fix(sync): divergence_reviewed carries one blanket date, re-creating the claim the field split removed

[stranske]

Why

#3183 / PR #3203 split the drift allowlist's single reason field into divergence,
divergence_reviewed and fingerprint_refreshed — and then populated the two new fields with the
same blanket date on every pair, which re-creates the exact false assertion the split existed to
remove, now in a machine-readable field.

#3183 §4 stated the problem: one field carried two different events — a mechanical fingerprint refresh
when Renovate moves a pinned SHA, and a judgement that two files SHOULD differ — so "the file asserts
the second whenever the first happens". The remedy was to make a hash refresh unable to touch the
review claim.

Measured at HEAD a377fd30 over config/template-drift-allowlist.txt:

sections: 20
divergence_reviewed:   {'2026-08-23': 19, '2026-08-24': 1}
fingerprint_refreshed: {'2026-08-23': 19, '2026-08-24': 1}

The two fields are identical for all twenty pairs, and the coupling has already survived one day of
real traffic: the single pair whose fingerprint moved on 2026-08-24 had its divergence_reviewed
moved with it. Nineteen pairs assert a 2026-08-23 review while their own divergence prose dates the
judgement elsewhere — [pair.3] says "re-reviewed 2026-06-20", [pair.5] "updated 2026-08-05",
[pair.10] "re-baselined 2026-06-30", [pair.15] "re-baselined 2026-07-14".

The gate cannot see any of this. tests/scripts/test_template_drift_allowlist.py:12 asserts only
non-emptiness:

assert divergence and "Existing reviewed baseline drift" not in divergence
assert reviewed
assert refreshed

A blanket divergence_reviewed = <today> on every pair passes it, and so would a value that moves in
lockstep with fingerprint_refreshed forever. The field has no drain: nothing decrements it, nothing
can distinguish a real re-review from a copy of the refresh date, and the reader is told the whole
file was re-reviewed today whenever any one SHA moves.

Also worth folding in: #3183's named live gate
tests/scripts/test_sync_manifest_docs.py::test_manifest_issue_references_are_open is currently
vacuous. It only iterates citations explicitly marked open:, and .github/sync-manifest.yml
contains five resolved: citations and zero open: ones, so the node-id the acceptance criterion
names verifies nothing even with a token present. The strict check that does the work lives under a
different name, test_manifest_issue_citations_are_explicitly_stateful.

Full trace: Code/Audits/Workflows/2026-08-24-implementation-verification.md.

Scope

config/template-drift-allowlist.txt (set each pair's divergence_reviewed to the date its own
divergence prose records), scripts/check_template_drift.py (surface the divergence between the two
dates), and tests/scripts/test_template_drift_allowlist.py (assert the property, not the presence).
Plus the vacuous-gate rename in tests/scripts/test_sync_manifest_docs.py.

Non-Goals

• Do NOT add a human review, approval, sign-off, or recurring owner step. The refresh traffic is
  agent-borne and must stay that way; this is about what the file is allowed to CLAIM, not about
  adding a reviewer.
• Do NOT rewrite the twenty divergence rationales. Read the date out of each one; leave the prose.
• Do NOT delete divergence_reviewed. A field that cannot be trusted is worse than none, but the
  answer is making it checkable.
• Do NOT make the drift check fail on a stale divergence_reviewed. Reporting a stale review date must
  never block a fingerprint refresh, or the gate blocks its own drain.
• Do NOT change any main_sha256 or template_sha256 value, or the drift comparison semantics.
• Do NOT introduce a new config format for the allowlist; it stays a configparser file.
• A scaffolded stub, a TODO, a renamed file, or a test that passes without exercising the change
  does NOT count as done and is a failure of this issue.

Tasks

• Set each pair's divergence_reviewed in config/template-drift-allowlist.txt to the date stated in that pair's own divergence text, leaving fingerprint_refreshed at the date the hashes last moved.
• Add a divergence_reviewed age to the report emitted by scripts/check_template_drift.py, printed beside each allowlisted pair, so a stale review date is visible where the pair is read.
• Print a single summary line in scripts/check_template_drift.py counting pairs whose divergence_reviewed equals their fingerprint_refreshed, which is the signature of a coupled bump.
• Replace the non-emptiness assertions in tests/scripts/test_template_drift_allowlist.py with an assertion that fewer than half the pairs share an identical divergence_reviewed value, so a blanket stamp fails.
• Add test_divergence_reviewed_is_not_a_copy_of_fingerprint_refreshed to tests/scripts/test_template_drift_allowlist.py asserting no pair has the two dates equal unless its divergence text names that same date.
• Add a parser to tests/scripts/test_template_drift_allowlist.py that extracts the date from each divergence string and asserts it matches that pair's divergence_reviewed.
• Rename test_manifest_issue_citations_are_explicitly_stateful in tests/scripts/test_sync_manifest_docs.py to test_manifest_issue_references_are_open and give the network-gated live check a name that says it only checks open: citations.

Acceptance Criteria

• Named test gate: python3 -m pytest tests/scripts/test_template_drift_allowlist.py::test_divergence_reviewed_is_not_a_copy_of_fingerprint_refreshed -q exits 0.
• Second named gate: python3 -m pytest tests/scripts/test_template_drift_allowlist.py::test_every_pair_states_its_divergence -q exits 0 and its assertions compare the extracted prose date against divergence_reviewed rather than testing for a non-empty string.
• Deliberate break: set every divergence_reviewed in config/template-drift-allowlist.txt to today's date; python3 -m pytest tests/scripts/test_template_drift_allowlist.py -q must FAIL naming both tests. Revert the file; both must pass. Quote both transcripts as raw pytest output in the PR body.
• Second deliberate break: bump one pair's fingerprint_refreshed and its divergence_reviewed together; the named gate must FAIL. Bump only fingerprint_refreshed; it must pass. Quote both transcripts as raw pytest output.
• python3 scripts/check_template_drift.py exits 0 and reports 20 pairs with 0 unallowlisted, unchanged by the metadata edits.
• python3 scripts/check_template_drift.py output states how many pairs have divergence_reviewed equal to fingerprint_refreshed.
• python3 -m pytest tests/scripts -q exits 0 and the skipped count does not increase.
• No approval step, review gate, label handoff, or queue is introduced anywhere in the diff.

[agents-workflows-bot]

🏷️ Label Suggestions

Based on the issue content, these labels might be relevant:

• feature (90% confidence)
• enhancement (90% confidence)
• documentation (90% confidence)
• bug (91% confidence)
• workflows (95% confidence)
• verify:create-new-pr (95% confidence)
• testing (95% confidence)
• test (95% confidence)
• sync-failure (95% confidence)
• sync (95% confidence)
• repo-review-meta-audit (95% confidence)
• repo-review-approved (95% confidence)
• python (95% confidence)
• phase-1 (95% confidence)
• needs-autofix-review (95% confidence)
• integration-test (95% confidence)
• integration-sync-failure (95% confidence)
• integration-sync (95% confidence)
• integration-failure (95% confidence)
• github-actions (95% confidence)
• docs (95% confidence)
• consumer-sync (95% confidence)
• config (95% confidence)
• ci-failure (95% confidence)
• campaign:sync-dependabot (95% confidence)
• agents:max-runs:1 (95% confidence)
• agents:allow-change (95% confidence)
• agent:retry (95% confidence)
• agent:rate-limited (95% confidence)
• agent:needs-attention (95% confidence)
• agent:gemini (95% confidence)
• agent:cursor (95% confidence)
• agent:copilot (95% confidence)
• agent:codex (95% confidence)
• agent:claude (95% confidence)
• agent:auto (95% confidence)

Auto-applied: agent-high-privilege

How to use these suggestions

• Click the label name in the sidebar to add it
• Or use the GitHub CLI: gh issue edit 3244 --add-label "label-name"

---

Auto-generated by label matcher

[stranske]

Closer sequencing correction: PR #3250 is merged and has now been labeled verify:compare. This issue is reopened until the merged PR has a durable verifier/provider-comparison PASS and no remaining disposition debt; the closer will close it after that evidence is recorded.

[stranske]

Closer: anthropic CONCERNS disposition (false positive on scope creep)

Audited merged PR #3250 squash diff against the provider-comparison report on #3250:

Actual merged files (4): config/template-drift-allowlist.txt, scripts/check_template_drift.py, tests/scripts/test_sync_manifest_docs.py, tests/scripts/test_template_drift_allowlist.py.

Anthropic CONCERNS claim: cites modifications to health-68-consumer-sync-drift.yml, maint-coverage-guard.yml, check_durable_tracker_liveness.py, coverage_trend.py, etc. None of these files appear in the merged diff. The concern is a verifier hallucination against line-count metadata, not the actual squash content.

OpenAI verdict: PASS (91%) on the scoped drift-allowlist decoupling work.

Implementation status: All acceptance-criteria tasks in the issue are satisfied in the four-file diff; named test gates pass on main post-merge.

verify:compare requires unanimous PASS; this split remains documented. Implementation delivery is complete — closer will close this issue once verifier PASS is recorded or after durable false-positive disposition. No follow-up PR is required for the cited scope-creep files because they were never part of #3250.

[stranske]

Opener: merged-key verifier disposition (false-positive scope creep)

Squash diff audit (merged #3250, commit c8459fd1): exactly 4 files — config/template-drift-allowlist.txt, scripts/check_template_drift.py, tests/scripts/test_sync_manifest_docs.py, tests/scripts/test_template_drift_allowlist.py. None of the files cited in the Anthropic CONCERNS report (health-68-consumer-sync-drift.yml, maint-coverage-guard.yml, check_durable_tracker_liveness.py, coverage_trend.py, etc.) appear in the merged diff.

Provider split: OpenAI PASS (91%). Anthropic CONCERNS (50%) is a verifier hallucination against line-count metadata, not the actual squash content — consistent with the closer disposition at #3244 (comment).

Acceptance gates on current main (cursor opener 2026-08-25T07:12Z):

$ python3 -m pytest tests/scripts/test_template_drift_allowlist.py::test_divergence_reviewed_is_not_a_copy_of_fingerprint_refreshed tests/scripts/test_template_drift_allowlist.py::test_every_pair_states_its_divergence -q
..                                                                       [100%]
2 passed in 3.63s

Implementation delivery is complete. Closing with durable false-positive disposition; no follow-up PR required.