chore(registry): pre-commit drift guard + document 2026-06-03 session (#368)

Wrap-up for the 2026-06-03 registry + workflow session (#356, #366, #363
all merged).

## Config update — anti-drift guard

`hooks/pre-commit` now runs `bash scripts/build-registry.sh --check`
(only where the generator exists, so the shared estate hook is safe
elsewhere). If a tracked file under a spec home — or `STATE.a2ml` —
changes without regenerating the derived registry/topology, the commit
is blocked locally with a fix hint, **instead of** red-ing
`registry-verify` on `main`.

> This is the local backstop for the failure mode that reded `main`
three times this session (spec-home edits, including in-home
`.github/workflows/*`, merged without `build-registry.sh`). The
remaining estate-side piece — making `registry-verify` a **required**
check — is noted as follow-up.

## Documentation

- `STATE.a2ml`: new `[session-history-2026-06-03]` block (PRs
#356/#366/#363, the external-pointer registry + HYP-S006 capabilities,
and the two open follow-ups); `last-updated`/`maintenance-status`
refreshed; `version` 0.2.0 → 0.3.0.
- `TOPOLOGY.md`: regenerated from the updated `STATE.a2ml` (derived
file, not hand-edited).
- `CHANGELOG.md`: **intentionally untouched** — it's generated from
conventional commits by `changelog-reusable.yml`; the merged
`feat(registry)`/`fix(ci)` commits flow in automatically.

## Verification

- `build-registry.sh --check` → **OK** (green).
- `bash -n hooks/pre-commit` → syntax OK.
- `REGISTRY.a2ml` unchanged (STATE isn't a spec home; only
`TOPOLOGY.md`'s `last-updated` moved).

https://claude.ai/code/session_0178nMYCNXgotTeekePkoUjd

---
_Generated by [Claude
Code](https://claude.ai/code/session_0178nMYCNXgotTeekePkoUjd)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/6a2/STATE.a2ml

@@ -9,10 +9,10 @@
 
 [metadata]
 project = "standards"
-version = "0.2.0"
-last-updated = "2026-06-02T18:00:00Z"
+version = "0.3.0"
+last-updated = "2026-06-03T00:00:00Z"
 status = "active"
-session = "2026-06-02 inbox cleanup + license-policy hardening + estate sweeps"
+session = "2026-06-03 AffineScript external-pointer registry + registry-verify repair + workflow startup_failure fixes"
 
 [project-context]
 name = "Standards"
@@ -39,9 +39,26 @@ actions = [
 ]
 
 [maintenance-status]
-last-run-utc = "2026-06-02T18:00:00Z"
+last-run-utc = "2026-06-03T00:00:00Z"
 last-result = "pass"  # unknown | pass | warn | fail
 
+[session-history-2026-06-03]
+session = "2026-06-03 AffineScript external-pointer registry + registry-verify repair + workflow startup_failure fixes"
+prs-merged = [
+  "#356 feat(registry): index AffineScript .affine/.affex/.affmap as verified external pointers (fold into main's generated registry)",
+  "#366 fix(registry): regenerate to clear accumulated source_hash drift (registry-verify red on main)",
+  "#363 fix(ci): clear residual workflow startup_failures (secrets-in-if, hashFiles-in-job-if)"
+]
+capabilities-added = [
+  "Registry now indexes EXTERNAL specs (kind=external): verified pointers (canonical_url + version_pin + recorded source_hash) to specs whose SSOT is another repo. AffineScript v2 (.affine/.affex/.affmap, SSOT hyperpolymath/affinescript) are the first; source_hash sentinel PENDING-FIRST-SYNC until upstream lands.",
+  "HYP-S006 (registry-staleness) extended to verify external pointers by re-fetching canonical_url (network-side), rejecting md5/sha1, capping external re-pin to :review.",
+  "hooks/pre-commit gains a registry/topology drift guard (runs build-registry.sh --check where the generator is present) so spec-home edits can't merge stale and red main."
+]
+notes = [
+  "registry-verify went red on main 3x this session: spec-home content (incl. in-home .github/workflows/*) was merged without `bash scripts/build-registry.sh`. The pre-commit guard above is the local backstop; making registry-verify a REQUIRED check is the remaining estate-side follow-up.",
+  "Open follow-up: teach hypatia secret_action_without_presence_gate to accept an env-mapped-from-secret gate (instant-sync false-positive after the secrets-in-if fix)."
+]
+
 [session-history-2026-06-02]
 session = "2026-06-02 inbox cleanup wave + license-policy hardening + estate sweeps"
 prs-merged = [

TOPOLOGY.md

@@ -8,7 +8,7 @@
 > `.machine_readable/6a2/STATE.a2ml` by `scripts/build-registry.sh`.
 > It cannot freeze: every regeneration re-reads ground truth. Do not edit by hand.
 
-- **Phase:** active   |  **Maturity:** experimental   |  **STATE last-updated:** 2026-06-02T18:00:00Z
+- **Phase:** active   |  **Maturity:** experimental   |  **STATE last-updated:** 2026-06-03T00:00:00Z
 - **Registry entries:** 31 specs across 6 streams
 - **Front door:** human → [README.adoc](README.adoc); machine → [0-AI-MANIFEST.a2ml](0-AI-MANIFEST.a2ml)
 - **Registry:** [.machine_readable/REGISTRY.a2ml](.machine_readable/REGISTRY.a2ml) (index + source hashes) · prose: [REGISTRY.adoc](REGISTRY.adoc)

hooks/pre-commit

@@ -74,6 +74,23 @@ for file in $SOURCE_FILES; do
     fi
 done
 
+# Registry / topology drift guard (standards repo only — runs where the
+# generator is present). The verifiable spec registry records a content
+# hash per spec home; when a tracked file under a home changes without
+# regenerating, the recorded source_hash goes stale and registry-verify.yml
+# reds main. (It did, three times, when spec-home edits merged without a
+# regenerate.) Catch it locally, before the commit, instead of in CI.
+if [ -f scripts/build-registry.sh ]; then
+    if ! bash scripts/build-registry.sh --check >/dev/null 2>&1; then
+        echo -e "${RED}✗ REGISTRY.a2ml / TOPOLOGY.md are stale — regenerate before committing.${NC}"
+        echo "  A tracked file under a spec home (or STATE.a2ml) changed without"
+        echo "  regenerating the derived registry/topology."
+        echo "  Fix:  bash scripts/build-registry.sh"
+        echo "        git add .machine_readable/REGISTRY.a2ml TOPOLOGY.md"
+        ERRORS=$((ERRORS + 1))
+    fi
+fi
+
 # Final result
 echo ""
 if [ $ERRORS -gt 0 ]; then