feat(ci): dashboard-check — fail the build when dashboards diverge from STATE

Structural defence against the estate's #1 recurring defect ("dashboards
that lie": a human-facing status surface claiming more than the
machine-readable STATE, e.g. the historical TOPOLOGY "100% Production
Ready" vs STATE 60%/Grade-D).

New Rust workspace crate `crates/dashboard-check` (Rust = the policy-
preferred CLI language) parses `.machine_readable/6a2/STATE.a2ml` — a2ml is
TOML, so it uses the `toml` crate, not a bespoke reader — extracts
completion-percentage / crg-grade / last-updated (tolerating januskey's
quoted "60"/"D" and other repos' bare integers), and asserts they match
TOPOLOGY.md (`OVERALL: …%`, `Grade X`) and READINESS.md (`CRG Grade: X`),
plus that the dashboard's `Last updated` is not older than STATE's. Exits
non-zero with a precise diff on divergence.

- 8 unit tests over pure extract/reconcile fns (quoted + bare parsing,
  each drift class, the aligned pass case, and a prose-shadowing regression
  where a note mentioning "OVERALL" must not shadow the real dashboard line).
- Verified end-to-end: passes on this repo (reconciled); catches an
  injected 100%-vs-60% drift with the exact "completion mismatch" message.
- Wired as `just check-dashboard` and CI workflow `Dashboard Check`
  (SPDX header, contents:read perms, SHA-pinned actions).
- TOPOLOGY.md's "source of truth" note now records that agreement is
  machine-enforced.

Prototyped in januskey; designed to be vendored estate-wide (every repo
has the same STATE.a2ml + dashboard shape).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015qwVESTcbfanY2iJPQNoSz

Author: claude

.github/workflows/dashboard-check.yml

@@ -0,0 +1,30 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# dashboard-check.yml — fail the build when a hand-maintained status dashboard
+# (TOPOLOGY.md / READINESS.md) diverges from the machine-readable STATE.a2ml.
+# Structural defence against the "dashboards that lie" failure mode.
+name: Dashboard Check
+
+on:
+  pull_request:
+    branches: ['**']
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+jobs:
+  dashboard-check:
+    name: STATE vs dashboard reconciliation
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+
+      - name: Reconcile dashboards against STATE.a2ml
+        run: cargo run -q -p dashboard-check -- --check .

Cargo.lock

@@ -2,7 +2,7 @@
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
 
 [workspace]
-members = ["crates/reversible-core", "crates/januskey-cli"]
+members = ["crates/reversible-core", "crates/januskey-cli", "crates/dashboard-check"]
 resolver = "2"
 
 [workspace.package]

Cargo.toml

@@ -31,6 +31,10 @@ fmt:
 lint:
     cargo clippy --workspace -- -D warnings
 
+# Fail if a hand-maintained dashboard diverges from STATE.a2ml (source of truth)
+check-dashboard:
+    cargo run -q -p dashboard-check -- --check .
+
 # Run benchmarks
 bench:
     cargo bench --workspace

Justfile

@@ -57,6 +57,9 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 > CRG grade **D**) and `READINESS.md` (Grade **D — Alpha, Unstable**). This
 > dashboard is a human-readable summary of those files; if they disagree,
 > they win. Percentages below are qualitative, not measured coverage.
+> This agreement is now **machine-enforced**: `just check-dashboard`
+> (crate `crates/dashboard-check`, CI job `Dashboard Check`) fails the build
+> if the `OVERALL` percentage or grade here drifts from STATE.a2ml.
 
 ```
 COMPONENT                          STATUS              NOTES

TOPOLOGY.md

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
+
+[package]
+name = "dashboard-check"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+authors.workspace = true
+description = "Fails CI when a hand-maintained status dashboard diverges from the machine-readable STATE.a2ml (the source of truth). Kills the 'dashboards that lie' failure mode at the root."
+
+[[bin]]
+name = "dashboard-check"
+path = "src/main.rs"
+
+[dependencies]
+toml = "0.8"