From 9a2c89668c83ec7a42142e7e1f07bbce0fddc6ae Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 4 Nov 2026 10:32:10 +0000
Subject: [PATCH 01/11] fix: enforce evidence boundaries and record adversarial
 audit

---
 .github/workflows/proven-tests.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/proven-tests.yml b/.github/workflows/proven-tests.yml
index d52eeb9..2d6cbac 100644
--- a/.github/workflows/proven-tests.yml
+++ b/.github/workflows/proven-tests.yml
@@ -181,7 +181,9 @@ jobs:
       - name: Install Idris2 (chez backend)
         working-directory: .proven-tests
         env:
-          IDRIS2_VERSION: ${{ env.IDRIS2_VERSION }}
+          # The pinned older installer passes this verbatim to git --branch.
+          # Idris2's release ref is v0.7.0, not 0.7.0.
+          IDRIS2_VERSION: v${{ env.IDRIS2_VERSION }}
         run: bash scripts/install-idris2.sh
 
       - name: Build and run the framework's suite

From a25027a5c89e23faa1e9d6a270fe63227e58e1b0 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 4 Nov 2026 10:32:18 +0000
Subject: [PATCH 02/11] fix: enforce evidence boundaries and record adversarial
 audit

---
 PROOF-NEEDS.adoc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/PROOF-NEEDS.adoc b/PROOF-NEEDS.adoc
index e893323..0ade0c8 100644
--- a/PROOF-NEEDS.adoc
+++ b/PROOF-NEEDS.adoc
@@ -58,9 +58,9 @@ signature correctness.
 
 |Hexad↔Octad persistence round-trip |`+src/storage/mod.rs+` (proptest)
 |*PROOF-PROGRAMME §3.1 (2026-06-04, #122)*:
-`+hexad_json_roundtrip_is_identity+` proves the on-disk serde round-trip
+`+hexad_json_roundtrip_is_identity+` tests the on-disk serde round-trip
 (`+write_*_hexad+` → `+load_hexad_dir+`) is the identity on the hexad
-JSON. The gateway octad projection is lossy by design, so the faithful
+JSON on generated samples, not by a universal theorem. The gateway octad projection is lossy by design, so the faithful
 integrity property is the persistence round-trip, not the literal
 hexad↔octad map.
 |===

From 2b59df9c88b2c1244cae48df9fde1ab8ad3b5633 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 4 Nov 2026 10:32:41 +0000
Subject: [PATCH 03/11] fix: enforce evidence boundaries and record adversarial
 audit

---
 docs/ASSURANCE-AUDIT-2026-11-04.adoc | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 docs/ASSURANCE-AUDIT-2026-11-04.adoc

diff --git a/docs/ASSURANCE-AUDIT-2026-11-04.adoc b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
new file mode 100644
index 0000000..9efbca8
--- /dev/null
+++ b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+= Assurance audit repair — 2026-11-04
+
+At base `be6ac46`, local default Rust tests pass 653 cases with three ignored;
+signing/http/sarif passes 720 with the same three ignored. These overlapping
+counts are not additive coverage. Feature-enabled Clippy passes with warnings
+as errors. GUI, distributed Chapel and all dynamic stress axes were not run.
+
+Both scanners ran against both suites and themselves. Every strict run reports
+partial coverage. panic-attack analysed 64 files in cicd-suite and 102 in
+proven-tests-and-benches, reporting four and three heuristic findings
+respectively. Those findings require triage, not automatic defect or proof labels.
+
+Scheduled framework run 41390102464 fails cloning Idris2 branch `0.7.0`.
+The pinned installer passes IDRIS2_VERSION directly to git; upstream's release
+tag is `v0.7.0`. This caller now supplies the prefix. The producer repository
+also receives normalisation and malformed-ref controls; its pin is not silently
+advanced here. Hosted framework build/test acceptance remains required.
+
+Idris models and conditional cryptographic premises do not prove that every
+Rust scanner path refines them. In particular a proptest round-trip is bounded
+property testing, not a universal proof. Hypatia ingestion issue #117 and the
+shared execution-evidence contract remain the appropriate integration boundary.

From e4b6f821bd85f5643855ab72e5821334841d298c Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 4 Nov 2026 10:42:23 +0000
Subject: [PATCH 04/11] fix: address hosted audit policy and metadata failures

---
 docs/ASSURANCE-AUDIT-2026-11-04.adoc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/ASSURANCE-AUDIT-2026-11-04.adoc b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
index 9efbca8..ebdfd21 100644
--- a/docs/ASSURANCE-AUDIT-2026-11-04.adoc
+++ b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
@@ -1,3 +1,4 @@
+// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
 // SPDX-License-Identifier: CC-BY-SA-4.0
 = Assurance audit repair — 2026-11-04
 

From 6addd22f2f0ce36baf57fde94cd4009ccf021e3e Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 4 Nov 2026 10:48:18 +0000
Subject: [PATCH 05/11] fix(ci): migrate pinned Standards callers and record
 assurance results

---
 .github/workflows/actions.lock       | 83 ----------------------------
 .github/workflows/governance.yml     |  3 +-
 .github/workflows/hypatia-scan.yml   |  3 +-
 .github/workflows/rust-ci.yml        |  3 +-
 docs/ASSURANCE-AUDIT-2026-11-04.adoc |  8 +++
 5 files changed, 14 insertions(+), 86 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 761942e..21a01fc 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -45,10 +45,6 @@ workflows:
         - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
         - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
         - 'swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0'
-    '.github/workflows/governance.yml':
-        - 'hyperpolymath/standards@333b06a01db1874ffedb2de1bfabb195640927c7'
-    '.github/workflows/hypatia-scan.yml':
-        - 'hyperpolymath/standards@333b06a01db1874ffedb2de1bfabb195640927c7'
     '.github/workflows/instant-sync.yml':
         - 'peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697'
     '.github/workflows/label-triage.yml': []
@@ -81,8 +77,6 @@ workflows:
         - 'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
         - 'softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64'
         - 'swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0'
-    '.github/workflows/rust-ci.yml':
-        - 'hyperpolymath/standards@333b06a01db1874ffedb2de1bfabb195640927c7'
     '.github/workflows/scan-and-report.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
@@ -107,61 +101,31 @@ dependencies:
         commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         owner_id: 44036562
         repo_id: 215566462
-    'actions/cache@v6.1.0':
-        ref: 'v6.1.0'
-        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
-        owner_id: 44036562
-        repo_id: 215566462
     'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
         ref: 'v7.0.1'
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
         owner_id: 44036562
         repo_id: 197814629
-    'actions/checkout@v7.0.1':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
     'actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d':
         ref: 'v6.0.0'
         commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
         owner_id: 44036562
         repo_id: 513659658
-    'actions/configure-pages@v6.0.0':
-        ref: 'v6.0.0'
-        commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
-        owner_id: 44036562
-        repo_id: 513659658
     'actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294':
         ref: 'v5.0.0'
         commit: 'sha1-a1d282b36b6f3519aa1f3fc636f609c47dddb294'
         owner_id: 44036562
         repo_id: 476372928
-    'actions/dependency-review-action@v5.0.0':
-        ref: 'v5.0.0'
-        commit: 'sha1-a1d282b36b6f3519aa1f3fc636f609c47dddb294'
-        owner_id: 44036562
-        repo_id: 476372928
     'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346':
         ref: 'v5.0.1'
         commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
         owner_id: 44036562
         repo_id: 438112499
-    'actions/deploy-pages@v5.0.1':
-        ref: 'v5.0.1'
-        commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
-        owner_id: 44036562
-        repo_id: 438112499
     'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333':
         ref: 'v8.0.2'
         commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
         owner_id: 44036562
         repo_id: 192626254
-    'actions/download-artifact@v8.0.2':
-        ref: 'v8.0.2'
-        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
-        owner_id: 44036562
-        repo_id: 192626254
     'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
         ref: 'v7.0.0'
         commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
@@ -172,11 +136,6 @@ dependencies:
         commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
         owner_id: 44036562
         repo_id: 192625955
-    'actions/upload-artifact@v7.0.2':
-        ref: 'v7.0.2'
-        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
-        owner_id: 44036562
-        repo_id: 192625955
     'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9':
         ref: 'v5.0.0'
         commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
@@ -184,13 +143,6 @@ dependencies:
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
-    'actions/upload-pages-artifact@v5.0.0':
-        ref: 'v5.0.0'
-        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
-        owner_id: 44036562
-        repo_id: 496012378
-        uses:
-            - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
     'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
         ref: 'v2.0.5'
         commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
@@ -201,11 +153,6 @@ dependencies:
         commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8'
         owner_id: 1940490
         repo_id: 260749683
-    'dtolnay/rust-toolchain@v1':
-        ref: 'v1'
-        commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8'
-        owner_id: 1940490
-        repo_id: 260749683
     'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
         ref: 'v3.0.0'
         commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
@@ -226,11 +173,6 @@ dependencies:
         commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
         owner_id: 9919
         repo_id: 259445878
-    'github/codeql-action@v4.39.0':
-        ref: 'v4.39.0'
-        commit: 'sha1-6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee'
-        owner_id: 9919
-        repo_id: 259445878
     'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406':
         ref: 'v2.2.1'
         commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406'
@@ -241,21 +183,11 @@ dependencies:
         commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
         owner_id: 75048950
         repo_id: 623796603
-    'haskell-actions/setup@v2.12.1':
-        ref: 'v2.12.1'
-        commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
-        owner_id: 75048950
-        repo_id: 623796603
     'hyperpolymath/smtp-notify-action@c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef':
         ref: 'v0.5.0'
         commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
         owner_id: 6759885
         repo_id: 1352485172
-    'hyperpolymath/smtp-notify-action@v0.5.0':
-        ref: 'v0.5.0'
-        commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
-        owner_id: 6759885
-        repo_id: 1352485172
     'hyperpolymath/standards@333b06a01db1874ffedb2de1bfabb195640927c7':
         ref: '333b06a01db1874ffedb2de1bfabb195640927c7'
         commit: 'sha1-333b06a01db1874ffedb2de1bfabb195640927c7'
@@ -290,11 +222,6 @@ dependencies:
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
         owner_id: 18365890
         repo_id: 220359305
-    'peter-evans/repository-dispatch@v4.0.1':
-        ref: 'v4.0.1'
-        commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
-        owner_id: 18365890
-        repo_id: 220359305
     'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a':
         ref: 'v2.1.0'
         commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
@@ -305,11 +232,6 @@ dependencies:
         commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
         owner_id: 2242
         repo_id: 204253808
-    'softprops/action-gh-release@v3.0.3':
-        ref: 'v3.0.3'
-        commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
-        owner_id: 2242
-        repo_id: 204253808
     'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6':
         ref: 'v2.9.2'
         commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
@@ -320,11 +242,6 @@ dependencies:
         commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0'
         owner_id: 580492
         repo_id: 298565987
-    'swatinem/rust-cache@v2.9.3':
-        ref: 'v2.9.3'
-        commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0'
-        owner_id: 580492
-        repo_id: 298565987
     'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
         ref: 'v0.10.0'
         commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 08448a5..ceefcd7 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,3 +1,4 @@
+# Reusable owner migrated; full commit and required job identifiers retained.
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
@@ -17,4 +18,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7  # 333b06a01db1874ffedb2de1bfabb195640927c7
+    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7  # 333b06a01db1874ffedb2de1bfabb195640927c7
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 720ee31..cfa339d 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,3 +1,4 @@
+# Reusable owner migrated; full commit and required job identifiers retained.
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
@@ -20,4 +21,4 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7  # 333b06a01db1874ffedb2de1bfabb195640927c7
+    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7  # 333b06a01db1874ffedb2de1bfabb195640927c7
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 73b1435..42ef830 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -1,3 +1,4 @@
+# Reusable owner migrated; full commit and required job identifiers retained.
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
@@ -18,4 +19,4 @@ permissions:
 
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 # re-pinned 2026-07-01: toolchain-required-input fix (standards#439)
+    uses: metadatastician/standards/.github/workflows/rust-ci-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 # re-pinned 2026-07-01: toolchain-required-input fix (standards#439)
diff --git a/docs/ASSURANCE-AUDIT-2026-11-04.adoc b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
index ebdfd21..797ad4e 100644
--- a/docs/ASSURANCE-AUDIT-2026-11-04.adoc
+++ b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
@@ -22,3 +22,11 @@ Idris models and conditional cryptographic premises do not prove that every
 Rust scanner path refines them. In particular a proptest round-trip is bounded
 property testing, not a universal proof. Hypatia ingestion issue #117 and the
 shared execution-evidence contract remain the appropriate integration boundary.
+
+The governance, Hypatia and Rust reusable callers now name the transferred
+`metadatastician/standards` owner at their original verified commits. The
+suite's tested deonboarding script removes their caller lock registrations
+and unreachable lock dependencies. Job identifiers, permissions and pinned
+callee content are retained; no security checks are removed. This repairs the
+known caller migration mechanism; current-head hosted runs must establish
+whether callee admission or additional defects remain.

From 4eeadf873ddfaa97718fc0aa39d17cf8c746910e Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 4 Nov 2026 10:56:32 +0000
Subject: [PATCH 06/11] fix: resolve adversarial review findings and retain
 failed migration evidence

---
 .github/workflows/actions.lock       | 83 ++++++++++++++++++++++++++++
 .github/workflows/governance.yml     |  3 +-
 .github/workflows/hypatia-scan.yml   |  3 +-
 .github/workflows/rust-ci.yml        |  3 +-
 PROOF-NEEDS.adoc                     | 11 ++--
 docs/ASSURANCE-AUDIT-2026-11-04.adoc | 17 +++---
 6 files changed, 102 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 21a01fc..761942e 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -45,6 +45,10 @@ workflows:
         - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
         - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
         - 'swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0'
+    '.github/workflows/governance.yml':
+        - 'hyperpolymath/standards@333b06a01db1874ffedb2de1bfabb195640927c7'
+    '.github/workflows/hypatia-scan.yml':
+        - 'hyperpolymath/standards@333b06a01db1874ffedb2de1bfabb195640927c7'
     '.github/workflows/instant-sync.yml':
         - 'peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697'
     '.github/workflows/label-triage.yml': []
@@ -77,6 +81,8 @@ workflows:
         - 'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
         - 'softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64'
         - 'swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0'
+    '.github/workflows/rust-ci.yml':
+        - 'hyperpolymath/standards@333b06a01db1874ffedb2de1bfabb195640927c7'
     '.github/workflows/scan-and-report.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
@@ -101,31 +107,61 @@ dependencies:
         commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         owner_id: 44036562
         repo_id: 215566462
+    'actions/cache@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
     'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
         ref: 'v7.0.1'
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
         owner_id: 44036562
         repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
     'actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d':
         ref: 'v6.0.0'
         commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
         owner_id: 44036562
         repo_id: 513659658
+    'actions/configure-pages@v6.0.0':
+        ref: 'v6.0.0'
+        commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
+        owner_id: 44036562
+        repo_id: 513659658
     'actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294':
         ref: 'v5.0.0'
         commit: 'sha1-a1d282b36b6f3519aa1f3fc636f609c47dddb294'
         owner_id: 44036562
         repo_id: 476372928
+    'actions/dependency-review-action@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-a1d282b36b6f3519aa1f3fc636f609c47dddb294'
+        owner_id: 44036562
+        repo_id: 476372928
     'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346':
         ref: 'v5.0.1'
         commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
         owner_id: 44036562
         repo_id: 438112499
+    'actions/deploy-pages@v5.0.1':
+        ref: 'v5.0.1'
+        commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
+        owner_id: 44036562
+        repo_id: 438112499
     'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333':
         ref: 'v8.0.2'
         commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
         owner_id: 44036562
         repo_id: 192626254
+    'actions/download-artifact@v8.0.2':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
+        owner_id: 44036562
+        repo_id: 192626254
     'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
         ref: 'v7.0.0'
         commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
@@ -136,6 +172,11 @@ dependencies:
         commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
         owner_id: 44036562
         repo_id: 192625955
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
     'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9':
         ref: 'v5.0.0'
         commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
@@ -143,6 +184,13 @@ dependencies:
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'actions/upload-pages-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
     'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
         ref: 'v2.0.5'
         commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
@@ -153,6 +201,11 @@ dependencies:
         commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8'
         owner_id: 1940490
         repo_id: 260749683
+    'dtolnay/rust-toolchain@v1':
+        ref: 'v1'
+        commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8'
+        owner_id: 1940490
+        repo_id: 260749683
     'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
         ref: 'v3.0.0'
         commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
@@ -173,6 +226,11 @@ dependencies:
         commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
         owner_id: 9919
         repo_id: 259445878
+    'github/codeql-action@v4.39.0':
+        ref: 'v4.39.0'
+        commit: 'sha1-6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee'
+        owner_id: 9919
+        repo_id: 259445878
     'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406':
         ref: 'v2.2.1'
         commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406'
@@ -183,11 +241,21 @@ dependencies:
         commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
         owner_id: 75048950
         repo_id: 623796603
+    'haskell-actions/setup@v2.12.1':
+        ref: 'v2.12.1'
+        commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
+        owner_id: 75048950
+        repo_id: 623796603
     'hyperpolymath/smtp-notify-action@c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef':
         ref: 'v0.5.0'
         commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
         owner_id: 6759885
         repo_id: 1352485172
+    'hyperpolymath/smtp-notify-action@v0.5.0':
+        ref: 'v0.5.0'
+        commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
+        owner_id: 6759885
+        repo_id: 1352485172
     'hyperpolymath/standards@333b06a01db1874ffedb2de1bfabb195640927c7':
         ref: '333b06a01db1874ffedb2de1bfabb195640927c7'
         commit: 'sha1-333b06a01db1874ffedb2de1bfabb195640927c7'
@@ -222,6 +290,11 @@ dependencies:
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
         owner_id: 18365890
         repo_id: 220359305
+    'peter-evans/repository-dispatch@v4.0.1':
+        ref: 'v4.0.1'
+        commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
+        owner_id: 18365890
+        repo_id: 220359305
     'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a':
         ref: 'v2.1.0'
         commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
@@ -232,6 +305,11 @@ dependencies:
         commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
         owner_id: 2242
         repo_id: 204253808
+    'softprops/action-gh-release@v3.0.3':
+        ref: 'v3.0.3'
+        commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
+        owner_id: 2242
+        repo_id: 204253808
     'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6':
         ref: 'v2.9.2'
         commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
@@ -242,6 +320,11 @@ dependencies:
         commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0'
         owner_id: 580492
         repo_id: 298565987
+    'swatinem/rust-cache@v2.9.3':
+        ref: 'v2.9.3'
+        commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0'
+        owner_id: 580492
+        repo_id: 298565987
     'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
         ref: 'v0.10.0'
         commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index ceefcd7..08448a5 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,4 +1,3 @@
-# Reusable owner migrated; full commit and required job identifiers retained.
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
@@ -18,4 +17,4 @@ permissions:
 
 jobs:
   governance:
-    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7  # 333b06a01db1874ffedb2de1bfabb195640927c7
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7  # 333b06a01db1874ffedb2de1bfabb195640927c7
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index cfa339d..720ee31 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,4 +1,3 @@
-# Reusable owner migrated; full commit and required job identifiers retained.
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
@@ -21,4 +20,4 @@ permissions:
 
 jobs:
   hypatia:
-    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7  # 333b06a01db1874ffedb2de1bfabb195640927c7
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7  # 333b06a01db1874ffedb2de1bfabb195640927c7
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 42ef830..73b1435 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -1,4 +1,3 @@
-# Reusable owner migrated; full commit and required job identifiers retained.
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
@@ -19,4 +18,4 @@ permissions:
 
 jobs:
   rust-ci:
-    uses: metadatastician/standards/.github/workflows/rust-ci-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 # re-pinned 2026-07-01: toolchain-required-input fix (standards#439)
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 # re-pinned 2026-07-01: toolchain-required-input fix (standards#439)
diff --git a/PROOF-NEEDS.adoc b/PROOF-NEEDS.adoc
index 0ade0c8..e09653d 100644
--- a/PROOF-NEEDS.adoc
+++ b/PROOF-NEEDS.adoc
@@ -58,11 +58,12 @@ signature correctness.
 
 |Hexad↔Octad persistence round-trip |`+src/storage/mod.rs+` (proptest)
 |*PROOF-PROGRAMME §3.1 (2026-06-04, #122)*:
-`+hexad_json_roundtrip_is_identity+` tests the on-disk serde round-trip
-(`+write_*_hexad+` → `+load_hexad_dir+`) is the identity on the hexad
-JSON on generated samples, not by a universal theorem. The gateway octad projection is lossy by design, so the faithful
-integrity property is the persistence round-trip, not the literal
-hexad↔octad map.
+`+hexad_json_roundtrip_is_identity+` tests an in-memory
+`+serde_json::Value+` serialize/deserialize/serialize round-trip on generated
+samples, not by a universal theorem. It does not call `+write_*_hexad+` or
+`+load_hexad_dir+`; on-disk persistence correspondence remains a separate
+obligation. The gateway octad projection is lossy by design, so this property
+also does not establish a faithful hexad↔octad map.
 |===
 
 === What Still Needs Proving
diff --git a/docs/ASSURANCE-AUDIT-2026-11-04.adoc b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
index 797ad4e..83313e9 100644
--- a/docs/ASSURANCE-AUDIT-2026-11-04.adoc
+++ b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
@@ -23,10 +23,13 @@ Rust scanner path refines them. In particular a proptest round-trip is bounded
 property testing, not a universal proof. Hypatia ingestion issue #117 and the
 shared execution-evidence contract remain the appropriate integration boundary.
 
-The governance, Hypatia and Rust reusable callers now name the transferred
-`metadatastician/standards` owner at their original verified commits. The
-suite's tested deonboarding script removes their caller lock registrations
-and unreachable lock dependencies. Job identifiers, permissions and pinned
-callee content are retained; no security checks are removed. This repairs the
-known caller migration mechanism; current-head hosted runs must establish
-whether callee admission or additional defects remain.
+Migration experiment `6addd22` changed three reusable callers to the transferred
+Standards owner and deonboarded their lock entries. Runs 41816637511, 41816636052
+and 41816634641 still startup-failed; CI Integrity run 41816632936 rejected the
+changed lock. The experiment was reverted, preserving the integrity gate.
+A coordinated caller/callee-lock/Actions-allowlist migration remains blocked;
+repository administration is unavailable through this connection.
+
+The Hexad property-test ledger now describes its actual in-memory serde value
+round-trip. It does not execute the file write/load path, and therefore cannot
+be credited as on-disk persistence coverage.

From a61696431a31e5810240ea5b102ce9a57bb7d611 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 4 Nov 2026 11:02:44 +0000
Subject: [PATCH 07/11] docs: link canonical community policies without
 conflicting commitments

---
 .github/CODE_OF_CONDUCT.md           | 6 ++++++
 .github/SECURITY.md                  | 7 +++++++
 docs/ASSURANCE-AUDIT-2026-11-04.adoc | 3 +++
 3 files changed, 16 insertions(+)
 create mode 100644 .github/CODE_OF_CONDUCT.md
 create mode 100644 .github/SECURITY.md

diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..ec35fea
--- /dev/null
+++ b/.github/CODE_OF_CONDUCT.md
@@ -0,0 +1,6 @@
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+<!-- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) -->
+# Code of conduct
+
+See the project’s [Code of Conduct](../CODE_OF_CONDUCT.adoc) for participation
+standards, reporting contacts and enforcement procedures.
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
new file mode 100644
index 0000000..aa894f2
--- /dev/null
+++ b/.github/SECURITY.md
@@ -0,0 +1,7 @@
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+<!-- SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) -->
+# Security policy
+
+See [SECURITY.adoc](../SECURITY.adoc) for supported versions and private
+vulnerability reporting. Do not report suspected vulnerabilities in public
+issues.
diff --git a/docs/ASSURANCE-AUDIT-2026-11-04.adoc b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
index 83313e9..4541a0b 100644
--- a/docs/ASSURANCE-AUDIT-2026-11-04.adoc
+++ b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
@@ -33,3 +33,6 @@ repository administration is unavailable through this connection.
 The Hexad property-test ledger now describes its actual in-memory serde value
 round-trip. It does not execute the file write/load path, and therefore cannot
 be credited as on-disk persistence coverage.
+
+GitHub-facing Security and Code of Conduct entry points link the existing
+canonical AsciiDoc policies, without inventing new response commitments.

From e2c787689bb5c55bd36cf382c558238511076e9e Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 4 Nov 2026 13:11:59 +0000
Subject: [PATCH 08/11] fix: restore task entrypoints and preserve diagnostic
 failures

---
 .github/workflows/verify.yml         |  23 +++++
 Justfile                             |  27 ++---
 QUICKSTART-USER.adoc                 | 144 ++++++++-------------------
 docs/ASSURANCE-AUDIT-2026-11-04.adoc |  34 +++++++
 scripts/ci/test-entrypoints.sh       |  64 ++++++++++++
 scripts/doctor.sh                    |  16 +++
 setup.sh                             |   6 +-
 7 files changed, 187 insertions(+), 127 deletions(-)
 create mode 100644 scripts/ci/test-entrypoints.sh
 create mode 100644 scripts/doctor.sh

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index be1ea2b..91d0306 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -47,6 +47,29 @@ env:
   RUST_BACKTRACE: '1'
 
 jobs:
+  entrypoints:
+    name: Installation entrypoint controls
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Verify pinned task runner and exercise isolated entrypoints
+        shell: bash
+        run: |
+          set -euo pipefail
+          tools_dir=$(mktemp -d)
+          trap 'rm -rf "$tools_dir"' EXIT
+          archive=just-1.36.0-x86_64-unknown-linux-musl.tar.gz
+          curl --fail --silent --show-error --location --max-time 60 \
+            "https://github.com/casey/just/releases/download/1.36.0/$archive" \
+            --output "$tools_dir/$archive"
+          (cd "$tools_dir" && printf '%s  %s\n' \
+            bc7c9f377944f8de9cd0418b11d2955adebfa25a488c0b5e3dd2d2c0e9d732da "$archive" | sha256sum --check)
+          tar --no-same-owner -xzf "$tools_dir/$archive" -C "$tools_dir" just
+          JUST_BIN="$tools_dir/just" bash scripts/ci/test-entrypoints.sh
+
   fmt:
     name: cargo fmt --check
     runs-on: ubuntu-latest
diff --git a/Justfile b/Justfile
index 9975dec..f3a5ef4 100644
--- a/Justfile
+++ b/Justfile
@@ -8,7 +8,7 @@ default: build test
 
 # Build release binary
 build:
-    cargo build --release
+    cargo build --locked --release
 
 # Run all tests
 test:
@@ -57,8 +57,9 @@ readiness-summary:
 clean:
     cargo clean
 
-# Install to system
+# Install for this user (does not modify PATH)
 install: build
+    mkdir -p ~/.local/bin
     cp target/release/panic-attack ~/.local/bin/
 
 # Scan self (dogfood)
@@ -73,15 +74,9 @@ assemblyline:
 lint:
     cargo clippy --all-targets
 
-# Format check
+# Format check (compatibility name)
 fmt:
-    cargo fmt -- --check
-
-# Check formatting without modifying
-fmt-check:
-    cargo fmt --all --check
-# Full CI check (fmt + lint + test)
-ci: fmt lint test
+    cargo fmt --all -- --check
 
 # Tag and push a release (usage: just release 2.1.0)
 release version:
@@ -204,17 +199,11 @@ chapel-diff:
 
 # Run panic-attacker pre-commit scan
 assail:
-    @command -v panic-attack >/dev/null 2>&1 && panic-attack assail . || echo "panic-attack not found — install from https://github.com/hyperpolymath/panic-attacker"
+    panic-attack assail .
 
-# Self-diagnostic — checks dependencies, permissions, paths
+# Local tool availability only; does not establish build or runtime compatibility
 doctor:
-    @echo "Running diagnostics for panic-attacker..."
-    @echo "Checking required tools..."
-    @command -v just >/dev/null 2>&1 && echo "  [OK] just" || echo "  [FAIL] just not found"
-    @command -v git >/dev/null 2>&1 && echo "  [OK] git" || echo "  [FAIL] git not found"
-    @echo "Checking for hardcoded paths..."
-    @grep -rn '$HOME\|$ECLIPSE_DIR' --include='*.rs' --include='*.ex' --include='*.res' --include='*.gleam' --include='*.sh' . 2>/dev/null | head -5 || echo "  [OK] No hardcoded paths"
-    @echo "Diagnostics complete."
+    sh scripts/doctor.sh
 
 # Auto-repair common issues
 heal:
diff --git a/QUICKSTART-USER.adoc b/QUICKSTART-USER.adoc
index fadace1..1a7b1e7 100644
--- a/QUICKSTART-USER.adoc
+++ b/QUICKSTART-USER.adoc
@@ -1,125 +1,59 @@
 // SPDX-License-Identifier: CC-BY-SA-4.0
 // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-// Template: QUICKSTART-USER.adoc — 5-minute path to working software
-// Replace panic-attack, Panic Attacker — See README.adoc for details., just run, Panic Attacker started successfully. with actuals
 = panic-attack — Quick Start for Users
-:toc:
-:toclevels: 2
 
-== What is panic-attack?
+panic-attack provides static analysis and optional stress testing. A scan result
+is evidence within its reported coverage, not a certificate that a project is safe.
 
-Panic Attacker — See README.adoc for details.
+== Build the default CLI
 
-== Prerequisites
+Install Rust and Cargo using your preferred tool manager. The default CLI's
+minimum Rust version is declared in `Cargo.toml` (`rust-version`, currently 1.90).
+Use a compatible compiler rather than updating every language toolchain.
+The optional GUI has additional compiler and system-library requirements.
+Scanning a language does not require installing that language's compiler.
 
-Before you begin, ensure you have:
+The following commands assume a POSIX shell, Git, a working native linker,
+and access to the pinned dependencies. They do not require just, mise, or Guix.
 
-* **just** — task runner (https://github.com/casey/just[install guide])
-* Platform-specific requirements listed below
-
-[cols="1,3"]
-|===
-| Platform | Additional Requirements
-
-| Linux
-| See README.adoc
-
-| macOS
-| See README.adoc
-
-| Windows
-| See README.adoc
-|===
-
-== Install
-
-=== Option 1: Standard Install (recommended)
-
-[source,bash]
+[source,shell]
 ----
-# Clone and set up
 git clone https://github.com/hyperpolymath/panic-attack.git
 cd panic-attack
-just setup
+cargo build --locked --release
+./target/release/panic-attack --help
+./target/release/panic-attack assail . --fail-on-incomplete
 ----
 
-The setup script will:
-
-* Detect your platform and shell
-* Install missing dependencies (with your permission)
-* Configure the application
-* Offer install location choices
-* Run a self-diagnostic to verify everything works
+A self-scan can return findings or incomplete coverage, including from deliberate
+test fixtures. Do not interpret a nonzero scan exit as an installation failure;
+inspect the report and coverage outcome.
 
-=== Option 2: Container (via Stapeln)
-
-[source,bash]
-----
-just stapeln-run
-----
-
-=== Option 3: Portable (no system changes)
-
-[source,bash]
-----
-just install --portable --prefix=./panic-attack-portable
-----
-
-== First Run
-
-[source,bash]
-----
-just run
-----
+== Optional task runner and installation
 
-Expected output:
+With just installed, `just --list` lists the actual recipes. `just install`
+builds the default release CLI and copies it to `$HOME/.local/bin`, creating
+that directory if needed. Add that directory to PATH yourself if desired.
+This recipe does not install prerequisites or offer a portable/prefix option.
 
-[source]
-----
-Panic Attacker started successfully.
-----
-
-== Self-Diagnostic
-
-If something isn't working:
-
-[source,bash]
-----
-just doctor
-----
-
-This checks all dependencies, permissions, paths, and connectivity.
-If it finds issues, it will suggest fixes.
-
-To attempt automatic repair:
-
-[source,bash]
-----
-just heal
-----
-
-== Get Help
-
-* **In-app**: `just run --help`
-* **Guided tour**: `just tour`
-* **Report a problem**: `just help-me` (pre-fills diagnostic context)
-* **Wiki**: https://github.com/hyperpolymath/panic-attack/wiki
-
-== Uninstall
-
-[source,bash]
-----
-just uninstall
-----
+`just doctor` checks whether Cargo, rustc, Git and just can run. It returns
+nonzero for a missing or broken tool. It does not check compiler compatibility,
+network connectivity, runtime safety, or prove a build will succeed.
+Use the locked build above to check compiler and dependency compatibility.
 
-You will be asked:
+== Troubleshooting
 
-1. Which uninstall tier (Bennett reversible, parameter-based, standard, or secure)
-2. Whether to include or exclude your data
-3. Whether to clear caches and LLM models
+Record the failing command and its exit code before changing toolchains.
+Report problems at https://github.com/hyperpolymath/panic-attack/issues with
+the relevant error text. Review any local paths or sensitive details before
+sharing logs. Platform details are optional.
 
-== Next Steps
+The legacy `setup.sh` still installs just through platform package managers;
+it is not the cross-platform provisioning interface proposed for the estate.
+The direct build path above avoids those automatic package-manager changes.
+The existing `heal` recipe is not a targeted dependency repair service.
+Do not use it as a substitute for diagnosing a failed build.
 
-* Read the link:README.adoc[README] for full feature overview
-* Read the link:EXPLAINME.adoc[EXPLAINME] for architecture and design decisions
-* Try `just tour` for a guided walkthrough
+There are no `stapeln-run`, `run`, or `uninstall` recipes in this checkout.
+To remove a user-local installation, remove only the binary you installed.
+See link:README.adoc[README] for features and analysis limitations.
diff --git a/docs/ASSURANCE-AUDIT-2026-11-04.adoc b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
index 4541a0b..4672eb0 100644
--- a/docs/ASSURANCE-AUDIT-2026-11-04.adoc
+++ b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
@@ -36,3 +36,37 @@ be credited as on-disk persistence coverage.
 
 GitHub-facing Security and Code of Conduct entry points link the existing
 canonical AsciiDoc policies, without inventing new response commitments.
+
+== Installation entrypoint follow-up
+
+At `a61696431a31e5810240ea5b102ce9a57bb7d611`, just 1.36.0 rejects the
+Justfile because `ci` is duplicated; `fmt-check` is duplicated too. Neither
+recipe is suppressed: the fuller CI dependency list and all-target formatting
+check remain. `just assail` no longer converts scanner failures into a
+successful "not found" message. Installation creates the user-local bin directory
+and builds with the lockfile enforced.
+
+The read-only doctor now fails for absent or nonfunctional tools. It checks
+availability, not minimum-version compliance or successful compilation.
+Bootstrap recipe selection uses `just --show`; a failed fallback doctor stops
+setup before its success report. The user quickstart documents actual commands
+and separates the default Rust MSRV from optional GUI requirements.
+
+Local evidence: 15 isolated entrypoint controls pass with upstream just 1.36.0
+Linux x86_64 musl archive SHA-256
+`bc7c9f377944f8de9cd0418b11d2955adebfa25a488c0b5e3dd2d2c0e9d732da`.
+The controls reject each of three counterexamples independently: original
+Justfile, original setup.sh with the corrected Justfile, and an always-successful
+doctor. POSIX/Bash syntax checks and git diff whitespace checks pass. CI runs
+the same controls using the checksum-pinned task runner under a five-minute
+job deadline. No Rust compilation, native macOS/Windows execution, actual
+package installation, or installer privilege escalation was performed in this
+follow-up. Action-lock verification could not run locally without GitHub
+authentication; existing action references are unchanged and hosted verification
+remains required.
+
+Remaining provisioning work: replace generic latest-tool mise boilerplate;
+align developer/maintainer quickstarts; replace broad chmod/cache-deletion heal
+with bounded repair plans; integrate canonical provisioning DEED and generated
+provider exports; specify opt-in platform disclosure and Bustfile-based diagnosis.
+These are pending work, not capabilities supplied by this entrypoint repair.
diff --git a/scripts/ci/test-entrypoints.sh b/scripts/ci/test-entrypoints.sh
new file mode 100644
index 0000000..5298bd6
--- /dev/null
+++ b/scripts/ci/test-entrypoints.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+# Hermetic tools: no compiler, package installer, network, or user files touched.
+set -euo pipefail
+root=$(cd "$(dirname "$0")/../.." && pwd)
+just_bin=${JUST_BIN:-$(command -v just)}
+just_bin=$(realpath "$just_bin")
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+mkdir -p "$tmp/bin" "$tmp/repo/scripts"
+cp "$root/Justfile" "$root/setup.sh" "$tmp/repo/"
+cp "$root/scripts/doctor.sh" "$tmp/repo/scripts/"
+ln -s /bin/sh "$tmp/bin/sh"
+ln -s "$(command -v head)" "$tmp/bin/head"
+ln -s "$just_bin" "$tmp/bin/just"
+for tool in cargo rustc git; do
+    printf '#!/bin/sh\nexit 0\n' > "$tmp/bin/$tool"
+    chmod +x "$tmp/bin/$tool"
+done
+cd "$tmp/repo"
+checks=0
+expect() {
+    local expected=$1 actual=0
+    shift
+    "$@" > "$tmp/output" 2>&1 || actual=$?
+    if [[ $actual != "$expected" ]]; then
+        cat "$tmp/output" >&2
+        printf 'expected %s, got %s: %s\n' "$expected" "$actual" "$*" >&2
+        exit 1
+    fi
+    checks=$((checks + 1))
+}
+expect 0 "$just_bin" --list
+expect 0 env PATH="$tmp/bin" "$just_bin" doctor
+for tool in cargo rustc git; do
+    mv "$tmp/bin/$tool" "$tmp/$tool"
+    expect 1 env PATH="$tmp/bin" "$just_bin" doctor
+    grep -q "\[FAIL\] $tool" "$tmp/output"
+    mv "$tmp/$tool" "$tmp/bin/$tool"
+    printf '#!/bin/sh\nexit 7\n' > "$tmp/bin/$tool"
+    expect 1 env PATH="$tmp/bin" "$just_bin" doctor
+    printf '#!/bin/sh\nexit 0\n' > "$tmp/bin/$tool"
+done
+for code in 0 1 2 127; do
+    printf '#!/bin/sh\nexit %s\n' "$code" > "$tmp/bin/panic-attack"
+    chmod +x "$tmp/bin/panic-attack"
+    expect "$code" env PATH="$tmp/bin" "$just_bin" assail
+done
+rm "$tmp/bin/panic-attack"
+expect 127 env PATH="$tmp/bin" "$just_bin" assail
+# Bootstrap must not swallow a failed doctor or emit a success report.
+printf '#!/bin/sh\nprintf Linux\n' > "$tmp/bin/uname"
+chmod +x "$tmp/bin/uname"
+rm "$tmp/bin/cargo"
+expect 1 env PATH="$tmp/bin" /bin/sh ./setup.sh
+if grep -q 'Setup Complete' "$tmp/output" || [[ -e INSTALL-SECURITY-REPORT.adoc ]]; then
+    echo 'bootstrap reported success after a failed diagnostic' >&2
+    exit 1
+fi
+# Select a real setup recipe (just --list indents recipe names).
+printf 'setup:\n    exit 23\n' > Justfile
+expect 23 env PATH="$tmp/bin" /bin/sh ./setup.sh
+printf 'entrypoint controls: %s passed\n' "$checks"
diff --git a/scripts/doctor.sh b/scripts/doctor.sh
new file mode 100644
index 0000000..d224917
--- /dev/null
+++ b/scripts/doctor.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+# Local, read-only availability probes. No network, repair, or telemetry.
+set -u
+failed=0
+for tool in cargo rustc git just; do
+    if command -v "$tool" >/dev/null 2>&1 && "$tool" --version >/dev/null 2>&1; then
+        printf '[OK] %s responds to --version\n' "$tool"
+    else
+        printf '[FAIL] %s missing or unable to run\n' "$tool" >&2
+        failed=1
+    fi
+done
+printf '%s\n' 'Availability only: use cargo build --locked --release to check compiler and dependency compatibility.'
+exit "$failed"
diff --git a/setup.sh b/setup.sh
index b057416..908a944 100755
--- a/setup.sh
+++ b/setup.sh
@@ -205,13 +205,13 @@ main() {
 
     # Step 3: Run just setup
     printf "%sStep 2: Project setup%s\n" "$BOLD" "$RESET"
-    if just --list 2>/dev/null | grep -q "^setup "; then
+    if just --show setup >/dev/null 2>&1; then
         just setup
-    elif just --list 2>/dev/null | grep -q "^setup-dev "; then
+    elif just --show setup-dev >/dev/null 2>&1; then
         just setup-dev
     else
         warn "No 'setup' recipe in Justfile — running 'just doctor' instead"
-        just doctor 2>/dev/null || true
+        just doctor
     fi
     printf "\n"
 

From f81d5d83fd1e4cdf301d60dca27ba422728cc0ca Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 4 Nov 2026 14:11:26 +0000
Subject: [PATCH 09/11] fix: address installation review and constrain Rust
 probes

---
 QUICKSTART-USER.adoc                 |  7 +++++--
 docs/ASSURANCE-AUDIT-2026-11-04.adoc | 10 ++++++++++
 scripts/ci/test-entrypoints.sh       |  6 +++++-
 scripts/doctor.sh                    |  6 ++++--
 4 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/QUICKSTART-USER.adoc b/QUICKSTART-USER.adoc
index 1a7b1e7..00fc66a 100644
--- a/QUICKSTART-USER.adoc
+++ b/QUICKSTART-USER.adoc
@@ -22,12 +22,12 @@ git clone https://github.com/hyperpolymath/panic-attack.git
 cd panic-attack
 cargo build --locked --release
 ./target/release/panic-attack --help
-./target/release/panic-attack assail . --fail-on-incomplete
+./target/release/panic-attack assail . --fail-on-incomplete --output panic-report.json
 ----
 
 A self-scan can return findings or incomplete coverage, including from deliberate
 test fixtures. Do not interpret a nonzero scan exit as an installation failure;
-inspect the report and coverage outcome.
+inspect `panic-report.json` for individual findings and the coverage outcome.
 
 == Optional task runner and installation
 
@@ -40,6 +40,9 @@ This recipe does not install prerequisites or offer a portable/prefix option.
 nonzero for a missing or broken tool. It does not check compiler compatibility,
 network connectivity, runtime safety, or prove a build will succeed.
 Use the locked build above to check compiler and dependency compatibility.
+The probe disables automatic toolchain installation with rustup 1.28.1 and
+later. Older rustup versions and external tool-manager shims may still perform
+their own setup; the diagnostic is not a sandbox around those programs.
 
 == Troubleshooting
 
diff --git a/docs/ASSURANCE-AUDIT-2026-11-04.adoc b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
index 4672eb0..4e7c271 100644
--- a/docs/ASSURANCE-AUDIT-2026-11-04.adoc
+++ b/docs/ASSURANCE-AUDIT-2026-11-04.adoc
@@ -70,3 +70,13 @@ align developer/maintainer quickstarts; replace broad chmod/cache-deletion heal
 with bounded repair plans; integrate canonical provisioning DEED and generated
 provider exports; specify opt-in platform disclosure and Bustfile-based diagnosis.
 These are pending work, not capabilities supplied by this entrypoint repair.
+
+App-review follow-up: the fixture now includes the checked-in imported
+`contractile.just`; the user command saves `panic-report.json`; and probes set
+`RUSTUP_AUTO_INSTALL=0`. The expanded 16-control suite passes locally, including
+an inherited auto-install setting overridden for the Rust probes. This control
+checks environment propagation with stand-ins, not a real Rustup installation.
+Rustup documents the opt-out from 1.28.1; earlier versions and external shims
+remain outside a guaranteed no-side-effect boundary, now stated explicitly.
+See https://blog.rust-lang.org/2025/03/04/Rustup-1.28.1/ and
+https://rust-lang.github.io/rustup/environment-variables.html.
diff --git a/scripts/ci/test-entrypoints.sh b/scripts/ci/test-entrypoints.sh
index 5298bd6..25a7d5c 100644
--- a/scripts/ci/test-entrypoints.sh
+++ b/scripts/ci/test-entrypoints.sh
@@ -9,7 +9,7 @@ just_bin=$(realpath "$just_bin")
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT
 mkdir -p "$tmp/bin" "$tmp/repo/scripts"
-cp "$root/Justfile" "$root/setup.sh" "$tmp/repo/"
+cp "$root/Justfile" "$root/contractile.just" "$root/setup.sh" "$tmp/repo/"
 cp "$root/scripts/doctor.sh" "$tmp/repo/scripts/"
 ln -s /bin/sh "$tmp/bin/sh"
 ln -s "$(command -v head)" "$tmp/bin/head"
@@ -33,6 +33,10 @@ expect() {
 }
 expect 0 "$just_bin" --list
 expect 0 env PATH="$tmp/bin" "$just_bin" doctor
+for tool in cargo rustc; do
+    printf '#!/bin/sh\n[ "${RUSTUP_AUTO_INSTALL:-}" = 0 ]\n' > "$tmp/bin/$tool"
+done
+expect 0 env PATH="$tmp/bin" RUSTUP_AUTO_INSTALL=1 "$just_bin" doctor
 for tool in cargo rustc git; do
     mv "$tmp/bin/$tool" "$tmp/$tool"
     expect 1 env PATH="$tmp/bin" "$just_bin" doctor
diff --git a/scripts/doctor.sh b/scripts/doctor.sh
index d224917..da10ac5 100644
--- a/scripts/doctor.sh
+++ b/scripts/doctor.sh
@@ -1,11 +1,13 @@
 #!/bin/sh
 # SPDX-License-Identifier: MPL-2.0
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-# Local, read-only availability probes. No network, repair, or telemetry.
+# Local availability probes; no repair or telemetry requested.
+# Disable implicit rustup installs on rustup >= 1.28.1. Older/external shims
+# may have their own side effects; these probes are not a process sandbox.
 set -u
 failed=0
 for tool in cargo rustc git just; do
-    if command -v "$tool" >/dev/null 2>&1 && "$tool" --version >/dev/null 2>&1; then
+    if command -v "$tool" >/dev/null 2>&1 && RUSTUP_AUTO_INSTALL=0 "$tool" --version >/dev/null 2>&1; then
         printf '[OK] %s responds to --version\n' "$tool"
     else
         printf '[FAIL] %s missing or unable to run\n' "$tool" >&2

From d48fc28ef2dd95eff34c42ba2b9fe3394410bb99 Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Wed, 4 Nov 2026 15:01:21 +0000
Subject: [PATCH 10/11] docs: document setup entry point behavior and failure
 handling

<!-- coderabbit-ai-generated:v1 -->
---
 setup.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/setup.sh b/setup.sh
index 908a944..38ce753 100755
--- a/setup.sh
+++ b/setup.sh
@@ -166,6 +166,13 @@ install_just() {
 }
 
 # ── Main ──
+# Set up the project from the current directory, installing just if needed.
+# Run the first recipe whose `just --show` probe succeeds: setup, then
+# setup-dev; otherwise run doctor. On success, overwrite
+# INSTALL-SECURITY-REPORT.adoc with platform details and print security status.
+# Exit 1 if just is unavailable after the install attempt or neither Justfile
+# nor justfile is present. A failed selected recipe or report write stops the
+# script with a non-zero status; failed recipe probes select the next option.
 main() {
     printf "%s=== panic-attacker Setup ===%s\n\n" "$BOLD" "$RESET"
 

From 7aa933513c19b925f055a247fd0c3f6f700e6f6a Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 4 Nov 2026 15:14:19 +0000
Subject: [PATCH 11/11] docs: clarify Zig native compiler prerequisite

---
 QUICKSTART-USER.adoc | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/QUICKSTART-USER.adoc b/QUICKSTART-USER.adoc
index 00fc66a..d10c890 100644
--- a/QUICKSTART-USER.adoc
+++ b/QUICKSTART-USER.adoc
@@ -13,8 +13,12 @@ Use a compatible compiler rather than updating every language toolchain.
 The optional GUI has additional compiler and system-library requirements.
 Scanning a language does not require installing that language's compiler.
 
-The following commands assume a POSIX shell, Git, a working native linker,
-and access to the pinned dependencies. They do not require just, mise, or Guix.
+The following commands assume a POSIX shell, Git, Zig configured to compile
+native C dependencies through `zig cc`, a working native linker, and access
+to the pinned dependencies. The default build compiles C sources from
+`tree-sitter-php`. Installing Zig alone does not select it for Cargo's native
+dependency build scripts; configure their C compiler before building.
+These commands do not require just, mise, or Guix.
 
 [source,shell]
 ----