[frostyard-machines]

Summary

This PR brings clix to frostyard's repository baseline (core ADR-0071, spec, rows B1 to B17): the checklist that every frostyard code repository carries and that the weekly conformance sweep checks. clix is the CLI library that updex and the other frostyard tools import, so its gate, its release path and its security policy must meet the same bar as the rest of the org. It follows the shape of frostyard/std#97 and frostyard/repogen#89. clix met most rows already; this PR closes B4, B5, B6, B7, B14 and B17, extends B3, and adds a guard test. It changes no product code.

• B4: ci: verify. make verify is now a prerequisite of ci instead of a recursive $(MAKE) verify line in the recipe; the recipe keeps the race detector, the coverage-instrumented tests, the coverage-script self-test and the 95.0% floor. Same steps, same order.
• B12: already met: the Unit Tests job runs make ci (ADR-0073 form 1). Job ids and names do not change, so the required checks stay the same.
• B5: ci.yml gets a top-level permissions: contents: read (it had none, so jobs took the repository default). Every actions/checkout sets persist-credentials: false (8 checkouts). release.yml had contents: write at the top level: now the top level is permissions: {} and the same scope is on its only job goreleaser. GoReleaser publishes through GITHUB_TOKEN in its env, not through the git credentials.
• B6: new .github/risk-paths.json (9 globs) and .github/workflows/risk-paths.yml, the caller of core's reusable workflow pinned at 1b02a129 (core#194). Core's validateRiskPaths returns ok.
• B7: ## Risk tier section in the PR template; the Checks list adds make ci.
• B14: new SECURITY.md: only the latest tag gets fixes (today v0.5.0); reports through https://github.com/frostyard/clix/security (private vulnerability reporting is on: gh api repos/frostyard/clix/private-vulnerability-reporting → {"enabled":true}); email fallback; scope (flag checks, JSON output, error rendering, BindViper).
• B17: root README.md rewritten as kind library (ADR-0072, spec: README). Core's checker prints ok README.md (library, 405 words). The consumer rules that left the README (flags and the reserved-flag rule, repeated Run calls, RunContext, reporter priority, JSON output outcomes, error rendering, the writer seams, BindViper) moved, checked against the code, to the new spec docs/specs/consumer-api.md. readme_example_test.go still compiles the README's package main program and now resolves every clix.<Ident> in the README and in the spec against the exported API.
• B3: docs/org-adrs.md adds ADR-0040, 0042, 0043, 0044, 0053, 0068, 0071, 0072, 0073, restates ADR-0022 (make ci is the canonical gate), and names ADR-0070 as not applicable (library).
• golangci-lint 2.13.1 → 2.15.0: the fleet pin from the frostyard-go-repo skill's Fleet toolchain table; mise lock regenerated mise.lock. It reports 0 issues with no code change. Go stays at toolchain go1.26.10: the Go 1.27 bump is the B11 follow-up.
• Guard: tests/baseline/baseline_test.go, a test-only package (stdlib only), 1 test per row the tree can show (B1 to B8, B10, B12 to B17), the same guard as std#97. It reads the committed tree with git ls-files -s -z and skips when git is unusable. The pure checks (the uses: pin, the checkout credentials, the top-level permissions, the Dependabot entries) have table tests with failing fixtures.
• Drift fixes: AGENTS.md (the gate triad, tests/baseline/, the README standard, SECURITY.md, risk paths), docs/design/overview.md (test packages, workflow permissions, the risk-paths workflow, "v0.4.0 and earlier" in the error-rendering note), docs/README.md (spec index), tests/e2e/README.md, .claude/session-summary.md (its state was from August).

No product change: git diff origin/main --stat -- clix.go errors.go flags.go output.go reporter.go go.mod go.sum tests/e2e/exampletool is empty. The Go files in the diff are readme_example_test.go and the new tests/baseline/baseline_test.go.

Inventory

clix had no agent-framework tree at the root (the yeti/ move was done earlier, ADR-0001 and core ADR-0025), and docs/plans/ holds only its template. Every path that is not product code:

File or group	Verdict	Reason
AGENTS.md; CLAUDE.md, GEMINI.md, .cursorrules, CONTRIBUTING.md, .github/copilot-instructions.md (symlinks)	keep; AGENTS.md updated	B1, ADR-0001 aliases.
.claude/settings.json, .claude/skills → .agents/skills	keep	B16 allowed names; settings deny merge, approve, release.
.claude/session-summary.md	keep, update	Its state was from August.
.agents/skills/	keep	Synced from core (ADR-0026); not edited. The open sync PR #106 changes only this tree, so the 2 PRs do not conflict.
.memory/README.md, .memory/corrections.jsonl	keep	B2 (empty inbox, valid).
docs/README.md, docs/{adr,design,specs,plans}/ with TEMPLATE.md, alias files docs/{quality,metrics,review-rubric}.md	keep	B3. ADR-0001 not changed.
docs/specs/consumer-api.md	add	The consumer rules that left the README (B17).
docs/org-adrs.md	keep, update	B3: 9 ADRs added, ADR-0070 not applicable.
Makefile, mise.toml, mise.lock	keep, change	B4 (ci: verify); golangci-lint 2.15.0.
.golangci.yml, .svu.yml, .goreleaser.yaml, .editorconfig, .gitignore, .coverage-thresholds.json	keep	Not changed.
.github/workflows/ci.yml	keep, change	B5 (top-level contents: read, persist-credentials).
.github/workflows/release.yml	keep, change	B5 (permission to the job, no persisted credentials).
.github/workflows/risk-paths.yml, .github/risk-paths.json	add	B6.
.github/pull_request_template.md	keep, change	B7.
.github/dependabot.yml	keep	B13: gomod and github-actions already.
.github/ISSUE_TEMPLATE/, .github/prompts/	keep	Issue templates and the review prompt (AGENTS.md names them).
policies/agent-governance.json	keep	Fluent enrollment surface. Not changed.
scripts/ (coverage floor and its self-test, docs gate)	keep	Gate scripts. Not changed.
readme_example_test.go	keep, change	Also checks the Go blocks of the new spec.
tests/e2e/	keep	e2e suite; only its README text changes.
tests/baseline/	add	The baseline guard.
README.md	keep, rewrite	B17.
SECURITY.md	add	B14.
LICENSE	keep	B10, MIT.

Counts: 0 framework trees, 0 deleted, 5 added, 14 changed, 0 moved (the README facts moved into 1 new spec).

Baseline rows

Row	Status	Why
B1 Instruction surface	done (already)	AGENTS.md 100644, 5 aliases 120000 → AGENTS.md. New test.
B2 Corrections inbox	done (already)	File present, no invalid line. New test.
B3 Docs shape	done	org-adrs adds 9 ADRs. New test.
B4 Make gate and pins	done	ci: verify; mise.toml, mise.lock. New test.
B5 Pinned, least-privilege actions	done	All uses: SHA-pinned with a version comment; top-level permissions read-only or {}; every checkout persist-credentials: false. New test.
B6 Risk paths	done	List + caller; release workflow, release config, make bump, workflows, policy, gate scripts. New test.
B7 PR template	done	## Risk tier. New test.
B8 svu	done (already)	.svu.yml, make bump runs svu next. New test.
B9 Docs site	exempt	Library: pkg.go.dev documents it (spec exemption table, ADR-0070).
B10 License	done (already)	MIT; gh api → MIT. New test.
B11 Go toolchain	follow-up PR	toolchain go1.26.10; the fleet is Go 1.27. golangci-lint is at the fleet pin 2.15.0 in this PR (no code change). The Go bump can change behavior: separate PR.
B12 CI entry	done (already)	ci.yml, job Unit Tests runs make ci on pull requests. New test.
B13 Dependabot	done (already)	gomod, github-actions. New test.
B14 Security policy	done	SECURITY.md; private vulnerability reporting is on. New test.
B15 No CODEOWNERS	done (already)	New test.
B16 No framework trees	done (already)	.claude/ holds the 3 allowed names. New test.
B17 README	done	Kind library; core checker ok. New test (marker and pkg.go.dev link).

