Refresh the carried intent docs against the hub

[ptr727]

spec/audit.py only presence-checks the sections of an intent-fidelity carried file, so these four drifted silently while every byte-locked region stayed green. Hand-diffing each against the hub found stale paragraphs in all four, plus a set of guarantees this repo describes but does not implement.

Audit run 2026-08-03T16:52:36Z | hub 1ed0cc8, read against develop@39c896b. Every hub change referenced here is promoted to hub maina9cd154.

CODESTYLE.md

The ## Python section is restored. The file's own intro says a repo keeps it whole and that an unused-language section costs nothing - trimming it contradicted the sentence directly above the cut. It is inert here, like the [*.cs] block a non-.NET repo keeps in .editorconfig.

Four stale paragraphs re-vendor:

• The clean-compile bullet is now "Run it after every code change, and it is not the whole gate", with the CI remainder spelled out and links to GOVERNANCE.md "Verification Discipline" and "Running the Linters Locally". Both anchors resolve here.
• MD033 now explicitly permits details and summary.
• Item 4 is reframed as "HISTORY.md mirrors the README opening". The old local wording also hardcoded the project name into a rule about mirroring.
• The intro, TreatWarningsAsErrors, and Directory.Packages.props bullets all drifted.

One adaptation is not the hub's bytes: the Python tasks-mirror pointed at catalog/snippets/configs/vscode-tasks-python.json, a hub path this repo does not have, so it now names the repo's own .vscode/tasks.json. That is what the file's own VS Code config rule requires - "a [vscode-tasks] reference must point wherever the repo actually keeps tasks.json" - and it keeps a carried file from linking to a path that does not exist here.

The repo-local #### The Full Post-Change Set and the InternalsVisibleTo project names are kept. The latter is a declared placeholder in spec/files.json.

WORKFLOW.md

Two re-vendors:

• D2.2 now explains that on smoke the check exits early while the job still reports success, and why a job-level if: would be wrong. This repo's validate-release already behaves exactly that way (exit 0 inside the step).
• D4.2 names GitCommitId, which is what get-version-task.yml already outputs and what github-release already passes as target_commitish.

Five guarantees described machinery this repo does not have - a paths-filter changes job, smoke-build needing the validation job, and a publish-plan-task.yml. Each is adapted to what the tree actually does:

	Was described as	Actually
D1.1	paths-filter marks changed targets	no filter; every push builds both targets
D1.2	smoke-build needs the validation job	validate and smoke-build are siblings; the aggregator needs both
D1.4	workflow-only changes skip smoke	smoke-built like anything else, against the pushed head
D1.5	aggregator needs the changes job	check-workflow-status needs [validate, smoke-build]
D4.1	a plan job gates a bot push to main	no plan job and no push trigger; dispatch or the weekly main schedule only

Both absences are stricter than the guarantee, not looser: every push smoke-builds, and no push publishes at all. So the fix is to state the repo's shape rather than build machinery it does not want. Scenarios S1, S2, S3, S5 and S6 are corrected the same way.

.github/copilot-instructions.md

Only the fleet-carried runbook sections change; everything from ## Project Overview down is this repo's own content and is untouched.

• Triggering and Polling still scoped the suppressed-finding query to the current head. That is how a finding stops appearing without ever being answered - a push does not retire it, since a suppressed finding has no resolved state. It now reads every round and marks which round each came from.
• The reviewer-login note gains the third spelling: the REST timeline's bare Copilot, which a filter written for either of the other two silently misses.
• Bounded Retry Workflow gains the pending-request-nobody-picked-up state, which is invisible from the reviews alone and indistinguishable from patience, plus the clear-and-re-request recovery.

repo-config/README.md

One paragraph. The file is now byte-identical to the hub.

Deliberately not in this PR

D4.5 stays out. This repo's WORKFLOW.md is missing it entirely, and the pipeline does not satisfy it - build-docker does not need build-executable, so a failed executable build still pushes the image. Stating the guarantee before implementing it would replace a silent gap with a false claim, so it lands with its fix in the next PR.

Verification

• repo-config/README.md and the two re-vendored WORKFLOW.md guarantees are byte-identical to the hub canonical.
• Every link reference in all four files resolves, with no unused definitions.
• CRLF preserved throughout.
• dotnet husky run clean, editorconfig-checker clean, hub prose gate clean on the changed lines.

Second of four in the round. Follows #39.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.37%. Comparing base (39c896b) to head (d101603).

Additional details and impacted files

@@ Coverage Diff @@## develop #40 +/- ##
========================================
Coverage 43.37% 43.37% ========================================
Files 28 28 Lines 3896 3896 Branches 306 306 ========================================
Hits 1690 1690 Misses 2154 2154 Partials 52 52 

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Updates this repository’s carried “intent” documentation to match the hub canonical (and to accurately describe this repo’s actual CI/release mechanics where the hub text assumed different machinery), keeping governance/intent docs consistent with current workflows and tooling.

Changes:

• Refreshes WORKFLOW.md guarantees and scenarios to reflect this repo’s no-paths-filter PR workflow and no-push publish model, and clarifies smoke/skip semantics for release validation.
• Restores and re-vendors the ## Python section and other drifted prose in CODESTYLE.md, including updated markdownlint/verification guidance and link targets.
• Updates the Copilot review runbook in .github/copilot-instructions.md to avoid head-scoped suppressed-finding blind spots and to document the “pending-but-not-picked-up” reviewer state.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
WORKFLOW.md	Aligns documented workflow guarantees/scenarios with this repo’s actual PR validation and release triggers (no paths filter; publish only on schedule/dispatch).
CODESTYLE.md	Re-vendors drifted guidance and restores the Python section per whole-file carry model, plus updated verification/markdownlint notes and references.
.github/copilot-instructions.md	Improves the Copilot review-loop runbook to correctly surface suppressed findings across all rounds and handle stuck pending requests.
repo-config/README.md	Minor prose alignment to match hub wording for repo settings application details.