Post-sync leftovers from the Financial-Modeling standup (TOCTOU pin, late addenda, carry-policy heads-up)

[ptr727]

Context

Financial-Modeling re-synced against the hub after #313/#317 landed (thanks - the reusable validate gate and downstream-neutral repo-config carried cleanly). Four small items from the downstream review arrived as late comments on the now-closed issues and did not make the incorporation; consolidating them here.

1. Publisher TOCTOU: checkout the dispatch-time commit (missed #317 addendum)

The gated publish-release.yml validates the dispatch event's github.sha, but publish checks out github.ref_name - a moving pointer - so a commit landing on the branch between dispatch and checkout is released unvalidated. Fix: ref: ${{ github.sha }} in the publish checkout (NBGV classification is unaffected; GITHUB_REF still names the dispatched branch). Financial-Modeling ships this pin locally (commit 90b94ca, kept through the re-sync).

2. repo-config/README.md: ".github/ is reserved for GitHub-Actions-owned content"

Copilot flags this downstream: .github/dependabot.yml is not Actions-owned. Financial-Modeling rewords to "which holds the GitHub-consumed configuration - workflows, Dependabot".

3. vscode-tasks-python.json: two nits (missed late #313 comment)

• Header says "Every task is type: process" but the aggregators (Python Verify, Lint: All) are dependsOn-only with no type - suggest "Every command-executing task is type: process...".
• Python Verify / Python Test use string groups ("group": "build"), which do not set the default build/test task; the object form { "kind": "build", "isDefault": true } makes Tasks: Run Build Task run the gate as CODESTYLE.md documents.

4. Carry-policy heads-up: downstream self-audit (owner-decided divergence)

The new Downstream Carry guidance says AUDIT.md/spec/ are hub-only, mentioned by name. The owner has directed Financial-Modeling to carry local adapted AUDIT.md + spec/secrets.json (repo-scoped: rulesets/settings/secrets self-audit against the committed repo-config/ baseline, hub never linked) so the repo-config tooling is self-contained. The carry guidance may want to bless this as the standard downstream shape rather than an exception.

References

ptr727/Financial-Modeling#15 (re-sync commit 5aa3bcb) · #313 · #317