
---
 .github/workflows/mirror.yml             | 2 +-
 .github/workflows/secret-scanner.yml     | 2 +-
 .github/workflows/spark-theatre-gate.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index e1f3ee20..a3d4c41d 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -11,5 +11,5 @@ permissions:
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 5b6a2b67..30ddde5f 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -18,5 +18,5 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml
index 12d40f7f..fa61d352 100644
--- a/.github/workflows/spark-theatre-gate.yml
+++ b/.github/workflows/spark-theatre-gate.yml
@@ -15,7 +15,7 @@ permissions:
   contents: read
 jobs:
   spark-theatre-gate:
-    uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     with:
       paths: "."
       enforce_zero_contract: false