chore(enforcement): wire standards#67/#68 — JS-RUNTIME-POLICY.adoc + recursive lockfile gate + propagation script

[hyperpolymath]

Summary

Closes the enforcement gap for standards#67 (package-lock.json estate-wide elimination) and standards#68 (.editorconfig/.claude/ gitignore) at the standards repo level.

• governance-reusable.yml: upgrades the package-lock.json check from a root-only [ -f … ] test to a recursive git ls-files query — catches monorepo sub-packages (e.g. boj-cartridges/*/package-lock.json). Also adds explicit bun.lockb / yarn.lock / .npmrc checks with a remediation pointer.
• docs/JS-RUNTIME-POLICY.adoc: canonical policy document previously missing; referenced in standards#67 acceptance criteria. Includes runtime hierarchy (Deno > Bun > pnpm > npm), hard rules, canonical .gitignore block, remediation recipe, and a 2026-05-19 consumer-repo audit snapshot.
• scripts/propagate-gitignore-67-68.sh: read-only audit tool + --fix propagation helper. Shell-only (no Python/SaltStack), idempotent, never auto-commits or pushes.

Consumer-repo audit (2026-05-19)

Metric	Count
Repos with tracked package-lock.json	10
Repos with tracked .editorconfig	118
Repos with tracked .claude/	56

See docs/JS-RUNTIME-POLICY.adoc for the full list.

Template status (already done)

• rsr-template-repo PR rsr-antipattern.yml: BUILTIN_GLOBS bash block stranded outside Python heredoc (exit 127) #49 merged 2026-05-16 — all 3 entries in .gitignore
• v3-templater PR Purge token-in-URL git remotes; SSH-only remote policy #69 merged 2026-05-16 — all 3 entries in .gitignore

Not in this PR

• Consumer-repo propagation (requires per-repo human-gated PRs; use scripts/propagate-gitignore-67-68.sh --fix)
• Removing already-tracked .editorconfig/.claude/ from consumer repos (separate owner-gated chore)

Test plan

• Review governance-reusable.yml diff — confirm git ls-files catches nested package-lock.json
• Review JS-RUNTIME-POLICY.adoc — confirm content matches estate policy
• Run bash scripts/propagate-gitignore-67-68.sh — confirm dry-run output is valid TSV
• CI passes on this branch

Refs #67
Refs #68
Refs #66

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 101 issues detected

Severity	Count
🔴 Critical	63
🟠 High	28
🟡 Medium	10

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence