ci: repin standards to e064539 (clears Allowlist Preflight); render deploy template from init

.github/workflows/actions.lock

@@ -21,34 +21,34 @@ workflows:
     '.github/workflows/dogfood-gate.yml':
         - 'actions/checkout@v7.0.1'
         - 'hyperpolymath/deed-ecosystem@main'
-        - 'metadatastician/standards@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8'
+        - 'metadatastician/standards@e064539116c2dcfdf282a4749dbd58c69961c7e6'
     '.github/workflows/e2e.yml':
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@v1'
         - 'goto-bus-stop/setup-zig@v2.2.1'
         - 'swatinem/rust-cache@v2.9.3'
     '.github/workflows/fork-governance.yml':
-        - 'metadatastician/standards@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8'
+        - 'metadatastician/standards@e064539116c2dcfdf282a4749dbd58c69961c7e6'
     '.github/workflows/governance.yml':
-        - 'metadatastician/standards@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8'
+        - 'metadatastician/standards@e064539116c2dcfdf282a4749dbd58c69961c7e6'
     '.github/workflows/hypatia-scan.yml':
-        - 'metadatastician/standards@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8'
+        - 'metadatastician/standards@e064539116c2dcfdf282a4749dbd58c69961c7e6'
     '.github/workflows/instant-sync.yml':
         - 'peter-evans/repository-dispatch@v4.0.1'
     '.github/workflows/label-triage.yml': []
     '.github/workflows/labels.yml': []
     '.github/workflows/main-estate-audit.yml':
         - 'hyperpolymath/cicd-suite@4f5404281dd7092fa77cc18daec7237c4f1ee4ac'
     '.github/workflows/mirror.yml':
-        - 'metadatastician/standards@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8'
+        - 'metadatastician/standards@e064539116c2dcfdf282a4749dbd58c69961c7e6'
     '.github/workflows/push-email-notify.yml':
         - 'hyperpolymath/smtp-notify-action@v0.5.0'
     '.github/workflows/rust-ci.yml':
         - 'metadatastician/standards@412a7031577112b31ee287cc6060179d638d6500'
     '.github/workflows/scorecard.yml':
-        - 'metadatastician/standards@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8'
+        - 'metadatastician/standards@e064539116c2dcfdf282a4749dbd58c69961c7e6'
     '.github/workflows/secret-scanner.yml':
-        - 'metadatastician/standards@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8'
+        - 'metadatastician/standards@e064539116c2dcfdf282a4749dbd58c69961c7e6'
 dependencies:
     'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
         ref: 'v6.1.0'
@@ -183,9 +183,9 @@ dependencies:
         commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
         owner_id: 6759885
         repo_id: 1352485172
-    'metadatastician/standards@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8':
-        ref: '1fdc61c0c1c8f4c94324f956700d78d1ea9584a8'
-        commit: 'sha1-1fdc61c0c1c8f4c94324f956700d78d1ea9584a8'
+    'metadatastician/standards@e064539116c2dcfdf282a4749dbd58c69961c7e6':
+        ref: 'e064539116c2dcfdf282a4749dbd58c69961c7e6'
+        commit: 'sha1-e064539116c2dcfdf282a4749dbd58c69961c7e6'
         owner_id: 297579217
         repo_id: 1116521501
         uses:

.github/workflows/dogfood-gate.yml

@@ -14,7 +14,7 @@
     branches: [main, master]
 
 permissions:
   actions: read
   contents: read
 
 jobs:
@@ -74,7 +74,7 @@
   k9-conformance:
     name: K9-DEED conformance (push)
     if: github.event_name == 'push'
-    uses: metadatastician/standards/.github/workflows/k9-conformance.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+    uses: metadatastician/standards/.github/workflows/k9-conformance.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
     permissions:
       contents: read
       pull-requests: read
@@ -260,7 +260,7 @@
           # VeriSimDB integration?
           if grep -rl 'verisim\|VeriSimDB' --include='*.toml' --include='*.yaml' --include='*.yml' --include='*.json' --include='*.rs' --include='*.ex' . 2>/dev/null | head -1 | grep -q .; then
             SCORE=$((SCORE + 1))
             VSDB_STATUS=":white_check_mark:"
           else
             VSDB_STATUS=":ballot_box_with_check:"
           fi

.github/workflows/fork-governance.yml

@@ -29,15 +29,15 @@ permissions:
 jobs:
   deed:
     name: DEED syntax
-    uses: metadatastician/standards/.github/workflows/deed-conformance.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+    uses: metadatastician/standards/.github/workflows/deed-conformance.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
     permissions:
       contents: read
     with:
       require-files: false
 
   k9:
     name: K9-DEED conformance
-    uses: metadatastician/standards/.github/workflows/k9-conformance.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+    uses: metadatastician/standards/.github/workflows/k9-conformance.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
     permissions:
       contents: read
       pull-requests: read
@@ -47,7 +47,7 @@ jobs:
 
   hypatia:
     name: Hypatia verdict grid
-    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
     permissions:
       actions: read
       contents: read
@@ -59,7 +59,7 @@ jobs:
     name: Post the fork governance summary
     needs: [deed, k9, hypatia]
     if: ${{ always() && github.event_name == 'pull_request' }}
-    uses: metadatastician/standards/.github/workflows/fork-governance-reusable.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+    uses: metadatastician/standards/.github/workflows/fork-governance-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
     permissions:
       contents: read
       actions: read
@@ -71,4 +71,5 @@ jobs:
       k9-verdict: ${{ needs.k9.outputs.verdict }}
       hypatia-result: ${{ needs.hypatia.result }}
       hypatia-verdict: ${{ needs.hypatia.outputs.verdict }}
-      canon-ref: 1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+      hypatia-advisory: ${{ needs.hypatia.outputs.advisory }}
+      canon-ref: e064539116c2dcfdf282a4749dbd58c69961c7e6

.github/workflows/governance.yml

@@ -33,6 +33,6 @@ permissions:
 
 jobs:
   governance:
-    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
     secrets:
       HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}

.github/workflows/hypatia-scan.yml

@@ -34,6 +34,6 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
     secrets:
       HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}

.github/workflows/mirror.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   mirror:
-    uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+    uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
     secrets:
       GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
       BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}

.github/workflows/scorecard.yml

@@ -16,4 +16,4 @@ jobs:
       contents: read
       security-events: write
       id-token: write
-    uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+    uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6

.github/workflows/secret-scanner.yml

@@ -21,4 +21,4 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@1fdc61c0c1c8f4c94324f956700d78d1ea9584a8
+    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6

panel-clades/Justfile

@@ -226,6 +226,10 @@ init:
     sed -i "s|\[YOUR-REPO-NAME\]|${PROJECT_NAME}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true
     sed -i "s|\[YOUR-NAME/ORG\]|${OWNER}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true
 
+    # init fills every placeholder, the container ones included, so the deploy
+    # template can be rendered here too.
+    "{{just_executable()}}" --justfile "{{justfile()}}" _render-deploy-k9
+
     echo ""
     echo "── Validation ───────────────────────────────────"
 
@@ -529,25 +533,7 @@ container-init:
         fi
     done
 
-    # The k9-svc deploy component ships as a template (deploy.k9.ncl.in): a
-    # file with brace tokens is not a K9 component. Render it once nothing is
-    # left to fill (init fills PROJECT_NAME and VERSION), so the K9 lane
-    # validates the real thing. The bracket spellings keep just from reading
-    # the token pattern as an interpolation.
-    DEPLOY_IN="container/deploy.k9.ncl.in"
-    DEPLOY_OUT="${DEPLOY_IN%.in}"
-    if [ -f "$DEPLOY_IN" ]; then
-        LEFT=$(grep -oE '[{][{][A-Za-z_]+[}][}]' "$DEPLOY_IN" | sort -u | tr '\n' ' ' || true)
-        if [ -n "$LEFT" ]; then
-            echo "Kept $DEPLOY_IN: unfilled tokens ${LEFT}remain."
-            echo "  Run 'just init', then 'just container-init' again to render it."
-        elif [ -e "$DEPLOY_OUT" ]; then
-            echo "Kept $DEPLOY_IN: $DEPLOY_OUT already exists, so it was not overwritten."
-        else
-            mv "$DEPLOY_IN" "$DEPLOY_OUT"
-            echo "Rendered $DEPLOY_OUT (K9 component, contract v1.0.0)."
-        fi
-    fi
+    "{{just_executable()}}" --justfile "{{justfile()}}" _render-deploy-k9
 
     echo "Container templates initialised."
     echo ""
@@ -557,6 +543,35 @@ container-init:
     echo "  3. Review container/compose.toml — adjust services and volumes"
     echo "  4. Build: just container-build"
 
+# Render container/deploy.k9.ncl.in to container/deploy.k9.ncl once no
+# placeholder is left. Called by `init` and `container-init`.
+[private]
+_render-deploy-k9:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    # The k9-svc deploy component ships as a template (deploy.k9.ncl.in): a
+    # file with brace tokens is not a K9 component. Render it once nothing is
+    # left to fill, so the K9 lane validates the real thing. The bracket
+    # spellings keep just from reading the token pattern as an interpolation.
+    DEPLOY_IN="container/deploy.k9.ncl.in"
+    DEPLOY_OUT="${DEPLOY_IN%.in}"
+    [ -f "$DEPLOY_IN" ] || exit 0
+    LEFT=$(grep -oE '[{][{][A-Za-z_]+[}][}]' "$DEPLOY_IN" | sort -u | tr '\n' ' ' || true)
+    if [ -n "$LEFT" ]; then
+        echo "Kept $DEPLOY_IN: unfilled tokens ${LEFT}remain."
+        echo "  Run 'just init' (or 'just container-init') to fill them; it renders the file."
+    elif [ -e "$DEPLOY_OUT" ]; then
+        echo "Kept $DEPLOY_IN: $DEPLOY_OUT already exists, so it was not overwritten."
+    else
+        mv "$DEPLOY_IN" "$DEPLOY_OUT"
+        # Both manifests name the template; point them at the component. The
+        # root inventory's line also loses its "(template)" note.
+        for MANIFEST in 0-AI-MANIFEST.a2ml container/0-AI-MANIFEST.a2ml; do
+            [ -f "$MANIFEST" ] && sed -i '/deploy\.k9\.ncl\.in/{s|deploy\.k9\.ncl\.in|deploy.k9.ncl|g; s| (template)||}' "$MANIFEST"
+        done
+        echo "Rendered $DEPLOY_OUT (K9 component, contract v1.0.0)."
+    fi
+
 # Build container image via cerro-torre pipeline
 container-build *args:
     #!/usr/bin/env bash