docs: correct site repository name, visibility, protection, and conformance coverage

[qmarcelle]

Wave 0 documentation truth for this repository. META-246 (ledger items 21, 23) and META-267 (items 24, 25).

No schema bytes, no stable read paths, no package metadata, no types. Nothing in AGENTS.md's "do not change without an issue" list is touched.

Site repository name — item 21

workspacejson/site does not exist and never did. The repository is workspacejson/workspacejson.dev.

Corrected in 11 places across 8 files — README, OWNERSHIP, GOVERNANCE, SUPPORT, CONTRIBUTING, SECURITY, AGENTS, and the Copilot instructions. The audit listed three; the name had spread further than that. Both ASCII dependency diagrams were recentred for the longer label.

One occurrence is deliberately left alone: docs/adr/002-bounded-enrichment-program.md:47. ADR-002 is a governance record under an amendment protocol, and silently editing a record is precisely what that protocol exists to prevent. It is flagged for amendment rather than fixed here. ADR-002 is Proposed, so nothing currently relies on it.

Branch protection — item 23

The README claimed the repository is private and on a plan without branch protection. It is public, and protection is enabled. But the correct replacement is neither the inverse of that claim nor a simple missing-control list. Measured against the GitHub API on 2026-08-04:

required_approving_review_count : 0
require_code_owner_reviews      : true
enforce_admins                  : false
rulesets                        : []
required checks                 : test (20), test (22), Four-path producer conformance  (strict)
dismiss_stale_reviews           : true
required_conversation_resolution: true
allow_force_pushes / deletions  : false

docs/repository-settings.md asserted "a pull request with at least one approving review" and "enforce on admins". Both are false.

The actual defect is structural, not a missing toggle

An earlier revision of this PR said the code-owner requirement "cannot bind" while the general count is 0. That was wrong and has been corrected in dcdba7f. require_code_owner_reviews is an independent control — it blocks an affected pull request until a code owner approves, regardless of the general count. It is not inert.

The real problem is the combination of four facts:

1. general approving-review count is 0, so paths no code-owner rule reaches get no review requirement;
2. code-owner review is enabled and does bind;
3. .github/CODEOWNERS assigns * and every specific path to a single owner, @qmarcelle, who authors the changes — and GitHub does not let an author approve their own pull request, so the code-owner gate cannot be satisfied from within;
4. enforce_admins: false, so the same account can bypass the protection entirely.

The controls are configured. What is missing is a second person.

Remediation therefore is not "set the count to 1". It needs an independent maintainer/code owner first, then a required approval, then admin enforcement or a no-bypass ruleset with a bounded release exception, with .github/CODEOWNERS itself staying protected (already true at CODEOWNERS:29).

This is not currently a credentialed package-publication risk — this repository holds no npm credential and ships no release workflow. It is not harmless in general: main here is the public canonical source of the standard, so unreviewed schema, guard and governance changes land the same way. Relevant to META-243, which requires reviewed release paths before a repository holds a credential.

Schema $id bullet — stale in the other direction

The README described the $id host as disagreeing with the canonical domain. main already carries the bare-host $id after META-272; the published @workspacejson/spec@0.4.4 still serves www.. Restated as the candidate-versus-released distinction rather than a live disagreement — the same distinction META-293 assertion 7 exists to enforce.

Producer conformance coverage — items 24, 25

docs/conformance.md "Known gaps" claimed producer conformance is not mechanically checked here. It has been since PR #9. Per META-267 the bullet is corrected in place rather than dropped, and expanded to state what the suite actually does:

• the invocation command, including WORKSPACEJSON_CLI_CANDIDATE;
• the five assertion groups;
• the external-candidate boundary — the producer does not grade itself;
• the mutation red tests, including the baseline case that stops the suite passing by rejecting everything;
• what it deliberately does not assert — nothing about per-file fileIndex values, carried over from the suite's own header, which is ADR-003 amendment A-004's open question.

The adjacent "no external conformance suite" bullet is narrowed, not deleted: a producer suite exists, but it requires a caller-supplied candidate path, so an unaided third-party implementer still cannot point at one published battery. That gap is real and remains stated.

Verification

pnpm -r build && pnpm -r typecheck && pnpm -r test
  221 passed  (48 spec, 173 rules)

check:docs         4 confirmed in the schema; 9 prose enumerations complete
check:schema       PASS
check:examples     PASS
check:architecture PASS
check:architecture:test PASS
check:adr          index matches the records; no Accepted record on an unresolved placeholder
check:conformance  28 passed, 0 failed   (against the local workspacejson/cli candidate)

check:docs carries the stable-read-path gate from PR #16, so the prose enumerations touched here are mechanically verified against the schema.

Refs META-246, META-267.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.