diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json
index 7f89fa5ab..b2ec16383 100644
--- a/.hypatia-baseline.json
+++ b/.hypatia-baseline.json
@@ -1,198 +1,4 @@
 [
- {
-  "severity": "critical",
-  "rule_module": "cicd_rules",
-  "type": "banned_language_file",
-  "file": "scripts/check-ts-allowlist.ts",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine TS-ban hit: portable Deno CLI script = the policy's 'convert-now bucket' for AffineScript. Non-trivial (needs compile-verified .affine wired in same PR, byte-identical behaviour). Baseline wit",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#254"
- },
- {
-  "severity": "high",
-  "rule_module": "cicd_rules",
-  "type": "missing_requirement",
-  "file": ".github/workflows/scorecard.yml",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Scorecard requirement is functionally satisfied by scorecard-enforcer.yml (push+weekly cron+dispatch) and scorecard-reusable.yml; rule matches the literal filename scorecard.yml instead of scorecard-a",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#399"
- },
- {
-  "severity": "critical",
-  "rule_module": "code_safety",
-  "type": "agda_postulate",
-  "file": "lol/proofs/theories/information_theory.agda",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine postulates but documented justified axioms of Shannon/Gibbs/Lin theorems, unprovable over IEEE754 Float without an R formalisation. Proof debt tracked; lol/ awaits eviction (#494).",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#124"
- },
- {
-  "severity": "medium",
-  "rule_module": "code_safety",
-  "type": "as_ptr",
-  "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): No dangling: every as_ptr comes from a named CString binding that outlives the synchronous FFI call. Idiomatic CString FFI; rule cannot see lifetimes."
- },
- {
-  "severity": "medium",
-  "rule_module": "code_safety",
-  "type": "expect_in_hot_path",
-  "file": "a2ml/bindings/rust/benches/a2ml_bench.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Criterion bench harness, not a production hot path; expect on static fixtures is idiomatic and unreachable by user input. Rule should exclude benches/."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "js_innerhtml",
-  "file": "2-protocols/avow/public/demo.js",
-  "note": "TRACKED (trivial fix available, not applied in this CI-hygiene PR): Genuine DOM XSS: user input flows unescaped into innerHTML in the public demo page. Low blast radius (self-XSS on a demo) but a real fix (textContent/escaping) is needed. Product evicting under #492.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#492"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "js_innerhtml",
-  "file": "2-protocols/axel/src/Tea.res.js",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real XSS surface: any view interpolating user data reaches innerHTML unescaped. File is bsc compiled output of Tea.res \u2014 fix belongs in the .res source. Product evicting under #492.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#492"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "ncl_http_url",
-  "file": "1-formats/k9/register.ncl",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The http:// strings are an XML namespace URI and a DTD public identifier \u2014 opaque identifiers mandated by the freedesktop/Apple specs, never fetched. Changing them to https would break MIME registrati"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "rwlock_unwrap",
-  "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine: a single panic while holding the lock poisons it and every subsequent session operation panics (DoS cascade). Needs poison handling or parking_lot. Product evicting under #492.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#492"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "rwlock_unwrap",
-  "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Test-only mock of the production SessionManager; never shipped. The production copy is already flagged (findings 25/26, REAL_DEBT #492). Double report against test scaffolding."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "rwlock_unwrap",
-  "file": "9-archive/rhodium-standard-repositories/examples/enterprise-service/src/handlers.rs",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real: exemplar code in the estate standard demonstrates unhandled lock poisoning; copies propagate the antipattern. Estate-authored (examples/ dir, distinct from third-party satellites/). Tracked by R",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#493"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "shell_download_then_run",
-  "file": "1-formats/a2ml/agentic/scripts/bootstrap.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same template-shared bootstrap as id 41 (byte-identical pattern). One template fix (download + sha256-verify + run) clears all instances.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#399"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "shell_download_then_run",
-  "file": "1-formats/a2ml/neurosym/scripts/bootstrap.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real download-and-execute. Template-shared bootstrap (identical in agentic-a2ml and rsr-deployer) \u2014 fix the template once: download to file, verify sha256, then run.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#399"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "shell_download_then_run",
-  "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Pipe-to-shell appears only as printed install advice, never executed. Also a vendored satellite under #493 \u2014 never edit regardless. Rule should ignore echo/string contexts."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "shell_download_then_run",
