drift allowlist: an exemption keyed only on x-schema-status: draft hides real request/response drift

[yakimoto]

Finding

Surfaced by a reviewer on #44 (2026-09-06). Entries in .github/scripts/published-drift-allowlist.json exempt an operation from the published-contract-drift gate by keying on the operation carrying x-schema-status: draft. While the marker is present, real request/response drift between openapi.yaml and the live behaviour of that operation is not reported.

This is not specific to /enhance (#44): roughly ten allowlist entries use the identical predicate, so the pattern predates #44 and is the allowlist's design, not a merge artifact.

Why it matters

The drift gate exists so the published contract cannot silently diverge from what the gateway serves. An exemption satisfied by a static marker is satisfied forever, independent of whether the operation's shape still matches. The live-classification work in #84 already derives publication from observed behaviour; the allowlist predicate should meet the same bar.

Proposed direction (decision needed before implementing)

1. Each allowlist entry carries an explicit expiry or a tracked issue; the gate fails when either lapses.
2. Or key the exemption on the operation being unreachable live (the classifier's own verdict) rather than on the draft marker, so a draft operation that starts answering live is re-included automatically.
3. Report per run how many operations are exempted and why, in the check summary.

Acceptance

• A test where an exempted draft operation's response shape changes and the gate goes red.
• The exemption count appears in the gate's run summary.