ci+docs: unify the standards pins, close the lock, underscore the archived session id

[hyperpolymath]

The actions policy is now all + SHA-pinning (owner ruling), so this repo's CI can run — and this closes the lock disease measured in today's survey (reposystem#319):

• Three heterogeneous standards pins unified to 94572e6 (current main — v0.2.0-aware lock helpers).
• actions.lock regenerated transitively closed — the dangling edges were killing locked workflows at startup with jobs=0. Wrapper --verify-local exits 0.
• The archived session handoff's external Claude session id underscored (not converted — converting a session record would falsify it); UUID strict scan now clean.

Note: this repo has no rsr-profile, so no [canon] pin applies. Companion PRs: occupancy-types #13, and the template/archetype root fixes in rsr-template-repo #240 + standards #1268.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe vibe@mistral.ai

Summary by CodeRabbit

• Chores

  • Updated the revisions used by automated governance, security scanning, Rust CI, scorecard, and repository mirroring workflows.
  • Updated the email notification integration.

• Documentation

  • Standardized the formatting of a session ID in an archived handoff; the ID itself is unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: hyperpolymath/absolute-zero/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4ae062ee-39ea-4aae-90a6-26f95bfd4b8a

📥 Commits

Reviewing files that changed from the base of the PR and between 4471796 and e4f49f6.

⛔ Files ignored due to path filters: 1

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing: 8

• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/mirror.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/rust-ci.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml
• docs/archive/SESSION-2026-05-25-HANDOFF.adoc

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Seven GitHub Actions workflow references changed. The archived handoff heading now uses underscores in the session ID and identifies it as external.

Changes: Workflow reference updates

Layer / File(s)	Summary
Update workflow references .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/push-email-notify.yml, .github/workflows/rust-ci.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml	Six reusable workflow references now point to updated revisions. The email notification action now uses the v0.5.0 tag. Existing triggers, permissions, inputs, and other configuration remain unchanged where specified.

Archived handoff heading

Layer / File(s)	Summary
Revise session ID heading docs/archive/SESSION-2026-05-25-HANDOFF.adoc	The heading uses underscores in the session ID and identifies it as external. The ID itself is unchanged.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to e4f49

The updated automation references are compatible with their existing configuration, and the archived session ID should not trigger the UUID scan. No actionable merge risk remains.

Security architecture risk: 🔵 Low · up to e4f49

The reusable workflows remain pinned to full commit hashes, and their declared permissions and secret forwarding are unchanged. The email action’s lock entry records the same commit previously referenced directly. No introduced vulnerability was established, but effective lock enforcement and the changed upstream workflow behavior remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — When notification is enabled and credentials are available, the selected action implementation handles this repository’s SMTP credentials. Any downstream authority would depend on those credentials’ actual scope, which is not supplied; cross-repository or organization-wide exposure is not established.

Trust Boundaries and Controls

• inferred — The SMTP reference now relies on effective lock enforcement to preserve the previous immutable selection. The lock records the original commit and repository identity, which is substantial counterevidence to an introduced tag-substitution vulnerability. Whether tag movement is ignored, rejected or followed during execution remains unresolved.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the workflow pin updates and the archived session ID documentation change. It also references the lock regeneration described in the objectives.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• 🤖 Coding Agent task started for unit test generation.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

Unit test generation is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

---

Generating unit tests... This may take up to 20 minutes.

[coderabbitai]

🤖 Coding Agent task started for unit test generation.