[Bug]: main's TypeScript digest-owner guard fails — progress_review_evidence.ts restates the bare SHA-256 shape #6117

LoopX version or commit: main 27090f049 (introduced by #6066, f968b6e27)

Host or runtime surface: Not host-specific

Area: Control plane / TypeScript core (static architecture guard)

Summary

loopx/control_plane/work_items/progress_review_evidence.ts states the bare SHA-256 shape itself instead of reading it from the single owner loopx/control_plane/content_digest.ts:

fail(typeof binding.criteria_sha256 === "string" && /^[a-f0-9]{64}$/.test(binding.criteria_sha256));
      && typeof binding.contract_digest === "string" && /^[a-f0-9]{64}$/.test(binding.contract_digest)
      && typeof binding.todo_semantic_digest === "string" && /^[a-f0-9]{64}$/.test(binding.todo_semantic_digest)

The owner exports that shape as BARE_SHA256_PATTERN = /^[0-9a-f]{64}$/; the three call sites spell the same character class in the other order, i.e. the same policy with a second statement of it.

The TypeScript architecture guard tests/control_plane_ts/content_digest_single_owner.test.ts exists to catch exactly this, and it does:

not ok 233 - no second whole-value digest matcher is reachable in the static model, outside recorded exceptions
  +   'control_plane/work_items/progress_review_evidence.ts:50 /^[a-f0-9]{64}$/',
  +   'control_plane/work_items/progress_review_evidence.ts:56 /^[a-f0-9]{64}$/',
  +   'control_plane/work_items/progress_review_evidence.ts:58 /^[a-f0-9]{64}$/'

Impact

PR #6066 was merged with this required check failing, so main is currently red: typescript-core reports # fail 1 and typescript-coverage fails, which makes the required checks job and merge-gate fail for every pull request based on current main (see checks: ValueError: typescript-coverage must be success). Every subsequent PR inherits a failing required check that it did not cause.

Reproduction

npm ci --ignore-scripts
node --no-warnings --experimental-sqlite --experimental-strip-types --test \
  tests/control_plane_ts/content_digest_single_owner.test.ts

On current main this ends with # pass 16 / # fail 1, and the failing assertion lists the three sites above. The failure is deterministic and reproduces from the source alone, with no fixture or local state.

Expected

The three fields are validated through BARE_SHA256_PATTERN from the owner, the guard passes, and the module is added to the guard's pinned CANONICAL_CONSUMERS, which is the guard's designed review event for a new reader of the owner.

Evidence

• Failing required check on the merged head: https://github.com/loopx-project/loopx/actions/runs/38026035693 (job typescript-core (1/3)), not ok 233 / # fail 1
• checks job for the same run: ValueError: typescript-coverage must be success

I reproduced the same three-site failure locally from main and will open the repair as a pull request that closes this report.