[docs] Update documentation for features from 2026-05-14

[danielmeppiel]

Documentation Updates - 2026-05-14

This PR updates the documentation based on features merged in the last 24 hours.

Features Documented

• manifest-missing baseline CI check (from fix: warn when apm.yml is missing but APM artifacts exist (closes #1056) #1255)

Changes Made

• Updated docs/src/content/docs/reference/baseline-checks.md:
  • Added manifest-missing row to the "At a glance" table
  • Added dedicated ### manifest-missing section describing what it verifies, when it fails, its effect, and remediation steps
  • Updated the run-order paragraph to include manifest-missing
• Updated docs/src/content/docs/concepts/lifecycle.md:
  • Updated the CI mode check list to include manifest-parse and manifest-missing (previously the list started at lockfile-exists and omitted both conditional checks)

Merged PRs Referenced

• fix: warn when apm.yml is missing but APM artifacts exist (closes #1056) #1255 - fix: warn when apm.yml is missing but APM artifacts exist -- introduced the manifest-missing check in ci_checks.py and models.py without a corresponding docs update
• fix(audit): drift check skip-with-info on cache miss (closes #1200) #1289 - drift check skip-with-info on cache miss (docs already included in PR)
• fix(policy): layer dependencies.require through extends: org (closes #1201) #1290 - policy inheritance fix for dependencies.require/deny with extends: org (bug fix, no user-facing docs needed)
• fix(ci): use audit-only pattern to prevent install overwriting tamper (closes #1202) #1291 - audit-only CI pattern (docs included in PR: enforce-in-ci.md, drift-detection.md, ci-cd.md)

Notes

The manifest-missing check is advisory (passes with a warning) in non-CI mode and a hard failure in CI mode (apm audit --ci). It is triggered when apm.yml is absent but .apm/, apm.lock.yaml, or the legacy apm.lock file is present -- evidence that the manifest may have been deleted to bypass policy enforcement.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• #1307 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #1292 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Daily Documentation Updater · ● 1.2M · ◷

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/daily-doc-updater.md@b87234850bf9664d198f28a02df0f937d0447295

• expires on May 16, 2026, 6:02 AM UTC

[Copilot]

Pull request overview

This PR updates the Starlight docs to reflect the recently introduced manifest-missing baseline CI check and to correct the baseline-check list shown in the lifecycle documentation for apm audit --ci.

Changes:

• Added manifest-missing to the baseline checks reference (table, dedicated section, and run-order paragraph).
• Updated the lifecycle “CI mode” checklist to include the conditional manifest-parse and manifest-missing checks.

Show a summary per file

File	Description
docs/src/content/docs/reference/baseline-checks.md	Documents the new manifest-missing baseline check and updates the stated baseline check run order.
docs/src/content/docs/concepts/lifecycle.md	Updates the apm audit --ci baseline-check list to include manifest-parse and manifest-missing.

Copilot's findings

Comments suppressed due to low confidence (2)

docs/src/content/docs/reference/baseline-checks.md:65

• The non-CI behavior is described inconsistently: the "Fails when" bullet says it "passes with a warning message", but the "Effect" bullet says it records a pass with an informational message. Please align these to the actual behavior (it sets passed=True outside --ci and surfaces an advisory message).

- **Fails when.** `apm.yml` is absent **and** at least one of `.apm/`, `apm.lock.yaml`, or `apm.lock` is present **and** the audit is running in CI mode (`apm audit --ci`). Outside CI mode the check is advisory (passes with a warning message).
- **Effect.** In CI mode (`--ci`), exits `1` and stops further checks. In non-CI mode, records the check as passed with an informational message.

docs/src/content/docs/reference/baseline-checks.md:130

• The documented run order lists manifest-missing before lockfile-exists, but in run_baseline_checks the lockfile-exists check is appended first, and manifest-missing is only appended later in the early-return branch when apm.yml is missing and artifacts exist. Please update this sentence so the order and conditional path match the implementation.

The aggregate runner in `run_baseline_checks` evaluates checks in this order: `manifest-parse` (only when `apm.yml` is unparseable), `manifest-missing` (only when `apm.yml` is absent but APM artifacts exist), `lockfile-exists`, `ref-consistency`, `deployed-files-present`, `no-orphaned-packages`, `skill-subset-consistency`, `config-consistency`, `content-integrity`, `includes-consent`. Drift is invoked separately by the audit command after the baseline batch.

• Files reviewed: 2/2 changed files
• Comments generated: 2