packages/polyfill-connectors/src/ is a stale narrow subset: 2 conformance-test failures, scanner allowlist assumes full source #53

Summary

reference-implementation/test/ri-zero-connector-knowledge-conformance.test.ts has 2 failing tests (of 89 in that file) that assert specific files exist under this repo's own packages/polyfill-connectors/src/:

• "falsifiability (terminal-redteam-0810 #3 counterweight): every real allowlisted registry/self-reference file is excluded from the scan's own file set and never appears in its violations" -- expects packages/polyfill-connectors/src/manual-upload-validation.ts to exist.
• "falsifiability (terminal-redteam-0810 #3 counterweight): packages/polyfill-connectors/src/'s legitimate connector-aware modules (orchestrator, auto-login, static-secret-injection) are NOT flagged by the narrow shared-library scan" -- expects packages/polyfill-connectors/src/orchestrator.ts (and others) to exist.

Root cause

packages/polyfill-connectors/ in this repo is NOT the full polyfill-connectors package -- its own package.json says so explicitly: "NOT a workspace package that anything imports by name... holds a closed subset of connector-content and runtime-support source vendored (by physical file, not by npm dependency) into @pdpp/local-collector's build via that package's tsconfig.build.json include list." The real, full package is vendored separately as a tarball (reference-implementation/vendor/pdpp-polyfill-connectors-0.0.1.tgz, resolved as @pdpp/polyfill-connectors in node_modules).

The scanner these 2 tests exercise (test/helpers/ri-zero-connector-knowledge-scan.ts, scanSharedLibraryKindDispatchRoot/sharedLibraryKindDispatchScanFiles) walks packages/polyfill-connectors/src/ as a real filesystem directory (SHARED_LIBRARY_KIND_DISPATCH_SCAN_ROOT), and its allowlist (and this test's fixture assertions) hardcode ~7 filenames (manual-upload-validation.ts, collector-registry.ts, auto-login/heb.ts, provider-auth-adapters.ts, orchestrator.ts, static-secret-injection.ts, auto-login/usaa.ts) that do not exist in the narrow local subset -- confirmed all 7 are missing via direct ls.

This is very likely a stale artifact from before this repo's own Move A/B split extracted the full polyfill-connectors package out to PDP-Connect/data-connectors, leaving packages/polyfill-connectors/ behind as the narrow local-collector-only subset it is today. The scanner + its allowlist were written when this local directory held the full connector source.

Why I didn't fix this in the seam-fix PR this issue accompanies

Two real options, both bigger than a CI-seam fix should invent unilaterally:

1. Redesign the scanner to walk the npm-vendored @pdpp/polyfill-connectors package (node_modules/@pdpp/polyfill-connectors/src/) instead of the local physical subset. This changes what invariant the scanner actually enforces (it currently proves something about THIS repo's own committed source tree; scanning node_modules is a different kind of check) and needs its own design decision about whether that's still the right invariant post-Move-A/B.
2. Expand the local subset to include the missing files. But that subset's own package.json explicitly says its membership is driven by @pdpp/local-collector's tsconfig.build.json include list, not by what a conformance test wants -- adding files here without checking whether local-collector actually needs them (or whether it's fine as a fixture-only addition) is a content decision I'd be making blind.

Current impact

2 of the current ~65-75 test-reference-implementation failures (exact current count in the accompanying PR's CI run). Isolated, well-understood, not blocking merge.