fix(governance): eliminate src classifier/matrix drift deadlock

[nulleimy]

Canonical R2 repair for #85, rebuilt directly from current main 30a95b2cde4564fb726c1f60aba57dc1930c9b39. Supersedes closed PRs #84 and #87.

Change rationale

The canonical decision matrix declares src/** as an architecture_change detection path, while the current classifier does not emit architecture_change for generic src/** changes. The Gate correctly reports CLASSIFIER_MATRIX_DRIFT, producing WARN/neutral for source-code PRs.

This repair aligns the classifier with the existing stricter matrix. It does not relax any governance rule.

Affected scope

Eight files:

• src/goverdocs/classifier.py
• tests/test_classifier_matrix_reconciliation.py
• tests/test_open_source_toolchain.py
• docs/architecture/ARCH-0003-governance-classifier-matrix-reconciliation.md
• DOCUMENTATION_INDEX.md
• manifests/DOCUMENT_REGISTRY.yaml
• manifests/RELATIONSHIP_GRAPH.json
• manifests/DOCUMENT_STATUS_SUMMARY.json

The four generated inventory files are the deterministic output of the existing goverdocs rebuild-index flow. Their rebuild also reconciles older governed documents that were already present in the repository but absent from stale generated manifests. The resulting registry contains 36 governed documents and uses deterministic generated_at: 2026-08-23T00:00:00+00:00.

The existing generated-artifact regression test was also strengthened: instead of hard-coding the obsolete July 26 / 24-document snapshot, it now recomputes the canonical registry from governed source documents and verifies exact registry equality, derived status summary, graph nodes/edges, and index discoverability. This preserves fail-closed freshness verification without requiring manual snapshot edits for every legitimate new governed document.

The architecture note records the classifier responsibility change, so the canonical base evaluator legitimately emits architecture_change for this architecture-level repair. No authority policy, decision matrix, ruleset, branch protection, required check name, workflow, merge permission, release, tag, or direct-main capability is changed by this PR.

Security / governance effect

This is a tightening/alignment change: src/** now emits architecture_change, matching the canonical matrix and preserving approval-required architecture handling. The regression tests prove a representative src/** path emits the event, creates no classifier/matrix drift, and generated governance inventory cannot silently drift from canonical source metadata.

Verification requirements

• fresh Quality and CodeQL on exact HEAD
• GOVERDOCS governance evaluation on exact HEAD/current base
• no unresolved review threads
• fresh exact-head project-owner approval after final HEAD
• independent setarchitect APPROVED review on exact HEAD before merge
• expected-head server merge only; no bypass

Rollback

Leave unmerged on any WARN/BLOCKED result. If merged and regression appears, revert only through a separately governed PR.

R13.2 PR #82 remains unmerged and must be reevaluated after this repair lands.

[nulleimy]

GOVERDOCS-APPROVAL-V1 role=project-owner pr=88 head=97b7ac38fbceb23164d11da2b717edeccb0de64e decision=approved

[nulleimy]

@setarchitect Independent governance review requested for the exact current subject.

Please review PR #88 at HEAD 97b7ac38fbceb23164d11da2b717edeccb0de64e and submit a normal GitHub APPROVED review only if the 3-file repair is acceptable. Scope is limited to classifier/matrix reconciliation + regression test + architecture record. No matrix, authority, ruleset, required-check, branch-protection, or merge capability is changed.

Do not approve if HEAD changes; exact-head binding is required. Tracking: #85.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 97b7ac38fb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[eimyroot]

Exact-head authority handoff — PR #88

Canonical subject: d64efe2b93dc9906ad2c5d63050b68d034c9dfe1
Base: main@30a95b2cde4564fb726c1f60aba57dc1930c9b39

Technical verification on this exact HEAD is green: Quality PASS, CodeQL PASS, and all inline review threads are resolved.

The published GOVERDOCS Governance Gate is currently BLOCKED only because no bound project-owner approval exists for this exact HEAD.

Project owner — @nulleimy

After reviewing the current 8-file diff, submit a COMMENT GitHub review anchored to the exact current HEAD with the body consisting of exactly this single line:

GOVERDOCS-APPROVAL-V1 role=project-owner pr=88 head=d64efe2b93dc9906ad2c5d63050b68d034c9dfe1 decision=approved

Do not reuse the old 97b7ac... approval; the approval contract is exact-head bound.

Independent reviewer — @setarchitect

After independently reviewing the current exact HEAD, submit a normal GitHub APPROVED review for commit d64efe2b93dc9906ad2c5d63050b68d034c9dfe1 only if acceptable.

Automated reviewer-request enrollment currently fails with GitHub 422 (GitHub does not expose setarchitect as a requestable collaborator for this repository), while the canonical OATHDO authority registry still binds setarchitect as the active independent reviewer. Do not substitute another identity or bypass this discrepancy inside PR #88.

If HEAD changes, both exact-head authority records must be renewed. Merge remains fail-closed until the required authority records are present and GOVERDOCS Governance Gate republishes PASS.

[eimyroot]

Exact-head authority update — independent review satisfied

@setarchitect has now submitted an APPROVED review anchored to the current exact HEAD d64efe2b93dc9906ad2c5d63050b68d034c9dfe1.

The Governance Gate immediately reevaluated and remains BLOCKED only because the project-owner approval for this exact HEAD is still not verified.

Remaining action — @nulleimy

After reviewing the current 8-file diff, submit a GitHub COMMENT review anchored to the exact current HEAD with the body consisting of exactly this single line:

GOVERDOCS-APPROVAL-V1 role=project-owner pr=88 head=d64efe2b93dc9906ad2c5d63050b68d034c9dfe1 decision=approved

Do not use a normal issue comment and do not reuse the stale 97b7ac... review. If HEAD changes, authority must be renewed. Once this exact-head owner record is present and the Gate republishes PASS, #88 is ready for expected-head server merge with no governance bypass.