diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 0000000..e74d1c9
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,170 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/cargo-audit.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/casket-pages.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/configure-pages@v6.0.0'
+        - 'actions/deploy-pages@v5.0.0'
+        - 'actions/upload-pages-artifact@v5.0.0'
+        - 'haskell-actions/setup@v2.11.0'
+    '.github/workflows/cflite_batch.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'google/clusterfuzzlite@v1'
+    '.github/workflows/cflite_pr.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'google/clusterfuzzlite@v1'
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.37.4'
+    '.github/workflows/comprehensive-quality.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'returntocorp/semgrep-action@v1'
+        - 'trufflesecurity/trufflehog@v3.96.0'
+    '.github/workflows/governance.yml': []
+    '.github/workflows/hypatia-scan.yml': []
+    '.github/workflows/jekyll-gh-pages.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/configure-pages@v6.0.0'
+        - 'actions/deploy-pages@v5.0.0'
+        - 'actions/jekyll-build-pages@v1.0.13'
+        - 'actions/upload-pages-artifact@v5.0.0'
+    '.github/workflows/mirror.yml': []
+    '.github/workflows/pages.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/deploy-pages@v5.0.0'
+        - 'actions/upload-pages-artifact@v5.0.0'
+    '.github/workflows/proofs.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/push-email-notify.yml':
+        - 'dawidd6/action-send-mail@v3.12.0'
+    '.github/workflows/release.yml':
+        - 'actions/attest-build-provenance@v4.1.1'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'dtolnay/rust-toolchain@stable'
+        - 'erlef/setup-beam@v1.24.1'
+        - 'softprops/action-gh-release@v2.2.1'
+    '.github/workflows/scorecard.yml': []
+    '.github/workflows/secret-scanner.yml': []
+    '.github/workflows/spark-theatre-gate.yml': []
+    '.github/workflows/test.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'bogdanp/setup-racket@v1.9.1'
+    '.github/workflows/workflow-linter.yml':
+        - 'actions/checkout@v7.0.1'
+dependencies:
+    'actions/attest-build-provenance@v4.1.1':
+        ref: 'v4.1.1'
+        commit: 'sha1-0f67c3f4856b2e3261c31976d6725780e5e4c373'
+        owner_id: 44036562
+        repo_id: 760702757
+        uses:
+            - 'actions/attest@a1948c3f048ba23858d222213b7c278aabede763'
+    'actions/attest@a1948c3f048ba23858d222213b7c278aabede763':
+        ref: 'v4.1.1'
+        commit: 'sha1-a1948c3f048ba23858d222213b7c278aabede763'
+        owner_id: 44036562
+        repo_id: 760701061
+    'actions/cache@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/configure-pages@v6.0.0':
+        ref: 'v6.0.0'
+        commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
+        owner_id: 44036562
+        repo_id: 513659658
+    'actions/deploy-pages@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
+        owner_id: 44036562
+        repo_id: 438112499
+    'actions/download-artifact@v8.0.1':
+        ref: 'v8.0.1'
+        commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/jekyll-build-pages@v1.0.13':
+        ref: 'v1.0.13'
+        commit: 'sha1-44a6e6beabd48582f863aeeb6cb2151cc1716697'
+        owner_id: 44036562
+        repo_id: 438323626
+    'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
+        ref: 'v7.0.0'
+        commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-pages-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'bogdanp/setup-racket@v1.9.1':
+        ref: 'v1.9.1'
+        commit: 'sha1-2466913449df77df2bad149d1f2fc4e1ea4795dd'
+        owner_id: 43347
+        repo_id: 219137853
+    'dawidd6/action-send-mail@v3.12.0':
+        ref: 'v3.12.0'
+        commit: 'sha1-2e600f3776677e493bf0da7aaec39a586d19a5ed'
+        owner_id: 9713907
+        repo_id: 222439721
+    'dtolnay/rust-toolchain@stable':
+        ref: 'stable'
+        commit: 'sha1-4cda84d5c5c54efe2404f9d843567869ab1699d4'
+        owner_id: 1940490
+        repo_id: 260749683
+    'erlef/setup-beam@v1.24.1':
+        ref: 'v1.24.1'
+        commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
+        owner_id: 47606891
+        repo_id: 331103973
+    'github/codeql-action@v4.37.4':
+        ref: 'v4.37.4'
+        commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38'
+        owner_id: 9919
+        repo_id: 259445878
+    'google/clusterfuzzlite@v1':
+        ref: 'v1'
+        commit: 'sha1-884713a6c30a92e5e8544c39945cd7cb630abcd1'
+        owner_id: 1342004
+        repo_id: 400046858
+    'haskell-actions/setup@v2.11.0':
+        ref: 'v2.11.0'
+        commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553'
+        owner_id: 75048950
+        repo_id: 623796603
+    'returntocorp/semgrep-action@v1':
+        ref: 'v1'
+        commit: 'sha1-713efdd345f3035192eaa63f56867b88e63e4e5d'
+        owner_id: 147861678
+        repo_id: 715166645
+    'softprops/action-gh-release@v2.2.1':
+        ref: 'v2.2.1'
+        commit: 'sha1-c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda'
+        owner_id: 2242
+        repo_id: 204253808
+    'trufflesecurity/trufflehog@v3.96.0':
+        ref: 'v3.96.0'
+        commit: 'sha1-6f3c981e7b77f235fd2702dd74af25fc4b72bf11'
+        owner_id: 79229934
+        repo_id: 77726177
diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml
index 5c2c8b7..06f8525 100644
--- a/.github/workflows/cargo-audit.yml
+++ b/.github/workflows/cargo-audit.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Prevention workflow - audits Rust dependencies for vulnerabilities
 name: Cargo Audit
 
@@ -22,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
 
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
@@ -42,7 +43,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
 
       - name: Create vulnerability issue
         env:
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 521b1f2..fc4c5fc 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages
 
 on:
@@ -21,22 +22,22 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
 
       - name: Checkout casket-ssg
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
 
       - name: Setup GHCup
-        uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2
+        uses: haskell-actions/setup@v2.11.0
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
 
       - name: Cache Cabal
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.cabal/packages
@@ -80,10 +81,10 @@ jobs:
           cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site
 
       - name: Setup Pages
-        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        uses: actions/configure-pages@v6.0.0
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
           path: '_site'
 
@@ -97,4 +98,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@v5.0.0
diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml
index f7925b7..73b65ff 100644
--- a/.github/workflows/cflite_batch.yml
+++ b/.github/workflows/cflite_batch.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: ClusterFuzzLite Batch Fuzzing
 on:
   schedule:
@@ -9,11 +10,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+      - uses: actions/checkout@v7.0.1
+      - uses: google/clusterfuzzlite/actions/build_fuzzers@v1
         with:
           language: rust
-      - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+      - uses: google/clusterfuzzlite/actions/run_fuzzers@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           fuzz-seconds: 1800
diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml
index 90a293a..21c7c2e 100644
--- a/.github/workflows/cflite_pr.yml
+++ b/.github/workflows/cflite_pr.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: ClusterFuzzLite PR Fuzzing
 on:
   pull_request:
@@ -12,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+      - uses: actions/checkout@v7.0.1
+      - uses: google/clusterfuzzlite/actions/build_fuzzers@v1
         with:
           language: rust
-      - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+      - uses: google/clusterfuzzlite/actions/run_fuzzers@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           fuzz-seconds: 300
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3988c5d..891a47a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 
 on:
@@ -35,15 +36,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3.28.1
+        uses: github/codeql-action/init@v4.37.4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3.28.1
+        uses: github/codeql-action/analyze@v4.37.4
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/comprehensive-quality.yml b/.github/workflows/comprehensive-quality.yml
index 2c85a01..b1e6290 100644
--- a/.github/workflows/comprehensive-quality.yml
+++ b/.github/workflows/comprehensive-quality.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
 name: Comprehensive Quality Gates
 permissions: read-all
@@ -15,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
       - name: Check test coverage
         run: |
           echo "Checking for test files..."
@@ -35,9 +36,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
       - name: Secret scanning
-        uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11 # v3.96.0
+        uses: trufflesecurity/trufflehog@v3.96.0
         continue-on-error: true
       - name: Dependency vulnerabilities
         run: |
@@ -56,7 +57,7 @@ jobs:
       # non-blocking, so SAST here is advisory only — worth replacing with a
       # maintained scanner.
       - name: SAST scan
-        uses: returntocorp/semgrep-action@713efdd345f3035192eaa63f56867b88e63e4e5d # v1
+        uses: returntocorp/semgrep-action@v1
         continue-on-error: true
 
   # INTEROPERABILITY - API and format compatibility
@@ -64,7 +65,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
       - name: Check API specs
         run: |
           if [ -f "openapi.yaml" ] || [ -f "openapi.json" ]; then
@@ -82,7 +83,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
       - name: Check for validation patterns
         run: |
           VALIDATION=$(grep -rE "validate|sanitize|Schema|Validator" --include="*.rs" --include="*.res" --include="*.ex" . 2>/dev/null | wc -l || echo "0")
@@ -97,7 +98,7 @@ jobs:
       contents: read
       attestations: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
       - name: Generate SBOM
         run: |
           echo "SBOM generation would run here"
@@ -114,7 +115,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
       - name: Check SPARK proofs
         run: |
           if find . -name "*.ads" | grep -q .; then
@@ -131,7 +132,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
       - name: Check TODOs and FIXMEs
         run: |
           echo "=== Incomplete items ==="
@@ -145,7 +146,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
       - name: Check for benchmarks
         run: |
           BENCHES=$(find . -name "*bench*" -o -name "*perf*" | wc -l)
@@ -167,7 +168,7 @@ jobs:
     # meaningless at job level, since nothing is checked out yet. The guard
     # therefore lives on the steps below, after checkout.
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
       - name: HTML accessibility check
         if: hashFiles('**/*.html') != ''
         run: |
@@ -184,7 +185,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
       - name: Check license files
         run: |
           if [ -f "LICENSE" ] || [ -f "LICENSE.txt" ] || [ -f "LICENSE.md" ]; then
@@ -211,7 +212,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
       - name: Check docs completeness
         run: |
           DOCS=""
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index b8aa88b..a256bb2 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # governance.yml — single wrapper calling the shared estate governance bundle
 # in hyperpolymath/standards instead of carrying per-repo copies.
 #
@@ -24,7 +25,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 3ba9757..c100e33 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
 # See standards#191 for the reusable's purpose and design.
 
@@ -16,10 +17,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
-  security-events: write
   pull-requests: write
+  security-events: write
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
-    secrets: inherit
\ No newline at end of file
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    secrets: inherit
diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml
index 60acb1a..3ca132d 100644
--- a/.github/workflows/jekyll-gh-pages.yml
+++ b/.github/workflows/jekyll-gh-pages.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Sample workflow for building and deploying a Jekyll site to GitHub Pages
 name: Deploy Jekyll with GitHub Pages dependencies preinstalled
 
@@ -29,16 +30,16 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Setup Pages
-        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        uses: actions/configure-pages@v6.0.0
       - name: Build with Jekyll
-        uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1
+        uses: actions/jekyll-build-pages@v1.0.13
         with:
           source: ./
           destination: ./_site
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        uses: actions/upload-pages-artifact@v5.0.0
 
   # Deployment job
   deploy:
@@ -51,4 +52,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@v5.0.0
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 6bd847d..bd1d7e1 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,12 +1,14 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Mirror to Git Forges
 on:
   push:
     branches: [main]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     secrets: inherit
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 8596374..3be681d 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages (Ddraig SSG)
 on:
   push:
@@ -19,9 +20,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@v7.0.1
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@v7.0.1
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
@@ -38,7 +39,7 @@ jobs:
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
           path: '_site'
   deploy:
@@ -51,4 +52,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
+        uses: actions/deploy-pages@v5.0.0
diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml
index eb1bfc5..9310881 100644
--- a/.github/workflows/proofs.yml
+++ b/.github/workflows/proofs.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Machine-check BetLang's formal proofs on every push/PR.
 # See docs/AFFINESCRIPT-ALIGNMENT.adoc (Phase 1).
 name: Proofs
@@ -21,7 +22,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Scan proof sources
         run: bash tools/proof-scan.sh .
 
@@ -33,7 +34,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Install elan (Lean toolchain manager)
         run: |
           set -euo pipefail
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 3421edd..b69c87f 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Dormant push-email notification. ARMED by setting the repo variable
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
 # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
@@ -15,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@2e600f3776677e493bf0da7aaec39a586d19a5ed # pinned
+        uses: dawidd6/action-send-mail@v3.12.0
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fd864ae..47eae95 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Release
 
 on:
@@ -30,10 +31,10 @@ jobs:
           - aarch64-unknown-linux-musl
           - riscv64gc-unknown-linux-gnu
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # stable (was misnamed dtolnay/rust-action)
+        uses: dtolnay/rust-toolchain@stable # (was misnamed dtolnay/rust-action)
         with:
           targets: ${{ matrix.target }}
 
