Catalog Blog and record its first audit

registry/repos.json

@@ -304,6 +304,22 @@
             "consumerModel": "pull",
             "releaseTrigger": "none",
             "driftNotes": ["xLights show sequences/models (asset repo).", "main is near-empty - all content lives on develop; promote to main.", "No CI/governance scaffolding."]
+        },
+        {
+            "name": "Blog",
+            "url": "https://github.com/ptr727/Blog",
+            "status": "cataloged",
+            "types": ["source-only"],
+            "groundTruthBranch": "main",
+            "workflowModel": "release",
+            "lineEndings": "lf",
+            "hasDevelop": true,
+            "publish": [{ "target": "github-release", "mechanism": "none" }],
+            "requiredSecrets": [],
+            "consumerModel": "pull",
+            "releaseTrigger": "dispatch-only",
+            "configLayout": { "rulesetsDir": "repo-config", "pythonConfig": null },
+            "driftNotes": ["Hugo static site migrated off WordPress.com, stood up 2026-08-01; release model with a dispatch-only publisher that cuts the tag and a source archive.", "lineEndings lf on a release repo, where the rule grants the native-platform default to operational repos only: every consumer is Linux (the Hugo build, the Caddy container, and the rsync deploy).", "types source-only rather than the docs the hub proposed, because both docs predicates are false for a repo that builds a site and gates a URL contract. Interim until the static-site-generator type lands, which #456 is holding for Blog's measured deploy shape.", "content/ is an imported WordPress archive, so the prose, spelling, and style gates are scoped to exclude it.", "The VPS deploy does not exist yet, so the publish target is the GitHub release only. Revisit publish[] once deploy-site.yml is proven."]
         }
     ]
 }

reports/blog/audit.md

@@ -0,0 +1,81 @@
+# Audit: Blog
+
+- **Audited branch:** main (`6855ddb`)
+- **Types:** source-only (from registry)
+- **Verdict:** operational
+- **Date:** 2026-08-03
+- **Run stamp:** `audit run 2026-08-03T22:34:03Z | hub 3a7cc64`
+
+First audit of this repo. It was stood up on 2026-08-01 and reached a proven release path the same day, but it was never added to [`registry/repos.json`][repos], so no hub tool had measured it until now and [`reports/divergences.md`][divergences] under-reported the fleet by exactly this repo. The registry entry lands with this report. Nothing here is a defect: every finding is the hub advancing after the carry, which is the propagation job [#536][issue-536] exists to make possible.
+
+## Develop Drift
+
+`develop` vs `main`: ahead 1, behind 1. The behind-1 is the promotion merge commit, which is the benign ancestry artifact merge-commit promotions always leave. The ahead-1 is a Dependabot action-SHA bump the merge bot landed after promotion. A second run with `--branch develop` reports the identical nine findings, so `develop` carries no conformance content `main` lacks.
+
+## Already Owed by the Hub's Own Develop
+
+This audit reads hub `main` (`3a7cc64`), which AUDIT.md section 1 makes the ground truth. Re-running it from a tree at hub `develop` (`362aec8`) reports two additional re-vendors and two DEFECTs, all four from [#545][pr-545] taking `bypass_actors` out of the three ruleset payloads about an hour before this run. They are recorded here rather than counted, because measuring a repo against un-promoted hub content reports work in flight as a conformance failure, and the same four will appear against every fleet repo the moment that change promotes:
+
+- `repo-config/develop.json` and `repo-config/main.json` become stale carries, re-vendored the same mechanical way as the rest.
+- The live `develop` and `main` rulesets then diverge from the payloads, because both still carry the `RepositoryRole` admin bypass the new payloads no longer declare. Closing that is a repository-settings change on a protected branch, so it is the maintainer's to apply, not an agent's.
+
+## Dimensions
+
+| Dimension | Letter | Intent | Verdict | Evidence (file:line) |
+| --- | --- | --- | --- | --- |
+| branch-model | pass | pass | pass | Both branches protected, exactly one ruleset per name, and both match `repo-config/develop.json` and `repo-config/main.json` by normalized diff. The required-status-check context is the fleet canonical `Check pull request workflow status job` (`repo-config/main.json:48`, `repo-config/develop.json:51`) and matches the aggregator's own name (`.github/workflows/test-pull-request.yml:26`) |
+| repo-setup | pass | pass | pass | The baseline App-token pair is present in both the Actions and Dependabot stores, no forbidden name is configured, and no stale secret. `requiredSecrets` is empty, correct for a source-only repo publishing only a GitHub release |
+| linter-parity | pass | pass | pass | One config per linter, each driving CI: markdownlint-cli2, cspell, actionlint, editorconfig-checker, shellcheck and shfmt, then the Hugo build and the URL-contract check (`.github/workflows/validate-task.yml:34-101`) |
+| recurring-violations | drift | pass | drift | Three prose findings across the repo's own files, none in carried content. Line endings are LF and bound by git rather than only by the editor (`.gitattributes:7,16`) |
+| readme-structure | pass | pass | pass | Sections present and in spec order, with Installation and Usage legitimately N/A for source-only. The intro is 77 characters, link-free, single-sentence (`README.md:3`), and the GitHub About description mirrors it exactly |
+| workflow (WORKFLOW.md 5A/5B) | pass | pass | pass | The PR gate runs the reusable validation and gates the merge on one always-run aggregator (`test-pull-request.yml:25-26`). The publisher is dispatch-only, refuses a ref that is not `main` or `develop` (`publish-release.yml:34`), pins the dispatch-time commit so a later push cannot release unvalidated, versions with NBGV (`publish-release.yml:52-53`), and derives prerelease from the ref (`publish-release.yml:64`). Proven end to end: release `1.0.11`, 2026-08-01 |
+| agent-instruction-set | drift | drift | drift | Eight verbatim units behind the canonical, two of them absent rather than stale, plus one undeclared section. Enumerated below |
+
+csharp, nuget, pypi, python, console, docker: N/A. The repo builds a Hugo site and ships no package or image. It carries Python helper scripts under `checks/`, which is not enough to make it a `python` repo: there is no package, no `pyproject.toml`, and no ruff or pyright surface for the dimension to check.
+
+## Defects
+
+None.
+
+## Drift Findings
+
+**Carried content behind the canonical.** Six of these are stale copies and two never arrived, and the distinction matters because a stale copy still states the rule in an older form while an absent one states nothing at all:
+
+1. `AGENTS.md > Fleet Bootstrap` is **absent**. Added by [#536][issue-536] after this repo carried its baseline, so the repo holds no statement of where the canonical rules live or how to route by its own state.
+2. `GOVERNANCE.md > Representative Data in Agent-Authored Text` is **absent**. The rule against agent-authored text quoting the maintainer's own data is not present in this repo in any form.
+3. `AGENTS.md > Context and Delegation Discipline` is stale. Missing the rule that a wait separates three outcomes and says which one it reached.
+4. `AGENTS.md > Where the Rules Live` is stale. Missing the table row routing to `Representative Data in Agent-Authored Text`, consistent with finding 2.
+5. `GOVERNANCE.md > Git and Commit Rules` is stale. Missing "Commit means commit and push".
+6. `GOVERNANCE.md > Verification Discipline` is stale. Missing "A launched process is not a result, and a cause nobody observed is not a diagnosis".
+7. `GOVERNANCE.md > PR Review Etiquette` is stale. Missing the whole `### Every Finding Ends in an Action` subsection, so the repo carries the review loop without the five outcomes that close a finding.
+8. `repo-config/configure.sh` is stale. It predates the payload-driven check mode ([#540][issue-540], [#543][issue-543]), so its check mode compares the pull-request merge methods and the required-status-check contexts by name rather than comparing every parameterized rule's whole parameters object in both directions. It passes clean over drift the current canonical would catch.
+
+**Undeclared section.** `AGENTS.md > Project Conventions` (`AGENTS.md:9`) is not a section [`spec/files.json`][files] declares. Its four rules are genuinely repo-specific (the append-only URL contract, never populating media over HTTP, `content/` as an archive, and a gate proving itself by failing) and none duplicates a verbatim section. Left in place pending the spec question raised below, which is what the section model asks for when reconciliation is not obvious.
+
+**Prose.** Three findings from `scripts/prose_lint.py` run over the repo excluding `content/`, `public/`, `themes/`, and `resources/`: a comment opening in lowercase (`.github/workflows/merge-bot-pull-request.yml:20`), a semicolon in prose (`OPERATIONS.md:142`), and a COPYRIGHT SIGN that the character-set tiers do not classify (`layouts/rss.xml:51`).
+
+## Proposed Registry / Spec Updates
+
+- Add the `Blog` registry entry. Applied in this change: `source-only`, `release` workflow model, `dispatch-only` release trigger, `lineEndings: "lf"`, and `driftNotes` recording the two declared deviations plus the interim classification.
+- Revisit `publish[]` once the VPS deploy exists. It declares the GitHub release only, because that is the only channel that currently ships. [#456][issue-456] holds the static-site type pending this repo's measured deploy shape.
+
+## Escalations
+
+Two spec questions, raised rather than resolved, per AUDIT.md section 9.
+
+1. **The hub contradicts itself on whether a repo may carry its own `AGENTS.md` section.** [`AGENTS.md`][agents] states that "a project's project-specific conventions and public-API/behavioral contracts (e.g. a 'Library API Conventions' section) live in that project's own `AGENTS.md`", while [`spec/section-model.md`][section-model] states that "a downstream repo's extra section the hub does not declare is drift to reconcile, not a local liberty" and lists four destinations for repo-specific content, none of them `AGENTS.md`. A repo following the first is flagged by the audit for violating the second. Blog is the case: its `Project Conventions` section is exactly the shape the first sanctions.
+2. **The character-set tiers do not classify the COPYRIGHT SIGN.** `layouts/rss.xml:51` emits the sign as U+00A9 in generated RSS output, where the alternative is an ASCII transliteration in a machine-read feed. The tiers in GOVERNANCE.md "Character Set" have no entry for it, so the linter reports `charset-unknown` rather than pass or fail, and every repo generating a feed or a rendered document will hit the same gap.
+
+<!-- Repo -->
+[agents]: ../../AGENTS.md
+[divergences]: ../divergences.md
+[files]: ../../spec/files.json
+[repos]: ../../registry/repos.json
+[section-model]: ../../spec/section-model.md
+
+<!-- External -->
+[pr-545]: https://github.com/ptr727/ProjectTemplate/pull/545
+[issue-456]: https://github.com/ptr727/ProjectTemplate/issues/456
+[issue-536]: https://github.com/ptr727/ProjectTemplate/pull/536
+[issue-540]: https://github.com/ptr727/ProjectTemplate/pull/540
+[issue-543]: https://github.com/ptr727/ProjectTemplate/pull/543

