ci: make the projection fan-out HOLD mechanically answerable

[jason931225]

What

docs/current/PRODUCT.md:38 holds Company, Person, Employment and PayRun projection fan-out until "each has an explicit owning port and a proven single-writer boundary." This adds one command that decides whether that condition currently holds, and cites the evidence.

MET      Company      (named in hold) owner=console-ontology-canonical-adapter-postgres tables=2 ci=yes
         proof: backend/crates/ontology/canonical-adapter-postgres/tests/company_port_as_runtime_role.rs
...
MET      PayRun       (named in hold) owner=console-payroll-adapter-postgres tables=6 ci=yes
         proof: backend/crates/payroll/adapter-postgres/tests/pay_run_port_as_runtime_role.rs

hold-release-conditions: every leg met for all 6 canonical objects

What this is NOT

It adds no enforcement. Every clause of the hold is already enforced, and enforced well — canonical_contract.rs (owner + owned tables, sized against ObjectKey::ALL), gate_detects_violation.rs (static gate catches a second writer, incl. misspelled evasions, table set derived from the same ALL), and topology.canonical_enforcement (refuses to claim enforcement over zero tables). Duplicating any of that would be the mistake, not the fix.

The actual friction

The release condition is prose; its evidence spans six files whose naming conventions disagree:

layer	spelling
registry	PayRun
suite on disk	pay_run_port_as_runtime_role.rs
CI map	payroll-adapter-postgres-pay-run-port-as-runtime-role-pg

Answering the question meant re-deriving three transforms by hand. That derivation is error-prone in a way that matters: a find under the canonical adapter's test dir returns five of six suites and misses PayRun, whose owner is the payroll adapter — which reads as "PayRun is barely covered" when it owns the largest table set of the six and has 17 tests. That wrong turn is why this exists, and it is pinned by a test.

Fails closed — verified by mutation, not asserted

mutation	result
un-wire PayRun's suite from the workflow postgres job	RED, naming that suite
hold names an object that is not an ObjectKey	RED — a hold over a non-existent object can never be evaluated
empty an object's owned-table set	RED, "owns no table, so no writer rule applies to it"
delete the hold bullet	throws, rather than passing over an empty subject list

The hold's subject is parsed from the bullet rather than hardcoded, so editing the bullet moves the check with it.

Authority

Releasing the hold stays a separate authority decision. The command reports evidence; it does not confer it. The PRODUCT.md edit adds a pointer to the verifier and says so explicitly — it does not change the hold's status.

Also

Fixes the tree walker: readdirSync(withFileTypes) reports a symlinked directory as neither file nor directory, so the naive isDirectory() walk skipped it and under-reported proofs.

Verification

13/13 gate sweep green in the worktree, both reachability scanners green (60 suites; dark 0), executed-tests-baseline green.

Base

Stacked on #818, which carries tools/ci/gate-sweep.json. Registering there rather than in package.json avoids re-introducing an && link that #819 exists to remove.

🤖 Generated with Claude Code