stylegallery 0.1.0

package/scripts/governance-test-fixture.mjs

@@ -0,0 +1,321 @@
+import { sentinelProvenanceClauses } from "./governance-policy-contract.mjs";
+
+export const generatedWarning = "<!-- Generated from `scripts/generate-patterns.mjs` and `scripts/pattern-data.mjs`. Do not hand-edit generated catalog or pattern docs; edit the source files and regenerate. -->";
+export { sentinelProvenanceClauses };
+
+export const files = {
+  "AGENTS.md": "# Agent Instructions\n\nSee [Governance, Lifecycle, And Docs-As-Code](GOVERNANCE.md) and [StyleGallery Domains](DOMAINS.md).\n",
+  "README.md": "# StyleGallery\n\n- [Governance, Lifecycle, And Docs-As-Code](GOVERNANCE.md)\n- [StyleGallery Domains](DOMAINS.md)\n",
+  "index.md": "# StyleGallery\n\n- [Governance, lifecycle, and docs-as-code](GOVERNANCE.md)\n- [StyleGallery Domains](DOMAINS.md)\n",
+  "DOMAINS.md": "# StyleGallery Domains\n\n### Consumer Reference Promotion\n\nPromotion records are JSON-only.\n",
+  "consumer-reference/contract.md": `They are not accepted or promoted RFCs.\nReview truth uses one enum; boolean aliases are invalid.\n${sentinelProvenanceClauses.join("\n")}\n`,
+  "consumer-reference/index.md": "[Promotion RFC schema](schema/promotion-rfc.schema.json)\n[Shared-experimental promotion policy](policies/shared-experimental.json)\n",
+  "consumer-reference/fixtures/promotion/manifest.json": '{"id": "promotion-fixture-inventory"}\n',
+  "consumer-reference/policies/shared-experimental.json": '{"review_independence": "single_account", "promotion_occurred": false, "adopter_attestations": 0, "stable_numeric_threshold": null}\n',
+  "CATALOG.md": `# Layout Pattern Catalog\n\n${generatedWarning}\n`,
+  "patterns/index.md": `# Pattern Categories\n\n${generatedWarning}\n`,
+  "patterns/stacking/index.md": `# Stacking\n\n${generatedWarning}\n`,
+  "patterns/stacking/stack.md": [
+    "---",
+    "lifecycle: generated",
+    "generated_from: scripts/generate-patterns.mjs, scripts/pattern-data.mjs",
+    "---",
+    "",
+    "# stack",
+    "",
+    generatedWarning,
+    "",
+  ].join("\n"),
+  "quality/evidence/executable-evidence.md": [
+    "| Claim | Validator or test | CI command | Positive evidence | Negative evidence | Evidence boundary |",
+    "| Governance, lifecycle, generated-file, ownership, and stale-content policy remain discoverable and CI-enforced. | `scripts/validate-governance.mjs` and `scripts/test-validate-governance.mjs` | `node scripts/validate-governance.mjs --json`; `node scripts/test-validate-governance.mjs --json` | `GOVERNANCE.md`, `.github/CODEOWNERS`, generated warnings, generated metadata, root links, lifecycle states, stale-audit decision, and CI wiring are present. | Missing governance file, generated warning, generated metadata, CODEOWNERS coverage, or stale policy fixtures must fail. | Proves governance policy is present and linked, not that CODEOWNERS users have verified repository write access. |",
+    "| Domain topology, metadata, provenance, scope boundaries, and root routes remain enforced. | `scripts/validate-domains.mjs` and `scripts/test-validate-domains.mjs` | `node scripts/validate-domains.mjs --json`; `node scripts/test-validate-domains.mjs` | Five governed domains and their declared leaves are reachable and attributed. | Domain metadata, immutable provenance, scope boundaries, and root-route fixtures must fail. | A full SHA proves content identity syntax, not publisher authenticity or local quality. |",
+    "Consumer-reference handoffs, schema/runtime parity, and containment remain enforced; repository handoff omissions must fail.",
+    "Promotion governance remains a closed JSON-only, invariant-scoped, deferred example contract.",
+    "Synthetic validation does not authenticate adoption, organizations, owners, support capacity, provenance, or a promotion decision.",
+    "The proposed Chromium sentinel preserves canonical card-grid geometry and truth-derived calibration evidence.",
+    "Governed-local button states retain source-bound visual, DOM, and accessibility-tree evidence across both example profiles.",
+    "one clean capture session binds the browser artifacts to the governed source inventory",
+    "It does not prove product suitability, independent adoption, full accessibility, cross-browser behavior, or owner approval",
+    "Explicit evidence deadlines are audited weekly without inventing a repository-wide maximum age.",
+    "Malformed records and auditor failures remain blocking even though due-date findings are advisory.",
+    "Linux/amd64 20-run calibration and `baseline_owner_approval` remain pending.",
+    ...sentinelProvenanceClauses,
+    "",
+  ].join("\n"),
+  ".github/CODEOWNERS": [
+    "* @changeroa",
+    "/GOVERNANCE.md @changeroa",
+    "/README.md @changeroa",
+    "/index.md @changeroa",
+    "/AGENTS.md @changeroa",
+    "/DOMAINS.md @changeroa",
+    "/GUIDE.md @changeroa",
+    "/guides/ @changeroa",
+    "/recipes/ @changeroa",
+    "/quality/ @changeroa",
+    "/layout/ @changeroa",
+    "/motion/ @changeroa",
+    "/design-engineering/ @changeroa",
+    "/game-ui/ @changeroa",
+    "/platform-guides/ @changeroa",
+    "/consumer-reference/ @changeroa",
+    "/consumer-reference/baselines/ @changeroa",
+    "/consumer-reference/policies/ @changeroa",
+    "/consumer-reference/fixtures/promotion/ @changeroa",
+    "/consumer-reference/schema/promotion-rfc.schema.json @changeroa",
+    "/tests/ @changeroa",
+    "/playwright.config.mjs @changeroa",
+    "/scripts/pattern-data.mjs @changeroa",
+    "/scripts/generate-patterns.mjs @changeroa",
+    "/patterns/ @changeroa",
+    "/CATALOG.md @changeroa",
+    "/.github/workflows/validate.yml @changeroa",
+    "/.github/ @changeroa",
+    "/scripts/ @changeroa",
+    "/scripts/validate-*.mjs @changeroa",
+    "/scripts/test-validate-*.mjs @changeroa",
+    "",
+  ].join("\n"),
+  ".github/workflows/validate.yml": [
+    "jobs:",
+    "  validate:",
+    "    steps:",
+    "      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4",
+    "        with:",
+    "          persist-credentials: false",
+    "      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4",
+    "      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4",
+    "      - run: |",
+    "node -c scripts/component-state-workflow-contract.mjs",
+    "node -c scripts/consumer-evidence-governance-contract.mjs",
+    "node -c scripts/promotion-fixture-inventory.mjs",
+    "node -c scripts/promotion-boundary-test-contract.mjs",
+    "node -c scripts/validate-governance.mjs",
+    "node -c scripts/test-validate-governance.mjs",
+    "node scripts/validate-governance.mjs --json",
+    "node scripts/test-validate-governance.mjs --json",
+    "node -c scripts/validate-domains.mjs",
+    "node -c scripts/test-validate-domains.mjs",
+    "node scripts/validate-domains.mjs --json",
+    "node scripts/test-validate-domains.mjs",
+    "node scripts/validate-webpage-workflow.mjs --json",
+    "node scripts/test-validate-webpage-workflow.mjs --json",
+    "node -c scripts/validate-consumer-reference.mjs",
+    "node -c scripts/test-validate-consumer-reference.mjs",
+    "node -c scripts/consumer-reference-case-runner.mjs",
+    "node -c scripts/governed-profile-registry.mjs",
+    "node -c scripts/promotion-attestation-contract.mjs",
+    "node -c scripts/validate-promotion-rfc.mjs",
+    "node -c scripts/test-validate-promotion-rfc.mjs",
+    "node -c scripts/json-schema-formats.mjs",
+    "node -c scripts/consumer-conformance-contract.mjs",
+    "node -c scripts/validate-consumer-conformance.mjs",
+    "node -c scripts/test-validate-consumer-conformance.mjs",
+    "node -c consumer-reference/fixtures/consumer-conformance/e2e-fixture.mjs",
+    "node -c scripts/page-evidence-contract.mjs",
+    "node -c scripts/page-evidence-fixture.mjs",
+    "node -c scripts/create-page-evidence-session.mjs",
+    "node -c scripts/finalize-page-evidence.mjs",
+    "node -c scripts/validate-page-evidence.mjs",
+    "node -c scripts/test-validate-page-evidence.mjs",
+    "node -c scripts/audit-evidence-freshness.mjs",
+    "node -c scripts/test-audit-evidence-freshness.mjs",
+    "node -c tests/fixtures/consumer-conformance-scenarios.mjs",
+    "node -c tests/helpers/render-consumer-conformance.mjs",
+    "node -c tests/consumer-conformance.spec.mjs",
+    "node -c scripts/test-consumer-conformance-sentinel.mjs",
+    "node scripts/validate-consumer-reference.mjs --json",
+    "node scripts/test-validate-consumer-reference.mjs --json",
+    "node scripts/validate-promotion-rfc.mjs --json",
+    "node scripts/test-validate-promotion-rfc.mjs --json",
+    "node scripts/test-validate-consumer-conformance.mjs --case valid-runtime-proof --json",
+    "node scripts/test-validate-consumer-conformance.mjs --json",
+    "node scripts/test-validate-page-evidence.mjs --json",
+    "node scripts/test-audit-evidence-freshness.mjs --json",
+    `node -e 'JSON.parse(require("fs").readFileSync("consumer-reference/schema/consumer-conformance-record.schema.json"))'`,
+    `node -e 'JSON.parse(require("fs").readFileSync("consumer-reference/schema/page-evidence-session.schema.json"))'`,
+    `node -e 'JSON.parse(require("fs").readFileSync("consumer-reference/schema/page-evidence-manifest.schema.json"))'`,
+    "consumer-reference/schema/promotion-rfc.schema.json",
+    "consumer-reference/policies/shared-experimental.json",
+    "node scripts/test-consumer-reference-sentinel.mjs",
+    "node -c scripts/baseline-schema-parity.mjs",
+    "node -c scripts/test-component-state-source-contract.mjs",
+    "node scripts/test-component-state-source-contract.mjs",
+    "consumer-reference/schema/visual-evidence.schema.json",
+    "  component-state-evidence:",
+    "    env:",
+    "      STATE_EVIDENCE_ROOT: .tmp/consumer-reference-state",
+    "      SENTINEL_CONTAINER_IMAGE: mcr.microsoft.com/playwright:v1.61.0-noble@sha256:57b65fdc9ceabe0ef613124c7bbe2babcf9362c4d85e382fe3b03604e84b428a",
+    "    container:",
+    "      image: mcr.microsoft.com/playwright:v1.61.0-noble@sha256:57b65fdc9ceabe0ef613124c7bbe2babcf9362c4d85e382fe3b03604e84b428a",
+    "    steps:",
+    "      - name: Run artifact harness",
+    "        run: node scripts/test-validate-component-state-artifacts.mjs",
+    "      - name: Capture evidence",
+    "        run: |",
+    "          node scripts/create-component-state-session.mjs \\",
+    "            --output \"$STATE_EVIDENCE_ROOT/capture-session.json\" \\",
+    "            --json",
+    "          STATE_ARTIFACT_DIR=\"$STATE_EVIDENCE_ROOT/runtime\" \\",
+    "            STATE_SESSION_RECEIPT=\"$STATE_EVIDENCE_ROOT/capture-session.json\" \\",
+    "            npm run test:component-state:runtime -- --reporter=line",
+    "          node scripts/finalize-component-state-evidence.mjs \\",
+    "            --artifact-root \"$STATE_EVIDENCE_ROOT\" \\",
+    "            --output \"$STATE_EVIDENCE_ROOT/runtime-manifest.json\" \\",
+    "            --json",
+    "          node scripts/validate-component-state.mjs \\",
+    "            --artifact-root \"$STATE_EVIDENCE_ROOT\" \\",
+    "            --runtime-manifest \"$STATE_EVIDENCE_ROOT/runtime-manifest.json\" \\",
+    "            --json",
+    "      - name: Upload evidence",
+    "        with:",
+    "          path: ${{ env.STATE_EVIDENCE_ROOT }}/",
+    "  chromium-sentinel:",
+    "    steps:",
+    "      - run: node scripts/test-consumer-reference-sentinel.mjs",
+    "  chromium-calibration:",
+    "  consumer-conformance:",
+    "    name: Consumer conformance Chromium matrix",
+    "    container:",
+    "      image: mcr.microsoft.com/playwright:v1.61.0-noble@sha256:57b65fdc9ceabe0ef613124c7bbe2babcf9362c4d85e382fe3b03604e84b428a",
+    "    steps:",
+    "      - run: npx playwright test tests/consumer-conformance.spec.mjs --project=chromium --reporter=line",
+    "      - run: node scripts/test-consumer-conformance-sentinel.mjs --json",
+    "  consumer-page-evidence:",
+    "    name: Consumer page-evidence raster capture (nonblocking)",
+    "    continue-on-error: true",
+    "    env:",
+    "      CONSUMER_CONFORMANCE_CAPTURE_DIR: .tmp/consumer-page-evidence",
+    "    steps:",
+    "      - run: node scripts/create-page-evidence-session.mjs --json",
+    "      - run: npx playwright test tests/consumer-conformance.spec.mjs --project=chromium --reporter=line",
+    "      - run: node scripts/finalize-page-evidence.mjs --json",
+    "      - run: node scripts/validate-page-evidence.mjs --json",
+    "      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4",
+    "        with:",
+    "          name: consumer-page-evidence-${{ github.run_id }}-${{ github.sha }}",
+    "          retention-days: 14",
+    "node scripts/validate-baseline-manifest.mjs --json",
+    "node scripts/test-validate-baseline-manifest.mjs --json",
+    "node scripts/test-summarize-sentinel-calibration.mjs",
+    "node scripts/validate-renderer-purity.mjs --json",
+    "checkout_sha=\"$(git -c safe.directory=\"$GITHUB_WORKSPACE\" rev-parse HEAD)\"",
+    "--repository \"changeroa/StyleGallery\" \\",
+    "--execution-repository \"$GITHUB_REPOSITORY\" \\",
+    "\"repository\":\"%s\",\"execution_repository\":\"%s\"",
+    "\"changeroa/StyleGallery\" \"$GITHUB_REPOSITORY\" \"$GITHUB_RUN_ID\"",
+    "permissions:",
+    "  contents: read",
+    "",
+  ].map((line, index, lines) => {
+    const commandStart = lines.indexOf("node -c scripts/component-state-workflow-contract.mjs");
+    const commandEnd = lines.indexOf("consumer-reference/policies/shared-experimental.json");
+    return index >= commandStart && index <= commandEnd ? `        ${line}` : line;
+  }).join("\n"),
+  ".github/workflows/evidence-freshness.yml": [
+    "name: Audit explicit evidence deadlines",
+    "on:",
+    "  workflow_dispatch:",
+    "  schedule:",
+    "    - cron: '0 5 * * 1'",
+    "permissions:",
+    "  contents: read",
+    "jobs:",
+    "  evidence-freshness:",
+    "    runs-on: ubuntu-latest",
+    "    steps:",
+    "      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4",
+    "        with:",
+    "          persist-credentials: false",
+    "      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4",
+    "      - run: npm ci --ignore-scripts --no-audit --no-fund",
+    "      - run: |",
+    "          node scripts/audit-evidence-freshness.mjs --record consumer-reference/baselines/calibration.json --as-of \"$as_of\" --mode advisory --json > evidence-freshness-report.json",
+    "          console.log(`::warning file=${warning.source_path}::${warning.code}: ${warning.message}`);",
+    "      - if: always()",
+    "        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4",
+    "        with:",
+    "          name: evidence-freshness-${{ github.run_id }}",
+    "          path: evidence-freshness-report.json",
+    "          retention-days: 14",
+    "",
+  ].join("\n"),
+  "GOVERNANCE.md": [
+    "---",
+    "scheduled_stale_audit: deferred",
+    "scheduled_evidence_audit: active_advisory",
+    "---",
+    "",
+    "# Governance, Lifecycle, And Docs-As-Code",
+    "",
+    "| Doc family | Source of truth | Generator | Generated artifacts | Lifecycle state | Stale trigger | Validator | Review owner |",
+    "| Root repository guide | `README.md` | Manual | None | `stable` | Source-of-truth route changes, broken root links, or ownership changes. | `scripts/validate-okf.mjs` | Repository governance owner |",
+    "| OKF bundle map | `index.md` | Manual | None | `scripts/validate-okf.mjs` | Repository governance owner |",
+    "| Agent editing rules | `AGENTS.md` | Manual | None | `scripts/validate-links.mjs` | Repository governance owner |",
+    "| Planning guides | `GUIDE.md`, `guides/*.md` | Manual | None | `scripts/validate-okf.mjs` | Planning-doc owner |",
+    "| Layout recipes | `recipes/*.md` | Manual | None | `scripts/validate-okf.mjs` | Recipe owner |",
+    "| Quality gates and evidence | `quality/**/*.md` | Manual | None | `scripts/validate-okf.mjs` | Quality owner |",
+    "| Consumer reference contract | `consumer-reference/contract.md` | Manual | None | `stable` | Receiver changes. | `scripts/validate-consumer-reference.mjs` | Validation owner |",
+    "| Governed local reference profiles | `design-engineering/reference-profiles/governed-local/editorial/profile.json`, `design-engineering/reference-profiles/governed-local/editorial/tokens.dtcg.json`, `design-engineering/reference-profiles/governed-local/editorial/local-foundations.json`, `design-engineering/reference-profiles/governed-local/terminal/profile.json`, `design-engineering/reference-profiles/governed-local/terminal/tokens.dtcg.json`, `design-engineering/reference-profiles/governed-local/terminal/local-foundations.json` | Manual | None | `experimental`, `example_only`, non-default related fixtures | Profile source changes. | `scripts/validate-consumer-reference.mjs` | Validation owner |",
+    "| Component-state evidence matrices | Each profile's declared `components/*.component.json`, `states/*.states.json`, `fixtures/*.fixture.json`, and `evidence/*.evidence.json` records | `scripts/generate-consumer-reference-evidence.mjs` | `design-engineering/reference-profiles/governed-local/editorial/generated/state-matrix.md`, `design-engineering/reference-profiles/governed-local/editorial/generated/keyboard-matrix.md`, `design-engineering/reference-profiles/governed-local/editorial/generated/evidence-coverage.md`, `design-engineering/reference-profiles/governed-local/terminal/generated/state-matrix.md`, `design-engineering/reference-profiles/governed-local/terminal/generated/keyboard-matrix.md`, `design-engineering/reference-profiles/governed-local/terminal/generated/evidence-coverage.md` | `generated` | Source or generator changes. | `scripts/validate-component-state.mjs` | Validation owner |",
+    "| Consumer migration conformance | `consumer-reference/schema/consumer-conformance-record.schema.json`, `design-engineering/consumer-migration-readiness.md` | Manual | Consumer-owned conformance records | `experimental` method | Method, dimension, scenario, mapping, or ownership changes. | `scripts/validate-consumer-conformance.mjs`, `scripts/test-validate-consumer-conformance.mjs` | Design Engineering owner with Validation owner |",
+    "| Consumer page-evidence lifecycle | `consumer-reference/schema/page-evidence-session.schema.json`, `consumer-reference/schema/page-evidence-manifest.schema.json` | Browser/session tooling | Consumer-owned session, runner, manifest, and raster artifacts | `experimental` evidence protocol | Source, revision, session, run, scenario, review deadline, or artifact integrity changes. | `scripts/test-validate-page-evidence.mjs`, deterministic Chromium consumer-conformance job | Validation owner with consumer owner |",
+    "| Explicit evidence freshness schedule | Evidence records that declare `expires_at` or `review_by` | `.github/workflows/evidence-freshness.yml` | Advisory JSON audit artifact | `stable` narrow schedule | Explicit deadline, auditor, schedule, or inventory changes. | `scripts/audit-evidence-freshness.mjs`, `scripts/test-audit-evidence-freshness.mjs` | Validation owner |",
+    "| Deterministic consumer browser conformance | `tests/consumer-conformance.spec.mjs`, `tests/fixtures/consumer-conformance-scenarios.mjs`, `tests/helpers/render-consumer-conformance.mjs` | Playwright `1.61.0` in the digest-pinned `linux/amd64` image | Optional page-evidence raster artifact | `experimental` contract with blocking semantic gate and nonblocking raster capture | Viewport, container, content, state, overlay, page-scale, focus, overflow, contrast, semantics, or runtime-error changes. | Playwright matrix and `scripts/test-consumer-conformance-sentinel.mjs` | Validation owner with Design Engineering owner |",
+    "| Shared promotion policy | Promotion policy | Manual | None | stable | Policy changes. | promotion validator | Validation owner |",
+    "| Proposed Chromium sentinel | `tests/helpers/render-consumer-reference.mjs`, `consumer-reference/schema/calibration-record.schema.json`, `consumer-reference/baselines/*.json` | Playwright | Snapshot and raw calibration evidence | `experimental` | Renderer or baseline changes. | `scripts/validate-baseline-manifest.mjs` | Validation owner |",
+    "| Domain manifest and scope decision | `DOMAINS.md`, `quality/claim-records/stylegallery-multidomain-scope.md` | Manual | None | `stable` | Domain membership, repository-scope, or provenance-policy changes. | `scripts/validate-domains.mjs`, `scripts/validate-governance.mjs` | Repository governance owner |",
+    "| Layout domain hub | `layout/index.md` | Manual | None | `stable` | Layout route or ownership changes. | `scripts/validate-domains.mjs`, `scripts/validate-ia.mjs` | Pattern-data owner |",
+    "| Motion domain guidance | `motion/*.md` | Manual | None | `experimental` | Upstream revision, evidence boundary, or guidance changes. | `scripts/validate-domains.mjs` | Motion domain owner |",
+    "| Design Engineering domain guidance | `design-engineering/*.md` | Manual | None | `experimental` | Upstream revision, evidence boundary, or guidance changes. | `scripts/validate-domains.mjs` | Design Engineering domain owner |",
+    "| Game UI domain guidance | `game-ui/**/*.md` | Manual | None | `experimental` | Classification, hierarchy, engine implementation, evidence boundary, or route changes. | `scripts/validate-domains.mjs` | Game UI domain owner |",
+    "| Platform Guides domain guidance | `platform-guides/*.md` | Manual | None | `experimental` | Platform version, upstream revision, evidence boundary, or guidance changes. | `scripts/validate-domains.mjs` | Platform Guides domain owner |",
+    "| Pattern data and examples | `scripts/pattern-data.mjs` | Manual data source | `patterns/**/*.md` | `generated` output from `stable` source | Source-lineage URL changes, generated drift, category changes, or pattern count changes. | `scripts/validate-patterns.mjs`, `scripts/validate-catalog.mjs`, `scripts/validate-governance.mjs` | Pattern-data owner |",
+    "| Pattern generator | `scripts/generate-patterns.mjs` | Manual code source | `patterns/**/*.md` | `stable` generator, `generated` output | Generated structure changes, generated-warning changes, or generated metadata changes. | `node -c scripts/generate-patterns.mjs` | Pattern-data owner |",
+    "| Validation scripts | `scripts/validate-*.mjs`, `scripts/test-validate-*.mjs` | Manual code source | CI validation output | `node -c` | Validation owner |",
+    "| CI workflow | `.github/workflows/validate.yml` | Manual | GitHub Actions run | GitHub Actions | Repository governance owner |",
+    "",
+    "## Generated Artifact Policy",
+    "Do not hand-edit generated artifacts.",
+    "`scripts/pattern-data.mjs`",
+    "`scripts/generate-patterns.mjs`",
+    "`scripts/generate-consumer-reference-evidence.mjs`",
+    "Browser state evidence begins with `scripts/create-component-state-session.mjs`",
+    "Receipt creation rejects dirty relevant sources.",
+    "browser-authored visual sidecars bind the same session, scenario, capture time, source digest, PNG bytes, dimensions, and hash",
+    "exactly 30 channel passes over the closed 40-file runtime set",
+    "Validation uses the receipt and completed manifest interval, not a wall-clock maximum age",
+    "design-engineering/reference-profiles/governed-local/editorial/generated/state-matrix.md",
+    "design-engineering/reference-profiles/governed-local/editorial/generated/keyboard-matrix.md",
+    "design-engineering/reference-profiles/governed-local/editorial/generated/evidence-coverage.md",
+    "design-engineering/reference-profiles/governed-local/terminal/generated/state-matrix.md",
+    "design-engineering/reference-profiles/governed-local/terminal/generated/keyboard-matrix.md",
+    "design-engineering/reference-profiles/governed-local/terminal/generated/evidence-coverage.md",
+    "",
+    "## Lifecycle States",
+    "`draft` `stable` `deprecated` `experimental` `generated`",
+    "",
+    "## Review Ownership",
+    "CODEOWNERS",
+    "owner.enforcement: \"placeholder\"",
+    "review_independence: \"single_account\"",
+    "The StyleGallery-local `>=2` independent-consumer gateway applies only to consumer-local → shared-experimental invariant eligibility.",
+    "Shared stable has no numeric adoption threshold.",
+    "Normative correctness may waive adoption count only.",
+    "Synthetic examples have zero durable adopter attestations and record no promotion.",
+    "A stable contract must never be silently relabeled shared-experimental.",
+    "",
+    "## Staleness Control",
+    "Decision: run a weekly advisory audit only for evidence records that already declare `expires_at` or `review_by`.",
+    "No repository-wide maximum age or inferred time-to-live applies.",
+    "Malformed records and auditor failures remain blocking even though due-date findings are advisory.",
+    ".github/workflows/evidence-freshness.yml",
+    "Monday at 05:00 UTC",
+    "Audit trigger:",
+    "node scripts/validate-links.mjs --json",
+    "node scripts/test-consumer-reference-sentinel.mjs",
+    ...sentinelProvenanceClauses,
+    "",
+  ].join("\n"),
+};

package/scripts/governance-workflow-negative-cases.mjs

@@ -0,0 +1,241 @@
+export function workflowSafetyCases(workflow) {
+  return [
+    {
+      name: "floating_action_ref",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4", "uses: actions/checkout@v4") },
+      expect: ".github/workflows/validate.yml: floating or unlabeled action ref uses: actions/checkout@v4",
+    },
+    {
+      name: "checkout_credentials_persisted",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("          persist-credentials: false\n", "") },
+      expect: ".github/workflows/validate.yml: every actions/checkout step must set persist-credentials: false",
+    },
+    {
+      name: "mixed_case_checkout_credentials_missing",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "      - uses: Actions/Checkout@34e114876b0b11c390a56381ad16ebd13914f8d5\n      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4") },
+      expect: ".github/workflows/validate.yml: every actions/checkout step must set persist-credentials: false",
+    },
+    {
+      name: "mixed_case_checkout_credentials_true",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "      - uses: Actions/Checkout@34e114876b0b11c390a56381ad16ebd13914f8d5\n        with:\n          persist-credentials: true\n      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4") },
+      expect: ".github/workflows/validate.yml: every actions/checkout step must set persist-credentials: false",
+    },
+    {
+      name: "mixed_case_checkout_credentials_false",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "      - uses: Actions/Checkout@34e114876b0b11c390a56381ad16ebd13914f8d5\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4") },
+    },
+    {
+      name: "third_party_floating_action_ref",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "uses: attacker/action@main") },
+      expect: ".github/workflows/validate.yml: floating or unlabeled action ref uses: attacker/action@main",
+    },
+    {
+      name: "docker_action_ref",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "      - uses: docker://alpine:latest\n      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4") },
+      expect: ".github/workflows/validate.yml: docker action refs are forbidden uses: docker://alpine:latest",
+    },
+    {
+      name: "repository_local_action_ref",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "      - uses: ./.github/actions/local\n      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4") },
+    },
+    {
+      name: "checkout_true_with_later_env_false",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("          persist-credentials: false\n", "          persist-credentials: true\n        env:\n          persist-credentials: false\n") },
+      expect: ".github/workflows/validate.yml: every actions/checkout step must set persist-credentials: false",
+    },
+    {
+      name: "checkout_true_with_block_scalar_false",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("          persist-credentials: false\n", "          sparse-checkout: |\n            persist-credentials: false\n          persist-credentials: true\n") },
+      expect: ".github/workflows/validate.yml: every actions/checkout step must set persist-credentials: false",
+    },
+    {
+      name: "checkout_duplicate_credentials",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("          persist-credentials: false\n", "          persist-credentials: false\n          persist-credentials: false\n") },
+      expect: ".github/workflows/validate.yml: every actions/checkout step must set persist-credentials: false",
+    },
+    {
+      name: "extra_top_level_permission",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("  contents: read\n", "  contents: read\n  issues: read\n") },
+      expect: ".github/workflows/validate.yml: top-level permissions must be exactly contents: read",
+    },
+    {
+      name: "write_top_level_permission",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("  contents: read\n", "  contents: write\n") },
+      expect: ".github/workflows/validate.yml: top-level permissions must be exactly contents: read",
+    },
+    {
+      name: "job_level_permission_override",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("  validate:\n", "  validate:\n    permissions:\n      contents: read\n") },
+      expect: ".github/workflows/validate.yml: job-level permissions overrides are forbidden",
+    },
+    {
+      name: "single_quoted_third_party_floating_action_ref",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "'uses': attacker/action@main") },
+      expect: ".github/workflows/validate.yml: floating or unlabeled action ref 'uses': attacker/action@main",
+    },
+    {
+      name: "double_quoted_third_party_floating_action_ref",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "\"uses\": attacker/action@main") },
+      expect: ".github/workflows/validate.yml: floating or unlabeled action ref \"uses\": attacker/action@main",
+    },
+    {
+      name: "single_quoted_checkout_floating_ref",
+      mutate: { ".github/workflows/validate.yml": quotedCheckout(workflow, "'") },
+      expect: ".github/workflows/validate.yml: floating or unlabeled action ref 'uses': actions/checkout@v4",
+    },
+    {
+      name: "single_quoted_checkout_credentials_persisted",
+      mutate: { ".github/workflows/validate.yml": quotedCheckout(workflow, "'") },
+      expect: ".github/workflows/validate.yml: every actions/checkout step must set persist-credentials: false",
+    },
+    {
+      name: "double_quoted_checkout_floating_ref",
+      mutate: { ".github/workflows/validate.yml": quotedCheckout(workflow, "\"") },
+      expect: ".github/workflows/validate.yml: floating or unlabeled action ref \"uses\": actions/checkout@v4",
+    },
+    {
+      name: "double_quoted_checkout_credentials_persisted",
+      mutate: { ".github/workflows/validate.yml": quotedCheckout(workflow, "\"") },
+      expect: ".github/workflows/validate.yml: every actions/checkout step must set persist-credentials: false",
+    },
+    {
+      name: "single_quoted_job_level_permission_override",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("  validate:\n", "  validate:\n    'permissions':\n      contents: read\n") },
+      expect: ".github/workflows/validate.yml: job-level permissions overrides are forbidden",
+    },
+    {
+      name: "double_quoted_job_level_permission_override",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("  validate:\n", "  validate:\n    \"permissions\":\n      contents: read\n") },
+      expect: ".github/workflows/validate.yml: job-level permissions overrides are forbidden",
+    },
+    {
+      name: "flow_sequence_action_mapping",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "- { uses: attacker/action@main }") },
+      expect: ".github/workflows/validate.yml: flow-style sequence mappings are forbidden",
+    },
+    {
+      name: "flow_sequence_checkout_with_inline_map",
+      mutate: { ".github/workflows/validate.yml": flowCheckout(workflow) },
+      expect: ".github/workflows/validate.yml: flow-style sequence mappings are forbidden",
+    },
+    {
+      name: "flow_collection_mapping_value",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("    steps:\n", "    steps: [{ uses: attacker/action@main }]\n") },
+      expect: ".github/workflows/validate.yml: flow-style collection values are forbidden",
+    },
+    {
+      name: "flow_collection_continuation_value",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("    steps:\n", "    steps:\n      [{ uses: attacker/action@main }]\n") },
+      expect: ".github/workflows/validate.yml: flow-style collection values are forbidden",
+    },
+    {
+      name: "double_quoted_escaped_action_key",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "\"u\\u0073es\": attacker/action@main") },
+      expect: ".github/workflows/validate.yml: escape sequences in double-quoted mapping keys are forbidden",
+    },
+    {
+      name: "double_quoted_escaped_permission_key",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("  validate:\n", "  validate:\n    \"permi\\u0073sions\":\n      contents: write\n") },
+      expect: ".github/workflows/validate.yml: escape sequences in double-quoted mapping keys are forbidden",
+    },
+    {
+      name: "explicit_action_mapping_key",
+      mutate: { ".github/workflows/validate.yml": replaceSetupNode(workflow, "        ? uses\n        : attacker/action@main") },
+      expect: ".github/workflows/validate.yml: explicit mapping keys are forbidden",
+    },
+    {
+      name: "explicit_checkout_mapping_key",
+      mutate: { ".github/workflows/validate.yml": replaceCheckout(workflow, "      - ? uses\n        : actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5\n        with:\n          persist-credentials: true") },
+      expect: ".github/workflows/validate.yml: explicit mapping keys are forbidden",
+    },
+    {
+      name: "explicit_permissions_mapping_key",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("permissions:\n  contents: read", "? permissions\n:\n  contents: write") },
+      expect: ".github/workflows/validate.yml: explicit mapping keys are forbidden",
+    },
+    {
+      name: "explicit_duplicate_checkout_credentials_key",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("          persist-credentials: false\n", "          ? persist-credentials\n          : false\n          persist-credentials: true\n") },
+      expect: ".github/workflows/validate.yml: explicit mapping keys are forbidden",
+    },
+    {
+      name: "tagged_action_key",
+      mutate: { ".github/workflows/validate.yml": replaceCheckout(workflow, "      - name: Checkout\n        !!str uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5") },
+      expect: ".github/workflows/validate.yml: YAML tags are forbidden",
+    },
+    {
+      name: "anchored_action_key",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "&name uses: attacker/action@main") },
+      expect: ".github/workflows/validate.yml: YAML anchors and aliases are forbidden",
+    },
+    {
+      name: "aliased_action_value",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("name: Validate StyleGallery", "x-action: &action attacker/action@main\nname: Validate StyleGallery").replace("uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "uses: *action") },
+      expect: ".github/workflows/validate.yml: YAML anchors and aliases are forbidden",
+    },
+    {
+      name: "merged_checkout_step",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("name: Validate StyleGallery", "x-checkout: &checkout\n  uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5\n  with:\n    persist-credentials: false\nname: Validate StyleGallery").replace("        with:\n          persist-credentials: false", "        <<: *checkout\n        with:\n          persist-credentials: true") },
+      expect: ".github/workflows/validate.yml: YAML merge keys are forbidden",
+    },
+    {
+      name: "literal_block_scalar_action_ref",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4", "uses: |-\n          attacker/action@main") },
+      expect: ".github/workflows/validate.yml: block scalar action refs are forbidden",
+    },
+    {
+      name: "folded_block_scalar_checkout_ref",
+      mutate: { ".github/workflows/validate.yml": replaceCheckout(workflow, "      - name: Checkout\n        uses: >-\n          actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5\n        with:\n          persist-credentials: true") },
+      expect: ".github/workflows/validate.yml: block scalar action refs are forbidden",
+    },
+    {
+      name: "yaml_directive",
+      mutate: { ".github/workflows/validate.yml": `%YAML 1.2\n---\n${workflow}` },
+      expect: ".github/workflows/validate.yml: YAML directives are forbidden",
+    },
+    {
+      name: "yaml_tag_directive",
+      mutate: { ".github/workflows/validate.yml": `%TAG !e! tag:example.com,2026:\n---\n${workflow}` },
+      expect: ".github/workflows/validate.yml: YAML directives are forbidden",
+    },
+    {
+      name: "yaml_document_start_marker",
+      mutate: { ".github/workflows/validate.yml": `---\n${workflow}` },
+      expect: ".github/workflows/validate.yml: YAML document markers are forbidden",
+    },
+    {
+      name: "yaml_document_end_marker",
+      mutate: { ".github/workflows/validate.yml": `${workflow}\n...\n` },
+      expect: ".github/workflows/validate.yml: YAML document markers are forbidden",
+    },
+    {
+      name: "block_scalar_body_structural_notation_ignored",
+      mutate: { ".github/workflows/validate.yml": workflow.replace("        run: |\n          node scripts/create-component-state-session.mjs", "        run: |\n          ? uses\n          : attacker/action@main\n          !!str uses: attacker/action@main\n          &action uses: attacker/action@main\n          <<: *action\n          uses: |\n            attacker/action@main\n          steps: [{ uses: attacker/action@main }]\n          ---\n          node scripts/create-component-state-session.mjs") },
+    },
+  ];
+}
+
+function quotedCheckout(workflow, quote) {
+  return workflow
+    .replace("uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4", `${quote}uses${quote}: actions/checkout@v4`)
+    .replace("        with:\n          persist-credentials: false", `        ${quote}with${quote}:\n          ${quote}persist-credentials${quote}: true`);
+}
+
+function flowCheckout(workflow) {
+  return replaceCheckout(
+    workflow,
+    "      - { uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, with: { persist-credentials: false } }",
+  );
+}
+
+function replaceCheckout(workflow, replacement) {
+  const named = "      - name: Checkout\n        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4\n        with:\n          persist-credentials: false";
+  const unnamed = "      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4\n        with:\n          persist-credentials: false";
+  return workflow.includes(named) ? workflow.replace(named, replacement) : workflow.replace(unnamed, replacement);
+}
+
+function replaceSetupNode(workflow, replacement) {
+  const named = "      - name: Setup Node\n        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4";
+  const unnamed = "      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4";
+  return workflow.includes(named) ? workflow.replace(named, `      - name: Setup Node\n${replacement}`) : workflow.replace(unnamed, `      - ${replacement.trimStart()}`);
+}