reports/conformance-matrix.md

@@ -11,7 +11,7 @@ The primary shapes are stood up as whole repos; the **composable targets** (`nug
 | Shape | Reference repo | Cold-standup | Last audited | First gap / notes |
 |---|---|---|---|---|
 | `python` + `source-only` | Financial-Modeling | not-tested | - | Reference for the source-release (dispatch-only) profile; the downstream standup issue is open. |
-| `source-only` + `release` | Blog | not-tested | - | Hugo static site (#456), the next standup and the first cold test of `STANDUP.md` step 0. Its deploy target has no declared type yet, so `releaseTrigger` is `none` and `publish[]` is empty until a deploy has actually run. |
+| `source-only` + `release` | Blog | not-tested | 2026-08-03 | Hugo static site (#456), stood up 2026-08-01 and cataloged 2026-08-03. It cut release `1.0.11` from a dispatch-only publisher, so `releaseTrigger` is `dispatch-only` and `publish[]` carries the GitHub release, both recorded from what ran rather than from what was predicted. The VPS deploy has still not run, so its target has no declared type yet. |
 | `csharp` + `console` | - | not-tested | - | |
 | `csharp` + `docker` | - | not-tested | - | |
 | `csharp` + `python` | PlexCleaner | not-tested | - | First mixed-language shape (#339). Python is a stdlib-only `uvx` **scripts** profile subtree (`RegressionTests/`): no `uv.lock`, `pyproject.toml` lint/type config only, mypy checker, `python.uvlock.pinned` + `python.coverage.codecov` N/A; `codecov.yml` stays required for the C# side. Both language rule-sets apply (CODESTYLE.md "Two profiles"). |

reports/divergences.md

@@ -22,35 +22,35 @@ Generated by `python3 spec/fidelity_honesty.py --report` - do not hand-edit. Cur
 
 ## Untriaged - add a disposition to `spec/divergences.json`
 
-- **AGENTS.md > Fleet Bootstrap** - **not carried** by AudioCleaner, DevKitCIoT, ESPHome-Config, ESPHome-NonRoot, Financial-Modeling, HolidayLights, HomeAssistant-Config, HomeAutomation-Config, KiCadLibrary, LanguageTags, MediaTools, NxWitness, PhotoCleaner, PlexCleaner, Utilities, VSCode-Server-DotNetCore, Vantage-Config, aiopurpleair, homeassistant-purpleair, so the section never arrived rather than being edited (verbatim canonical)
+- **AGENTS.md > Fleet Bootstrap** - **not carried** by AudioCleaner, Blog, DevKitCIoT, ESPHome-Config, ESPHome-NonRoot, Financial-Modeling, HolidayLights, HomeAssistant-Config, HomeAutomation-Config, KiCadLibrary, LanguageTags, MediaTools, NxWitness, PhotoCleaner, PlexCleaner, Utilities, VSCode-Server-DotNetCore, Vantage-Config, aiopurpleair, homeassistant-purpleair, so the section never arrived rather than being edited (verbatim canonical)
 - **AGENTS.md > Context and Delegation Discipline** - **not carried** by AudioCleaner, DevKitCIoT, ESPHome-Config, ESPHome-NonRoot, HolidayLights, HomeAssistant-Config, HomeAutomation-Config, KiCadLibrary, LanguageTags, MediaTools, NxWitness, PlexCleaner, Utilities, VSCode-Server-DotNetCore, Vantage-Config, aiopurpleair, homeassistant-purpleair, so the section never arrived rather than being edited (verbatim canonical)
 - **AGENTS.md > Where the Rules Live** - **not carried** by AudioCleaner, DevKitCIoT, ESPHome-Config, ESPHome-NonRoot, HolidayLights, HomeAssistant-Config, HomeAutomation-Config, KiCadLibrary, LanguageTags, MediaTools, NxWitness, PlexCleaner, Utilities, VSCode-Server-DotNetCore, Vantage-Config, aiopurpleair, homeassistant-purpleair, so the section never arrived rather than being edited (verbatim canonical)
-- **GOVERNANCE.md > Representative Data in Agent-Authored Text** - **not carried** by Financial-Modeling, so the section never arrived rather than being edited (verbatim canonical)
+- **GOVERNANCE.md > Representative Data in Agent-Authored Text** - **not carried** by Blog, Financial-Modeling, so the section never arrived rather than being edited (verbatim canonical)
 
 ## Mechanical re-vendor (verbatim stale copies)
 
 A past hub revision, not the current canonical - the audit already flags these as DRIFT. Copy the current file down. No judgment needed.
 
-- **AGENTS.md > Context and Delegation Discipline** (1): Financial-Modeling
-- **AGENTS.md > Where the Rules Live** (1): Financial-Modeling
+- **AGENTS.md > Context and Delegation Discipline** (2): Blog, Financial-Modeling
+- **AGENTS.md > Where the Rules Live** (2): Blog, Financial-Modeling
 - **GOVERNANCE.md > Foundational Principles** (1): Financial-Modeling
 - **GOVERNANCE.md > Durable Knowledge and Self-Improvement** (1): Financial-Modeling
 - **GOVERNANCE.md > Repository Boundaries and Write Safety** (1): Financial-Modeling
-- **GOVERNANCE.md > Git and Commit Rules** (1): Financial-Modeling
+- **GOVERNANCE.md > Git and Commit Rules** (2): Blog, Financial-Modeling
 - **GOVERNANCE.md > Branching Model** (1): Financial-Modeling
 - **GOVERNANCE.md > Release Model** (1): Financial-Modeling
 - **GOVERNANCE.md > Operational Repositories** (1): Financial-Modeling
 - **GOVERNANCE.md > Pull Request Title and Commit Message Conventions** (1): Financial-Modeling
 - **GOVERNANCE.md > Documentation Style Conventions** (1): Financial-Modeling
-- **GOVERNANCE.md > Verification Discipline** (1): Financial-Modeling
-- **GOVERNANCE.md > PR Review Etiquette** (1): Financial-Modeling
+- **GOVERNANCE.md > Verification Discipline** (2): Blog, Financial-Modeling
+- **GOVERNANCE.md > PR Review Etiquette** (2): Blog, Financial-Modeling
 - **GOVERNANCE.md > Communicating with the User** (1): Financial-Modeling
 - **GOVERNANCE.md > Workflow YAML Conventions** (1): Financial-Modeling
 - **GOVERNANCE.md > Supported Development Platforms** (1): Financial-Modeling
 - **GOVERNANCE.md > Editor and Tasks** (1): Financial-Modeling
 - **GOVERNANCE.md > Repository Details** (1): Financial-Modeling
 - **.markdownlint-cli2.jsonc** (16): DevKitCIoT, ESPHome-Config, ESPHome-NonRoot, Financial-Modeling, HolidayLights, HomeAssistant-Config, HomeAutomation-Config, KiCadLibrary, LanguageTags, MediaTools, NxWitness, PlexCleaner, Utilities, VSCode-Server-DotNetCore, Vantage-Config, homeassistant-purpleair
-- **repo-config/configure.sh** (8): ESPHome-Config, Financial-Modeling, HomeAssistant-Config, HomeAutomation-Config, PhotoCleaner, PlexCleaner, Utilities, Vantage-Config
+- **repo-config/configure.sh** (9): Blog, ESPHome-Config, Financial-Modeling, HomeAssistant-Config, HomeAutomation-Config, PhotoCleaner, PlexCleaner, Utilities, Vantage-Config
 
 ## Promote candidates (intent uniform -> verbatim)