feat(website): the .t27 catalog syncs itself from GitHub, nightly

[gHashTag]

The catalog behind the Queen map and the Spec Explorer had been frozen at 856 specs since 2026-09-12 while GitHub held far more. Three things had to be true at once, and all three are fixed here: the founding sync read a laptop, the nightly workflow never ran it and died at an unrelated gate, and its push to main is refused by the work-report ruleset.

1407 specs across 10 repositories, from GitHub, with no machine of anyone's in the path.

{
  "version": 1,
  "head_sha": "604c0186d2c7bc40e8bf6790ff0ec99912d6274a",
  "summary": "The .t27 catalog now refreshes itself from GitHub nightly: the founding sources are pulled as tarballs instead of read from a developer's working copy, the scheduled workflow runs that sync and lands its result through a pull request, and the gate that had been failing every night since 2026-09-13 now asserts the invariant it states.",
  "changes": [
    "scripts/sync-t27-specs.mjs pulls gHashTag/t27 from a GitHub tarball at a named ref instead of reading a working copy at T27_ROOT, which CI does not have; the local checkout is now opt-in through T27_LOCAL=1 for compiler work.",
    "The teaching course, whose nine specs live on a branch never merged to master, is vendored through a named overlay ref that contributes only the paths the main ref lacks, so the overlay contributes nothing once the course is merged.",
    "The compiler wasm is reused from the copy already vendored beside the corpus when no cargo build is present, so a spec refresh no longer requires a Rust toolchain and no longer silently swaps the compiler.",
    "Files a spec names in SOURCES or BODY_EN that are not .t27 are vendored from the same tarball at the same commit, which restores the seven docs/system markdown documents a docs chapter renders.",
    "qa/tools-spec-contract.mjs asserts that every MCP server lists tools or is marked external, per its own message, instead of summing the two counts as though they were disjoint; mcp/inngest-dev is truthfully both.",
    ".github/workflows/t27-world-scan.yml runs the founding sync as its first step, and commits to a branch, generates a work report from the artifacts it wrote, opens or updates a pull request and enables auto-merge instead of pushing to main, which ruleset 23148303 refuses.",
    "Duplicate copies are recorded as {path, repo, sameAs} pairs by both vendor paths and carried through the manifest rebuild, and the Spec Explorer shows a spec's other homes.",
    "The embedded Spec Explorer lifts its course filter whenever an address names a spec, so the homepage frame no longer reads 9 specs beside a map reading 856.",
    "The .spec-x-brief box no longer shrinks below its content in either variant: measured at 404px it was a 0px box around 636px of content drawing over the tab strip and the code.",
    "The apex deploy workflow copied a fixed list of four data directories while the build produces ten, so the six generated catalogs behind the Explorer tabs were live only because a person had copied them; it now iterates what the build produced.",
    "A failed universe-atlas.json fetch used to replace the whole Queen shell, taking all thirteen tabs down with the map; the shell now mounts without the atlas, as it already does for a connected repository, and the failure is reported over it with a retry.",
    "The catalog itself moved from 856 specs across 8 repositories to 1407 across 10, adding tt-trinity-euler and turbobaby-user-bot and attributing chips/euler to the repository that owns it."
  ],
  "tests": [
    {
      "command": "npm run check:discovery check:shared-core check:spec-catalog check:queen-atlas check:queen-catalog check:queen-continuous check:queen-spec-mirrors check:skills-catalog check:crons-catalog check:agents check:tools check:docs",
      "result": "all twelve catalog gates pass against this tree",
      "status": "passed",
      "evidence": "run with BOT_ROOT and T27_ROOT pointed at a nonexistent path so the sibling-checkout branches behave as they do on a runner"
    },
    {
      "command": "node scripts/sync-t27-specs.mjs with T27_ROOT unset",
      "result": "the founding corpus was vendored from GitHub with no local checkout",
      "status": "passed",
      "evidence": "manifest generatedFrom.source reads github tarball gHashTag/t27@master, wasmSource reads the copy already vendored here, and the overlay contributed 11 paths not on master"
    },
    {
      "command": "npm run discover -- scan && npm run discover -- vendor && npm run core -- index && npm run atlas -- scan && npm run atlas -- build",
      "result": "the full nightly chain ran end to end and produced 1407 specs across 10 repositories",
      "status": "passed",
      "evidence": "atlas reports 10 worlds, 1167 issues, 167 shared opportunities; shared-core reports 1407 specs and 91 collisions"
    },
    {
      "command": "npm run typecheck:ratchet",
      "result": "179 errors across 26 files, unchanged from the baseline",
      "status": "passed",
      "evidence": "the runner printed: no file gained type errors"
    },
    {
      "command": "npx vite build",
      "result": "the production build completed without errors",
      "status": "passed",
      "evidence": "built in 21.57s after the final gate run"
    },
    {
      "command": "browser measurement of the Spec Explorer at 404 and 1280 CSS pixels",
      "result": "the brief no longer draws over the tab strip at either width",
      "status": "passed",
      "evidence": "at 404px the brief is 405px with its 636px of content scrolling and the tab strip at y=583; at 1280px it is 308px and uncapped, as before"
    },
    {
      "command": "npm run lint",
      "result": "ESLint reports 180 problems, the same count as origin/main",
      "status": "failed",
      "evidence": "the identical 180 problems appear with this branch's source reverted, so the count is pre-existing and untouched here"
    }
  ],
  "limitations": [
    "The duplicate-pair list ships empty in this commit: the pairs were recorded by the founding sync and then dropped by the vendor step, and that ordering was fixed after the corpus had already been rebuilt. The next scheduled refresh writes them.",
    "Health is what the vendored compiler said at scan time, not a claim that a spec is correct or that its generated code was run.",
    "Eleven t27 specs, the teaching course among them, reach the site only through a named overlay ref; a reader cloning master alone will not find them.",
    "The scan reads public repositories only, so a private repository writing .t27 specs stays invisible to the map.",
    "Auto-merge on the nightly pull request depends on two repository settings that were enabled for this, and it will fall back to leaving the pull request open if either is turned off again."
  ],
  "tags": ["t27", "catalog", "automation", "specs", "website"],
  "blog": {
    "title": "The catalog that could not refresh itself",
    "summary": "A nightly job had been running for three days, rebuilding the spec catalog correctly every time and throwing the result away, while the repository holding two thirds of the corpus was the one repository it could not read at all.",
    "outline": [
      "The symptom was that the map and the library disagreed with GitHub, and the first instinct is to look for a data divergence between the two artifacts the two screens read; they agreed exactly, and shared a manifest hash, so the divergence was between both of them and the source.",
      "The founding sources were pulled from a working copy at a hard-coded path on one developer's machine, which meant that no runner could ever refresh them, and that whatever branch the checkout happened to be standing on became the corpus the world saw.",
      "The nightly job did rebuild the discovered worlds correctly on each of its three runs, and each time it aborted at a gate about MCP servers that had nothing to do with the scan, before it reached the step that commits.",
      "That gate asserted a sum where its own message stated a disjunction, which held only for as long as no external server listed any tools, and stopped holding the day one truthfully did both.",
      "Fixing all of that still left the job unable to push, because a ruleset now requires a work report on the branch it was pushing to, so the job takes the route everybody else takes and opens a pull request with a report generated from the artifacts it just wrote."
    ]
  }
}