Realm readiness: say what the protected paths do not cover yet, and the one skipping template test (realm-readiness-final) (#56)

Co-authored-by: Bruno Guilhermo de Barros Valério <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>

docs/4-ways-of-working/docs-standard.md

@@ -227,7 +227,8 @@ Run one check with `--check <name>`, or name repos to check only those.
   required. It skips and names any repo whose `main` doesn't hold `lint.yml` yet. Both modes are
   safe to run twice and need the same token as `new-repo.sh`.
 - **A realm repo holds three more things.** Its own `ci.yml`, with the required job `test`, which
-  runs the realm's tests with the template tests set to fail, not skip. A `ci.yml` in each template
+  runs the realm's tests with the template tests set to fail, not skip (helheim-go has one
+  template test that still skips in CI, until its backlog item B-057 lands). A `ci.yml` in each template
   (job `test`), on the stack's pinned images. And a readiness assessment against the
   [realm readiness checklist](https://github.com/ouroboric-dev/yggdrasil/blob/main/docs/2-engineering/realm-readiness.md),
   filed in the Yggdrasil repo. The `shared` check of `check-repos.sh` fails when a realm's copy of a

docs/6-journal/2026-10-19-a-definition-of-done-for-realms.md

@@ -26,10 +26,15 @@ fix the gaps in one pass.
 Write the checklist, 22 items (RR-01 to RR-22), then retrofit. The retrofit gave each build realm:
 
 - a root `ci.yml` with one required job, `test`, that runs the tests with `YGG_REQUIRE_TEMPLATES=1`,
-  so the template tests fail rather than skip;
+  so the template tests fail rather than skip (one template test in helheim-go still skips in CI, B-057);
 - a `ci.yml` in each template, kept matched to the stack by a realm test, `TestTemplateCI`;
 - a protected path: the ladder's rung 1 (and every web rung) refuses a task's change under
-  `.github/`, so a run can't weaken its own CI;
+  `.github/`, which covers the product's workflows. It does not yet cover everything a run could use to
+  weaken its own CI. Not refused yet: the tool configs the product's CI reads, and the files that
+  `lint.yml` runs from (`.pre-commit-config.yaml`, the gitleaks, markdownlint, yamllint and shellcheck
+  configs, `REUSE.toml`, `LICENSES/`), which wait on one founder decision
+  ([B-055](https://github.com/ouroboric-dev/yggdrasil/blob/main/docs/2-engineering/backlog.md)); and, in the web
+  ladder, `.devcontainer/` ([B-063](https://github.com/ouroboric-dev/yggdrasil/blob/main/docs/2-engineering/backlog.md));
 - one `docs.sh`, byte for byte the same in both realms, with a `shared` check in `check-repos.sh`
   that fails closed;
 - the org's base CI, `lint`, through the base CI rollout.