feat(ci): migrate shell safety and docs drift to policy rules

Author: github-actions[bot]

docs/governance/CI_POLICY.md

@@ -5,12 +5,11 @@ This document defines policy principles, severity handling, and exit code policy
 Normative policy definitions live in:
 - `tools/ci/policies/schema/rules.schema.json`
 - `tools/ci/policies/rules/`
+Entry index:
+- `docs/governance/POLICY_INDEX.md`
 
 ## Global Rules
 - Fail-closed: no silent bypass paths.
-- No `continue-on-error: true` in workflow files.
-- No `|| true` on critical workflow paths.
-- No `set +e` without explicit allow-list entry.
 - Workflow YAML only calls entry scripts under `tools/ci/bin/`.
 
 ## Result Contract
@@ -22,17 +21,8 @@ All required checks MUST write:
 `result.json` must comply with `tools/ci/schema/result.schema.json`.
 
 ## Rule Catalog
-- `CI-ARTIFACT-001` fail: required artifact missing.
-- `CI-POLICY-001` fail: policy rule loading/schema validation failed.
-- `CI-SCHEMA-001` fail: `result.json` schema validation failed.
-- `CI-SHELL-001` fail: found `continue-on-error: true`.
-- `CI-SHELL-002` fail: found `|| true` in critical workflow path.
-- `CI-SHELL-003` fail: found `set +e` outside allow-list.
-- `CI-SHELL-004` fail: workflow `run: |` block exceeds configured max lines.
-- `CI-GRAPH-001` fail: required CI graph edge or job constraint violated.
-- `CI-QODANA-001` fail: `QODANA_TOKEN` missing.
-- `CI-QODANA-002` fail: expected SARIF missing.
-- `CI-QODANA-003` fail: SARIF invalid JSON.
+- Rule IDs and file ownership are indexed in `docs/governance/POLICY_INDEX.md`.
+- Evaluation details and thresholds are defined only in `tools/ci/policies/rules/`.
 
 ## Severity Rules
 - `warn`: visible, non-blocking.
@@ -43,5 +33,5 @@ All required checks MUST write:
 - `1`: policy/contract/check failure (`fail`)
 - `2`: invalid invocation or missing prerequisites
 
-## set +e Allow-list
-No allow-list entries in Phase 1.
+## Allow-lists
+Allow-list definitions are managed in rule parameters under `tools/ci/policies/rules/`.

docs/governance/POLICY_INDEX.md

@@ -0,0 +1,12 @@
+# Policy Index (SSOT Navigation)
+
+This index is non-normative. Normative policy definitions are the rule files under `tools/ci/policies/rules/`.
+
+| Rule ID | Rule File |
+| --- | --- |
+| `CI-ARTIFACT-001` | `tools/ci/policies/rules/artifact_contract.yaml` |
+| `CI-SHELL-001` | `tools/ci/policies/rules/shell_safety.yaml` |
+| `CI-SHELL-002` | `tools/ci/policies/rules/shell_safety.yaml` |
+| `CI-SHELL-003` | `tools/ci/policies/rules/shell_safety.yaml` |
+| `CI-SHELL-004` | `tools/ci/policies/rules/shell_safety.yaml` |
+| `CI-DOCS-001` | `tools/ci/policies/rules/docs_drift.yaml` |

tools/ci/bin/run.sh

@@ -63,7 +63,9 @@ run_preflight() {
   run_or_fail "CI-PREFLIGHT-001" "Docs check" python3 "${ROOT_DIR}/tools/check-docs.py"
   run_or_fail "CI-PREFLIGHT-001" "Versioning guard" bash "${ROOT_DIR}/tools/versioning/check-versioning.sh"
   run_or_fail "CI-PREFLIGHT-001" "Format check" dotnet format "${ROOT_DIR}/FileClassifier.sln" --verify-no-changes
-  run_or_fail "CI-PREFLIGHT-001" "Policy shell safety" bash "${ROOT_DIR}/tools/ci/policies/policy_shell_safety.sh"
+  if ! ci_run_capture "Policy shell safety" bash "${ROOT_DIR}/tools/ci/policies/policy_shell_safety.sh"; then
+    return 1
+  fi
   run_or_fail "CI-GRAPH-001" "CI graph assertion" bash "${ROOT_DIR}/tools/ci/bin/assert_ci_graph.sh"
 
   ci_result_append_summary "Preflight checks completed."