Audit-derived onboarding issues ship stale; driftNotes are hand-maintained and drift #341

Context

Filed from the HomeAssistant-Config #16 operational onboarding. Two related staleness problems surfaced: the audit-derived onboarding issue shipped with already-resolved findings, and the registry driftNotes described work already completed.

1. Audit-derived onboarding issues ship stale

#16's "Audit findings driving this" block listed three findings. When an agent picked it up, two were already resolved:

• DEFECT secrets: CODEGEN_APP_CLIENT_ID / CODEGEN_APP_PRIVATE_KEY missing (both stores) - both were already present in the Actions and Dependabot stores.
• DRIFT branch: main carries content develop lacks (forward-sync needed) - inverted: develop was already content-ahead of main; nothing to forward-sync.
• LETTER file: repo-config/... absent - the only finding still real.

An agent that trusted the issue body would "fix" already-fixed things (re-request secrets, attempt a no-op forward-sync). The findings are a point-in-time snapshot with no freshness signal.

Suggestion: have spec/audit.py (or the issue-filing flow) timestamp findings, and/or re-verify at pickup, so a standup issue reflects live state rather than a stale snapshot. A one-line "as of <commit> / <UTC>" stamp plus a "re-run the audit before acting" note would be enough.

2. Registry driftNotes are hand-maintained and drift

HomeAssistant-Config's driftNotes described work already completed at pickup:

• "develop is behind main by 2 commits - fast-forward develop... then flip groundTruthBranch to develop" - develop was ahead, not behind (and the flip is declined; see the operational-ground-truth issue).
• "pending: lint CI (a Home Assistant config-check feeding the required check)" - test-pull-request.yml with the Check pull request workflow status job required check was already live.
• "pending: dispatch-only source-release scaffolding (version.json + ... publish-release.yml)" - both already present.

This is the same class of staleness #329 fixed reactively for Vantage-Config. Hand-maintained prose drifts silently because nothing checks it against reality.

Suggestion: treat driftNotes as generated/verified by the audit rather than free prose - e.g. have audit.py flag driftNotes whose asserted facts (branch-behind, missing CI, missing files) no longer match live state, so drift is caught the same way ruleset/secret drift is.

Related

• #310 (strengthen onboarding: enforce the audit, STANDUP counterpart, cold-start self-test)
• #329 (reactive Vantage-Config driftNotes reconciliation)