From 22f46fb53e54c7ffa45cd4cf5820d1c1d54f84cd Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 22:30:33 +0000 Subject: [PATCH 1/3] fix(ci): call standards reusables at metadatastician/standards MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit standards moved from hyperpolymath to metadatastician, and GitHub does not follow the rename for reusable workflows. Every job calling hyperpolymath/standards/... fails before it starts, e.g. governance run 40463073589: "hyperpolymath/standards/.github/workflows/ governance-reusable.yml@3c00687…: workflow was not found". The six job-level `uses:` move to the canonical owner and keep their immutable pin, 3c00687 (standards playbook docs/compliance/repo-transfer-to-enterprise-playbook.adoc §4). actions.lock is rekeyed by standards' scripts/relock-standards-pin.sh (the owner-transfer support from standards#1391): the six workflow entries and the standards record move to the new key, owner_id becomes 297579217, repo_id is unchanged. A second run reports nothing to do. Checked with standards' own tools at main: check-lock-sync (in sync), close-lock --check (closed), check-workflow-coordinates (no former-owner coordinates in 35 workflows), and check-lock-pin-contract (the same 18 pre-existing findings as main, none added; that gate does not run at this pin). Standards' lock at 3c00687 passes the pin contract. actionlint is clean on the six workflows. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JHfuPCv1pEiqkQGG5DQASb --- .github/workflows/actions.lock | 16 ++++++++-------- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/spark-theatre-gate.yml | 2 +- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 4bc4f2e0..ab7ebb43 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -46,9 +46,9 @@ workflows: - 'actions/attest-build-provenance@v4.2.2' - 'actions/checkout@v7.0.1' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/idris2-abi-ci.yml': - 'actions/checkout@v7.0.1' '.github/workflows/label-triage.yml': [] @@ -58,7 +58,7 @@ workflows: - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.3' '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/mvp-smoke.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' @@ -81,16 +81,16 @@ workflows: - 'swatinem/rust-cache@v2.9.3' - 'taiki-e/install-action@v2.87.32' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/security-scan.yml': [] '.github/workflows/server-boot-gate.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.3' '.github/workflows/spark-theatre-gate.yml': - - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - 'actions/download-artifact@v8.0.2' @@ -229,10 +229,10 @@ dependencies: commit: 'sha1-4c772eb235b04455307d5c03cbbc4f45130f7f0f' owner_id: 6759885 repo_id: 1326697643 - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0': + 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0': ref: '3c00687a5bbd0d881d351db8502417b5d0a8b0b0' commit: 'sha1-3c00687a5bbd0d881d351db8502417b5d0a8b0b0' - owner_id: 6759885 + owner_id: 297579217 repo_id: 1116521501 uses: - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index a8d0dc85..f4f276b6 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,4 +18,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 76f80191..9bbf3236 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -21,6 +21,6 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }} diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index a623e1ba..c2a07042 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -24,7 +24,7 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 14b23c3a..bd5c1140 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,4 +26,4 @@ jobs: security-events: write id-token: write contents: read - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index fd1c6e17..04bb8f12 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -23,4 +23,4 @@ jobs: # caller must grant at least that or the run startup-fails. permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index ca2b37c9..c4c7e03a 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -20,7 +20,7 @@ permissions: jobs: spark-theatre-gate: - uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/spark-theatre-gate.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) with: paths: "." enforce_zero_contract: false From dd46278836d636cefc28bb2889523be4dcd61b1a Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 22:35:06 +0000 Subject: [PATCH 2/3] fix(ci): pin the standards reusables at standards main (087f6bf) The first push kept the pre-transfer pin 3c00687. The callers then started, but governance / Allowlist Preflight failed on all six calls (run 41925934029): at 3c00687 the reusable checks against its own tree canon, rhodium-standard-repositories/actions-allowlist/allowed-actions.json, which predates the transfer pattern. Any pin older than standards#1367 fails this way once its coordinate is canonical. 087f6bf is standards main. scripts/lock-selfcheck.sh rates it SELF-CONSISTENT, the selection step standards#1391's rollout guard asks for. Its tree canon carries metadatastician/standards/.github/workflows/*@*, and the preflight run offline with it gives 0 of 27 refs uncovered (6 before). relock-standards-pin.sh moves the lock to the new pin and adds actions/download-artifact@9000827 (v8.0.2), which the reusables use at 087f6bf. Unchanged: lock-sync in sync, close-lock closed, no former-owner coordinates, the same 18 pin-contract findings as main, actionlint clean. The call-site comments now name the new pin and the hypatia-ref default it vets (adb2f41d). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JHfuPCv1pEiqkQGG5DQASb --- .github/workflows/actions.lock | 24 +++++++++++++++--------- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/spark-theatre-gate.yml | 2 +- 7 files changed, 21 insertions(+), 15 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index ab7ebb43..d7165c14 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -46,9 +46,9 @@ workflows: - 'actions/attest-build-provenance@v4.2.2' - 'actions/checkout@v7.0.1' '.github/workflows/governance.yml': - - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@087f6bff5135ce3da6f287c83752256ce4a8efc1' '.github/workflows/hypatia-scan.yml': - - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@087f6bff5135ce3da6f287c83752256ce4a8efc1' '.github/workflows/idris2-abi-ci.yml': - 'actions/checkout@v7.0.1' '.github/workflows/label-triage.yml': [] @@ -58,7 +58,7 @@ workflows: - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.3' '.github/workflows/mirror.yml': - - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@087f6bff5135ce3da6f287c83752256ce4a8efc1' '.github/workflows/mvp-smoke.