diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 908d439..e6cb433 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   analyze:
-    name: Analyze Rust
+    name: Analyze
     runs-on: ubuntu-latest
     permissions:
       actions: read
@@ -24,17 +24,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
         with:
-          languages: rust
+          languages: python, typescript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
-        with:
-          category: "/language:rust"
+        uses: github/codeql-action/analyze@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml
index 96d3014..e3dc606 100644
--- a/.github/workflows/trufflehog.yml
+++ b/.github/workflows/trufflehog.yml
@@ -8,7 +8,7 @@ jobs:
   trufflehog:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
       - uses: trufflehog/actions/setup@main
diff --git a/README.md b/README.md
index 5b9aa4b..8c87d34 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,4 @@
+<!-- Work-state: alpha — [######----] 60% — core policy resolve/sync/host-rules green, lint+format debt open, vite CVE to land, CI workflows ubuntu-only -->
 # Policy scope stack for multi-harness AgentOps
 
 This folder contains a concrete policy scope model:
diff --git a/package-lock.json b/package-lock.json
index 9018887..0ddbea3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,5 +1,5 @@
 {
-  "name": "policystack-deps",
+  "name": "PolicyStack",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
@@ -2474,9 +2474,9 @@
       }
     },
     "node_modules/vite": {
-      "version": "6.4.2",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.2.tgz",
-      "integrity": "sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==",
+      "version": "6.4.3",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.3.tgz",
+      "integrity": "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/package.json b/package.json
index 0512252..8faab97 100644
--- a/package.json
+++ b/package.json
@@ -10,6 +10,6 @@
   },
   "overrides": {
     "esbuild": "^0.25.0",
-    "vite": "^6.4.2"
+    "vite": "^6.4.3"
   }
 }
diff --git a/pyproject.toml b/pyproject.toml
index 20d84e7..b0fdd4f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,6 +7,11 @@ name = "policy-federation"
 version = "0.1.0"
 description = "Agent policy federation"
 
+[tool.setuptools.packages.find]
+where = ["."]
+include = []
+namespaces = false
+
 [tool.ruff]
 line-length = 88
 target-version = "py310"
diff --git a/uv.lock b/uv.lock
new file mode 100644
index 0000000..3b7eeb4
--- /dev/null
+++ b/uv.lock
@@ -0,0 +1,8 @@
+version = 1
+revision = 3
+requires-python = ">=3.12"
+
+[[package]]
+name = "policy-federation"
+version = "0.1.0"
+source = { editable = "." }