[ss-o]

Summary

Make generated knowledge resource tables a fixed point of the repository's pinned formatter. resource_pages() now pads each domain's columns after constructing links and escaping pipe characters, following the existing decision-index renderer. Regenerate the nine existing resource pages without changing their cells, links, headings, file dispositions or discovery behavior.

Closes #796. This is the separately scoped prerequisite for the PROPOSED parser-packaging ADR/guidance work in #795, not an ADR acceptance, parser change, release or consumer repin.

The two edited Python files also needed their existing Black/isort normalization. AST comparison verifies unchanged imports and all non-renderer runtime semantics. The three pre-existing Bandit findings on fixed-argv Git discovery have narrow, explained annotations; its test now asserts the complete argument list and that no shell is enabled. Git is still resolved from the caller's PATH, as before. No scanner is disabled and no dependency or inventory schema is added.

Verification

• The new exact-output regression fails on main's unpadded output and passes after the renderer change. It covers unequal columns, imported-owner links, referenced-file links, escaped reasons and immediate exact-byte check mode.
• 338 unit tests pass across knowledge coverage (7), knowledge delivery (14), decision records (17), agent policy (99), routing/impact reporting (90) and Zsh policy (111).
• Coverage, delivery, decision-index, agent-policy, routing, approved-source and Zsh-policy validators pass. Coverage remains 364 files: 57 imported and 307 referenced.
• All nine generated pages have identical table cells and non-table content against main. The only page changes are column/separator padding. Regenerating, running the pinned Prettier formatter and checking coverage again preserve every frozen source byte.
• Changed-file Trunk checks and git diff --check pass.
• A separate read-only local review reported no verified defect and independently reran the seven coverage tests and coverage check. It did not run the parent's formatter or broader suites and is not a hosted review of record.

Validation ran on Linux x86_64 with Python 3.14.8, Zsh 5.9.2, Trunk 1.25.0 and pinned Prettier 3.8.3. The hosted validation job, which uses the workflow's Python 3.10 lane, also passes. The elected upfront ADR-0026 review of record is posted on the exact head at #797 (review). No Copilot request was made. Width calculation follows the decision-index renderer's string-length model; the current inventory/pages are ASCII. Wide or combining Unicode in future cell content is not established formatter coverage.

Agent handoff

Status: Merged as signature-verified 4501d90, with the exact reviewed tree. The elected upfront fallback is posted on the source head. All five post-merge workflows pass; Org Routing initially encountered temporary Git-fixture teardown errors in unchanged tests, then passed on one failed-job rerun. The separate PROPOSED ADR/guidance work continues in #795; its acceptance, policy/source merge, release and consumer repins are not part of this prerequisite.

[ss-o]

Fallback review under ADR-0026: maintainer elected, no Copilot request on a2316d4.

Reviewed the full merge-base diff from d2db15c to a2316d4 under the owning code-review skill and quality criteria. Classification: class 4 Python generation and generated Markdown, not Zsh plugin lifecycle or policy acceptance. No confirmed CRITICAL or IMPORTANT finding remains. An author-side review is not an independent approval or permission to merge.

Correctness and determinism: each emitted domain necessarily has at least one row; headings and rendered/escaped cells determine its own widths. The helper binds those widths to avoid late loop-variable capture. Link targets, imported-owner links and pipe escaping retain their prior construction. The nine current resource pages preserve every cell, link and non-table line against the base. Repeated generation and a real pinned-Prettier format round trip leave all frozen source bytes unchanged. The new exact-output regression was observed failing on the baseline's unpadded table and passing on this head.

Contract and safety: the inventory schema, file-discovery filters, source/generated ownership and dependencies are unchanged. AST comparison verifies every non-renderer function and the import set against the base despite Black/isort normalization of the two touched files. The subprocess scanner annotations are narrow and explain the unchanged fixed Git argv; the test asserts the complete list and that a shell is not enabled. Git still resolves from the caller's PATH, so this is not a new executable-trust guarantee. No workflow permission, review control or source-project pin changes.

Verification: 338 local unit tests pass across coverage, delivery, decision records, agent policy, routing/impact and Zsh policy. Coverage, delivery, decision/index, policy, routing, approved-source and Zsh-policy validators pass, as do changed-file Trunk and Git whitespace checks. Hosted checks, including the workflow's Python 3.10 validation lane, pass on this head. A separate read-only local review reran the seven coverage tests and coverage check and reported no verified defect; it did not independently repeat the broader formatter/AST proof. The current PR has no review threads and closes only issue 796.

Limits: verified inventory/page content is ASCII, matching the existing decision-index renderer's string-length width model. Wide or combining Unicode in future cell content is not established formatter coverage. This prerequisite neither accepts ADR-0041 nor merges or delivers the separately preserved #795 proposal, and it does not authorize the zsh-lint source merge or release.