feat(repos_sync): check the hygiene conductor's repo coverage

[Jammy2211]

The Mind half of PyAutoLabs/PyAutoBrain#197 — paired with PyAutoLabs/PyAutoBrain#200, which repairs the conductor itself. Safe to merge in either order: the check skips cleanly when PyAutoBrain is not checked out.

Why the firewall could not catch this

The hygiene conductor's repo arrays drifted to five libraries of six and four organs of seven, with every drift check green. The tenant firewall had an entry for hygiene.sh — but it allowlisted the stale names. It asked "are these names permitted here?" when the question was "does this cover the organism?".

check_hygiene_coverage asks the second question, in two legs because either alone is escapable:

Leg A — every reader the conductor might use returns exactly the declared sets.

Worth being precise about what this can and cannot prove: the conductor reads repos.yaml, so a manifest edit moves both sides together and they can never desynchronise — that is the whole point of deriving. What leg A actually guards is the reader, specifically the PyYAML-free fallback, which runs only where PyYAML is absent and is verified nowhere else. A fallback that quietly drops a repo is exactly the original bug's class, so both readers run and both must agree. A --parser flag was added to the helper for this.

Leg B — no repo name is written back into a *_REPOS=(…) array. This is what stops a future edit from "simplifying" the derivation away.

Both legs were driven with failing input before being trusted

A drift check that cannot fail is decoration.

• Leg B, on a re-hardcoded array → caught PyAutoFit, PyAutoLens.
• Leg A, on a deliberately narrowed fallback regex → caught 4 repos dropped by the minimal reader alone, while the PyYAML reader stayed correct. This is precisely the invisible case.
• My first attempt at leg A passed when it should have failed — that is how the tautology above was found, and why the check now tests the reader rather than the content.

The allowlist entry is removed, not updated

The conductor now names no instance fact at all (verified by running the token scan over both its files), so re-adding an entry would re-permit the drift this check exists to catch. A comment in its place says so.

Testing

• 88 passed on Python 3.12 (the version the privacy job pins), plus 3.11 — 9 new.
• repos_sync.py --check gains exactly one line and nothing else: diffed against a stashed baseline to prove the 6 tenant-firewall mismatches it still reports are pre-existing PyAutoHands drift, not introduced here.
• lifecycle.py check: OK.
• Fixtures are fictional throughout — tests/** is KEEP-copied verbatim into the public template, and a test that hardcodes the list under test can only agree with itself.

---

Generated by Claude Code