flows: drive-local verify+report do not enforce package scope; broken implementation reports PACKAGE_VERIFIED

[kjgbot]

Summary

The verify workflow step only rebuilds and runs the general SDK suite; it does not execute selected-package acceptance checks or a scope check. The report function checks HEAD equality, prints unrestricted git diff --stat, and prints the DoD strings without asserting them. An unattended local drive run therefore exits PACKAGE_VERIFIED with the selected task still broken AND an out-of-scope edit outside the declared package.

Surfaced during the 2026-09-10 launch-prep PR sweep in the context of #242 and its related hardening #244. Reproduced against the exact head of #242 (c4831e29ae0e99020edb7282e0ec40c7abbbb427) in isolation.

Repro

Fixture:

• Committed src/value.txt containing broken.
• Metadata declaring only src/value.txt in scope and requiring fixed.
• Uncommitted edit to outside.txt (not in the declared scope).

Run the fetched-head report helper unmodified against that fixture.

Actual:

• Exit 0.
• PACKAGE_VERIFIED printed.
• git diff --stat prints the out-of-scope outside.txt edit without objecting.
• The declared task remains failed: src/value.txt still contains broken.

Expected

Report exits non-zero with a diagnostic naming (a) the unmet DoD on src/value.txt and (b) the out-of-scope edit to outside.txt. verify runs the selected-package acceptance check, not just the general SDK suite.

Suggested direction

• verify should execute the acceptance argv from the immutable package (or a copy taken before implementation edits) against the changed source. fix(drive-local): enforce scope and selected package acceptance #244 opens the design space for immutable inputs / a separately preserved acceptance workspace.
• report should assert every DoD string against the actual state, not print it — and refuse when the working tree contains edits outside the package's declared scope.

Acceptance criteria

• An isolated report against a fixture with an outside-scope edit exits non-zero.
• The same helper with the selected task unmet exits non-zero with a diagnostic naming the DoD.
• Regression test that reproduces the sweep's fixture.

Context

Filed from the sweep report at commit 64de443 on branch sweep/v2-launch-prep-0910. See PR-SWEEP-REPORT-0910.md §#242 and ops/runtime-evidence/pr-sweep-0910.txt. #244 tracks related acceptance hardening; changes should coordinate with its owner.