ci: make the four required status checks reportable on every PR

[hyperpolymath]

Problem

The merge box shows four required checks stuck at "Expected — Waiting for status to be reported". This push confirmed it server-side:

- 4 of 4 required status checks are expected.

"Expected" is not a failure — it means a required context name was never reported on the head commit. Each of the four is produced by a different mechanism, and each can independently fail to report (proven against live PRs: affinescript #626, hypatia #517, gitbot-fleet #307):

Required context	Producer	Why it can sit "Expected"
analyze (actions, none)	codeql.yml job analyze	pull_request: was gated to branches:[main,master] → no run on other bases → check never created
hypatia / Hypatia Neurosymbolic Analysis	hypatia-scan.yml reusable caller hypatia	same branch gate
Hypatia	Hypatia GitHub App check	external; rides on the scan — absent on PRs where the scan didn't run (e.g. gitbot-fleet #307)
governance / Validate Hypatia baseline	the standards governance reusable (job governance / "Validate Hypatia baseline")	this repo migrated off that reusable to a standalone governance job (#603/#604), which emits the context governance instead — so the pinned name is orphaned and can never report

Root cause (one line): branch protection pins context strings that this repo only conditionally emits — a renamed job, branch-filtered workflows, and an external app — and GitHub renders any required-but-unproduced context as a permanent "Expected", indistinguishable from a hang.

What this PR changes (repo-side fix)

1. codeql.yml — drop pull_request: branches:[main,master]. The required analyze (actions, none) job now runs on PRs against every base. (push: unchanged.)
2. hypatia-scan.yml — same de-gate, so hypatia / Hypatia Neurosymbolic Analysis runs on every PR base (and the Hypatia app check rides along).
3. governance-baseline.yml + governance-baseline-impl.yml (new) — a local reusable whose caller job id governance + reusable job Validate Hypatia baseline re-emit the exact pinned context governance / Validate Hypatia baseline, on every PR. It is:
   • additive — the standalone governance.yml gate is untouched; the repo now emits both governance and governance / Validate Hypatia baseline;
   • safe vs. the reasons ci: make CI standalone (drop estate reusable workflows + third-party setup action) #603/ci: fix standalone-CI fallout — SHA-pin actions, de-trip secret scanner #604 left the reusable — it's local (no @main cross-repo coupling) and declares no concurrency: in the reusable (avoids the BP008 startup-failure class);
   • a real gate — validates .hypatia-baseline.json with jq (no npm) when present; passes with a notice when absent (this repo's current state).

Residuals that need branch-protection admin (cannot be done from repo files)

• Hypatia app check: de-gating the scan is the best repo-side lever, but the app posting is ultimately external. If it still shows "Expected" on some PRs, either make it post unconditionally or de-require it.
• Pin reconciliation (the cleaner fix): the truly correct change is to repoint the pins to the names this repo actually emits — governance / Validate Hypatia baseline → governance, and confirm no other governance / * sub-checks (the reusable emits 8) are still pinned from the pre-ci: make CI standalone (drop estate reusable workflows + third-party setup action) #603/ci: fix standalone-CI fallout — SHA-pin actions, de-trip secret scanner #604 era. The local-reusable bridge here exists only so the box can go green without that admin access; if you'd rather repoint the pin, this bridge can be dropped.

Verification

This PR's own run should now report all four contexts instead of leaving them "Expected"; governance / Validate Hypatia baseline is self-demonstrating (the new workflow runs on this PR). I'll confirm from the check-runs once they land.

Estate note

codeql.yml / hypatia-scan.yml carry the identical branches:[main,master] PR gate in hypatia, gitbot-fleet, and .git-private-farm; the same de-gate applies there. The governance divergence is affinescript-only — the other three still call the reusable and emit governance / Validate Hypatia baseline natively.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UXXpaoiATzxcn3kW3eTM26

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 41 issues detected

Severity	Count
🔴 Critical	2
🟠 High	23
🟡 Medium	16

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affinescript-cli/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (2 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/packages/affine-vscode/mod.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-vite/src/affine-plugin-improved.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (32 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/wasm_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (29 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/affine_gen.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/panic.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/alloc.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (3 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/affinescript/affinescript/runtime/src/ffi.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence