refactor(governance): close M15 decision-test residual + L12 least-privilege docs checker (#1230 B2.8)

[SisyphusZheng]

Closes #1230. Refs #1288 (stage), #1155 (umbrella), #1216 (A10.8 M15 origin). Dependencies landed: #1294 (B2.6), #1295 (B2.7). ADR-0144 boundary, ADR-0151 train.

Problem

After B2.6/B2.7 burned down the bespoke generic machinery, three residuals remained on the CI/check/task governance surface:

1. M15 residual: three wired gates still carried pass/fail decision logic with no decision-logic tests — check-repo-hygiene.ts (allow/deny classification: credential-template carve-out, large-binary allowlist, tracked-ignored allowlist, removed-package-mention allowlist), check-static-output-freeze.ts (the normalizers that decide which byte differences are masked before the freeze comparison — precisely "logic that can turn failure into success"), check-visual-baseline-duplicates.ts (hash-grouping verdict).
2. L12 (confirmed at the baseline audit): the audit-citation docs checker ran as deno run -A — ambient authority for a docs check that needs only read + git.
3. No machine-checked integrity guarantee that the gate registry (policy.ts → deno tasks → owning scripts) stays free of duplicate owners.

Owner

One responsibility, one semantic owner after this PR:

Concern	Sole owner	Wired at
Gate registry	tools/autoflow/policy.ts (machine-readable)	integrity asserted by policy.test.ts (every gate → existing task; no two gates share a command)
Tracked-credential filename tripwire + repo residue	check-repo-hygiene.ts	repo:hygiene gate; content-level secrets stay with gitleaks (#1294)
Static-output determinism/freeze	check-static-output-freeze.ts	check:static-output-freeze --self-check gate (ci/release)
Visual-baseline duplicate storage	check-visual-baseline-duplicates.ts	check:visual-baselines gate
Audit citation freshness (docs checker)	check-audit-citations.ts	audit:citations:check task, now --allow-read --allow-run=git (L12)
Release/version truth (check-release-truth.ts: release-state.json consistency + README/STATUS/ROADMAP registry anchors)	release:truth:check gate (new in this PR; thinker review of the initial push confirmed the local-only reachability violated CI-GATING)	ci + release tiers in policy.ts; same command the docs:truth composition runs, which now delegates to the task

Audit findings (what was verified, not assumed)

• No duplicate deno task aliases remain: grouped all 99 task command strings programmatically — zero collisions (B2.7 removed the last one).
• No duplicate gates: the new registry guard initially failed RED on test:e2e:firefox-smoke/test:e2e:webkit-smoke sharing task test:e2e:browser-smoke — inspected: same task, different args (per-browser project), i.e. parameterized distinct concerns, not duplication. The guard now compares the full command vector.
• No redundant workflow jobs/steps: all 8 workflows audited; autoflow-ci jobs (dependency-review / autoflow-ci / node-serve-smoke / workspace-qualification / pr-full-ci-evidence) each own a distinct assertion; generic-toolchain steps are the single OSS owner wiring from refactor(autoflow): shrink policy registry to OE-specific invariants (#1229 B2.7) #1295.
• Scripts checking the same concern: check-strategic-docs.ts, check-public-docs-integrity.ts, claims-registry.ts are libraries imported by check-docs-truth.ts (one owner, seven --check= selector tasks), not parallel checkers. coverage-summary.ts, gate-verdict.ts, stress-gate.ts, benchmark-v044.ts, third-party-wc-smoke.ts are libraries of tested consumers.
• Ungated tools with stated owners (not CI gates, kept): check-audit-citations.ts (manual/evidence, this PR's L12 fix), check-v044-performance.ts + benchmark-v044.ts (manual v0.44 acceptance gate per docs/current/v0.44.0-PERFORMANCE.md), check-v044-legacy-absence.ts (scan logic tested via tools/migration/v044/migration.test.ts).
• Registry decision: NO new registry file/doc added — policy.ts already is the machine-readable registry; a second list would add drift. Instead two guard tests keep the registry referentially intact, and docs/governance/PROJECT_WORKFLOW.md states the ownership rule without duplicating the list (net-reduction rule honored).

