spawn: classify the three files that reddened Spawn Drift, and catch the next one at PR time

[Jammy2211]

The failure

The weekly spawn_drift run failed on 2026-08-24 (run 32701028244) with exit 2 (UNSAFE). Three files on main matched no MIND_RULES entry, so the partition could not decide whether they travel into PyAutoMind-template:

== PyAutoMind-template
  UNMATCHED (3) — extend the spec's tables, then mirror here:
    ✗ .github/workflows/firewall_gate.yml
    ✗ .github/workflows/pages_dashboard.yml
    ✗ dashboard.html
  canary scan: clean

That is rule 9d working as designed, not a bug: there is deliberately no .github/* catch-all, because a fallback is fail-OPEN and would ride a new workflow into the template carrying whatever schedule and secrets it has. The canary scan was clean, so nothing leaked — the run stopped before proposing a sync.

Everything else in Mind CI was and is green; this was the only red workflow.

Part 1 — classify the three files (bac5102)

All three are DROP under the spec's fresh-repo invariant:

File	Rule	Why
firewall_gate.yml	9c	Checks out PyAutoLabs/{PyAutoBrain,PyAutoHeart,PyAutoHands} by name — dashboard_refresh.yml's failure mode three times over. A fresh org has no such siblings, and owner substitution only turns them into YOURORG/... placeholders
pages_dashboard.yml	9c	Needs a GitHub Pages site the default token cannot create on a fresh repo — the Hands lesson already recorded for Memory's knowledge_board.yml — and takes pages: write + id-token: write
dashboard.html	new 7c	The Pages twin of dashboard.md. DROP rather than 7b's EMPTY: there is no broken-link argument to answer, since no shipped file links it and its publisher is dropped above

Spec tables extended first, then mirrored into spawn.py, per the error message's own instruction. Also fixed a stray "The rest They" in the 9c cell being rewritten.

Part 2 — catch the next one at PR time (661be2b)

The three files reached main because nothing at PR time ever looked at the real file list. Closing that needs two changes; either alone is inert.

Dropped spawn_drift's pull_request: paths filter. It watched the generator — spawn.py, tests/, the spec, itself. That is the wrong input set: the partition's other input is the source tree, so a PR adding a file that matches no rule is exactly what needs checking and exactly what the filter excluded. None of the three offenders touched a watched path, so the workflow never ran on their PRs. This is cheap rather than heavy, because the drift job is already skipped on pull_request — a PR runs only the hermetic privacy job (pytest, synthetic inputs, no clones, no secrets, no writes).

Added test_no_tracked_file_is_unmatched_by_mind_rules. Widening the trigger alone would have caught nothing: every other test in that file builds a synthetic tree, so it only covers file classes somebody remembered to add to the fixture. The new test reads git ls-files and asserts every tracked path resolves to a MIND_RULES entry — the same condition the drift job reports as UNMATCHED/exit 2, minus the clones.

MEMORY_RULES cannot be checked from this checkout (PyAutoMemory is not a sibling), so it stays covered by the weekly run.

Verification

• 0 of 1395 tracked files now UNMATCHED, down from 3 — the exact condition that failed
• lifecycle_drift.yml still resolves to KEEP, so rule 9 has not over-dropped
• 187 tests pass; lifecycle check and lifecycle index --check both OK
• Workflow YAML re-parsed: pull_request: with no value fires on all PRs, and the drift job's skip gate is unchanged
• Negative probes, both non-vacuous: removing the firewall_gate rule again fails test_check_exit_codes_are_the_self_heal_contract on exit != EXIT_CLEAN; adding a tracked .github/workflows/zzz_probe.yml fails the new test, naming the file and both places to fix it

Expected follow-on

This converts exit 2 (UNSAFE, hard stop) into exit 1 (DRIFT). Once on main, the next scheduled or dispatched run takes the self-heal path at spawn_drift.yml:92 and proposes a sync PR against the published template repos — the designed happy path, but it does mean a follow-up PR will appear.

---

Generated by Claude Code