docs(governance): CRG v2.0 STRICT audit — C (declared) -> D (honest)

One-grade demotion. Re-triage of Bucket-A exempt (v0.9.0, 74%) — the
self-consistency canary no longer flags, so a full evidence audit was
required.

Positive case is unusually strong vs today's other C-claimants:
- Honest EXPLAINME (30+ File Map entries all present on disk — zero
  fabrication, distinguishing this from proof-of-work / fireflag /
  reposystem / misinformation-defence-platform)
- Zero banned languages (no TypeScript / Python / Go / package.json /
  Dockerfile)
- Test counts match grep (honest)
- Disciplined PROOF_HOLES_AUDIT

But C is not earned. Four non-negotiable clauses fail:

1. CI red 30/30 recent runs on rust-cli.yml. validation.yml
   verify-proofs is gated `if: false` — so Coq/Lean/Agda/Isabelle/Z3
   proof systems aren't verified in CI at all. Prior audit-2026-04-04
   read YAMLs and declared "COMPREHENSIVE, WELL-MAINTAINED" without
   checking run history — that assessment was wrong.

2. 404 sites of .expect("TODO: handle error") anti-pattern across 17
   files in impl/rust-cli/src/ — applied mechanically in bulk.
   Identical panic + fake-debt marker. LARGEST instance estate-wide
   (hesiod-dns-map had ~40 sites earlier today). This is the proximate
   cause of the CI red — the logs flag these sites.

3. No [dogfooding-status] + no real dogfood evidence.

4. Per-directory README coverage 5 of 22 subtrees (~23%).

Proof-state honesty drift:
- STATE [coq-proof-status] admitted = 0.
- proofs/coq/filesystem_composition.v:199 contains undeclared `admit.`.
  Policy gaming — one axiomatic escape hatch hidden from STATE claim.

Secondary findings:
- ANCHOR.a2ml still says version: "1.0.0" (Sonnet-era drift the
  2026-02-12 Opus audit cleaned elsewhere but missed here).

Route-to-C (concrete, largest rocks first):
1. (XL) Revert the 404 .expect("TODO") sites to .unwrap() or real
   error handling. Unblocks CI and closes the single largest
   anti-pattern instance in the estate.
2. (M) Fix the Coq admit. at filesystem_composition.v:199 OR update
   STATE to admit = 1 — eliminate the discrepancy either way.
3. (S) Ungate validation.yml verify-proofs so Coq/Lean/Agda/Isabelle/Z3
   actually run in CI.
4. (M) Populate [dogfooding-status] with real consumers if any.
5. (M) Write 17 missing per-directory READMEs (5/22 -> 22/22).
6. (S) Reconcile ANCHOR.a2ml version.

Defect profile note: valence-shell isn't gamed, it's *broken* on one
anti-pattern sweep. Different failure mode than the
fabrication / scope-fraud / banned-language patterns seen in the other
13 audits this session.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath