fix(drift-check): --all covers every live repo, not only active ones

--all now checks every registry entry except deprecated and archived,
so experimental and beta tools (6 of 17 today) are no longer invisible
to the weekly drift run. The token setup doc notes that a PAT scoped to
selected repositories must include new entries.

required-refs.json stays empty on purpose: the check has no warn tier,
so any requirement would fail every repo at once. The comment now
records that rationale and the rollout path.

Closes #125

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: TMHSDigital <154358121+TMHSDigital@users.noreply.github.com>

Author: TMHSDigital

docs/drift-check-token-setup.md

@@ -1,7 +1,9 @@
 # `DRIFT_CHECK_TOKEN` setup
 
-The drift checker's `--all` / `--remote` mode sparse-checks every active
-tool repo from the registry. This requires cross-repo read access that
+The drift checker's `--all` / `--remote` mode sparse-checks every live
+tool repo from the registry (every status except `deprecated` and
+`archived`). If the token is scoped to selected repositories, add each new
+registry entry to its repository list. This requires cross-repo read access that
 the workflow's auto-issued `GITHUB_TOKEN` does not have. `DRIFT_CHECK_TOKEN`
 is the dedicated fine-grained PAT that fills that gap.
 

scripts/drift_check/cli.py

@@ -297,8 +297,10 @@ def _resolve_gh_token(args_token: Optional[str]) -> Optional[str]:
 
 
 def _expand_all_repos(meta_repo_path: Path) -> List[str]:
-    """Read registry.json from the meta-repo and return active repo slugs
-    (owner/name)."""
+    """Read registry.json from the meta-repo and return every live repo
+    slug (owner/name): all statuses except ``deprecated`` and ``archived``.
+    Experimental and beta repos are included because new tools are the
+    ones most likely to drift."""
     import json
     reg_path = meta_repo_path / "registry.json"
     if not reg_path.is_file():
@@ -308,7 +310,10 @@ def _expand_all_repos(meta_repo_path: Path) -> List[str]:
         )
         raise SystemExit(2)
     data = json.loads(reg_path.read_text(encoding="utf-8"))
-    return [r["repo"] for r in data if r.get("status") == "active"]
+    return [r["repo"] for r in data if r.get("status") not in RETIRED_STATUSES]
+
+
+RETIRED_STATUSES = frozenset({"deprecated", "archived"})
 
 
 def _run_checks(snapshots: Sequence[RepoSnapshot]) -> List[Finding]:

standards/required-refs.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "_comment": "Required standards references per repo type. Q2 resolution: start permissive. Audit on 2026-04-24 found zero tool repos with standards/*.md links; shipping with an empty requirements block so the check is silent until tool repos start referencing standards deliberately. File a follow-up issue against Developer-Tools-Directory to populate this when the first tool repo adds a standards reference.",
+  "_comment": "Required standards references per repo type. Intentionally empty: the required_refs check only emits errors (no warn tier), and a 2026-04-24 audit found zero tool repos linking standards/*.md, so any requirement here would fail every weekly drift run at once. Populate per repo type once tool repos reference standards deliberately, starting with one link (for example AGENTS.md -> standards/agents-template.md) rolled out across the fleet first. Revisited in DTD#125.",
   "requirements": {
     "cursor-plugin": {},
     "mcp-server": {}

tests/test_cli_remote_flags.py

@@ -27,6 +27,8 @@ def meta_repo(tmp_path: Path) -> Path:
             {"repo": "TMHSDigital/Alpha", "status": "active"},
             {"repo": "TMHSDigital/Beta", "status": "active"},
             {"repo": "TMHSDigital/Stale", "status": "archived"},
+            {"repo": "TMHSDigital/Fresh", "status": "experimental"},
+            {"repo": "TMHSDigital/Old", "status": "deprecated"},
         ]),
         encoding="utf-8",
     )
@@ -59,7 +61,7 @@ def test_all_without_registry_errors(capsys, tmp_path: Path):
     assert "registry.json" in capsys.readouterr().err
 
 
-def test_all_expands_active_repos(capsys, meta_repo: Path):
+def test_all_expands_live_repos(capsys, meta_repo: Path):
     """--all without a working network would normally fail at sparse-checkout.
     We patch build_remote_snapshot to verify the expansion logic only."""
     seen = []
@@ -79,7 +81,8 @@ def fake_remote(repo_slug, **kw):
     with patch("scripts.drift_check.cli.build_remote_snapshot", side_effect=fake_remote):
         rc = cli.main(["--all", "--gh-token", "x", *_base(meta_repo)])
     # 2 active entries; archived is skipped
-    assert {s for s, _ in seen} == {"Alpha", "Beta"}
+    # Every live repo, including experimental; retired statuses excluded.
+    assert {s for s, _ in seen} == {"Alpha", "Beta", "Fresh"}
     assert all(o == "TMHSDigital" for _, o in seen)
     # Empty snapshots have no findings -> exit 0
     assert rc == 0