No staleness signal for the OIT FY portfolio transcription

[ProfessorPolymorphic]

Problem

lib/oit-ea-portfolio.ts is a hand transcription of a spreadsheet OIT emails over (61 FY2027 rows, landed in #304). Its only freshness marker is SOURCE_AS_OF, a date string in the file header. Nothing checks it.

Every other vendored dataset in this repo has a drift or freshness signal:

• vendor/data-governance/ → Governance Drift (fails the build) + Submodule freshness (advisory PR comment, scripts/governance-freshness.ts, STALE_AFTER_DAYS: 14)
• vendor/strategic-plan/ → Strategic-plan submodule freshness
• lib/portfolio.ts → npm run verify:portfolio (ADR 0001 rules, and since Model OIT's FY2027 EA portfolio and crosswalk it to ours #304 the OIT crosswalk slug guard)

The OIT transcription has none of these, and it can't have the same kind: there is no upstream to diff against. The source is a .xlsx in someone's inbox, deliberately not committed (it's an OIT-internal document).

Why it matters

The data is load-bearing in three places now — /standards/oit-portfolio, the "Also tracked by OIT" block on three project detail pages, and the standing-context section on /portfolio/pipeline (#305). All three assert OIT's current FY27 commitments. A silently stale transcription doesn't degrade visibly; it just quietly starts lying about priority, effort, and who owns what. The pipeline section in particular presents the load as a live capacity signal.

The crosswalk itself is the more fragile half. Its three matches were owner-confirmed against the July 2026 cut. If OIT re-scopes or renames a row, the confirmation no longer refers to anything and no check will notice — verify-portfolio only validates that the slug still resolves on our side.

Two options

Cheap — age warning (a few hours)

Follow the scripts/governance-freshness.ts pattern: a script that compares SOURCE_AS_OF against today and emits an advisory when it exceeds a threshold. Since UI's fiscal year runs Jul 1 – Jun 30 and OIT's list is FY-scoped, a quarterly threshold (~90 days) fits the actual cadence better than the 14 days used for the governance submodules.

Surface as an advisory PR comment via the existing Governance PR Summary workflow, and consider a small note on /standards/oit-portfolio itself once past threshold — the page already prints SOURCE_AS_OF, so the honest move is saying "this may be stale" rather than only printing a date the reader has to evaluate.

Advisory only. Never fail the build: staleness is a fact about the world, not a defect in the PR that happens to be open.

Real — get the list from a system

The spreadsheet is a symptom. OIT tracks this work in Azure DevOps (dev.azure.com/uidaho, already referenced in lib/oit-pathway.ts), and the same rows likely exist there as work items. An ADO query would give us a diffable upstream and make the transcription obsolete rather than merely monitored.

This needs an OIT conversation and API access, in the same category as the TDX sync blocked under ADR 0005. Not something we can just build.

Recommendation

Ship the cheap version so the failure mode is visible, and raise the ADO question the next time the FY portfolio comes up with OIT. The cheap version is not a substitute for the real one — an age warning tells you the data might be old, never that it is wrong.

Notes for whoever picks this up

• Re-transcription procedure and the transcription rules are in the lib/oit-ea-portfolio.ts header.
• The crosswalk bar is documented on the RelatedSurface type: an owner has affirmed it. Shared subject matter is not enough — four adjacencies were struck in Model OIT's FY2027 EA portfolio and crosswalk it to ours #304 for exactly that reason. Don't let a re-transcription quietly reintroduce them.
• Verify a re-transcription by diffing the parsed spreadsheet against the module cell-by-cell rather than reading it over; that's how the original 61 rows were checked.