docs(governance): fold in codex round-2 review findings (6 issues)

External Codex CLI review pass 2 surfaced 6 substantive issues that
round 1 fold-in missed — the self-consistency trap recurred when fold-in
was scoped only to files codex explicitly named in round 1. This commit
closes round 2 in full.

1. ADR 0002 contradicted ALIGNMENT.md (P1, codex round 2 finding 1)
   ADR 0002 still said "three default-enabled (Anthropic, OpenAI Codex,
   Mistral Vibe)" while ALIGNMENT.md (post round 1) said v0.1 ships zero
   Enabled Providers. Accepted ADR contradicted constitution.
   Fix: ADR 0002 + ADR 0001 + docs/adr/README.md index rewritten to
   Candidate framing.

2. release.yml would publish stale v0.1.0-bootstrap notes (P1, round 2
   finding 2)
   The "Unreleased" amendments would have been silently dropped on tag
   push because release.yml extracts only the matching version section.
   Fix: CHANGELOG restructured so the amended state IS the v0.1.0-
   bootstrap section. Full review history (opus + 2 codex rounds)
   captured inline.

3. package.json advertised non-existent entrypoints (P2, round 2
   finding 3)
   main/scripts.test/scripts.start pointed to files that do not exist.
   Local npm test and npm start failed; CI masked.
   Fix: remove all three from package.json. They return in Phase 1
   alongside the real files. test.yml bootstrap-tolerance updated to
   also skip when scripts.test is absent.

4. models-registry.json missing despite SPOT claim (P2, round 2
   finding 4)
   Fix: minimal stub committed (version + empty providers map).
   alignment.yml validator now actually runs.

5. alignment.yml commit-citation soft check Bash subshell trap (P2,
   round 2 finding 5)
   git log ... while read ... WARN=1 — the while loop ran in a subshell
   because of the pipe, so WARN never propagated out. The post-loop
   check always reported "clean" even when warnings fired.
   Fix: process substitution done less than less than (git log ...).

6. Tier A "permanent" wording inconsistent across ADR 0006 + alignment.
   yml workflow text (P3, round 2 finding 6)
   Fix: unified to "Excluded by default with no routine reinstatement
   path; re-inclusion requires ADR 0006 supersession or amendment with
   new primary-source evidence."

Reviewer: OpenAI Codex CLI (external, fresh-context, pass 2). Iron Rule
10 satisfied — round 2 reviewer was not the implementer of round 1
fold-in.

Memory learning updated: the self-consistency trap recurs in the fold-in
step. Future fold-ins must grep the entire repo for the concept, not
only edit files the reviewer named. See learnings/ai_reviewer_self_
consistency_trap.md in cross-machine memory.

Co-Authored-By: Claude Opus 4.7 (noreply@anthropic.com)

.github/workflows/alignment.yml

@@ -89,7 +89,7 @@ jobs:
           for token in "${FORBIDDEN_PROVIDER_TOKENS[@]}"; do
             HITS="$(echo "$SOURCE_FILES" | xargs grep -n -F "$token" 2>/dev/null || true)"
             if [ -n "$HITS" ]; then
-              echo "::error::Tier-A-excluded provider token '$token' detected in OLP source. Per ALIGNMENT.md / ADR 0006, this provider is permanently excluded."
+              echo "::error::Tier-A-excluded provider token '$token' detected in OLP source. Per ALIGNMENT.md / ADR 0006, this provider is excluded by default; re-inclusion requires ADR 0006 supersession/amendment with new primary-source evidence."
               echo "$HITS"
               FAIL=1
             fi
@@ -101,7 +101,7 @@ jobs:
             echo "ALIGNMENT GUARDRAIL FAILURE"
             echo "============================================================"
             echo "OLP source contains a token on the alignment blacklist or"
-            echo "references a permanently excluded provider."
+            echo "references a Tier-A-excluded provider."
             echo ""
             echo "Blacklist tokens were introduced by LLM hallucinations and"
             echo "do not appear in the relevant authority (provider CLI,"
@@ -110,8 +110,10 @@ jobs:
             echo "record at https://github.com/dtzp555-max/ocp."
             echo ""
             echo "Excluded providers are listed in ALIGNMENT.md \xc2\xa7 Risk Tier"
-            echo "Framework and ADR 0006. Permanent exclusion means not"
-            echo "bundled, not pluggable, not added via opt-in."
+            echo "Framework and ADR 0006. Tier-A exclusion means not"
+            echo "bundled, not pluggable, not added via opt-in;"
+            echo "re-inclusion requires ADR 0006 amendment with new"
+            echo "primary-source evidence."
             echo ""
             echo "Required action:"
             echo "  1. Remove the token from source."
@@ -191,8 +193,14 @@ jobs:
             exit 0
           fi
 
+          # Use process substitution `< <(...)` rather than piping into the
+          # while loop. A piped while runs in a subshell, so `WARN=1` would
+          # never propagate back out to this scope — the if-check below would
+          # always report "clean" even when warnings were emitted. Classic
+          # Bash subshell trap; see commit history for the codex review that
+          # caught this.
           WARN=0
-          git log --format="%H" "${BASE_SHA}..${HEAD_SHA}" | while read -r sha; do
+          while read -r sha; do
             BODY="$(git log -1 --format=%B "$sha")"
             if echo "$BODY" | grep -E -i -q '(provider|claude|codex|vibe|grok|kimi|minimax|glm|qwen|cli)[[:space:]]+(code[[:space:]]+)?uses'; then
               if echo "$BODY" | grep -E -i -q '(cli[[:space:]]+v[0-9]+|https?://|ADR[[:space:]]+[0-9]{4})'; then
@@ -202,7 +210,7 @@ jobs:
                 WARN=1
               fi
             fi
-          done
+          done < <(git log --format="%H" "${BASE_SHA}..${HEAD_SHA}")
 
           if [ "$WARN" -ne 0 ]; then
             echo "Soft check raised warnings. Reviewer: please enforce per CLAUDE.md."

.github/workflows/test.yml

@@ -46,12 +46,12 @@ jobs:
       - name: Run npm test
         shell: bash
         run: |
-          # Bootstrap tolerance: if test-features.mjs does not exist yet (Phase 0
-          # ships before Phase 1 lands the test harness), skip with a notice.
-          # The `npm test` script is configured in package.json from day one, so
-          # checking script presence is not a useful gate — the file must exist.
-          if [ ! -f test-features.mjs ]; then
-            echo "::notice::test-features.mjs not present yet (Phase 0 bootstrap phase). Skipping. Test harness lands with Phase 1 per docs/adr/0001 / spec §6."
+          # Bootstrap tolerance: skip if either test-features.mjs is absent OR
+          # package.json has no scripts.test entry. v0.1 founding ships
+          # neither — both land with Phase 1 per spec §6. Once one or both
+          # are present, this guard falls through to `npm test`.
+          if [ ! -f test-features.mjs ] || ! node -e "p=require('./package.json');process.exit(p.scripts&&p.scripts.test?0:1)" 2>/dev/null; then
+            echo "::notice::Phase 0 bootstrap: test-features.mjs absent OR scripts.test not declared in package.json. Skipping. Both land with Phase 1 per docs/adr/0001 / spec §6."
             exit 0
           fi
           npm test