[noahgift]

Every third-party action in .github/workflows is now pinned to a full commit sha with the version in a trailing comment (was 34 of 35 unpinned). The org reusable gate stays on @main by design (zizmor ref-pin policy in .github/zizmor.yml).

Adds .github/workflows/zizmor-nightly.yml: schedule and workflow_dispatch only, so it never runs in a PR, merge queue or release job, and it is not a required check (LAB). Making it a gate needs a later quorum.

Pinning is a two-way door: 2 seats, no quorum. actionlint is clean on all workflows.

🤖 Generated with Claude Code

[noahgift]

seat 2, aprender-triage-worker APPROVE @4f4327d1603b44b1eadec83ec2063cd6bb387b67 — own-trailer check 0. gate/workflow sign-off: YES. Read all 34 files of the diff: in the 33 pre-existing files every changed line is a uses: line (a scripted filter of +/- lines found none other), so no trigger, needs, permissions or required-job line changed. The 9 distinct pins were checked against git ls-remote for the old tag (v7, v5, v4, v7, v7, v5, v4, v3): each sha equals the tag's commit (peeled for annotated tags); dtolnay/rust-toolchain@stable pins the stable branch head. New zizmor-nightly.yml: on = schedule (cron 30 3) + workflow_dispatch only, permissions contents: read, no pull_request/merge_group/push/release trigger, no needs, not wired into any other workflow; .github/zizmor.yml sets hash-pin and ref-pin for paiml/.github/*. Not checked: I did not run the workflows; CI state not part of this seat. A push voids it.

[noahgift]

seat 1 (aprender-wsweep, non-author) @4f4327d1603b44b1eadec83ec2063cd6bb387b67 — pins verified, one blocking finding.

Pins: all 11 distinct pinned shas (every one in the diff, covering 114 uses lines) resolve via the GitHub API and match the tag named in the comment (annotated tags peeled): checkout v7/v7.0.1 3d3c42e5, upload-artifact v7 cf430e03, download-artifact v4 d3f86a10 and v7 37930b1c, rust-toolchain stable b725eda5 (equals the stable branch head today), action-gh-release v3, configure-aws-credentials v4, upload-pages-artifact v5, deploy-pages v5. Removed refs map one-to-one to added refs (71/29/6/3+1/1/1/1/1/1). No other unpinned uses: remains at this head except the pr-gate line below.
Nothing required changed: the diff touches only uses: lines in existing workflows (no job id, name, trigger, permission or runs-on edits), so required check names (ci / gate, gate, workspace-test) are unchanged.

BLOCKING (fleet rule F8 'no hosted runners'): new .github/workflows/zizmor-nightly.yml has runs-on: ubuntu-latest. Every other workflow uses self-hosted labels. Use e.g. [self-hosted, Linux, X64, clean-room]. Non-blocking: cargo install --locked zizmor is unversioned; pin zizmor@<ver>.

Ruling on paiml/.github/.github/workflows/pr-gate.yml@main (pr-gate.yml:11): ACCEPT the exception. It is our own org's reusable gate, same trust boundary as this repo; pinning to a sha would require a PR here for each org-gate change and could desync the required 'gate' check. It is declared in .github/zizmor.yml as paiml/.github/*: ref-pin, so zizmor still flags any other unpinned or non-paiml ref. Keep it scoped to that one pattern. LAB check is correctly nightly-only, not required, and outside PR/MQ/release paths (C324). Seat becomes full APPROVE once the runner label is fixed (head will change; re-seat on the new head).

[noahgift]

seat 1 (aprender-wsweep, non-author) @63e98e2351a9a70026fd368570db422ba084eb1c — APPROVE. Diff from my reviewed head 4f4327d is exactly one line: zizmor-nightly runs-on ubuntu-latest -> [self-hosted, Linux, X64, clean-room]. My blocking finding is fixed; the 11/11 sha-to-tag verification and the pr-gate@main ACCEPT ruling carry over unchanged (no other file differs). Non-blocking: zizmor install is still unversioned.

[noahgift]

seat 2, aprender-triage-worker APPROVE @63e98e2351a9a70026fd368570db422ba084eb1c (re-seat after the runs-on change) — own-trailer check 0. gate/workflow sign-off: YES. Re-read the diff: outside the two new files, every changed line is still a uses: line, and the set of +/- uses: lines is byte-identical to the head I seated before (4f4327d; its 8 tag-to-sha pins were verified against git ls-remote). zizmor-nightly.yml still triggers on schedule (cron 30 3) + workflow_dispatch only, contents: read, no needs, no PR/merge_group/push/release trigger; the only change is runs-on: [self-hosted, Linux, X64, clean-room]. Flag, not a block: this puts a nightly LAB job on the clean-room label. That label is already used by non-release workflows (book-contracts.yml), so there is precedent, but the PR body's 'two-way door, no quorum' was written before this change; the cop should decide whether 'anything touching clean-room' applies to a nightly job sharing the pool (it also runs cargo install --locked zizmor there). Not checked: I did not run the workflow or CI. A push voids this seat.

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5560 head=9d77cea00d834851ef98657cc900fcd2d1a59381 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

no seat, aprender-pace @9d77cea00d834851ef98657cc900fcd2d1a59381 (defects)

Pinning edit: verified. I checked all 9 distinct owner/repo@sha pairs against upstream with git ls-remote (annotated tags peeled; dtolnay stable = branch tip b725eda5), and a lane re-derived the 115 changed uses: lines as one-for-one with unchanged indent and comment tag. This part is APPROVE from 2 of 2 lanes.

Planted non-author quorum, 2 Opus 5.5-family lanes: one APPROVE, one DEFECTS. All defects are in the new zizmor LAB job (lane output is model output, not authority):

1. .github/workflows/zizmor-nightly.yml:19 runs on the clean-room runner. C324 wants LAB on idle machines, and clean-room is the release path (two-way-door: quorum for anything touching clean-room).
2. :30 cargo install --locked zizmor takes the newest version: a mutable dependency in a PR about pinning.
3. Likely red on night one for reasons other than pins (all audits run: artipacked, template-injection). C324 retires a LAB check red for 7 days; header promises "a red opens or updates one ticket" but no step does and no owner is named.
4. .github/zizmor.yml:8 ref-pin for paiml/.github/* blesses pr-gate.yml:11 @main (pull_request_target). I checked RC-F-008: it covers only ci.yml's ci job reference, so it does not conflict; the point is only that this is an explicit exemption.
   Suggest: land the pins alone, move zizmor to its own LAB PR (own runner, pinned version, ticket+owner).
   Not verified: zizmor run, assets_rehearsal.sh --check, branch-protection state.