fix(ci): foundational CI/CD audit — bytesLength + STEP 4-B stdlib decls + governance allowlist + Pages precheck + Scorecard caller perms

[hyperpolymath]

Summary

Foundational CI/CD audit of main (HEAD 319bc84). Four red lanes had four distinct root causes; this PR closes all four + adds a regression test that catches the most pernicious one before merge.

Workflow	Status before	Root cause	Fix
CI / build	red, every push	bytesLength / math_random etc. wired in codegen + fixture but missing pub extern fn in stdlib/Deno.affine (PR #504 + #509 partial landings)	7 decls added; regression test test/test_deno_builtins_consistency.ml enforces subset across all stdlib/*.affine
Governance / Language anti-pattern	red, every push	check-ts-allowlist scanner's glob⇒regex doesn't anchor against the ./-prefixed paths from walkRecursive(".") — all 3 CLAUDE.md exemptions matched zero files in practice	added .governance-allowlist (Layer 2.5) with a leading-wildcard pattern that works against the prefixed paths; underlying scanner bug deferred to upstream
GitHub Pages	red, every push	Pages not enabled on the repo; configure-pages@v6 enablement: true can't escalate to admin via GITHUB_TOKEN	precheck job probes gh api .../pages and short-circuits build/deploy when disabled; emits a clear unblock notice
Scorecards	startup_failure since adoption	permissions: read-all at workflow level diverged from the canonical caller block (contents: read); SHA pin was the first cut of the reusable	aligned to canonical form + bumped reusable SHA to standards/main HEAD

Verification

• dune build bin/main.exe: clean.
• dune runtest: 357/357 tests green (including the new consistency test).
• tools/run_codegen_deno_tests.sh: all 30 harnesses pass.
• check-ts-allowlist locally: ✅ "No TypeScript files outside allowlist (4 per-repo exemption(s) parsed across CLAUDE.md + .governance-allowlist)."

Owner action (one-time, optional, separate)

To unblock the Pages workflow's deploy lane: enable Pages once via Settings → Pages (source: GitHub Actions). The new precheck job's notice will flip from "Pages not enabled" to "Pages enabled — proceeding with build + deploy" on the next push.

What was NOT changed

• Other repos in the estate (owner directive: don't go estate-wide; the scanner bug is filed-as-comment as belonging upstream at standards).
• .hypatia-ignore — governs a different rule.
• .claude/CLAUDE.md TypeScript Exemptions table — left as Layer-2 reference; .governance-allowlist is the working Layer-2.5 backstop.
• claude/websocket-binding branch — left alone (parallel-session WIP).
• tests/codegen-deno/*.deno.js regenerated outputs — left at their pre-existing committed state; the test runner regenerates them on every run.

Test plan

• dune build bin/main.exe clean
• dune runtest 357/357 green
• tools/run_codegen_deno_tests.sh all 30 harnesses pass
• check-ts-allowlist clean against local checkout
• Post-merge: next push run is green on CI / Governance / Scorecards
• Pages stays guard-skipped until owner enables Pages (then green)

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 88 issues detected

Severity	Count
🔴 Critical	2
🟠 High	16
🟡 Medium	70

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action ons/checkout@v6\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action land/setup-deno@v2\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affine-vscode-publish.yml",
    "type": "missing_timeout_minutes",
    "file": "affine-vscode-publish.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[github-actions]

🔍 Hypatia Security Scan

Findings: 88 issues detected

Severity	Count
🔴 Critical	2
🟠 High	16
🟡 Medium	70

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action ons/checkout@v6\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action land/setup-deno@v2\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affine-vscode-publish.yml",
    "type": "missing_timeout_minutes",
    "file": "affine-vscode-publish.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence