Reject YAML non-printable frontmatter residuals

[Chris0Jeky]

Summary

Refs #3006.

Follow-up to merged PR #3134 for two unresolved Codex review findings:

• reject YAML-non-printable U+FFFE and U+FFFF in policy paths and decoded quoted rule paths;
• validate comment-only frontmatter lines for forbidden characters before skipping comments.

Regression-first evidence

c95a670827706425eb0cda66b231f34a369ac993 adds focused coverage for:

• matching policy/rule paths containing U+FFFE or U+FFFF;
• decoded quoted rule paths containing those sentinels;
• comment-only frontmatter lines containing NUL, C1 NEXT LINE, U+FFFE, or U+FFFF.

Scope

• scripts/check-docs-governance.mjs
• scripts/check-docs-governance.review-residuals.test.mjs

No workflow, policy, rule-frontmatter, or canonical status changes.

Verification

Exact head b35149425fb0f0329169e0c572d81f80105a731c has green required CI, Smart CI self-tests, docs governance, security, backend solution, containers, visual regression, and Chromium/Firefox/mobile browser matrices. The advisory WebKit internal-error failure is the pre-existing #2763 flake and is owned by #3157.

[Chris0Jeky]

Implementation review complete. Required CI, docs governance, Smart CI self-tests, visual regression, Chromium/Firefox/mobile browser matrices, backend solution, containers, security, and dependency review are green on b35149425fb0f0329169e0c572d81f80105a731c. The only red is the known intermittent WebKit internal-error lane tracked by #2763; this two-file parser/test change does not touch browser or application code, and PR #3157 owns the navigation hardening. Moving this bounded residual fix to review.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-18T03:37:49.418678Z	b351494	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b35149425f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Left draft. This branch was updated the morning of 2026-09-18 and is treated as in-flight (criterion 4): not marked ready, not reviewed as complete, not merged. Resume from the existing head; do not steal the session.

[Chris0Jeky]

Not a finding: tabs in comment-only frontmatter lines are already permitted, and I measured it.

The whole-line check is not FORBIDDEN_SCALAR_CONTROL for comments. validateFrontMatterStructure picks the pattern per line:

const commentOnly = /^ *#/.test(line)
const forbiddenCharacter = commentOnly ? FORBIDDEN_COMMENT_CONTROL : FORBIDDEN_SCALAR_CONTROL

and FORBIDDEN_COMMENT_CONTROL = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F��]/u deliberately excludes U+0009. scripts/check-docs-governance.review-residuals.test.mjs already pins this with the case permits horizontal tabs in comment-only frontmatter content (9/9 pass locally).

Measured directly by injecting each shape into .claude/rules/ci-control.md and running node scripts/check-docs-governance.mjs (file restored afterwards, git status clean):

injected frontmatter line	exit
# owner<TAB>team	0 — accepted
# owner<U+FFFF>team	1 — rejected
# owner<NUL>team	1 — rejected
- "docs/<U+FFFF>/**"	1 — rejected
description: "a<TAB>b"	1 — rejected

The last row is a real residual, on the other branch of the ternary: a horizontal tab inside a non-comment frontmatter line is now rejected although a YAML loader accepts a tab inside a quoted (or plain) scalar, so this is a new over-strictness, not the fail-open shape the check targets. Leading-tab indentation already has its own earlier, correctly-worded error, so the structure check could use FORBIDDEN_COMMENT_CONTROL for both branches.

Non-blocking under global law 2a: the only rule file this validator reads is .claude/rules/ci-control.md, no shape like that exists in it, and the check fails closed with the file named. Tracked on #3006 rather than fixed here.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.