RSR workflow templates use an illegal uses: ../../ ref — every instantiated workflow is permanently dead (0 jobs) #808

Summary

The RSR workflow templates in this repo use a uses: ref form that GitHub Actions does not support:

uses: ../../.github/workflows/codeql-reusable.yml

A reusable-workflow uses: may only be ./.github/workflows/<file>.yml (same repo) or
<owner>/<repo>/.github/workflows/<file>.yml@<ref> (cross repo). A ../ path is rejected at
parse time, so every workflow instantiated from these templates is permanently dead.

Why it was invisible

A workflow that fails this way produces the triple conclusion=failure, 0 jobs, and a run
name equal to its path rather than its declared name:. That is the same triple produced
by callee-lockfile poisoning, so these have been repeatedly mis-triaged as lockfile faults.
They are not — they never parsed.

Measured on hyperpolymath/a2ml: six workflows (codeql, governance, mirror,
scorecard, secret-scanner, hypatia-scan) all died on a single push at 2026-09-14T21:40.
Six simultaneous 0-job failures in one repo is the tell.

Population (a FLOOR, not a total)

GitHub code search for "uses: ../../.github/workflows" user:hyperpolymath extension:yml
returns 41 files:

⚠ Code search undercounts. hyperpolymath/a2ml carries the identical broken ref — verified
directly through the contents API — yet does not appear in the search results. The real live
population must be established with a contents-API sweep over the estate, not code search.

The 24 files in this repo sit under rhodium-standard-repositories/, meta-a2ml/,
axel-protocol/ and 0-ai-gatekeeper-protocol/. They are inert here (GitHub only executes
.github/workflows/ at the repo root) but they are what gets copied outward.

Acceptance criteria

• Every uses: ../../.github/workflows/<x>-reusable.yml in this repo's template directories
  is replaced with hyperpolymath/standards/.github/workflows/<x>-reusable.yml@<sha>,
  SHA-pinned, with the SHA present in actions.lock.
• The same repair is applied to hyperpolymath/k9-ecosystem/dispatch-templates/from-k9-svc/.
• A contents-API sweep (not code search) enumerates every estate repo with a ../ uses:
  ref at root .github/workflows/; the resulting list is recorded in this issue.
• hyperpolymath/lol, hyperpolymath/deed-core and hyperpolymath/a2ml are repaired and
  each shows a non-zero job count on a re-fired run.
  (⚠ a2ml is under a standing hands-off hold — owner to confirm before touching it.)
• A guard rejects any uses: containing ../ or $/ — extend the existing
  uses ⊆ actions.lock gate, which today only inspects SHA-pinned refs and so is blind to
  this class entirely.
• A regression fixture carries one ../ ref and the guard is proven to fail on it
  (mutant must die).

Related

• The uses ⊆ actions.lock gate landed in fix(standards): unblock commits, repair the lockfile, gate it in CI #804 does not catch this: it matches only
  @<40-hex> refs, and these have no @ref at all.
• Sibling corruption already on record: gh actions-lock rewrite mode inventing
  uses: $/.github/actions/....

🤖 Generated with Claude Code

https://claude.ai/code/session_01HfgwLCdKNd5iZVo6VTiSim