fix(ci): unblock E2E Validation and Static Analysis Gate (actions.lock drift from #268)

.github/workflows/c5-regenerate.yml

@@ -51,7 +51,7 @@ jobs:
           path: affinescript
 
       - name: Install OCaml
-        uses: ocaml/setup-ocaml@v3.9.0
+        uses: ocaml/setup-ocaml@v3.8.0
         with:
           ocaml-compiler: '4.14.2'
 

.github/workflows/e2e.yml

@@ -53,7 +53,7 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: '25'
 
@@ -158,7 +158,7 @@ jobs:
 
       # ---- Node (for smoke test within E2E script) ----
       - name: Set up Node.js
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: '25'
 

.github/workflows/release.yml

@@ -1,4 +1,4 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
@@ -77,7 +77,7 @@
           git cliff --output CHANGELOG.md
 
       - name: Upload updated CHANGELOG.md
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: changelog
           path: CHANGELOG.md

.github/workflows/static-analysis-gate.yml

@@ -1,4 +1,4 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Static Analysis Gate — Required by branch protection rules.
 # Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning.
@@ -117,7 +117,7 @@
           echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload panic-attack findings
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: panic-attack-findings
           path: panic-attack-findings.json
@@ -251,7 +251,7 @@
           echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload hypatia findings
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: hypatia-findings
           path: hypatia-findings.json
@@ -341,7 +341,7 @@
           echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload bridge report
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: bridge-report
           path: bridge-report.json
@@ -365,19 +365,19 @@
 
     steps:
       - name: Download panic-attack findings
-        uses: actions/download-artifact@v8.0.2
+        uses: actions/download-artifact@v8.0.1
         with:
           name: panic-attack-findings
           path: findings/
 
       - name: Download hypatia findings
-        uses: actions/download-artifact@v8.0.2
+        uses: actions/download-artifact@v8.0.1
         with:
           name: hypatia-findings
           path: findings/
 
       - name: Download bridge report
-        uses: actions/download-artifact@v8.0.2
+        uses: actions/download-artifact@v8.0.1
         with:
           name: bridge-report
           path: findings/
@@ -439,7 +439,7 @@
           echo "low=$LOW"           >> "$GITHUB_OUTPUT"
 
       - name: Upload unified findings (fleet scanner picks these up)
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: unified-findings
           path: findings/unified-findings.json

README.adoc

@@ -223,7 +223,7 @@ PROOF-NEEDS.md                             # Outstanding proof obligations
 TEST-NEEDS.md                              # Outstanding test coverage
 docs/PRODUCTION-PATH.adoc                  # 6-phase plan to production-ready
 docs/onboarding/README.adoc                # New here? Start here.
-docs/WHITEPAPER.md                         # Full academic treatment
+docs/WHITEPAPER.adoc                         # Full academic treatment
 AUDIT.adoc                                 # Hard rules and audit posture
 ----
 
@@ -267,7 +267,7 @@ The post-codegen verifier's `verify_access_sites_from_module` pass shipped in PR
 GraalVM's Truffle framework has the same multi-language shared state problem.
 typed-wasm's approach could give GraalVM **compile-time guarantees** for
 cross-language interop, replacing runtime `InteropLibrary` dispatch with
-compile-time schema agreement. See `docs/WHITEPAPER.md` for details.
+compile-time schema agreement. See `docs/WHITEPAPER.adoc` for details.
 
 == License
 

ROADMAP.adoc

@@ -47,7 +47,7 @@ Key capabilities delivered:
 * `.twasm` grammar (spec/grammar.ebnf) -- EBNF surface syntax
 * 10-level spec (spec/type-safety-levels-for-wasm.adoc) -- checked DB-to-WASM core mapping
 * Example `.twasm` files for the checked core, plus draft higher-level examples
-* Whitepaper drafts (docs/WHITEPAPER.md + docs/arxiv/typed-wasm.tex) under audit
+* Whitepaper drafts (docs/WHITEPAPER.adoc + docs/arxiv/typed-wasm.tex) under audit
 * No unsound escape hatches in the checked Idris2 core (`believe_me`, `assert_total`)
 * Estate-axis accommodation (A15/A16, 2026-06-16): L11/L12/Echo now cross-document
   and mirror the canonical estate repos -- `tropical-resource-typing` (Lean4

tests/aspect/claim-envelope.mjs

@@ -5,7 +5,7 @@
 // Claim-envelope aspect test.
 //
 // Every claim this repo makes in human-readable docs (README.adoc,
-// ROADMAP.adoc, LEVEL-STATUS.md, EXPLAINME.adoc) is also a contract with
+// ROADMAP.adoc, LEVEL-STATUS.adoc, EXPLAINME.adoc) is also a contract with
 // the artefacts it ships (src/abi/typed-wasm.ipkg, src/parser/*, Rust
 // crate constants, CI toolchain pins). When docs and artefacts drift,
 // nobody notices until an audit week later.
@@ -106,7 +106,7 @@ function assertDocsAgreeOnL11L12(path, regex) {
 const stalePattern =
   /L11.{0,4}L12[^\n]{0,180}?(not part of|not in.*(?:package|ipkg)|standalone.*fail)/i;
 assertDocsAgreeOnL11L12("ROADMAP.adoc", stalePattern);
-assertDocsAgreeOnL11L12("LEVEL-STATUS.md", stalePattern);
+assertDocsAgreeOnL11L12("LEVEL-STATUS.adoc", stalePattern);
 assertDocsAgreeOnL11L12("README.adoc", stalePattern);
 
 // ----------------------------------------------------------------------
@@ -318,10 +318,10 @@ const rsrFiles = [
   "LICENSE",
   "Justfile",
   "0-AI-MANIFEST.a2ml",
-  "LEVEL-STATUS.md",
+  "LEVEL-STATUS.adoc",
   "ROADMAP.adoc",
-  "PROOF-NEEDS.md",
-  "TEST-NEEDS.md",
+  "PROOF-NEEDS.adoc",
+  "TEST-NEEDS.adoc",
   "docs/PRODUCTION-PATH.adoc",   // canonical strategic plan (added 2026-05-24)
   "docs/onboarding/README.adoc", // RSR taxonomy (added 2026-05-25)
   "docs/status/README.adoc",     // RSR taxonomy (added 2026-05-25)

tests/aspect/security-envelope.mjs

@@ -8,7 +8,7 @@
 // checks that human-readable doc claims match shipped artefacts in
 // general, this file specifically checks SECURITY claims:
 //
-//   - SECURITY.md contact email matches .well-known/security.txt
+//   - SECURITY.md contact email matches www/.well-known/security.txt
 //   - SPDX-License-Identifier headers present on all source files
 //   - "believe_me: 0" README badge matches actual code (not comments)
 //   - No committed secrets / private keys
@@ -58,23 +58,23 @@ function maybeRead(rel) {
 }
 
 // ----------------------------------------------------------------------
-// 1. SECURITY.md ↔ .well-known/security.txt — contact alignment
+// 1. SECURITY.md ↔ www/.well-known/security.txt — contact alignment
 // ----------------------------------------------------------------------
-section("1. SECURITY.md and .well-known/security.txt agree on contact");
+section("1. SECURITY.md and www/.well-known/security.txt agree on contact");
 
 const securityMd = maybeRead("SECURITY.md");
-const securityTxt = maybeRead(".well-known/security.txt");
+const securityTxt = maybeRead("www/.well-known/security.txt");
 
 if (!securityMd) bad("SECURITY.md missing");
-if (!securityTxt) bad(".well-known/security.txt missing");
+if (!securityTxt) bad("www/.well-known/security.txt missing");
 
 if (securityMd && securityTxt) {
   const mdEmail = (securityMd.match(/[\w._%+-]+@[\w.-]+\.[A-Za-z]{2,}/) || [])[0];
   const txtEmail = (securityTxt.match(/Contact:\s*mailto:([\w._%+-]+@[\w.-]+\.[A-Za-z]{2,})/) || [])[1]
     || (securityTxt.match(/[\w._%+-]+@[\w.-]+\.[A-Za-z]{2,}/) || [])[0];
 
   if (!mdEmail) bad("SECURITY.md has no contact email");
-  else if (!txtEmail) bad(".well-known/security.txt has no Contact: line");
+  else if (!txtEmail) bad("www/.well-known/security.txt has no Contact: line");
   else if (mdEmail.toLowerCase() !== txtEmail.toLowerCase()) {
     bad(`Contact email mismatch: SECURITY.md=${mdEmail} vs security.txt=${txtEmail}`);
   } else {

tests/e2e.sh

@@ -11,7 +11,7 @@
 #   4. Zig FFI implementation files are present
 #   5. ReScript parser source files are present
 #   6. JSON/TOML/IPKG configuration files are well-formed
-#   7. LEVEL-STATUS.md documents all 12 levels
+#   7. LEVEL-STATUS.adoc documents all 12 levels
 #   8. Grammar document is non-trivial
 #   9. SPDX licence headers are present on key files
 #
@@ -65,17 +65,17 @@ else
   fail "Missing: spec/type-safety-levels-for-wasm.adoc"
 fi
 
-# LEVEL-STATUS.md documents all 12 levels
-if [ -f "LEVEL-STATUS.md" ]; then
+# LEVEL-STATUS.adoc documents all 12 levels (AsciiDoc table rows read "|N |...")
+if [ -f "LEVEL-STATUS.adoc" ]; then
   for lvl in $(seq 1 12); do
-    if grep -q "| $lvl |" "LEVEL-STATUS.md" 2>/dev/null; then
-      pass "LEVEL-STATUS.md contains level $lvl"
+    if grep -qE "^\|${lvl} \|" "LEVEL-STATUS.adoc" 2>/dev/null; then
+      pass "LEVEL-STATUS.adoc contains level $lvl"
     else
-      fail "LEVEL-STATUS.md missing entry for level $lvl"
+      fail "LEVEL-STATUS.adoc missing entry for level $lvl"
     fi
   done
 else
-  fail "Missing: LEVEL-STATUS.md"
+  fail "Missing: LEVEL-STATUS.adoc"
 fi
 
 # Grammar document