fix(ci): clear the two governance checks still red after #6

.github/workflows/actions.lock

@@ -1,4 +1,4 @@
 # This file is machine-generated by `gh actions-lock`.
 # Do not edit by hand; run `gh actions-lock` to update.
 # Docs: https://gh.io/actions-lockfile
 version: 'v0.0.3'
@@ -31,13 +31,13 @@
     '.github/workflows/estate-rules.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/governance.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/groove-check.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/guix-policy.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/hypatia-scan.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/k9-validate.yml':
         - 'actions/checkout@v7.0.1'
         - 'hyperpolymath/k9-ecosystem@main'
@@ -47,7 +47,7 @@
     '.github/workflows/main-estate-audit.yml':
         - 'hyperpolymath/cicd-suite@55556cf5ba71ba744695861503c13148d3915a5d'
     '.github/workflows/mirror.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/ossf-best-practices.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/pages.yml':
@@ -74,11 +74,11 @@
     '.github/workflows/runtime-policy.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/rust-ci.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/scorecard.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/secret-scanner.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/security-policy.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/sonarqube.yml':
@@ -162,6 +162,11 @@
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
+        ref: 'v2.0.5'
+        commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        owner_id: 42048915
+        repo_id: 356423100
     'dependabot/fetch-metadata@v3.1.0':
         ref: 'v3.1.0'
         commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98'
@@ -235,28 +240,35 @@
         commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
         owner_id: 6759885
         repo_id: 1352485172
-    'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3':
-        ref: 'ae36881b5ff4b469fb904b66542ac226a15107f3'
-        commit: 'sha1-ae36881b5ff4b469fb904b66542ac226a15107f3'
+    'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82':
+        ref: '934b879f6068295e42dac20d80e010d555ebec82'
+        commit: 'sha1-934b879f6068295e42dac20d80e010d555ebec82'
         owner_id: 6759885
         repo_id: 1116521501
         uses:
             - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
             - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
             - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+            - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
             - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f'
             - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
             - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
             - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
             - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406'
             - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
+            - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
             - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
             - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
     'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
         ref: '2d1146689b8cda280b9bc96326124645441f03bc'
         commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
         owner_id: 67707773
         repo_id: 421101922
+    'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
+        ref: 'v2.2.0'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635
     'oven-sh/setup-bun@v2.2.0':
         ref: 'v2.2.0'
         commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'

.github/workflows/governance.yml

@@ -18,4 +18,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82

.github/workflows/hypatia-scan.yml

@@ -27,4 +27,4 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82

.github/workflows/mirror.yml

@@ -13,7 +13,7 @@ permissions:
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82
     # Explicit secrets map — no `secrets: inherit` (Hypatia WH008, alert #131).
     # All seven are the callee's complete optional contract (standards
     # mirror-reusable.yml@da2c748); behaviour is unchanged, future secrets

.github/workflows/rust-ci.yml

@@ -16,4 +16,4 @@ permissions:
   contents: read
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82

.github/workflows/scorecard.yml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82
     # Reusable called-workflow permissions are CAPPED by the caller's grants;
     # without security-events: write here the scorecard SARIF upload fails with
     # startup_failure (hypatia WF018). id-token: write enables OIDC publish.

.github/workflows/secret-scanner.yml

@@ -26,4 +26,4 @@ jobs:
     # is therefore the cap GitHub applies to the called workflow.
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82

.machine_readable/arrival-pack/extract.sh

@@ -49,10 +49,18 @@
 # hash12 -> short content hash of stdin (drift provenance)
 hash12() { sha256sum | cut -c1-12; }
 
-# The uuid is derived from the header :repo-uuid name, never stored (deed.abnf).
+# The identity is the deed's own TYPED literal (#u5"<name>", later #u8"<domain:name>"),
+# never a computed hex uuid. The uuid is derived from that name and never
+# stored (deed.abnf); printing its hex form put a version-5 literal in
+# CLAUDE.md, which ADR-008's strict gate (owner ruling D320, standards
+# governance job uuid-v7-conformance) rejects in every minted repo. The
+# typed literal says what the identifier is, as ADR-008 asks of legacy ids,
+# and follows the deed when it moves to version 8.
 uuid_name="$(field '' repo-uuid)"
 uuid=""
-[ -z "$uuid_name" ] || uuid="$(bash "$READ" --uuid "$DEED")"
+[ -z "$uuid_name" ] || uuid="$(sed -n -E 's/^  :repo-uuid (#u[0-9]+"[^"]*").*/\1/p' "$DEED" | head -1)"
+[ -z "$uuid_name" ] || [ -n "$uuid" ] \
+  || { echo "extract.sh: $(basename "$DEED") :repo-uuid is not a typed #u<n>\"...\" literal" >&2; exit 2; }
 
 # read_clauses -> the clauses this pack reads, one token per line. Hashing only
 # these keeps an unrelated deed edit (say a canon-pin bump) from reading as drift.

CLAUDE.md

@@ -62,7 +62,7 @@ Put every question that needs the owner's decision through the selector (the Ask
 
 # This repo: `resource-algebra`  ·  clade `fv-resource-algebra`
 
-- **Identity** — uuid `241f1c29-0838-5033-b654-7f4c5e279ebc`; clade `fv` (secondary ``); born 2026-10-12; forge `hyperpolymath/resource-algebra`.
+- **Identity** — uuid `#u5"github.com/hyperpolymath/resource-algebra"`; clade `fv` (secondary ``); born 2026-10-12; forge `hyperpolymath/resource-algebra`.
 - **IS** — Parametric resource algebra in Agda, with Loss, MaxPlus, HWM and MinMax instances and strict/lax morphisms.
 - **IS-NOT** — a repository template · the K-CUT statement, which belongs in choreographic-types · occupancy-types' own algebra, for which HWM is a proposal
 - **Where it sits** — pipeline position **kernel**; chain `resource-algebra → hyperpolymath type family`; coordination = `standards`.