@@ -51,7 +52,7 @@ jobs:
           cd release
           tar -czvf betlang-${{ github.ref_name }}-${{ matrix.target }}.tar.gz *
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@v7.0.1
         with:
           name: betlang-${{ matrix.target }}
           path: release/*.tar.gz
@@ -65,10 +66,10 @@ jobs:
           - x86_64-apple-darwin
           - aarch64-apple-darwin
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # stable (was misnamed dtolnay/rust-action)
+        uses: dtolnay/rust-toolchain@stable # (was misnamed dtolnay/rust-action)
         with:
           targets: ${{ matrix.target }}
 
@@ -83,7 +84,7 @@ jobs:
           cd release
           tar -czvf betlang-${{ github.ref_name }}-${{ matrix.target }}.tar.gz *
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@v7.0.1
         with:
           name: betlang-${{ matrix.target }}
           path: release/*.tar.gz
@@ -92,10 +93,10 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # stable (was misnamed dtolnay/rust-action)
+        uses: dtolnay/rust-toolchain@stable # (was misnamed dtolnay/rust-action)
 
       - name: Build
         run: cargo build --release
@@ -109,7 +110,7 @@ jobs:
           cd release
           7z a betlang-${{ github.ref_name }}-x86_64-pc-windows-msvc.zip *
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@v7.0.1
         with:
           name: betlang-windows
           path: release/*.zip
@@ -118,10 +119,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
 
       - name: Install Gleam
-        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.18.2
+        uses: erlef/setup-beam@v1.24.1
         with:
           otp-version: '26'
           gleam-version: 'latest'
@@ -134,7 +135,7 @@ jobs:
           cd build
           tar -czvf bet-lsp-${{ github.ref_name }}.tar.gz erlang-shipment
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@v7.0.1
         with:
           name: bet-lsp
           path: lsp/bet-lsp/build/*.tar.gz
@@ -148,9 +149,9 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@v8.0.1
         with:
           path: artifacts
 
@@ -162,7 +163,7 @@ jobs:
           sha256sum * > SHA256SUMS.txt
 
       - name: Create Release
-        uses: softprops/action-gh-release@c87adaf44f9b5c94295d4615a639679203028d77 # v2.2.1
+        uses: softprops/action-gh-release@v2.2.1 # v2.2.1
         with:
           files: release/*
           generate_release_notes: true
@@ -170,6 +171,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@v4.1.1
         with:
           subject-path: 'release/*'
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 19dfa18..9e42679 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Scorecards supply-chain security
 on:
   branch_protection_rule:
@@ -18,5 +19,5 @@ jobs:
       contents: read
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     secrets: inherit
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 1c7ebb4..abfddba 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Secret Scanner
 on:
   pull_request:
@@ -13,5 +14,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     secrets: inherit
diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml
index 1c8db86..b660266 100644
--- a/.github/workflows/spark-theatre-gate.yml
+++ b/.github/workflows/spark-theatre-gate.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Estate SPARK Theatre Gate — thin caller of the reusable workflow in
 # hyperpolymath/standards (#135 / #141). Pinned by commit SHA per the
 # estate action-pinning policy. Regenerate the pin only when the reusable
@@ -9,10 +10,11 @@ on:
   push:
     branches: [main, master]
 permissions:
+  actions: read
   contents: read
 jobs:
   spark-theatre-gate:
-    uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@462003782f3ebb93ea763e81d0d199ce13ef7d73
+    uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     with:
       paths: "."
       enforce_zero_contract: false
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b267d0a..0864636 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Test
 permissions: read-all
 
@@ -23,10 +24,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Setup Racket
-        uses: Bogdanp/setup-racket@2466913449df77df2bad149d1f2fc4e1ea4795dd # v1.15
+        uses: Bogdanp/setup-racket@v1.9.1
         with:
           version: ${{ matrix.racket-version }}
           # rackunit ships with the full Racket distribution (already present
@@ -76,10 +77,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Setup Racket
-        uses: Bogdanp/setup-racket@2466913449df77df2bad149d1f2fc4e1ea4795dd # v1.15
+        uses: Bogdanp/setup-racket@v1.9.1
         with:
           version: 'current'
 
@@ -106,7 +107,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Check documentation completeness
         run: |
@@ -134,7 +135,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Check RSR compliance
         run: |
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 1d338ec..e4e36e7 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Prevention workflow - validates all workflows have proper security config
 name: Workflow Security Linter
 
@@ -17,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@v7.0.1
 
       - name: Check SPDX headers
         run: |