fix: fail closed on a type: adr document the adr-smadr gate cannot see

[zircote]

Closes #209.

Problem

The ADR carve-out (#203) removes documents from the mif-validate corpus on a content predicate (type: adr, any L3 tree), but the adr-smadr CI job that is supposed to gate them instead is scoped to a directory — and its pattern: '*.md' is non-recursive: the structured-madr Action resolves glob(join(path, pattern)) verbatim (src/validate.js), so only direct children of docs/adr/ are ever seen. A type: adr document in another L3 tree, or nested below docs/adr/, was carved out of one gate and invisible to the other: validated by nothing, CI green.

Resolution (option 2 of the three in #209, extended)

scripts/lib/corpus.mjs now walks the L3 trees once (partitionL3Docs()) and throws when a type: adr document sits outside the adr-smadr gate's actual coverage — outside docs/adr/, or nested below it. This keeps the content-based carve-out #208 chose, makes the module's stated contract true, and matches the fail-closed discipline already in the file (missing tree, empty result, non-directory tree).

The issue's open question about globstar semantics is resolved empirically: the Action's glob is non-recursive, so nested docs/adr/** files do escape it — the fail-closed check covers that shape too.

Acceptance criteria mapping

• A type: adr doc under any L3 tree is validated by exactly one gate: direct children of docs/adr/ go to adr-smadr; anywhere else now throws in every corpus consumer (mif-validate steps, engine-parity.mjs, provenance-corpus-check.mjs) — PR-gated, never silently passing.
• corpus.mjs's stated contract and what ci.yml gates now agree; both comment blocks updated to say so.
• Covered by regression tests that fail on the pre-fix tree (verified by swapping in the pre-fix corpus.mjs: both fail-closed tests fail, 2/16) and pass after (16/16; full test:hook 308/308).

Gates run locally

validate-plugin OK · test:hook 308/308 · lint:md 0 issues / 317 files · actionlint clean · provenance-corpus-check byte-idempotent.

[Copilot]

Pull request overview

This PR closes a validation gap where type: adr documents could be carved out of the mif-validate corpus yet also be invisible to the adr-smadr CI job due to its non-recursive docs/adr/*.md glob, causing CI to pass while validating nothing.

Changes:

• Adds a fail-closed partition in scripts/lib/corpus.mjs that throws if any type: adr doc falls outside the adr-smadr job’s actual coverage.
• Adds regression tests that reproduce the “escapes both gates” scenarios and assert the new fail-closed behavior.
• Updates CI and changelog documentation/comments to reflect the non-recursive gate boundary.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
tests/corpus.test.mjs	Adds regression tests covering ungated type: adr placements and the expected fail-closed behavior.
scripts/lib/corpus.mjs	Introduces partitionL3Docs() to split ADR vs non-ADR docs and throw on ADRs outside docs/adr/*.md coverage.
CHANGELOG.md	Documents the fix and its rationale for gate coverage.
.github/workflows/ci.yml	Clarifies in-job comments that pattern: '*.md' is non-recursive and relies on corpus fail-closed enforcement.

Suppressed comments (1)

scripts/lib/corpus.mjs:98

• dirname(f) !== ADR_GATE_DIR relies on platform-specific path parsing. If any globbed path contains backslashes (e.g., on Windows), this check can misclassify direct children of docs/adr as "ungated" and throw. Prefer posix.dirname on normalized forward-slash paths for repo-relative comparisons.

  const adrDocs = files.filter((f) => isAdrDoc(f));
  const ungated = adrDocs.filter((f) => dirname(f) !== ADR_GATE_DIR);
  if (ungated.length > 0) {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (2)

scripts/lib/corpus.mjs:90

• partitionL3Docs() is invoked separately by listL3Docs() and listAdrDocs(). Callers like listAllGatedDocs() (and provenance-corpus-check.mjs via listAllGatedDocs) end up walking the L3 trees twice (glob + frontmatter reads), which contradicts the nearby “One walk” intent and adds avoidable IO. Consider memoizing the partition per process.cwd() so a single run doesn’t rescan the filesystem twice while still supporting tests that chdir().

function partitionL3Docs() {
  for (const d of L3_DIRS) {
    if (!isDirectory(d)) throw new Error(`L3 doc directory missing: ${d}`);
  }
  const files = L3_DIRS.flatMap((d) => globSync(`${d}/**/*.md`)).sort();

tests/corpus.test.mjs:233

• This regex pins pattern: to single quotes only. That makes the regression test brittle to harmless YAML formatting changes (e.g., pattern: "*.md" or pattern: *.md) even though the semantic contract is the same. Consider accepting either quote style (or none).

  const projectAdrSteps = [...ci.matchAll(/path:[ \t]*(docs\/[^\s]+)\s*\n\s*pattern:[ \t]*'([^']+)'/g)];