check_intent_staleness ignores the intentRef the manifest declares, so seven entries are measured against the wrong file

[ptr727]

check_intent_staleness reads item.get("reference") or path (spec/audit.py:1785), but no intent entry in spec/files.json sets reference. Seven of them set intentRef instead, naming a canonical that is not the same path, and the check never looks at it. Each of those seven is compared against the hub file that happens to share its name.

entry	intentRef declares	compared against
.editorconfig	GOVERNANCE.md#line-endings	hub .editorconfig
.editorconfig-checker.json	GOVERNANCE.md#line-endings	hub .editorconfig-checker.json
.gitattributes	GOVERNANCE.md#line-endings	hub .gitattributes
version.json	WORKFLOW.md#d3---versioning-and-classification	hub version.json
repo-config/settings.json	repo-config/README.md	hub repo-config/settings.json
AUDIT.md	docs/repo-config-carry.md	hub AUDIT.md
spec/secrets.json	docs/repo-config-carry.md	hub spec/secrets.json

codecov.yml is the one intent entry that does set reference, so the field the function reads exists and is honored. The seven above are simply not using it.

Both directions are wrong, and the second is silent

False positive. AUDIT.md is the clearest case, because the two documents are not versions of each other: the hub's is the fleet audit procedure, and a downstream repo's is a self-audit of its own settings, rulesets and secrets, which docs/repo-config-carry.md prescribes. A hub commit touching the fleet procedure raises an intent finding on every repo's unrelated self-audit doc. ESPHome-Config's 2026-08-15 audit reported exactly that, citing 6418d25, a commit that added mermaid diagrams to the hub procedure.

False negative. docs/repo-config-carry.md last changed at 91c887c (2026-08-10), and that change altered the ruleset-field comparison a downstream AUDIT.md is supposed to implement. It raised no finding on any repo, because nothing declares it as the canonical for anything. The document that actually governs those two carried files is the one document the audit does not watch.

Fix

item.get("reference") or item.get("intentRef") or path, with the #anchor stripped, would resolve all seven to a real hub path. Whether an anchored intentRef should compare against the whole file or the named section is the one judgment call: GOVERNANCE.md changes often for unrelated reasons, so resolving .editorconfig to the whole of GOVERNANCE.md would trade a wrong comparand for a noisy one. See #727 on intent findings that correct action cannot clear.

Found during the ESPHome-Config resync, audit run 2026-08-15T14:30:53Z | hub 0e84805.

[ptr727]

A fresh instance from the ESPHome-Config resync against hub 79f4f17, now that #736 declares publish-release.yml at intent fidelity with intentRef: WORKFLOW.md#d4---release--publish.

DRIFT  intent: .github/workflows/publish-release.yml last changed 2026-07-26T06:29:09Z on develop,
       and the hub canonical changed later at 2026-08-08T02:24:52Z (f353630)

f353630 is a Dependabot action-SHA bump to the hub's own publish-release.yml, three uses: lines, nothing about D4. The repository's copy already carries the identical post-bump SHAs (actions/checkout@3d3c42e5 v7.0.1, softprops/action-gh-release@3d0d9888 v3.0.2), so the file it is being compared against is one it already agrees with, and the declared canonical, WORKFLOW.md#d4---release--publish, was not read at all.

This makes the failure mode concrete in a way the original report could only describe: every Dependabot bump to a hub workflow now raises an intent finding on each repository that declares that workflow, against a comparand the manifest does not name. The repository's publisher satisfies D4 on inspection, dispatch-only with a ref gate (D4.1), target_commitish: ${{ steps.nbgv.outputs.GitCommitId }} (D4.2), prerelease: ${{ github.ref_name != 'main' }} (D4.3), and release-create gated on exists == 'false' || workflow_dispatch (D4.4).

Worth noting for the fix that this one resolves cleanly: WORKFLOW.md#d4---release--publish is an anchor into a file, and comparing against the whole of WORKFLOW.md would be the noisy outcome flagged in the original report for GOVERNANCE.md#line-endings. The section-scoped comparison is what these anchors want.