Closes soc-v07b — Enforce finding-registry contract.
Why
- A2 audit classified finding-registry as doc-only. The registry is
the canonical reusable-finding intake for planning + judgment;
unchecked, schema or contract drift silently breaks downstream
consumers (compiler, planning rules, pre-mortem checks).
What
- scripts/check-finding-registry.sh (NEW): validates schema is
valid JSON, required-field list cross-checks with contract doc
(accepts both `foo` and `foo.child` forms for nested object
fields like `source`), canonical path is documented in the
contract, and if a runtime `.agents/findings/registry.jsonl`
exists every line parses as JSON and carries 8 top-level
required fields. Honors AGENTOPS_FINDING_REGISTRY_SKIP=1.
- GOALS.md: new gate row finding-registry, weight 4.
- .github/workflows/validate.yml: new validate-finding-registry
job. Registered in summary.needs[] + summary echo per validate-
ci-policy-parity (56 jobs, 7 non-blocking).
- scripts/pre-push-gate.sh: new always-on check 22j (<200ms).
- AGENTS.md: CI Jobs row for validate-finding-registry.
- tests/scripts/pre-push-gate.bats: stub for the new gate script.
Verification
- check-finding-registry.sh: PASS (schema valid; 19 required fields
cross-checked; 5 live registry lines validated on this box).
- shellcheck: clean.
- pre-push --fast: green.
Migrates A2 classification: finding-registry → enforced.
Companion: A2 audit soc-nzji (cycle 19), factory-yield-ledger gate
(soc-olsa cycle 37) — same enforcement pattern.
Boden Fuller