feat(engines): GT-716 AC4 — the named backlog is implemented or declared; nothing coverage-only by omission

[beyondnetPeru]

What

GT-716 AC4: the named backlog is implemented or declared, none of it left in coverageOnly by omission.

Implemented — the OPA-only side of engine-coverage-parity.baseline.json is empty on both scenarios (was 7 / 7):

• TelemetryEvidenceRuleHandler decides OBS-EVD-01..03 from the satellite's dependencies — the same proxy and package lists telemetry-evidence.rego reads, so the same verdict. The rules declare satellite.packageJson and nothing they do not read; telemetryBackend leaves the vocabulary (84 facets).
• McpRuleHandler decides MCP-05 from the server source (the tokens mcp.rego looks for) and fails MCP-01..03 on absent smoke evidence with the policy's own words — the evidence is an observed fact of the checkout; its absence is the finding.

Declared, in the rule where the declaration belongs:

• SEC-INJ-01/02, SEC-PATH-01/02, SEC-TIMING-01/02, SEC-RL-03 declare satellite.findings: a scanner's finding over the AST, not a regex over the tree (MM-R10 forbids that kind of handler). unimplemented-native 21 → 14, needs-external-system 27 → 33.
• QT-05 declares satellite.testing and SdlcRuleHandler no longer claims it — "always passes (requires runtime analysis)" was a fixed answer, not a verdict. It leaves the native-only baseline (82 → 81 / 49 → 48).

Recorded, and enforced — .harness/scripts/ci/engine-coverage-decisions.json. Every baseline entry whose class is debt (no-policy-in-bundle, unimplemented-native, handler-declined, opa-gave-no-reason, undecided) must carry a decision — native-only / opa-only / neither — or guard 73 fails it as coverage-only by omission; a decision the runs contradict (its rule decided by both engines, or by the engine it said would not) fails too. Eight decisions: SSDF-*, SLSA-*, SEC-RL-01/02, MM-R* ×11, the enforcer-routed HXA-01/02/04/05 (native-only, each with why and what reopens it); the 138 generated ADR-conformance rules as a neither pattern — documentation-only on both engines, now that OpaEvaluator states the declaration's class for a policy-less rule whose facts: [] say there is nothing to check; the seven scanner rules and QT-05 as neither.

Falsifier, observed before it was trusted

The extended guard's first run went red on MM-R03 (decision modular-monolith-native-only) — modular-monolith.rego decides it and both engines agree, which the register had not said — and green once the id left the decision.

Not done as the criterion first phrased it

No .rego twin was authored for the 11 no-policy rules. Each is a recorded decision instead: SSDF/SLSA — the input builder projects none of what the handler reads, so a twin is the same check behind a second projection; SEC-RL-01/02 — a source scan; MM-R* — an import graph the OPA path does not carry until GT-514's seam feeds it.

Costs and side effects

• Pins: native-handler 171 → 173, needs-runtime 23 → 22; blocking rules that do not run 73 → 71 (5 handlers, 21 adapters, 14 runtime, 27 postures, 4 authoring); unclaimed 106 → 104. Snapshot, ISO 5055 mapping and the standards README (EN/ES) re-derived: backlog 14 (5 adoptable, 0 partial, 9 to author).
• Guard 68 gains one registered conflict, GOV-RULE-NON-EXECUTABLE: on its --core-less run the native engine resolves the corpus to the CLI's bundled copy and fails the 138 ADR-conformance rules (0 non-executable) while OPA now counts 138; with --core . both engines emit the identical row. Moving 68 onto the export is AC5's.
• Parity fixtures follow the handlers; OPA README, known-limitations and the CLI's bundled copy updated (EN/ES). Board and catalog (EN/ES) carry AC4 as met in ea736a75; AC5 stays open.

Verified locally

core-domain 2098 specs green (incl. 19 guard-73 unit tests); guards 73, 68, 27, 46 (fixed point), 08, 09, 01, 04, 66, 47, 49, 50, 42, 43 green; npm run build:policy green (415 rules checked, 84 facets).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

📊 Bilingual Coverage Impact

PR Changes

• Paired EN/ES files modified: 6
• New EN files needing ES translation: 0

Repository Coverage

Metric	Value
Total EN files	527
Total ES files	497
Paired files	0
Coverage	0%

✅ Good: All EN changes have ES counterparts.

---

Generated by GitHub Actions

[beyondnetPeru]

CI caught the native twin of telemetry-evidence.rego failing a freshly initialised satellite on OBS-EVD-01..03 (Test infra-providers, the GT-571 invariant: a scaffold does nothing wrong) — exactly what --engine opa had been doing on every scaffold. Fixed in a6a415b8 the way MTN-05 was: the three rules declare appliesFromSdlcPhase: 3 (Construction), which is what their text says (production request paths and services), so both engines exclude them before running on a phase-0 scaffold and bind unchanged from Construction on. Deferral test added; catalog updated.

[beyondnetPeru]

Second catch from the same job, visible only on a checkout without the gitignored .harness/evidence/: with the native engine now failing MCP-01..03 on absent smoke evidence (as mcp.rego does), a fresh satellite validated against a Core with no evidence got three blocking findings addressed to the Core — GT-571's complaint verbatim. 076efb60: the MCP pack declares audience: core (its scope: core-cli always said so; the CLI packs already declare it), so both engines exclude MCP-* on a satellite and still decide all five on the Core. Reproduced locally by hiding the evidence file; MCP-01 pinned in the GT-571 exclusion list.