-  "file": "9-archive/rhodium-standard-repositories/satellites/rsr-deployer/scripts/bootstrap.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real download-and-execute, but inside a vendored satellite of rhodium-standard-repositories: flag-only, never propose in-place edits; real fix lands via the eviction campaign.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#493"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "shell_download_then_run",
-  "file": "setup.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real curl|bash of the just installer with no integrity check; root scaffold slated for cleanup under the scaffold-junk carve-out.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#496"
- },
- {
-  "severity": "medium",
-  "rule_module": "code_safety",
-  "type": "unsafe_block",
-  "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Genuine hygiene gap (missing SAFETY comments on FFI calls) in example code of a product awaiting eviction; baseline with expiry under the avow-protocol carve-out.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#492"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "unwrap_without_check",
-  "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same 5 lines as finding 26 (rwlock_unwrap) \u2014 generic rule double-counts the RwLock rule. Underlying issue is real: poison cascades panics in the production session manager. Evicting under #492.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#492"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "unwrap_without_check",
-  "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): tests-offline is a test/mock crate (offline mirror of session_manager for testing). Panic IS the test-failure mode; unwrap in test code is idiomatic. Rule should exclude test crates."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "unwrap_without_check",
-  "file": "a2ml/bindings/rust/benches/a2ml_bench.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The sole unwrap match is text inside a benchmark fixture string, not code. Upstream rule should skip string-literal contents."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "unwrap_without_check",
-  "file": "a2ml/bindings/rust/src/parser.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The single production unwrap is provably infallible (len>=3 guard guarantees a first char). Remaining unwraps are a doc-comment (L32) and #[test] code (L499+)."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "unwrap_without_check",
-  "file": "a2ml/lsp/src/completions.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All 6 unwraps are const-pattern regex compiles or guaranteed capture groups \u2014 infallible. Same rule misfire class as ids 35/36."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "unwrap_without_check",
-  "file": "a2ml/lsp/src/diagnostics.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All 15 unwraps are const-pattern Regex::new() or mandatory capture groups after a successful match \u2014 provably infallible, no user-input panic path. Upstream: whitelist const-regex unwrap."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "unwrap_without_check",
-  "file": "a2ml/lsp/src/hover.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same infallible const-regex/mandatory-capture pattern as diagnostics.rs; cannot panic at runtime. Baseline permanently."
- },
  {
   "severity": "high",
   "rule_module": "code_safety",
@@ -200,49 +6,6 @@
   "file": "9-archive/rhodium-standard-repositories/examples/enterprise-service/benches/api_benchmarks.rs",
   "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Benchmark harness setup; panic on runtime-creation failure is the intended and only sensible failure mode. Not a DoS surface. Rule should exclude benches/ directories."
  },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "unwrap_without_check",
-  "file": "9-archive/rhodium-standard-repositories/examples/enterprise-service/src/handlers.rs",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same 4 production lines as finding 30 (rwlock rule double-count). Estate-authored RSR example (examples/, not satellites/) that teaches the poison-cascade antipattern. RSR evicting under #493.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#493"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "zig_align_cast",
-  "file": "lol/ffi/zig/src/main.zig",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Same shim-template issue as id 47 (each @alignCast pairs with a flagged @ptrCast); one template fix with handle validation covers both rule hits.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#494"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "zig_ptr_cast",
-  "file": "lol/api/zig-gateway/src/lol_ffi.zig",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Rule matched @ptrCast inside a // comment; no actual cast in the file. Upstream rule should strip comments before matching."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "zig_ptr_cast",
-  "file": "lol/ffi/zig/src/main.zig",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Real unchecked handle recovery (garbage handle = UB); this is the estate-wide vendored FFI shim pattern (~230x) \u2014 fix the shim template (magic-number handle validation), tracked with lol eviction.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#494"
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "zig_ptr_cast",
-  "file": "2-protocols/overlay/ffi/zig/src/main.zig",
-  "note": "TRACKED (trivial fix available, not applied in this CI-hygiene PR): The cast is sound only if termination is guaranteed; it is not when the message exactly fills the 1024-byte buffer, giving the C caller an out-of-bounds read. One-character fix.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#399"
- },
  {
   "severity": "high",
   "rule_module": "code_scanning_alerts",
@@ -271,48 +34,6 @@
   "file": ".github/workflows/scorecard.yml",
   "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Stale 46-day-old mirror (standards#378) against a file since renamed to scorecard-enforcer.yml/scorecard-reusable.yml; the missing_requirement alert has no current target."
