ci(estate): consumers pinned to stale standards reusable SHAs — hypatia-scan (bad actions/cache pin) + governance staleness fail estate-wide #520

Symptom (estate-wide, on every PR/push)

Two checks fail across hyperpolymath repos that consume the shared reusable workflows in hyperpolymath/standards:

• scan / Hypatia Neurosymbolic Analysis fails in ~3s: Unable to resolve action actions/cache@d4373f267a887d77f9eb0683a479ec60b1fe5b2b, unable to find version d4373f26…
• governance / Check Workflow Staleness fails.

Root cause

Consumers call three reusables via thin caller stubs:
uses: hyperpolymath/standards/.github/workflows/{hypatia-scan,governance,scorecard}-reusable.yml@<sha>.
The pinned <sha>s are stale: at those old commits, hypatia-scan-reusable.yml pins a non-existent actions/cache@d4373f26…. standards@main (4ddc926b4b86451c2711a16bf927ed16ad2db45e) already fixes it → actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0. The staleness gate (governance-reusable.yml → scripts/check-workflow-staleness.sh) then flags the stale refs.

A naive SHA bump is not sufficient: hypatia-scan-reusable.yml's workflow_call interface also changed —

• OLD (e.g. @915139d7): inputs: { runs-on }, permissions: { security-events: write, pull-requests: write }
• NEW (@main): no inputs, permissions: { security-events: read }

Pinning convention (decided)

Immutable full-SHA, pin all three reusables to standards@4ddc926b4b86451c2711a16bf927ed16ad2db45e. Rationale: every estate caller stub uses a 40-char SHA, and hypatia's own security policy mandates SHA-pinned dependencies — a moving @v1 tag would cut against the norm.

Proposed caller-stub fixes (grounded in the in-scope twins; verify interface against standards@4ddc926b before merge)

hypatia-scan.yml (the interface-changed one):

permissions:
  contents: read
  security-events: read          # was: write; drop `pull-requests: write`
jobs:
  hypatia:
    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4ddc926b4b86451c2711a16bf927ed16ad2db45e
    secrets: inherit
    timeout-minutes: 30
    # If the old stub had `with: { runs-on: … }` — delete it (new interface takes no inputs)

governance.yml / scorecard.yml — SHA-bump only (interfaces not reported changed; keep scorecard's security-events: write + id-token: write for SARIF upload):

uses: …/governance-reusable.yml@4ddc926b4b86451c2711a16bf927ed16ad2db45e
uses: …/scorecard-reusable.yml@4ddc926b4b86451c2711a16bf927ed16ad2db45e

Per-consumer pin map

In-scope consumer status (read live this session)

• gitbot-fleet main: hypatia-scan.yml is already at an intermediate @6cd3772824e59c8c9affeab66061e25383544242 (not the broken 915139d7, not the fixed 4ddc926b). Status unknown — needs comparison against standards history to know if 6cd37728 carries the valid cache pin or still needs bumping.
• hypatia main: hypatia-scan.yml at @5eb28d7d…; its Hypatia Neurosymbolic Analysis check passed on PR docs(status): session handover snapshot 2026-06-20 #517, so likely already OK — verify.

Verification checklist (requires standards scope)

1. Confirm hypatia-scan-reusable.yml@4ddc926b pins actions/cache@1bd1e32a…, and its on.workflow_call declares no inputs + security-events: read, and still accepts secrets: inherit.
2. Read scripts/check-workflow-staleness.sh to learn exactly what it compares (target ref/tag vs. consumer pins) and whether it requires a .hypatia-baseline.json (both in-scope repos have one — consumers likely each need one).
3. Confirm governance-reusable.yml / scorecard-reusable.yml@4ddc926b interfaces didn't also change.
4. Confirm whether standards publishes a moving tag and whether the staleness script prefers it (recommendation stands: SHA).

Acceptance

On a test PR in a consuming repo: scan / Hypatia Neurosymbolic Analysis resolves its actions and runs (no "Unable to resolve action"), and governance / Check Workflow Staleness passes.

Scope note

This needs hyperpolymath/standards + verisimdb + quandledb + vcl-ut in the working session's GitHub scope. The session that filed this was limited to hypatia/gitbot-fleet/.git-private-farm and the add_repo tool was unavailable, so neither the source nor the named consumers could be read or edited.

Related

• standards#191 (reusable design), wire reusable_workflow_sha_bump_needs_propagation rule: rule exists, registry+dispatch wiring missing #421 (reusable_workflow_sha_bump_needs_propagation detector rule — the rule that should catch this class automatically).