docs(exemptions): add Layer 5 census scope for the 23 vendored workflow copies

[hyperpolymath]

What

Adds Layer 5: Census scope to docs/EXEMPTION-MECHANISMS.adoc, documenting the 23
vendored workflow copies that the standards#1005 codeql-action re-pin census surfaced, and
records the basis on which they are out of scope.

Also corrects the preamble, which said "Three concentric exemption layers" while Layer 4
already existed. Adding Layer 5 would have made that miscount worse, so it is fixed here
rather than left.

Why this is a different kind of exemption

Layers 1–4 all answer "this finding is real, and we are choosing not to act on it."
Layer 5 answers "is this file in scope at all?" — a question the existing document had no
home for, which is why the population had no recorded disposition.

An estate census walks paths, not runtimes. GitHub Actions dispatches a workflow only from
.github/workflows/ at the repository root. A file at
stubs/cpt/.github/workflows/scorecard.yml is an ordinary file in the tree: never
registered, never dispatched.

The population, measured 2026-09-23

23 copies across 5 repositories. 0 at a repository root; 23 under a directory prefix.

repo	prefixes	copies
ssg-collection	stubs/{cpt,dei,reliquary,tiamat,tripos,tyrano,ultimatum,vladik}/, ssg-fixes/jtv-playground/, variants/befunge/	10
polystack	poly-ssg/satellites/{…}-ssg/	8
wordpress-tools	journal-theme/ (2), resurrect/	3
jtv-lang	playground/	1
reposystem	total-upgrade/	1

A stale pin in one of these cannot produce a startup_failure, cannot pull a vulnerable
action, and cannot consume a runner. Re-pinning them is churn against files that cannot run.

The condition, which is the part worth reviewing

The exemption is conditional on the directory staying vendored, and the re-check trigger is
promotion, not a date. stubs/ and satellites/ exist precisely so a skeleton can become a
repository of its own. The moment one is extracted, its .github/workflows/ becomes live and
every pin this exemption excused becomes a real defect — silently, with no gate firing and no
census entry changing. The section states that any PR extracting a skeleton must re-pin it as
part of the extraction.

A rationale I am retracting rather than carrying forward

The earlier statement of this exemption also claimed that some copies are "compared
byte-for-byte by tests", implying a second independent justification. That is false.
ssg-collection/tests contains only fuzz/; no such comparison exists anywhere in the estate.
It is recorded in the document as withdrawn, because the difference matters to whoever
revisits this: the exemption is narrow and rests on non-execution alone, not doubly justified.

What the section explicitly refuses

• Not a reason to skip a census — the right output is "23 found, 23 out of scope, here is
  why", never "0 found". An exemption you cannot see is one you cannot audit.
• Not transferable to a file that merely looks inert. A disabled workflow at the root is
  still registered, or one edit from it, and stays in scope. The discriminator is the path.
• Not a licence to let the copies drift, since they seed future repositories.

Acceptance criteria

• AC1 — population measured, not asserted: 23 paths, 0 at root, 5 repos; table sums to 23.
• AC2 — basis is non-execution only; the refuted tests rationale is recorded as withdrawn.
• AC3 — promotion risk documented with a named trigger rather than a review date.
• AC4 — decision-tree entry and cross-reference added so the layer is reachable.
• AC5 — asciidoctor renders clean (rc=0, no warnings); both table blocks balanced.

Follow-up, deliberately not in this PR: the document still references
bot_exclusion_registry.a2ml and Debtfile.a2ml, and A2ML is retired. That is an
estate-wide rename tracked separately; doing it here would bury a 23-path scope decision
inside a doctrine migration.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm

[coderabbitai]

Warning

Review limit reached

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 82c54589-0ede-45fb-9439-3a22d4cadc4a

📥 Commits

Reviewing files that changed from the base of the PR and between 779d8a9 and f37a427.

📒 Files selected for processing (1)

• docs/EXEMPTION-MECHANISMS.adoc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud