ci(hcg): wire surface-drift check into Actions (standards#100 §1.5)

[hyperpolymath]

Summary

Wires scripts/hcg-surface-drift-check.sh (landed in boj-server#228, merged 2026-06-19) into GitHub Actions, so the surface⊆policy invariant the ADR calls its largest declared risk is re-proven on every PR rather than relying on the manual re-verification stamp in config/gateway-policy-boj.yaml's header.

PR #228 explicitly flagged this CI wiring as the follow-up step — "a CI wiring PR should follow [the always-trigger + changes-job] pattern. Out of scope here." This is that follow-up; the script, the router, and the policy are unchanged.

What lands

A single new file: .github/workflows/hcg-surface-drift.yml. The workflow follows the boj-server "always-trigger + changes-job" pattern documented in docs/wikis/CI-and-Required-Checks.adoc and .claude/CLAUDE.md §"CI / Required Status Checks":

• No on.*.paths — the check is always created. A path-filtered required workflow that never fires is the failure mode that stranded chore(deps): bump nixpkgs from 8c3cede to 8c91a71 #213/feat(scripts): extend §1.5 verb-canary coverage (Phase E) #215 until ci: make path-filtered required gates always report (unblock stuck PRs) #216 fixed it; this gate is built to never re-introduce it, regardless of whether it later joins required_status_checks.
• Lightweight changes job recomputes relevance via git diff origin/<base>...HEAD against the four paths this gate cares about — router (elixir/lib/boj_rest/router.ex), live policy (config/gateway-policy-boj.yaml), the drift script (scripts/hcg-surface-drift-check.sh), and the workflow file itself. Fail-safe to run=true on any diff failure.
• Heavy check job is needs: changes + if: needs.changes.outputs.run == 'true'. A skipped if: reports SUCCESS to any future required-context list, so unrelated PRs never pay for it and can never be blocked by it.
• Pinned action, timeout-minutes, concurrency group, permissions: contents: read, SPDX header — matches the canonical pattern in .github/workflows/abi-drift.yml.

The check job invokes the script with bash scripts/hcg-surface-drift-check.sh -v (matching the test plan in #228) so it works regardless of the script's file mode — #228 committed the script as 0644.

What this PR does NOT do

• Does NOT modify the runbook §1.5 ("Gateway-side prerequisites"). Adoption of the CI gate into the §1.5 checklist is a one-line owner-driven runbook update — the PR feat(hcg): add surface-drift check script (standards#100 §1.5) #228 deliberate boundary stays in place.
• Does NOT add the new check to .github/settings.yml's required_status_checks list (currently hypatia-scan + codeql). Promotion to required is a settings change for the owner to make once the gate has run green on a few PRs.
• Does NOT modify the live policy, the example policy, the router, the script, or any other Phase E artefact. The change is wholly within .github/workflows/.
• Does NOT pre-empt the §6.4 Trustfile flip (tier_2_gateway.status stays PENDING), the staging soak (§3.3), or cerro-torre .ctp signing — all of which remain owner-driven per the channel doctrine reaffirmed in docs(hcg-runbook): refresh rollout runbook v0.1→v0.2 after Phase D close (standards#100) #207 / feat(scripts): hcg-policy-smoke.sh — stealth-profile status canary (Phase E) #224.
• Per the single-lane HCG channel discipline (pattern set in http-capability-gateway PRs fix: offline inspection mode for Glama tool detection #14, Update dependabot.yml #22, Add Green Web Foundation badge #26, Claude/resume repos migration 9 o2 u1 #30, chore(deps): bump nixpkgs from 01fbdee to 6368eda #38 and boj-server PRs docs(hcg-load-profile): Phase D D1 — load profile declaration (standards#99) #168, feat(k8s): NetworkPolicy restricting BoJ ingress to HCG pod (#135) #173, feat(scripts): hcg-policy-smoke.sh — stealth-profile status canary (Phase E) #224, docs(integration): Phase E observability spec (standards#100) #226, feat(hcg): add surface-drift check script (standards#100 §1.5) #228): joint-close is owner-only. This PR refs but does not close standards#100.

Channel state note

This session could not read hyperpolymath/standards#91 / #100 (the session's MCP repo scope is restricted to http-capability-gateway and boj-server), so the brief's instructed status comment on standards#91 could not be posted. State was reconstructed from the canonical sources in this repo (ADR-0004, the integration plan, the audit, the rollout runbook, the live policy, docs/wikis/CI-and-Required-Checks.adoc) plus the merged-PR history of both in-scope repos. Analysis: Phase A/B/C/D closed; Phase E (standards#100) is the only open phase; #228 (2026-06-19) is the most recent advance and explicitly named this CI wiring as the next step.

Test plan

• Required: the changes job runs and emits run=true (because .github/workflows/hcg-surface-drift.yml matches the path regex), so the check job is gated through, not skipped, on this PR.
• Required: the check job runs bash scripts/hcg-surface-drift-check.sh -v and exits 0 with the OK message — current main (64a70c5) has 7 wired routes, 28 policy rules, no drift; locally re-verified on this branch.
• Synthetic skip: on a follow-up PR that touches none of the four watched paths, changes.outputs.run is false and check reports skipped (which counts as success for any required-context list).
• Synthetic drift: a temporary PR adding get "/__drift_test__" to elixir/lib/boj_rest/router.ex without a matching policy rule fires run=true, check exits 1 with the route listed under DRIFT:, and the PR is blocked from merge if/when this gate is promoted to required.
• No actionlint / Hypatia / SPDX gate fires on the new workflow file.

Refs hyperpolymath/standards#91
Refs hyperpolymath/standards#100

🤖 Generated with Claude Code

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 215 issues detected

Severity	Count
🔴 Critical	15
🟠 High	129
🟡 Medium	71

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard-enforcer.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence