feat(rules): detect the three workflow-pin defect classes behind the estate's dead Rust CI

.claude/CLAUDE.md

@@ -13,7 +13,7 @@ Hypatia is the neurosymbolic CI/CD intelligence layer for the hyperpolymath ecos
 ## Architecture
 
 ```
-Hypatia                       # 141 Elixir modules total (`shopt -s globstar; ls lib/**/*.ex | wc -l`)
+Hypatia                       # 142 Elixir modules total (`shopt -s globstar; ls lib/**/*.ex | wc -l`)
 ├── Elixir pipeline          # core: pattern analysis, dispatch, learning
 ├── Merge orchestration       # 12 modules — leases, ledger, ticker (largest subsystem)
 ├── Kin subsystem             # 6 modules — contingency, arbiter, gate, watchdog

.github/workflows/hypatia-scan.yml

@@ -25,5 +25,6 @@ jobs:
     # Scanner pin: see governance.yml. Drop once `uses:` is re-pinned.
     with:
       hypatia-ref: aa34a4cc6ba39d873710ff39763fdb9cde715f9d
+    # Only the one secret the callee declares (standards#1108 §6b).
     secrets:
       HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}

.github/workflows/mirror.yml

@@ -42,6 +42,7 @@ permissions:
 jobs:
   mirror:
     uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7
+    # Only the seven forge keys the callee declares (standards#1108 §6b).
     secrets:
       GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
       BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}

.gitleaksignore

@@ -1,9 +1,21 @@
 # SPDX-License-Identifier: MPL-2.0
-# Historical false positives, scoped to these exact commit/path/rule/line findings.
-# Prometheus recording-rule identifier for API latency, not a credential.
-269dac03d57835a1dfe3fb336095ffac61567ccf:deploy/terraform/modules/monitoring/main.tf:generic-api-key:421
-# Kubernetes template values all decode to the literal CHANGE_ME_IN_PRODUCTION.
+#
+# Exact historical fingerprints only (commit:file:rule:line). The full-history
+# gitleaks pass in hyperpolymath/standards secret-scanner-reusable.yml scans
+# every commit; these five matches sit in two files that f2fe2df removed from
+# the tree. Each entry names what the matched value is. None of them suppresses
+# a rule in any new commit or location.
+#
+# deploy/k8s/secrets.yaml at 0d310fa is a Secret TEMPLATE. Each of the four
+# values is base64 of the placeholder CHANGE_ME_IN_PRODUCTION, as the comment
+# above each line says. Checked 2026-10-19 by comparing every value against
+# the encoded placeholder.
 0d310faa0d74da36faa8f5cfb5b6786ebe912c1b:deploy/k8s/secrets.yaml:generic-api-key:38
 0d310faa0d74da36faa8f5cfb5b6786ebe912c1b:deploy/k8s/secrets.yaml:generic-api-key:40
 0d310faa0d74da36faa8f5cfb5b6786ebe912c1b:deploy/k8s/secrets.yaml:generic-api-key:44
 0d310faa0d74da36faa8f5cfb5b6786ebe912c1b:deploy/k8s/secrets.yaml:generic-api-key:50
+#
+# deploy/terraform/modules/monitoring/main.tf at 269dac0, line 421, is a
+# Prometheus recording-rule name (record = "cicd_hyper_a:api:<name>"). It is
+# a metric identifier, not a credential.
+269dac03d57835a1dfe3fb336095ffac61567ccf:deploy/terraform/modules/monitoring/main.tf:generic-api-key:421

.machine_readable/descriptiles/AGENTIC.a2ml

@@ -40,6 +40,23 @@ require-rerun-after-fix = true
 release-claim-requires-hard-pass = true
 completion-claim-requires-behavioural-tests = true
 
+[workflow-pin-detection]
+# Hypatia's half of the pin-propagation architecture
+#   hypatia (this: detection) -> gitbot-fleet (actuation) -> .git-private-farm (propagation)
+# Every rule here has a fleet fix script that carries the SAME facts, so a
+# detection without a repair, or a repair without a detection, is a drift:
+#   WF026  workflow_audit.ex  SHA-pinned dtolnay/rust-toolchain with no toolchain: input   -> fleet fix-rust-toolchain-input.sh
+#          (detected in block YAML and KYAML/flow style alike, Y-3; repaired in block style only —
+#          a KYAML, flow-step, anchored or aliased finding carries auto_fixable: false and routes to review)
+#   WF027  workflow_audit.ex  caller pinned at a reusable revision MEASURED dead (table)     -> fleet fix-stale-reusable-pin.sh (Window A)
+#   PIN-003 pr-automerge-policy.json  standards revisions whose own actions.lock GitHub
+#          rejects at job setup (545 commits, 2026-08-19..2026-10-19; PI001/PA001 fire)    -> fleet fix-stale-reusable-pin.sh (Window B)
+#   known_reusables (sha_bump_propagation.ex) now include hyperpolymath/cicd-suite's gates
+may-extend-dead-revision-tables = true     # only from a MEASURED walk (file content or lock record checked per commit), never from dates
+may-name-a-replacement-revision = false    # a human chooses it against standards/scripts/lock-selfcheck.sh; agents carry the choice into the table
+must-mirror-fleet-tables = true            # WF027's list == fleet stale-reusable-pins.tsv Window A; PIN-003 == Window B; regenerate together
+must-not-promote-to-blocking = true        # these rules report and route to the fleet; a gate that blocks on them is an owner decision
+
 [automation-hooks]
 on-enter = [
   "Read 0-AI-MANIFEST.a2ml or AI.a2ml first",