  },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying rwlock unwrap already tracked by the primary rule. repo-guardian-fs/** carved out to #492."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); also test code, where lock unwrap is idiomatic. repo-guardian-fs/** carved out to #492."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "a2ml/lsp/src/completions.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying alert already exists as the primary code_safety finding. a2ml/** carved out to #490."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "a2ml/lsp/src/diagnostics.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own unwrap_without_check alert (standards#378). a2ml/** carved out to #490."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "a2ml/lsp/src/hover.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying unwraps are compile-constant regexes plus a guarded caps.get(1). a2ml/** carved out to #490."
- },
- {
-  "severity": "medium",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); as_ptr into an FFI param struct is the intended example-code pattern. 2-protocols/avow/** carved out to #492."
- },
  {
   "severity": "high",
   "rule_module": "code_scanning_alerts",
@@ -320,13 +41,6 @@
   "file": "1-formats/k9/register.ncl",
   "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doubly false: CSA mirror double-report (#378) AND underlying ncl_http_url matched XML namespace identifiers which are opaque strings, never dereferenced. 1-formats/k9/** carved out to #491."
  },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "lol/api/zig-gateway/src/lol_ffi.zig",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doubly false: CSA mirror double-report (#378) AND the underlying alert matched a comment, not code. lol/** is also carved out to #494."
- },
  {
   "severity": "high",
   "rule_module": "code_scanning_alerts",
@@ -344,16 +58,11 @@
  {
   "severity": "high",
   "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "scorecard.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): hypatia re-ingesting its own workflow_audit alert. Underlying gap is tracked by the original alert; baseline permanently."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA001",
-  "file": "scripts/check-ts-allowlist.ts",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); underlying banned_language_file is emitted by cicd_rules directly. The .ts is the allowlist checker, in the grandfathered TS\u2192AffineScript migration bucket (#252 t"
+  "type": "CSA003",
+  "file": "9-archive/rhodium-standard-repositories/templates/setup.sh.template",
+  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378 of a Scorecard alert; file lives in rhodium-standard-repositories, carve-out #493 (template awaiting eviction). Re-acked 2026-10-14 (P1.1): CSA findings echo live Scorecard alert state and cannot be re-verified from the tree; the pinned scanner emitted no CSA finding on main (dead PAT), so this ack is kept as the tripwire #957 describes until that issue is ruled. Tracker #378 was closed.",
+  "expires_at": "2026-12-22",
+  "tracking_issue": "hyperpolymath/standards#957"
  },
  {
   "severity": "high",
@@ -371,485 +80,66 @@
  },
  {
   "severity": "medium",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA002",
-  "file": "hyperpolymath/standards",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): aggregate counter of alerts hypatia already re-reports one-by-one; triple-counting by construction. Baseline permanently."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": ".github/workflows/changelog-reusable.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already follows the recommended pattern (read at top, write scoped per-job)."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": ".github/workflows/hypatia-scan-reusable.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378; security-events: write at top level is the documented requirement for SARIF upload from the reusable scan."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": ".github/workflows/hypatia-scan.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already declares least-privilege top-level perms with a documented, deliberate grant for SARIF upload."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": ".github/workflows/scorecard.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia's own missing_requirement alert; Scorecard coverage exists under scorecard-reusable.yml/scorecard-enforcer.yml, so the naming expectation is stale."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/src/session_manager.rs",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378. Underlying rwlock-unwrap debt is real-but-tracked in the repo-guardian-fs eviction carve-out #492; the CSA003 staleness echo adds nothing.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#378"
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "2-protocols/0-ai-gatekeeper/repo-guardian-fs/tests-offline/src/lib.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378. Also test-only code (tests-offline), where unwrap is conventional; product tracked under #492."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "a2ml/lsp/src/completions.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own alert; underlying unwrap debt rides the a2ml eviction carve-out #490."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "a2ml/lsp/src/diagnostics.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own alert; a2ml/** tracked under eviction #490."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "a2ml/lsp/src/hover.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own unwrap_without_check alert; a2ml/** product debt tracked under eviction #490."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "2-protocols/avow/avow-lib/examples/rust/src/main.rs",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378: hypatia re-ingests its own code-scanning alert. Underlying file is avow-protocol product awaiting eviction (#492); as_ptr in an FFI example is idiomatic."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "1-formats/k9/register.ncl",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Double-false: mirror double-report per standards#378, AND the underlying ncl_http_url alert flags XML namespace/DTD identifiers, which are opaque IDs never fetched over HTTP. k9-svc carve-out #491."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "lol/api/zig-gateway/src/lol_ffi.zig",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own alert; lol/** is carved out for eviction under #494 where the real work is tracked."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "2-protocols/overlay/ffi/zig/src/main.zig",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): hypatia re-ingesting its own code_safety alert. Underlying shim debt is the estate-wide template-rot campaign (fix the boj-server template once)."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "9-archive/rhodium-standard-repositories/templates/setup.sh.template",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378 of a Scorecard alert; file lives in rhodium-standard-repositories, carve-out #493 (template awaiting eviction).",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#378"
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "scorecard.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia workflow_audit/missing_workflow; the scorecard workflow exists under different filenames \u2014 rule expects a fixed name."