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' @@ -81,16 +81,16 @@ workflows: - 'swatinem/rust-cache@v2.9.3' - 'taiki-e/install-action@v2.87.32' '.github/workflows/scorecard.yml': - - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@087f6bff5135ce3da6f287c83752256ce4a8efc1' '.github/workflows/secret-scanner.yml': - - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@087f6bff5135ce3da6f287c83752256ce4a8efc1' '.github/workflows/security-scan.yml': [] '.github/workflows/server-boot-gate.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.3' '.github/workflows/spark-theatre-gate.yml': - - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + - 'metadatastician/standards@087f6bff5135ce3da6f287c83752256ce4a8efc1' '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - 'actions/download-artifact@v8.0.2' @@ -142,6 +142,11 @@ dependencies: commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346' owner_id: 44036562 repo_id: 438112499 + 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333': + ref: 'v8.0.2' + commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' + owner_id: 44036562 + repo_id: 192626254 'actions/download-artifact@v8.0.2': ref: 'v8.0.2' commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' @@ -229,14 +234,15 @@ dependencies: commit: 'sha1-4c772eb235b04455307d5c03cbbc4f45130f7f0f' owner_id: 6759885 repo_id: 1326697643 - 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0': - ref: '3c00687a5bbd0d881d351db8502417b5d0a8b0b0' - commit: 'sha1-3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + 'metadatastician/standards@087f6bff5135ce3da6f287c83752256ce4a8efc1': + ref: '087f6bff5135ce3da6f287c83752256ce4a8efc1' + commit: 'sha1-087f6bff5135ce3da6f287c83752256ce4a8efc1' owner_id: 297579217 repo_id: 1116521501 uses: - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index f4f276b6..b673c5b9 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,4 +18,4 @@ permissions: jobs: governance: - uses: metadatastician/standards/.github/workflows/governance-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@087f6bff5135ce3da6f287c83752256ce4a8efc1 # main 2026-11-04, standards#1395 hypatia-ref adb2f41d (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9bbf3236..ea4a25ce 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -21,6 +21,6 @@ permissions: jobs: hypatia: - uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@087f6bff5135ce3da6f287c83752256ce4a8efc1 # main 2026-11-04, standards#1395 hypatia-ref adb2f41d (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }} diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c2a07042..ac87a3ba 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -24,7 +24,7 @@ permissions: jobs: mirror: - uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@087f6bff5135ce3da6f287c83752256ce4a8efc1 # main 2026-11-04, standards#1395 hypatia-ref adb2f41d (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index bd5c1140..6a165506 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,4 +26,4 @@ jobs: security-events: write id-token: write contents: read - uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@087f6bff5135ce3da6f287c83752256ce4a8efc1 # main 2026-11-04, standards#1395 hypatia-ref adb2f41d (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 04bb8f12..aff0d210 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -23,4 +23,4 @@ jobs: # caller must grant at least that or the run startup-fails. permissions: contents: read - uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@087f6bff5135ce3da6f287c83752256ce4a8efc1 # main 2026-11-04, standards#1395 hypatia-ref adb2f41d (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index c4c7e03a..8fb4e0e1 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -20,7 +20,7 @@ permissions: jobs: spark-theatre-gate: - uses: metadatastician/standards/.github/workflows/spark-theatre-gate.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: metadatastician/standards/.github/workflows/spark-theatre-gate.yml@087f6bff5135ce3da6f287c83752256ce4a8efc1 # main 2026-11-04, standards#1395 hypatia-ref adb2f41d (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) with: paths: "." enforce_zero_contract: false From 5ab6c1369099bbce655b7ab317e5d4fe62f44b79 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 5 Nov 2026 00:49:15 +0000 Subject: [PATCH 3/3] fix(contractile): A040 sees standards callers under the new owner After the repoint, adjust-shas-stale still grepped only for `uses: hyperpolymath/standards/...`, found none of the six callers, and the A040 staleness audit went silent (Codex review on #458). The probe now matches either owner, so it reports current callers and any caller still on the old coordinate. `just -f contractile.just adjust-shas-stale` lists the callers again (it found none before this change). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JHfuPCv1pEiqkQGG5DQASb --- contractile.just | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contractile.just b/contractile.just index 116b621e..eb378012 100644 --- a/contractile.just +++ b/contractile.just @@ -114,7 +114,7 @@ adjust-julia-outdated: adjust-shas-stale: @echo 'A040: Standards reusable SHA pin staleness' - @grep -rE 'uses: hyperpolymath/standards/.+@[0-9a-f]{40}' .github/workflows/ 2>/dev/null | head -5 || echo 'A040 SKIP: no standards-reusable callers' + @grep -rE 'uses: (metadatastician|hyperpolymath)/standards/.+@[0-9a-f]{40}' .github/workflows/ 2>/dev/null | head -5 || echo 'A040 SKIP: no standards-reusable callers' # ── BUST (Breakage / Rollback) ──────────────────────────────────────── # Source: .machine_readable/contractiles/bust/Bustfile.a2ml