canon: resolve work-record governance packets

tests/test_validate_work_records.py

@@ -4,7 +4,7 @@
 Covers:
   - load_registry / classify — id pattern matching against the live canon
     registry, incl. grandfathered legacy schemes (AWQ-, DEC-, OH-, task
-    single-digit / -LEGACY- variants)
+    single-digit / -LEGACY- variants, and the exact MASON-0001 bootstrap)
   - load_validators — jsonschema-backed per-kind checks (intake, decision,
     engagement): required-field gates on non-terminal records, historical
     grace on terminal ones
@@ -64,6 +64,8 @@ class TestClassify:
             ("DEC-2026-004", "decision"),
             ("OH-2026-003", "engagement"),
             ("CUST-WP-0060-T1", "task"),
+            ("MASON-0001", "workplan"),
+            ("MASON-0001-T01", "task"),
         ],
     )
     def test_grandfathered_legacy_ids(self, kinds, legacy_id, expected_kind):
@@ -72,6 +74,11 @@ class TestClassify:
     def test_unregistered_id_returns_none(self, kinds):
         assert classify("FOO-QX-001", kinds) is None
 
+    def test_risk_register_species(self, kinds):
+        assert classify("RISK-F-0008", kinds) == "register-entry"
+        assert classify("RISK-REG-0001", kinds) == "register-entry"
+        assert classify("RISK-N-0003", kinds) is None
+
 
 class TestValidators:
     def test_intake_open_without_lane_errors(self, validators):
@@ -305,6 +312,37 @@ class TestMainEndToEnd:
         assert result.returncode == 0, result.stdout
         assert "2 checked" in result.stdout
 
+    def test_mason_bootstrap_ids_pass_unmodified(self, tmp_path):
+        (tmp_path / "legacy-mason.md").write_text(
+            textwrap.dedent(
+                """
+                ```yaml
+                id: MASON-0001
+                title: "legacy Mason bootstrap"
+                status: finished
+                ```
+                ```task
+                id: MASON-0001-T01
+                status: done
+                priority: high
+                ```
+                """
+            ),
+            encoding="utf-8",
+        )
+        result = self._run(tmp_path, "--strict")
+        assert result.returncode == 0, result.stdout
+        assert "2 checked" in result.stdout
+
+    def test_task_fence_rejects_non_task_registered_id(self, tmp_path):
+        (tmp_path / "wrong-fence.md").write_text(
+            "```task\nid: CUST-WP-0063\nstatus: active\n```\n",
+            encoding="utf-8",
+        )
+        result = self._run(tmp_path)
+        assert result.returncode == 1
+        assert "registered as workplan, not task" in result.stdout
+
     def test_terminal_record_grace_does_not_mask_structural_errors(self, tmp_path):
         """Historical grace waives missing-field ('required') errors on
         terminal records, but a genuine value violation (bad lane enum)