Diagnose-and-record audit for the estate-wide
`scan / Hypatia Neurosymbolic Analysis` failure (2026-06-20/21):

  Unable to resolve action actions/cache@d4373f2

Root cause: the corrupt SHA (a corruption of v4.2.2's d4323d4…) was pinned
centrally in the two reusable workflows (hypatia-scan-reusable.yml,
governance-reusable.yml) — zero consumer workflows carried it. Already
repaired and merged in standards#394 (d72fe5a): re-pinned to the genuine
v4.2.0 commit 1bd1e32a…, verified against upstream `git ls-remote`.

The audit also documents the propagation caveat (consumers pin reusables by
standards SHA, so the post-#394 "Check Workflow Staleness" red is expected
drift pending gitbot-fleet enroll-repos re-pin to d72fe5a+) and records two
out-of-scope nextgen-databases findings (K9 pedigree missing metadata.name;
trusted-base reduction policy red).

Adds .adoc + .a2ml companion, mirroring audit-hypatia-pin-orphan-2026-05-27.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0144t85ipupFBhd9eJ8t9vaC

…ir (#396)

## What

Adds a diagnose-and-record audit (`.adoc` + `.a2ml` companion) for the
estate-wide `scan / Hypatia Neurosymbolic Analysis` failure observed
2026-06-20/21:

```
Unable to resolve action actions/cache@d4373f2
(unable to find version d4373f267a887d77f9eb0683a479ec60b1fe5b2b)
```

This is **documentation only** — the underlying fix already shipped.

## Root cause (already fixed in #394)

The corrupt SHA was pinned **centrally** in the two reusable workflows
(`hypatia-scan-reusable.yml`, `governance-reusable.yml`) — zero consumer
workflows carried it. It is a corruption of v4.2.2's real commit
`d4323d4…`.
**standards#394** (merged 2026-06-21, commit `d72fe5a`) already
re-pinned both
to the genuine `v4.2.0` commit `1bd1e32a…`.

## Independent verification (this session)

Via `git ls-remote https://github.com/actions/cache`:

| SHA | Upstream ref | Resolves? |
|---|---|---|
| `d4373f26…` (corrupt) | (none) | ✗ bogus |
| `1bd1e32a…` (repair) | `refs/tags/v4.2.0` | ✓ |
| `0057852b…` | `v4` + `v4.3.0` | ✓ |
| `27d5ce7f…` | `main` + `v5` + `v5.0.5` | ✓ |

`git grep d4373f…` across standards + hypatia → zero matches.

## Why the audit matters (propagation caveat)

Consumers pin these reusables by **standards commit SHA**, not `@main`
(`@5eb28d7…` / `@861b5e9…`). So the post-#394 `Check Workflow
Staleness`
red is **expected drift** — the signal that a gitbot-fleet
`enroll-repos`
re-pin to `d72fe5a`+ is still pending, not a new defect. The audit also
records two out-of-scope `nextgen-databases` findings (K9 pedigree
missing
`metadata.name`; trusted-base reduction policy red).

Full status recorded on the umbrella: hyperpolymath/hypatia#464.
Cross-refs
hyperpolymath/nextgen-typing#69.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0144t85ipupFBhd9eJ8t9vaC

---
_Generated by [Claude
Code](https://claude.ai/code/session_0144t85ipupFBhd9eJ8t9vaC)_

Co-authored-by: Claude <noreply@anthropic.com>