governance-reusable: two jobs cannot fail (Code quality + docs; Guix/Nix policy) + redundant trufflehog

[hyperpolymath]

governance-reusable.yml — two jobs cannot fail, plus a redundant scanner

Surfaced by the nexia-list CI failure-path audit (2026-07-17). governance-reusable.yml is partly real — most of its jobs have genuine exit 1 paths (Check Workflow Staleness, Language/package anti-pattern, Security policy checks, Well-Known RFC 9116, Workflow security linter, Trusted-base, Licence consistency). These are fine and should be kept. But two jobs are theatre:

1. "Code quality + docs" — no path to non-zero

• trufflehog step: continue-on-error: true
• editorconfig step: continue-on-error: true
• everything else: ... | head -10 || true, || echo, ::warning::

Nothing in this job can make the check red. It reports success over any input.

2. "Guix primary / Nix fallback policy" — echo-only

Every branch echoes; the job terminates with echo "✅ Package policy check passed" and no exit 1. It cannot detect a policy violation.

3. Redundant secret scanner

This reusable's trufflehog overlaps secret-scanner-reusable (which, post-#500, is the real gitleaks gate). The secret-scanner reusable's own header even claims "Trufflehog removed as redundant" while governance still runs it — a self-contradiction across the same estate.

Task

• Make "Code quality + docs" gate: pick the checks that are genuinely required (e.g. editorconfig conformance) and let them fail; downgrade the rest to explicitly-advisory with a comment saying so, or drop them.
• Make "Guix/Nix policy" gate on a real violation, or delete it if the policy is not actually enforceable yet (don't keep a green stub — per doctrine, an unrunnable gate that reports success manufactures confidence).
• Remove the redundant trufflehog step now that gitleaks gates for real; reconcile the "Trufflehog removed as redundant" header claim.
• Prove each change with both a pass and a fail fixture before merge.

Note: reusable changes are not self-tested in standards (callers pin a fixed SHA), so validate locally / in a consumer branch, not just by watching standards CI go green.

Refs: PR #500 (gitleaks real gate). Companion: the .gitleaks.toml allowlist follow-up.

[hyperpolymath]

✅ PARTIALLY FIXED by commit e7fb60c: Made Code quality checks advisory in governance-reusable.yml by removing || true operators and adding continue-on-error + advisory comments. Guix/Nix + trufflehog already fixed in prior commits.

[hyperpolymath]

Completed across #513 and #618 and re-verified on current main.

Acceptance evidence:

• quality / Check documentation now executes scripts/check-docs-presence.sh; missing README or LICENSE blocks immediately, and missing CONTRIBUTING blocks on/after the declared cutoff.
• package-policy / Enforce Guix-only packaging policy now executes scripts/check-package-policy.sh; Nix-only, absent, stray-.scm, and vendored-only packaging all have tested blocking paths.
• the redundant TruffleHog step is absent from .github/workflows/governance-reusable.yml; secret scanning remains in the dedicated gitleaks-based reusable workflow.
• bash scripts/tests/governance-gates-505-test.sh passes 22/22 fixtures, including both pass and fail fixtures for both gates, both sides of each cutoff, malformed-cutoff refusal, vendored false positives, and the large-tree SIGPIPE regression.
• the full workflow-equivalent shell discovery passes 25/25 test files locally.

This completes every checkbox in the issue; closing as fixed.