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "scripts/check-ts-allowlist.ts",
-  "note": "TRACKED DEBT (hypatia triage 2026-07-21): Mirror double-report per standards#378. Underlying alert is also wrong at source: this is Deno-runtime tooling enforcing the TS allowlist itself; TS-tooling carve-outs exist in CLAUDE.md policy.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#378"
- },
- {
-  "severity": "high",
-  "rule_module": "code_scanning_alerts",
-  "type": "CSA003",
-  "file": "setup.sh",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): third reporting channel (hypatia alert + Scorecard alert + this mirror) for the same two lines. Baseline permanently."
- },
- {
-  "severity": "critical",
-  "rule_module": "security_errors",
-  "type": "secret_detected",
-  "file": "a2ml/actions/validate/.envrc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret."
- },
- {
-  "severity": "critical",
-  "rule_module": "security_errors",
-  "type": "secret_detected",
-  "file": "a2ml/bindings/deno/.envrc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Commented-out template placeholder (value is literally \"...\"); no credential present. Upstream rule should skip comment lines / \"...\" values. a2ml eviction tracked in #490."
- },
- {
-  "severity": "critical",
-  "rule_module": "security_errors",
-  "type": "secret_detected",
-  "file": "a2ml/bindings/haskell/.envrc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret."
- },
- {
-  "severity": "critical",
-  "rule_module": "security_errors",
-  "type": "secret_detected",
-  "file": "a2ml/bindings/rust/.envrc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder as id 96; commented out, value \"...\". No secret."
- },
- {
-  "severity": "critical",
-  "rule_module": "security_errors",
-  "type": "secret_detected",
-  "file": "a2ml/editors/vscode/.envrc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret. Fix the upstream generic-API-key rule to ignore commented placeholders."
- },
- {
-  "severity": "critical",
-  "rule_module": "security_errors",
-  "type": "secret_detected",
-  "file": "a2ml/pandoc/.envrc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/TRUSTED-BASE-REDUCTION-POLICY.adoc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Path is inside the `proven` repo, cited in an estate-wide trusted-base table. SD022 wrongly resolves cross-repo paths against the standards tree. Rule needs cross-repo-doc awareness."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/archive/provenance/echidna/ECHIDNA-TODO.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Archived provenance doc describing the echidna repo's tree, not standards'. Also historical (docs/archive/). SD022 cross-repo resolution error."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/audits/dogfooding-matrix-2026-04-04.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Estate-wide dogfooding audit; `src/scan/` is in the iseriser repo. Dated snapshot audit (2026-04-04) referencing another repo. SD022 cross-repo resolution error."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/REQUIREMENTS-MASTER.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doc is 'Proof Requirements Master \u2014 All 292 Repos'; `src/vql/` is verisimdb's tree. SD022 cross-repo resolution error."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T1-critical/ProvenCrypto.jl.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template explicitly targets the ProvenCrypto.jl repo; paths are relative to that repo. SD022 cross-repo resolution error."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T1-critical/echidna.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template for the echidna repo; `src/rust/` is echidna's tree. SD022 cross-repo resolution error."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T1-critical/ephapax.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template for the ephapax repo; `src/formal/` is ephapax's tree. SD022 cross-repo resolution error."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T1-critical/januskey.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template for the januskey repo; path is in that repo. SD022 cross-repo resolution error."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T1-critical/proven.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template explicitly targets the proven repo; `src/Proven/` is its Idris2 source tree. SD022 cross-repo resolution error."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T1-critical/svalinn.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template targets the svalinn repo; path is in that repo. SD022 cross-repo resolution error."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T1-critical/verisimdb.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Spec template targets the verisimdb repo; `src/vcl/` is its tree. SD022 cross-repo resolution error."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T2-high/conflow.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Proof-spec template for the external conflow repo; src/pipeline/ is conflow's tree, not standards'. Not drift \u2014 upstream rule should skip cross-repo spec templates."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T2-high/panic-attacker.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Path belongs to the panic-attacker repo, not standards. Cross-repo spec template; baseline permanently."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T2-high/panll.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Describes panll's tree, not standards'. Cross-repo spec template; baseline permanently."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T2-high/reposystem.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): External-repo key-files list; not a local dangling reference."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/spec-templates/T2-high/statistease.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): statistease repo's Julia sources, not standards'. Cross-repo spec template; baseline permanently."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "2-protocols/k9-coordination/spec/COORDINATION-K9-SPEC.adoc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Illustrative YAML example in a protocol spec (sample invariants/protected config for a hypothetical project). Not a reference to this repo's tree."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "1-formats/a2ml/meta/spec/SCM-FORMAT-FAMILY.adoc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Sample SCM session data in a format spec \u2014 the path is example payload content, not a repo reference."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "1-formats/sub-specs/panll-panels/README.adoc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Explicitly a path in the external PanLL repo (future destination), not this tree. Intentional cross-repo reference."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "9-archive/rhodium-standard-repositories/docs/haskell-registry-design.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Design doc laying out a proposed rsr-registry Haskell service; src/RSR/ is the design's target layout, not an existing dir. Also inside RSR carve-out #493."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "9-archive/rhodium-standard-repositories/satellites/META.scm/spec/SCM-FORMAT-FAMILY.adoc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Vendored satellite copy of the SCM spec \u2014 same illustrative example payload as meta-a2ml. Satellite is third-party-treated: never edit; baseline permanently."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/PROJECT_MANAGEMENT/RECONCILIATION_AUDIT.md",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Historical audit record of a GitLab source repo path that was deliberately NOT imported \u2014 prose-history by design. Vendored satellite: never edit."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "3-practice/testing-and-benchmarking/TESTING-TAXONOMY.adoc",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All src/rust/ mentions are explicitly paths inside the external echidna repo (named on each line). Cross-repo reference, not local drift."
- },
- {
-  "severity": "high",
-  "rule_module": "workflow_audit",
-  "type": "missing_workflow",
-  "file": "scorecard.yml",
-  "note": "TRACKED (trivial fix available, not applied in this CI-hygiene PR): Required caller workflow genuinely absent while the reusable already exists in-repo; a 15-line thin wrapper closes it.",
-  "expires_at": "2026-10-21",
-  "tracking_issue": "hyperpolymath/standards#399"
- },
- {
-  "severity": "high",
-  "rule_module": "workflow_audit",
-  "type": "scorecard_publish_with_run_step",
-  "file": "scorecard-enforcer.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): OSSF publish verification restricts publishing workflows; enforcement run-steps belong apart. scorecard-reusable.yml already publishes \u2014 enforcer should not double-publish."
- },
- {
-  "severity": "high",
-  "rule_module": "workflow_audit",
-  "type": "secret_action_without_presence_gate",
-  "file": "instant-sync.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Presence gate exists via the env-mapped pattern (secrets context is illegal in step if:). Rule must learn to recognize job-level env secret mapping + env-based step if:. Baseline permanently."
- },
- {
-  "severity": "high",
-  "rule_module": "workflow_audit",
-  "type": "secret_action_without_presence_gate",
-  "file": "mirror-reusable.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): mirror-gitlab ssh-agent step IS presence-gated via env mapping; comment L54-57 documents why secrets can't appear in if:. Same upstream rule gap as instant-sync. Baseline permanently."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "zig_ptr_cast",
-  "file_pattern": "**/ffi/zig/**",
-  "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time."
- },
- {
-  "severity": "medium",
-  "rule_module": "code_safety",
-  "type": "zig_bit_cast",
-  "file_pattern": "**/ffi/zig/**",
-  "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "zig_align_cast",
-  "file_pattern": "**/ffi/zig/**",
-  "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time."
- },
- {
-  "severity": "high",
-  "rule_module": "code_safety",
-  "type": "zig_ptr_cast",
-  "file_pattern": "**/zig-gateway/**",
-  "note": "FFI boundary. A Zig shim crossing into a foreign runtime must reinterpret opaque pointers; the cast is unavoidable in the host language and the guarantee holds on the core's side of the boundary. Architectural, not deferred \u2014 it does not shrink over time."
