feat(guards): resolve gate expressions, scope dead-output to its workflow (#341, #342)

.github/workflows/deploy-docs.yml

@@ -48,10 +48,6 @@ jobs:
         run: npm run build:site
       - name: Fail if committed pages drifted from the source
         run: git diff --exit-code -- site
-      - name: Check site links and anchors
-        run: npm run check:site
-      - name: Check SVG diagram layout
-        run: npm run check:svg
 
   deploy:
     name: Deploy to GitHub Pages

AGENTS.md

@@ -106,7 +106,7 @@ Host auth is normally **keyring + SSH** (`gh` logged in as the active user; `ori
 <!-- gitnexus:start -->
 # GitNexus — Code Intelligence
 
-This project is indexed by GitNexus as **workflow-server** (10790 symbols, 14448 relationships, 271 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.
+This project is indexed by GitNexus as **workflow-server** (13503 symbols, 18236 relationships, 294 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.
 
 > If any GitNexus tool warns the index is stale, run `npx gitnexus analyze` in terminal first.
 

CLAUDE.md

@@ -106,7 +106,7 @@ Host auth is normally **keyring + SSH** (`gh` logged in as the active user; `ori
 <!-- gitnexus:start -->
 # GitNexus — Code Intelligence
 
-This project is indexed by GitNexus as **workflow-server** (10790 symbols, 14448 relationships, 271 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.
+This project is indexed by GitNexus as **workflow-server** (13503 symbols, 18236 relationships, 294 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.
 
 > If any GitNexus tool warns the index is stale, run `npx gitnexus analyze` in terminal first.
 

package.json

@@ -11,6 +11,7 @@
     "build:site": "tsx scripts/generate-site-data.ts",
     "check:site": "tsx scripts/check-site-links.ts",
     "check:svg": "tsx scripts/check-svg-layout.ts",
+    "check:encoding": "tsx scripts/check-source-encoding.ts",
     "start": "node dist/index.js",
     "start:http": "node dist/index.js --transport=http",
     "dev": "tsx src/index.ts",

