Fail closed on incomplete project priority audits

.github/workflows/reusable-docs-governance.yml

@@ -30,6 +30,24 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Validate project Priority audit parser and regressions
+        shell: pwsh
+        run: |
+          $script = "scripts/github/Sync-TaskdeckProjectPriority.ps1"
+          $tokens = $null
+          $parseErrors = $null
+          [System.Management.Automation.Language.Parser]::ParseFile(
+            (Resolve-Path -LiteralPath $script).Path,
+            [ref]$tokens,
+            [ref]$parseErrors
+          ) | Out-Null
+          if ($parseErrors.Count -ne 0) {
+            $parseErrors | ForEach-Object { Write-Error $_ }
+            exit 1
+          }
+
+          & $script -SelfTest
+
       - name: Validate failure ledger projection synchronization
         run: python -m unittest discover -s scripts/agent_hooks -p "test_render_failure_ledger.py"
 

OUTSTANDING_TASKS.md

@@ -91,7 +91,7 @@ Analysis docs: `docs/PROJECT_TRAJECTORY.md` (strengths + path) and `docs/COURSE_
 - [ ] **#1173** — Apply and verify the required branch-protection settings in GitHub. This is repository-settings work and remains maintainer-only.
 - [ ] **#1303** — Push the `v0.1.0` release tag only after the maintainer accepts the release deck and its pipeline evidence. Agents may repair the pipeline but must not push the tag.
 - [ ] **#1482 — Taskdeck name, pre-commercial legal residuals.** *(Supersedes the old "#1299 trademark check" line: #1299 shipped with PR #1337 on 2026-07-25 and its AC4 search + cost + recommendation are recorded on the issue.)* What remains is genuinely legal and none of it blocks the free beta: an **attorney registrability opinion** for Classes 9/42 asking about *descriptiveness* (not just conflict), a read on **TASKADE** (live, incontestable US Cl. 42 mark covering task management), the UKIPO/EUIPO coverage gaps (UKIPO hard-blocked automated access, so all GB data is indirect), perishable namespace reservations, and the **keep-or-rename decision before `v0.1.0` (#1303)** — renaming is nearly free pre-tag and expensive after.
-- [ ] **#1327 project sync access** — Run `gh auth refresh -s project`, then rerun `scripts/github/Sync-TaskdeckProjectPriority.ps1` in audit and apply modes and verify no issue/PR project item has an empty Priority.
+- [ ] **#1458 project-priority data cleanup** — Complete read access is verified and the helper fails closed beyond 1,000 items. On 2026-07-27, all 130 formerly unlabeled Taskdeck Issues were classified and verified 130/130 with exactly one Priority label (`I=5`, `II=9`, `III=2`, `IV=18`, `V=96`). A stable 1,472/1,472 snapshot proved all 665 Issue items have exactly one Priority label and found 142 ProjectV2 field drifts (131 Issues and 11 PRs; 137 empty plus five non-empty mismatches). External Issue references are visible non-authority: their labels never rank, external-only PRs derive `Priority V`, and an external closing Issue still permits same-repository body fallback. No project-field `-Apply` had run at that checkpoint. Keep this human-owned item open until a reviewed Apply and a separate complete zero-drift audit both succeed.
 - [ ] **#1330** — Repair the CI Extended reusable-workflow permission contract; affected PRs remain ineligible while the workflow startup failure is red.
 - [ ] **#1282 / #1332 / #1335** — Stabilize the required full-suite harness: SQLite concurrency, Redis connect/dispose, and hosted-worker/presence lifecycle isolation. Narrow passes do not clear the recorded full-suite failures.
 - [ ] **#1338** — Map HTTP MCP and its API-key middleware to the same `/mcp` route before documenting or exposing HTTP transport; the current parameterless mapping serves MCP at an unintended unauthenticated root route.
@@ -100,23 +100,26 @@ Analysis docs: `docs/PROJECT_TRAJECTORY.md` (strengths + path) and `docs/COURSE_
 - [ ] **#1274 / `origin/issue-1274/paper-e2e-axe` at `993f188f`** — Resume the parked Paper E2E/axe re-point from the pushed WIP branch; fix tracked Paper Review blockers #1347/#1348, finish the named first-run/onboarding/smoke and axe coverage, then run the full frontend/E2E gates before opening a PR.
 - [ ] **#1347 / #1348** — Repair the Paper deep-review enum wire-contract crash and the SQLite-backed similar-past HTTP 500; both were reproduced by the real Paper capture/review path and must not be hidden by frontend fallbacks.
 - [ ] **#1323 prompt-rail remainder** — Bind the hostile transcript/PDF/image and malformed-response fixtures from PR #1340 to PR #1312's effective prompt/parser path before GEN-04; prove grounded-task-or-empty verdicts and deterministic fallback for schema escapes.
-- [ ] **#1456 / PR #1457 — Codex deny-floor adapter T4 gate.** Stages a security boundary and does not self-ratify: merging needs the maintainer to trust the project hook in a **fresh interactive Codex `/hooks` session** and to record live allow/deny canaries. No agent can perform or substitute for that. **Step-by-step instructions are posted on the PR** (2026-07-25), including the exact canary commands and what a failure looks like. *(Its pinned dispatcher hash was stale — v1.5.2 vs the installed 1.6.5 — and has been refreshed; verify it is still current before the trust session, since the floor shipped twice in one day. The other two standing holds are resolved: #1295 closed as superseded, #1337 merged.)*
+- [ ] **#1456 / PR #1457 — Codex deny-floor adapter T4 gate.** **Do not run the posted `/hooks` canaries yet.** The 2026-07-26 audit found red DCO on all four commits, no substantive review of the current head, material drift behind `main`, a v1.6.5 pin behind the installed/producer v1.6.12 floor, and unresolved root/common-directory hook discovery. First repair and synchronize the branch, settle the exact reviewed dispatcher bytes and authoritative hook source, then rerun exact-head CI and two adversarial reviews. Only after those prerequisites may the maintainer trust the project hook in a fresh interactive `/hooks` session and record allow/deny canaries; no agent can perform or substitute for that final gate.
 - [ ] **Prune the merged agent worktrees.** `git worktree remove` is blocked by the deny floor, so this is human-only and recurs after every wave (upstream: [agent-harness#41](https://github.com/Chris0Jeky/agent-harness/issues/41)). *(Added 2026-07-25.)*
 
   ```bash
   cd /c/Users/jekyt/source/Taskdeck
   git worktree remove .worktrees/claude-model-routing-canon    # docs/model-routing-canonical-pointer
   git worktree remove .worktrees/claude-sweep-0725             # docs/sweep-2026-07-25
   git worktree remove .worktrees/codex-1299-licensing-pack     # issue-1299/licensing-pack — merged as PR #1337
-  git branch -d docs/model-routing-canonical-pointer docs/sweep-2026-07-25 issue-1299/licensing-pack
+  git worktree remove .worktrees/codex-1345-sqlite-native-patch # issue-1345/sqlite-native-patch — merged as PR #1486
+  git branch -d docs/model-routing-canonical-pointer docs/sweep-2026-07-25 issue-1299/licensing-pack issue-1345/sqlite-native-patch
   ```
 
-  All three are clean and fully merged into `main`. **Keep** `.worktrees/codex-1456-codex-deny-floor-adapter` — PR #1457 is still open and its trust session runs from there.
+  All four are clean and fully merged into `main`. **Keep** `.worktrees/codex-1456-codex-deny-floor-adapter` (PR #1457 is still open) and `.worktrees/codex-1458-project-priority-pagination` (active #1458 work).
 - [ ] **Branch from an explicit base.** PR #1477 was closed-as-merged without anyone merging it. Root cause: `feat/1271-dogfooding-instrumentation` (PR #1478) was created with a bare `git checkout -b` **while standing on `fix/1123-release-dry-run`**, so it silently inherited `#1477`'s commit `0ebbf330`. Merging #1478 carried that commit onto `main`, GitHub detected `#1477`'s branch as fully merged and auto-closed it two seconds later, attributing the event to the acting token. The single-parent "rebase" appearance was GitHub recording the already-landed commit, not a rebase anyone performed. *How:* always name the base — `git checkout -b <name> main` — and verify with `git log --oneline main..<name>` before pushing. *(Added 2026-07-25. Supersedes an earlier item on this list that wrongly framed this as an unidentified autonomous merger — that alert was mine and it was wrong; caught by Codex on PR #1483.)*
 
 ---
 
 ## Changelog
+- 2026-07-27: **#1458 label remediation and external-reference policy supersede the prior checkpoint below.** The 130 missing Taskdeck Issue labels were classified and verified, and a stable 1,472-item audit found 142 remaining project-field drifts. External Issues are now recorded as visible non-authority rather than rejected: their labels never rank, external-only PRs derive `Priority V`, and canonical body fallback remains available after an external closing reference. No project-field `-Apply` had run at this checkpoint; the unchecked item remains pending a reviewed Apply and separate zero-drift audit.
+- 2026-07-26: **#1458 corrected the project-priority record and the resumable cleanup path.** The old 1,000-item helper could not prove a project-wide clean result; the complete read-only snapshot reached 1,458/1,458 items and correctly stopped on 130 issues without a Priority label. A preliminary pass saw six PR fallback candidates; the next pass falsely treated merged PR #123 as an unlabeled issue, which re-review caught. The typed rerun ignores that PR and then reaches external Issue `dotnet/efcore#35983`, which GitHub exposes as a closing reference for 12 historical Taskdeck Dependabot PRs because their release-note text links it. The safe default now rejects all cross-repository Issue authority pending any explicit future opt-in; the preliminary PR plan remains retracted pending truthful project-issue labels. No `-Apply` or audit remediation write ran; only PR #1488's own `Review` / `Priority I` project metadata was populated after opening. Added the merged #1345 worktree to the human-prunable block and retained the active #1457/#1458 worktrees. No checkbox was checked in this pass.
 - 2026-07-25 (latest): **PR queue cleared — 8 PRs merged, 1 draft left.** `#1469` (`#1462` frontend pin), `#1471`, `#1472`, `#1477`+`#1481` (`#1123` release rehearsal), `#1478` (`#1271` dogfooding instrumentation), `#1479`, and `#1337` (`#1299` licensing pack — **`#1299` closed by that merge**, residuals → `#1482`). `#1295` **closed as superseded**, with the salvage plan and acceptance criteria recorded on `#1293`. Only `#1457` remains, and its step-by-step human procedure is now on the PR. Repo hardening: force-push and deletion blocked on `main`; 288 truncation-hidden project-priority mismatches synced. Under `#1270`, 12 already-decided issues closed with dated notes — but **`#1270` stays open**, because two of its own acceptance criteria are obsolete against ADR-0044 and REVIVAL_PLAN §6 and must not be run as written. Seeded `#1470` `#1473` `#1474` `#1475` `#1476` `#1480` `#1482` and upstream `agent-harness#56`. Dogfooding baseline measured for the first time and recorded in `docs/dogfooding/LOG.md`: **sustained use has not started**, though the core loop works (17/20 proposals reached Apply). No item below was checked off in this pass.
 - 2026-07-25 (later): **#1273 and #1235 checked off — rule-3 exception, on the maintainer's explicit instruction.** During a guided walkthrough the maintainer reviewed both record-only items and said "please tick them yourself". Recorded here because rule 3 reserves check-offs to the maintainer, so the authorization — not the agent's judgement — is what permits these two. Both were delivered long ago (#1273 by #1283, #1235 by #1280 with regression coverage) and **both GitHub issues were already closed on 2026-07-03**; only the checkboxes lagged. No other item was touched, and rule 3 continues to apply to every remaining `[ ]`.
 - 2026-07-25: **Two human-only items added to §E** (no items checked off — rule 3). PR `#1469` closed `#1462` (frontend `approvedRevisionId`, now declared *required*) and the follow-up sweep `#1471` re-hydrated the canonical docs; both merged with green CI. Of the four open PRs, only `#1469` was agent-actionable — `#1295`, `#1337`, and `#1457` are all human-gated, and `#1457`'s `/hooks` trust gate plus the recurring merged-worktree pruning were the two that no file tracked, so they are recorded above. Seeded `#1470` (`DATA_MODEL.md` omits `ApprovedRevisionId`/`DeferredUntil`; stale snapshot figure). Correction on the record: `#1469`'s review comment reported 383 pre-existing spec typecheck errors for `#1468`; the figure by the documented method is **415**, and `#1468`, `#1470`, `#1469` and both canonical docs were corrected.

docs/GITHUB_PROJECT_AUTOMATION.md

@@ -2,7 +2,7 @@
 
 This document defines the canonical setup for the `Taskdeck Execution` GitHub Project.
 Use this to keep intake and status transitions consistent for every issue and PR.
-Last Updated: 2026-04-25
+Last Updated: 2026-07-26
 
 ## Canonical Status Model
 
@@ -158,7 +158,16 @@ Local helper scripts:
 - `scripts/github/Sync-TaskdeckProjectPriority.ps1` — audit issue/PR Project v2 `Priority` drift and optionally apply fixes.
 
 These helpers are fallbacks for GitHub MCP gaps. Project v2 priority audit needs `read:project`; applying field updates with `Sync-TaskdeckProjectPriority.ps1 -Apply` requires `gh auth refresh -s project`.
-The sync helper preserves an existing PR priority when no linked/referenced issue can be derived; use `-StrictFallbackPriority` only when intentionally forcing those PRs to `Priority V`.
+The sync helper enforces the PR rule above: complete same-repository closing issues take precedence over repository-aware body references, the highest derived urgency wins, and a PR with no authoritative issue references receives `Priority V`. If every closing Issue is external, the helper still evaluates the body for a same-repository fallback. Every body reference is resolved to a typed, repository-matching object. Only actual same-repository Issues contribute Priority labels. A validated PullRequest reference is ignored as a non-Issue. Cross-repository Issue authority is default-off: those references stay visible by exact PR/source/repository/number identity in human and JSON output, but their labels never enter ranking; mixed references derive only from same-repository Issues. An actual same-repository Issue whose priority is missing, ambiguous, unreadable, or identity-mismatched fails closed instead of becoming a fallback.
+
+The priority helper's completeness contract is fail-closed:
+- It walks the ProjectV2 item connection by cursor and reports clean only after the collected item count exactly matches a stable `totalCount`/`updatedAt` snapshot.
+- It rejects repeated or non-advancing cursors, ordinal duplicate item IDs, truncated label/field-value/closing-issue connections, and project changes observed during pagination.
+- External Issue or PullRequest content placed directly in the project is outside the canonical audit boundary and fails closed. This is distinct from an external Issue merely referenced by a same-repository PR, which is reported as visible non-authority.
+- `-Limit 0` (the default) means no configured ceiling. A positive `-Limit` is a safety ceiling, not a sample size; if the project is larger, the command exits nonzero without a completeness claim.
+- All same-repository project Issues with zero or multiple priority labels are aggregated and reported before any PR reference resolution. Issue priorities are never guessed; fix every listed label defect first under the issue-item rule above.
+- `-Apply` validates every planned Priority option, rebuilds the complete snapshot and source-derived update plan immediately before writes, and aborts before the first write if either plan drifts. The guarded source fingerprint includes the exact ignored external Issue occurrences, so reference identity/count drift is fatal even when the Priority update plan is unchanged. After the first write attempt it always runs a complete post-apply audit, including when a later write fails, because ProjectV2 edits are not transactional as a batch. Success output is built from that verified post-state; a partial failure reports both the writer error and whether the final state was auditable.
+- `-SelfTest` exercises the authentication-free parser/audit behavior for pagination, saturation, identity, cursor, nested-connection, typed reference authority, ignored-reference evidence/drift, plan drift, zero-write preflight, partial-writer failure, and post-apply output. Required CI runs the parser and this regression suite directly.
 
 ## Weekly Backlog Seeding Cadence (OPS-06)