Repository-tooling hygiene - structural validation only, fail-closed CI

[RedEyeNinja-BKK]

Repository-tooling hygiene — structural validation only, fail-closed CI

Branch: tooling-hygiene-structural-validation
Base SHA (verified before branching): 78a11d37e88a596053272a59e9edcc8556753e6c
Head SHA: 51b6d08790e9de24975adf97192dce7215bbed66
References: Issue #1 — senior steering + read-only tooling audit (2026-08-08)

Do not merge. This PR is for independent review. It is repository architecture/hygiene, NOT a Process Engine behavioral feature.

Classification

This PR is repository architecture/hygiene — not a Process Engine behavioral feature. No persona behavior, no pipeline-skill instructions, no runtime behavior changed. It removes the obsolete hidden-authoring/regeneration architecture, keeps small structural validation, and makes CI honest (fail-closed). Objective (per audit): keep only small structural repository validation that earns its place; remove the obsolete hidden-authoring/regeneration architecture and make CI honest.

Problem statement

The read-only tooling audit (delegated to Hermes, independently verified) found the clean-slate repo still retained:

• tools/convert.py declaring a repo-adjacent ../drafts directory the "Source of truth for CONTENT" — a hidden/local canonical authoring store + generated-source pipeline, contradicting GitHub-canonical, prompts-only architecture.
• tools/validate.py containing a check_generated_diff() / --strict regeneration/idempotence mechanism that invokes convert.py (regeneration machinery).
• GitHub workflow release-gate running python3 tools/validate.py --repo . --no-diff || true — a validator failure was swallowed by || true, so a green workflow did not prove the validator passed.
• A drafts-conditional regeneration step that never runs in GitHub (no drafts/ in the checkout).
• process-engine.toml + docs labeled a "canonical release manifest" while the CHANGELOG claims manifest mechanics were removed.

Files removed / changed

File	Change
tools/convert.py	DELETED — obsolete hidden-authoring/generated-source pipeline
tools/validate.py	SIMPLIFY — removed check_generated_diff() + --strict + subprocess convert; reframed to structural repository validation; output STRUCTURAL VALIDATION PASS
.github/workflows/release-gate.yml	SIMPLIFY — display name structural-validation; run python3 tools/validate.py --repo . (no || true, no --no-diff); removed drafts-conditional convert + git-diff regeneration step
process-engine.toml	Header re-labeled repository release metadata (no fields added/removed)
tools/README.md	Describes only validate.py structural validation; removed converter/drafts/"canonical manifest" claims
docs/architecture.md	§Release integrity updated to structural-validation framing; explicit "green structural check is not behavioral proof or release gate"

Diff: 6 files changed, 39 insertions(+), 421 deletions(-) (421 deletions mostly from deleting convert.py).

Why convert.py no longer belongs

It declared ../drafts (a repo-adjacent, untracked local authoring directory) the "Source of truth for CONTENT" and regenerated skills/, references/, templates/, persona.md from it. Under GitHub-canonical, prompts-only architecture, checked-in persona/skills/references/templates are canonical; a hidden local authoring store must not conceptually outrank them. This is exactly the kind of hidden/local canonical authoring store + generated-source pipeline the boundary says must not return. (Local operational evidence — MAINTAINER-NOTES.md, CHECKPOINT-2026-08-04/03 — records it descended from the pre-split authoring flow; historical evidence, not authority.)

What remains in validate.py

Small structural validation over committed GitHub content only:

• expected skill/reference/template counts vs process-engine.toml metadata;
• skill frontmatter/spec shape (allowed fields, name rules, description ≤1024, required sections);
• root ↔ embedded-reference equality (where the self-contained core duplication is intentional);
• local Markdown link integrity;
• current-version consistency sweep;
• lightweight documentation-count consistency.

Removed: check_generated_diff(), --strict, subprocess convert.py invocation, all regeneration/idempotence claims. A successful run means only: committed repository structure is internally consistent — NOT behavioral quality, trial PASS, release approval, or deployment approval.

No local/untracked authoring source remains authoritative

After deletion, the tracked repo has no references to convert.py, ../drafts, drafts/, local-authoring "source of truth", or regeneration instructions (verified by grep). The only remaining match is CHANGELOG.md v1.9.5 historical release prose ("regeneration drift"), which is preserved historical release notes, not rewritten. The sibling operations/process-engine/drafts/ tree exists outside the repo and is not referenced by any tracked file.

Old CI behavior vs new CI behavior

	Old	New
Display name	release-gate	structural-validation
Validator command	python3 tools/validate.py --repo . --no-diff || true	python3 tools/validate.py --repo .
Validator failure	Swallowed (green check even on FAILED)	Fails the check (exit 1 → red)
Regeneration step	Conditional on ./drafts (never runs in GitHub); git diff --exit-code trivially passes clean checkout	Removed
Meaning	"release gate" (overstated)	structural repository consistency only

This is explicitly NOT a product-quality proof or an operator release gate. Behavioral trials establish product behavior; Turnstone provides runtime/governance; operator approval governs merge/release/deployment.

Local negative canary (prove fail-closed)

Run on the branch (uncommitted, deliberately broken, then restored exactly):

1. Break embedded-reference equality — appended a line to skills/process-engine-core/references/intake.md → validator exit 1, STRUCTURAL VALIDATION FAILED. File restored.
2. Break frontmatter name — changed name: in process-engine-ship/SKILL.md → validator exit 1, STRUCTURAL VALIDATION FAILED. File restored.
3. Clean state — python3 tools/validate.py --repo . → exit 0, STRUCTURAL VALIDATION PASS — committed repository structure is internally consistent.

git status after restore: only the intended 6-file change set (no canary residue). The deliberately-broken state was never committed.

GitHub Actions result on this PR

Pending — the structural-validation workflow runs on the PR. A non-zero validator exit now fails the check; the valid committed state should pass.

Confirmation

• Runtime prompts/package behavior unchanged — no persona, skill-instruction, template, or reference content changed; no frontmatter version changes. Structural output wording and tooling only.
• No Turnstone mutation occurred — no live-store API writes, no persona/skill/resource changes, no policy changes. This is repo-only.
• No v1.9.6 bump, no tag/release, no Issue Review & steering - Proxmox Manager trial evidence (2026-08-08) #1 close, no branch deletion, no process-engine-facts.yaml change.

Evidence note (qualification of prior CI claims)

Observed local validate.py --no-diff runs genuinely returned PASS; GitHub workflow runs were green; because the old workflow used || true, green GitHub status alone was not fail-closed proof the validator passed; the drafts regeneration check was not exercised in GitHub because drafts/ was absent. This PR corrects that evidence weakness going forward.

Non-goals honored

No behavioral prompt changes; no evaluators; no generated-package-behavior tests in Python; no Method Factory contracts recreated; no state machines; no deployment manifests; no live Turnstone object changes; no version bump; no tag/release; no facts-file update; no Issue #1 close; no branch deletion.

[RedEyeNinja-BKK]

Senior review verdict — PASS; ready for operator merge gate

I reviewed the actual PR #3 head 51b6d08790e9de24975adf97192dce7215bbed66 against base 78a11d37e88a596053272a59e9edcc8556753e6c, including the complete six-file diff, current workflow behavior, and the Issue #1 evidence correction.

Verdict

PASS — no remaining repository/product-boundary blocker in the committed diff.

This is the right simplification for the current Process Engine architecture: GitHub-canonical prompts remain the product, obsolete hidden-authoring/regeneration machinery is removed, and the retained Python is limited to small structural checks over committed repository content.

This review is not merge/release/deployment authorization. Vincent remains the operator gate.

What is correct

1. convert.py removal closes the architectural contradiction

Deleting tools/convert.py removes the repo-adjacent ../drafts source-of-truth and generated-content pipeline. Nothing in the replacement diff recreates that authority elsewhere. This restores the intended model: committed GitHub persona/skills/references/templates are canonical.

2. validate.py now earns its place

The remaining validator is narrow and structural: counts, frontmatter/spec shape, required sections, embedded-reference equality, local-link resolution, version consistency, and lightweight documentation consistency. Regeneration, subprocess conversion, --strict, and generated-drift behavior are gone.

Its framing is also corrected: a PASS means the committed repository structure is internally consistent, not that Process Engine behavior, release readiness, or deployment has been proven.

3. CI is now honest and fail-closed

The workflow runs python3 tools/validate.py --repo . directly, without || true, and the drafts/regeneration ceremony is removed. A validator exit 1 now fails the GitHub check. The exact reviewed head has a successful structural-validation workflow run.

The reported local negative canaries are consistent with the committed failure semantics: violations accumulate in FAILURES, cause exit 1, and clean state exits 0. I see no committed canary residue.

4. Release metadata is appropriately lightweight

process-engine.toml remains an eight-field release/version/count metadata file, but the misleading canonical release manifest terminology is removed. No runtime state, hashes, approvals, deployment state, or release-sealing machinery was added.

5. Evidence correction is appropriate

Issue #1 now accurately records that prior local validator PASS results stand, while old green GitHub workflow status did not itself prove validator PASS because || true swallowed failure and regeneration was skipped without drafts/. This corrects the evidence interpretation without rewriting history.

One non-blocking operational follow-up

The PR states that a sibling/local operations/process-engine/drafts/ tree and historical maintainer/checkpoint material still exist outside this repository. I do not recommend adding or deleting them in this PR.

After merge, ensure future Process Engine development instructions treat those materials as historical/local evidence only, never as an authoring source or source of truth. If any active local maintainer instruction still says “edit drafts first / convert to sync,” retire or clearly mark that instruction through a separately scoped, non-destructive operational cleanup. Do not let the obsolete workflow re-enter through agent habit after the repository has removed it.

Recommended next sequence

1. Present this exact head to Vincent for the merge gate.
2. If approved, merge only if head remains exactly 51b6d08790e9de24975adf97192dce7215bbed66; read back resulting main and verify structural-validation remains green.
3. Then create the separately reviewed metadata-only v1.9.6 release-prep PR from the new main.
4. Keep tag/release and any live Turnstone update as separate operator gates.

Senior review status: PASS — ready for operator merge decision.