chore(taxonomy): close #3216's automation-label decision with a guard

[Xore]

Follow-through on the open taxonomy decisions from the 2026-09-17 label/census audit published in #3216. The 17 label fixes are not redone here.

What the live catalogue actually said when I re-read it

The brief said the repo is busy, so I re-read everything immediately before acting rather than trusting the 2026-09-17 snapshot. Two of the six open decisions had already moved:

Decision 1 was already answered by someone else. github-actions, go and containers were created on 2026-09-27 — after the audit, before this branch. All six labels dependabot.yml references now exist. Re-creating them would have been noise, and pruning them from dependabot.yml would have been wrong: go and containers carry heavy historical usage. The create-route is what the audit's own options list implied, and it is the route taken.

Decisions made

1. frontend gets a description — the only real residue of decisions 1+2. It was the only label of 35 with an empty description. Decision 2 could not be answered from the catalogue, because the one label whose relationship to dashboard was in question was the one that documented nothing. Live catalogue mutation, not a repo change:

	before	after
frontend description	(empty)	Frontend dependency updates (Dependabot npm scope) — not the dashboard product area
frontend name / colour	frontend / eda087	unchanged

Read-back after the edit: description set, name and color unchanged, catalogue still 35 labels, and empty-description labels: [] across the whole catalogue. Carriers untouched: issue #3279 and PRs #3290/#3274 hold the same label as before — no issue was relabelled.

frontend is kept distinct from dashboard (decision 2's default), and the description now says so in the place someone looks. It is not retired: decision 2 conditioned retirement on Dependabot labels being pruned, and they were created instead. Colour is left alone deliberately — dashboard is 1d76db and moving frontend onto the Dependabot family colour would make the two indistinguishable in the sidebar, which is the exact question decision 2 asks.

2. Decision 1's drift class is now guarded. Nothing in the repo checked that automation-referenced labels are real, which is why it sat for ten days. scripts/check-label-taxonomy.py records every automation-referenced label and which of two kinds it is:

• applies — Dependabot must have the label to pre-exist, or it is dropped on every PR with no error;
• creates — a watcher owns it and runs gh label create, so absence self-heals and zero usage does not make it obsolete (the audit's own conclusion for the alarm family).

Offline it cross-checks that ledger against dependabot.yml and the watcher LABEL constants; --live asks GitHub whether each label is really there and really has a description. Unreadable catalogue → exit 2, never a silent pass.

Regression evidence

tests/docs/test_3216_label_taxonomy.py — 14 tests, each rule pinned against a synthetic tree with the real script under test:

• real tree passes offline and live (slug derived from origin, not hardcoded — my first hardcoded slug made the live test skip while appearing to verify);
• dependabot naming an undeclared label fails, naming label + ecosystem (the housekeeping: label/census audit 2026-09-17 — 17 label fixes applied, taxonomy decisions open #3216 defect verbatim);
• undeclared watcher label fails; stale ledger entry fails;
• live: absent label, empty description, and a full page treated as unreadable;
• both YAML spellings of labels: are read.

Replaying the real pre-2026-09-27 state against the real tree fails with exactly the four defects the audit named:

- Xore/APIARY: 'containers' is not in the live catalogue (dropped on every PR)
- Xore/APIARY: 'frontend' has an empty description; every other label documents itself
- Xore/APIARY: 'github-actions' is not in the live catalogue (dropped on every PR)
- Xore/APIARY: 'go' is not in the live catalogue (dropped on every PR)

Two false-pass holes I found reviewing my own guard are closed and pinned: a YAML block-style labels: list would have stopped being read entirely (verified: the old single-spelling regex returns [] for block form), and a full page of results would have reported everything past the cut as deleted.

Decisions confirmed, no change (as the audit found)

• 3. analysis vs research — both live and used as documented; no merge.
• 4. State-label family — blocked, decision, parked, HALTED, in-progress keep distinct semantics.

Escalated — not actioned, needs an operator or an issue edit

1. HALTED is the only uppercase label among five lowercase state labels. The case mismatch is real but cosmetic; the audit proposed no consolidation for this family, and renaming a label rewrites it on 16 issues (15 closed + open epic Epic: rewrite dashboard from scratch with TanStack Start, Bun, and Astryx #3279, which is under active work). That is a relabel, so it is left alone. No automation references HALTED (grep across the repo excluding vendored corpora: no hits), so a rename is mechanically safe whenever you want it — it is a judgement call, not a hazard.
2. Epic: rewrite dashboard from scratch with TanStack Start, Bun, and Astryx #3279 carries both dashboard and frontend. Real-world evidence that the two are distinct — it is a product-area epic and a Dependabot npm-scope carrier — but carrying both on a human epic is the taxonomy smell decision 2 left open. Dropping frontend from Epic: rewrite dashboard from scratch with TanStack Start, Bun, and Astryx #3279 is a relabel. Not done.
3. ops: pause honeypot containers to free RAM/CPU for heavy benchmark/training work, resume after #3135 keeps decision although it reads like a documented procedure. Removing a label is a relabel. Not done.
4. round-7 / #shadcn-N child aliases. The corrective fix lives in the child bodies, by their own campaigns. Editing issue bodies is out of scope here.
5. compose-drift-alarm's description is narrow relative to its watcher's current scope (retired stacks, health streaks, resource drift). Left as-is: it matches the watcher's own gh label create text. Worth a separate pass to widen both together.
6. main-red-alarm (created 2026-09-26) and backup-staleness-alarm (2026-09-23) post-date the audit; both are watcher-created and consistent with the doctrine, so nothing to do — noting them so the next audit does not re-derive it.

Verification

• python3 -m pytest tests/docs/ — 600 passed, 1 xfailed (pre-existing), 17 subtests, 0 failures. The pre-existing xfail count is unchanged and no test was skipped, weakened or deleted.
• check-label-taxonomy.py offline rc=0; --live rc=0.
• py_compile clean on both new files.

One thing worth knowing for whoever runs grit here: grit claim creates a worktree copy at .grit/worktrees/<agent>/, and tests/docs/test_3321_fix.py::test_pins_are_not_duplicated_anywhere_by_grep rglobs the repo tree while excluding .git/ and node_modules but not .grit/. The trivy pin therefore appears twice and that test fails for any agent using grit in-tree. I removed my worktree to leave the tree green and did not weaken the test — flagging it as a real interaction worth a separate fix.

Refs #3216. Not merging.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None