vendored-sync.yaml is now a fourth de-facto shared file with no drift protection

[realmarcin]

From the review of the #198 sweep (TraitMech#196, MediaIngredientMech#166, CommunityMech#302).

All three spokes now carry .github/workflows/vendored-sync.yaml, and the executable part is byte-identical: I diffed the retry blocks across TraitMech, MediaIngredientMech and CommunityMech and they match exactly. Only the comments differ, naming each repo's local gate.

Nothing enforces that. The file is not on check_vendored_sync.sh's FILES list — and it could not usefully be, because the canonical hub (CultureMech) has no copy: as the hub it has no check_vendored_sync.sh and no vendored-sync job at all.

So the guard against vendored drift is itself now triplicated with no guard. That is the same shape as CommunityMech#278, which observes that check_vendored_sync.sh has no canonical copy in the hub either. Two files in the same mechanism now share the same hole.

Measured on 2026-08-02

file	TraitMech	MediaIngredientMech	CommunityMech	on the drift list?
scripts/check_vendored_sync.sh	04674a58…	04674a58…	04674a58…	no (#278)
.github/workflows/vendored-sync.yaml retry block	identical	identical	identical	no (this issue)
scripts/.vendored_canon_ref	6be694f3…	6be694f3…	6be694f3…	n/a — it is the pin

The fleet is consistent right now. The point is that it will stay consistent only by hand.

Why it is not urgent

Divergence here degrades gracefully. If one repo's copy drifts, that repo's guard behaves differently — it does not corrupt data or produce a false pass in the others. And CultureMech's nightly vendored-fleet-audit still compares the files that are on the list.

Options

1. Accept it and document that the workflow is intentionally per-repo, so a future reader does not assume it is synchronised.
2. Give the mechanism a canonical home in the hub. CultureMech would carry reference copies of check_vendored_sync.sh and vendored-sync.yaml that it does not itself execute, purely as the diff target — resolving ci: bump actions/upload-artifact from 4.6.2 to 7.0.1 #278 and this together. The oddity is a hub holding a file it never runs.
3. Move the shared logic out of the workflow into the checker script, so there is one place to keep in sync rather than two. Blocked by the same problem: the checker has no canonical copy either, which is exactly why the retry was put in the workflow in the first place.

(2) is the only option that actually closes both. Worth deciding alongside #278 rather than separately, since neither is fixable without the other.

[realmarcin]

Two corrections to this issue, and a PR that closes half of it

PR: CultureBotAI/culturebotai-claw#41. It closes CommunityMech#278 outright and the check_vendored_sync.sh half of this issue.

Correction 1 — my proposed option (2) was wrong, and dangerous

This issue suggested "CultureMech would carry reference copies of check_vendored_sync.sh and vendored-sync.yaml that it does not itself execute". I wrote that without checking whether the hub should have them. It should not, on both counts:

• check_vendored_sync.sh is what a spoke runs to diff itself against the hub. A hub copy would make the hub check itself against itself at a pinned ref — the self-referential pin CultureMech already retired (Phase 2: shared-reference vendored-file drift check #176, Re-converge drift check on CultureMech hub; extend to mech_shared; retire schema-pin #182).
• vendored-sync.yaml in .github/workflows/ would be executed by GitHub, not merely stored. The hub would run that self-referential check on every PR.

The hub's absence is an invariant, not a gap. #41 therefore asserts it: if CultureMech ever gains one of these files, the audit fails and explains why. That guardrail exists specifically because this issue proposed the opposite.

Correction 2 — the safety net moved; my severity note was stale

This issue said "CultureMech's nightly vendored-fleet-audit still compares the files that are on the list." That stopped being true the day before I wrote it.

CultureMech 5aa41b72 (2026-08-01) — "Retire the fleet audit; claw now enforces both directions" — deleted it, after claw#36 merged a single enforcer covering both directions in one run. Sequenced so coverage never lapsed. The backstop still exists; it is claw/scripts/audit_idlabel_fleet.sh, running daily at 06:41 UTC. Its last CultureMech-side run was 2026-07-31.

Substance holds, location was wrong. Worth noting because #184, #197 and #198 all cite that audit by its old name.

What landed

shared/spoke/ in claw as the reference for files the hub legitimately lacks, plus a fourth audit direction comparing every spoke against it. Live fleet: 23 → 27 comparisons, exit 0. Every new check was made to fire — tampered mirror, hub-absence trip, unlisted file, empty manifest.

It also adds shared/spoke/** to that workflow's paths: filters, which listed shared/idlabel/** only. Editing the new mirror would not have triggered its own audit — the same defect as #184 and #200, found in the fix for it.

Remaining — keep this issue open

.github/workflows/vendored-sync.yaml is not vendored yet. The three copies' logic is byte-identical (I diffed the extracted run: blocks) but the files are not — comments name each repo's local gate.

Sequencing: MediaIngredientMech#166 and CommunityMech#302 must merge first, since those repos do not have the file yet. Then normalise the three copies and add one line to shared/spoke/MANIFEST.

So the correct order is the reverse of "this first": the sweep PRs, then normalisation, then the manifest entry.