Tenant reference-discovery (agent-operated; not on spine cron yet)
Runs bun tools/reference-discovery.ts --check
Proof manual / agent cleanup batch
Skill .agents/skills/reference-discovery/SKILL.md
bun run reference:discover:check exits non-zero — plane mismatch, legacy domain, or warn-tier drift in harness perimeter.
bun tools/reference-discovery.ts --jsonplane-mismatch — REGISTRY_URL vs Pages host)legacy-domain, skill-broken-link, unused-canonical, high-similarity env pairs)factoryWagerRegistryUrlFromEnv() · docs/registry-client.mdresolveRoutingProbeBaseUrl() · config/r2-env.tsresolveR2BucketName() in lib/security/r2-credentials.ts (R2_BUCKET_NAME / S3_BUCKET_NAME)bun run reference:discover:check · bun tools/doc-map-check.tsThese pairs are not drift — scanner skips them via isAllowedSimilarEnvPair in lib/reference-discovery.ts:
| Cluster | Keys | Owner |
|---|---|---|
| Secrets service IDs | FW_INFRA_SECRETS_SERVICE · FW_R2_SECRETS_SERVICE · FW_SECRETS_SERVICE |
lib/security/infra-secrets.ts |
| S3-compat bucket | R2_BUCKET_NAME · S3_BUCKET_NAME |
lib/security/r2-credentials.ts · config/r2-env.ts |
| Search bench pin | SEARCH_BENCH_PIN_* fail vs SEARCH_BENCH_PIN_WARN_* warn thresholds |
scripts/search-benchmark-pin.ts |
| Search bench proxy | SEARCH_BENCH_PROXY_URL · SEARCH_BENCH_PROXY_AUTH |
search bench harness |
New env keys: prefer SSOT helpers in config/r2-env.ts over raw Bun.env reads in harness perimeter.
| Layer | Gate |
|---|---|
| Harness plane | bun run reference:discover:check |
| Public plane | bun run public:discover:check |
| Both planes | bun run discover:compose:check |
| Markdown SSOT | bun tools/doc-map-check.ts |
Bun @see / taxonomy |
bun tools/bun-doc-refs.ts integrity |
| Audit catalog | bun run audit:verify |
| Tenant gap rows | skill audit-gap-close · tenant gap map |
| Code symbol collisions | ast-grep collisions / anchors |
| Registry live | bun run verify:registry-client |
| Proof catalog | reference-discovery-v1 · freshRerun: discover:compose:check |
bun run discover:compose:check
bun run reference:discover:check
bun run audit:verify
bun tools/doc-map-check.ts
bun tools/bun-doc-refs.ts integrity
| Gate | Last run | Result |
|---|---|---|
discover:compose:check |
2026-07-26 | 0 errors · harness + public |
reference:discover:check |
2026-07-26 | 0 errors · 0 warn · 36 info |
audit:verify |
2026-07-26 | pass · 4 findings · 5 concepts |
docs:map:check |
2026-07-26 | pass |
bun-doc-refs integrity |
2026-07-26 | pass · 2277 links |
harness-skills-catalog |
2026-07-26 | 22 skills · skill-loop-registry.json |
Promote to spine cron or pre-commit --check on staged harness paths when warn count stays at zero for two release cycles.
Owner // owner: platform / docs operate
Fresh-rerun bun run docs:reference-discovery