diff --git a/.github/workflows/ijson-jcs.yml b/.github/workflows/ijson-jcs.yml
index d3cbfe14..813462f8 100644
--- a/.github/workflows/ijson-jcs.yml
+++ b/.github/workflows/ijson-jcs.yml
@@ -1,8 +1,9 @@
 # SPDX-License-Identifier: MPL-2.0
 # Local dogfood gate for 3-practice/JSON-POLICY.adoc (owner ruling D306):
 # every .json / .jsonl is I-JSON (RFC 7493) + JCS (RFC 8785) canonical.
-# REPORT-ONLY: the scan lists non-canonical files and exits 0. The test step
-# is what can fail, and it proves the scan can tell the three verdicts apart.
+# The repo-wide scan is REPORT-ONLY: it lists non-canonical files and exits 0.
+# Its test step can fail, and proves the scan can tell the three verdicts apart.
+# The converted-stay-canonical job BLOCKS, but only on files already converted.
 name: ijson-jcs conformance
 
 on:
@@ -30,3 +31,19 @@ jobs:
       - run: cargo install --git https://github.com/hyperpolymath/ijson-jcs --rev 0fdeea716fd558e9807362acf6f8202d56d8d88f --locked ijson-jcs
       - run: bash scripts/tests/check-ijson-jcs-test.sh
       - run: scripts/check-ijson-jcs.sh .
+
+  # BLOCKING, for converted files only (JSON-POLICY §6). A file listed here was
+  # canonicalised under an owner ruling and must not drift back to an indented
+  # layout on its next jq edit. The report-only scan above cannot catch that.
+  # Fix a failure with `ijson-jcs fix <file>`.
+  converted-stay-canonical:
+    name: Converted JSON stays canonical
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Pinned to a commit: ijson-jcs has no releases yet.
+      - run: cargo install --git https://github.com/hyperpolymath/ijson-jcs --rev 0fdeea716fd558e9807362acf6f8202d56d8d88f --locked ijson-jcs
+      - run: scripts/check-ijson-jcs.sh --enforce .hypatia-baseline.json
diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json
index 06aa24e7..08e86d8c 100644
--- a/.hypatia-baseline.json
+++ b/.hypatia-baseline.json
@@ -1,516 +1 @@
-[
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "js_exec_sync",
-  "file": "1-formats/k9/tools/conformance-report.mjs",
-  "note": "FALSE POSITIVE (CI triage 2026-10-18): Hypatia 51ab6496 matches the node:child_process import itself. The reporter uses spawnSync(command, args) with separate argument arrays and shell disabled by default; no command string is evaluated by a shell. Keep argv-only execution when extending this reporter."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "js_exec_sync",
-  "file": "1-formats/k9/tools/conformance-report.test.mjs",
-  "note": "FALSE POSITIVE (CI triage 2026-10-18): Hypatia 51ab6496 matches the node:child_process import itself. These tests use spawnSync with separate argument arrays and shell disabled by default to run git and Bash fixture scripts; no shell command interpolation occurs. The subprocesses verify that failed or missing validator evidence cannot pass."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "unwrap_without_check",
-  "file": "9-archive/rhodium-standard-repositories/examples/enterprise-service/benches/api_benchmarks.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Benchmark harness setup; panic on runtime-creation failure is the intended and only sensible failure mode. Not a DoS surface. Rule should exclude benches/ directories."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": ".github/workflows/changelog-reusable.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; write perms are job-scoped and required to open the changelog PR. Baseline permanently."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": ".github/workflows/hypatia-scan-reusable.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; security-events:write is the minimum for SARIF upload, not excess privilege. Baseline permanently."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": ".github/workflows/hypatia-scan.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; the permissions block is deliberate and documented in-file. Baseline permanently."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": ".github/workflows/scorecard.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Stale 46-day-old mirror (standards#378) against a file since renamed to scorecard-enforcer.yml/scorecard-reusable.yml; the missing_requirement alert has no current target."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "1-formats/k9/register.ncl",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doubly false: CSA mirror double-report (#378) AND underlying ncl_http_url matched XML namespace identifiers which are opaque strings, never dereferenced. 1-formats/k9/** carved out to #491."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "2-protocols/overlay/ffi/zig/src/main.zig",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own SARIF alert (standards#378). Underlying @ptrCast is already emitted by the primary code_safety rule; the CSA copy is a duplicate."
- },
- {
-  "severity": "medium",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "9-archive/rhodium-standard-repositories/templates/setup.sh.template",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of the Scorecard alert; file also lives under the #493 eviction carve-out. Baseline permanently as a mirror."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "9-archive/rhodium-standard-repositories/templates/setup.sh.template",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378 of a Scorecard alert; file lives in rhodium-standard-repositories, carve-out #493 (template awaiting eviction). Re-acked 2026-10-14 (P1.1): CSA findings echo live Scorecard alert state and cannot be re-verified from the tree; the pinned scanner emitted no CSA finding on main (dead PAT), so this ack is kept as the tripwire #957 describes until that issue is ruled. Tracker #378 was closed.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#957"
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "setup.sh",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own alert (standards#378). Underlying curl|bash is real and covered by the primary code_safety finding; root scaffold is also #496 territory."
- },
- {
-  "severity": "medium",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "setup.sh",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): Scorecard's Pinned-Dependencies alert already tracks this line; hypatia re-mirroring it adds nothing. Baseline permanently."
- },
- {
-  "severity": "medium",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA002",
-  "file": "hyperpolymath/standards",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): aggregate counter of alerts hypatia already re-reports one-by-one; triple-counting by construction. Baseline permanently."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": ".github/workflows/changelog-reusable.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already follows the recommended pattern (read at top, write scoped per-job)."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": ".github/workflows/hypatia-scan-reusable.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378; security-events: write at top level is the documented requirement for SARIF upload from the reusable scan."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": ".github/workflows/hypatia-scan.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already declares least-privilege top-level perms with a documented, deliberate grant for SARIF upload."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": ".github/workflows/scorecard.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia's own missing_requirement alert; Scorecard coverage exists under scorecard-reusable.yml/scorecard-enforcer.yml, so the naming expectation is stale."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "1-formats/k9/register.ncl",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Double-false: mirror double-report per standards#378, AND the underlying ncl_http_url alert flags XML namespace/DTD identifiers, which are opaque IDs never fetched over HTTP. k9-svc carve-out #491."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "2-protocols/overlay/ffi/zig/src/main.zig",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): hypatia re-ingesting its own code_safety alert. Underlying shim debt is the estate-wide template-rot campaign (fix the boj-server template once)."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "setup.sh",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): third reporting channel (hypatia alert + Scorecard alert + this mirror) for the same two lines. Baseline permanently."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "1-formats/sub-specs/panll-panels/README.adoc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Explicitly a path in the external PanLL repo (future destination), not this tree. Intentional cross-repo reference."
- },
- {
-  "severity": "critical",
-  "rule_module": "cicd_rules",
-  "type": "banned_language_file",
-  "file": "1-formats/deed/tools/a2ml_to_deed.py",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): DEED toolchain file in banned Python (port-or-exempt decision pending); SonarCloud issues in it fixed separately.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#944"
- },
- {
-  "severity": "critical",
-  "rule_module": "cicd_rules",
-  "type": "banned_language_file",
-  "file": "1-formats/deed/tools/deed_lint.py",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): DEED toolchain file in banned Python (port-or-exempt decision pending); SonarCloud issues in it fixed separately.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#944"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/mirror-reusable.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/boj-build.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/label-triage.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/github-backup-mirror-reusable.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/labels.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/hypatia-scan-reusable.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/instant-sync.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/tailscale-connect-reusable.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/governance-reusable.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/allowlist-preflight-reusable.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "high",
-  "rule_module": "workflow_hardening",
-  "type": "WH013",
-  "file": ".github/workflows/github-backup-mirror-reusable.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-09-22): pushes target FOREIGN repos via PAT, not GITHUB_TOKEN contents; `contents: read` is correct least privilege.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#943"
- },
- {
-  "severity": "medium",
-  "rule_module": "scorecard",
-  "type": "DependencyPinning",
-  "file": ".",
-  "note": "PREEMPTIVE (hypatia triage 2026-09-22): observed once alongside the invalid lock; the lock repair should clear it \u2014 dormant if so.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#945"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "npx_in_workflow",
-  "file": ".github/copilot/coding-agent.yml",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#938"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "npx_in_workflow",
-  "file": "9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.github/workflows/rescript-deno-ci.yml",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#938"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "npx_in_workflow",
-  "file": "9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.gitlab-ci.yml",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#938"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "npx_in_workflow",
-  "file": "9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/Justfile",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#938"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "npx_in_workflow",
-  "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/rescript-deno-ci.yml",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#938"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "npx_in_workflow",
-  "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/post-sync.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#938"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "known_fake_action_sha",
-  "file": "9-archive/rhodium-standard-repositories/examples/enterprise-service/.github/workflows/security.yml",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#940"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "known_fake_action_sha",
-  "file": "9-archive/rhodium-standard-repositories/satellites/cccp/satellites/php-aegis/.github/workflows/comprehensive-quality.yml",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#940"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "known_fake_action_sha",
-  "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/ci.yml",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#940"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "known_fake_action_sha",
-  "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/security.yml",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#940"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "eval_in_shell",
-  "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#493"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "eval_in_shell",
-  "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#493"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "download_then_run_shell",
-  "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#493"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "scripts/sweep-classifiers/classify-codeql.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#1243"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "scripts/sweep-classifiers/classify-hypatia-scan.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#1243"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "scripts/sweep-classifiers/classify-mirror.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#1243"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "scripts/sweep-classifiers/classify-secret-scanner.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#1243"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "http_in_docs",
-  "file": "2-protocols/axel/CODE_OF_CONDUCT.adoc",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#937"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "http_in_docs",
-  "file": "2-protocols/axel/docs/cloudflare-dns-guide.adoc",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#937"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "http_in_docs",
-  "file": "2-protocols/axel/docs/github-pages-setup.adoc",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#937"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "http_in_docs",
-  "file": "LICENSES/MPL-2.0.txt",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#937"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "http_in_docs",
-  "file": "9-archive/rhodium-standard-repositories/examples/minimal-rust-project/README.adoc",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#937"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "http_in_docs",
-  "file": "9-archive/rhodium-standard-repositories/examples/standard-library/README.adoc",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#937"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "http_in_docs",
-  "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/GUIDES_v0.4/professional-integration/MUSEUMS.adoc",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#937"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/k9-contractile.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today. Same decision as the other RE001 entries; this workflow's 'Publish the K9 verdict' job (GITHUB_TOKEN only) joined the set on 2026-10-06.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "ncl_k9_missing_pedigree",
-  "file": "1-formats/k9/tools/fixtures/invalid/L1-K9-S001-no-pedigree.k9.ncl",
-  "note": "FALSE POSITIVE BY DESIGN: this is the NEGATIVE CONTROL for K9-S001 (no pedigree). k9-validate.sh --fixtures requires it to be rejected at L1 for exactly this reason; adding a pedigree would destroy the control. Exact path, not a pattern, so a real component that loses its pedigree is still reported."
- }
-]
+[{"file":"1-formats/k9/tools/conformance-report.mjs","note":"FALSE POSITIVE (CI triage 2026-10-18): Hypatia 51ab6496 matches the node:child_process import itself. The reporter uses spawnSync(command, args) with separate argument arrays and shell disabled by default; no command string is evaluated by a shell. Keep argv-only execution when extending this reporter.","rule_module":"code_safety","severity":"high","type":"js_exec_sync"},{"file":"1-formats/k9/tools/conformance-report.test.mjs","note":"FALSE POSITIVE (CI triage 2026-10-18): Hypatia 51ab6496 matches the node:child_process import itself. These tests use spawnSync with separate argument arrays and shell disabled by default to run git and Bash fixture scripts; no shell command interpolation occurs. The subprocesses verify that failed or missing validator evidence cannot pass.","rule_module":"code_safety","severity":"high","type":"js_exec_sync"},{"file":"9-archive/rhodium-standard-repositories/examples/enterprise-service/benches/api_benchmarks.rs","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Benchmark harness setup; panic on runtime-creation failure is the intended and only sensible failure mode. Not a DoS surface. Rule should exclude benches/ directories.","rule_module":"code_safety","severity":"high","type":"unwrap_without_check"},{"file":".github/workflows/changelog-reusable.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; write perms are job-scoped and required to open the changelog PR. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":".github/workflows/hypatia-scan-reusable.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; security-events:write is the minimum for SARIF upload, not excess privilege. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":".github/workflows/hypatia-scan.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of Scorecard Token-Permissions; the permissions block is deliberate and documented in-file. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":".github/workflows/scorecard.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Stale 46-day-old mirror (standards#378) against a file since renamed to scorecard-enforcer.yml/scorecard-reusable.yml; the missing_requirement alert has no current target.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":"1-formats/k9/register.ncl","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Doubly false: CSA mirror double-report (#378) AND underlying ncl_http_url matched XML namespace identifiers which are opaque strings, never dereferenced. 1-formats/k9/** carved out to #491.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":"2-protocols/overlay/ffi/zig/src/main.zig","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own SARIF alert (standards#378). Underlying @ptrCast is already emitted by the primary code_safety rule; the CSA copy is a duplicate.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":"9-archive/rhodium-standard-repositories/templates/setup.sh.template","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of the Scorecard alert; file also lives under the #493 eviction carve-out. Baseline permanently as a mirror.","rule_module":"code_scanning_alerts","severity":"medium","type":"CSA001"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/templates/setup.sh.template","note":"TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378 of a Scorecard alert; file lives in rhodium-standard-repositories, carve-out #493 (template awaiting eviction). Re-acked 2026-10-14 (P1.1): CSA findings echo live Scorecard alert state and cannot be re-verified from the tree; the pinned scanner emitted no CSA finding on main (dead PAT), so this ack is kept as the tripwire #957 describes until that issue is ruled. Tracker #378 was closed.","rule_module":"code_scanning_alerts","severity":"high","tracking_issue":"hyperpolymath/standards#957","type":"CSA003"},{"file":"setup.sh","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own alert (standards#378). Underlying curl|bash is real and covered by the primary code_safety finding; root scaffold is also #496 territory.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA001"},{"file":"setup.sh","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): Scorecard's Pinned-Dependencies alert already tracks this line; hypatia re-mirroring it adds nothing. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"medium","type":"CSA001"},{"file":"hyperpolymath/standards","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): aggregate counter of alerts hypatia already re-reports one-by-one; triple-counting by construction. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"medium","type":"CSA002"},{"file":".github/workflows/changelog-reusable.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already follows the recommended pattern (read at top, write scoped per-job).","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":".github/workflows/hypatia-scan-reusable.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378; security-events: write at top level is the documented requirement for SARIF upload from the reusable scan.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":".github/workflows/hypatia-scan.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already declares least-privilege top-level perms with a documented, deliberate grant for SARIF upload.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":".github/workflows/scorecard.yml","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia's own missing_requirement alert; Scorecard coverage exists under scorecard-reusable.yml/scorecard-enforcer.yml, so the naming expectation is stale.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":"1-formats/k9/register.ncl","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Double-false: mirror double-report per standards#378, AND the underlying ncl_http_url alert flags XML namespace/DTD identifiers, which are opaque IDs never fetched over HTTP. k9-svc carve-out #491.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":"2-protocols/overlay/ffi/zig/src/main.zig","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): hypatia re-ingesting its own code_safety alert. Underlying shim debt is the estate-wide template-rot campaign (fix the boj-server template once).","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":"setup.sh","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): third reporting channel (hypatia alert + Scorecard alert + this mirror) for the same two lines. Baseline permanently.","rule_module":"code_scanning_alerts","severity":"high","type":"CSA003"},{"file":"1-formats/sub-specs/panll-panels/README.adoc","note":"FALSE POSITIVE (hypatia triage 2026-07-21): Explicitly a path in the external PanLL repo (future destination), not this tree. Intentional cross-repo reference.","rule_module":"structural_drift","severity":"medium","type":"SD022"},{"expires_at":"2026-12-22","file":"1-formats/deed/tools/a2ml_to_deed.py","note":"TRACKED DEBT (hypatia triage 2026-09-22): DEED toolchain file in banned Python (port-or-exempt decision pending); SonarCloud issues in it fixed separately.","rule_module":"cicd_rules","severity":"critical","tracking_issue":"hyperpolymath/standards#944","type":"banned_language_file"},{"expires_at":"2026-12-22","file":"1-formats/deed/tools/deed_lint.py","note":"TRACKED DEBT (hypatia triage 2026-09-22): DEED toolchain file in banned Python (port-or-exempt decision pending); SonarCloud issues in it fixed separately.","rule_module":"cicd_rules","severity":"critical","tracking_issue":"hyperpolymath/standards#944","type":"banned_language_file"},{"expires_at":"2026-12-22","file":".github/workflows/mirror-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/boj-build.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/label-triage.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/github-backup-mirror-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/labels.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/hypatia-scan-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/instant-sync.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/tailscale-connect-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/governance-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/allowlist-preflight-reusable.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"expires_at":"2026-12-22","file":".github/workflows/github-backup-mirror-reusable.yml","note":"FALSE POSITIVE (hypatia triage 2026-09-22): pushes target FOREIGN repos via PAT, not GITHUB_TOKEN contents; `contents: read` is correct least privilege.","rule_module":"workflow_hardening","severity":"high","tracking_issue":"hyperpolymath/standards#943","type":"WH013"},{"expires_at":"2026-12-22","file":".","note":"PREEMPTIVE (hypatia triage 2026-09-22): observed once alongside the invalid lock; the lock repair should clear it — dormant if so.","rule_module":"scorecard","severity":"medium","tracking_issue":"hyperpolymath/standards#945","type":"DependencyPinning"},{"expires_at":"2026-12-22","file":".github/copilot/coding-agent.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.github/workflows/rescript-deno-ci.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.gitlab-ci.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/Justfile","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/rescript-deno-ci.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/post-sync.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): rule text is stale (recommends retired Deno); vendored example CI or agent config, not live estate CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#938","type":"npx_in_workflow"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/examples/enterprise-service/.github/workflows/security.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#940","type":"known_fake_action_sha"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/cccp/satellites/php-aegis/.github/workflows/comprehensive-quality.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#940","type":"known_fake_action_sha"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/ci.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#940","type":"known_fake_action_sha"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/.github/workflows/security.yml","note":"TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#940","type":"known_fake_action_sha"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#493","type":"eval_in_shell"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#493","type":"eval_in_shell"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#493","type":"download_then_run_shell"},{"expires_at":"2026-12-22","file":"scripts/sweep-classifiers/classify-codeql.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#1243","type":"hardcoded_tmp"},{"expires_at":"2026-12-22","file":"scripts/sweep-classifiers/classify-hypatia-scan.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#1243","type":"hardcoded_tmp"},{"expires_at":"2026-12-22","file":"scripts/sweep-classifiers/classify-mirror.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#1243","type":"hardcoded_tmp"},{"expires_at":"2026-12-22","file":"scripts/sweep-classifiers/classify-secret-scanner.sh","note":"TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#1243","type":"hardcoded_tmp"},{"expires_at":"2026-12-22","file":"2-protocols/axel/CODE_OF_CONDUCT.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"2-protocols/axel/docs/cloudflare-dns-guide.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"2-protocols/axel/docs/github-pages-setup.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"LICENSES/MPL-2.0.txt","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/examples/minimal-rust-project/README.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/examples/standard-library/README.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":"9-archive/rhodium-standard-repositories/satellites/palimpsest-license/GUIDES_v0.4/professional-integration/MUSEUMS.adoc","note":"TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.","rule_module":"content_patterns","severity":"medium","tracking_issue":"hyperpolymath/standards#937","type":"http_in_docs"},{"expires_at":"2026-12-22","file":".github/workflows/k9-contractile.yml","note":"ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today. Same decision as the other RE001 entries; this workflow's 'Publish the K9 verdict' job (GITHUB_TOKEN only) joined the set on 2026-10-06.","rule_module":"research_extensions","severity":"warn","tracking_issue":"hyperpolymath/standards#941","type":"RE001"},{"file":"1-formats/k9/tools/fixtures/invalid/L1-K9-S001-no-pedigree.k9.ncl","note":"FALSE POSITIVE BY DESIGN: this is the NEGATIVE CONTROL for K9-S001 (no pedigree). k9-validate.sh --fixtures requires it to be rejected at L1 for exactly this reason; adding a pedigree would destroy the control. Exact path, not a pattern, so a real component that loses its pedigree is still reported.","rule_module":"code_safety","severity":"high","type":"ncl_k9_missing_pedigree"}]
diff --git a/3-practice/JSON-POLICY.adoc b/3-practice/JSON-POLICY.adoc
index 79ecd8f0..764d802c 100644
--- a/3-practice/JSON-POLICY.adoc
+++ b/3-practice/JSON-POLICY.adoc
@@ -116,7 +116,11 @@ would differ from another JCS implementation's.
   output. Converting those is undone on the next tool run. For `package.json`
   the answer is RULED in LANGUAGE-POLICY §1.4 (2026-10-14): `js-runtimes regen`
   (tools/js-runtimes) re-canonicalises it after the tool, and the governance
-  `js-runtimes` jobs fail a forgotten run. For the
+  `js-runtimes` jobs fail a forgotten run. For `.hypatia-baseline.json` the
+  answer is RULED (owner, 2026-10-19): it is J-1 canonical. No tool rewrites
+  it here; it is edited by hand or with `jq` in a PR. After an edit, run
+  `ijson-jcs fix .hypatia-baseline.json`. The `ijson-jcs.yml` job
+  `Converted JSON stays canonical` fails a forgotten run. For the
   rest, whether they are carved out or the tools are changed is open.
 * *Mass reformatting.* Convert a repository's JSON in a PR scoped to that
   repository, after checking each consumer reads it by parsing, not by line.
diff --git a/docs/HYPATIA-BASELINE-FORMAT.adoc b/docs/HYPATIA-BASELINE-FORMAT.adoc
index 895994d9..1045a5ea 100644
--- a/docs/HYPATIA-BASELINE-FORMAT.adoc
+++ b/docs/HYPATIA-BASELINE-FORMAT.adoc
@@ -35,6 +35,12 @@ ajv validate --spec=draft2020 -s /tmp/schema.json -d .hypatia-baseline.json
 A JSON array. Each element is a *baseline entry* — same shape as a
 Hypatia finding, plus optional metadata.
 
+The committed file is I-JSON + JCS canonical (`3-practice/JSON-POLICY.adoc`
+J-1): one line, members sorted. The example below is indented for reading
+only. After any edit, by hand or with `jq`, run
+`ijson-jcs fix .hypatia-baseline.json`. In `hyperpolymath/standards`, CI
+fails a non-canonical baseline.
+
 [source,json]
 ----
 [