fix(bot): verify prover contracts and the requested forge revision

.claude/CLAUDE.md

@@ -4,7 +4,7 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 ## Machine-Readable Artefacts
 
-The following files in `.machine_readable/6a2/` contain structured project metadata
+The following files in `.machine_readable/descriptiles/` contain structured project metadata
 (TOML-flavoured A2ML, migrated from Guile Scheme in `bdbc5a4`):
 
 - `STATE.a2ml` - Current project state and progress
@@ -35,7 +35,7 @@ The following files in `.machine_readable/6a2/` contain structured project metad
 | **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Bun APIs |
 | **Nickel** | Configuration language | For complex configs |
 | **Guile Scheme** | Guix packages | guix.scm, manifests/*.scm |
-| **A2ML (TOML)** | State/meta files | .machine_readable/6a2/*.a2ml |
+| **A2ML (TOML)** | State/meta files | .machine_readable/descriptiles/*.a2ml |
 | **Julia** | Batch scripts, data processing | Per RSR |
 | **OCaml** | AffineScript compiler | Language-specific |
 | **Ada** | Safety-critical systems | Where required |
@@ -108,8 +108,8 @@ Both are FOSS with independent governance (no Big Tech).
 
 ### First-read order (when entering this repo)
 
-1. `.machine_readable/6a2/STATE.a2ml` — blockers + completion-percentage + session notes
-2. `.machine_readable/6a2/AGENTIC.a2ml` — tooling constraints; check `[exceptions.*]`
+1. `.machine_readable/descriptiles/STATE.a2ml` — blockers + completion-percentage + session notes
+2. `.machine_readable/descriptiles/AGENTIC.a2ml` — tooling constraints; check `[exceptions.*]`
 3. `.machine_readable/bot_directives/echidnabot.a2ml` — self-mode + future-direction notes
 4. `EXPLAINME.adoc` — caveats on README claims (test counts, mode wiring, prover surface drift)
 5. `ROADMAP.adoc` — what's actually done vs aspirational
@@ -141,7 +141,7 @@ and the eventual fix path (promote to real submodule or delete
 `list_outcome_history`, `corpus_refresh`) is a documented carve-out
 from the estate-wide "all MCP through BoJ" rule. Scope: this repo
 only. Sunset: when the BoJ cartridge supports the double-loop
-feedback protocol. See `.machine_readable/6a2/AGENTIC.a2ml`
+feedback protocol. See `.machine_readable/descriptiles/AGENTIC.a2ml`
 `[exceptions.boj-only-mcp]` for the canonical record.
 
 ### Upstream-drift warning (12 vs 113 provers)
@@ -175,8 +175,8 @@ provers can land without touching the type. Use
 | New prover support              | `wiki/Supported-Provers.md` + `src/dispatcher/`         |
 | New bot-mode behaviour          | `wiki/FAQ.md` + `.machine_readable/bot_directives/echidnabot.a2ml` |
 | ABI/FFI surface change          | `src/abi/*.idr` + `ffi/zig/src/main.zig` + `ABI-FFI-README.md` |
-| Roadmap item closed             | `ROADMAP.adoc` + `.machine_readable/6a2/STATE.a2ml`     |
-| New external target / consumer  | `.machine_readable/6a2/STATE.a2ml` `[external-targets]` |
+| Roadmap item closed             | `ROADMAP.adoc` + `.machine_readable/descriptiles/STATE.a2ml`     |
+| New external target / consumer  | `.machine_readable/descriptiles/STATE.a2ml` `[external-targets]` |
 
 ### Tests — full suite is 184
 

.github/workflows/actions.lock

@@ -0,0 +1,191 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/boj-build.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/cargo-audit.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'dtolnay/rust-toolchain@master'
+    '.github/workflows/casket-pages.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/configure-pages@v6.0.0'
+        - 'actions/deploy-pages@v5.0.1'
+        - 'actions/upload-pages-artifact@v5.0.0'
+        - 'haskell-actions/setup@v2.12.0'
+    '.github/workflows/cflite_batch.yml':
+        - 'google/clusterfuzzlite@v1'
+    '.github/workflows/cflite_pr.yml':
+        - 'google/clusterfuzzlite@v1'
+    '.github/workflows/container.yml':
+        - 'actions/attest-build-provenance@v4.2.2'
+        - 'actions/checkout@v7.0.1'
+        - 'docker/build-push-action@v7.3.0'
+        - 'docker/login-action@v4.6.0'
+        - 'docker/metadata-action@v6.2.0'
+        - 'docker/setup-buildx-action@v4.3.0'
+    '.github/workflows/db-checks.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'dtolnay/rust-toolchain@master'
+        - 'swatinem/rust-cache@v2.9.2'
+    '.github/workflows/dependabot-automerge.yml':
+        - 'dependabot/fetch-metadata@v3.1.0'
+    '.github/workflows/docs.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/deploy-pages@v5.0.1'
+        - 'actions/upload-pages-artifact@v5.0.0'
+        - 'haskell-actions/setup@v2.12.0'
+    '.github/workflows/dogfood-gate.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/e2e.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'swatinem/rust-cache@v2.9.2'
+    '.github/workflows/echidna-fuzz.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+    '.github/workflows/echidnabot.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/openssf-compliance.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/proof-safety.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'swatinem/rust-cache@v2.9.2'
+    '.github/workflows/publish.yml':
+        - 'actions/attest-build-provenance@v4.2.2'
+        - 'actions/checkout@v7.0.1'
+        - 'dtolnay/rust-toolchain@master'
+        - 'softprops/action-gh-release@v3.0.3'
+        - 'swatinem/rust-cache@v2.9.2'
+    '.github/workflows/release.yml':
+        - 'actions/attest-build-provenance@v4.2.2'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'dtolnay/rust-toolchain@master'
+        - 'softprops/action-gh-release@v3.0.3'
+    '.github/workflows/rhodibot.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/static-analysis-gate.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'erlef/setup-beam@v1.24.1'
+    '.github/workflows/stress-test.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'dtolnay/rust-toolchain@master'
+    '.github/workflows/workflow-linter.yml':
+        - 'actions/checkout@v7.0.1'
+dependencies:
+    'actions/attest-build-provenance@v4.2.2':
+        ref: 'v4.2.2'
+        commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8'
+        owner_id: 44036562
+        repo_id: 760702757
+        uses:
+            - 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d'
+    'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d':
+        ref: 'v4.2.1'
+        commit: 'sha1-508db95dd578ae2727ebd6217d5ba78e4fbda05d'
+        owner_id: 44036562
+        repo_id: 760701061
+    'actions/cache@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/configure-pages@v6.0.0':
+        ref: 'v6.0.0'
+        commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
+        owner_id: 44036562
+        repo_id: 513659658
+    'actions/deploy-pages@v5.0.1':
+        ref: 'v5.0.1'
+        commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
+        owner_id: 44036562
+        repo_id: 438112499
+    'actions/download-artifact@v8.0.1':
+        ref: 'v8.0.1'
+        commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
+        ref: 'v7.0.0'
+        commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-pages-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'dependabot/fetch-metadata@v3.1.0':
+        ref: 'v3.1.0'
+        commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98'
+        owner_id: 27347476
+        repo_id: 371068214
+    'docker/build-push-action@v7.3.0':
+        ref: 'v7.3.0'
+        commit: 'sha1-53b7df96c91f9c12dcc8a07bcb9ccacbed38856a'
+        owner_id: 5429470
+        repo_id: 241092383
+    'docker/login-action@v4.6.0':
+        ref: 'v4.6.0'
+        commit: 'sha1-dbcb813823bdd20940b903addbd779551569679f'
+        owner_id: 5429470
+        repo_id: 287743349
+    'docker/metadata-action@v6.2.0':
+        ref: 'v6.2.0'
+        commit: 'sha1-dc802804100637a589fabce1cb79ff13a1411302'
+        owner_id: 5429470
+        repo_id: 306769011
+    'docker/setup-buildx-action@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-37fe631027851001ddb9b187196cc803df7f5f0e'
+        owner_id: 5429470
+        repo_id: 288485773
+    'dtolnay/rust-toolchain@master':
+        ref: 'master'
+        commit: 'sha1-b3b07ba8b418998c39fb20f53e8b695cdcc8de1b'
+        owner_id: 1940490
+        repo_id: 260749683
+    'erlef/setup-beam@v1.24.1':
+        ref: 'v1.24.1'
+        commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
+        owner_id: 47606891
+        repo_id: 331103973
+    'google/clusterfuzzlite@v1':
+        ref: 'v1'
+        commit: 'sha1-884713a6c30a92e5e8544c39945cd7cb630abcd1'
+        owner_id: 1342004
+        repo_id: 400046858
+    'haskell-actions/setup@v2.12.0':
+        ref: 'v2.12.0'
+        commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
+        owner_id: 75048950
+        repo_id: 623796603
+    'softprops/action-gh-release@v3.0.3':
+        ref: 'v3.0.3'
+        commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
+        owner_id: 2242
+        repo_id: 204253808
+    'swatinem/rust-cache@v2.9.2':
+        ref: 'v2.9.2'
+        commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
+        owner_id: 580492
+        repo_id: 298565987

.github/workflows/boj-build.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 #
 # OPTIONAL: BoJ Server Build Trigger
 # This workflow notifies a BoJ Server instance when code is pushed.
@@ -23,7 +24,7 @@ jobs:
     if: ${{ vars.BOJ_SERVER_URL != '' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         env:
           BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }}

.github/workflows/cargo-audit.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # cargo-audit.yml — Dependency vulnerability scanning for Rust projects.
@@ -21,12 +22,12 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
       - name: Install Rust toolchain
         # `toolchain:` is mandatory when this action is pinned to a SHA — see
         # the note in stress-test.yml. This SHA currently tolerates its absence;
         # stating it explicitly keeps the step working across future re-pins.
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        uses: dtolnay/rust-toolchain@master
         with:
           toolchain: stable
       - name: Install cargo-audit

.github/workflows/casket-pages.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages
 on:
   push:
@@ -14,22 +15,24 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
       - name: Checkout casket-ssg
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
         with:
           repository: hyperpolymath/casket-ssg
+          ref: cec3c20d80ea1dc93660b69a4e7b38aa49f2a56b
           path: .casket-ssg
+          persist-credentials: false
       - name: Setup GHCup
-        uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2
+        uses: haskell-actions/setup@v2.12.0
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
       - name: Cache Cabal
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.cabal/packages
@@ -38,7 +41,9 @@ jobs:
           key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }}
       - name: Build casket-ssg
         working-directory: .casket-ssg
-        run: cabal build
+        run: |
+          cabal update
+          cabal build --index-state=2026-09-06T00:00:00Z
       - name: Build site
         run: |
           mkdir -p site _site
@@ -68,21 +73,21 @@ jobs:
               echo "Documentation coming soon." >> site/index.md
             fi
           fi
-          cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site
+          cd .casket-ssg && cabal run --index-state=2026-09-06T00:00:00Z casket-ssg -- build ../site ../_site
       - name: Setup Pages
-        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        uses: actions/configure-pages@v6.0.0
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v3
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
           path: '_site'
   deploy:
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
     needs: build
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
+        uses: actions/deploy-pages@v5.0.1

.github/workflows/cflite_batch.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: ClusterFuzzLite batch fuzzing
 on:
   schedule:
@@ -16,13 +17,13 @@ jobs:
     steps:
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build
-        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
         with:
           language: rust
           sanitizer: ${{ matrix.sanitizer }}
       - name: Run Fuzzers (${{ matrix.sanitizer }})
         id: run
-        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           fuzz-seconds: 1800

.github/workflows/cflite_pr.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: ClusterFuzzLite PR fuzzing
 on:
   pull_request:
@@ -23,13 +24,13 @@ jobs:
     steps:
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build
-        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
         with:
           language: rust
           sanitizer: ${{ matrix.sanitizer }}
       - name: Run Fuzzers (${{ matrix.sanitizer }})
         id: run
-        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           fuzz-seconds: 300