docs(topics): add the Phase 6 engine-Node-port plan

[kyle-sexton]

Summary

The planning pass for Phase 6 (engine Node port), the last unplanned phase of the standards-sync-audit remediation. Executes ledger decision Q12 (Node port approved; yq-adapter rejected — not relitigated). Grounded on a fresh-context exploration of the engine contract at origin/main e6b9155 and stress-tested by two independent fresh-context reviews (a plan reviewer and an adversarial devils-advocate): 2 CRITICAL and 8 IMPORTANT deduplicated findings, all verified against the live repos and folded in (details in the PLAN's stress-test summary).

Closes #451

Fix

Adds to docs/topics/standards-sync-audit/PLAN.md: the Phase 6 contract description (six subcommands, byte-exact outputs, spawn-batching contract, yq behaviors needing a real YAML AST); four decisions pending user approval — 6-A yaml dependency with the ajv dev-split and PINNED parser configuration, 6-B exec-wrapper entrypoint continuity, 6-C staged dual-gate cutover, 6-D no-Node control inversion plus the control-char-equivalence disposition; five sequential sub-phases (6.1 port + dual-gate suite, 6.2 threat-model re-run + npm supply-chain assessment, 6.3 reusable prep with per-job paths, 6.4 one-file cutover + Bash retirement, 6.5 close-out), each with mechanically verifiable Sanity Checks; the HIGH blast-radius entry; the stress-test summary; execution-shape rows; and the approval-gate rows. Also corrects the Brief's suite figure in prose (929 lines, post-5.3) and extends the Mechanical-work PR series list.

Verification

• markdownlint green on the edited file (pre-commit); comment-hygiene green (no trip shapes in the added prose).
• Outcome-gate checks on the artifact: 5 sub-phases ↔ 5 Sanity Check blocks; all sub-phases tagged [PENDING]; all four Brief acceptance items (suite green on Node, threat-model re-run, no-Node control disposition, supply-chain assessment) map to sub-phases; decisions surfaced in the approval-gates section; blast-radius entry present.
• This PR changes documentation only — no engine, manifest, workflow, or test bytes change; implementation starts only after the 6-A..6-D approval gate.

Related

• Phase 6 of docs/topics/standards-sync-audit/PLAN.md (Brief acceptance line) and ledger decision Q12 in the audit's decision register.
• Predecessor plan PRs: 444 (Phase 4R+5), merged; Phases 0-5 all closed on main.

[claude]

Claude finished @kyle-sexton's task in 3m 26s —— View job

---

Code review — Phase 6 plan addition

• Gather context (PR diff, REVIEW.md code-review-lane scope, repo state at c9eb81e)
• Verify the plan's factual claims against the live repo
• Post findings

This is a docs-only addition to docs/topics/standards-sync-audit/PLAN.md (Phase 6 planning content, all sub-phases [PENDING], no engine/workflow/test bytes touched). Per REVIEW.md's code-review-lane scope, this covers correctness/consistency; nothing security-relevant is in scope here or in this diff.

I independently verified several of the plan's grounding claims against origin/main rather than taking them on the PR's word:

• distribution/sync-manifest.test.sh is 929 lines — confirmed.
• The actionlint job (.github/workflows/ci.yml:478-519) runs claude-lanes.test.sh with no setup-node/npm ci step, and that test does invoke distribution/sync-manifest.sh apply — confirmed, matches the stress-test's CRITICAL feat(powershell): PowerShell static-analysis module #1 claim.
• ajv is currently a production dependency in distribution/package.json (not dev) — confirmed, matches the 6-A dev-split rationale.
• Two symlink-related cases exist in the suite (source-symlink rejection, destination-symlink rejection) — confirmed, matches the 6.1 Sanity Check's "two known symlink cases."

I could not run markdownlint myself in this environment (no network access in this sandbox), so the PR's "markdownlint green" claim is author-reported and unverified by me, not confirmed.

One finding, on an unchanged line the diff doesn't carry, so it's placed here per the reporting split:

Suggestion — stale suite-length figure left uncorrected in the Brief's acceptance criteria
docs/topics/standards-sync-audit/PLAN.md#L33 still reads "full 921-line black-box contract suite green against the Node engine." The new Phase 6 section this PR adds, at line 510, states "The Brief's acceptance stands with one figure correction: the black-box contract suite is now 929 lines" — but that's a note added elsewhere, not an edit to the Brief bullet itself, so the file now asserts two different suite lengths for the same acceptance item. The PR description's "corrects the Brief's suite figure in prose" oversells what actually happened. This document has an established convention for exactly this situation — superseding a stale fact in place rather than leaving it and noting the correction elsewhere (see the ADR-0003 Status-line precedent at line 336: "ADR-0003's Status line becomes superseded by [ADR-0005]"). Phase 6.5's close-out Sanity Check calls for verifying "the Brief acceptance line item-by-item," so a reader doing that check hits a number mismatch with no pointer at the source line. Worth either updating line 33's figure directly or adding an explicit forward-reference at line 33 to the Phase 6 correction note.

Everything else in the addition — the four decision blocks (6-A..6-D), the five sub-phase blocks with Sanity Checks, the blast-radius entry, the stress-test summary, the execution-shape table, and the approval-gate rows — read as internally consistent and well-grounded against current repo state, with no other correctness or maintainability issues rising to this lane's high-signal bar.

Branch: docs/sync-audit-phase6-plan

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9eb81e931

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.