diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index bbc7a857e..a7305dd7d 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -19,7 +19,7 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Pinned image tag (not :latest) for reproducible lint runs.
       - name: Check workflows
diff --git a/.github/workflows/adapters-ci.yml b/.github/workflows/adapters-ci.yml
index f3692ebf8..5b0a03d94 100644
--- a/.github/workflows/adapters-ci.yml
+++ b/.github/workflows/adapters-ci.yml
@@ -16,8 +16,8 @@ jobs:
   node-express:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
       - name: Install and typecheck
@@ -34,8 +34,8 @@ jobs:
   python-fastapi:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - name: Install adapter deps
@@ -54,8 +54,8 @@ jobs:
   go-chi:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version: "1.23"
       - name: Build
@@ -70,7 +70,7 @@ jobs:
   rust-adapters:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: stable
diff --git a/.github/workflows/allowlist-sync.yaml b/.github/workflows/allowlist-sync.yaml
index 32cd94bfc..637d64703 100644
--- a/.github/workflows/allowlist-sync.yaml
+++ b/.github/workflows/allowlist-sync.yaml
@@ -30,10 +30,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -211,7 +211,7 @@ jobs:
 
       - name: Upload drift report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: allowlist-drift-report
           path: /tmp/drift_report.json
@@ -220,7 +220,7 @@ jobs:
         if: github.event_name == 'pull_request' && failure()
         # ci-honesty: justified wave7-remediation
         continue-on-error: true
-        uses: actions/github-script@v6
+        uses: actions/github-script@v9
         with:
           script: |
             github.rest.issues.createComment({
diff --git a/.github/workflows/art-benchmark.yaml b/.github/workflows/art-benchmark.yaml
index 521d0233d..c75b1f59c 100644
--- a/.github/workflows/art-benchmark.yaml
+++ b/.github/workflows/art-benchmark.yaml
@@ -37,10 +37,10 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -56,7 +56,7 @@ jobs:
           fi
 
       - name: Upload results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: art-smoke-results
           path: tests/art_results/*.json
diff --git a/.github/workflows/bench-nightly-criterion.yaml b/.github/workflows/bench-nightly-criterion.yaml
index 49e832be9..55f3aafbb 100644
--- a/.github/workflows/bench-nightly-criterion.yaml
+++ b/.github/workflows/bench-nightly-criterion.yaml
@@ -54,7 +54,7 @@ jobs:
     if: github.event_name == 'pull_request' || github.event_name == 'push'
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -76,7 +76,7 @@ jobs:
     timeout-minutes: 90
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
@@ -144,14 +144,14 @@ jobs:
           PY
 
       - name: Upload updated BASELINE.md
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: criterion-baseline-md-${{ github.sha }}
           path: bench/BASELINE.md
           if-no-files-found: error
 
       - name: Cache Criterion baseline
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: target/criterion
           key: criterion-main-${{ github.sha }}
@@ -169,7 +169,7 @@ jobs:
     timeout-minutes: 90
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
@@ -182,7 +182,7 @@ jobs:
           key-suffix: "-criterion-deps"
 
       - name: Restore Criterion baseline (from last main)
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         id: criterion-cache
         with:
           path: target/criterion
diff --git a/.github/workflows/bench-swebench-smoke.yaml b/.github/workflows/bench-swebench-smoke.yaml
index 70a6674ed..87bd95d87 100644
--- a/.github/workflows/bench-swebench-smoke.yaml
+++ b/.github/workflows/bench-swebench-smoke.yaml
@@ -27,10 +27,10 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -50,7 +50,7 @@ jobs:
     continue-on-error: true  # optional gate; bench-smoke is the required PR gate
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install protoc
         run: |
@@ -82,10 +82,10 @@ jobs:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/bench-swebench-stress-scheduled.yaml b/.github/workflows/bench-swebench-stress-scheduled.yaml
index 777e3fafd..b7bb0c25a 100644
--- a/.github/workflows/bench-swebench-stress-scheduled.yaml
+++ b/.github/workflows/bench-swebench-stress-scheduled.yaml
@@ -22,10 +22,10 @@ jobs:
     timeout-minutes: 25
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -116,7 +116,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload mock pipeline-smoke artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: swebench-mock-pipeline-smoke-${{ github.run_number }}
           path: |
@@ -153,10 +153,10 @@ jobs:
     timeout-minutes: 360
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -267,7 +267,7 @@ jobs:
 
       - name: Upload stress artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: swebench-stress-openhands-${{ github.run_number }}
           path: |
@@ -278,7 +278,7 @@ jobs:
 
       - name: Upload stress_summary.json (named artifact)
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: stress-summary
           path: runs/exp-step2-lite-stress-large-repos/stress_summary.json
diff --git a/.github/workflows/bench-swebench-unit.yaml b/.github/workflows/bench-swebench-unit.yaml
index 980233e9e..aae9dc859 100644
--- a/.github/workflows/bench-swebench-unit.yaml
+++ b/.github/workflows/bench-swebench-unit.yaml
@@ -27,10 +27,10 @@ jobs:
         os: [ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/billing-test.yaml b/.github/workflows/billing-test.yaml
index ea71bb653..3b417791b 100644
--- a/.github/workflows/billing-test.yaml
+++ b/.github/workflows/billing-test.yaml
@@ -37,17 +37,17 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "18"
           cache: "npm"
           cache-dependency-path: runtime/ledger/package-lock.json
 
       - name: Setup Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v7
         with:
           go-version: "1.21"
           cache: true
@@ -164,7 +164,7 @@ jobs:
         run: npm test -- --watchAll=false
 
       - name: Upload test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: billing-test-results
diff --git a/.github/workflows/bundle-check.yaml b/.github/workflows/bundle-check.yaml
index e81313226..8c33d7256 100644
--- a/.github/workflows/bundle-check.yaml
+++ b/.github/workflows/bundle-check.yaml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -33,7 +33,7 @@ jobs:
           done
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v7
         with:
           go-version: '1.23'
 
@@ -46,7 +46,7 @@ jobs:
         run: pip install pyyaml
 
       - name: Comment on PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/cargo-deny.yml b/.github/workflows/cargo-deny.yml
index 5563f90da..f4c920449 100644
--- a/.github/workflows/cargo-deny.yml
+++ b/.github/workflows/cargo-deny.yml
@@ -24,7 +24,7 @@ jobs:
   deny:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: cargo deny
         uses: EmbarkStudios/cargo-deny-action@v2
diff --git a/.github/workflows/cert-validate.yml b/.github/workflows/cert-validate.yml
index cc72ae98c..f1c3de98c 100644
--- a/.github/workflows/cert-validate.yml
+++ b/.github/workflows/cert-validate.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Init external standards
         env:
@@ -65,7 +65,7 @@ jobs:
 
       - name: Upload validation artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: cert-validation-failures
           path: |
@@ -75,7 +75,7 @@ jobs:
 
       - name: Comment on PR
         if: github.event_name == 'pull_request' && failure()
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/chaos-nightly.yaml b/.github/workflows/chaos-nightly.yaml
index 89ba4f20a..18716efd5 100644
--- a/.github/workflows/chaos-nightly.yaml
+++ b/.github/workflows/chaos-nightly.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Validate chaos manifests parse
         run: |
           python -m pip install --upgrade pip pyyaml
@@ -29,10 +29,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Set up Kind
         uses: helm/kind-action@v1
@@ -40,7 +40,7 @@ jobs:
           node_image: kindest/node:v1.28.0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v5
         with:
           version: v3.12.0
 
@@ -324,7 +324,7 @@ jobs:
           EOF
 
       - name: Upload chaos report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: chaos-report-${{ github.run_number }}
           path: chaos-report.md
diff --git a/.github/workflows/ci-nightly-pytest.yml b/.github/workflows/ci-nightly-pytest.yml
index 7a33880bf..461486969 100644
--- a/.github/workflows/ci-nightly-pytest.yml
+++ b/.github/workflows/ci-nightly-pytest.yml
@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/ci-weekly-full.yml b/.github/workflows/ci-weekly-full.yml
index 1029e1ced..c698f5167 100644
--- a/.github/workflows/ci-weekly-full.yml
+++ b/.github/workflows/ci-weekly-full.yml
@@ -14,7 +14,7 @@ jobs:
   protobuf-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: bufbuild/buf-setup-action@v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 73d0299c7..0446f1230 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,8 +30,8 @@ jobs:
       go: ${{ steps.filter.outputs.go }}
       pcs: ${{ steps.filter.outputs.pcs }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -138,7 +138,7 @@ jobs:
   protobuf-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: bufbuild/buf-setup-action@v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -148,7 +148,7 @@ jobs:
   ci-honesty:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Audit workflow false-green patterns
         run: python scripts/audit_ci_honesty.py
 
diff --git a/.github/workflows/cla-bot.yaml b/.github/workflows/cla-bot.yaml
index 04604bbe0..82e9172e5 100644
--- a/.github/workflows/cla-bot.yaml
+++ b/.github/workflows/cla-bot.yaml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0 # Need full history for commit analysis
 
@@ -206,7 +206,7 @@ jobs:
 
       - name: Comment on PR
         if: github.event_name == 'pull_request' && steps.cla-verify.outputs.cla_status == 'failure'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const { data: comments } = await github.rest.issues.listComments({
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index a255609c1..f31e63331 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -49,10 +49,10 @@ jobs:
       matrix: ${{ steps.set.outputs.matrix }}
       any: ${{ steps.set.outputs.any }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         if: github.event_name != 'schedule' && github.event_name != 'workflow_dispatch'
 
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@v4
         id: filter
         if: github.event_name != 'schedule' && github.event_name != 'workflow_dispatch'
         with:
@@ -118,7 +118,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Free disk space
         if: matrix.language == 'javascript'
@@ -139,14 +139,14 @@ jobs:
           df -h
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Set up Go
         if: matrix.language == 'go'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: "1.23"
 
@@ -158,7 +158,7 @@ jobs:
 
       - name: Set up Node.js
         if: matrix.language == 'javascript'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
@@ -241,7 +241,7 @@ jobs:
           df -h
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{matrix.language}}"
 
@@ -273,7 +273,7 @@ jobs:
     if: github.event_name == 'schedule'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Generate security trends
         run: |
diff --git a/.github/workflows/compliance.yaml b/.github/workflows/compliance.yaml
index f2fa49903..80b2de200 100644
--- a/.github/workflows/compliance.yaml
+++ b/.github/workflows/compliance.yaml
@@ -12,12 +12,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -95,7 +95,7 @@ jobs:
 
       - name: Deploy to GitHub Pages
         if: github.event_name == 'release'
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs/compliance
@@ -114,7 +114,7 @@ jobs:
 
       - name: Comment on release
         if: github.event_name == 'release'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/demo-e2e.yml b/.github/workflows/demo-e2e.yml
index c3bde7728..c848e4edb 100644
--- a/.github/workflows/demo-e2e.yml
+++ b/.github/workflows/demo-e2e.yml
@@ -21,7 +21,7 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
     
     - name: Set up Node workspace (demo)
       uses: ./.github/actions/setup-node-workspace
@@ -111,7 +111,7 @@ jobs:
         fi
 
     - name: Store demo artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       if: always()
       with:
         name: demo-e2e-artifacts
diff --git a/.github/workflows/dep-graph.yaml b/.github/workflows/dep-graph.yaml
index 681251260..2c1a9bf55 100644
--- a/.github/workflows/dep-graph.yaml
+++ b/.github/workflows/dep-graph.yaml
@@ -17,12 +17,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v7
         with:
           go-version: "1.23"
 
@@ -89,7 +89,7 @@ jobs:
           echo "✅ All impacted bundle proofs built successfully"
 
       - name: Comment on PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 7e30dfa03..aebf28382 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -19,7 +19,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Check dependency graph availability
         id: dep-graph
@@ -36,7 +36,7 @@ jobs:
 
       - name: Dependency review
         if: steps.dep-graph.outputs.available == 'true'
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high
           deny-licenses: GPL-2.0, GPL-3.0, AGPL-3.0
diff --git a/.github/workflows/dfa.yaml b/.github/workflows/dfa.yaml
index 1f54e4ca4..1869e4623 100644
--- a/.github/workflows/dfa.yaml
+++ b/.github/workflows/dfa.yaml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0 # Full history for commit comparison
 
@@ -117,7 +117,7 @@ jobs:
           "
 
       - name: Upload DFA artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dfa-export
           path: artifact/dfa/
@@ -125,7 +125,7 @@ jobs:
 
       - name: Comment on PR
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const { data: comments } = await github.rest.issues.listComments({
diff --git a/.github/workflows/docs-build.yaml b/.github/workflows/docs-build.yaml
index e540502e3..e42d62164 100644
--- a/.github/workflows/docs-build.yaml
+++ b/.github/workflows/docs-build.yaml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Init external standards
         env:
@@ -39,17 +39,17 @@ jobs:
         run: make submodules
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: "1.23"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
diff --git a/.github/workflows/docs-deploy.yaml b/.github/workflows/docs-deploy.yaml
index 12f558712..d72f1d376 100644
--- a/.github/workflows/docs-deploy.yaml
+++ b/.github/workflows/docs-deploy.yaml
@@ -27,10 +27,10 @@ jobs:
       pages_ready: ${{ steps.pages.outcome == 'success' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -44,13 +44,13 @@ jobs:
 
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v4
+        uses: actions/configure-pages@v6
         # ci-honesty: justified wave7-remediation
         continue-on-error: true
 
       - name: Upload artifact
         if: steps.pages.outcome == 'success'
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: ./build
 
@@ -71,4 +71,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/dr-cross.yaml b/.github/workflows/dr-cross.yaml
index f017f0383..54c861a35 100644
--- a/.github/workflows/dr-cross.yaml
+++ b/.github/workflows/dr-cross.yaml
@@ -62,10 +62,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -89,7 +89,7 @@ jobs:
           PY
 
       - name: Upload moto DR report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: moto-dr-smoke-report
           path: reports/dr/
@@ -111,7 +111,7 @@ jobs:
       sidecar_url: ${{ steps.get_endpoints.outputs.sidecar_url }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Live DR preflight (secrets required)
         env:
@@ -124,7 +124,7 @@ jobs:
           python3 scripts/dr/live_dr_preflight.py
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -160,7 +160,7 @@ jobs:
           echo "sidecar_url=$SIDECAR_URL" >> "$GITHUB_OUTPUT"
 
       - name: Upload live preflight
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: live-dr-preflight
           path: reports/dr/
@@ -177,10 +177,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -286,9 +286,9 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && github.event.inputs.mode == 'live'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -324,9 +324,9 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && github.event.inputs.mode == 'live'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -357,7 +357,7 @@ jobs:
       github.event.inputs.mode == 'live'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Generate test report
         run: |
           mkdir -p reports/dr
@@ -371,7 +371,7 @@ jobs:
           ### Migration: ${{ needs.test-blue-green-migration.result }}
           EOF
       - name: Upload report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dr-test-report-live
           path: reports/dr/
diff --git a/.github/workflows/edge-load.yaml b/.github/workflows/edge-load.yaml
index d12c62a09..86b47dfbb 100644
--- a/.github/workflows/edge-load.yaml
+++ b/.github/workflows/edge-load.yaml
@@ -36,7 +36,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install k6
         run: |
@@ -72,7 +72,7 @@ jobs:
             --max-fail-rate 0.01 --max-p95-ms 400 --min-checks-rate 0.99
 
       - name: Upload results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: edge-load-smoke-results
@@ -95,7 +95,7 @@ jobs:
     timeout-minutes: 40
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Require live edge secrets (fail-closed)
         env:
@@ -150,7 +150,7 @@ jobs:
 
       - name: Upload live results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: edge-load-full-results
           path: |
diff --git a/.github/workflows/egress.yml b/.github/workflows/egress.yml
index 2cbec9c4f..dae6895e5 100644
--- a/.github/workflows/egress.yml
+++ b/.github/workflows/egress.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Init external standards
         env:
@@ -44,7 +44,7 @@ jobs:
 
       - name: Upload egress report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: egress-report
           path: evidence/egress/
diff --git a/.github/workflows/engineering-budget-smoke.yml b/.github/workflows/engineering-budget-smoke.yml
index 60798d638..b6bf23cb7 100644
--- a/.github/workflows/engineering-budget-smoke.yml
+++ b/.github/workflows/engineering-budget-smoke.yml
@@ -33,10 +33,10 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/evidence-v01-smoke.yml b/.github/workflows/evidence-v01-smoke.yml
index 554553ad0..1df957fe5 100644
--- a/.github/workflows/evidence-v01-smoke.yml
+++ b/.github/workflows/evidence-v01-smoke.yml
@@ -69,7 +69,7 @@ jobs:
   evidence-schema-only:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python tests
         uses: ./.github/actions/setup-python-tests
@@ -84,7 +84,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: evidence-schema-only
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go CLI
         uses: ./.github/actions/setup-go-cli
@@ -109,7 +109,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: evidence-validator
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
 
diff --git a/.github/workflows/evidence.yaml b/.github/workflows/evidence.yaml
index 36b446286..69389d5a3 100644
--- a/.github/workflows/evidence.yaml
+++ b/.github/workflows/evidence.yaml
@@ -39,7 +39,7 @@ jobs:
     if: needs.detect-aws.outputs.aws_configured != 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Generate offline compliance report (no AWS secrets)
         run: |
           mkdir -p docs/compliance
@@ -57,10 +57,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -70,7 +70,7 @@ jobs:
           pip install boto3 requests
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: us-west-2
@@ -92,7 +92,7 @@ jobs:
             --end-time "$(date -Iseconds)"
 
       - name: Upload manifest artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: evidence-manifest
           path: evidence-manifest.json
@@ -106,10 +106,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download manifest
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: evidence-manifest
           path: .
@@ -191,10 +191,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download manifest
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: evidence-manifest
           path: .
diff --git a/.github/workflows/fuzz.yaml b/.github/workflows/fuzz.yaml
index 4de139480..919808c77 100644
--- a/.github/workflows/fuzz.yaml
+++ b/.github/workflows/fuzz.yaml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@nightly
@@ -40,7 +40,7 @@ jobs:
           cargo +nightly fuzz run json_actions -- -runs=1000 -max_total_time=120
 
       - name: Upload fuzz artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: fuzz-artifacts
diff --git a/.github/workflows/heartbeat-test.yaml b/.github/workflows/heartbeat-test.yaml
index 4217ab9b4..9194edb70 100644
--- a/.github/workflows/heartbeat-test.yaml
+++ b/.github/workflows/heartbeat-test.yaml
@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Set up Kind
         uses: helm/kind-action@v1
@@ -30,7 +30,7 @@ jobs:
           node_image: kindest/node:v1.28.0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v5
         with:
           version: v3.12.0
 
diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml
index d6aa97662..6b2a01cdc 100644
--- a/.github/workflows/integration.yaml
+++ b/.github/workflows/integration.yaml
@@ -33,10 +33,10 @@ jobs:
       kind: ${{ steps.filter.outputs.kind }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Path filter (Kind / admission)
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -54,7 +54,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Init external standards
         env:
@@ -68,7 +68,7 @@ jobs:
           packages: pytest pytest-asyncio requests pyyaml flake8-breakpoint kubernetes
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       # Kind/Helm only when admission/helm paths change; compose-smoke is the default signal.
       - name: Install Kind
@@ -82,13 +82,13 @@ jobs:
 
       - name: Set up Helm
         if: needs.changes.outputs.kind == 'true'
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v5
         with:
           version: v3.12.0
 
       - name: Cache Kind images
         if: needs.changes.outputs.kind == 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.kind
diff --git a/.github/workflows/jwks-validate.yml b/.github/workflows/jwks-validate.yml
index d18ee6113..2cfea53b1 100644
--- a/.github/workflows/jwks-validate.yml
+++ b/.github/workflows/jwks-validate.yml
@@ -12,7 +12,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Build CLI (so)
         run: |
           set -euo pipefail
diff --git a/.github/workflows/lean-morph.yml b/.github/workflows/lean-morph.yml
index 4b091d384..a32d43ae3 100644
--- a/.github/workflows/lean-morph.yml
+++ b/.github/workflows/lean-morph.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Check for MORPH_API_KEY
         id: keycheck
         run: |
@@ -64,10 +64,10 @@ jobs:
         total: [8]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Cache Lean toolchain and mathlib artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.elan
diff --git a/.github/workflows/lean-offline.yaml b/.github/workflows/lean-offline.yaml
index 9dd16bb97..42385ef8e 100644
--- a/.github/workflows/lean-offline.yaml
+++ b/.github/workflows/lean-offline.yaml
@@ -49,10 +49,10 @@ jobs:
     name: "Lean Offline Smoke (Runtime + sorry scan)"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Cache Lean toolchain
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.elan
@@ -119,7 +119,7 @@ jobs:
     name: "Lean Offline Full (vendored mathlib)"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -127,7 +127,7 @@ jobs:
       # vendor/mathlib (.git + .lake). Historical cancels hung on cold
       # `lake exe cache get` when .git was omitted from the cache paths.
       - name: Cache Lean toolchain and mathlib artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.elan
@@ -266,7 +266,7 @@ jobs:
 
       - name: Upload offline build report
         if: success()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: lean-offline-full-report
           path: artifacts/lean-offline-full.txt
diff --git a/.github/workflows/lean-style.yaml b/.github/workflows/lean-style.yaml
index 40aece088..59b756346 100644
--- a/.github/workflows/lean-style.yaml
+++ b/.github/workflows/lean-style.yaml
@@ -20,12 +20,12 @@ jobs:
     
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Full history for git operations
 
       - name: Cache Lean toolchain and mathlib artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.elan
@@ -196,7 +196,7 @@ jobs:
           echo "- spec-templates/v1/proofs/Spec.lean" >> lean-style-report.md
 
       - name: Upload style report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: lean-style-report
           path: lean-style-report.md 
\ No newline at end of file
diff --git a/.github/workflows/loadtest.yaml b/.github/workflows/loadtest.yaml
index efd354267..c7f651f68 100644
--- a/.github/workflows/loadtest.yaml
+++ b/.github/workflows/loadtest.yaml
@@ -33,7 +33,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install k6
         run: |
@@ -62,7 +62,7 @@ jobs:
             --max-fail-rate 0.01 --max-p95-ms 500 --min-checks-rate 0.99
 
       - name: Upload k6 results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: k6-smoke-${{ github.run_id }}
@@ -81,9 +81,9 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Build and run ledger compose load
         run: |
           cd runtime/ledger
diff --git a/.github/workflows/morph-replay.yml b/.github/workflows/morph-replay.yml
index eef9b73f4..bee2bf6fc 100644
--- a/.github/workflows/morph-replay.yml
+++ b/.github/workflows/morph-replay.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Package replay bundles
         run: |
@@ -63,14 +63,14 @@ jobs:
           echo '{"skipped":true,"reason":"MORPH_API_KEY not set"}' > evidence/morph/evidence-pack/summary.json
 
       - name: Upload evidence pack
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: morph-evidence-pack
           path: evidence/morph/evidence-pack/
 
       - name: Upload morph summary
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: morph-replay-summary
           path: evidence/morph/evidence-pack/summary.json
diff --git a/.github/workflows/multiarch-build.yaml b/.github/workflows/multiarch-build.yaml
index cf1162532..dd51ba9c1 100644
--- a/.github/workflows/multiarch-build.yaml
+++ b/.github/workflows/multiarch-build.yaml
@@ -167,7 +167,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
@@ -180,14 +180,14 @@ jobs:
           fi
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           driver-opts: |
             image=moby/buildkit:v0.12.0
 
       - name: Log in to Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -195,7 +195,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/${{ matrix.service }}
           flavor: |
@@ -209,7 +209,7 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}
@@ -244,7 +244,7 @@ jobs:
         service: ${{ fromJson(needs.resolve-matrix.outputs.services) }}
     steps:
       - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -294,7 +294,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Resolve GHCR image ref (amd64)
         id: image
@@ -307,7 +307,7 @@ jobs:
           echo "ref=${{ env.REGISTRY }}/${owner}/${repo}/sidecar-watcher:sha-${short}-amd64" >> "$GITHUB_OUTPUT"
 
       - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -321,7 +321,7 @@ jobs:
           output: "trivy-results.sarif"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: "trivy-results.sarif"
diff --git a/.github/workflows/nightly-replay.yml b/.github/workflows/nightly-replay.yml
index a738675d4..57387cb0b 100644
--- a/.github/workflows/nightly-replay.yml
+++ b/.github/workflows/nightly-replay.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Init external standards
         env:
@@ -21,10 +21,10 @@ jobs:
         run: make submodules
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -44,7 +44,7 @@ jobs:
         run: bash tests/replay/run_replays.sh
 
       - name: Upload replay artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: nightly-replay-artifacts
           path: tests/replay/out
diff --git a/.github/workflows/opa-test.yaml b/.github/workflows/opa-test.yaml
index e9a3e6e77..426227bb1 100644
--- a/.github/workflows/opa-test.yaml
+++ b/.github/workflows/opa-test.yaml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install OPA and conftest
         run: |
diff --git a/.github/workflows/operational-excellence.yaml b/.github/workflows/operational-excellence.yaml
index 826e49fcc..928b27ecb 100644
--- a/.github/workflows/operational-excellence.yaml
+++ b/.github/workflows/operational-excellence.yaml
@@ -60,7 +60,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
@@ -83,7 +83,7 @@ jobs:
 
       - name: Configure AWS credentials
         if: steps.aws.outputs.available == 'true'
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -117,10 +117,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v7
         with:
           go-version: "1.23"
 
@@ -150,7 +150,7 @@ jobs:
           jq . ./reports/*.json > /dev/null
 
       - name: Upload billing reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: billing-reports-${{ github.run_id }}
           path: tools/metering/reports/
@@ -174,7 +174,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -218,7 +218,7 @@ jobs:
           nix-shell supply-chain-reproducibility.nix --run "verify-signed-attestations"
 
       - name: Upload attestations and SBOM
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: supply-chain-artifacts-${{ github.run_id }}
           path: |
@@ -238,10 +238,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -269,10 +269,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -306,7 +306,7 @@ jobs:
           "
 
       - name: Upload performance results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: performance-results-${{ github.run_id }}
           path: scripts/perf-results.json
@@ -321,10 +321,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: "1.22"
 
@@ -373,7 +373,7 @@ jobs:
             || test -s cargo-audit-results.json
 
       - name: Upload security scan results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: security-scan-results-${{ github.run_id }}
           path: |
@@ -392,7 +392,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Validate all components
         run: |
@@ -419,7 +419,7 @@ jobs:
           echo "- [x] Security scanning completed without critical issues" >> summary.md
 
       - name: Upload summary report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: operational-excellence-summary
           path: summary.md
diff --git a/.github/workflows/paper-conformance.yaml b/.github/workflows/paper-conformance.yaml
index 6bf859017..9265c549e 100644
--- a/.github/workflows/paper-conformance.yaml
+++ b/.github/workflows/paper-conformance.yaml
@@ -33,13 +33,13 @@ jobs:
       run_sidecar: ${{ steps.set.outputs.run_sidecar }}
       run_labeler: ${{ steps.set.outputs.run_labeler }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         if: github.event_name == 'push'
 
       - name: Paths filter (push)
         id: filter
         if: github.event_name == 'push'
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         with:
           filters: |
             sidecar:
@@ -71,7 +71,7 @@ jobs:
     needs: resolve-suite
     if: needs.resolve-suite.outputs.run_sidecar == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -97,7 +97,7 @@ jobs:
       needs.resolve-suite.outputs.run_labeler == 'true'
       && needs.resolve-suite.outputs.full_suite != 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -116,7 +116,7 @@ jobs:
     needs: resolve-suite
     if: needs.resolve-suite.outputs.full_suite == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -142,7 +142,7 @@ jobs:
     needs: resolve-suite
     if: needs.resolve-suite.outputs.run_sidecar == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -167,7 +167,7 @@ jobs:
     needs: resolve-suite
     if: needs.resolve-suite.outputs.run_sidecar == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -195,7 +195,7 @@ jobs:
     env:
       PF_SHADOW_MODE: "1"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -223,7 +223,7 @@ jobs:
     needs: resolve-suite
     if: needs.resolve-suite.outputs.full_suite == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -251,7 +251,7 @@ jobs:
     needs: resolve-suite
     if: needs.resolve-suite.outputs.full_suite == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -280,7 +280,7 @@ jobs:
     needs: resolve-suite
     if: needs.resolve-suite.outputs.run_sidecar == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -306,7 +306,7 @@ jobs:
     if: needs.resolve-suite.outputs.full_suite == 'true'
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -314,7 +314,7 @@ jobs:
           toolchain: stable
 
       - name: Cache cargo build
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
@@ -340,7 +340,7 @@ jobs:
     needs: resolve-suite
     if: needs.resolve-suite.outputs.run_sidecar == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -361,7 +361,7 @@ jobs:
     needs: resolve-suite
     if: needs.resolve-suite.outputs.run_sidecar == 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -428,7 +428,7 @@ jobs:
       && (needs.safety-case-bundle.result == 'success' || needs.safety-case-bundle.result == 'skipped')
       && needs.dfa-equivalence.result == 'success'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -455,7 +455,7 @@ jobs:
       && needs.resolve-suite.outputs.full_suite == 'true'
       && needs.integration.result == 'success'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install protoc
         run: |
@@ -471,7 +471,7 @@ jobs:
         run: cargo bench -p provability-fabric-bench -- --quick --output-format=json | tee performance_report.json
 
       - name: Upload Performance Report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: performance-report
           path: performance_report.json
@@ -486,7 +486,7 @@ jobs:
       && needs.resolve-suite.outputs.full_suite == 'true'
       && needs.integration.result == 'success'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -508,7 +508,7 @@ jobs:
           if [ "$audit_status" -eq 2 ]; then exit 2; fi
 
       - name: Upload Security Report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: security-report
           path: security_report.json
@@ -523,7 +523,7 @@ jobs:
       && needs.resolve-suite.outputs.full_suite == 'true'
       && needs.integration.result == 'success'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -537,7 +537,7 @@ jobs:
           cargo test --doc --all-features
 
       - name: Upload Documentation
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: documentation
           path: runtime/sidecar-watcher/target/doc
diff --git a/.github/workflows/pcs-ci.yml b/.github/workflows/pcs-ci.yml
index 58ed35dea..18e685b62 100644
--- a/.github/workflows/pcs-ci.yml
+++ b/.github/workflows/pcs-ci.yml
@@ -95,9 +95,9 @@ jobs:
     env:
       PCS_CORE_PATH: ${{ github.workspace }}/pcs-core
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           repository: SentinelOps-CI/pcs-core
           path: pcs-core
@@ -111,7 +111,7 @@ jobs:
             examples/workflow_profiles
             examples/artifact_registry.valid.json
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: "1.23"
           cache-dependency-path: |
diff --git a/.github/workflows/perf-proofmeter.yaml b/.github/workflows/perf-proofmeter.yaml
index 980ecc407..be2522227 100644
--- a/.github/workflows/perf-proofmeter.yaml
+++ b/.github/workflows/perf-proofmeter.yaml
@@ -32,10 +32,10 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: "1.23"
 
@@ -78,7 +78,7 @@ jobs:
           PY
 
       - name: Upload results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: smoke-results
           path: tests/perf/smoke_results.json
@@ -97,9 +97,9 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: "1.23"
       - name: Build and note
diff --git a/.github/workflows/perf.yaml b/.github/workflows/perf.yaml
index cb36fa997..b1c66d7b4 100644
--- a/.github/workflows/perf.yaml
+++ b/.github/workflows/perf.yaml
@@ -19,10 +19,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -46,7 +46,7 @@ jobs:
           python scripts/bench.py --count 100000 --output perf-results.json
 
       - name: Upload performance results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: perf-results-${{ github.run_number }}
           path: perf-results.json
@@ -63,7 +63,7 @@ jobs:
 
       - name: Deploy to gh-pages
         if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./perf
diff --git a/.github/workflows/performance-gate.yaml b/.github/workflows/performance-gate.yaml
index 842cbfe19..05917fb4c 100644
--- a/.github/workflows/performance-gate.yaml
+++ b/.github/workflows/performance-gate.yaml
@@ -32,7 +32,7 @@ jobs:
     
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Full history for baseline comparison
 
@@ -43,7 +43,7 @@ jobs:
           profile: minimal
 
       - name: Cache dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
@@ -68,7 +68,7 @@ jobs:
         id: gates
 
       - name: Upload benchmark results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: benchmark-results-${{ matrix.rust-version }}
diff --git a/.github/workflows/pf-ci.yaml b/.github/workflows/pf-ci.yaml
index d519ea1ae..ad97f1c66 100644
--- a/.github/workflows/pf-ci.yaml
+++ b/.github/workflows/pf-ci.yaml
@@ -69,7 +69,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
@@ -91,7 +91,7 @@ jobs:
     timeout-minutes: 90
     steps:
       - name: Checkout current repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -99,19 +99,19 @@ jobs:
       # so CI behavior stays aligned with the reference implementation. Override with CI_PAT if the default
       # GITHUB_TOKEN lacks cross-repo read on forks.
       - name: Checkout SentinelOps-CI/provability-fabric as action source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: SentinelOps-CI/provability-fabric
           path: ci-src
           token: ${{ secrets.CI_PAT || secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -344,7 +344,7 @@ jobs:
           JSON
 
       - name: Upload trust-fire artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: trust-fire-report-${{ github.run_id }}
           path: trust-fire-report.json
@@ -358,7 +358,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Download trust-fire artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: trust-fire-report-${{ github.run_id }}
 
diff --git a/.github/workflows/pf-core-schema-check.yml b/.github/workflows/pf-core-schema-check.yml
index 883b42d37..73fda9cf2 100644
--- a/.github/workflows/pf-core-schema-check.yml
+++ b/.github/workflows/pf-core-schema-check.yml
@@ -23,9 +23,9 @@ jobs:
   schema-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/pf-cross-repo-consumer.yaml b/.github/workflows/pf-cross-repo-consumer.yaml
index 8b934426d..fd6e4ad2d 100644
--- a/.github/workflows/pf-cross-repo-consumer.yaml
+++ b/.github/workflows/pf-cross-repo-consumer.yaml
@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Assert reusable PF CI workflow contract
         run: |
diff --git a/.github/workflows/platform-cert-validate.yml b/.github/workflows/platform-cert-validate.yml
index 184a1f332..bec729e5d 100644
--- a/.github/workflows/platform-cert-validate.yml
+++ b/.github/workflows/platform-cert-validate.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Init external standards
         env:
@@ -38,12 +38,12 @@ jobs:
         run: make submodules
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Install dependencies
         run: |
@@ -76,7 +76,7 @@ jobs:
           python tools/compliance/check_compliance.py --threshold 0.999
 
       - name: Upload validation report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: cert-validation-report
diff --git a/.github/workflows/platform-perf-smoke.yml b/.github/workflows/platform-perf-smoke.yml
index 4efc657a6..7ad757e20 100644
--- a/.github/workflows/platform-perf-smoke.yml
+++ b/.github/workflows/platform-perf-smoke.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install k6
         run: |
@@ -58,7 +58,7 @@ jobs:
         run: python tools/perf/generate_report.py k6-results.json
 
       - name: Upload performance results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: performance-results
diff --git a/.github/workflows/platform-replay.yml b/.github/workflows/platform-replay.yml
index f5c06bd95..36729dd83 100644
--- a/.github/workflows/platform-replay.yml
+++ b/.github/workflows/platform-replay.yml
@@ -26,15 +26,15 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Init external standards
         env:
@@ -59,7 +59,7 @@ jobs:
         run: make validate-certs
 
       - name: Upload replay artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: replay-artifacts
diff --git a/.github/workflows/policy-build.yml b/.github/workflows/policy-build.yml
index e57df9d69..b784063d4 100644
--- a/.github/workflows/policy-build.yml
+++ b/.github/workflows/policy-build.yml
@@ -19,10 +19,10 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
     
     - name: Set up Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v7
       with:
         go-version: '1.23'
     
@@ -99,7 +99,7 @@ jobs:
         echo "$COMMENT" > pr-comment.md
     
     - name: Upload build artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       if: always()
       with:
         name: policy-build-artifacts
diff --git a/.github/workflows/policy-gates.yaml b/.github/workflows/policy-gates.yaml
index 07f8fca48..2aafa098e 100644
--- a/.github/workflows/policy-gates.yaml
+++ b/.github/workflows/policy-gates.yaml
@@ -36,10 +36,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Cache Lean toolchain and mathlib artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.elan
@@ -101,7 +101,7 @@ jobs:
           fi
 
       - name: Upload DFA artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dfa-artifacts
           path: artifact/dfa.json
@@ -118,16 +118,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download DFA artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dfa-artifacts
           path: artifact/
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -165,16 +165,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download DFA artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dfa-artifacts
           path: artifact/
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -202,16 +202,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download DFA artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dfa-artifacts
           path: artifact/
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -251,7 +251,7 @@ jobs:
           echo "replay_determinism=$REPLAY_DETERMINISM" >> $GITHUB_OUTPUT
 
       - name: Upload coverage report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-report
           path: tools/coverage/coverage_report.json
@@ -259,7 +259,7 @@ jobs:
 
       - name: Comment coverage on PR
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           TOOLS_COVERED: ${{ steps.coverage.outputs.tools_covered }}
           EVENTS_COVERED: ${{ steps.coverage.outputs.events_covered }}
@@ -296,16 +296,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download DFA artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dfa-artifacts
           path: artifact/
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -345,16 +345,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download DFA artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dfa-artifacts
           path: artifact/
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -377,7 +377,7 @@ jobs:
           python scripts/bench.py --count 1000 --output bench/benchmark_results.json
 
       - name: Upload benchmark results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: benchmark-results
           path: bench/benchmark_results.json
diff --git a/.github/workflows/policy-pr-proof.yml b/.github/workflows/policy-pr-proof.yml
index 34b4fbb27..9ff89acb3 100644
--- a/.github/workflows/policy-pr-proof.yml
+++ b/.github/workflows/policy-pr-proof.yml
@@ -21,10 +21,10 @@ jobs:
     timeout-minutes: 25
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: core/cli/pf/go.mod
 
@@ -99,7 +99,7 @@ jobs:
 
       - name: Post PR comment with hashes
         if: ${{ github.event_name == 'pull_request' && steps.compile.outputs.skip != 'true' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -130,10 +130,10 @@ jobs:
     if: ${{ always() }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: core/cli/pf/go.mod
 
@@ -170,7 +170,7 @@ jobs:
 
       - name: Comment on PR with replay result
         if: ${{ github.event_name == 'pull_request' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/pr-comments.yml b/.github/workflows/pr-comments.yml
index 3a495046f..be6a2ee51 100644
--- a/.github/workflows/pr-comments.yml
+++ b/.github/workflows/pr-comments.yml
@@ -13,7 +13,7 @@ jobs:
   comment:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/privacy-test.yaml b/.github/workflows/privacy-test.yaml
index d93cd655d..75181d6ef 100644
--- a/.github/workflows/privacy-test.yaml
+++ b/.github/workflows/privacy-test.yaml
@@ -32,10 +32,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -75,10 +75,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -189,7 +189,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
@@ -255,7 +255,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Run integration tests
         run: |
diff --git a/.github/workflows/proof-bot.yaml b/.github/workflows/proof-bot.yaml
index 3e23e537a..49dacdc20 100644
--- a/.github/workflows/proof-bot.yaml
+++ b/.github/workflows/proof-bot.yaml
@@ -19,13 +19,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0 # Full history for git operations
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -54,7 +54,7 @@ jobs:
 
       - name: Create Pull Request
         if: success() && steps.proofbot.outcome == 'success'
-        uses: peter-evans/create-pull-request@v5
+        uses: peter-evans/create-pull-request@v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: "Auto-proof: Resolve admits via APOLLO"
diff --git a/.github/workflows/proof-fuzz.yaml b/.github/workflows/proof-fuzz.yaml
index a2ed8cbb7..9664af25c 100644
--- a/.github/workflows/proof-fuzz.yaml
+++ b/.github/workflows/proof-fuzz.yaml
@@ -28,12 +28,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0 # Full history for git operations
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -261,7 +261,7 @@ jobs:
           "
 
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: proof-fuzz-results
           path: |
@@ -271,7 +271,7 @@ jobs:
           retention-days: 30
 
       - name: Upload trend dashboard
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: proof-fuzz-dashboard
           path: tests/proof-fuzz/results/trend_dashboard.png
@@ -281,7 +281,7 @@ jobs:
         if: github.event_name == 'pull_request'
         # ci-honesty: justified #229 — comment is non-gating; harness results already uploaded as artifacts
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/proto-compat.yaml b/.github/workflows/proto-compat.yaml
index 4d756cab2..faef71991 100644
--- a/.github/workflows/proto-compat.yaml
+++ b/.github/workflows/proto-compat.yaml
@@ -55,7 +55,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         fetch-depth: 0
 
@@ -114,7 +114,7 @@ jobs:
         fi
 
     - name: Upload test results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       if: always()
       with:
         name: proto-compat-${{ matrix.language }}-${{ github.run_id }}
@@ -130,7 +130,7 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
 
     - name: Setup protobuf tools
       run: |
@@ -168,7 +168,7 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
 
     - name: Setup security tools
       run: |
@@ -211,10 +211,10 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
 
     - name: Setup Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v7
       with:
         go-version: '1.23'
 
@@ -250,7 +250,7 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
 
     - name: Generate report
       run: |
@@ -316,7 +316,7 @@ jobs:
         echo "| Rust | ✅ | ✅ | ✅ |" >> proto-compat-report.md
 
     - name: Upload compatibility report
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: proto-compatibility-report-${{ github.run_id }}
         path: proto-compat-report.md
@@ -325,7 +325,7 @@ jobs:
       if: github.event_name == 'pull_request'
       # ci-honesty: justified wave7-remediation
       continue-on-error: true
-      uses: actions/github-script@v6
+      uses: actions/github-script@v9
       with:
         script: |
           const fs = require('fs');
diff --git a/.github/workflows/publish-updates.yaml b/.github/workflows/publish-updates.yaml
index 61482bd24..49be6c62e 100644
--- a/.github/workflows/publish-updates.yaml
+++ b/.github/workflows/publish-updates.yaml
@@ -33,13 +33,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # Needed so live path can open a PR from a bot branch.
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -154,7 +154,7 @@ jobs:
 
       - name: Upload artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: updates-package
           path: |
diff --git a/.github/workflows/rbac-test.yaml b/.github/workflows/rbac-test.yaml
index e9cc666fc..3a755a1a4 100644
--- a/.github/workflows/rbac-test.yaml
+++ b/.github/workflows/rbac-test.yaml
@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Set up Kind
         uses: helm/kind-action@v1
@@ -30,12 +30,12 @@ jobs:
           cluster_name: provability-fabric-test
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v5
         with:
           version: v3.12.0
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: core/cli/pf/go.mod
 
@@ -300,7 +300,7 @@ jobs:
           kill $PF_PID
 
       - name: Comment on PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const body = `## RBAC Test Results
diff --git a/.github/workflows/redteam.yaml b/.github/workflows/redteam.yaml
index 514e80a43..0a30a371f 100644
--- a/.github/workflows/redteam.yaml
+++ b/.github/workflows/redteam.yaml
@@ -16,8 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - name: Install dependencies
@@ -32,7 +32,7 @@ jobs:
             --output injection-results.json
           python tests/redteam/abac_fuzz.py --offline
       - name: Upload results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: redteam-offline-${{ github.run_id }}
           path: injection-results.json
@@ -44,15 +44,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Set up Kind cluster
         run: |
@@ -121,7 +121,7 @@ jobs:
             --output redteam-results.md
 
       - name: Upload red-team results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: redteam-results-${{ github.run_id }}
           path: redteam-results.md
@@ -146,7 +146,7 @@ jobs:
 
       - name: Comment on PR
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/release-sbom.yml b/.github/workflows/release-sbom.yml
index c2fcd49f9..ce93f66a9 100644
--- a/.github/workflows/release-sbom.yml
+++ b/.github/workflows/release-sbom.yml
@@ -16,7 +16,7 @@ jobs:
   cyclonedx:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Syft
         run: |
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index b83fe40e7..c3d2dc5f6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -32,7 +32,7 @@ jobs:
       ni-passed: ${{ steps.check-ni.outputs.passed }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Check NI Pass Rate
         id: check-ni
@@ -65,7 +65,7 @@ jobs:
       slo-passed: ${{ steps.check-slo.outputs.passed }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Check SLO Compliance
         id: check-slo
@@ -102,7 +102,7 @@ jobs:
       evidence-passed: ${{ steps.check-evidence.outputs.passed }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Check Safety Case Evidence
         id: check-evidence
@@ -135,7 +135,7 @@ jobs:
       security-passed: ${{ steps.check-security.outputs.passed }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Check Security Metrics
         id: check-security
@@ -175,7 +175,7 @@ jobs:
       needs.security-fence.outputs.security-passed == 'true'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Create Release
         run: |
diff --git a/.github/workflows/replay.yml b/.github/workflows/replay.yml
index 7d0635b6a..2a66d27a6 100644
--- a/.github/workflows/replay.yml
+++ b/.github/workflows/replay.yml
@@ -21,15 +21,15 @@ jobs:
         runs: [3]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Init external standards
         env:
@@ -83,14 +83,14 @@ jobs:
 
       - name: Upload replay outputs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: replay-outputs
           path: tests/replay/out/
 
       - name: Upload zipped bundles
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: replay-bundles-zipped
           path: artifact/replay_zips/
diff --git a/.github/workflows/retrieval-gateway.yml b/.github/workflows/retrieval-gateway.yml
index 2db1e5ec9..3afa7c31a 100644
--- a/.github/workflows/retrieval-gateway.yml
+++ b/.github/workflows/retrieval-gateway.yml
@@ -26,7 +26,7 @@ jobs:
     name: Build and test retrieval-gateway
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/reusable-ci-extended.yml b/.github/workflows/reusable-ci-extended.yml
index e71bee422..409d27819 100644
--- a/.github/workflows/reusable-ci-extended.yml
+++ b/.github/workflows/reusable-ci-extended.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python tests
         uses: ./.github/actions/setup-python-tests
diff --git a/.github/workflows/reusable-ci-go-node.yml b/.github/workflows/reusable-ci-go-node.yml
index 0edd9c1e7..d1fc656ea 100644
--- a/.github/workflows/reusable-ci-go-node.yml
+++ b/.github/workflows/reusable-ci-go-node.yml
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go CLI
         uses: ./.github/actions/setup-go-cli
@@ -103,7 +103,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Node.js ledger workspace
         uses: ./.github/actions/setup-node-workspace
@@ -136,7 +136,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Node.js SDK workspace
         uses: ./.github/actions/setup-node-workspace
@@ -162,11 +162,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Global spectral CLI only — no package-dir npm ci; setup-node-workspace does not fit.
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
@@ -188,7 +188,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Node.js console
         uses: ./.github/actions/setup-node-workspace
diff --git a/.github/workflows/reusable-ci-lean.yml b/.github/workflows/reusable-ci-lean.yml
index 64b8dc242..7c2add62d 100644
--- a/.github/workflows/reusable-ci-lean.yml
+++ b/.github/workflows/reusable-ci-lean.yml
@@ -24,10 +24,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python (Lean gates)
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -51,7 +51,7 @@ jobs:
           lean --version
 
       - name: Cache Lean artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.elan
diff --git a/.github/workflows/reusable-ci-prepare.yml b/.github/workflows/reusable-ci-prepare.yml
index de154f074..aa0b79c47 100644
--- a/.github/workflows/reusable-ci-prepare.yml
+++ b/.github/workflows/reusable-ci-prepare.yml
@@ -25,15 +25,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: "1.23"
           cache: true
diff --git a/.github/workflows/reusable-ci-rust.yml b/.github/workflows/reusable-ci-rust.yml
index 0c9319e0a..42aaea658 100644
--- a/.github/workflows/reusable-ci-rust.yml
+++ b/.github/workflows/reusable-ci-rust.yml
@@ -24,7 +24,7 @@ jobs:
       run_workspace_libs: ${{ steps.crates.outputs.run_workspace_libs }}
       workspace_crates: ${{ steps.crates.outputs.workspace_crates }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -60,7 +60,7 @@ jobs:
       CARGO_TERM_COLOR: always
       PF_SHADOW_MODE: "1"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install protoc
         run: |
@@ -118,7 +118,7 @@ jobs:
       CARGO_TERM_COLOR: always
       PF_SHADOW_MODE: "1"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install protoc
         run: |
@@ -162,7 +162,7 @@ jobs:
     env:
       CARGO_TERM_COLOR: always
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install protoc
         run: |
diff --git a/.github/workflows/revocation-sync.yaml b/.github/workflows/revocation-sync.yaml
index b64774893..c5e0c50d3 100644
--- a/.github/workflows/revocation-sync.yaml
+++ b/.github/workflows/revocation-sync.yaml
@@ -35,7 +35,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Validate local revocation list
         run: |
@@ -75,7 +75,7 @@ jobs:
           PY
 
       - name: Upload synced artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: revocations-synced
           path: runtime/admission-controller/revocation/revocations.synced.json
@@ -90,7 +90,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -152,7 +152,7 @@ jobs:
           fi
 
       - name: Upload live synced artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: revocations-synced-live
           path: |
diff --git a/.github/workflows/sbom-diff.yaml b/.github/workflows/sbom-diff.yaml
index 5e199a64d..7b91f2ab2 100644
--- a/.github/workflows/sbom-diff.yaml
+++ b/.github/workflows/sbom-diff.yaml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -48,7 +48,7 @@ jobs:
           echo "sbom-file=sbom.json" >> $GITHUB_OUTPUT
 
       - name: Upload SBOM
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sbom-${{ github.sha }}
           path: sbom.json
@@ -60,10 +60,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download SBOM
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: sbom-${{ github.sha }}
           path: .
@@ -93,10 +93,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download SBOM
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: sbom-${{ github.sha }}
           path: .
@@ -142,7 +142,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -158,7 +158,7 @@ jobs:
           sudo install -m 0755 "$SYFT_BIN" /usr/local/bin/syft
 
       - name: Download current SBOM
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: sbom-${{ github.sha }}
           path: .
@@ -219,10 +219,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download SBOM
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: sbom-${{ github.sha }}
           path: .
@@ -252,7 +252,7 @@ jobs:
         if: github.event_name == 'pull_request'
         # ci-honesty: justified wave7-remediation
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
@@ -301,10 +301,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download SBOM
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: sbom-${{ github.sha }}
           path: .
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index a8889a3fb..d3bf089c6 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -23,12 +23,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@v2.4.2
+        uses: ossf/scorecard-action@v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
diff --git a/.github/workflows/slo-gates.yaml b/.github/workflows/slo-gates.yaml
index dfd575456..3736e4ae8 100644
--- a/.github/workflows/slo-gates.yaml
+++ b/.github/workflows/slo-gates.yaml
@@ -31,7 +31,7 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       
     - name: Install k6
       run: |
@@ -59,7 +59,7 @@ jobs:
         npm run test:component-budgets || echo "component-budgets skipped (no root package.json suite)"
         
     - name: Upload test results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       if: always()
       with:
         name: pr-smoke-results
@@ -75,7 +75,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
 
     - name: Install k6
       run: |
@@ -98,7 +98,7 @@ jobs:
           --stage 30s:0
 
     - name: Upload k6 results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       if: always()
       with:
         name: nightly-k6-results
diff --git a/.github/workflows/spec-ai.yaml b/.github/workflows/spec-ai.yaml
index dcd2eced3..112e8f8f4 100644
--- a/.github/workflows/spec-ai.yaml
+++ b/.github/workflows/spec-ai.yaml
@@ -18,12 +18,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0 # Need full history for diff analysis
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -74,7 +74,7 @@ jobs:
 
       - name: Post AI suggestions
         if: steps.ai-review.outputs.suggestions != '[]'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
@@ -184,10 +184,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -234,7 +234,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Calculate acceptance rate
         run: |
@@ -299,7 +299,7 @@ jobs:
           echo "Metrics report generated"
 
       - name: Upload metrics report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ai-spec-metrics
           path: ai_spec_metrics_report.md
diff --git a/.github/workflows/standards-pin.yml b/.github/workflows/standards-pin.yml
index c27ef51e9..112833e4f 100644
--- a/.github/workflows/standards-pin.yml
+++ b/.github/workflows/standards-pin.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Init external standards
         env:
@@ -37,7 +37,7 @@ jobs:
       - name: Comment on PR (drift)
         if: failure() && github.event_name == 'pull_request'
         continue-on-error: true  # ci-honesty: justified wave7-remediation
-        uses: actions/github-script@v6
+        uses: actions/github-script@v9
         with:
           script: |
             github.rest.issues.createComment({
diff --git a/.github/workflows/test-windows.yml b/.github/workflows/test-windows.yml
index 3e1252944..edf8e8814 100644
--- a/.github/workflows/test-windows.yml
+++ b/.github/workflows/test-windows.yml
@@ -40,10 +40,10 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: core/cli/pf/go.mod
 
diff --git a/.github/workflows/trust-fire-ga-test.yaml b/.github/workflows/trust-fire-ga-test.yaml
index eed533ba5..cb49c24d1 100644
--- a/.github/workflows/trust-fire-ga-test.yaml
+++ b/.github/workflows/trust-fire-ga-test.yaml
@@ -37,10 +37,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -88,7 +88,7 @@ jobs:
             --output trust-fire-report.json
 
       - name: Upload test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: trust-fire-results-${{ github.run_id }}
           path: trust-fire-report.json
diff --git a/.github/workflows/verify-publish-bundle.yaml b/.github/workflows/verify-publish-bundle.yaml
index c7b618ff4..aa6887934 100644
--- a/.github/workflows/verify-publish-bundle.yaml
+++ b/.github/workflows/verify-publish-bundle.yaml
@@ -45,7 +45,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python tests
         uses: ./.github/actions/setup-python-tests
diff --git a/.github/workflows/wasm-scan.yaml b/.github/workflows/wasm-scan.yaml
index 4da978726..fa960eec2 100644
--- a/.github/workflows/wasm-scan.yaml
+++ b/.github/workflows/wasm-scan.yaml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
@@ -230,7 +230,7 @@ jobs:
           echo "Security report generated"
 
       - name: Upload security report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wasm-security-report
           path: wasm-security-report.md
@@ -242,7 +242,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable