docs: fix documentation drift — AGENTS.md architecture tree for scripts/ section

[github-actions]

Documentation Freshness Audit

This audit compared code against documentation across AGENTS.md, docs/*.md, README.md, and prompts/create-ado-agentic-workflow.md.

Findings

Area	Issue	File(s)
Architecture tree	scripts/gate.js listed as a committed file, but it is in .gitignore (build artifact)	AGENTS.md
Architecture tree	scripts/ado-script/src/ showed only import/ — missing gate/ and shared/ subdirectories	AGENTS.md

Details

scripts/gate.js — not a repo file

The AGENTS.md architecture tree listed scripts/gate.js as a committed file with the label "Bundled gate evaluator (built from scripts/ado-script/, see docs/ado-script.md)". However:

• scripts/gate.js appears in .gitignore (line 1)
• The actual build output goes to scripts/ado-script/dist/gate/index.js (produced by npm run build:gate via ncc)
• The release workflow zips dist/ into ado-script.zip; pipelines download that asset at runtime (see src/compile/extensions/ado_script.rs:108-110)
• docs/ado-script.md correctly describes dist/ as gitignored

scripts/ado-script/src/ missing subdirectories

The tree showed only import/ but the actual source has three subdirectories:

• gate/ — Gate evaluator source (index.ts, bypass.ts, facts.ts, predicates.ts, selfcancel.ts) — bundled to dist/gate/index.js
• import/ — Runtime prompt resolver source — bundled to dist/import/index.js
• shared/ — Modules shared across bundles: auth.ts, ado-client.ts, env-facts.ts, policy.ts, types.gen.ts, vso-logger.ts

docs/ado-script.md already documents all three subdirectories correctly in its own architecture diagram.

No other drift found

All other areas checked were accurate:

• CLI commands in docs/cli.md and README.md match src/main.rs
• FrontMatter fields in docs/front-matter.md match src/compile/types.rs
• Template markers in docs/template-markers.md match the base YAML templates
• Safe output tools match src/safeoutputs/
• Schedule syntax matches src/fuzzy_schedule.rs
• Engine defaults (claude-opus-4.7) match src/engine.rs
• Pool defaults (ubuntu-22.04 / AZS-1ES-L-MMS-ubuntu-22.04) match src/compile/common.rs
• Network domains in docs/network.md match src/allowed_hosts.rs
• prompts/create-ado-agentic-workflow.md model table and safe-output tool table are complete and accurate

Applied Fixes

• Removed scripts/gate.js from the AGENTS.md architecture tree (gitignored build artifact)
• Updated scripts/ado-script/src/ in AGENTS.md to list all three subdirectories: gate/, import/, shared/

---

This pull request was created by the automated documentation freshness check.

---

Warning

Protected Files

This was originally intended as a pull request, but the patch modifies protected files. These files may affect project dependencies, CI/CD pipelines, or agent behaviour. Please review the changes carefully before creating the pull request.

Click here to create the pull request once you have reviewed the changes

Protected files

• AGENTS.md

To route changes like this to a review issue instead of blocking, configure protected-files: fallback-to-issue in your workflow configuration.

Generated by Documentation Freshness Check · ● 5.9M · ◷