[B2] Replace generic self-built governance checks with mature OSS

[SisyphusZheng]

Part of #1155 and #1192. Target: continuous Beta.2.x cleanup; residual closure in beta.2.3.

Objective

Alongside each verified responsibility migration, replace generic repository-owned governance with pinned mature tools and delete duplicated custom machinery.

Scope

• Renovate for supported Deno/npm/JSR/GitHub Actions dependency updates
• Gitleaks and GitHub secret protection
• markdownlint-cli2 and lychee
• actionlint and zizmor
• CodeQL and OpenSSF Scorecard
• publint and Are The Types Wrong against packed artifacts
• CODEOWNERS, issue forms, PR templates, and generated release notes
• AutoFlow/checker inventory and deletion of generic duplicate authority

Acceptance

• Mature tools run reproducibly and fail CI non-zero for owned violations.
• Replaced custom implementation, tests, tasks, and workflow steps are removed in the same migration.
• Remaining repository-owned checks map to named OpenElement invariants.
• No duplicate generic authority remains.

Boundary

This issue does not block Alpha compiler/runtime work. It is also not a Beta.2.1 completion gate: Beta.2.1 carries only the supporting/non-blocking inventory (owned by #1320's scope), and the first concrete executable migration preparation begins in Beta.2.2. Do not build wrapper frameworks, long-lived dual paths, or broad repository-owned equivalence suites around mature tools.

Source audit and deletion candidates (2026-09-08)

See docs/architecture/infrastructure-reduction.md in planning PR #1342. This is a bounded audit, not completed migration.

• Existing check-package-artifacts already invokes publint/ATTW: remove redundant generic scans/wrappers, do not add them again. Preserve OE browser dependency and packed-consumer invariants.
• Evaluate generic dependency traversal/rules separately from Deno workspace export and publication semantics.
• Evaluate ordinary link checking separately from public metadata/Pagefind/API-anchor semantics.
• Remove duplicated writable release/docs facts before retiring synchronization regexes ([beta.2.3] Establish one release-state authority #1334/[beta.2.2] Collapse SEO/search/sitemap projection onto resolved Document truth #1327).
• Record deleted implementations/tests/tasks, new dependency/glue costs and retained OE-specific rules; no deletion quota or permanent wrapper framework.
  WTR pilot and fake-DOM migration are [beta.2.3] Consolidate framework fixtures and consumer qualification #1333; direct runner/CI execution replaces redundant orchestration under [beta.2.3] Simplify CI and AutoFlow around final semantic responsibilities #1332. Oxc/TS7 are separate prospective migrations, not immediate prerequisites.

Accepted upstream-contribution priority — 2026-09-08

Select replacement tools for the most credible sustained upstream-contribution path, not lowest local glue. Existing publint/ATTW are already installed: reduce overlap and contribute real generic gaps. Evaluate dependency-cruiser/lychee with OE/Deno constraints. Scope Oxc/TS7 executable preparation in Beta.2.2 (decorators, diagnostics, source maps, declarations, Deno resolution), not production backend replacement; full production migration remains independently qualified Alpha work. Each migration names recipient/version/native harness/reproducer/patch boundary and OE remainder.

Use docs/architecture/infrastructure-reduction.md and VERSION_PLAN as scope. Prepare useful generic fixes for contribution through normal authorization; no invented bugs, cosmetic PR quota, or upstream-response release dependency. No migration is completed by this update.

Approved executable maturation — 2026-09-09

• Beta.2.2: inventory TS syntax, TypeChecker, CLI, declaration and pack consumers.
• Run representative Oxc TSX -> existing PartProgram comparison with properties/computed/events/conditional/keyed regions and adversarial provenance/Unicode spans. Reuse current grammar/determinism/source-map tests; hold emitter and authoring contract stable initially.
• Qualify TS7 CLI type/declaration/resolution separately from Deno check and old Compiler API. Inspect deno pack staging and generated-code strictness exceptions; verify final declarations/maps in independent consumers.
• Evaluate upstream CEM extraction separately from OE hydration/layer policy; do not merely port the bespoke scanner to Oxc.
• Record binding/install/OS/CPU/Deno requirements, parse/analysis/emit/total costs and portable upstream gaps.
• Alpha: actively implement independently qualified Oxc frontend and TS7 type/declaration adoption. Temporary differential paths have an exit; no permanent dual production frontend or public generic AST API. Documented blockers allow deferral, not silent abandonment.
• Close only when adopted replacements retire old owners and deferred scope has explicit disposition. Correctness, provenance, diagnostics, maps and runtime behavior are hard gates; local speed/LOC are not the only benefits.

Scope: docs/architecture/alpha-maturation.md and VERSION_PLAN (planning PR #1342). Upstream contribution potential can justify bounded extra integration cost; no invented defects, PR quota or upstream-response release dependency. This update changes planned work, not implementation status.

[SisyphusZheng]

[ADR-0146 CLAIM]

Loop: a0-002
Candidate: 0.44.0-alpha.0 internal integration baseline
Base SHA: 3563812351258ebde655326a60b2219f5c152e9c
Acceptance slice: CI evidence tiering and role-neutral documentation.
Dispatch: docs/evidence/v0.44.0-agent-loops/a0-002/dispatch.md

Reason for advancing this ready slice: it removes repeated full-matrix cost before the remaining train and makes all subsequent documentation inherit neutral role vocabulary. This slice does not claim full #1156 completion.

Preflight: orchestration check PASS; configured executor check PASS.
Owned paths: governance/tooling, role profiles, AutoFlow policy/tests, and docs only. Product/packages/examples/www/workflows are forbidden.

[SisyphusZheng]

a0-002 slice integrated into dev by exact-SHA fast-forward. Candidate: 0ae6585. PR: #1186. Authoritative AutoFlow CI: https://github.com/open-element/openelement/actions/runs/33142165035 (pull_request, attempt 1, success, exact head SHA). Artifact: pr-full-ci-evidence-0ae65853a8e807b1b31da8752b434167219d25d6 (unique, non-expired, schema v2, full matrix complete, production provenance verifier PASS). All PR checks passed, including CodeQL, external review, Cloudflare, dependency review, and both Node smoke jobs. Implementer GO and thinker GO were recorded; this internal alpha.0 slice requires no release-verifier publication closure. The prior SHA 2ab06b5 and run 33140997895 remain rejected. Alpha.0 was not tagged, published, released, assigned a dist-tag, promoted to main, or otherwise externally released. This closes only the CI evidence tiering and role-neutral documentation slice; #1156 remains open for its Renovate/tool offload and ownership deliverables.

[SisyphusZheng]

Reconciled into the NEW release train (umbrella #1155, baseline 2936bf0). The old Alpha.1–8 / five-Beta topology is obsolete; supported topology: A10 → B1 → B2 → B3 → RC1 → Stable. This issue is reused (not duplicated) — see the umbrella child-issue checklist for its exact mapping.

Mapped as B2.6 (mature OSS governance migration) per ADR-0144: Renovate vs Dependabot/custom dependency automation, markdownlint, lychee, actionlint, zizmor, OpenSSF Scorecard where they genuinely replace custom logic. Per migration: identify custom check → compare semantics → prove coverage → remove duplicate check + CI wiring → document what remains OE-specific. Note: SECURITY.md:20 currently claims tools that are not wired (Gitleaks/actionlint/zizmor/Scorecard) — the migration must make that true or fix the claim.