Include required governance artifact in website qualification snapshot

Retain actual candidate F failure and unchanged canonical governance plan; keep complete native and website gates and record pending browser regressions.

Author: KSemenenko

mcaf-governance.plan.md

@@ -0,0 +1,28 @@
+# MCAF governance plan
+
+Status: implementation snapshot `3559225a5f918160e46e32c9a812c3f71790e382` is on `main`; exact-SHA CI run [36988949282](https://github.com/managedcode/KeyLoad/actions/runs/36988949282) failed on governance because this ignored plan was absent from the checkout and Windows normalized `AGENTS.md` line endings. The plan is now updated and is explicitly unignored as a required governance source artifact for the next delivery commit; `.gitattributes` pins root and local policy files to LF. These repairs have passed local governance, but require a new exact-SHA three-OS run. Inputs: [brainstorm](mcaf-governance.brainstorm.md), [acceptance](mcaf-governance.acceptance.md), [feature](docs/Features/RepositoryGovernance.md), [ADR-032](docs/ADR/ADR-032-mcaf-governance.md).
+
+## Ordered work and completion criteria
+
+- [x] Inventory and read current root policy, upstream template, tutorial, .NET configuration and all existing local governance (none existed).
+- [x] Establish GitHub baseline: [36926803549](https://github.com/managedcode/KeyLoad/actions/runs/36926803549), commit 9c570f8c33a7a9667507a8e1c0ca68860de3be45, successful complete CI. No new local tests run. This baseline predates the newer mandatory implementation migrations.
+- [x] Create stable REQ/AC, task ownership, acceptance and ADR contracts before coding workers start.
+- [x] Save exact current root prefix preservation record and skill inventory; merge customized template requirements without deleting any existing byte.
+- [x] Create architecture diagrams and full slice-to-surface map before delegated implementation.
+- [x] TASK-MCAF-LOCAL-002: local policies were reviewed and preserved across the current 25-project/four-module inventory; no policy was weakened or omitted.
+- [x] TASK-MCAF-CHECK-003: validator and scripts policy complete; positive validation and altered-prefix/missing-policy/unsafe-path rejection evidence reviewed.
+- [x] Join TASK-MCAF-REVIEW-001, both coding tasks and independent TASK-MCAF-REVIEW-005; every diff, evidence packet and terminal state inspected.
+- [x] Integrated local static validation passed for 25 projects/four modules; whitespace and local links were reviewed; architecture/governance diagrams rendered with the existing cached Mermaid CLI 11.12.0; the repository MCAF skill inventory remains empty. GitHub cross-platform validation is not yet green.
+- [x] Record AC-MCAF-001 through AC-MCAF-007 local configuration outcomes and exact conflict register in docs/implementation/mcaf-installation.json.
+
+Delivery constraint: do not publish a governance-only snapshot that records concurrent analyzer projects while omitting their source. New GitHub qualification must run on the complete committed snapshot. Local configuration, rendered documentation and source review do not claim a new CI run or production qualification. The owner-selected .gitignore excludes task scaffolding; its explicit exception now includes this validator-required governance plan in the qualified source snapshot.
+
+## Baseline failures and implementation gaps
+
+The recorded 9c570f8 baseline passed, but it predates mandatory product migrations. Exact candidate `3559225a5f918160e46e32c9a812c3f71790e382` built on Linux, macOS and Windows before governance; run 36988949282 failed on four analyzer tests, two comparison tests, 20 RF3 integration tests, and governance on all three matrix OSes. Governance symptoms are a missing tracked `mcaf-governance.plan.md` and Windows CRLF conversion of the preserved root-policy prefix; both source/packaging repairs are prepared, with local governance pass only. Comparison fixes for the Timescale resource-name collision and overbroad digest assertion are prepared. RF3 began with a byte-array reference assertion, a retained-snapshot `Validation`, and a leader-loss read with an unclassified safe internal-request rejection; the latter left a shared node stopped and caused most later connection/MCP failures. Test diagnostics now preserve the error code and both destructive scenarios attempt bounded container recovery. No exact-SHA rerun has qualified these repairs.
+
+## Task graph and methodology
+
+Read-only highest-capability review runs in parallel with lead-owned contracts. After contracts and root policy exist, least expensive capable workers write disjoint local governance and validator paths. Integration waits for all required complete results. Workers stop on ambiguity and return complete/blocked/failed/cancelled with changed paths, requirement IDs, commands, outcomes and limitations.
+
+Validation order: governance validator (project coverage/preservation), complete diff review (no weakened policy), architecture/link/Mermaid source review (coherent navigation), GitHub baseline inspection (evidence source). No newly installed skill is required or permitted. Runtime build/analyze/test/format/complexity/coverage gates remain required for later production changes and are not invented or skipped to call this bootstrap production qualification.

site-publication.plan.md

@@ -157,3 +157,35 @@ strict unsupported-schema rejection and previous verified public output; do not
 silently reinterpret, fabricate stream measurements or fall back after selected
 success. Producer/schema3 migration is independently scoped and cannot establish
 current website or database qualification from a failed artifact.
+
+## Actual candidate F governance baseline, 2026-10-02
+
+- [x] Candidate `a3bc3adb8974bd1c7e14431ad3f1c6c9f60a707d`,
+  [run37005652004](https://github.com/managedcode/KeyLoad/actions/runs/37005652004),
+  [qualify job110833177216](https://github.com/managedcode/KeyLoad/actions/runs/37005652004/job/110833177216)
+  completed with failure at static governance: the required canonical
+  `mcaf-governance.plan.md` was absent from the scoped committed snapshot.
+  Three focused formatter checks passed, with empty retained diagnostics.
+  Native Analyzer TUnit ran118/118 passing,0 skipped; TRX SHA256
+  `52d2215d36895a8189141b500700846a2bfc1ed55fa01d0bfebe1e016630f5a2`.
+  Numeric native gate passed, report SHA256
+  `9d8cb1a5aea3745037950428f8fdba1c9855620aaa8ae8ffcf885e8389743573`.
+  Full Site TUnit/Chrome/JS gates were skipped and remain unqualified.
+- [x] Immutable qualification artifact11225886317 was downloaded and inspected:
+ 865524 bytes, SHA256
+ `6c86e543fbcbee47da1cec43e5ffa909acf62100795ce12179ab75a796994064`.
+ This is failure evidence, not publication or a green suite receipt.
+- [ ] TASK-SITE-GOVERNANCE-SNAPSHOT-033: root adds the existing unchanged
+  required governance plan to the next ordinary descendant candidate, with this
+  execution record. Strongest reviews the exact two-file diff and parent/blob
+  inventory. Do not edit the validator, other chat's plan, `.gitignore`, runtime,
+  README or global status. Repeat the complete GitHub gate with the same authentic
+  comparison input. No source test exists for adding an unchanged required
+  documentation artifact; static governance and the real full workflow are the
+  direct positive/negative evidence. This does not waive any acceptance criterion.
+  F4 tracks the required plan directly. That borrowed plan's `.gitignore`
+  preparation statements describe the other owner's shared-workspace changes;
+  F4 retains its parent's `.gitignore` bytes and includes no such config change.
+- [ ] TASK030/032 production repair remains blocked until the corresponding
+  real Site regression failures are recorded; this governance failure does not
+  count as their red baseline. No deployment occurred.