TD-CLEANUP Report: TD-052 + TD-053

Date: 2026-03-03 | Agent: claude_code (Opus 4.6) PR: #422 (web-test)

TD-052: AD↔Directus Sync Gap — RESOLVED

Root Cause Analysis

Gap was 13 (AD: 179, Directus: 192). Directus had 13 MORE docs than AD.

Breakdown:

• 8 stale test artifacts: _test_conn_final_* docs in knowledge/ops/. Created by automated connection tests in Agent Data, synced to Directus via EventBus listener. Later deleted from AD Firestore, but delete events failed to propagate (fire-and-forget emission). Directus retained stale copies.
• 5 structural READMEs: Folder placeholder docs created directly in Directus during initial setup (IDs #298-302). Never existed in Agent Data. Incorrectly flagged as is_folder=false.
• 0 AD docs missing from Directus: Forward sync (AD→Directus) working correctly. EventBus listener registered, 280 events logged.

Fix Applied

1. Deleted 8 stale _test_conn_final_* docs from Directus (IDs: #435, #436, #439, #440, #442, #443, #444, #445)
2. Marked 5 READMEs as is_folder=true in Directus (IDs: #298, #299, #300, #301, #302) — excluded from sync-check count
3. Lowered threshold from 20 back to 5 in sync-check.yml (CHECK 8)

Before/After

Metric	Before	After
AD knowledge docs	179	179
Directus non-folder docs	192	179
Gap	13	0
Threshold	20	5
CHECK 8 status	WARN	OK

Ongoing Sync Health

• EventBus: enabled, 1 internal listener (directus_sync), 0 external webhooks
• Events logged: 280
• Forward sync (AD→Directus): working
• Delete event propagation: partially reliable (fire-and-forget can fail)
• Recommendation: monitor gap; if it drifts >5, investigate delete event failures

TD-053: Hardcoded ALLOWED List — RESOLVED

Problem

Line 208 of .github/workflows/sync-check.yml hardcoded:

ALLOWED="current-state current-tasks dev ops other"

Adding a new knowledge folder required editing the CI workflow directly.

Fix Applied

Created .sync-allowed-folders.json config file:

{
  "_comment": "Allowed top-level folders under knowledge/ (KS-LAW v1.0 §2)",
  "allowed": ["current-state", "current-tasks", "dev", "ops", "other"]
}

Updated sync-check.yml CHECK 7 to read from config:

ALLOWED=$(jq -r '.allowed | join(" ")' .sync-allowed-folders.json 2>/dev/null || echo "current-state current-tasks dev ops other")

Fallback: if config file is missing or jq fails, uses the original inline default.

Verification

• PR #422: CI GREEN (all checks pass including E2E)
• Config file parseable: jq extracts allowed list correctly
• Fallback tested: || echo provides safe default

Summary

TD	Status	PR	Evidence
TD-052	RESOLVED	#422	Gap: 13→0, threshold: 20→5
TD-053	RESOLVED	#422	Config file replaces hardcoded list

Files Changed

• .github/workflows/sync-check.yml — threshold + dynamic ALLOWED
• .sync-allowed-folders.json — new config file (4 lines)
• Directus data: 8 records deleted, 5 records updated