CI-GATING follow-up (thinker review of the initial push)

check-release-truth.ts was reachable only via the local docs:truth composition — a release-truth check with no CI wiring. Fixed in this PR: new release:truth:check deno task (least privilege, --allow-read only) + policy gate, tiers ['ci','release'] (matching sibling release:evidence:check), triggers covering docs/release/release-state.json, docs/{status,roadmap,current}/, README*, the starter's deno.json, tools/check-release-truth(.test).ts, tools/project-constants.ts, tools/lib/version.ts, root deno.json. docs:truth now delegates to the task instead of inlining the command (one owner of the invocation).

check-docs-truth.ts full mode — the other half of the composition — is CI-gated piecewise: its full check set [strategic, public, current, www, text, evidence, claims] maps 1:1 onto the gated selector tasks docs:check-strategy, docs:check-public, docs:check-current, www:check-current-truth, text-integrity:check, release:evidence:check, docs:check-claims. No additional gate needed; verified against the docsTruthChecks registry and the policy gate list.

M15 residual resolution (decision-logic tests for every gate that can turn failure into success)

Gate script	Before	After
check-repo-hygiene.ts	no test	check-repo-hygiene.test.ts (6 tests): credential template carve-out is exact (.env.example allowed, .env/.env.production/id_rsa/*.pem fail), large-binary allowlist, root-anchored artifact tripwire, tracked-ignored allowlist, active-scan classification, exact-path mention allowlist
check-static-output-freeze.ts	no test	check-static-output-freeze.test.ts (4 tests): arg parsing (flag-without-value edge), builtAt masking is the only island-manifest difference masked, pagefind canonicalization (hash/language-order/set-order), non-normalized paths byte-untouched, diff verdicts (identical/differs/one-sided)
check-visual-baseline-duplicates.ts	no test	check-visual-baseline-duplicates.test.ts (3 tests): hash grouping, same-size-different-hash is not a duplicate, empty/singleton pass
check-project-workflow.ts, check-workflow-slimming.ts	no test	Not applicable, justified: pure presence/count/anchor assertions with no allowlist or catch-and-pass path; read failure records a failure (fail closed). No failure→success logic exists to test
qualify-workspace-runtime.ts, smoke-www-dev.ts, nitro-proof.ts, third-party-wc-*	no unit test	Not applicable, justified: fail-closed integration runners whose assertions execute in CI (catches re-throw with diagnostics; startup-race catches escalate to non-zero)
generate-ui-token-module.ts --check, generate-openelement-export-files.ts --check	no test	Not applicable, justified: deterministic regenerate-and-compare sync checks; the verdict is byte equality, no decision logic
All other wired gates	tested	unchanged (checkers.test.ts, per-script .test.ts, autoflow suite)

L12 resolution

audit:citations:check: deno run -A → deno run --allow-read --allow-run=git. --allow-run=git is required (archived reports are verified against their archival commit); --allow-write is deliberately absent (the task never passes --write; the write form is documented in the script header for manual use). After this change zero check/governance tasks run with ambient authority; the remaining deno run -A tasks are npm test-runner binaries (playwright/markdownlint/vite) and integration smokes that need broad permissions by nature. Behavior verified identical: same exit code and same output under both permission sets (the 14 pre-existing citation drifts in docs/audit/2026-08-17-deep-repo-scan.md reproduce at origin/dev and are untouched — that report's drift is a content issue, not this packet's scope).

Deletion / surviving-owner table

No scripts, gates, tasks, or jobs were deleted — the audit (above) found zero remaining exact duplicates after #1294/#1295, and the issue explicitly optimizes for one-owner clarity, not fewest tasks. No protection is dropped: every check green before this PR is green after it, with the same or tighter wiring.

Looked duplicated / redundant	Verdict	Surviving owner
docs:truth wrapper vs the 7 granular check-docs-truth gates	kept	only caller of check-release-truth.ts; local composition, not CI-duplicated
www:check-current-truth vs www:check-artifact-truth	kept	source-truth gate vs build-time artifact superset; different trigger surfaces
test:e2e:install vs test:e2e:browsers:install	kept	chromium-only contributor install vs three-engine install for the cross-browser gates
firefox/webkit smoke gates sharing test:e2e:browser-smoke	kept	parameterized distinct concerns (per-engine verdicts); guard now compares full command
docs:check-version-anchors vs check-release-truth anchor sets	kept, ownership recorded	version-string anchors (docs:check-version-anchors gate) / release-state + registry-line anchors (release:truth:check gate, this PR)

Before / After (counts)

Metric	Before	After	Δ
deno.json tasks	99	100	+1 (release:truth:check — the gated invocation the gate and docs:truth now share)
Custom check scripts (tools/check-*.ts)	32	32	0
AutoFlow policy gates	50	51	+1 (release:truth:check — closes the CI-GATING hole; a wiring fix, not new machinery)
Workflow files / CI jobs	8 / unchanged	8 / unchanged	0
Check/governance tasks running with -A ambient authority	1	0	−1 (L12)
Wired gates with untested failure→success decision logic (M15 residual)	3	0	−3
Machine-checked registry invariants	0	2 (gate→task integrity, no-duplicate-command)	+2 guards, no new machinery
Files	—	+3 test files, +6 modified	net governance surface down: one fewer ambient-authority task, zero untested verdict logic

Why-not-second-owner

No second registry/policy document was created: policy.ts + the two guard tests are the registry, and duplicating it into docs would create the drift this stage exists to remove. The PROJECT_WORKFLOW.md addition is a pointer to the owner rule, not a copied list. check-release-truth.ts was not re-wired into CI here: version/release truth gating is B2.9 (#1231) packet scope (M16/M17), and touching it would fork ownership mid-train; it keeps its current single caller (docs:truth) and its test.

Evidence

Local, on this branch (macOS, Deno workspace), exact commands and exit codes:

• RED first: deno test --allow-read tools/check-repo-hygiene.test.ts tools/check-static-output-freeze.test.ts → exit 1 before the refactors (TS2305, 11 missing-export errors); after exporting the decision logic behind import.meta.main → 11 passed, 0 failed.
• RED discovery: the new no-duplicate-command guard initially failed on the parameterized browser-smoke gates (see Audit findings); corrected to compare the full command vector.
• deno test tools/autoflow/__tests__/ → 138 passed, 0 failed (135 → 138: two registry guards + the release-truth gate assertion; RED first — the gate test failed before the gate was added).
• deno task release:truth:check → exit 0; deno task docs:truth → exit 0 via the new task (composition behavior preserved).
• deno task test → exit 0 (1783 passed, 105 steps, 0 failed; starter workspace 150 passed, 0 failed).
• deno task pack:dry-run → exit 0; deno task package-artifacts:check → exit 0 (5 packages).
• deno task check:static-output-freeze --self-check → exit 0 (655 files byte-identical across two builds — exercises the refactored main end-to-end).
• deno task audit:citations:check (least privilege) vs deno run -A ... → identical output and exit code (L12 behavior-preserving).
• deno task check:visual-baselines → exit 0 (236 baselines, 0 duplicates) — exercises the refactored main.
• deno task fmt:check, lint, lint:markdown, typecheck, arch:check, repo:hygiene, workflow:check, workflow:check-slimming, actions:check-pins, docs:truth, text-integrity:check, docs:check-role-neutral, freeze:semantics:check → all exit 0.

Scope

Touched: deno.json (L12 task permissions; new release:truth:check task; docs:truth delegates to it), tools/check-audit-citations.ts (usage header), tools/check-repo-hygiene.ts + new test, tools/check-static-output-freeze.ts + new test, tools/check-visual-baseline-duplicates.ts + new test, tools/autoflow/policy.ts (gate trigger covers the new visual-baseline test file; new release:truth:check gate), tools/autoflow/__tests__/policy.test.ts (two registry guards + release-truth gate tier/command assertion), docs/governance/PROJECT_WORKFLOW.md (ownership pointer). No frozen-semantics paths touched (verified: freeze:semantics:check exit 0); no package source or public API changed; no control-plane files touched.

Risk

• The three refactors are export-and-import.meta.main-guard only; runtime behavior is unchanged and each script's real invocation was exercised after the change (self-check, visual-baselines gate, repo:hygiene gate).
• check-repo-hygiene.ts now stats every tracked file (previously only binary-extension files) — read-only, negligible cost.
• The release:truth:check gate joins ci/release selection; push-tier selection is unchanged (the gate is ci/release-only, matching release:evidence:check).
• Pre-existing, untouched: 14 citation drifts in docs/audit/2026-08-17-deep-repo-scan.md surface when the (ungated) citation checker runs; identical at origin/dev.

[cloudflare-workers-and-pages]

Deploying openelement with    Cloudflare Pages

Latest commit:	0dc9c1e
Status:	✅  Deploy successful!
Preview URL:	https://15012e55.lessjs.pages.dev
Branch Preview URL:	https://fix-1230-b2-8-governance-ded.lessjs.pages.dev

View logs

[github-actions]

APIError: Insufficient Balance

opencode session  |  github run

[github-actions]

APIError: Insufficient Balance

opencode session  |  github run