fix(security): canonical action lock format and restricted build egress

.claude/CLAUDE.md

@@ -78,7 +78,7 @@ Both are FOSS with independent governance (no Big Tech).
 ### Package Management
 
 - **Primary**: Guix (guix.scm)
-- **Fallback**: Nix (flake.nix)
+- **Nix**: Retired estate-wide; do not introduce flakes. A Guix build is not yet implemented here, so no reproducible-build capability is claimed.
 - **JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
 
 ### Security Requirements

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: CC-BY-SA-4.0
+# SPDX-License-Identifier: MPL-2.0
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 #
 # Issue chooser configuration. Blank issues stay enabled so that reports which

.github/workflows/boj-build.yml

@@ -11,6 +11,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
+      - name: Monitor build-service egress
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: block
+          allowed-endpoints: ${{ vars.BOJ_BUILD_ALLOWED_ENDPOINTS }}
       - name: Trigger the configured build service securely
         env:
           BUILD_URL: ${{ vars.BOJ_BUILD_URL }}

.tool-versions

@@ -1 +1,2 @@
+bun 1.4.2
 rust stable

docs/STANDARDS-ALIGNMENT.adoc

@@ -59,9 +59,14 @@ team, stable-release backports or third-party legal immunity without evidence.
   privileged PR execution has been added.
 * Audit issue creation is disabled for PR events, where writable issue tokens
   may be unavailable; the audit remains blocking on PRs.
+* Local external action refs are commit-pinned as well as locked; the site
+  builder source checkout is pinned to `3dcade85400cef62949a6a0ab6900f5e7f065e56`.
 * The broken, unauthenticated HTTP BoJ trigger is replaced by a manual opt-in
-  HTTPS/authenticated integration with a bounded request and JSON-safe inputs.
+  HTTPS/authenticated integration with a bounded request, JSON-safe inputs and
+  block-mode egress restricted by `BOJ_BUILD_ALLOWED_ENDPOINTS`.
   It is not a claimed working deployment until a maintainer configures it.
+* Environment definitions provision pinned Bun first as required by the estate
+  runtime policy; this does not claim a JavaScript application capability.
 * Developer tasks now fail on the actual Rust failure instead of falling back
   to unrelated runtimes. Unused generic Python/Go/Java/yarn tooling was removed.
 * `just ci-check` validates the lock graph, regression controls and local
@@ -86,15 +91,17 @@ that every remote setting is enabled.
 == Explicit remaining canonical-layout gaps
 
 The current Standards profile checker expects Rust at `src/**/*.rs` rather than
-workspace `crates/*/src/`, FFI at `src/interface/ffi/`, an `abi.ipkg`, Idris at
-`src/interface/abi/` and a `src/interface/generated/` tree. This repository uses
+workspace `crates/*/src/`, FFI at the canonical interface FFI directory, an `abi.ipkg`, Idris at
+the canonical interface ABI directory and a the canonical generated-interface directory tree. This repository uses
 `crates/`, `ffi/zig/`, `rpa-elysium-abi.ipkg` and `src/abi/`; no generated ABI
 artefacts are claimed. The exact upstream checker therefore reports these as
 *MISSING*. We do not create empty scaffolds, change declared capabilities to
 hide real source, or weaken the upstream checker to report a false pass.
 
 Resolve these layout differences through a reviewed source/build migration or
 upstream capability-table support for workspace/named-package alternatives.
+The concrete capability decision and generated-output gap are tracked in
+https://github.com/hyperpolymath/standards/issues/1262[Standards #1262].
 Rust CI does not compile all Idris2/Zig targets; use `just verify-abi-ffi` with
 those toolchains and record evidence before claiming that tier validated.
 Latest Standards HEAD also adds a JS-runtime checker whose build previously

mise.toml

@@ -1,6 +1,8 @@
 # SPDX-License-Identifier: MPL-2.0
 # Minimal Rust development environment; ABI/site tools are installed only when used.
 [tools]
+# Estate environment policy provisions Bun first, even in Rust workspaces.
+bun = "1.4.2"
 rust = "stable"
 
 [tasks.build]

scripts/render-actions-lock.jq

@@ -0,0 +1,24 @@
+# SPDX-License-Identifier: MPL-2.0
+# Emit the official single-quoted, four-space-indented lockfile dialect. Native
+# YAML parsers accept other styles, but Hypatia's deployed lock reader does not.
+def quote: "'" + (tostring | gsub("'"; "''")) + "'";
+if any(.dependencies[]; ((keys - ["hostname", "ref", "commit", "owner_id", "repo_id", "uses"]) | length) > 0)
+then error("unknown dependency fields; review the lock schema before rendering")
+else
+  "# SPDX-License-Identifier: MPL-2.0",
+  "# Resolved action graph; regenerate with scripts/update-actions-lock.sh.",
+  ("version: " + (.version | quote)),
+  ("workflows:" + (if (.workflows | length) == 0 then " {}" else "" end)),
+  (.workflows | to_entries | sort_by(.key)[] |
+    ("    " + (.key | quote) + ":" + (if (.value | length) == 0 then " []" else "" end)),
+    (.value | sort[] | "        - " + quote)),
+  ("dependencies:" + (if (.dependencies | length) == 0 then " {}" else "" end)),
+  (.dependencies | to_entries | sort_by(.key)[] |
+    ("    " + (.key | quote) + ":"),
+    (.value as $d | ["hostname", "ref", "commit", "owner_id", "repo_id"][] as $field |
+      select($d[$field] != null) |
+      "        " + $field + ": " + ($d[$field] | if type == "number" then tostring else quote end)),
+    (if (.value.uses // [] | length) > 0 then
+      "        uses:", (.value.uses | sort[] | "            - " + quote)
+    else empty end))
+end

scripts/restore-reusable-lock-coverage.sh

@@ -37,5 +37,5 @@ jq -L "$(dirname "${BASH_SOURCE[0]}")" --slurpfile old "$scratch/old.json" --slu
 ' "$scratch/current.json" > "$scratch/merged.json"
 # Write only when parsing and merging both succeeded. The parent updater owns
 # rollback if its subsequent authoritative or structural verification fails.
-yq -P -o=yaml '.' "$scratch/merged.json" > "$scratch/actions.lock"
+jq -r -f "$(dirname "${BASH_SOURCE[0]}")/render-actions-lock.jq" "$scratch/merged.json" > "$scratch/actions.lock"
 cp "$scratch/actions.lock" "$wf_dir/actions.lock"

scripts/tests/actions-lock-update-test.sh

@@ -80,3 +80,14 @@ bash "$SCRIPTS/check-lock-sync.sh"
 echo 'PASS: update preserves reusable closure, SPDX ordering, and discards verifier mutations'
 yq -o=json '.' .github/workflows/actions.lock | jq -e '.dependencies["owner/transitive@v1"] != null and .dependencies["owner/dead@v1"] == null' >/dev/null
 echo 'PASS: restore retains reachable transitive nodes and prunes stale old records'
+# The deployed Hypatia reader needs the official quoted lock dialect.
+grep -q "^version: 'v0.0.3'$" .github/workflows/actions.lock
+grep -q "^    'owner/transitive@v1':$" .github/workflows/actions.lock
+yq -o=json '.' .github/workflows/actions.lock | jq -e '.dependencies["owner/transitive@v1"].owner_id | type == "number"' >/dev/null
+if jq -r -f "$SCRIPTS/render-actions-lock.jq" <<'JSON' > "$ROOT/unexpected-lock" 2> "$ROOT/renderer-error"
+{"version":"v0.0.3","workflows":{},"dependencies":{"owner/action@v1":{"unknown_field":true}}}
+JSON
+then
+  echo 'FAIL: renderer dropped unknown schema fields'; exit 1
+fi
+echo 'PASS: canonical quote formatting, numeric identities and unknown-field rejection'