spec/divergences.json 'gaps' has no disposition for .github/actionlint.yaml or .github/actions/validate/action.yml, so audit.py flags them as untriaged every run

[ptr727]

What happened

spec/audit.py reports both of these as hub-only findings on ptr727/HomeAutomation-Config on every run, current main included:

DRIFT  hub-only: .github/actionlint.yaml is undeclared in spec/files.json and this repo carries it - read the file and triage it in spec/divergences.json 'gaps' (this repo's own content at a shared path, a carry to declare, or a hub copy to delete)
DRIFT  hub-only: .github/actions/validate/action.yml is undeclared in spec/files.json and this repo carries it - read the file and triage it in spec/divergences.json 'gaps' (this repo's own content at a shared path, a carry to declare, or a hub copy to delete)

Read both -- they're genuinely this repo's own content at paths the hub also hosts, matching the existing accepted pattern already used for LICENSE, TODO.md, .husky/pre-commit, and scripts/README.md in the same gaps array:

• .github/actionlint.yaml: this repo's own self-hosted-runner labels (homelab, ubuntu-24.04) for its self-hosted CI runner -- entirely different content from the hub's own .github/actionlint.yaml, which configures $/ self-reference ignore rules for the hub's own workflows.
• .github/actions/validate/action.yml: this repo's own override of the interface-workflow validate hook (WORKFLOW.md's "Interface workflows" contract), running CloudInit's nested Python project through uv/ruff/pyright/pytest. The hub's own file at this same path is a different override -- its own registry/spec self-test suite. Per WORKFLOW.md, this is exactly the intended override mechanism: a repo declaring its own .github/actions/validate/action.yml is the documented way to plug a repo-specific validate hook into the shared validate-task.yml, not drift to reconcile.

There's no spec/divergences.json gaps entry for either path, so they stay untriaged and keep re-surfacing as findings with no way to close them out, unlike the four already-accepted paths above.

Suggested fix

Add two accepted entries to spec/divergences.json's gaps array, one per path, with a reason along the lines of "this repo's own content at a shared/interface path" (matching the existing accepted entries' shape), or -- for .github/actions/validate/action.yml specifically, since it's the documented interface-workflow override point named in WORKFLOW.md section 3 ("Interface workflows... Honor the named contract... rather than copying bytes") -- consider whether the detector should exempt interface-workflow override paths generically rather than needing a per-repo gaps entry for each repo that overrides one.

audit run 2026-08-25T13:46:24Z | hub fa63163

[ptr727]

Fixed by PR #994 (merged to develop), promoted to main via PR #996 and released as v2.0.471. Verified live on origin/main: spec/divergences.json 'gaps' now carries accepted entries for both paths, with disposition reasons explaining each as a path collision rather than a carry (HomeAutomation-Config's own self-hosted-runner actionlint config, and its own validate-hook override per RESYNC.md 'Interface workflows'):

{ "path": ".github/actionlint.yaml", "disposition": "accepted", ... }
{ "path": ".github/actions/validate/action.yml", "disposition": "accepted", ... }

This did not auto-close on merge (unlike #987/#988, which closed at the PR #996 merge timestamp), closing manually now with the evidence above.