🔥 chore(deps): drop dormant Renovate; Dependabot is the updater

CHANGELOG.md

@@ -89,6 +89,7 @@ repository still gets a decision, never by following the link; no release carrie
 - build(deps): bump actions/attest from 4.2.1 to 4.2.2
 - build(deps): bump github.com/google/cel-go from 0.30.0 to 0.31.0
 - build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.2.3
+- :fire: chore(deps): drop dormant Renovate; Dependabot is the updater
 
 ### Documentation
 - :memo: docs(decisions): record D-126 (D-031 domain deferred) and D-127 (SEC-05 PAT rotation scheduled)

GUIDELINES.md

@@ -46,7 +46,7 @@ holds the *how*. Conflicts: ADRs win; update this file via PR when they do.
 - Prefer stdlib; new deps need: active maintenance (commits within 6 months), >1 effective
   maintainer, compatible license (Apache-2.0/MIT/BSD), and no heavyweight transitive tail
   into the single static binary (ADR-0001, ADR-0013's dependency-health bar).
-- SHA-pin CI actions; renovate/dependabot keep them current.
+- SHA-pin CI actions; Dependabot keeps them current.
 
 ## Repository discipline
 

Taskfile.yml

@@ -116,6 +116,14 @@ tasks:
       # .github/workflows/**, so without this line an unpinned workflow is caught
       # only by CI — and only for as long as the CI step itself survives.
       - task: lint-workflow-pins-test
+      # Operator 2026-08-13: Dependabot is the updater; a reintroduced
+      # renovate.json would otherwise merge green.
+      - task: ci-audit-test
+
+  ci-audit-test:
+    desc: "E9-S04 + Dependabot-only: single CodeQL workflow; no Renovate config"
+    cmds:
+      - bash hack/release/ci_audit_test.sh
 
   lint-workflow-pins-test:
     desc: "AUD-S09/S14 gate: workflow supply-chain pins are present and the checks can fail (REQ-AUD-S09-01, REQ-AUD-S14-01/02)"

docs/planning/ci-hardening-status.md

@@ -13,7 +13,7 @@ Last reviewed: 2026-08-04 (E9-S04).
 | **govulncheck** (weekly) | ✅ Exists | `.github/workflows/vulncheck.yaml` | Schedule-only sweep; complements push gate. |
 | **gitleaks** | ✅ Exists | `.github/workflows/verify.yaml` (`gitleaks` step) | HEAD-scoped history scan; CLI (no paid org action). |
 | **SHA-pinned Actions** | ✅ Exists | All `.github/workflows/*.yaml` | Full commit SHAs + version comments (D-045). |
-| **Dependabot** | ✅ Exists | `.github/dependabot.yml` | `gomod`, `github-actions`, `pip` (docs) weekly. |
+| **Dependabot** | ✅ Exists | `.github/dependabot.yml` | `gomod`, `github-actions`, `pip` (docs), `npm` (hack/schemas-validator) weekly. **Chosen updater** (operator 2026-08-13); Renovate is not used. |
 | **actionlint** | ✅ Exists | `.github/workflows/actionlint.yaml` | Lint workflow YAML on workflow changes (E9-S04 residual). |
 
 ## Residual gaps (operator / later lanes)
@@ -22,13 +22,13 @@ Last reviewed: 2026-08-04 (E9-S04).
 | --- | --- | --- |
 | Branch protection + required status checks on `main` | Gap | Operator (D-045 residual) |
 | codecov / coverage badge | Gap | Deferred (not in D-045 scope) |
-| renovate (vs Dependabot-only) | Gap | Optional; Dependabot covers actions + modules |
 
 ## Explicit non-actions (D-102)
 
 - Do **not** add a second CodeQL workflow or matrix.
 - Do **not** duplicate govulncheck on every push (weekly job in `vulncheck.yaml` is sufficient).
 - Do **not** add a second Scorecard job.
+- Do **not** add Renovate (Dependabot is the chosen updater).
 
 Verify locally:
 

docs/planning/oss-playbook.md

@@ -12,7 +12,7 @@ surface). Ordered backlog for assent; "when" anchors each item to the meta-plan.
 | 2 | Community files: CODE_OF_CONDUCT (Contributor Covenant 2.1), CONTRIBUTING with a **standards map** (each doc owns exactly one concern), GOVERNANCE with maintainer-continuity note | CoC + templates now; CONTRIBUTING with GUIDELINES.md; GOVERNANCE before going public | 🔶 |
 | 3 | README formula: logo → ≤6 badges → one-line value prop + tagline → status callout → why-bullets with ADR links → mermaid hero diagram → quick start → **honest maturity table** (frontends / forges / providers as Core·Beta·Planned) → community/security tables | with first public push (E9) | ⏳ |
 | 4 | Release engineering: tag-triggered workflow, git-cliff notes, cosign keyless signing, SLSA provenance + SBOM attestation — **plus goreleaser for CLI binaries** (`go install`, brew, curl+checksum): the one piece the siblings lack and a CLI must have | E9 | ⏳ |
-| 5 | CI hardening: gitleaks, CodeQL, OpenSSF Scorecard (+badge), govulncheck, SHA-pinned actions, dependabot+renovate, codecov | E9, incrementally from first code | ⏳ |
+| 5 | CI hardening: gitleaks, CodeQL, OpenSSF Scorecard (+badge), govulncheck, SHA-pinned actions, dependabot, codecov | E9, incrementally from first code | ⏳ |
 | 6 | Branding pack via reproducible source assets and generator script (logos, social cards, favicons) | before going public | ✅ |
 | 7 | mkdocs-material site + GH Pages docs workflow | E9 | ✅ |
 | 8 | Compatibility-promise doc (`API_STABILITY.md` equivalent): what policy schema / decision contract / test-format guarantee per version, graduation criteria — **high trust signal for a gate tool** | Phase 3 (contracts freeze) | ⏳ |

hack/release/README.md

@@ -171,7 +171,7 @@ explicit `permissions:` block sets every unlisted scope to `none`, so this is no
 | --- | --- |
 | `task release-snapshot` | Local goreleaser snapshot under `dist/` |
 | `hack/release/snapshot_test.sh` | REQ-E9-S02 gate: archives, checksums, stamped version |
-| `hack/release/ci_audit_test.sh` | REQ-E9-S04 gate: no duplicate CodeQL workflow |
+| `hack/release/ci_audit_test.sh` | REQ-E9-S04 gate: no duplicate CodeQL workflow; Dependabot-only (no Renovate config) |
 
 ## Install script (E9-S07a)
 

hack/release/ci_audit_test.sh

@@ -16,4 +16,18 @@ if ! grep -q codeql.yaml docs/planning/ci-hardening-status.md; then
   exit 1
 fi
 
-echo "OK: CI audit — single CodeQL workflow; hardening inventory present"
+# Operator 2026-08-13: Dependabot is the live updater; Renovate config is dormant
+# and must not return. Negative files are listed explicitly so a renamed
+# renovate.json5 / .github/renovate.json cannot hide.
+if [[ ! -f .github/dependabot.yml ]]; then
+  echo "FAIL: .github/dependabot.yml must exist (Dependabot is the version updater)" >&2
+  exit 1
+fi
+for stale in renovate.json renovate.json5 .github/renovate.json .renovaterc .renovaterc.json; do
+  if [[ -e "$stale" ]]; then
+    echo "FAIL: $stale must not exist — Dependabot is the updater; Renovate is not" >&2
+    exit 1
+  fi
+done
+
+echo "OK: CI audit — single CodeQL workflow; hardening inventory present; Dependabot-only"

openspec/specs/p5-e11-rego-backend/spec.md

@@ -197,7 +197,7 @@ made silently by a story.
 
 *Supply chain, separately:* OPA is a large dependency with a large transitive tree on a
 project shipping cosign signing, SLSA-grade provenance, `govulncheck`, and Scorecard. It
-materially changes binary size, vulnerability surface, and `renovate` load. S03 pins it and
+materially changes binary size, vulnerability surface, and Dependabot load. S03 pins it and
 records the size delta.
 
 *Status (2026-08-10) — the two halves have diverged and must not be conflated:*
@@ -377,7 +377,7 @@ human dependency.
   - Verify: `go test ./internal/core/... -run TestRegoCompileErrorIsHardError`
   - Level: L1
 - **REQ-E11-S03-03** — Given judgment call (d), when OPA is added to `go.mod`, then the
-  version is pinned, `govulncheck` and `renovate` cover it, and the binary-size delta is
+  version is pinned, `govulncheck` and Dependabot cover it, and the binary-size delta is
   recorded in the story's notes. **This REQ may not be started before (d) is answered** — it is
   the adoption itself, not a consequence of it.
   - Test: `go.mod`, `go.sum`