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file_pattern": "docs/proofs/spec-templates/**/*.adoc",
-  "note": "FALSE POSITIVE CLASS (2026-08-24): these are cross-repository proof-spec templates. Their src/... examples describe the target repository named by each template, not directories asserted to exist inside standards. The Markdown-to-AsciiDoc migration made this established corpus newly visible to SD022.",
-  "tracking_issue": "hyperpolymath/standards#399"
- },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": ".machine_readable/archive/scorecards-v1/hypatia-rules.scorecard.a2ml",
-  "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify whether the src/A2ML path is target-relative example content or stale repository-local documentation.",
-  "expires_at": "2026-11-29",
-  "tracking_issue": "hyperpolymath/standards#687"
+  "rule_module": "code_scanning_alerts",
+  "type": "CSA002",
+  "file": "hyperpolymath/standards",
+  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): aggregate counter of alerts hypatia already re-reports one-by-one; triple-counting by construction. Baseline permanently."
  },
  {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": ".machine_readable/template-capability-gates.toml",
-  "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the template's target-relative src/interface path before changing either content or rule semantics.",
-  "expires_at": "2026-11-29",
-  "tracking_issue": "hyperpolymath/standards#687"
+  "severity": "high",
+  "rule_module": "code_scanning_alerts",
+  "type": "CSA003",
+  "file": ".github/workflows/changelog-reusable.yml",
+  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already follows the recommended pattern (read at top, write scoped per-job)."
  },
  {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "0-canon/TEMPLATE-APPLICABILITY-POLICY.adoc",
-  "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the policy's target-relative src/interface example before correction or rule refinement.",
-  "expires_at": "2026-11-29",
-  "tracking_issue": "hyperpolymath/standards#687"
+  "severity": "high",
+  "rule_module": "code_scanning_alerts",
+  "type": "CSA003",
+  "file": ".github/workflows/hypatia-scan-reusable.yml",
+  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378; security-events: write at top level is the documented requirement for SARIF upload from the reusable scan."
  },
  {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/audits/dogfooding-matrix-2026-04-04.adoc",
-  "note": "TEMPORARY REVIEW BASELINE (2026-08-29): historical audit path may be intentionally historical or stale; review without rewriting audit evidence.",
-  "expires_at": "2026-11-29",
-  "tracking_issue": "hyperpolymath/standards#687"
+  "severity": "high",
+  "rule_module": "code_scanning_alerts",
+  "type": "CSA003",
+  "file": ".github/workflows/hypatia-scan.yml",
+  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of Scorecard TokenPermissionsID; workflow already declares least-privilege top-level perms with a documented, deliberate grant for SARIF upload."
  },
  {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "docs/proofs/REQUIREMENTS-MASTER.adoc",
-  "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the src/vql and src/registry references as target-relative requirements or local drift.",
-  "expires_at": "2026-11-29",
-  "tracking_issue": "hyperpolymath/standards#687"
+  "severity": "high",
+  "rule_module": "code_scanning_alerts",
+  "type": "CSA003",
+  "file": ".github/workflows/scorecard.yml",
+  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378 of hypatia's own missing_requirement alert; Scorecard coverage exists under scorecard-reusable.yml/scorecard-enforcer.yml, so the naming expectation is stale."
  },
  {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "2-protocols/groove/spec/GROOVE-RANKED-OWNERSHIP-CLEAVE-SPEC.adoc",
-  "note": "TEMPORARY REVIEW BASELINE (2026-08-29): the Groove spec references a consumer source layout; verify target context before altering the interface design.",
-  "expires_at": "2026-11-29",
-  "tracking_issue": "hyperpolymath/standards#687"
+  "severity": "high",
+  "rule_module": "code_scanning_alerts",
+  "type": "CSA003",
+  "file": "1-formats/k9/register.ncl",
+  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Double-false: mirror double-report per standards#378, AND the underlying ncl_http_url alert flags XML namespace/DTD identifiers, which are opaque IDs never fetched over HTTP. k9-svc carve-out #491."
  },
  {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "9-archive/rhodium-standard-repositories/docs/haskell-registry-design.adoc",
-  "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the src/RSR reference against the documented target repository rather than assuming local drift.",
-  "expires_at": "2026-11-29",
-  "tracking_issue": "hyperpolymath/standards#687"
+  "severity": "high",
+  "rule_module": "code_scanning_alerts",
+  "type": "CSA003",
+  "file": "2-protocols/overlay/ffi/zig/src/main.zig",
+  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): hypatia re-ingesting its own code_safety alert. Underlying shim debt is the estate-wide template-rot campaign (fix the boj-server template once)."
  },
  {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/PROJECT_MANAGEMENT/RECONCILIATION_AUDIT.adoc",
-  "note": "TEMPORARY REVIEW BASELINE (2026-08-29): preserve the satellite audit while classifying its src/widget-ts and src/scripts references.",
-  "expires_at": "2026-11-29",
-  "tracking_issue": "hyperpolymath/standards#687"
+  "severity": "high",
+  "rule_module": "code_scanning_alerts",
+  "type": "CSA003",
+  "file": "setup.sh",
+  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378): third reporting channel (hypatia alert + Scorecard alert + this mirror) for the same two lines. Baseline permanently."
  },
  {
   "severity": "medium",
   "rule_module": "structural_drift",
   "type": "SD022",
-  "file": "0-canon/rsr/LANGUAGE-POLICY.adoc",
-  "note": "TEMPORARY REVIEW BASELINE (2026-08-29): classify the src/api policy example as target-relative content or stale local documentation.",
-  "expires_at": "2026-11-29",
-  "tracking_issue": "hyperpolymath/standards#687"
+  "file": "1-formats/sub-specs/panll-panels/README.adoc",
+  "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Explicitly a path in the external PanLL repo (future destination), not this tree. Intentional cross-repo reference."
  },
  {
   "severity": "critical",
@@ -959,96 +249,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#941"
  },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE005",
-  "file": ".github/workflows/echidna-verify.yml",
-  "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#942"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE005",
-  "file": ".github/workflows/affinescript-verify.yml",
-  "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#942"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE005",
-  "file": ".github/workflows/readme-derive-reusable.yml",
-  "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#942"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE005",
-  "file": ".github/workflows/changelog-reusable.yml",
-  "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#942"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE005",
-  "file": ".github/workflows/hypatia-scan-reusable.yml",
-  "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#942"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE005",
-  "file": ".github/workflows/scorecard-enforcer.yml",
-  "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#942"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE005",
-  "file": ".github/workflows/secret-scanner-reusable.yml",
-  "note": "TOLERATED PENDING CLASSIFICATION (hypatia triage 2026-09-22): flagged exit-masking step not yet reviewed; verify fail-closed-with-fallback or file a masking bug.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#942"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE005",
-  "file": ".github/workflows/governance-reusable.yml",
-  "note": "VERIFIED FAIL-CLOSED (hypatia triage 2026-09-22): best-effort helper checkout whose next step names the missing piece and exits non-zero; masking is by design, not a bug.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#942"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE005",
-  "file": ".github/workflows/ci-pipeline.yml",
-  "note": "VERIFIED FAIL-CLOSED (hypatia triage 2026-09-22): best-effort helper checkout whose next step names the missing piece and exits non-zero; masking is by design, not a bug.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#942"
- },
- {
-  "severity": "warn",
-  "rule_module": "workflow_hardening",
-  "type": "WH006",
-  "file": ".github/workflows/codeql.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-09-22): a `uses:` caller job cannot carry timeout-minutes; the called reusable declares its own (20).",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#943"
- },
  {
   "severity": "warn",
   "rule_module": "workflow_hardening",
@@ -1085,15 +285,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#943"
  },
- {
-  "severity": "high",
-  "rule_module": "workflow_hardening",
-  "type": "WH013",
-  "file": ".github/workflows/mirror-reusable.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-09-22): pushes target FOREIGN repos via PAT, not GITHUB_TOKEN contents; `contents: read` is correct least privilege.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#943"
- },
  {
   "severity": "high",
   "rule_module": "workflow_hardening",
@@ -1112,15 +303,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#945"
  },
- {
-  "severity": "medium",
-  "rule_module": "structural_drift",
-  "type": "SD022",
-  "file": "2-protocols/k9-coordination/spec/COORDINATION-K9-SPEC.adoc",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): illustrative spec content referencing another project's path; needs an owner eyes-check before editing.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#945"
- },
  {
   "severity": "medium",
   "rule_module": "content_patterns",
@@ -1193,15 +375,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#940"
  },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "known_fake_action_sha",
-  "file": "9-archive/rhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/.github/workflows/comprehensive-quality.yml",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): placeholder SHAs inside vendored rhodium satellite example workflows, not live CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#940"
- },
  {
   "severity": "medium",
   "rule_module": "content_patterns",
@@ -1220,212 +393,68 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#940"
  },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "eval_in_shell",
-  "file": "9-archive/rhodium-standard-repositories/rsr-audit.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#939"
- },
  {
   "severity": "medium",
   "rule_module": "content_patterns",
   "type": "eval_in_shell",
   "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.",
+  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).",
   "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#939"