Follow-up: B11 Go 1.27 toolchain PR.

Risk tier

• Tier 1: Low
• Tier 2: Moderate
• Tier 3: High
• Tier 4: Critical

Rationale: risk:high: the PR touches the workflows, the release workflow and the gate. The list is new in this PR, so the base has no list for the workflow to read; the label is set by hand. Each path that the new list matches, and why the change is safe:

• .github/workflows/release.yml: only the permissions: block moves from the top to the single job goreleaser, with the same contents: write; the token the job gets does not change. The checkout adds persist-credentials: false; GoReleaser uses GITHUB_TOKEN from its env. TestBaselineB5ActionsPinned pins the top level.
• .github/workflows/ci.yml: job ids and names unchanged; top-level contents: read (each job needs only to read the repository; security and release-config already set it on the job); persist-credentials: false on every checkout; no step changes.
• .github/workflows/risk-paths.yml, .github/risk-paths.json: new; pull_request_target, top level {}, the job gets contents: read and pull-requests: write, checks out nothing, runs core's reusable workflow pinned by full SHA.
• Makefile: ci gets verify as its prerequisite in place of the recursive call; same steps in the same order; bump not changed.
• mise.toml, mise.lock: golangci-lint 2.13.1 → 2.15.0 (checksums by mise lock, provenance = "github-attestations").

The tag release cannot run on a pull request, so the permission move is shown by the guard test, not by a release run; the next tag shows it.

Verification

• make ci (umask 022): exit 0, check-coverage: observed total statement coverage 97.0% (required >= 95.0%).
• make check: passed; make fmt changed no file.
• node scripts/check-docs.mjs: checked: 6 docs, 157 links, 9 symlinks.
• Core README checker (origin/main): ok README.md (library, 405 words).
• go mod tidy -diff: empty. golangci-lint 2.15.0: 0 issues.
• Core's validateRiskPaths on .github/risk-paths.json: ok, 9 globs.
• Revert test (scratch worktree at 5435466, removed after): with Makefile, ci.yml, release.yml, the PR template and README.md from the base, and without SECURITY.md and .github/risk-paths.json, go test -count=1 ./tests/baseline/ fails TestBaselineB4MakeGate, TestBaselineB5ActionsPinned (no top-level permissions in ci.yml, 8 checkouts without persist-credentials: false, contents: write at the top of release.yml), TestBaselineB6RiskPaths, TestBaselineB7PRTemplate, TestBaselineB14SecurityPolicy and TestBaselineB17Readme.
• CI at 307bda8: all 7 checks pass. The Risk paths workflow runs from the base branch (pull_request_target), which has no caller yet, so risk:high is set by hand on this PR.

Cross-review

Coder: deepseek/deepseek-flash, with edits by the author (claude-opus). Reviewer: openai/gpt-6.1-sol (cross-family), read-only.

• Initial review at 5435466 (base e820582; all 18 authored paths; mise.lock excluded from line review, checked to move only golangci-lint 2.13.1 → 2.15.0): Ready, Blocking: none. The reviewer confirmed that make ci keeps its steps and order, that Unit Tests still runs make ci, that no workflow loses a scope it needs (GoReleaser keeps job-level contents: write and needs no persisted git credentials), that the consumer-API spec and SECURITY.md agree with the code, and that the guard tests can fail.
• 3 non-blocking findings: (1) the B17 guard checks only the kind marker and the pkg.go.dev link, not R1 to R12: kept as a limit, now stated in AGENTS.md (core's checker holds R1 to R12; it reaches clix with the skills sync PR chore: sync agent skills from frostyard/core #106); (2) the README checker command in AGENTS.md passed . from a core checkout: fixed in 307bda8; (3) "a fourth workflow" in the overview: fixed in 307bda8.
• Re-review 1 at 307bda8 (delta from 5435466): Ready, Blocking: none.