docs(governance): CRG v2.0 STRICT audit — C (declared) -> D (honest)

One-grade demotion. Annotation discipline and test-count honesty are
the cleanest of any recent C-candidate:
- 19/19 SPDX headers
- 22 declared Deno tests = 22 grep-verifiable (honest count)
- Real module doc-blocks
- Populated docs/governance/

But C fails on three independent axes:

1. No [dogfooding-status] section + [maintenance-status]
   last-run-utc = "never". No evidence of dogfood or operational
   use of any kind.

2. Zero .github/workflows/*.yml invoke deno / cargo / zig. The 22
   tests exist but run only locally. CI-green clause fails because
   CI doesn't run the tests at all — a novel failure mode this
   session (neurophone had red CI, ephapax had parse-fail CI, this
   one has tests-never-run CI).

3. ~8,000 LOC of AffineScript + Idris2 + Zig is written but never
   typechecked / built / run in CI. The repo's main claim of
   substance sits unverified.

HYP-S005 blind spot surfaced:
- session-sentinel uses sectioned [crg]/grade, not flat crg-grade.
  The existing self-consistency canary reads only flat form. Rule
  drift: HYP-S005 needs to match both schema shapes (same finding
  as gossamer audit earlier today).

Secondary findings:
- TypeScript language-policy breach: the one file that supposedly
  buys the C grade is tests/validate.test.ts (TS banned, no test
  carve-out). Same pattern as double-track-browser, fireflag,
  modshells.
- Honest caveats vs dishonest File Map in same doc: EXPLAINME top
  says "src/panels/ was not present at the time of this writing"
  but the File Map at the bottom cites src/panels/manifest.json
  as real. Internal inconsistency, not pure fabrication.
- verification/proofs/ README is 15 bytes.
- 8 verification subtrees are pure stubs, no .idr proof files.
- Duplicate scaffold at systems-ecosystem/ambientops/session-sentinel/
  needs canonical-vs-duplicate disposition.

Route-to-C:
1. (M) Port the TypeScript test to ReScript or Rust.
2. (S) Wire CI to actually run deno/cargo/zig (any real build+test
   signal — "tests exist but nobody runs them" is the hardest shape
   to lift).
3. (S) Populate [dogfooding-status] if any real downstream exists.
4. (L) Either realise the 8,000 LOC of proof material or delete the
   stubs and declare narrower scope.
5. (S) Pick canonical vs duplicate for the ambientops copy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath