The intent staleness advisory has no action-pin normalization, so a Dependabot bump marks every downstream copy as trailing

[ptr727]

Surfaced by #732, which declares .github/workflows/publish-release.yml and .github/workflows/validate-task.yml at intent fidelity. Measured at audit run 2026-08-15T17:35:45Z | hub 0713008.

What

The intent fidelity advisory compares two dates: a downstream copy's last commit against the hub canonical's last commit. A hub canonical that moved later marks the copy as "possibly trails the hub, verify intent per AUDIT.md section 7".

The verbatim engine normalizes three classes of governed drift before hashing, per spec/fidelity-model.md "Normalization": line endings, uses: <action>@<sha> pins with their trailing version comment, and a job's needs: list. The intent advisory normalizes none of them, because it reads no content at all.

For a workflow file, the action-pin class is the one that matters. Dependabot bumps the hub's pins on its own schedule, and each bump is a commit against the canonical, so the advisory fires on every carrier at once for a change the fidelity model already classifies as governed per-repo drift rather than a deviation.

Measured

Declaring those two files raised 30 staleness advisories across the fleet in one run, 17 for the publisher and 13 for the validator. Reading the two hub commits the advisories name:

• .github/workflows/publish-release.yml, hub canonical last changed at 1892d6f (2026-08-08), which is Bump the actions-deps group with 4 updates (#612). Dependabot, pins only. Every one of the 17 advisories is against that commit.
• .github/workflows/validate-task.yml, hub canonical last changed at 0d18078 (2026-08-14), which added the ruff format --check step. That one is real content, though a repository that adopted the same step independently still reports as trailing (PlexCleaner runs it at a pinned version rather than @latest, and is flagged).

So of 30 advisories, 17 are provably about pins alone.

Why it matters

An advisory nobody can clear teaches its reader to skip the whole class, which is the failure the fidelity model already avoids for verbatim units and now reintroduces one tier down. It is worse for a workflow than for a doc, since a doc canonical moves when someone writes prose while a workflow canonical moves whenever Dependabot runs.

The advisory is deliberately a hint rather than proof, and it stays a hint under any fix here. What is wrong is that the most common trigger carries no information at all.

Options

1. Read the canonical's history and take the last commit that changed something other than an action pin. spec/audit.py already walks the canonical's git history for the verbatim stale-versus-modified classification, so the machinery is present. This keeps the check date-based and makes its date mean "the hub last changed this file in a way a carrier could care about".
2. Compare content rather than dates for the workflow subset, reusing the verbatim normalizer and reporting a hint rather than a verdict. Stronger, and it also closes the independently-adopted case (a copy that matches after normalization is not trailing whatever the dates say).
3. Accept it and say so in the finding text, naming the pin bump as the likely cause so a reader knows what to check first. Cheapest, and it leaves 17 advisories standing.

Option 1 looks like the smallest change that removes the whole false class, and option 2 subsumes it.