scripts/binding-fidelity-triage.json

@@ -1,6 +1,6 @@
 {
   "note": "One-time triage of the binding-fidelity findings the retired baseline had suppressed (issue #327 R3). Every finding carries a verdict and a named rationale, so \"harmless\" and \"live bug\" are no longer the same silence. harmless = correct by design, suppressed. fix-later = real debt, suppressed but counted. live-bug = REPORTED, so the guard stays red until it is fixed. A finding absent from this file is untriaged and reported; an entry that matches nothing is stale and reported. There is no regenerate flag \u2014 an entry is a human judgement, which is exactly what the baseline never required. The triage also found and FIXED three live defects, so they appear here as history rather than as entries: work-package auto-created GitHub/Jira issues in a headless review run (two review-reachable checkpoints with a create default); substrate-node-security-audit required user_request without declaring it; and the stealth push path computed push_remote_verified and commits_signed without gating on either.",
-  "corpusSha": "7a57d3c1b33cfabd3cb5e205d2f7d80ea853c20f",
+  "corpusSha": "6bc46faf346b9ac18ac9922a96ad7feff6201d4c",
   "rationales": {
     "shared-op-return-contract": "A shared meta operation declares what it returns. Library ops are bound ad hoc by any workflow, so having no consumer inside the corpus is the expected state of a library, not a broken seam; the caller that binds the op consumes the value in its own context.",
     "shared-op-caller-argument": "A shared meta operation input that the binding step supplies as a deviation when it needs a non-default value. No workflow-level producer is expected: callers that need it bind it, and callers that do not take the op default path.",
@@ -1169,6 +1169,223 @@
       "detail": "own input 'issue_details' has no producer in workflow 'work-package' (no step-binding entry, workflow variable, step output, or default)",
       "verdict": "fix-later",
       "rationale": "test-fixture-pins-the-defect"
+    },
+    {
+      "check": "read-resolution",
+      "site": "meta/activities/03-dispatch-client-workflow.yaml[present-yielded-checkpoint]",
+      "detail": "gate expression reads 'worker_yielded_checkpoint', which has no producer (declared id / workflow var / set-target)",
+      "verdict": "fix-later",
+      "rationale": "undeclared-seed"
+    },
+    {
+      "check": "read-resolution",
+      "site": "meta/activities/03-dispatch-client-workflow.yaml[respond-yielded-checkpoint]",
+      "detail": "gate expression reads 'worker_yielded_checkpoint', which has no producer (declared id / workflow var / set-target)",
+      "verdict": "fix-later",
+      "rationale": "undeclared-seed"
+    },
+    {
+      "check": "read-resolution",
+      "site": "meta/activities/03-dispatch-client-workflow.yaml[commit-activity-artifacts]",
+      "detail": "gate expression reads 'worker_yielded_checkpoint', which has no producer (declared id / workflow var / set-target)",
+      "verdict": "fix-later",
+      "rationale": "undeclared-seed"
+    },
+    {
+      "check": "read-resolution",
+      "site": "meta/activities/03-dispatch-client-workflow.yaml[advance-activity]",
+      "detail": "gate expression reads 'worker_yielded_checkpoint', which has no producer (declared id / workflow var / set-target)",
+      "verdict": "fix-later",
+      "rationale": "undeclared-seed"
+    },
+    {
+      "check": "read-resolution",
+      "site": "work-package/activities/01-start-work-package.yaml[verify-jira-issue]",
+      "detail": "gate expression reads 'jira_cloud_id', which has no producer (declared id / workflow var / set-target)",
+      "verdict": "fix-later",
+      "rationale": "undeclared-seed"
+    },
+    {
+      "check": "read-resolution",
+      "site": "work-package/activities/09-lean-coding-audit.yaml[validate-safety-floor]",
+      "detail": "gate expression reads 'safety_floor', which has no producer (declared id / workflow var / set-target)",
+      "verdict": "fix-later",
+      "rationale": "undeclared-seed"
+    },
+    {
+      "check": "read-resolution",
+      "site": "work-packages/activities/01-scope-assessment.yaml[verify-preconditions]",
+      "detail": "gate expression reads 'agents_md_read', which has no producer (declared id / workflow var / set-target)",
+      "verdict": "fix-later",
+      "rationale": "undeclared-seed"
+    },
+    {
+      "check": "dead-output",
+      "site": "cicd-pipeline-security-audit/techniques/execute-sub-agent.md",
+      "detail": "output 'sub_agent_output' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "midnight-system-review/techniques/verdict-and-report/render-review.md",
+      "detail": "output 'review_summary' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "prism-audit/techniques/execute-analysis/compose-trigger-context.md",
+      "detail": "output 'target' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "prism-audit/techniques/execute-analysis/compose-trigger-context.md",
+      "detail": "output 'target_description' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "prism-audit/techniques/execute-analysis/compose-trigger-context.md",
+      "detail": "output 'analysis_focus' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "prism-audit/techniques/scope-definition/summarize-scope.md",
+      "detail": "output 'scope_summary' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "prism-evaluate/techniques/plan-evaluation/summarize-scope.md",
+      "detail": "output 'scope_summary' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "prism-update/techniques/verify-prism-consistency.md",
+      "detail": "output 'verification_report' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "substrate-node-security-audit/techniques/execute-sub-agent.md",
+      "detail": "output 'sub_agent_output' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "substrate-node-security-audit/techniques/score-severity.md",
+      "detail": "output 'scored_findings' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "work-package/techniques/repo-root-resolution.md",
+      "detail": "output 'component_path' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-authoring/techniques/workflow-definition/compose-publication.md",
+      "detail": "output 'paths' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-authoring/techniques/workflow-definition/compose-publication.md",
+      "detail": "output 'commit_message' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-authoring/techniques/workflow-definition/compose-publication.md",
+      "detail": "output 'title' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-authoring/techniques/workflow-definition/compose-publication.md",
+      "detail": "output 'body' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-authoring/techniques/workflow-definition/derive-workflows-target-path.md",
+      "detail": "output 'host_repo_path' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-authoring/techniques/workflow-definition/intake-classification.md",
+      "detail": "output 'headless_mode' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-design/techniques/TECHNIQUE.md",
+      "detail": "output 'workflow_files' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-design/techniques/apply-audit-fixes.md",
+      "detail": "output 'fixes_applied' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-design/techniques/publish-workflow-pr.md",
+      "detail": "output 'title' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-design/techniques/publish-workflow-pr.md",
+      "detail": "output 'body' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-design/techniques/reconcile-design-assumptions.md",
+      "detail": "output 'open_assumptions' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-design/techniques/verify-artifact-conforms.md",
+      "detail": "output 'artifact_conformance' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
+    },
+    {
+      "check": "dead-output",
+      "site": "workflow-design/techniques/yaml-authoring.md",
+      "detail": "output 'yaml_file' is declared but nothing outside its own file consumes it (no read, condition, binding value, remap, or same-named input)",
+      "verdict": "fix-later",
+      "rationale": "terminal-product-unconsumed"
     }
   ]
 }