+  "tracking_issue": "hyperpolymath/standards#493"
  },
  {
   "severity": "medium",
   "rule_module": "content_patterns",
   "type": "eval_in_shell",
   "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#939"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "eval_in_shell",
-  "file": "scripts/tests/fill-placeholders-test.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#939"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "eval_in_shell",
-  "file": "scripts/tests/propagate-workflow-pins-test.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#939"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "download_then_run_shell",
-  "file": ".github/workflows/tag-ruleset-canon.yml",
-  "note": "FALSE POSITIVE (hypatia triage 2026-09-22): rule matches the scanner's own detection patterns/comments in this file; no real download-then-run present (verified).",
+  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).",
   "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#939"
+  "tracking_issue": "hyperpolymath/standards#493"
  },
  {
   "severity": "medium",
   "rule_module": "content_patterns",
   "type": "download_then_run_shell",
   "file": "9-archive/rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#939"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "download_then_run_shell",
-  "file": "setup.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#939"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "download_then_run_shell",
-  "file": "tests/test_tag_ruleset_canon.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#939"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "1-formats/sub-specs/inline-annotations/extractor/batch-extract.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "docs/UX-standards/comprehensive-launcher-template.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "docs/UX-standards/dustfile-template.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "docs/UX-standards/e-grade-launcher-template.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "launcher/soft-attach.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "9-archive/rhodium-standard-repositories/ux-test-harness/run-ux-test.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "9-archive/rhodium-standard-repositories/ux-test-harness/test-repo.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "scripts/check-lockfile-drift.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "scripts/registry-readiness.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
+  "note": "TRACKED DEBT (hypatia triage 2026-09-22): vendored satellite demo script pattern; not live estate CI. Re-acked 2026-10-14 (P1.1): still present (finding re-verified in the file and in the main@bf211558 CI scan); tracker #939 closed, moved to #493 (open; de-vendoring of the rhodium-standard-repositories satellites that carry this demo content).",
   "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
+  "tracking_issue": "hyperpolymath/standards#493"
  },
  {
   "severity": "medium",
   "rule_module": "content_patterns",
   "type": "hardcoded_tmp",
   "file": "scripts/sweep-classifiers/classify-codeql.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
+  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).",
   "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
+  "tracking_issue": "hyperpolymath/standards#1243"
  },
  {
   "severity": "medium",
   "rule_module": "content_patterns",
   "type": "hardcoded_tmp",
   "file": "scripts/sweep-classifiers/classify-hypatia-scan.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
+  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).",
   "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
+  "tracking_issue": "hyperpolymath/standards#1243"
  },
  {
   "severity": "medium",
   "rule_module": "content_patterns",
   "type": "hardcoded_tmp",
   "file": "scripts/sweep-classifiers/classify-mirror.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
+  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).",
   "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
+  "tracking_issue": "hyperpolymath/standards#1243"
  },
  {
   "severity": "medium",
   "rule_module": "content_patterns",
   "type": "hardcoded_tmp",
   "file": "scripts/sweep-classifiers/classify-secret-scanner.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
- },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "hardcoded_tmp",
-  "file": "scripts/sweep-classifiers/list-workflow-paths.sh",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass.",
+  "note": "TRACKED DEBT (hypatia triage 2026-09-22): new content_patterns module; hardcoded /tmp path pending a mktemp conversion pass. Re-acked 2026-10-14 (P1.1): still present at the default INPUT/BLOBS_DIR assignments under /tmp/drift-survey (finding re-verified in the file and in the main@bf211558 CI scan); tracker #936 closed (its mktemp pass, PR #1072, did not reach this script), moved to #1243 (open; same hardcoded-/tmp defect class in scripts/).",
   "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#936"
+  "tracking_issue": "hyperpolymath/standards#1243"
  },
  {
   "severity": "medium",
@@ -1454,15 +483,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#937"
  },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "http_in_docs",
-  "file": "3-practice/TRUST-DEFAULTS-POLICY.adoc",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#937"
- },
  {
   "severity": "medium",
   "rule_module": "content_patterns",
@@ -1499,15 +519,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#937"
  },
- {
-  "severity": "medium",
-  "rule_module": "content_patterns",
-  "type": "http_in_docs",
-  "file": "toolchain-readiness-grades/testing/LANGUAGE-TESTING-STANDARDS.adoc",
-  "note": "TRACKED DEBT (hypatia triage 2026-09-22): plain-HTTP URL in prose; needs per-instance eyes (protocol examples may be intentional) before flipping to https.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#937"
- },
  {
   "severity": "warn",
   "rule_module": "research_extensions",