From aaf792b22a844c4c6c7941458d637dd455ccbc75 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 16:56:35 +0000
Subject: [PATCH] docs: add missing trigger-e2e/__tests__ dirs and
 export-fact-catalog command

- AGENTS.md: add trigger-e2e/ (gate/synth-PR E2E harness) and __tests__/
  (Jest suite) to the scripts/ado-script/src/ architecture tree
- docs/cli.md: document the hidden export-fact-catalog command alongside
  export-gate-schema under Hidden Build-Time Tools

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 AGENTS.md   | 2 ++
 docs/cli.md | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index 41667fac..0431e434 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -268,7 +268,9 @@ fail-closed and only pauses when the agent actually proposed a reviewed output.
 │           ├── approval-summary/ # Safe-outputs summary renderer (bundled to approval-summary.js; end-of-Agent-job summary tab)
 │           ├── github-app-token/ # GitHub App token minter (bundled to github-app-token.js; mints installation token in Agent + Detection when engine.github-app-token is set)
 │           ├── executor-e2e/ # Stage 3 safe-output E2E test harness (not a bundle; runs deterministic scenarios against a real ADO project and files a GitHub issue on failure)
+│           ├── trigger-e2e/ # Trigger-condition (gate / synth-PR) E2E test harness (not a bundle; queues victim builds, asserts skip/run outcomes, files a GitHub issue on failure; FACT_META drift guard cross-checks against export-fact-catalog output)
 │           ├── prepare-pr-base/ # create-pull-request base-ref preparer (bundled to prepare-pr-base.js; fetches/deepens target branch so mcp.rs finds a diff base on shallow-default pools — issue #1413; emitted in BOTH the Agent job and the SafeOutputs job before the executor's worktree add — issue #1453)
+│           ├── __tests__/  # Jest test suite for shared bundle utilities (bundle-coverage.test.ts)
 │           └── shared/   # Shared modules across bundles (auth, ado-client, env-facts, types.gen.ts)
 ├── tests/                # Integration tests and fixtures
 ├── docs/                 # Per-concept reference documentation (see index below)
diff --git a/docs/cli.md b/docs/cli.md
index 4bc2dbe7..f689d103 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -187,6 +187,9 @@ These commands are not shown in `--help` but are available for contributors work
   - `--output, -o <path>` - Write the schema to a file instead of stdout. Parent directories are created automatically.
   - See [`docs/ado-script.md`](ado-script.md) for how this command fits into the ado-script build workflow (`cargo run -- export-gate-schema --output schema/gate-spec.schema.json`).
 
+- `export-fact-catalog` - Export the fact catalog JSON (kind, failure policy, and dependencies for every gate `Fact`). Used as a build-time drift guard: the `trigger-e2e` TypeScript workspace mirrors this data in its `FACT_META` table and the test suite verifies the two stay in sync.
+  - `--output, -o <path>` - Write the catalog to a file instead of stdout. Parent directories are created automatically.
+
 ## Pipeline IR Reference
 
 The compiler builds typed Azure DevOps pipeline IR and lowers it through one YAML emitter. The canonical Setup → Agent → Detection → SafeOutputs → Teardown shape, plus the optional always-running Conclusion job when `safe-outputs:` is configured, lives in `agentic_pipeline.rs` (shared by every target); target-specific builders (`standalone_ir.rs`, `onees_ir.rs`, `job_ir.rs`, and `stage_ir.rs`) own only the per-target envelope (pipeline shape, template parameters, 1ES wrapping).