docs: record aFIPC required workflow coverage gap

PR_GOVERNANCE_AUDIT.md

@@ -139,13 +139,15 @@ still remain PR-head capability checks.
 | Bucket | Repositories | Scheduler implication |
 |---|---|---|
 | Public target repos with central required Strix, OpenCode, and scheduler | `.github`, `ContextualWisdomLab.github.io`, `appguardrail`, `bandscope`, `clearfolio`, `codec-carver`, `contextual-orchestrator`, `hyosung-itx-slogan-brief`, `naruon`, `newsdom-api`, `pg-erd-cloud`, `scopeweave` | Treat central required workflows as the rollout mechanism. Do not add repo-local copies only to satisfy governance. |
+| Public target repos missing central required Strix, OpenCode, and scheduler | `aFIPC` | Do not drain or merge the PR queue until organization ruleset `18156473` targets the default branch and produces current-head central review evidence. |
 | Public target repos with repo-local Strix/OpenCode/scheduler copies | `.github`, `ContextualWisdomLab.github.io`, `appguardrail`, `clearfolio`, `codec-carver`, `naruon`, `newsdom-api`, `pg-erd-cloud`, `scopeweave` | Retire thick local copies only after central required workflow runs prove stable for that repo's current heads. |
 | Public target repos with partial or no local governance workflow footprint | `bandscope`, `contextual-orchestrator`, `hyosung-itx-slogan-brief` | They are still centrally governed by ruleset `18156473`; local absence is not a required-workflow gap. |
 | Public forks | `argos`, `html4tree`, `nonnest2`, `seedream_evasepic`, `vooster`, `vooster-v2-mvp` | Fork status is not a categorical exclusion; onboarding is an explicit repository decision, and PR mutation remains capability-gated per head. |
 
 | Repo | Flow | Default | Auto | Central required workflows | Repo rules/protection | Repo required checks | Stale dismissal | Open PRs | Local workflow footprint | Recent merged actor |
 |---|---:|---:|---:|---|---|---|---:|---:|---|---|
 | `ContextualWisdomLab/.github` | GitHub Flow | `main` | on | Strix; OpenCode; scheduler | `Lock default branch` | none | ruleset true | 25 | Copilot; OpenCode Review; PR Review Merge Scheduler; Strix Security Scan | #80 `seonghobae`; #79 `seonghobae`; #78 `seonghobae` |
+| `ContextualWisdomLab/aFIPC` | GitHub Flow | `master` | off | missing on PR #78 | repo ruleset `PR` only | `check`, `quality`, `secret-and-workflow-audit` | ruleset false | 1 | CodeQL; Dependency Review; R-CMD-check; quality/security audit | #45 `seonghobae`; #43 `seonghobae`; #38 `seonghobae` |
 | `ContextualWisdomLab/ContextualWisdomLab.github.io` | GitHub Flow | `main` | on | Strix; OpenCode; scheduler | `Lock default branch` | none | ruleset true | 9 | Copilot; OpenCode Review; PR Review Merge Scheduler; Strix Security Scan; Pages | #25 `seonghobae`; #15 `seonghobae`; #14 `seonghobae` |
 | `ContextualWisdomLab/appguardrail` | Git Flow | `develop` | on | Strix; OpenCode; scheduler | `Lock default branch`, `PR` | none | mixed: true/false by repo ruleset | 0 | CodeQL; OpenCode Review; PR Review Merge Scheduler; release/security; Strix Security Scan | #133 `seonghobae`; #131 `seonghobae`; #115 `seonghobae` |
 | `ContextualWisdomLab/bandscope` | Git Flow | `develop` | on | Strix; OpenCode; scheduler | `Lock default branch`; classic branch protection | `CodeQL`, `ci / build-and-test`, `dependency-review`, `gate / build / macos`, `gate / build / windows`, `release-preflight`, `sbom`, `security-audit`, `trivy-fs-scan` | ruleset true; classic false | 81 | OpenCode Review; PR Review Merge Scheduler; many app/security workflows | #451 `github-actions`; #459 `seonghobae`; #458 `seonghobae` |
@@ -206,6 +208,7 @@ both separately; a change can improve one while harming the other.
 | `ContextualWisdomLab.github.io` | Site and documentation changes make reader-facing UX review concrete. | Review comments that say only that a check failed do not help the site reader or maintainer understand the issue. | Treat documentation clarity, homepage behavior, and status-check explanations as UX surfaces. |
 | `hyosung-itx-slogan-brief` | The repo now inherits the central required workflows and has local review/merge workflow names without heavier required checks, which makes it a lightweight GitHub Flow fixture. | It lacks the default-branch lock/stale-dismissal policy used by most organization repos. | Leave autonomous merge disabled unless that policy gap is intentional; otherwise add the standard default-branch lock before relying on autonomous merge. |
 | `contextual-orchestrator` | It now inherits central required workflows without carrying local governance workflow copies, which is the desired no-copy posture. | With no local branch lock, no stale-dismissal policy, no auto-merge, and no open PRs, inherited checks alone do not prove useful runtime behavior. | Use the next real PR as a proof fixture; add a default-branch lock only if autonomous merge is desired. |
+| `aFIPC` | It has real PR pressure and a domain-specific requirement: fixed parameter item calibration changes must reproduce true parameters before estimates can be trusted. | PR #78 shows the central required workflows are absent; the repo ruleset requires only local checks and zero approvals, so a direct merge would bypass the central review contract. | Add or repair the organization required-workflow ruleset target for `master`, then require current-head OpenCode approval, Strix, scheduler, and the true-parameter FIPC test before merging lower-number PRs. |
 
 ## Current Scheduler Contract
 
@@ -328,6 +331,7 @@ PR #381: wait: OpenCode review is already in progress
 - `naruon` PR #756 completed the repo-local rollout for the scheduler contract. Its initial head failed backend governance and Scorecard because `actions: write`/`contents: write` were broader than the repo policy allows; the amended and merged head restores minimal `GITHUB_TOKEN` permissions, keeps `trigger_reviews` and `enable_auto_merge` defaulted off, keeps `update_branches` defaulted on, and still dry-runs PR #694/#721 as `update_branch`.
 - `update-branch` `422/403` now has a safe fixture: unit tests simulate both permission-denied and stale `expected_head_sha` failures, assert they become `action_error`, and assert later PRs are still inspected. A real live `422/403` case is still useful as operational evidence, but it is no longer missing from the decision contract test surface.
 - `bandscope` PR #378 exposed a self-referential failed-check loop after manual retry run `28155083916`: the retry run succeeded and approved step execution, but the check rollup still contained the cancelled older `OpenCode Review/opencode-review` run `28152862698`, so OpenCode posted current-head `CHANGES_REQUESTED` review `4569063977` with the banned generic `No deterministic missing-string markers...` text. The collector now excludes OpenCode's own check by check name and by both actual (`OpenCode Review`) and legacy (`OpenCode PR Review`) workflow names before failed-check fallback evidence is built.
+- `aFIPC` PR #78 is the current negative fixture for target coverage drift: head `bc78373f59310b6fbee76d1a5a72fb3d84fc84eb` has local `check`, `quality`, and `secret-and-workflow-audit` checks, but no central `opencode-review`, `strix`, or `scan-pr-queue`; repository ruleset `12815994` requires zero approving reviews. This PR must not be merged until organization required-workflow evidence exists on the current head.
 - Public repo drift is real, not hypothetical: only `.github` matched the central scheduler/workflow byte-for-byte in the 2026-06-26 scan. Some drift is policy-specific and should not be overwritten blindly, but `bandscope` had behaviorally unsafe drift and now has PR #459 merged downstream.
 - The previous drift response still over-indexed on copying. `bandscope` PR
   #460 proved the correction: even when the copied scheduler produced the right

docs/org-required-workflow-rollout.md

@@ -1,6 +1,6 @@
 # ContextualWisdomLab central required workflow rollout
 
-Updated: 2026-06-29 16:45 KST
+Updated: 2026-06-29 16:33 KST
 
 ## Decision
 
@@ -65,6 +65,7 @@ The active ruleset targets the public, non-fork repositories found by live GitHu
 | Repository | Default branch | Flow | Open PRs | Default-branch workflow footprint | Local central-workflow copies | Rollout status |
 | --- | --- | --- | ---: | --- | --- | --- |
 | `ContextualWisdomLab/.github` | `main` | GitHub Flow | 0 | OpenCode, scheduler, Strix | central source; keep | PR `#100` merged; verify ruleset `18156473` points at `.github@main` |
+| `ContextualWisdomLab/aFIPC` | `master` | GitHub Flow | 1 | local R/security checks only | none | drift: PR `#78` lacks inherited OpenCode, Strix, and scheduler required-workflow checks |
 | `ContextualWisdomLab/ContextualWisdomLab.github.io` | `main` | GitHub Flow | 1 | none | none | migrated; re-verify before final closure |
 | `ContextualWisdomLab/appguardrail` | `develop` | Git Flow | 1 | none | none | migrated; re-verify before final closure |
 | `ContextualWisdomLab/bandscope` | `develop` | Git Flow | 1 | none | none | no local central copies observed; verify inherited checks on next PR |
@@ -110,6 +111,7 @@ The active ruleset targets the public, non-fork repositories found by live GitHu
 - The organization ruleset API reports the central required workflows ruleset as `active` and inherited by each public non-fork target repository.
 - `.github` PR `#100` added required-workflow job rerun support and cancels older same-PR OpenCode runs before retrying the current head. Local verification on head `3c62c37a4deabdb0c6ed4ddf0951c1987f09866b`: `pytest -q` passed 38 tests, `coverage report --fail-under=100` reported 100%, `interrogate --fail-under=100 .` reported 100%.
 - `.github` PR `#100` merged at 2026-06-29 05:45 KST with merge commit `81408f3dbe0a3c43dc4b76133f72a5e314df8a10`. A follow-up admin check should verify organization ruleset `18156473` is no longer pinned to `refs/heads/codex/rerun-required-opencode-job`.
+- On 2026-06-29 16:33 KST, `ContextualWisdomLab/aFIPC` PR `#78` proved a target coverage gap: the PR had local `check`, `quality`, and `secret-and-workflow-audit` check runs, but no inherited `opencode-review`, `strix`, or `scan-pr-queue` check runs. The repository ruleset `PR` (`12815994`) required only those three local checks and required zero approving reviews. Do not merge `aFIPC` PRs until current-head central review evidence is present.
 
 ## Good patterns to keep
 
@@ -127,3 +129,4 @@ The active ruleset targets the public, non-fork repositories found by live GitHu
 - Some repositories still have local Strix/OpenCode/scheduler workflows. Do not copy more workflows into repositories; retire local copies only after repository tests and docs are rewritten to the central required-workflow contract.
 - Repositories with local autofix/update workflows, especially `pg-erd-cloud`, need an explicit central autofix contract before local workflows are removed.
 - Some repositories use classic branch protection while others use rulesets. Normalize branch protection into rulesets without removing repository-specific required application checks.
+- `aFIPC` must be added to the organization required-workflow ruleset, or the ruleset target conditions must be repaired, before its PR queue can be drained under the central-review contract. The repository-local `PR` ruleset alone is insufficient because it does not create OpenCode/Strix/scheduler evidence and allows zero required approvals.

tests/test_pr_governance_audit_contract.py

@@ -14,3 +14,18 @@ def test_html4tree_public_fork_queue_requires_central_review_gate():
     assert "PR #3 is the lowest open PR" in audit
     assert "has no check runs and no reviews" in audit
     assert "do not bypass the review gate" in audit
+
+
+def test_afipc_queue_requires_central_required_workflow_evidence():
+    """Guard the aFIPC central required-workflow coverage gap."""
+    audit = Path("PR_GOVERNANCE_AUDIT.md").read_text(encoding="utf-8")
+    rollout = Path("docs/org-required-workflow-rollout.md").read_text(
+        encoding="utf-8"
+    )
+
+    assert "aFIPC" in audit
+    assert "aFIPC" in rollout
+    assert "PR #78" in audit
+    assert "PR `#78` lacks inherited OpenCode, Strix, and scheduler" in rollout
+    assert "zero approving reviews" in audit
+    assert "must not be merged until organization required-workflow evidence exists" in audit