fix(ci): qualify governance against the current Runner source

.github/workflows/validate-configurator.yml

@@ -109,6 +109,8 @@ jobs:
           tofu_wrapper: false
       - name: Check all template exports against native Accelerator variable contracts
         run: npm run test:common-contract
+      - name: Test native Plan, Application and governance contracts
+        run: LZC_TEST_TOFU_BIN="$(command -v tofu)" npm run test:plan
       - name: Test database migrations and tenant isolation
         run: npm run test:database -- --maxWorkers=2 --testTimeout=30000
         env:

landing-zone-configurator/app/integration/fixtures/governance/governance.tftest.hcl

@@ -72,3 +72,13 @@ run "empty_description" {
     error_message = "Empty description must remain harmless; populated descriptions remain blocked by the Configurator (#82)."
   }
 }
+
+run "non_empty_description_rejected" {
+  command = plan
+  variables {
+    rm_folders = {
+      platform = { name = "Platform", description = "Must not be silently discarded" }
+    }
+  }
+  expect_failures = [var.rm_folders]
+}

landing-zone-configurator/app/integration/fixtures/governance/source.json

@@ -1,14 +1,14 @@
 {
-  "acceleratorRevision": "c4b43c36af198985980b17626c48d357795e3fbd",
+  "acceleratorRevision": "9e7fb46c329aca32e878ce1f0ea3b944ea240354",
   "files": {
-    "src/main.tf": "8592367381556c5eb6ae376d4bfe58ff4afe8bb7c37e1b8d8052d7678834d4d9",
-    "src/variables.tf": "b77e59054c7d2c6dabcb9f9add22c1efb56d79735fd14eb5461e11d99c105f57",
+    "src/main.tf": "0b2f27c869b6afe2be5614fe8895966739f874f18d1fd8905224735703b249c6",
+    "src/variables.tf": "c650b337ee9e154b988927c9a129091b6c6627ff90e9d1661bb9c8ba7815bda5",
     "src/locals.tf": "7c4f7c2887755b8581b31982ada8d63c2c0796c963994e61da95c270db1c8d78",
     "src/modules/governance/1-rm-folders.tf": "f1ff318487c780914620a3b516f55b2f17f13af4dd38364937d9567c93cd865b",
     "src/modules/governance/2-custom-roles.tf": "5cf14fc37fb6ad76d0914d38177c0b9bf7600606f2110827f85fded466a1c3d0",
     "src/modules/governance/3-organization-roles.tf": "209a6456b0d627516c36c8cfcfe0cf8444840c8b62ac01d352cef8f0ba4391da",
     "src/modules/governance/outputs.tf": "f16f31960dd81166cc1372ef9f2e6cb9f58044d7772785d8a31193e83b1f5b85",
     "src/modules/governance/terraform.tf": "6407250ce406a1fe3085c8ca64e392f6116c2b13de96a468de031569e5a56220",
-    "src/modules/governance/variables.tf": "9dd60d5196c884c6957e21cf6e8c6d00e6b8e48a0d8c48abc0abbc428018b736"
+    "src/modules/governance/variables.tf": "ddd29245d3bd76cf621b2e89663c0571b61313781404b78bb89afc8e57565b23"
   }
 }

landing-zone-configurator/docs/plan-execution.de.md

@@ -582,9 +582,19 @@ verwendeten Governance-Modul geprüft: `npm run test:plan` ruft den separaten
 Accelerator-Pin. OpenTofu 1.12.6 plant mit Mock-Providern in bereinigter Umgebung,
 ohne Cloud-Credentials und ohne Apply. Geprüft werden Organisationsrollen
 `owner`/`organization.auditor`, Ordnerrollen `owner`/`auditor`, das Auslassen
-doppelter Ordnerzuweisungen für Organisations-Owner sowie beide Elternvarianten.
+doppelter Ordnerzuweisungen für Organisations-Owner, beide Elternvarianten sowie
+die Ablehnung nicht leerer Ordnerbeschreibungen.
 Diese lokale Qualifikation ersetzt keinen Plan gegen die konkrete Kundenorganisation.
 
+Der geprüfte Quellnachweis liegt unter
+`app/integration/fixtures/governance/source.json`. Bei Änderungen am Plattform-
+Runner-Pin die Root- und Governance-Dateihashes gegen genau diesen Commit prüfen
+und alle vorhandenen Governance-Pläne erneut ausführen. Die strikten Revisions-/
+Hashprüfungen sowie Rollen- und Eigentümer-Assertions bleiben erhalten. Die
+PR-Validierung führt den vollständigen Ablauf `npm run test:plan` einschließlich
+dieser Qualifikation aus; Release-Builds wiederholen ihn vor der Paketierung des
+isolierten Runners.
+
 **Service-Account-Föderation für CI/CD** ist eine optionale Editor-Komponente.
 Sie regelt, welche OIDC-Tokens externer Pipelines den Management-Service-Account
 nutzen dürfen; sie ist keine Benutzeranmeldung am Configurator.

landing-zone-configurator/docs/plan-execution.md

@@ -238,7 +238,14 @@ Commit `9aa3322`, [release 36849188406](https://github.com/stackitcloud/stackit-
 <a id="governance-qualifikation-und-service-account-föderation-2026-10-01"></a>
 ## Governance qualification and service-account federation (2026-10-01)
 
-Governance input approval is additionally checked with the actually used governance module: `npm run test:plan` calls separate `test-governance-contract.sh`. Source hashes bind checking to the Accelerator pin. OpenTofu 1.12.6 plans with mock providers in a cleaned environment, without cloud credentials or Apply. Checks cover organization roles `owner`/`organization.auditor`, folder roles `owner`/`auditor`, omission of duplicate folder assignments for organization owners and both parent variants. This local qualification does not replace a Plan against the specific customer organization.
+Governance input approval is additionally checked with the actually used governance module: `npm run test:plan` calls separate `test-governance-contract.sh`. Source hashes bind checking to the Accelerator pin. OpenTofu 1.12.6 plans with mock providers in a cleaned environment, without cloud credentials or Apply. Checks cover organization roles `owner`/`organization.auditor`, folder roles `owner`/`auditor`, omission of duplicate folder assignments for organization owners, both parent variants and rejection of non-empty folder descriptions. This local qualification does not replace a Plan against the specific customer organization.
+
+The reviewed source receipt is `app/integration/fixtures/governance/source.json`.
+When updating the platform Runner pin, review the root and governance file hashes
+against that exact commit and rerun all existing governance plans. Preserve the
+strict revision/hash checks and role/ownership assertions. PR validation runs the
+complete `npm run test:plan` flow, including this qualification; release builds
+repeat it before packaging the isolated Runner.
 
 **Service-account federation for CI/CD** is an optional editor component. It controls which external pipeline OIDC tokens may use the management service account; it is not user login to the Configurator. `issuer` is the trusted issuer, `aud` the token audience and `sub`, for example, the specific GitHub repository with branch. Conditions use comparison `equals` supported by the pinned provider; `aud` is required. The GitHub template limits `sub` to a specified branch and does not apply unchanged to jobs with GitHub environments.