chore: align manual governance lanes and truth docs

Author: xiaojiou176

.github/workflows/mutation-weekly.yml

@@ -1,16 +1,14 @@
-name: mutation-weekly
+name: mutation-manual
 
 on:
   workflow_dispatch:
-  schedule:
-    - cron: "0 3 * * 1"
 
 permissions:
   contents: read
   packages: read
 
 concurrency:
-  group: mutation-weekly-${{ github.ref }}
+  group: mutation-manual-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -102,7 +100,7 @@ jobs:
           MATRIX_TESTS: ${{ matrix.tests }}
         run: |
           set -euo pipefail
-          bash tooling/scripts/container_exec.sh --label mutation-weekly -- bash -lc '
+          bash tooling/scripts/container_exec.sh --label mutation-manual -- bash -lc '
             set -euo pipefail
             $HOME/.cache/movi-organizer/venv/default/bin/mutmut run \
               --paths-to-mutate "${MATRIX_MUTATE_PATH}" \
@@ -114,7 +112,7 @@ jobs:
           MATRIX_MODULE: ${{ matrix.module }}
         run: |
           set -euo pipefail
-          bash tooling/scripts/container_exec.sh --label mutation-weekly-report -- bash -lc '
+          bash tooling/scripts/container_exec.sh --label mutation-manual-report -- bash -lc '
             set -euo pipefail
             $HOME/.cache/movi-organizer/venv/default/bin/mutmut results | tee ".runtime-cache/logs/mutmut-results-${MATRIX_MODULE}.txt"
             $HOME/.cache/movi-organizer/venv/default/bin/python tooling/scripts/check_mutation_report.py \
@@ -130,7 +128,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
-          name: mutation-weekly-diagnostics-${{ matrix.module }}
+          name: mutation-manual-diagnostics-${{ matrix.module }}
           path: |
             .runtime-cache/logs/
             .runtime-cache/test/mutation/.mutmut-cache
@@ -218,7 +216,7 @@ jobs:
       - name: Run cargo-mutants
         if: steps.detect_rs.outputs.has_rs == 'true'
         env:
-          XDG_CACHE_HOME: ${{ runner.temp }}/organizer-mutation-weekly-xdg-cache
+          XDG_CACHE_HOME: ${{ runner.temp }}/organizer-mutation-manual-xdg-cache
         run: |
           set -euo pipefail
           cargo mutants --in-place

.github/workflows/upstream-governance-weekly.yml

@@ -1,16 +1,13 @@
-name: upstream-governance-weekly
+name: upstream-governance-manual
 
 on:
   workflow_dispatch:
-  merge_group:
-  schedule:
-    - cron: "30 5 * * 1"
 
 permissions:
   contents: read
 
 concurrency:
-  group: upstream-governance-weekly-${{ github.ref }}
+  group: upstream-governance-manual-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -60,6 +57,6 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
-          name: upstream-governance-weekly
+          name: upstream-governance-manual
           path: .runtime-cache/logs/
           if-no-files-found: warn

README.md

@@ -298,7 +298,7 @@ Public readiness gates:
 - **Supplemental gates**: `webui-build-test` (frontend correctness), `functional-gate` (critical smoke), `test` (Python version parity)
 - **Dual failure-domain required jobs**: None
 - **Shared-pool-only required jobs**: None
-- **Side workflows**: `pre-commit` bootstraps directly on hosted runners, while `live-integration` and `mutation-weekly` reuse `reusable-build-runtime-image.yml`; runtime image build keeps provenance artifact wiring when the platform supports attestations.
+- **Side workflows**: `pre-commit` bootstraps directly on hosted runners, while `live-integration` and `mutation-manual` reuse `reusable-build-runtime-image.yml`; runtime image build keeps provenance artifact wiring when the platform supports attestations.
 - **Drift / evidence surfaces**: `nightly-drift-audit.yml`, `collect_ci_run_metrics.py`, `generate_ci_evidence_bundle.py`.
 - **Local auxiliary evidence**: `npm run ci:local` writes repo-local CI metrics, a repo-local evidence bundle, and governed upstream receipts under the repo-local runtime cache directory; these are local derived reports, not Branch Protection truth. Read `truth.truth_class`, `truth.remote_traceability`, and `truth.authoritative_terminal_receipt` before treating the bundle as anything stronger. Older pass receipts remain historical audit evidence only; current closeout wording must follow the latest canonical terminal receipt.
 - **Developer fallback**: use `bash tooling/gates/pre_push_gate.sh` (`standard/strict/full`) for fast local feedback before remote CI.

