fix(telemetry_policy): suppress baseline fallback on canon_url override

When canon_url is provided, getFile() previously still appended the
klappy.dev baseline as a search source. A missing governance file in the
override canon would be silently satisfied by the baseline, causing
governance_source to report 'canon' instead of 'minimal'.

Add an optional skipBaselineFallback flag to ZipBaselineFetcher.getFile
and pass it from the telemetry_policy handler when canon_url is set, so
a missing file in the override canon correctly falls back to the
minimal tier.

Author: cursoragent

workers/src/index.ts

@@ -521,7 +521,14 @@ Time filter example: WHERE timestamp > NOW() - INTERVAL '30' DAY`,
       let governanceSource: "canon" | "baseline" | "minimal" = "minimal";
 
       try {
-        const content = await fetcher.getFile("canon/constraints/telemetry-governance.md", canon_url);
+        // When a canon_url override is provided, suppress the baseline fallback
+        // so a missing file in the override canon surfaces as "minimal" rather
+        // than silently serving the klappy.dev baseline.
+        const content = await fetcher.getFile(
+          "canon/constraints/telemetry-governance.md",
+          canon_url,
+          canon_url ? { skipBaselineFallback: true } : undefined,
+        );
         if (content) {
           policyContent = content;
           const parsed = parseSelfReportHeadersTable(content);

workers/src/zip-baseline-fetcher.ts

@@ -978,12 +978,25 @@ export class ZipBaselineFetcher {
    * Get a specific file from the baseline or canon.
    * Content-addressed: file cache is keyed to each repo's own commit SHA.
    * Three-tier: module memory → R2 → ZIP extraction.
+   *
+   * When `options.skipBaselineFallback` is true, the baseline repo is not
+   * appended to the search sources. Callers that need to distinguish between
+   * "file found in the canon_url override" and "file found in the baseline
+   * fallback" can pass this flag so a null return unambiguously means the
+   * override canon lacks the file.
    */
-  async getFile(path: string, canonUrl?: string): Promise<string | null> {
+  async getFile(
+    path: string,
+    canonUrl?: string,
+    options?: { skipBaselineFallback?: boolean },
+  ): Promise<string | null> {
     const baselineRepoUrl = "https://github.com/klappy/klappy.dev";
+    const skipBaselineFallback = options?.skipBaselineFallback === true;
 
-    // Resolve SHA for each repo independently
-    const baselineSha = await this.getLatestCommitSha(baselineRepoUrl);
+    // Resolve SHA for the baseline only when it will actually be searched.
+    const baselineSha = skipBaselineFallback && canonUrl
+      ? null
+      : await this.getLatestCommitSha(baselineRepoUrl);
 
     // Build the list of repos to search, each with its own SHA
     const sources: Array<{ url: string; repoKey: string; sha: string }> = [];
@@ -998,13 +1011,15 @@ export class ZipBaselineFetcher {
       });
     }
 
-    sources.push({
-      url: this.env.BASELINE_URL.includes("raw.githubusercontent.com")
-        ? this.env.BASELINE_URL.replace("/main", "").replace("raw.githubusercontent.com", "github.com")
-        : baselineRepoUrl,
-      repoKey: getCacheKey("baseline"),
-      sha: baselineSha || "unknown",
-    });
+    if (!(skipBaselineFallback && canonUrl)) {
+      sources.push({
+        url: this.env.BASELINE_URL.includes("raw.githubusercontent.com")
+          ? this.env.BASELINE_URL.replace("/main", "").replace("raw.githubusercontent.com", "github.com")
+          : baselineRepoUrl,
+        repoKey: getCacheKey("baseline"),
+        sha: baselineSha || "unknown",
+      });
+    }
 
     for (const source of sources) {
       // Content-addressed cache key: repo identity + repo SHA + file path