fix(testing): the E2E board published 12 divergences that do not exist

[beyondnetPeru]

They were not product defects. All twelve had one shape — MCP FORBIDDEN while CLI and REST succeeded — and the message names the cause:

Native: []. OPA: [OPA_ERROR: ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING_FLAG:
A dynamic import callback was invoked without --experimental-vm-modules]

Native ABAC raised no violation. The OPA engine could not load its wasm for want of a Node flag, and dispatch requires both engines to allow, so every tools/call fail-closed. The capture that produced them was made on 2026-08-03 at 09:56 by a run launched without that flag; npm run test:exploration does pass it. Re-run through the npm script, the same suite reports zero findings — measured, not argued.

The defect is in this board, not in the product

It rendered a stale capture with no indication of age, and twelve non-existent divergences read as observed fact. A derived artifact exists to make exactly that impossible.

coverage.json carries no timestamp of its own, so the page now stamps the file's mtime and names the command that produces it. A reader can see the measurement predates the tree it describes.

Four hypotheses died on the way, and none was the answer

Hypothesis	Refuted by
Classification drift rego ↔ TS map (the GT-602 shape)	All twelve tools are classified, all as read_tools
A role the policy does not know	reader needs no named role — read tools allow any role
A missing/mismatched scope	None of the twelve declares one; requiredScope resolves to read
A harness that never authenticates	It starts the server with allowNoAuth: true → READER_CONTEXT

The message was in howto-capture.json the whole time. Reading it first would have cost four fewer steps.

Not changed here

The exploration suite is red on this machine for an unrelated and already recorded reason: the how-to capture embeds rule ids that differ by environment (DRIFT-01 on the runner, INH-03 here), documented in GT-650. Regenerating locally fixes one half and breaks the other, so those files are left untouched.

Guard	Result
ci-runner.mjs governance	✅ 17 scripts
generate-e2e-scenario-board --check	✅ current
gitleaks dir .	✅ exit 0

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

📊 Bilingual Coverage Impact

PR Changes

• Paired EN/ES files modified: 1
• New EN files needing ES translation: 0

Repository Coverage

Metric	Value
Total EN files	527
Total ES files	501
Paired files	0
Coverage	0%

✅ Good: All EN changes have ES counterparts.

---

Generated by GitHub Actions