docs/_generated/render_state.json

@@ -63,7 +63,7 @@
         ".github/workflows/ci.yml": "145d243beb087cd6a976d45e4455e0747ace3ee3ad9c77160b57fb17f75c63fe",
         ".github/workflows/pre-commit.yml": "ed0082256d36108f1bdb3d6c66f6f9805295a4f7f738465b0092d0b3fe0199ed",
         ".github/workflows/live-integration.yml": "87a1d413bc8d92d2103b5d4a6e19cfcb85fdb30e9e753b88a3267607a41d2b92",
-        ".github/workflows/mutation-weekly.yml": "0dd231d0ef088f8e4d6bd8ceecfda142748a22849962eaca9c354e2550374962"
+        ".github/workflows/mutation-weekly.yml": "c892aa745b913f37a4662e51ecf0c2013dc32faecd1c97d4a59f2d1e808fb101"
       },
       "output_hash": "1e9db2c2bcd9dc853fd5772bd1edabf7b910d9014dc7bc2cc78f5a835f83e588"
     },
@@ -76,7 +76,7 @@
       "source_hashes": {
         "contracts/api/web_api.openapi.yaml": "c97830844b65fd8f76cd23688187ca8648835d787d1819045882dea01e1d7b64"
       },
-      "output_hash": "560ad547242b0c1b25a236d2f2ad7028b0fb644bb243027844d8e1731d36a0da"
+      "output_hash": "cb6345e4f376224c71bddab270ce33f2a043caf985668a63c5b18cdea159c44a"
     },
     {
       "id": "root-runtime-topology",
@@ -91,7 +91,7 @@
         "package.json": "19ed161b16378601fc42d4baa05b7225fc57a47cfdee28a64131fd57d3cd1efc",
         ".env.example": "32a60792624cd36eb5992b34d9c67c6e6e2a0971a45f3a48370f3b0b720b0aa8"
       },
-      "output_hash": "560ad547242b0c1b25a236d2f2ad7028b0fb644bb243027844d8e1731d36a0da"
+      "output_hash": "cb6345e4f376224c71bddab270ce33f2a043caf985668a63c5b18cdea159c44a"
     },
     {
       "id": "root-ci-governance-summary",
@@ -106,7 +106,7 @@
         "contracts/governance/required_checks_policy.yaml": "51f9e8cb17df93c3912ae719a6ba95b74f2c666b6b11c79e1728f7002fb3e3b3",
         "package.json": "19ed161b16378601fc42d4baa05b7225fc57a47cfdee28a64131fd57d3cd1efc"
       },
-      "output_hash": "560ad547242b0c1b25a236d2f2ad7028b0fb644bb243027844d8e1731d36a0da"
+      "output_hash": "cb6345e4f376224c71bddab270ce33f2a043caf985668a63c5b18cdea159c44a"
     },
     {
       "id": "root-release-identity",
@@ -117,7 +117,7 @@
       "source_hashes": {
         "pyproject.toml": "d12c2c415c3900d81c888e91d3a8ec1af88af96a701c6de801c37a1e52b4a495"
       },
-      "output_hash": "560ad547242b0c1b25a236d2f2ad7028b0fb644bb243027844d8e1731d36a0da"
+      "output_hash": "cb6345e4f376224c71bddab270ce33f2a043caf985668a63c5b18cdea159c44a"
     },
     {
       "id": "script-readme-web-api-routes",
@@ -128,7 +128,7 @@
       "source_hashes": {
         "contracts/api/web_api.openapi.yaml": "c97830844b65fd8f76cd23688187ca8648835d787d1819045882dea01e1d7b64"
       },
-      "output_hash": "b12f14d83eedfaf64a31d9b1d02339671513f2f1cef9e6773bbfdf4db5cc1356"
+      "output_hash": "4203a15a1ce623a972a6ba31f6a28f55eaa4520db960e7529b165e1bb550e2b3"
     },
     {
       "id": "script-readme-runtime-topology",
@@ -143,7 +143,7 @@
         "package.json": "19ed161b16378601fc42d4baa05b7225fc57a47cfdee28a64131fd57d3cd1efc",
         ".env.example": "32a60792624cd36eb5992b34d9c67c6e6e2a0971a45f3a48370f3b0b720b0aa8"
       },
-      "output_hash": "b12f14d83eedfaf64a31d9b1d02339671513f2f1cef9e6773bbfdf4db5cc1356"
+      "output_hash": "4203a15a1ce623a972a6ba31f6a28f55eaa4520db960e7529b165e1bb550e2b3"
     },
     {
       "id": "script-readme-ci-governance-summary",
@@ -158,7 +158,7 @@
         "contracts/governance/required_checks_policy.yaml": "51f9e8cb17df93c3912ae719a6ba95b74f2c666b6b11c79e1728f7002fb3e3b3",
         "package.json": "19ed161b16378601fc42d4baa05b7225fc57a47cfdee28a64131fd57d3cd1efc"
       },
