SigMap 8.85.1

Patch. Every workflow action is pinned to a commit SHA, every workflow's default token is read-only, and CHANGELOG.md leaves the npm package (#1042; parts of #999 and #1000). This is R3 of the plan in the issue list: repository files and workflow YAML only. src/, packages/ and the bundle are byte-identical to v8.85.0, so the package differs from 8.85.0 in one way, a smaller download.

Added

• A workflow hygiene check (#1000) — scripts/check-workflow-pins.mjs, run as npm run check:workflows and as the first step of CI's test job, fails on a uses: that is not a full commit SHA followed by a # vX.Y.Z comment, on a docker:// image that is not pinned by digest, and on a workflow with no top-level permissions: block or with a write scope in it. Against the v8.85.0 workflows it reports 69 findings (53 unpinned, 3 with no block, 13 workflow-level write scopes); against this release, none. test/integration/workflow-pins.test.js plants every breach and its compliant form, and pins that id-token: write sits on exactly two jobs (npm-publish.yml#publish-npm, pages.yml#deploy). Eight mutations of the real files (a floating tag back in ci.yml, a write scope at workflow level, a step added to CI only, and others) each fail the test written for them.
• .github/dependabot.yml (#1000) — the github-actions ecosystem, weekly, against develop: minor and patch updates arrive together, a major alone, so a pin moves by a pull request that CI runs on. Validated against the published Dependabot schema. Dependabot reads the file from the default branch, so it starts when this release reaches main.
• npm run test:ci (#999) — the command CI's test job runs, step for step and in order (workflow hygiene, bundle integrity and reproducibility, metrics consistency, unit, Python and integration tests, the retrieval and grounding gates). test/integration/release-hygiene.test.js fails when either side gains a step the other lacks. npm test stays the fast loop.

Changed

• All 53 uses: references (11 actions) are pinned to the commit their floating tag resolved to (#1000), with the release in a trailing comment (actions/checkout@11d5960… # v4.4.0). Each SHA was resolved through the API and cross-checked with git ls-remote on both the floating and the exact release tag (11 of 11 agree), so the code that runs does not change; what changes is that a tag moved upstream no longer reaches the job that publishes the package until a pull request moves the pin.
• Every workflow's default token is contents: read, and write scopes sit on the job that needs them (#1000). Computed from the YAML, of 23 jobs 10 are unchanged and 13 are narrowed: in npm-publish.yml the test job is read-only, publish-npm holds id-token: write, publish-github holds packages: write and the release job holds contents: write, where each held all three; prerelease-publish.yml loses id-token entirely (it publishes with NPM_TOKEN and no provenance); the binaries build job is read-only. None is widened.
• CHANGELOG.md leaves the npm package (#999; AGENTS.md left in 8.85.0) — 227 → 226 files, 1444 → 1187 KB packed, 4699 → 3960 KB unpacked. Nothing reads it at runtime (the two mentions in src/ classify the name as a documentation file); the notes live on the GitHub Releases page. The issue's 3.5 MB unpacked target is not met: the bundle alone is 2.1 MB and the package ships src/ beside it.
• CONTRIBUTING.md and SECURITY.md (#999, #1000) — the hand-typed "21/21 PASS" and "17/17 integration suites" are gone and the local command is npm run test:ci; the support table names the 8.x line (it listed v6.x as current).

Fixed

• The prerelease workflow's release job built its tag from an empty value (#1000) — prerelease-publish.yml read needs.update-versions.outputs.npm_version without listing update-versions in needs, and needs only exposes direct dependencies, so tag_name evaluated to just v. actionlint reports it. update-versions is listed now; the order does not change, because every publish job already depends on it. The workflow is manual-dispatch only and has not been exercised.

Notes

• One published figure moves, and it is the grep side of the honest comparison. Token reduction (95.2%), retrieval hit@5 (80.4%), the task-success proxy (61.9%), prompt reduction (44.4%), test-discovery F1 (98.0%), the grounding corpus, the hallucination guard and the third-party corpus (118 of 208) reproduce v8.85.0 leaf for leaf. The honest scan reads the repository's own files, so it finds 50 of 125 answers (40.0%) where it found 49 (39.2%) and the lift reads 2.32× where it read 2.37×; SigMap's side is unchanged at 116 of 125 (92.8%), and so is the reading with SigMap's files left out (58 of 125, 2.00×). A control at the v8.85.0 tag reproduces 49 / 125, 136 places and 2.37×, and an untouched merged develop reads 50 / 125, 135 places and 2.32×, so the movement belongs to #1043 (a checker, two tests, a Dependabot file and workflow edits, all of which the scan reads) and not to this release's text.
• #999 and #1000 stay open. Not in this release, and the maintainer's to decide: the publish rule and cadence (#999 items 1 and 2), the repository settings (CodeQL, Dependabot alerts, requiring the xrepo check; #1000 items 3 and 4), replacing SYNC_PAT and moving the prerelease publish to Trusted Publishing so NPM_TOKEN can go (item 5), the look-alike package names (item 7) and #705.
• The publish, binaries, tag, notes, sync and Pages workflows run only on main or a tag, so the scope changes above could not be exercised before this release; each job was read for the scope it needs and the effective permissions compared before and after. This release is their first run.
• This version has no runtime change, which is the case #999 describes (an npm version whose runtime files equal the previous one's). It ships because the package is smaller and because the pinned workflows and dependabot.yml only take effect on main.

---