@biffo/cli 0.237.0 → 0.238.1

package/_skeletons/plugin-template/.githooks/pre-push

@@ -31,11 +31,14 @@ cd "$root" || exit 0
 # Why it exists: a force-push can quietly add a file to a branch's change set
 # and record a stale copy of somebody else's merged work as your own change.
 # That happened (tabsii-platform#446) and every local gate was green on it.
-if [ -f scripts/rewrite-scope-check.sh ]; then
-  sh scripts/rewrite-scope-check.sh || exit 1
-else
-  echo "pre-push: no scripts/rewrite-scope-check.sh — rewrite scope NOT checked" >&2
-fi
+# Runs from the version-pinned CLI rather than a per-repo copy (#1109).
+#
+# This used to warn and CONTINUE when the script was absent, which is a
+# fail-open in a gate whose whole job is refusing a push: the one repo missing
+# the file was the one where nothing checked. There is no absent case now --
+# the bridge resolves the script from the package -- and if the bridge itself
+# cannot run, that is a reason to stop, not to wave the push through.
+sh scripts/biffo.sh rewrite-scope-check || exit 1
 
 if [ ! -f scripts/verify.sh ]; then
   echo "pre-push: no scripts/verify.sh — NO checks ran (see local-gates.md)" >&2

package/_skeletons/plugin-template/scripts/verify.sh

@@ -662,8 +662,12 @@ _pg_modules=$(pg_test_modules)
 # rebuild), so calling it is better than warning about it. Failure is silent
 # BECAUSE the WARN below is the honest report of it -- no Docker, no server, no
 # schema all end in the same place: the lane did not run, and the gate says so.
-if [ -z "$PG_TEST_DSN" ] && [ -n "$_pg_modules" ] && [ -z "$LIST" ] && [ -f scripts/pg-test-db.sh ]; then
-  PG_TEST_DSN=$(sh scripts/pg-test-db.sh 2>/dev/null | tail -1) || PG_TEST_DSN=""
+if [ -z "$PG_TEST_DSN" ] && [ -n "$_pg_modules" ] && [ -z "$LIST" ]; then
+  # Through the bridge since #1109; the `-f scripts/pg-test-db.sh` guard went
+  # with the copy. Failure stays silent here BECAUSE the WARN below is the
+  # honest report of it -- no Docker, no server, no schema and no CLI all end
+  # in the same place: the lane did not run, and the gate says so.
+  PG_TEST_DSN=$(sh scripts/biffo.sh pg-test-db 2>/dev/null | tail -1) || PG_TEST_DSN=""
   case "$PG_TEST_DSN" in
     postgres*) ;;
     *) PG_TEST_DSN="" ;;

package/_skeletons/sibling-template/.githooks/pre-push

@@ -31,11 +31,14 @@ cd "$root" || exit 0
 # Why it exists: a force-push can quietly add a file to a branch's change set
 # and record a stale copy of somebody else's merged work as your own change.
 # That happened (tabsii-platform#446) and every local gate was green on it.
-if [ -f scripts/rewrite-scope-check.sh ]; then
-  sh scripts/rewrite-scope-check.sh || exit 1
-else
-  echo "pre-push: no scripts/rewrite-scope-check.sh — rewrite scope NOT checked" >&2
-fi
+# Runs from the version-pinned CLI rather than a per-repo copy (#1109).
+#
+# This used to warn and CONTINUE when the script was absent, which is a
+# fail-open in a gate whose whole job is refusing a push: the one repo missing
+# the file was the one where nothing checked. There is no absent case now --
+# the bridge resolves the script from the package -- and if the bridge itself
+# cannot run, that is a reason to stop, not to wave the push through.
+sh scripts/biffo.sh rewrite-scope-check || exit 1
 
 if [ ! -f scripts/verify.sh ]; then
   echo "pre-push: no scripts/verify.sh — NO checks ran (see local-gates.md)" >&2

package/_skeletons/sibling-template/scripts/verify.sh

@@ -662,8 +662,12 @@ _pg_modules=$(pg_test_modules)
 # rebuild), so calling it is better than warning about it. Failure is silent
 # BECAUSE the WARN below is the honest report of it -- no Docker, no server, no
 # schema all end in the same place: the lane did not run, and the gate says so.
-if [ -z "$PG_TEST_DSN" ] && [ -n "$_pg_modules" ] && [ -z "$LIST" ] && [ -f scripts/pg-test-db.sh ]; then
-  PG_TEST_DSN=$(sh scripts/pg-test-db.sh 2>/dev/null | tail -1) || PG_TEST_DSN=""
+if [ -z "$PG_TEST_DSN" ] && [ -n "$_pg_modules" ] && [ -z "$LIST" ]; then
+  # Through the bridge since #1109; the `-f scripts/pg-test-db.sh` guard went
+  # with the copy. Failure stays silent here BECAUSE the WARN below is the
+  # honest report of it -- no Docker, no server, no schema and no CLI all end
+  # in the same place: the lane did not run, and the gate says so.
+  PG_TEST_DSN=$(sh scripts/biffo.sh pg-test-db 2>/dev/null | tail -1) || PG_TEST_DSN=""
   case "$PG_TEST_DSN" in
     postgres*) ;;
     *) PG_TEST_DSN="" ;;

package/dist/index.js

@@ -10813,6 +10813,27 @@ function packagedScriptCommand(spec) {
   });
 }
 
+// src/commands/hook-audit.ts
+var hookAuditCommand = packagedScriptCommand({
+  name: "hook-audit",
+  script: "scripts/hook-audit.sh",
+  description: "Report whether git hooks will actually fire in every working tree"
+});
+
+// src/commands/pg-test-db.ts
+var pgTestDbCommand = packagedScriptCommand({
+  name: "pg-test-db",
+  script: "scripts/pg-test-db.sh",
+  description: "Provision the local Postgres test database and print its DSN"
+});
+
+// src/commands/rewrite-scope-check.ts
+var rewriteScopeCheckCommand = packagedScriptCommand({
+  name: "rewrite-scope-check",
+  script: "scripts/rewrite-scope-check.sh",
+  description: "Refuse a push whose rewrite scope absorbs merged work from another branch"
+});
+
 // src/commands/branch-health.ts
 var branchHealthCommand = packagedScriptCommand({
   name: "branch-health",
@@ -10852,6 +10873,9 @@ program.addCommand(teardownCommand);
 program.addCommand(waitForChecksCommand);
 program.addCommand(branchHealthCommand);
 program.addCommand(claimCommand);
+program.addCommand(hookAuditCommand);
+program.addCommand(pgTestDbCommand);
+program.addCommand(rewriteScopeCheckCommand);
 program.addCommand(pluginCommand);
 program.addCommand(dataCommand);
 program.addCommand(coreCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.237.0",
+  "version": "0.238.1",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",
@@ -26,7 +26,10 @@
     "_skeletons",
     "scripts/wait-for-checks.sh",
     "scripts/branch-health.sh",
-    "scripts/claim.sh"
+    "scripts/claim.sh",
+    "scripts/hook-audit.sh",
+    "scripts/pg-test-db.sh",
+    "scripts/rewrite-scope-check.sh"
   ],
   "scripts": {
     "build": "tsup src/index.ts --format esm --dts --clean",

package/_skeletons/sibling-template/scripts/hook-audit.sh

@@ -1,145 +0,0 @@
-#!/usr/bin/env bash
-#
-# Is a git hook actually going to execute here?
-#
-# ## Why this exists
-#
-# A configured hook that does not run is worse than no hook, because it is
-# assumed to be protecting you. On 2026-07-29 the estate was in exactly that
-# state: `core.hooksPath` pointed at `.husky/_`, a **gitignored** directory
-# created only by `prepare: husky` on `pnpm install` — and git resolves that
-# relative path against *each worktree's* root. Every fresh worktree therefore
-# had no hooks, and git said nothing: no warning, no error, no output.
-#
-# AGENTS.md §1 mandates a fresh worktree per unit of work, so the required
-# workflow disarmed its own gates. 6 of 32 working trees were armed. The pre-push
-# pyright, the pre-commit lint-staged and commitlint had all been silently
-# skipped in the other 26 for as long as anyone had been using worktrees.
-#
-# Nothing detected it because nothing looked. This is the thing that looks.
-#
-# ## Verdicts
-#
-#   ARMED     git will execute a hook here.
-#   DEAD      core.hooksPath is set and its target is missing or carries no
-#             hooks. Git skips silently. **This is the state that lies to you**,
-#             and the only one that makes this script exit non-zero.
-#   NO-HOOKS  no hooks configured at all. Honest, and visible in this report.
-#
-# Usage:
-#   sh scripts/hook-audit.sh                 # this repo and its worktrees
-#   sh scripts/hook-audit.sh --estate ~/code # every repo under a directory
-#   sh scripts/hook-audit.sh --quiet         # verdict counts only
-
-set -uo pipefail
-
-ESTATE=""
-QUIET=""
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --estate) ESTATE="$2"; shift 2 ;;
-    --quiet) QUIET=1; shift ;;
-    *) echo "unknown argument: $1" >&2; exit 2 ;;
-  esac
-done
-
-armed=0
-dead=0
-nohooks=0
-dead_list=""
-
-# The three hooks this standard cares about. A hooksPath directory containing
-# none of them is not armed for our purposes even if it holds something else.
-WANTED='^(pre-commit|pre-push|commit-msg)$'
-
-report() {
-  tree="$1"
-  label="$2"
-  hp=$(git -C "$tree" config core.hooksPath 2>/dev/null)
-
-  if [ -z "$hp" ]; then
-    # The default hooks directory is in the **common** git dir, which linked
-    # worktrees share. Reading "$tree/.git/hooks" is wrong for exactly the trees
-    # this audit exists to check: in a linked worktree `.git` is a *file*
-    # containing a gitdir pointer, so that path does not exist and every armed
-    # worktree was about to be reported NO-HOOKS. Ask git where it actually is.
-    #
-    # Git ships .sample files there that never execute, so counting the
-    # directory as armed merely for being non-empty would be exactly the false
-    # comfort this script exists to remove.
-    common=$(git -C "$tree" rev-parse --path-format=absolute --git-common-dir 2>/dev/null)
-    real=$(ls "${common:-$tree/.git}/hooks" 2>/dev/null | grep -vc '\.sample$' || true)
-    if [ "${real:-0}" -gt 0 ]; then
-      armed=$((armed + 1))
-      [ -n "$QUIET" ] || printf '%-56s %-14s \033[32mARMED\033[0m    %s\n' "$label" "(default)" "$real hook(s) in .git/hooks"
-    else
-      nohooks=$((nohooks + 1))
-      [ -n "$QUIET" ] || printf '%-56s %-14s \033[33mNO-HOOKS\033[0m %s\n' "$label" "(default)" "no hooks configured"
-    fi
-    return
-  fi
-
-  # Relative hooksPath resolves against the working tree root — the whole bug.
-  case "$hp" in
-    /*) dir="$hp" ;;
-    *) dir="$tree/$hp" ;;
-  esac
-
-  present=$(ls "$dir" 2>/dev/null | grep -E "$WANTED" | tr '\n' ',' || true)
-  if [ -z "$present" ]; then
-    dead=$((dead + 1))
-    dead_list="$dead_list  $label ($hp)
-"
-    [ -n "$QUIET" ] || printf '%-56s %-14s \033[31mDEAD\033[0m     %s\n' "$label" "$hp" "$hp missing or holds no hooks — git skips ALL hooks silently"
-  else
-    armed=$((armed + 1))
-    [ -n "$QUIET" ] || printf '%-56s %-14s \033[32mARMED\033[0m    %s\n' "$label" "$hp" "${present%,}"
-  fi
-}
-
-walk_repo() {
-  root="${1%/}"
-  name="$2"
-  # Every working tree, not just the primary — the primary is usually the one
-  # that IS armed, which is how this went unnoticed for so long.
-  git -C "$root" worktree list --porcelain 2>/dev/null | awk '/^worktree /{print $2}' | while read -r t; do
-    [ -d "$t" ] || continue
-    if [ "$t" = "$root" ]; then echo "$t|$name"; else echo "$t|$name${t#$root}"; fi
-  done
-}
-
-[ -n "$QUIET" ] || printf '%-56s %-14s %-8s %s\n' "WORKING TREE" "hooksPath" "VERDICT" "detail"
-
-if [ -n "$ESTATE" ]; then
-  targets=$(for d in "$ESTATE"/*/; do
-    [ -e "$d/.git" ] || continue
-    walk_repo "$d" "$(basename "${d%/}")"
-  done)
-else
-  root=$(git rev-parse --show-toplevel 2>/dev/null) || { echo "not a git repo" >&2; exit 2; }
-  # From inside a worktree, --show-toplevel gives the worktree; walk from the
-  # common repo so sibling worktrees are audited too.
-  common=$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null)
-  root=$(dirname "$common")
-  targets=$(walk_repo "$root" "$(basename "$root")")
-fi
-
-while IFS='|' read -r tree label; do
-  [ -n "$tree" ] || continue
-  report "$tree" "$label"
-done <<EOF
-$targets
-EOF
-
-total=$((armed + dead + nohooks))
-printf '\n%s working trees — \033[32m%s armed\033[0m, \033[31m%s dead\033[0m, %s without hooks' "$total" "$armed" "$dead" "$nohooks"
-[ "$total" -gt 0 ] && printf ' (%s%% armed)' "$((100 * armed / total))"
-printf '\n'
-
-if [ "$dead" -gt 0 ]; then
-  printf '\n\033[31mDEAD working trees — hooks are configured here and are NOT running:\033[0m\n%s' "$dead_list"
-  printf 'Every commit and push made in these is unguarded, and nothing says so.\n'
-  printf 'Fix: run `pnpm install` there, or move the repo to tracked .githooks/.\n'
-  exit 1
-fi
-exit 0

package/_skeletons/sibling-template/scripts/pg-test-db.sh

@@ -1,275 +0,0 @@
-#!/usr/bin/env sh
-#
-# Give the Postgres-dependent test lane a database with a CURRENT schema, and
-# print its DSN.
-#
-# ## Why this exists
-#
-# `scripts/verify.sh` grew a `pg-test` check (#1089) because on 2026-08-02 nine
-# of thirteen locally-catchable failing CI steps across the estate were one
-# repo's real-Postgres lane -- a required check with no local counterpart at all.
-# But a gate can only run that lane against a database, and no repo documented
-# how to get one: no compose file, no script, no DSN written down. The container
-# that existed on the workstation had been created ad hoc in some earlier session
-# and held a scatter of scratch databases. That undocumented setup WAS the
-# fail-open, because a gate nobody can run is not a gate.
-#
-# ## Why freshness, not rebuild-every-time
-#
-# The expensive failure is not a slow rebuild, it is a STALE one. Measured on
-# tabsii-platform while writing this: a database built about an hour earlier,
-# before two PRs merged, produced **23 failures** in a module that had nothing to
-# do with the change in hand. Rebuilt from the same tree it passed 336/336, and
-# passed 336 again on an immediate re-run -- so the lane was genuinely
-# re-runnable and every one of those failures was the old schema.
-#
-# That is the worst shape a local gate can have. Twenty-three red tests that are
-# not your fault teach people the gate is unreliable, and an unreliable gate gets
-# bypassed -- which H4 pre-registered as the condition refuting the whole
-# local-gate programme. So the schema inputs are fingerprinted and a rebuild
-# happens only when they actually changed: reuse ~0.3s, rebuild ~4s.
-#
-# ## Why it is generic
-#
-# It adapts to the repo rather than being told about it, for the same reason
-# `verify.sh` does: forks drift, and a per-instance copy of this would drift from
-# the DDL layout it is meant to build. Everything instance-specific is DERIVED --
-# the schema directories from `db/imports/*/`, the engine image from whether the
-# DDL asks for PostGIS, and the did-it-build threshold from the number of
-# policies the DDL itself declares. Nothing here names a product.
-#
-# ## Usage
-#
-#   eval "$(sh scripts/pg-test-db.sh --export)"   # export BIFFO_TEST_PG_DSN
-#   sh scripts/pg-test-db.sh                      # print the DSN on stdout
-#   sh scripts/pg-test-db.sh --recreate           # force a rebuild
-#
-# Only the DSN reaches stdout, so it is safe to capture; progress goes to stderr.
-#
-# Overridable: BIFFO_PG_HOST, BIFFO_PG_PORT, BIFFO_PG_USER, BIFFO_PG_PASSWORD,
-# BIFFO_PG_DB, BIFFO_PG_CONTAINER, BIFFO_PG_IMAGE.
-#
-# ## Concurrency: derived, not coordinated
-#
-# The port, database name, and container name below default to values DERIVED
-# from this checkout's own path, not fixed constants. A fixed port
-# (`BIFFO_PG_PORT` used to default to `55432` everywhere) meant any two
-# checkouts running this script at the same time -- two worktrees of one repo,
-# or two entirely different repos on one machine -- attached to the SAME
-# Postgres cluster and raced on cluster-wide catalogs like `pg_shdepend`
-# (#1114). A fixed database name (`biffo_test`) meant they then shared one
-# database on top of that (#1120).
-#
-# The fix is not a lock: a machine-wide `flock` around this script would make
-# concurrent runs correct by serializing them, but that is coordination, and
-# this estate's shared-mutable-state defects have twice been solved instead by
-# making the value itself unique per user rather than making users take turns.
-# Deriving from `$REPO_ROOT` gets that for free -- it is already different for
-# every worktree and every repo -- and deterministically, so repeat runs
-# against the SAME checkout still land on the same port/db/container and reuse
-# the fingerprinted schema (see step 2 below) instead of rebuilding it under a
-# fresh identity every time. `BIFFO_PG_PORT`, `BIFFO_PG_DB`, and
-# `BIFFO_PG_CONTAINER` remain explicit overrides; only the *default* changed.
-
-set -eu
-
-REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
-
-# sha256sum is already a dependency of this script (see `fingerprint` below),
-# so reusing it here for a deterministic, cheap per-checkout key adds nothing
-# new to install. 12 hex chars is ample to keep collisions between checkouts
-# on one machine practically impossible while staying short enough to read in
-# `docker ps` output and a psql prompt.
-_checkout_key=$(printf '%s' "$REPO_ROOT" | sha256sum | cut -c1-12)
-_checkout_suffix=$(printf '%s' "$_checkout_key" | cut -c1-8)
-# IANA's dynamic/private port range (49152-65535, 16384 ports) mapped from the
-# next 4 hex chars of the same hash -- an ephemeral port picked deterministically
-# rather than asked of the OS, because a freshly-random port on every invocation
-# would break the reuse this key is for (a second run against the same checkout
-# has to land back on the same container to find its existing database).
-_checkout_port=$((49152 + (0x$(printf '%s' "$_checkout_key" | cut -c9-12) % 16384)))
-
-HOST="${BIFFO_PG_HOST:-localhost}"
-PORT="${BIFFO_PG_PORT:-$_checkout_port}"
-USER_="${BIFFO_PG_USER:-postgres}"
-PASS="${BIFFO_PG_PASSWORD:-postgres}"
-DB="${BIFFO_PG_DB:-biffo_test_$_checkout_suffix}"
-# Keyed the same way as PORT and for the same reason: the container is where
-# the port mapping actually lives (`docker run -p "$PORT:5432"`), so if the
-# container name stayed fixed while the port became per-checkout, a second
-# checkout would find the first checkout's container already occupying that
-# name, "start" it rather than create its own, and then poll forever against a
-# port that container was never bound to.
-CONTAINER="${BIFFO_PG_CONTAINER:-biffo-pg-test-$_checkout_suffix}"
-
-RECREATE=0
-EXPORT=0
-for arg in "$@"; do
-  case "$arg" in
-    --recreate) RECREATE=1 ;;
-    --export) EXPORT=1 ;;
-    -h | --help)
-      sed -n '2,72p' "$0" | sed 's/^#\{1,2\} \{0,1\}//'
-      exit 0
-      ;;
-    *)
-      echo "unknown argument: $arg" >&2
-      exit 2
-      ;;
-  esac
-done
-
-say() { echo "pg-test-db: $*" >&2; }
-
-cd "$REPO_ROOT"
-
-# --- what this repo's schema is made of --------------------------------------
-#
-# `db/imports/<name>/*.sql` is the Biffo DDL-import convention that the API's own
-# `ddl_import.list_sql_files` reads at startup, so deriving from it means this
-# script and the running app agree by construction rather than by someone
-# remembering to update both.
-DDL_FILES=$(find db/imports -mindepth 2 -maxdepth 2 -name '*.sql' 2>/dev/null | LC_ALL=C sort || true)
-ALEMBIC_DIR=""
-for _d in services/api .; do
-  [ -f "$_d/alembic.ini" ] && ALEMBIC_DIR="$_d" && break
-done
-
-if [ -z "$DDL_FILES" ] && [ -z "$ALEMBIC_DIR" ]; then
-  say "no db/imports/*/ DDL and no alembic.ini - this repo has no schema to build"
-  exit 1
-fi
-
-# PostGIS or plain, decided by what the DDL asks for. A plain `postgres` image
-# fails on the first `CREATE EXTENSION postgis`, and picking the heavier image
-# unconditionally would slow every repo that does not need it.
-if [ -n "$DDL_FILES" ] && echo "$DDL_FILES" | xargs grep -liE 'EXTENSION[[:space:]]+(IF[[:space:]]+NOT[[:space:]]+EXISTS[[:space:]]+)?postgis' >/dev/null 2>&1; then
-  IMAGE="${BIFFO_PG_IMAGE:-postgis/postgis:16-3.4}"
-else
-  IMAGE="${BIFFO_PG_IMAGE:-postgres:16}"
-fi
-
-export PGPASSWORD="$PASS"
-psql_admin() { psql -q -h "$HOST" -p "$PORT" -U "$USER_" -d postgres "$@"; }
-psql_db() { psql -q -h "$HOST" -p "$PORT" -U "$USER_" -d "$DB" "$@"; }
-
-# --- 1. a reachable server ---------------------------------------------------
-#
-# Started here rather than assumed, because "docker run one yourself" is exactly
-# the tribal knowledge this script replaces. An already-running server is reused.
-if ! psql_admin -c 'SELECT 1' >/dev/null 2>&1; then
-  if ! command -v docker >/dev/null 2>&1; then
-    say "no Postgres at $HOST:$PORT and docker is not installed."
-    say "Start one and re-run, or set BIFFO_PG_HOST / BIFFO_PG_PORT."
-    exit 1
-  fi
-  if docker ps -a --format '{{.Names}}' | grep -qx "$CONTAINER"; then
-    say "starting existing container $CONTAINER"
-    docker start "$CONTAINER" >/dev/null
-  else
-    say "creating container $CONTAINER ($IMAGE) on port $PORT"
-    docker run -d --name "$CONTAINER" \
-      -e POSTGRES_PASSWORD="$PASS" -p "$PORT:5432" "$IMAGE" >/dev/null
-  fi
-  # Polled, not slept: a cold image pull and a warm restart differ by an order of
-  # magnitude, and one fixed sleep is wrong for both.
-  _waited=0
-  until psql_admin -c 'SELECT 1' >/dev/null 2>&1; do
-    _waited=$((_waited + 1))
-    if [ "$_waited" -gt 90 ]; then
-      say "Postgres did not become ready in 90s"
-      exit 1
-    fi
-    sleep 1
-  done
-  say "Postgres ready after ${_waited}s"
-fi
-
-DSN="postgresql+asyncpg://$USER_:$PASS@$HOST:$PORT/$DB"
-emit() {
-  if [ "$EXPORT" -eq 1 ]; then
-    echo "export BIFFO_TEST_PG_DSN='$DSN'"
-  else
-    echo "$DSN"
-  fi
-}
-
-# --- 2. is the existing schema current? --------------------------------------
-#
-# By CONTENT, not mtime: a branch switch changes content and leaves mtime
-# anywhere. Stored inside the database, so it cannot outlive a drop or describe
-# some other database.
-fingerprint() {
-  {
-    [ -n "$ALEMBIC_DIR" ] && find "$ALEMBIC_DIR" -name '*.py' -path '*alembic*' -type f 2>/dev/null |
-      LC_ALL=C sort | xargs cat 2>/dev/null
-    [ -n "$DDL_FILES" ] && echo "$DDL_FILES" | xargs cat 2>/dev/null
-  } | sha256sum | cut -d' ' -f1
-}
-
-WANT=$(fingerprint)
-HAVE=""
-if [ "$RECREATE" -eq 0 ] &&
-  psql_admin -tAc "SELECT 1 FROM pg_database WHERE datname='$DB'" 2>/dev/null | grep -q 1; then
-  HAVE=$(psql -tAq -h "$HOST" -p "$PORT" -U "$USER_" -d "$DB" \
-    -c "SELECT value FROM biffo_pg_test_fingerprint LIMIT 1" 2>/dev/null || true)
-fi
-
-if [ -n "$HAVE" ] && [ "$HAVE" = "$WANT" ]; then
-  say "schema is current, reusing $DB"
-  emit
-  exit 0
-fi
-
-[ -n "$HAVE" ] && say "schema inputs changed - rebuilding rather than serving a stale schema"
-
-# --- 3. rebuild the way the app and CI do ------------------------------------
-say "rebuilding $DB"
-psql_admin -c "DROP DATABASE IF EXISTS $DB WITH (FORCE)" >/dev/null
-psql_admin -c "CREATE DATABASE $DB" >/dev/null
-
-if [ -n "$ALEMBIC_DIR" ]; then
-  BIFFO_DATABASE_URL="$DSN" uv run --directory "$ALEMBIC_DIR" alembic upgrade head >/dev/null
-  say "alembic upgrade head"
-fi
-
-if [ -n "$DDL_FILES" ]; then
-  # ONE psql session, sorted by filename, mirroring the API's own DDL import.
-  # Session state an early module sets -- typically `SET search_path` in the
-  # first file -- has to survive into later ones, so a per-file connection would
-  # silently change the meaning of every unqualified name after it. LC_ALL=C
-  # keeps the shell's sort byte-ordered to match Python's.
-  # shellcheck disable=SC2046
-  psql -q -v ON_ERROR_STOP=1 -h "$HOST" -p "$PORT" -U "$USER_" -d "$DB" \
-    --single-transaction $(echo "$DDL_FILES" | sed 's/^/-f /' | tr '\n' ' ') >/dev/null
-  say "$(echo "$DDL_FILES" | wc -l | tr -d ' ') DDL modules applied"
-fi
-
-# --- 4. refuse to bless a half-built schema ----------------------------------
-#
-# The threshold is derived, not guessed: count the policies the DDL declares and
-# require the database to hold at least half. Recording a fingerprint against a
-# partial schema is worse than failing, because the NEXT run would trust it and
-# every failure after that would look like the developer's own change.
-if [ -n "$DDL_FILES" ]; then
-  _declared=$(echo "$DDL_FILES" | xargs grep -ciE '^[[:space:]]*CREATE[[:space:]]+POLICY' 2>/dev/null |
-    awk -F: '{s+=$NF} END {print s+0}')
-  if [ "${_declared:-0}" -gt 0 ]; then
-    _actual=$(psql -tAq -h "$HOST" -p "$PORT" -U "$USER_" -d "$DB" \
-      -c "SELECT count(*) FROM pg_policies" 2>/dev/null || echo 0)
-    if [ "${_actual:-0}" -lt $((_declared / 2)) ]; then
-      say "only ${_actual:-0} policies present against $_declared declared - the schema did not build."
-      say "Not recording a fingerprint; fix the DDL and re-run."
-      exit 1
-    fi
-    say "$_actual RLS policies ($_declared declared)"
-  fi
-fi
-
-psql_db \
-  -c "CREATE TABLE IF NOT EXISTS biffo_pg_test_fingerprint (value text primary key)" \
-  -c "TRUNCATE biffo_pg_test_fingerprint" \
-  -c "INSERT INTO biffo_pg_test_fingerprint (value) VALUES ('$WANT')" >/dev/null
-
-say "ready"
-emit

package/_skeletons/sibling-template/scripts/rewrite-scope-check.sh

@@ -1,189 +0,0 @@
-#!/usr/bin/env sh
-# Refuse a force-push that has quietly started touching a file somebody else
-# just changed.
-#
-# ## The incident (tabsii-platform#446, 2026-07-31)
-#
-# A branch had to be rebuilt to purge a Secret Scan finding from its history.
-# The rebuild used:
-#
-#     git reset --soft origin/dev && git add -A
-#
-# `origin/dev` had advanced by two merged PRs since the branch was cut. So
-# `reset --soft` moved HEAD onto the NEWER dev while the working tree still
-# held the OLDER copy of a doc those PRs had edited — and `git add -A`
-# faithfully staged the difference. The resulting commit, whose subject was
-# about RLS policies, silently REVERTED four lines of somebody else's merged
-# work.
-#
-# Nothing local saw it: `verify.sh` passed, 2884 tests passed, the real-Postgres
-# lane passed twice. It surfaced only because GitHub reported the PR as
-# CONFLICTING and somebody went looking for why. **Had those two PRs touched any
-# other file, there would have been no conflict and the revert would have
-# merged.** A conflict is not a detector; it is the lucky case.
-#
-# ## What this checks, and why it is narrow
-#
-# It fires only on the intersection of two conditions, because either alone is
-# far too noisy to be a gate:
-#
-#   1. The push is a REWRITE — the remote tip is not an ancestor of what you are
-#      pushing. An ordinary fast-forward push cannot have this problem.
-#   2. A file the branch changes would be written back to content the
-#      integration branch ALREADY HAD earlier in its history. Not new work: an
-#      older copy.
-#
-# Condition 2 is the accidental-revert signature exactly, and it is the second
-# attempt. The first asked "has the integration branch moved this file since my
-# base?", which sounds equivalent and is not — `git reset --soft origin/dev`
-# makes your base the integration tip, so the answer is always no. **That
-# version scored a clean pass on a faithful reconstruction of the incident
-# above.** `cli/src/lib/rewrite-scope-check.test.ts` reinstates it to prove the
-# tests can tell the two apart.
-#
-# What stays silent, deliberately: amending to add a file nobody else has
-# touched; rebasing onto a newer integration branch; two branches making
-# genuinely different edits to one shared file. Only a STALE copy is a bug.
-#
-# ## What it deliberately does NOT do
-#
-# It does not try to decide whether a change is "intended". That needs intent,
-# which no gate has. It answers a narrower question answerable from history
-# alone: *is the content I am about to push actually older content?*
-#
-# It also never fails the push because it could not run. A guard that blocks
-# work when its own inputs are missing gets disabled, and then it protects
-# nothing. When it cannot answer it says so, loudly, and exits 0 — the same
-# contract `verify.sh` uses for a check whose tool is absent. Absence is
-# reported, never mistaken for a clean result.
-
-set -u
-
-ZERO=0000000000000000000000000000000000000000
-ESCAPE_HATCH=BIFFO_ALLOW_SCOPE_CHANGE
-
-note() { printf 'rewrite-scope: %s\n' "$1" >&2; }
-
-# The integration branch every Biffo repo uses (AGENTS.md §2). Resolved rather
-# than assumed: a repo whose remote HEAD says otherwise is a repo this check
-# should not guess about.
-integration=""
-for candidate in dev main master; do
-  if git rev-parse --verify --quiet "refs/remotes/origin/$candidate" >/dev/null 2>&1; then
-    integration="origin/$candidate"
-    break
-  fi
-done
-
-if [ -z "$integration" ]; then
-  note "no origin/dev, origin/main or origin/master — check did NOT run"
-  exit 0
-fi
-
-# The inner filter below runs in a subshell (it is on the right of a pipe), so
-# it cannot assign to a variable in this shell. Collect through a file instead.
-FINDINGS_FILE=$(mktemp) || {
-  note "could not create a temp file — check did NOT run"
-  exit 0
-}
-trap 'rm -f "$FINDINGS_FILE"' EXIT HUP INT TERM
-
-# git feeds pre-push one line per ref: <local ref> <local sha> <remote ref> <remote sha>
-while read -r _local_ref local_sha _remote_ref remote_sha; do
-  # Branch deletion, or nothing to push.
-  [ "$local_sha" = "$ZERO" ] && continue
-  # Brand-new remote branch: there is no previous scope to compare against.
-  [ "$remote_sha" = "$ZERO" ] && continue
-  # The remote may not have the old object locally (shallow clone, pruned).
-  git cat-file -e "$remote_sha^{commit}" 2>/dev/null || {
-    note "remote tip $remote_sha not available locally — check did NOT run for this ref"
-    continue
-  }
-  # Fast-forward: not a rewrite, cannot exhibit this defect.
-  if git merge-base --is-ancestor "$remote_sha" "$local_sha" 2>/dev/null; then
-    continue
-  fi
-
-  new_base=$(git merge-base "$local_sha" "$integration" 2>/dev/null) || continue
-  old_base=$(git merge-base "$remote_sha" "$integration" 2>/dev/null) || continue
-
-  # Every file this branch claims to change, relative to where it forked.
-  #
-  # Iterated with `while read`, not `for file in $scope`: word splitting would
-  # break any path containing a space, and a guard that silently skips the file
-  # it should have flagged is worse than no guard. Process substitution
-  # (`grep -f <(...)`) is avoided for the same class of reason — it is a
-  # bashism, and this runs under `sh` from the pre-push hook.
-  git diff --name-only "$new_base" "$local_sha" 2>/dev/null | while IFS= read -r file; do
-    [ -z "$file" ] && continue
-
-    mine=$(git rev-parse --quiet --verify "$local_sha:$file" 2>/dev/null) || continue
-    theirs=$(git rev-parse --quiet --verify "$integration:$file" 2>/dev/null) || continue
-    # Agreeing with the integration branch is the normal, safe case.
-    [ "$mine" = "$theirs" ] && continue
-
-    # The signature of an accidental revert: the content you are about to push
-    # is not new work, it is a version this file ALREADY HAD earlier in the
-    # integration branch's history.
-    #
-    # This is what makes the check work at all. The first version asked "has
-    # the integration branch moved this file since my base?", which sounds
-    # equivalent and is not: `git reset --soft origin/dev` makes your base the
-    # integration tip, so the answer is always no and the guard never fires.
-    # Verified against a reconstruction of tabsii-platform#446 — the earlier
-    # condition scored a clean pass on the exact commit that reverted two
-    # merged PRs.
-    #
-    # Bounded to recent history: an unbounded walk on a long-lived file costs
-    # more than a pre-push gate should, and a stale copy older than this is not
-    # the accident this catches.
-    git log --format=%H -n 200 "$integration" -- "$file" 2>/dev/null | while IFS= read -r commit; do
-      [ -z "$commit" ] && continue
-      past=$(git rev-parse --quiet --verify "$commit:$file" 2>/dev/null) || continue
-      if [ "$past" = "$mine" ]; then
-        printf '%s\n' "$file"
-        break
-      fi
-    done
-  done >>"$FINDINGS_FILE"
-done
-
-findings=$(cat "$FINDINGS_FILE" 2>/dev/null)
-
-[ -z "$findings" ] && exit 0
-
-if [ -n "${BIFFO_ALLOW_SCOPE_CHANGE:-}" ]; then
-  note "scope change allowed via $ESCAPE_HATCH:"
-  printf '%s' "$findings" | sed 's/^/  /' >&2
-  exit 0
-fi
-
-cat >&2 <<EOF
-
-  This force-push would write a version of these file(s) that $integration
-  ALREADY HAD earlier in its history — not new work, an older copy:
-
-$(printf '%s' "$findings" | sed 's/^/    /')
-
-  That is the signature of an accidental revert. A rewrite (rebase, amend,
-  reset --soft) picked up a stale copy of somebody else's merged work and
-  recorded it as your change. It merges silently unless it happens to
-  conflict, and no test can see it — the content is valid, just old.
-
-  Check what you are actually about to write:
-
-    git diff $integration...HEAD -- <file>
-
-  If it is intended, push again with:
-
-    $ESCAPE_HATCH=1 git push ...
-
-  If it is not: restore the file and amend —
-
-    git checkout $integration -- <file> && git commit --amend --no-edit
-
-  Rebuilding a branch? Reset to a FIXED SHA (the branch point), never to a
-  moving ref like $integration.
-
-EOF
-exit 1