-      "output_hash": "b12f14d83eedfaf64a31d9b1d02339671513f2f1cef9e6773bbfdf4db5cc1356"
+      "output_hash": "4203a15a1ce623a972a6ba31f6a28f55eaa4520db960e7529b165e1bb550e2b3"
     },
     {
       "id": "script-readme-release-identity",
@@ -169,7 +169,7 @@
       "source_hashes": {
         "pyproject.toml": "d12c2c415c3900d81c888e91d3a8ec1af88af96a701c6de801c37a1e52b4a495"
       },
-      "output_hash": "b12f14d83eedfaf64a31d9b1d02339671513f2f1cef9e6773bbfdf4db5cc1356"
+      "output_hash": "4203a15a1ce623a972a6ba31f6a28f55eaa4520db960e7529b165e1bb550e2b3"
     },
     {
       "id": "script-readme-governance-truth",
@@ -184,9 +184,9 @@
         ".github/workflows/ci.yml": "145d243beb087cd6a976d45e4455e0747ace3ee3ad9c77160b57fb17f75c63fe",
         ".github/workflows/pre-commit.yml": "ed0082256d36108f1bdb3d6c66f6f9805295a4f7f738465b0092d0b3fe0199ed",
         ".github/workflows/live-integration.yml": "87a1d413bc8d92d2103b5d4a6e19cfcb85fdb30e9e753b88a3267607a41d2b92",
-        ".github/workflows/mutation-weekly.yml": "0dd231d0ef088f8e4d6bd8ceecfda142748a22849962eaca9c354e2550374962"
+        ".github/workflows/mutation-weekly.yml": "c892aa745b913f37a4662e51ecf0c2013dc32faecd1c97d4a59f2d1e808fb101"
       },
-      "output_hash": "b12f14d83eedfaf64a31d9b1d02339671513f2f1cef9e6773bbfdf4db5cc1356"
+      "output_hash": "4203a15a1ce623a972a6ba31f6a28f55eaa4520db960e7529b165e1bb550e2b3"
     },
     {
       "id": "architecture-web-api-summary",
@@ -227,7 +227,7 @@
         ".github/workflows/ci.yml": "145d243beb087cd6a976d45e4455e0747ace3ee3ad9c77160b57fb17f75c63fe",
         ".github/workflows/pre-commit.yml": "ed0082256d36108f1bdb3d6c66f6f9805295a4f7f738465b0092d0b3fe0199ed",
         ".github/workflows/live-integration.yml": "87a1d413bc8d92d2103b5d4a6e19cfcb85fdb30e9e753b88a3267607a41d2b92",
-        ".github/workflows/mutation-weekly.yml": "0dd231d0ef088f8e4d6bd8ceecfda142748a22849962eaca9c354e2550374962"
+        ".github/workflows/mutation-weekly.yml": "c892aa745b913f37a4662e51ecf0c2013dc32faecd1c97d4a59f2d1e808fb101"
       },
       "output_hash": "c0cb776be4feeaa4d6517d934e2d4f541ae1a04d66350c7bd82da6b009f710b4"
     },
@@ -244,7 +244,7 @@
         ".github/workflows/ci.yml": "145d243beb087cd6a976d45e4455e0747ace3ee3ad9c77160b57fb17f75c63fe",
         ".github/workflows/pre-commit.yml": "ed0082256d36108f1bdb3d6c66f6f9805295a4f7f738465b0092d0b3fe0199ed",
         ".github/workflows/live-integration.yml": "87a1d413bc8d92d2103b5d4a6e19cfcb85fdb30e9e753b88a3267607a41d2b92",
-        ".github/workflows/mutation-weekly.yml": "0dd231d0ef088f8e4d6bd8ceecfda142748a22849962eaca9c354e2550374962"
+        ".github/workflows/mutation-weekly.yml": "c892aa745b913f37a4662e51ecf0c2013dc32faecd1c97d4a59f2d1e808fb101"
       },
       "output_hash": "590a2ddf45c93e4e0639c4c4a077e725da6fb8c107a7567d7edb484e714a5b2b"
     },
@@ -259,7 +259,7 @@
         ".github/workflows/ci.yml": "145d243beb087cd6a976d45e4455e0747ace3ee3ad9c77160b57fb17f75c63fe",
         ".github/workflows/pre-commit.yml": "ed0082256d36108f1bdb3d6c66f6f9805295a4f7f738465b0092d0b3fe0199ed",
         ".github/workflows/live-integration.yml": "87a1d413bc8d92d2103b5d4a6e19cfcb85fdb30e9e753b88a3267607a41d2b92",
-        ".github/workflows/mutation-weekly.yml": "0dd231d0ef088f8e4d6bd8ceecfda142748a22849962eaca9c354e2550374962"
+        ".github/workflows/mutation-weekly.yml": "c892aa745b913f37a4662e51ecf0c2013dc32faecd1c97d4a59f2d1e808fb101"
       },
       "output_hash": "6f81c9b2b0e6e733c3f9eaebc0a92d2c05d246683a14750e6cb42f7d4a359700"
     },

docs/usage.md

@@ -252,7 +252,7 @@ Repo-side governance scorecard, not delivery completion:
 - **Supplemental gates**: `webui-build-test` (frontend correctness), `functional-gate` (critical smoke), `test` (Python version parity)
 - **Dual failure-domain required jobs**: None
 - **Shared-pool-only required jobs**: None
-- **Side workflows**: `pre-commit` bootstraps directly on hosted runners, while `live-integration` and `mutation-weekly` reuse `reusable-build-runtime-image.yml`; runtime image build keeps provenance artifact wiring when the platform supports attestations.
+- **Side workflows**: `pre-commit` bootstraps directly on hosted runners, while `live-integration` and `mutation-manual` reuse `reusable-build-runtime-image.yml`; runtime image build keeps provenance artifact wiring when the platform supports attestations.
 - **Drift / evidence surfaces**: `nightly-drift-audit.yml`, `collect_ci_run_metrics.py`, `generate_ci_evidence_bundle.py`.
 - **Local auxiliary evidence**: `npm run ci:local` writes repo-local CI metrics, a repo-local evidence bundle, and governed upstream receipts under the repo-local runtime cache directory; these are local derived reports, not Branch Protection truth. Read `truth.truth_class`, `truth.remote_traceability`, and `truth.authoritative_terminal_receipt` before treating the bundle as anything stronger. Older pass receipts remain historical audit evidence only; current closeout wording must follow the latest canonical terminal receipt.
 - **Developer fallback**: use `bash tooling/gates/pre_push_gate.sh` (`standard/strict/full`) for fast local feedback before remote CI.

tests/unit/test_gatekeeper_scripts.py

@@ -2262,9 +2262,9 @@ def test_ci_workflow_hardening_gate_blocks_unpinned_actions_in_mutation_weekly_w
     mutation_workflow = repo / "mutation-weekly.yml"
     mutation_workflow.write_text(
         """
-name: mutation-weekly
+name: mutation-manual
 concurrency:
-  group: mutation-weekly-${{ github.ref }}
+  group: mutation-manual-${{ github.ref }}
   cancel-in-progress: true
 permissions:
   contents: read
@@ -2367,7 +2367,7 @@ def test_ci_workflow_hardening_gate_blocks_unpinned_third_party_actions_in_mutat
     mutation_workflow = repo / "mutation-weekly.yml"
     mutation_workflow.write_text(
         """
-name: mutation-weekly
+name: mutation-manual
 jobs:
   rust-cargo-mutants:
     runs-on: [self-hosted, shared-pool]
@@ -2397,7 +2397,7 @@ def test_ci_workflow_hardening_gate_allows_local_actions_in_mutation_weekly_work
     mutation_workflow = repo / "mutation-weekly.yml"
     mutation_workflow.write_text(
         """
-name: mutation-weekly
+name: mutation-manual
 permissions:
   contents: read
 jobs:
@@ -2772,11 +2772,11 @@ def test_ci_workflow_hardening_gate_allows_runner_temp_hygiene_in_aux_workflows(
     mutation_workflow = repo / "mutation-weekly.yml"
     mutation_workflow.write_text(
         """
-name: mutation-weekly
+name: mutation-manual
 permissions:
   contents: read
 concurrency:
-  group: mutation-weekly-${{ github.ref }}
+  group: mutation-manual-${{ github.ref }}
   cancel-in-progress: true
 jobs:
   build-ci-image:
@@ -3191,11 +3191,11 @@ def test_ci_workflow_hardening_gate_requires_hygiene_script_in_live_and_mutation
     mutation_workflow = repo / "mutation-weekly.yml"
     mutation_workflow.write_text(
         """
-name: mutation-weekly
+name: mutation-manual
 permissions:
   contents: read
 concurrency:
-  group: mutation-weekly-${{ github.ref }}
+  group: mutation-manual-${{ github.ref }}
   cancel-in-progress: true
 jobs:
   build-ci-image:
@@ -3408,11 +3408,11 @@ def test_ci_workflow_hardening_gate_allows_runner_temp_cache_and_hygiene_script_
     mutation_workflow = repo / "mutation-weekly.yml"
     mutation_workflow.write_text(
         """
-name: mutation-weekly
+name: mutation-manual
 permissions:
   contents: read
 concurrency:
-  group: mutation-weekly-${{ github.ref }}
+  group: mutation-manual-${{ github.ref }}
   cancel-in-progress: true
 jobs:
   build-ci-image:

tests/unit/test_governance_dedicated_gates.py

@@ -228,12 +228,10 @@ def test_governance_wiring_includes_new_dedicated_gates() -> None:
 
     for needle in (
         "check_root_public_surface.py",
-        "check_upstream_receipts.py",
         "check_no_private_upstream_coupling.py",
         "check_done_signal_claims.py",
         "check_docs_fragment_completeness.py",
         "check_snapshot_scope_labels.py",
-        "check_gate_log_correlation.py",
         "check_collaboration_surface.py",
         "check_local_only_tracking.py",
         "check_sensitive_surface.py",
@@ -245,3 +243,13 @@ def test_governance_wiring_includes_new_dedicated_gates() -> None:
         assert needle in local_quality
         assert needle in quality
         assert needle in score
+
+    assert "check_upstream_receipts.py" in verify
+    assert "check_upstream_receipts.py" not in local_quality
+    assert "check_upstream_receipts.py" in quality
+    assert "check_upstream_receipts.py" in score
+
+    assert "check_gate_log_correlation.py" in verify
+    assert "check_gate_log_correlation.py" not in local_quality
+    assert "check_gate_log_correlation.py" in quality
+    assert "check_gate_log_correlation.py" in score

tests/unit/test_test_system_round2_audit.py

@@ -126,7 +126,7 @@ def test_weekly_mutation_workflow_covers_core_python_modules() -> None:
     repo_root = _repo_root()
     weekly = (repo_root / ".github" / "workflows" / "mutation-weekly.yml").read_text(encoding="utf-8")
 
-    _assert_contains(weekly, "name: mutation-weekly", "weekly mutation workflow header")
+    _assert_contains(weekly, "name: mutation-manual", "manual mutation workflow header")
     _assert_contains(weekly, "python-mutmut:", "weekly mutmut job")
     _assert_contains(weekly, "matrix:", "weekly mutmut matrix")
     _assert_contains(weekly, "max-parallel: 3", "weekly mutmut parallelism cap")
@@ -152,7 +152,7 @@ def test_weekly_mutation_workflow_covers_core_python_modules() -> None:
     _assert_contains(weekly, "--max-suspicious 0", "weekly mutmut suspicious threshold")
     _assert_contains(weekly, "--min-killed 1", "weekly mutmut min killed threshold")
     _assert_contains(weekly, "--require-non-empty-sample", "weekly mutmut non-empty sample threshold")
-    _assert_contains(weekly, "mutation-weekly-diagnostics-${{ matrix.module }}", "weekly mutmut per-module artifacts")
+    _assert_contains(weekly, "mutation-manual-diagnostics-${{ matrix.module }}", "manual mutmut per-module artifacts")
 
     test_paths = _extract_weekly_mutation_test_paths(weekly)
     assert test_paths, "weekly mutation workflow must define at least one tests: path"
@@ -168,11 +168,11 @@ def test_weekly_mutation_workflow_uses_hash_locked_mutmut_install() -> None:
     _assert_contains(weekly, "name: mutation-image-contract", "weekly mutation image contract artifact")
     _assert_contains(weekly, "Load CI runtime image from contract", "weekly mutation image contract load step")
     _assert_contains(weekly, 'echo "MOVI_CI_IMAGE=$IMAGE_REF" >> "$GITHUB_ENV"', "weekly image env export")
-    _assert_contains(weekly, "bash tooling/scripts/container_exec.sh --label mutation-weekly --", "weekly mutation run via container_exec")
+    _assert_contains(weekly, "bash tooling/scripts/container_exec.sh --label mutation-manual --", "manual mutation run via container_exec")
     _assert_contains(
         weekly,
-        "bash tooling/scripts/container_exec.sh --label mutation-weekly-report --",
-        "weekly mutation report via container_exec",
+        "bash tooling/scripts/container_exec.sh --label mutation-manual-report --",
+        "manual mutation report via container_exec",
     )
     _assert_contains(dev_shell, "-r requirements-dev.lock.txt", "dev shell forwards to dev lock")
     _assert_contains(dev_lock, "mutmut==2.5.1", "dev lock includes mutmut pin")

tests/unit/test_truth_surface_boundaries.py

@@ -9,7 +9,7 @@ def test_readme_keeps_terminal_truth_and_supporting_surfaces_separate() -> None:
     readme = (REPO_ROOT / "README.md").read_text(encoding="utf-8")
 
     assert "delivery-complete receipt" in readme
-    assert "Treat repository docs as guidance, not as live platform state" in readme
+    assert "treat repository docs as guidance rather than a live platform dashboard" in readme.lower()
 
 
 def test_open_source_runbook_keeps_public_boundary_separate_from_product_value_maturity() -> None: