Register WP01 repository inventory and drift checks

.github/workflows/pr-gate.yml

@@ -35,7 +35,7 @@ jobs:
           if ($LASTEXITCODE) { throw 'Invalid package version.' }
           "value=$version" >> $env:GITHUB_OUTPUT
   managed-packages:
-    needs: [allocate-version, native, secret-scan, repository-hooks, design-policy, licence-policy, provenance-policy, reference-policy, runtime-policy]
+    needs: [allocate-version, native, secret-scan, repository-hooks, design-policy, licence-policy, provenance-policy, reference-policy, runtime-policy, reconciliation-policy]
     uses: ./.github/workflows/package-validation.yml
     with:
       version: ${{ needs.allocate-version.outputs.version }}
@@ -172,6 +172,30 @@ jobs:
           if-no-files-found: error
           retention-days: 30
 
+  reconciliation-policy:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Reject incomplete inventory and linked source
+        run: python -m unittest discover -s eng -p test_reconciliation.py -v
+      - name: Verify historical and current immutable project trees
+        run: python eng/reconciliation.py
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: reconciliation-policy-${{ matrix.os }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: artifacts/evidence/reconciliation.json
+          if-no-files-found: error
+          retention-days: 30
+
   provenance-policy:
     strategy:
       fail-fast: false
@@ -203,7 +227,7 @@ jobs:
 
   ci:
     if: always()
-    needs: [allocate-version, managed-packages, native, secret-scan, repository-hooks, design-policy, licence-policy, provenance-policy, reference-policy, runtime-policy]
+    needs: [allocate-version, managed-packages, native, secret-scan, repository-hooks, design-policy, licence-policy, provenance-policy, reference-policy, runtime-policy, reconciliation-policy]
     runs-on: ubuntu-latest
     env:
       CI_NEEDS: ${{ toJSON(needs) }}

README.md

@@ -111,3 +111,6 @@ There are no Git submodules. Contracts publishes independently from its own revi
 
 [Runtime and source ownership](docs/runtime-ownership.md) records the current nine-owner
 policy, bounded runtime checks and retained bootstrap/scaffold dispositions.
+
+[Current repository reconciliation](docs/reconciliation-inventory.md) binds current projects,
+historical dispositions and planned directory owners to exact source and candidate identities.

docs/reconciliation-inventory.md

@@ -0,0 +1,13 @@
+# Current repository reconciliation
+
+The [WP01.00 Design profile](https://github.com/ArcForges/ArcForges-Design/blob/33bcddd9508ec60c0a2b0d7b53901ee7f50d0a70/docs/assurance/wp01-00-inventory-policy.md) governs `eng/policy/reconciliation/`.
+
+- `source.json` binds the Design authority, WP00 candidate receipt and historical tree.
+- `current.json` records nine clean primary commits, their worktrees, 75 build projects and exact published candidate identities. Worktree observations are historical local state, not instructions to read adjacent sources during a build.
+- `historical.json` gives all 166 ede43db C# projects an owner, target, reason and disposition, including already absent projects. Absence never means the feature is complete.
+- `directories.json` assigns current and planned directories to one repository and scheduled producer. Keep can mean required future content; no empty placeholder is authorized.
+- `native.json` keeps historical native admission decisions separate from project counts.
+
+Run `python -m unittest discover -s eng -p test_reconciliation.py -v`, then `python eng/reconciliation.py`. CI checks Windows and Linux before packing. The default run fetches eight immutable owner snapshots plus pinned Design, audits this DesktopPlatform checkout, and verifies all historical/current paths and recorded candidate identities. It does not build adjacent source or call a provider. A fresh read-only family audit accepts all nine `--repository Owner=absolute-root` arguments and an optional local `--design-root`; its report states actual commits, cleanliness and whether each snapshot is current.
+
+The WP00 receipt supplies the already verified public NuGet/npm/Maven/native/desktop/Web/Android/Cloud/AI evidence. The checker validates its exact hash and source identities, not current registry availability or new runtime behavior. Changes to the inventory require review against actual Git trees and the producing step; do not edit a count to hide a missing entry. The existing runtime, licence and provenance checks remain required. Full contract assignment, shared content review, native surface work, test-family mapping and physical moves remain WP01.01 through WP01.05.