chore(close-out): CI hardening + hexad proof + doc accuracy + 6a2 metadata

[hyperpolymath]

Follow-up close-out batch after #121. Four coherent commits:

ef1e235 — CI hardening (Hypatia missing_timeout_minutes)

Adds timeout-minutes to 27 runs-on jobs across 12 workflow files that lacked one; reusable-workflow-call jobs are correctly exempt (GitHub rejects job-level timeout-minutes there). Purely additive (27 insertions, 0 deletions); all 19 workflow files still parse as YAML. (The remaining Hypatia "unpinned_action" flags are either false positives — dtolnay/Swatinem are already full-SHA-pinned — or the policy-governed standards/...@main reusable workflow.)

b4fb18e — flagged unwrap + a real proof

• assay::assimilate: replaced the Hypatia-flagged source.unwrap() (CWE-754, though guarded) with a let Some(source) = source else { … } that folds in the already-handled None branch. No behaviour change; zero unwrap.
• storage: new proptest hexad_json_roundtrip_is_identity (PROOF-PROGRAMME §3.1, faithful form). The gateway octad projection is lossy by design, so the load-bearing integrity property is the on-disk serde round-trip used by write_*_hexad → load_hexad_dir; this proves it is the identity on the hexad JSON representation.

94aed04 — doc accuracy

20 → 38 subcommands and 47 → 49 languages across CLAUDE.md / EXPLAINME / README; assay/assimilate/aggregate added to the module tree and CLI examples.

37e73ea — 6a2 metadata

Completes .machine_readable/6a2/ to the echidna/standards shape: new AGENTIC / NEUROSYM / PLAYBOOK / ANCHOR (clade=diagnostic), fleshed-out META / ECOSYSTEM; STATE.a2ml untouched.

Tests

Full library suite green; the new proptest and the refactored assimilate pass. Zero new warnings.

Still open (not in this PR)

• Attestation-chain unforgeability proof (Idris2) — the second proof "easy win".
• Contractile-layout reconciliation (three overlapping representations + missing INDEX.a2ml) — pending location of the CONTRACTILE-SPEC.

https://claude.ai/code/session_01K2TJLeQSyz4tpydZ18aRcb

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 86 issues detected

Severity	Count
🔴 Critical	6
🟠 High	12
🟡 Medium	68

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f5599 needs attention",
    "type": "unpinned_action",
    "file": "e2e.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action es: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb needs attention",
    "type": "unpinned_action",
    "file": "e2e.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "missing_timeout_minutes",
    "file": "mirror.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in release.yml",
    "type": "missing_timeout_minutes",
    "file": "release.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in rust-ci.yml",
    "type": "missing_timeout_minutes",
    "file": "rust-ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence