fix: restore local governance guards

Author: xiaojiou176

tests/unit/test_test_system_round2_audit.py

@@ -459,8 +459,16 @@ def test_local_fast_and_standard_prepush_align_with_ci_core_gates() -> None:
         'step fast-lane bash "$ROOT/gates/local_quality_gate.sh" fast',
         "pre-push strict fast lane",
     )
-    assert "check_upstream_verification_freshness.py" not in local_quality_gate
-    assert "check_upstream_receipts.py" not in local_quality_gate
+    _assert_contains(
+        local_quality_gate,
+        "check_upstream_verification_freshness.py",
+        "local upstream freshness guard",
+    )
+    _assert_contains(
+        local_quality_gate,
+        "check_upstream_receipts.py",
+        "local upstream receipts guard",
+    )
     _assert_contains(
         local_quality_gate,
         "check_gate_log_correlation.py",

tooling/gates/local_quality_gate.sh

@@ -15,9 +15,10 @@ set -euo pipefail
 #   - Runs targeted checks on changed files only
 #   - Falls back to full check if detection fails
 #
-# Receipt-driven governance checks stay in tooling/gates/quality_gate.sh after
-# summary generation. Keeping them out of fast/prepush-lite preserves the
-# advertised local-burn envelope and avoids false reds on clean local clones.
+# Summary-dependent receipt synthesis still belongs to tooling/gates/quality_gate.sh.
+# The local lanes keep the cheaper closeout guards that validate upstream freshness,
+# upstream receipts, and gate-log correlation without forcing the full quality-gate
+# summary pipeline on every routine local run.
 
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(dirname "$DIR")"
@@ -346,6 +347,8 @@ run_fast() {
   run_parallel_step upstream-drift "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_drift.py" --root "$REPO_ROOT"
   run_parallel_step upstream-registry "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_registry_completeness.py" --root "$REPO_ROOT"
   run_parallel_step upstream-compat "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_compat_matrix.py" --root "$REPO_ROOT"
+  run_parallel_step upstream-freshness "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_verification_freshness.py" --root "$REPO_ROOT"
+  run_parallel_step upstream-receipts "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_receipts.py" --root "$REPO_ROOT"
   run_parallel_step upstream-host-capabilities "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_host_capabilities.py" --root "$REPO_ROOT"
   run_parallel_step upstream-fetch "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_fetch_surfaces.py" --root "$REPO_ROOT"
   run_parallel_step private-upstream-coupling "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_no_private_upstream_coupling.py" --root "$REPO_ROOT"
@@ -472,6 +475,8 @@ run_prepush_lite() {
   run_parallel_step upstream-drift "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_drift.py" --root "$REPO_ROOT"
   run_parallel_step upstream-registry "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_registry_completeness.py" --root "$REPO_ROOT"
   run_parallel_step upstream-compat "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_compat_matrix.py" --root "$REPO_ROOT"
+  run_parallel_step upstream-freshness "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_verification_freshness.py" --root "$REPO_ROOT"
+  run_parallel_step upstream-receipts "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_receipts.py" --root "$REPO_ROOT"
   run_parallel_step upstream-host-capabilities "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_host_capabilities.py" --root "$REPO_ROOT"
   run_parallel_step upstream-fetch "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_upstream_fetch_surfaces.py" --root "$REPO_ROOT"
   run_parallel_step private-upstream-coupling "$VENV/bin/python" "$REPO_ROOT/tooling/scripts/check_no_private_upstream_coupling.py" --root "$REPO_ROOT"