@erclx/canon 5.12.0 → 5.14.0

package/src/tooling/verify-stack.ts

@@ -0,0 +1,249 @@
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+import { execa, type Options } from 'execa'
+import { isStackExcluded, loadManifest } from '@/tooling/manifest'
+import { intro, logError, logInfo, logStep, logWarn, outro } from '@/ui'
+
+const SCREENSHOT_TIMEOUT_MS = 60_000
+const TAIL_LINES = 20
+
+export interface VerifyOptions {
+  readonly root: string
+  readonly stack: string
+  readonly keep?: boolean
+}
+
+export interface PhaseResult {
+  readonly name: string
+  readonly passed: boolean
+}
+
+export interface VerifyOutcome {
+  readonly results: readonly PhaseResult[]
+  readonly exitCode: number
+}
+
+interface Run {
+  readonly dir: string
+  readonly results: PhaseResult[]
+  isFailed: boolean
+}
+
+/**
+ * Scaffolds a stack into `.canon/tmp/runs/verify-<stack>/`, syncs its chain
+ * from the checkout at `root`, and runs the scaffold's own `lint:fix`,
+ * `check`, `test:e2e`, and `screenshot` scripts. Every line goes to stderr.
+ *
+ * A failed phase is recorded and the run carries on, so the Results block
+ * reports every phase rather than the first failure. The tmp dir is removed
+ * only on a clean run without `keep`.
+ */
+export async function verifyStack(opts: VerifyOptions): Promise<VerifyOutcome> {
+  intro(`canon tooling verify ${opts.stack}`)
+  // A signal skips the `finally` below, so the handler closes the frame on
+  // that path and leaves the tmp dir in place for inspection.
+  let isOpen = true
+  const close = (): void => {
+    if (isOpen) outro()
+    isOpen = false
+  }
+  const handleSignal = (): void => {
+    close()
+    process.exit(130)
+  }
+  process.once('SIGINT', handleSignal)
+  process.once('SIGTERM', handleSignal)
+
+  try {
+    return await run(opts)
+  } finally {
+    process.off('SIGINT', handleSignal)
+    process.off('SIGTERM', handleSignal)
+    close()
+  }
+}
+
+async function run({
+  root,
+  stack,
+  keep = false,
+}: VerifyOptions): Promise<VerifyOutcome> {
+  const refuse = (message: string): VerifyOutcome => {
+    logError(message)
+    return { results: [], exitCode: 1 }
+  }
+
+  if (isStackExcluded(stack)) {
+    return refuse(`Stack '${stack}' is excluded from tooling.`)
+  }
+  const manifest = loadManifest(root, stack)
+  if (manifest === undefined) {
+    return refuse(`No manifest at tooling/${stack}/manifest.toml`)
+  }
+  if (manifest.scaffold === undefined) {
+    return refuse(`Stack '${stack}' has no scaffold command in manifest.`)
+  }
+
+  const runsDir = join(root, '.canon/tmp/runs')
+  const name = `verify-${stack}`
+  const state: Run = { dir: join(runsDir, name), results: [], isFailed: false }
+
+  mkdirSync(runsDir, { recursive: true })
+  rmSync(state.dir, { recursive: true, force: true })
+
+  logStep(`Scaffolding ${stack}`)
+  // Manifests carry shell syntax (`&&`, `cd`, quoted globs), so the command
+  // runs under a shell rather than as a split argv.
+  const scaffold = await shell(
+    manifest.scaffold.replaceAll('{{name}}', name),
+    runsDir,
+  )
+  if (scaffold.failed) {
+    logWarn('Scaffold failed')
+    writeTail(scaffold.all)
+    state.isFailed = true
+  }
+
+  if (!existsSync(state.dir)) {
+    return refuse(`Scaffold did not produce ${state.dir}`)
+  }
+
+  await shell(
+    'git init -q && git add . && git commit -m "chore: verify scaffold" -q --no-verify --allow-empty',
+    state.dir,
+  )
+
+  const { prepare } = manifest
+  if (prepare !== undefined) {
+    await phase(state, 'Prepare', () => shell(prepare, state.dir))
+  }
+
+  const cli = join(root, 'src/cli.ts')
+  logInfo(`Sync resolves via bun ${cli}, not PATH canon`)
+  await phase(state, 'Sync', () =>
+    execa('bun', [cli, 'tooling', 'sync', stack, '.', '--write'], {
+      ...captured(state.dir),
+      env: { CI: '1', CANON_NON_INTERACTIVE: '1' },
+    }),
+  )
+
+  const packagePath = join(state.dir, 'package.json')
+  if (existsSync(packagePath)) {
+    await runScripts(state, readScriptKeys(packagePath))
+  } else {
+    logError(
+      `No package.json after Sync for ${stack}, so no phase past Sync can run.`,
+    )
+    state.isFailed = true
+  }
+
+  logStep('Results')
+  for (const result of state.results) {
+    if (result.passed) logInfo(result.name)
+    else logWarn(result.name)
+  }
+
+  if (!keep && !state.isFailed) {
+    rmSync(state.dir, { recursive: true, force: true })
+  } else {
+    logInfo(`Kept ${state.dir}`)
+  }
+
+  return { results: state.results, exitCode: state.isFailed ? 1 : 0 }
+}
+
+/**
+ * `lint:fix` runs first and reformats the scaffold, so `check` reads the
+ * reformatted tree.
+ */
+async function runScripts(state: Run, scripts: Set<string>): Promise<void> {
+  await phase(state, 'lint:fix', () => bunRun('lint:fix', state.dir))
+  await phase(state, 'check', () => bunRun('check', state.dir))
+
+  if (scripts.has('test:e2e')) {
+    await phase(state, 'test:e2e', () => bunRun('test:e2e', state.dir))
+  }
+
+  if (!scripts.has('screenshot')) return
+  const isShot = await phase(state, 'screenshot', () =>
+    bunRun('screenshot', state.dir, SCREENSHOT_TIMEOUT_MS),
+  )
+  // A killed or failed screenshot run is already a failure, and its partial
+  // output says nothing about the artifacts.
+  if (!isShot) return
+
+  const shots = countScreenshots(join(state.dir, 'screenshots'))
+  if (shots === 0) logWarn('screenshot produced no png files')
+  record(state, 'screenshot-artifacts', shots > 0)
+}
+
+type Spawned = Awaited<ReturnType<typeof execa>>
+
+async function phase(
+  state: Run,
+  name: string,
+  spawn: () => Promise<Spawned>,
+): Promise<boolean> {
+  logStep(name)
+  const result = await spawn()
+  if (!result.failed) {
+    logInfo(`${name} passed`)
+    record(state, name, true)
+    return true
+  }
+  logWarn(result.timedOut ? `${name} timed out` : `${name} failed`)
+  writeTail(result.all)
+  record(state, name, false)
+  return false
+}
+
+function record(state: Run, name: string, passed: boolean): void {
+  state.results.push({ name, passed })
+  if (!passed) state.isFailed = true
+}
+
+function captured(cwd: string): Options {
+  return { cwd, all: true, reject: false, stdin: 'ignore' }
+}
+
+function shell(command: string, cwd: string): Promise<Spawned> {
+  return execa(command, {
+    ...captured(cwd),
+    shell: 'bash',
+    env: { CI: '1' },
+  })
+}
+
+function bunRun(
+  script: string,
+  cwd: string,
+  timeout?: number,
+): Promise<Spawned> {
+  return execa('bun', ['run', script], {
+    ...captured(cwd),
+    env: { CI: '1' },
+    ...(timeout !== undefined ? { timeout } : {}),
+  })
+}
+
+function writeTail(output: unknown): void {
+  if (typeof output !== 'string' || output === '') return
+  const lines = output.replace(/\n$/, '').split('\n').slice(-TAIL_LINES)
+  process.stderr.write(`${lines.join('\n')}\n`)
+}
+
+function readScriptKeys(packagePath: string): Set<string> {
+  try {
+    const parsed = JSON.parse(readFileSync(packagePath, 'utf8')) as {
+      scripts?: Record<string, unknown>
+    }
+    return new Set(Object.keys(parsed.scripts ?? {}))
+  } catch {
+    return new Set()
+  }
+}
+
+function countScreenshots(dir: string): number {
+  if (!existsSync(dir)) return 0
+  return [...new Bun.Glob('**/*.png').scanSync({ cwd: dir, dot: true })].length
+}

package/tooling/base/seeds/.cspell/tech-stack.txt

@@ -3,11 +3,13 @@ bradlc
 bunx
 commitlint
 dbaeumer
+dotenv
 dotfolders
 erclx
 errexit
 esac
 esbenp
+eslintcache
 frontmatter
 lintstagedrc
 mkhl

package/tooling/claude/manifest.toml

@@ -1,5 +1,5 @@
 # Consumed only by `canon claude init`. Claude is not a discoverable tooling stack
-# and is excluded from `canon tooling` discovery via scripts/lib/tooling.sh.
+# and is excluded from `canon tooling` discovery via `EXCLUDED_STACKS` in src/tooling/manifest.ts.
 
 [stack]
 name = "claude"
@@ -8,8 +8,8 @@ runtime = ""
 scaffold = ""
 
 # Checked against this repository's own `.gitignore` by
-# scripts/core/check-ignore-parity.sh, which carries no sanctioned divergence
-# now that both sides ship the same two entries.
+# the Ignore parity stage of `bun run check`, which carries no sanctioned
+# divergence now that both sides ship the same two entries.
 #
 # One root entry rather than a folder apiece, so a target that gains a record
 # folder later receives no manifest edit and no sync. `.claude/worktrees/` is

package/tooling/go/manifest.toml

@@ -11,3 +11,6 @@ scaffold = "mkdir {{name}} && cd {{name}} && go mod init example.com/{{name}} &&
 "test" = "go test ./..."
 "test:run" = "go test -v ./..."
 "build" = "go build ./..."
+
+[verify]
+prepare = "bun init -y && (command -v golangci-lint >/dev/null || go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest)"

package/tooling/go/reference.md

@@ -32,6 +32,7 @@ The go stack also ships `smoke_test.go` at the module root as a copy-once seed.
 - Probe `go` and `golangci-lint` first, and name the `go install` command when `golangci-lint` is missing.
 - Keep `build` out of `verify.json`, even though the stack declares the script. `go build ./...` exits 1 with `no packages to build` on a module holding only a test file, and a seeded `main.go` would assume every module is a binary rather than a library.
 - Keep `-race` out of `test:run`. The race detector needs cgo and a C toolchain, so it belongs in CI rather than in a local `bun run check`.
+- The manifest's `[verify] prepare` runs checklist steps 3 and 6 for `canon tooling verify go`: `bun init -y`, then the `golangci-lint` `go install` when the binary is not already on PATH. The scaffold writes no `package.json`, and a verify that reaches its end with none fails.
 
 ## CI
 

package/tooling/php/manifest.toml

@@ -13,3 +13,6 @@ scaffold = "mkdir {{name}} && cd {{name}} && composer init -n --name example/{{n
 
 [gitignore]
 "# PHP" = ["vendor/", ".php-cs-fixer.cache", ".phpunit.cache/", ".phpunit.result.cache"]
+
+[verify]
+prepare = "bun init -y && composer require --dev friendsofphp/php-cs-fixer phpstan/phpstan phpunit/phpunit"

package/tooling/php/reference.md

@@ -44,6 +44,7 @@ The php stack also ships `tests/SmokeTest.php` as a copy-once seed, so `bun run
 - Probe `php` and `composer` first.
 - Hold a precondition on `vendor/bin/phpunit`, so the run stops and names `composer install` when it is missing.
 - Require Typecheck (`phpstan analyse`), Lint (`php-cs-fixer check`), and Unit tests (`phpunit --testdox`). Base's runner adds the four base phases wherever the folder declares their scripts, then the markdown bans stage.
+- The manifest's `[verify] prepare` runs checklist steps 2 and 5 for `canon tooling verify php`: `bun init -y`, then the `composer require --dev` line. The scaffold writes no `package.json`, and a verify that reaches its end with none fails.
 
 ## Gitignore
 

package/tooling/python/manifest.toml

@@ -14,3 +14,6 @@ scaffold = "uv init --package {{name}}"
 
 [gitignore]
 "# Python" = [".pytest_cache/", ".mypy_cache/", ".ruff_cache/", ".coverage_cache/"]
+
+[verify]
+prepare = "bun init -y && uv add --dev ruff mypy pytest pytest-cov && uv sync"

package/tooling/python/reference.md

@@ -39,7 +39,7 @@ The manifest declares no `[dependencies.dev]`. Manifest injection currently call
 
 ## Verify command
 
-`canon tooling verify <stack>` currently runs `bun run lint:fix` and `bun run check` against any stack with a `package.json`. Since base ships a `package.json`, those run for python too. Python's `verify.json` requires the package.json `lint`/`typecheck`/`test:run` scripts that delegate to `uv run`, so the verify path works end-to-end as long as `uv` is installed in the verify environment. The end-to-end test and screenshot phases are gated on `package.json` script keys that python does not declare, so they cleanly skip.
+`canon tooling verify python` runs the manifest's `[verify] prepare` before Sync, which is checklist steps 2, 5, and 6: `bun init -y`, `uv add --dev ruff mypy pytest pytest-cov`, and `uv sync`. `uv init` writes no `package.json`, and a verify that reaches its end with none fails, so the prepare is what lets `bun run lint:fix` and `bun run check` run at all. Python's `verify.json` requires the `lint`, `typecheck`, and `test:run` scripts that delegate to `uv run`, so the run needs `uv` on the machine and a network for the installs. The end-to-end test and screenshot phases are gated on `package.json` script keys that python does not declare, so they skip.
 
 ## Anti-patterns
 

package/tooling/python/seeds/.cspell/tech-stack.txt

@@ -2,7 +2,6 @@ addopts
 appuser
 asyncio
 coveragerc
-dotenv
 fastapi
 flake8
 htmlcov

package/scripts/core/check-capability-seeding.sh

@@ -1,134 +0,0 @@
-#!/usr/bin/env bash
-set -e
-set -o pipefail
-shopt -s nullglob
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-
-TOOLING_ROOT="$PROJECT_ROOT/tooling"
-MARKER="canon-no-seed:"
-
-# `find` writes to stderr and returns non-zero for a missing root, inside a
-# process substitution whose status nothing reads. Without this the walk covers
-# nothing and the check reports every capability seeded having never read one.
-if [ ! -d "$TOOLING_ROOT" ]; then
-  echo "No tooling root at ${TOOLING_ROOT#"$PROJECT_ROOT/"}, capability seeding unverifiable." >&2
-  exit 1
-fi
-
-failures=""
-
-# A comment naming the marker anywhere in the source file is the recorded
-# reason a capability withholds itself from every destination it was compared
-# against. The reason's own prose is free-form, so only the marker is tested.
-has_reason() {
-  grep -q "$MARKER" "$1"
-}
-
-# Compares one source directory's files against the basenames already
-# expanded from a set of destination paths. Presence on either side clears a
-# name; a source file reaching neither the destination nor a marked reason is
-# a capability answered on one side of the seed or config boundary and not
-# the other.
-check_capability() {
-  local label="$1" src_dir="$2"
-  shift 2
-
-  [ -d "$src_dir" ] || return 0
-
-  local dest_names=" "
-  local dest
-  for dest in "$@"; do
-    [ -f "$dest" ] || continue
-    dest_names="$dest_names$(basename "$dest") "
-  done
-
-  local src_file name
-  for src_file in "$src_dir"/*; do
-    [ -f "$src_file" ] || continue
-    name=$(basename "$src_file")
-    case "$dest_names" in
-    *" $name "*) continue ;;
-    esac
-    has_reason "$src_file" && continue
-    failures="$failures  $label: ${src_file#"$PROJECT_ROOT/"} reaches no seed or config and carries no $MARKER reason"$'\n'
-  done
-}
-
-check_capability "Hooks" "$PROJECT_ROOT/.claude/hooks" \
-  "$PROJECT_ROOT"/tooling/claude/seeds/.claude/hooks/*
-
-check_capability "Workflows" "$PROJECT_ROOT/.github/workflows" \
-  "$PROJECT_ROOT"/tooling/*/configs/.github/workflows/* \
-  "$PROJECT_ROOT"/tooling/*/seeds/.github/workflows/*
-
-check_capability "Husky" "$PROJECT_ROOT/.husky" \
-  "$PROJECT_ROOT"/tooling/base/configs/.husky/*
-
-# The reverse direction: a destination file whose source here is gone reaches
-# neither check_capability above nor the wiring pass below, both of which read
-# forward from the source, and it ships a target a hook, workflow, or husky
-# script this repository has already deleted. A destination carrying the same
-# marker clears just as a source does, which is the escape hatch a target-only
-# capability needs, such as a stack-specific workflow with no root counterpart
-# by design.
-check_orphans() {
-  local label="$1" src_dir="$2" dest_dir="$3"
-
-  [ -d "$dest_dir" ] || return 0
-
-  local dest_file name
-  for dest_file in "$dest_dir"/*; do
-    [ -f "$dest_file" ] || continue
-    name=$(basename "$dest_file")
-    [ -f "$src_dir/$name" ] && continue
-    has_reason "$dest_file" && continue
-    failures="$failures  $label: ${dest_file#"$PROJECT_ROOT/"} is seeded or configured with no source at ${src_dir#"$PROJECT_ROOT/"}/$name"$'\n'
-  done
-}
-
-check_orphans "Hooks" "$PROJECT_ROOT/.claude/hooks" \
-  "$PROJECT_ROOT/tooling/claude/seeds/.claude/hooks"
-
-for dir in "$PROJECT_ROOT"/tooling/*/configs/.github/workflows \
-  "$PROJECT_ROOT"/tooling/*/seeds/.github/workflows; do
-  check_orphans "Workflows" "$PROJECT_ROOT/.github/workflows" "$dir"
-done
-
-check_orphans "Husky" "$PROJECT_ROOT/.husky" \
-  "$PROJECT_ROOT/tooling/base/configs/.husky"
-
-# A hook that reached the seed tree with no wiring in the seeded settings.json
-# is installed dead, which fails the same way an unseeded hook does.
-SEED_HOOKS_DIR="$PROJECT_ROOT/tooling/claude/seeds/.claude/hooks"
-SEED_SETTINGS="$PROJECT_ROOT/tooling/claude/seeds/.claude/settings.json"
-
-if [ -d "$SEED_HOOKS_DIR" ]; then
-  if [ ! -f "$SEED_SETTINGS" ]; then
-    failures="$failures  Seed settings: no settings.json at ${SEED_SETTINGS#"$PROJECT_ROOT/"} to confirm a seeded hook is wired"$'\n'
-  elif ! command -v jq >/dev/null 2>&1; then
-    failures="$failures  Seed settings: jq is not installed, seeded-hook wiring unverifiable"$'\n'
-  else
-    # Every wired command as its own path segment set, rather than a substring
-    # search over the raw file, so a hook name that is a substring of another
-    # hook's filename (`log.sh` inside `pr-create-log.sh`) cannot pass on a
-    # neighbor's wiring.
-    wired=" $(jq -r '.. | .command? // empty' "$SEED_SETTINGS" | tr '/\n' '  ') "
-    for hook_file in "$SEED_HOOKS_DIR"/*.sh; do
-      [ -f "$hook_file" ] || continue
-      name=$(basename "$hook_file")
-      case "$wired" in
-      *" $name "*) continue ;;
-      esac
-      failures="$failures  Seed settings: $name is seeded and wired into no command in ${SEED_SETTINGS#"$PROJECT_ROOT/"}"$'\n'
-    done
-  fi
-fi
-
-if [ -n "$failures" ]; then
-  echo "A capability reaches one side of the seed or config boundary and not the other:" >&2
-  printf '%s' "$failures" >&2
-  echo "Seed or configure the capability, or mark the source line with # $MARKER <reason>." >&2
-  exit 1
-fi

package/scripts/core/check-ignore-parity.sh

@@ -1,141 +0,0 @@
-#!/usr/bin/env bash
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-
-GITIGNORE="$PROJECT_ROOT/.gitignore"
-MANIFEST="$PROJECT_ROOT/tooling/claude/manifest.toml"
-SECTION="# Claude"
-
-# Parity is exact, with no exception list behind it, and the move to `.canon/`
-# is what removed the one there was. Its two members each named a path inside
-# `.claude/` that this repository ignored and the manifest withheld, so a target
-# kept tracking it. A single root entry can withhold nothing inside itself: git
-# does not descend into an excluded directory, so a re-inclusion like
-# `!.canon/diagrams/` matches nothing. Retiring both is what buys the one line.
-#
-# The diagrams divergence is the one that cost something. A target used to track
-# its diagrams and keep the context audit's default coverage of them, and it now
-# ignores them with the rest of its records, so that coverage is gone unless the
-# project names the folder itself. `canon/context/tooling/manifests.md` carries the
-# narrative.
-#
-# An exception mechanism is not kept against a future divergence, because an
-# empty one cannot be exercised and a check nobody can test is a check nobody
-# should trust. It comes back with its first real member or not at all.
-
-if [ ! -f "$GITIGNORE" ]; then
-  echo "No .gitignore at ${GITIGNORE#"$PROJECT_ROOT/"}, ignore parity unverifiable." >&2
-  exit 1
-fi
-
-if [ ! -f "$MANIFEST" ]; then
-  echo "No claude manifest at ${MANIFEST#"$PROJECT_ROOT/"}, ignore parity unverifiable." >&2
-  exit 1
-fi
-
-# A gitignore pattern and a manifest entry describe the same folder whether or
-# not either spells the trailing slash, so presence is compared with it dropped.
-# No live pair differs that way now that both lists carry the same two entries,
-# and the normalization stays because either side may be written without one.
-normalize() {
-  printf '%s\n' "${1%/}"
-}
-
-# Every pattern the file carries, comments and blank lines dropped. The whole
-# file rather than one header, since a claude-scoped entry filed under a header
-# of its own would otherwise read as missing from a list that carries it.
-gitignore_patterns() {
-  awk '{ sub(/[[:space:]]+$/, "") } $0 ~ /^[[:space:]]*#/ || $0 == "" { next } { print }' "$GITIGNORE"
-}
-
-# Every entry of the named array in the manifest's `[gitignore]` table. The
-# array is accumulated to its closing bracket before the quoted strings are read
-# out, so a formatter wrapping it across lines does not silently empty this.
-manifest_entries() {
-  awk -v key="\"$SECTION\"" '
-    /^\[/ { table = $0 }
-    table != "[gitignore]" { next }
-    index($0, key) == 1 { collecting = 1; buf = "" }
-    collecting { buf = buf $0 }
-    collecting && index($0, "]") > 0 {
-      collecting = 0
-      buf = substr(buf, index(buf, "["))
-      count = split(buf, parts, "\"")
-      for (i = 2; i <= count; i += 2) print parts[i]
-    }
-  ' "$MANIFEST"
-}
-
-contains() {
-  local needle=$1
-  shift
-  local candidate
-  for candidate in "$@"; do
-    [ "$candidate" = "$needle" ] || continue
-    return 0
-  done
-  return 1
-}
-
-ignored=()
-while IFS= read -r pattern; do
-  [ -n "$pattern" ] || continue
-  ignored+=("$(normalize "$pattern")")
-done < <(gitignore_patterns)
-
-shipped=()
-while IFS= read -r entry; do
-  [ -n "$entry" ] || continue
-  shipped+=("$(normalize "$entry")")
-done < <(manifest_entries)
-
-# An empty read on either side is a parse that failed rather than a repository
-# ignoring nothing, and reporting parity off it would say the two lists agree
-# having compared none of their entries.
-if [ ${#ignored[@]} -eq 0 ]; then
-  echo "No patterns read from .gitignore, ignore parity unverifiable." >&2
-  exit 1
-fi
-
-if [ ${#shipped[@]} -eq 0 ]; then
-  echo "No entries read from the \"$SECTION\" array in ${MANIFEST#"$PROJECT_ROOT/"}, ignore parity unverifiable." >&2
-  exit 1
-fi
-
-failures=""
-
-# Entries the manifest ships that this repository does not ignore. A target is
-# told to ignore a folder the toolkit itself tracks, which no decision sanctions,
-# so this direction carries no exception list.
-for entry in "${shipped[@]}"; do
-  contains "$entry" "${ignored[@]}" && continue
-  failures="$failures  $entry is shipped by the manifest and absent from .gitignore"$'\n'
-done
-
-# Claude-scoped patterns this repository ignores that the manifest does not
-# ship. Scoped to the two record roots because the manifest is the claude stack
-# and says nothing about `node_modules/` or `.env`.
-#
-# `.canon` is read as a bare root as well as a prefix, since it is one line
-# covering a whole tree where `.claude/` names a folder inside a root that also
-# holds tracked content. Leaving it out is what would let a new entry sit outside
-# the only stage comparing the two lists, which is the direction that goes
-# silently blind.
-for pattern in "${ignored[@]}"; do
-  case "$pattern" in
-  .claude/* | .canon | .canon/*) ;;
-  *) continue ;;
-  esac
-  contains "$pattern" "${shipped[@]}" && continue
-  failures="$failures  $pattern is ignored here and absent from the manifest"$'\n'
-done
-
-if [ -n "$failures" ]; then
-  echo "The ignore set a target receives disagrees with this repository's own:" >&2
-  printf '%s' "$failures" >&2
-  echo "Add the entry to the \"$SECTION\" array in ${MANIFEST#"$PROJECT_ROOT/"} and to .gitignore. The two lists are compared exactly, and nothing here records an exception." >&2
-  exit 1
-fi

package/scripts/core/check-plugin-boundary.sh

@@ -1,45 +0,0 @@
-#!/usr/bin/env bash
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-
-INTERNAL_ROOT="$PROJECT_ROOT/internal"
-PLUGIN_ROOT="$PROJECT_ROOT/claude"
-
-# `find` writes to stderr and returns non-zero for a missing root, inside a
-# process substitution whose status nothing reads. Without this the walk covers
-# nothing and the check reports the boundary clean having never measured it.
-if [ ! -d "$PLUGIN_ROOT" ]; then
-  echo "No plugin root at ${PLUGIN_ROOT#"$PROJECT_ROOT/"}, boundary unverifiable." >&2
-  exit 1
-fi
-
-# `realpath` resolves each walked path below. Absent, `set -e` aborts on the
-# substitution and the stage reports a leak for a tool that is not installed,
-# which is the same unmeasured-tree-with-a-verdict shape the guard above closes.
-if ! command -v realpath >/dev/null 2>&1; then
-  echo "realpath is not installed, boundary unverifiable." >&2
-  exit 1
-fi
-
-# The plugin reaches `standards/` through a symlink, which an
-# installer dereferences with no code in the path to filter. Walking the plugin
-# tree with symlinks followed is what an install actually copies, so resolving
-# each file and rejecting anything under `internal/` asserts the boundary at the
-# only place it can be measured.
-leaked=""
-while IFS= read -r file; do
-  resolved=$(realpath "$file")
-  case "$resolved" in
-  "$INTERNAL_ROOT"/*) leaked="$leaked  ${file#"$PROJECT_ROOT/"} -> ${resolved#"$PROJECT_ROOT/"}"$'\n' ;;
-  esac
-done < <(find -L "$PLUGIN_ROOT" -type f)
-
-if [ -n "$leaked" ]; then
-  echo "Plugin ships toolkit-internal content:" >&2
-  printf '%s' "$leaked" >&2
-  echo "Author internal content under internal/, which nothing under claude/ reaches." >&2
-  exit 1
-fi