From 658d68b82e0feb0bec13c2e3916f56fa056f96fb Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 30 Aug 2026 13:06:10 +0100
Subject: [PATCH 1/4] fix(governance): grant allowlist Actions read access

---
 .github/workflows/governance-reusable.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml
index 6ed47ae5..d6b420a4 100644
--- a/.github/workflows/governance-reusable.yml
+++ b/.github/workflows/governance-reusable.yml
@@ -73,6 +73,7 @@ jobs:
     runs-on: ${{ inputs.runs-on }}
     timeout-minutes: 5
     permissions:
+      actions: read
       contents: read
     steps:
       - name: Checkout caller repository

From 8f2353497519ff88caf039d6c111e5a61638d383 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 30 Aug 2026 13:44:06 +0100
Subject: [PATCH 2/4] fix(actions-lock): honor structured valid verdict

---
 scripts/tests/actions-lock-update-test.sh | 8 ++++++++
 scripts/update-actions-lock.sh            | 7 ++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/scripts/tests/actions-lock-update-test.sh b/scripts/tests/actions-lock-update-test.sh
index 8ca997b5..debfffe7 100755
--- a/scripts/tests/actions-lock-update-test.sh
+++ b/scripts/tests/actions-lock-update-test.sh
@@ -46,6 +46,10 @@ if [ "${2:-}" = "--verify-local" ]; then
       printf '%s\n' 'not valid JSON'
       exit 0
       ;;
+    valid-with-warning)
+      printf '%s\n' '{"valid":true,"findings":[{"workflow":".github/workflows/ci.yml","category":"sha-as-ref","severity":"warning","dependency":"actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"}]}'
+      exit 1
+      ;;
     *)
       printf '%s\n' '{"valid":true,"findings":[]}'
       exit
@@ -96,6 +100,10 @@ cmp -s "$WORK/ci.before-verify" .github/workflows/ci.yml
 cmp -s "$WORK/lock.before-verify" .github/workflows/actions.lock
 echo "PASS: Actions lock verification restores tool-authored workflow edits"
 
+FAKE_VERIFY_FINDING=valid-with-warning GH_BIN="$WORK/bin/fake-gh" \
+  bash "$UPDATE" --verify-local .github/workflows >/dev/null
+echo "PASS: valid lock with advisory warning is accepted"
+
 cat > .github/workflows/reusable.yml <<'EOF'
 # SPDX-License-Identifier: MPL-2.0
 name: Reusable caller
diff --git a/scripts/update-actions-lock.sh b/scripts/update-actions-lock.sh
index ed9bd1ea..b8889c4e 100755
--- a/scripts/update-actions-lock.sh
+++ b/scripts/update-actions-lock.sh
@@ -71,7 +71,12 @@ verify_lock_coverage() {
     [[ "$status" -ne 0 ]] && return "$status"
     return 1
   fi
-  if printf '%s' "$result" | jq -e '.valid == true and (.findings | length == 0)' >/dev/null; then
+  # The verifier may exit non-zero while returning a valid lock plus advisory
+  # findings (for example, sha-as-ref traceability warnings). Once the output
+  # shape is established, its structured `valid` verdict is authoritative;
+  # warnings must remain visible without turning a valid lock into a failure.
+  if printf '%s' "$result" | jq -e '.valid == true' >/dev/null; then
+    printf '%s\n' "$result"
     return 0
   fi
 

From f0ffb0a79eb7e12089fa03a3b31b23c222bbb7af Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 30 Aug 2026 13:46:11 +0100
Subject: [PATCH 3/4] fix(governance): self-test PR-tree lock verifier

---
 .github/workflows/governance-reusable.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml
index d6b420a4..5e67a2eb 100644
--- a/.github/workflows/governance-reusable.yml
+++ b/.github/workflows/governance-reusable.yml
@@ -1178,7 +1178,11 @@ jobs:
           # standards helper is not present. Preserve the canonical helper
           # before removing this sparse standards checkout.
           LOCK_SCRIPT=".standards-dupkey/scripts/update-actions-lock.sh"
-          if [ ! -f "$LOCK_SCRIPT" ] && [ -f scripts/update-actions-lock.sh ]; then
+          # Standards must exercise the helper from its own PR tree or a broken
+          # helper can never validate its fix. Consumers may not substitute a
+          # repository-local verifier: they continue to use standards@main.
+          if [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] && \
+             [ -f scripts/update-actions-lock.sh ]; then
             LOCK_SCRIPT="scripts/update-actions-lock.sh"
             echo "Using this repository's own actions-lock verifier (standards self-lint)."
           fi

From ba4f354d7a3b551fbbbdb9cbf5bcc3bb4bda64f9 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 30 Aug 2026 13:49:20 +0100
Subject: [PATCH 4/4] fix(governance): keep live policy credential-scoped

---
 .github/workflows/governance-reusable.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml
index 5e67a2eb..16663383 100644
--- a/.github/workflows/governance-reusable.yml
+++ b/.github/workflows/governance-reusable.yml
@@ -73,7 +73,6 @@ jobs:
     runs-on: ${{ inputs.runs-on }}
     timeout-minutes: 5
     permissions:
-      actions: read
       contents: read
     steps:
       - name: Checkout caller repository