Harden security checks and separate K9/DEED governance evidence

.github/dependabot.yml

@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: MPL-2.0
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  # Dependabot's npm ecosystem supports bun.lock. Julia and R pins remain
+  # maintainer-reviewed in tool_versions.yml, Manifest.toml and renv.lock.
+  - package-ecosystem: npm
+    directory: /frontend
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      development-tooling:
+        dependency-type: development
+        update-types: [minor, patch]

.github/workflows/ci.yml

@@ -172,6 +172,8 @@ jobs:
     # silently. If a matrix is ever genuinely wanted here, the required context must move
     # to a matrix-free aggregator job first.
     name: Julia tests
+    # R/Julia setup and integration tests are expensive, but may not hang for 6h.
+    timeout-minutes: 90
     needs: gate
     if: needs.gate.outputs.relevant == 'true'
     # Explicit, not ubuntu-latest: the R pin below names an apt package revision built
@@ -383,6 +385,12 @@ jobs:
           bun install --frozen-lockfile --ignore-scripts
           bun run build
 
+      - name: Audit frontend dependencies
+        working-directory: frontend
+        # Moderate advisories remain visible in `bun audit`; upgrading Router
+        # across a major version needs a separate routing/SSR review.
+        run: bun audit --audit-level high
+
       - name: Frontend unit tests
         working-directory: frontend
         run: bun run test
@@ -413,7 +421,11 @@ jobs:
         run: |
           set +e
           julia --project=. -t2 --compiled-modules=no test/runtests.jl numeric_policy exact_summaries high_precision derived_analyses validated_statistics 2>&1 | tee /tmp/validated-statistics-tests.log
-          status="${PIPESTATUS[0]}"
+          # Preserve both exits immediately: a successful Julia run must not
+          # hide a failed log write (e.g. a full runner filesystem).
+          statuses=("${PIPESTATUS[@]}")
+          status="${statuses[0]}"
+          if [ "$status" -eq 0 ]; then status="${statuses[1]}"; fi
           if [ "$status" -ne 0 ]; then
             enc() { head -c 3000 | sed -e 's/%/%25/g' -e 's/\r/%0D/g' | awk '{printf "%s%%0A", $0}'; }
             # One annotation cannot hold a failing run, and a tail hides every
@@ -450,7 +462,11 @@ jobs:
           command -v vsearch # The full suite must run the occupancy experiment, not skip it.
           set +e
           julia --project=. -t 2 --code-coverage=user --compiled-modules=no test/runtests.jl --integration --server 2>&1 | tee /tmp/julia-tests.log
-          status="${PIPESTATUS[0]}"
+          # Preserve both exits immediately: a successful Julia run must not
+          # hide a failed log write (e.g. a full runner filesystem).
+          statuses=("${PIPESTATUS[@]}")
+          status="${statuses[0]}"
+          if [ "$status" -eq 0 ]; then status="${statuses[1]}"; fi
           if [ "$status" -ne 0 ]; then
             enc() { head -c 3500 | sed -e 's/%/%25/g' -e 's/\r/%0D/g' | awk '{printf "%s%%0A", $0}'; }
             awk '

.github/workflows/governance.yml

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MPL-2.0
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
-# Fork governance lane. DEED syntax comes from hyperpolymath/standards; the
+# Fork governance lane. DEED and K9 conformance come from hyperpolymath/standards; the
 # Hypatia verdict grid uses a fork-local copy of the standards reusable so its
 # advisory PR scan cannot become a blocking code-scanning-results check. Both
 # sources are pinned to commits. The grid covers Hypatia, panic-attack, pons
@@ -38,7 +38,12 @@ jobs:
         with:
           persist-credentials: false
       - name: Check the advisory SARIF boundary
-        run: bash scripts/check-governance-contract.sh
+        run: |
+          bash scripts/check-governance-contract.sh
+          bash scripts/tests/test-governance-contract.sh
+          bash scripts/tests/test-ci-logging.sh
+          bash scripts/tests/test-k9-log-copy.sh
+          bash scripts/tests/test-scanner-boundaries.sh
 
   deed:
     name: DEED syntax
@@ -48,6 +53,18 @@ jobs:
     with:
       require-files: true
 
+  k9:
+    name: K9 conformance
+    uses: ./.github/workflows/k9-conformance-reusable.yml
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      # No K9 contracts are committed yet: report grey, never pretend that
+      # DEED syntax validation establishes K9 semantic conformance.
+      require-files: false
+      fail-on-indeterminate: true
+
   hypatia:
     name: Hypatia verdict grid
     needs: [workflow-contract]
@@ -64,7 +81,7 @@ jobs:
 
   verdict:
     name: Post the verdict grid
-    needs: [deed, hypatia]
+    needs: [deed, k9, hypatia]
     if: ${{ always() && github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -80,11 +97,20 @@ jobs:
           name: verdict-grid
           path: verdict-grid
 
+      - name: Download the K9 conformance grid
+        continue-on-error: true
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: k9-grid
+          path: k9-grid
+
       - name: Update the compact PR verdict
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           DEED_RESULT: ${{ needs.deed.result }}
+          K9_RESULT: ${{ needs.k9.result }}
+          K9_VERDICT: ${{ needs.k9.outputs.verdict }}
           HYPATIA_RESULT: ${{ needs.hypatia.result }}
           HYPATIA_VERDICT: ${{ needs.hypatia.outputs.verdict }}
         run: |
@@ -97,20 +123,33 @@ jobs:
             failure) deed='🔴 failing' ;;
             *)       deed="🟠 indeterminate ($DEED_RESULT)" ;;
           esac
+          # A rendered grid is not proof that its job completed successfully.
+          case "$K9_RESULT" in
+            success) k9="${K9_VERDICT:-orange}" ;;
+            failure) k9=red ;;
+            *)       k9=orange ;;
+          esac
           {
             echo '<!-- fork-governance-verdict: regenerated on every run -->'
             echo '# Fork governance'
             echo
             echo "| Lane | Status | Run |"
             echo "|---|---|---|"
             echo "| DEED syntax (repo deed) | $deed | [run $GITHUB_RUN_ID]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID) |"
+            echo "| K9 conformance (L0–L2; L3 not verified) | $k9 (job: $K9_RESULT) | same run |"
             echo "| Hypatia verdict grid | ${HYPATIA_VERDICT:-orange} (job: $HYPATIA_RESULT) | same run |"
             echo
             if [ -s verdict-grid/report.md ]; then
               cat verdict-grid/report.md
             else
               echo '🟠 indeterminate · no verdict-grid artifact was produced by the Hypatia lane; see the run.'
             fi
+            echo
+            if [ -s k9-grid/report.md ]; then
+              cat k9-grid/report.md
+            else
+              echo '🟠 indeterminate · no K9 grid artifact was produced; see the run.'
+            fi
           } > "$RUNNER_TEMP/body.md"
           # One comment per PR, updated in place; newest run wins.
           comment_id=$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \