fix(#117): cite launcher-standard_praxis.deed v0.4.0 + estate CI alignment

[arena-ai-coding-agent]

Closes #117 (standards#960)

Issue #117 — launcher descriptor (comment-only)

All four check-launcher-standard-currency defects corrected in .machine_readable/launcher/the-nash-equilibrium.launcher.a2ml (lines 8/9/26/93):

• AC1: git grep -n 'launcher-standard\.a2ml' → 0 hits (repo-wide).
• AC2: citations name launcher-standard_praxis.deed at v0.4.0 (current at fix time) with DEED clause notation — no [section], no § anywhere in the descriptor (e.g. (runtime …), (integration (linux …)), (version-output …)).
• AC3: no path in the descriptor names developer-ecosystem/.
• AC4: every edit is comment-only; the minted scripts/the-nash-equilibrium-launcher.sh is untouched and the descriptor keeps its .a2ml extension (extension migration stays gated behind launch-scaffolder#40). launch-scaffolder is not available in this sandbox, so byte-identity is established by construction rather than by running mint.
• AC5: remote had only refs/heads/main (no corrupt branches) before this fix.

Currency gate: canonical=launcher-standard_praxis.deed expected=v0.4.0 → No stale launcher-standard references. rc=0.

Estate alignment + CI root-cause fixes (same branch)

Root causes of long-red checks:

• estate-rules.yml had steps: null, e2e.yml had jobs: null — both rewritten with real jobs (e2e runs tests/e2e.sh, verified rc=0 locally).
• Code Quality docs job's gem install ran without sudo — moved into estate-rules (sudo gem install asciidoctor -v 2.0.26); render/parse gates green (145 .adoc files).
• OpenSSF compliance checked a doubled 6a2/ path — fixed to descriptiles/; the 6a2 dual-accept fallback removed per check-descriptile-policy.
• CodeQL held at v4.38.0 (b96794f015dfd88f77b49b1c93e0fa7110f94c63), reverting the chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the actions group #118 bump: v4.38.1 fails workflow-startup estate-wide (nexia-list#100/feat(labels): estate label tooling + auto-triage for new issues #101/chore(ci): repoint push-email-notify to smtp-notify-action #104). Two-entry language matrix (actions + javascript-typescript for mvt/src/**).

Template/standards alignment:

• .machine_readable/6a2/ → descriptiles/ (all refs updated).
• wellknown-enforcement.yml → dot-wellknown-enforcement.yml; guix-nix-policy.yml → guix-policy.yml (Nix hard-fail; no .nix files exist, stays green).
• workflow-linter.yml → template shape + vendored scripts/check-action-pinning.js.
• New lock-sync-gate.yml + vendored scripts/check-lock-sync.sh (standards#968).
• Six callers re-pinned 84355587cb → da2c748a with template caller shape (concurrency, explicit 7-secret mirror map per Hypatia WH008, job-level permissions: contents: read per standards#500).
• dependabot.yml → template form (cargo security-only open-pull-requests-limit: 0, github/codeql-action ignore, nix ecosystem dropped).

Trusted-base / root shape / docs:

• docs/proof-debt.adoc documents the three believe_me escapes (Layout.idr:143|166|185) with inline -- DEBT: markers; check-trusted-base rc=0.
• Stray .codex deleted; root-allow.txt gains mvt/ + INSTALL-SECURITY-REPORT.adoc; check-root-shape PASS.
• Onboarding quickstarts + .github/CONTRIBUTING.md no longer tell contributors to clone rsr-template-repo, use banned Nix, or run recipes that don't exist.
• actions.lock regenerated with gh actions-lock v0.1.6, then hand-corrected for job-level reusable refs the tool cannot see (six standards callers, SLSA generator in release.yml) — --verify-local valid, four lock-sync clauses green.

Verification (all run locally)

Gate	Result
launcher currency + AC greps	rc=0 / clean
check-workflows-parse (replica)	29 files clean
check-workflow-duplicate-keys	rc=0
check-action-pinning (bun)	rc=0
check-action-pins-resolve	rc=0 (all SHAs resolve)
check-workflow-staleness	rc=0 (da2c: no KNOWN_BAD; age advisory)
check-allowed-actions	rc=0 (23 refs)
check-descriptile-policy / trusted-base / root-shape	rc=0
check-docs-render / no-md / adoc-not-markdown	rc=0 (145 files)
deed validation (dogfood)	118 files, 0 errors, 0 warnings
tests/e2e.sh	rc=0

Ledger updated: docs/status/CICD-REMEDIATION.adoc (incl. items intentionally left: required status checks = NEEDS-ADMIN, deed-validate workflow blocked on estate allowlist, Justfile TODO-stub recipes).

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3d3d1bdb-509c-4bd2-9414-31c1571762be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[arena-ai-coding-agent]

CI status on this PR: blocked by the org-side actor gate, not by these files

Every workflow run triggered by arena-ai-coding-agent[bot] ends startup_failure with zero jobs and the annotation:

Actor is not allowed to trigger Actions workflows. Workflow file: '.github/workflows/<name>.yml'.

This is the known org-wide restriction documented in hyperpolymath/wordpress-tools#96 (the GitHub App is not permitted to trigger Actions; same signature on rsr-template-repo since 2026-09-24). It is not the lockfile gate (standards#968/#992 cover that, and those gates are green locally).

Evidence it is not branch-content: a bisect push that reverted actions.lock to the pre-existing base version failed all 19 runs identically — including workflows untouched by this PR (Runtime Policy, Static Analysis, RSR Anti-Pattern…), whose file content is byte-identical to the green runs on main from earlier today.

Owner actions (from wordpress-tools#96): permit the arena-ai-coding-agent App under org Settings → Actions → General → trigger permission, or re-run/merge as the owner actor, after which this PR's checks (estate-rules, e2e, workflow-linter, lock-sync-gate, dot-wellknown, guix-policy, governance, CodeQL at v4.38.0, …) will execute.

All gates were verified locally on the final HEAD 4994533: launcher currency + issue AC greps clean, workflow parse/dup-keys/allowed/pins-resolve/pinning/staleness/descriptile/trusted-base/root-shape/licence/docs-render green, gh actions-lock --verify-local valid, and all four check-lock-sync clauses green.