@erclx/canon 5.13.0 → 5.14.0

package/src/pr/frames.ts

@@ -0,0 +1,323 @@
+import { readFile } from 'node:fs/promises'
+
+/** The branch holding review frames. It never merges into a branch anyone checks out. */
+export const FRAMES_BRANCH = 'canon-frames'
+
+/** The eight bytes every PNG opens with. A frame that lacks them embeds as a broken image. */
+const PNG_SIGNATURE = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]
+
+const SHORT_HEAD_LENGTH = 7
+
+const HEAD_PATTERN = /^[0-9a-f]{7,40}$/
+
+/** A compact UTC instant such as `20261002T154450Z`, the form `date -u +%Y%m%dT%H%M%SZ` prints. */
+const PASS_PATTERN = /^\d{8}T\d{6}Z$/
+
+/** How many times an add rebuilds on a tip another writer moved. */
+const ADD_ATTEMPTS = 3
+
+const FOLDER_PATTERN = /^pr-(\d+)$/
+
+const DAY_MS = 86_400_000
+
+export interface TreeEntry {
+  readonly path: string
+  readonly mode: string
+  readonly type: 'blob' | 'tree'
+  readonly sha: string
+}
+
+export type Tip =
+  | { readonly kind: 'found'; readonly commit: string; readonly tree: string }
+  | { readonly kind: 'missing' }
+  | { readonly kind: 'unreadable' }
+
+/** How a ref write landed. `conflict` means another writer holds the ref the call expected to own. */
+export type RefWrite = 'ok' | 'conflict' | 'failed'
+
+export interface PullClosure {
+  readonly state: 'open' | 'closed'
+  readonly closedAt?: string
+}
+
+/**
+ * The git data API calls a frame write needs, injected so the logic runs
+ * without a network. Every read that fails returns undefined rather than
+ * throwing, and each caller decides what an absent answer means.
+ */
+export interface FramesApi {
+  readTip(): Promise<Tip>
+  listTree(tree: string): Promise<readonly TreeEntry[] | undefined>
+  createBlob(base64: string): Promise<string | undefined>
+  createTree(
+    entries: readonly TreeEntry[],
+    base?: string,
+  ): Promise<string | undefined>
+  createCommit(
+    message: string,
+    tree: string,
+    parents: readonly string[],
+  ): Promise<string | undefined>
+  createRef(commit: string): Promise<RefWrite>
+  moveRef(commit: string, force: boolean): Promise<RefWrite>
+  deleteRef(): Promise<boolean>
+  readPull(number: number): Promise<PullClosure | undefined>
+}
+
+export type FramesRefusal = 'unreadable-tip' | 'push-failed' | 'ref-conflict'
+
+export interface FrameInput {
+  readonly number: number
+  readonly head: string
+  readonly pass: string
+  readonly box: number
+  readonly bytes: Uint8Array
+}
+
+export type PushResult =
+  | {
+      readonly kind: 'pushed'
+      readonly commit: string
+      readonly path: string
+      readonly created: boolean
+    }
+  | { readonly kind: 'refused'; readonly reason: FramesRefusal }
+
+export type DropResult =
+  | {
+      readonly kind: 'dropped'
+      readonly removed: readonly number[]
+      readonly commit?: string
+      readonly deleted?: boolean
+    }
+  | { readonly kind: 'refused'; readonly reason: FramesRefusal }
+
+export type PruneResult =
+  | {
+      readonly kind: 'dropped'
+      readonly removed: readonly number[]
+      readonly kept: readonly number[]
+      readonly unread: readonly number[]
+      readonly commit?: string
+      readonly deleted?: boolean
+    }
+  | { readonly kind: 'refused'; readonly reason: FramesRefusal }
+
+/** Whether a value names a commit, so a branch name or a path never becomes a folder. */
+export function isFrameHead(head: string): boolean {
+  return HEAD_PATTERN.test(head)
+}
+
+/** Whether a value is a compact UTC stamp, the only pass segment the path takes. */
+export function isFramePass(pass: string): boolean {
+  return PASS_PATTERN.test(pass)
+}
+
+/**
+ * Where a frame lands. The pass segment keeps a second pass at the same head
+ * and box from replacing the image an earlier review comment shows, since a
+ * branch-path link reads whatever the path holds now.
+ */
+export function framePath(
+  number: number,
+  head: string,
+  pass: string,
+  box: number,
+): string {
+  return `pr-${number}/${head.slice(0, SHORT_HEAD_LENGTH)}/${pass}/box-${box}.png`
+}
+
+/**
+ * The embed link, by branch path rather than by commit. Every drop rewrites
+ * the branch, so a commit-pinned link to another pull request's frame would
+ * stop resolving once GitHub collects the commit, while a path link lives
+ * exactly as long as its file. The blob form is the one `canon pr evidence`
+ * embeds, which a private repository's browser can open where the raw host
+ * serves nothing.
+ */
+export function frameLink(repo: string, path: string): string {
+  return `https://github.com/${repo}/blob/${FRAMES_BRANCH}/${path}?raw=true`
+}
+
+/** The frame's bytes, or undefined when the file is absent, empty, or not a PNG. */
+export async function readFrame(path: string): Promise<Uint8Array | undefined> {
+  const bytes = await readFile(path).catch(() => undefined)
+  if (bytes === undefined || bytes.length <= PNG_SIGNATURE.length) {
+    return undefined
+  }
+  return PNG_SIGNATURE.every((byte, index) => bytes[index] === byte)
+    ? new Uint8Array(bytes)
+    : undefined
+}
+
+/**
+ * Commits one frame onto the branch, creating the branch with a root
+ * commit when it is missing. The ref only fast-forwards here, so a drop or a
+ * second add landing between the read and the move fails the move, and the
+ * add rebuilds on the tip that writer left.
+ */
+export async function pushFrame(
+  api: FramesApi,
+  input: FrameInput,
+): Promise<PushResult> {
+  const path = framePath(input.number, input.head, input.pass, input.box)
+  const blob = await api.createBlob(Buffer.from(input.bytes).toString('base64'))
+  if (blob === undefined) return { kind: 'refused', reason: 'push-failed' }
+  const entry: TreeEntry = { path, mode: '100644', type: 'blob', sha: blob }
+  const message = `chore(frames): add box ${input.box} of #${input.number}`
+
+  for (let attempt = 0; attempt < ADD_ATTEMPTS; attempt += 1) {
+    const tip = await api.readTip()
+    if (tip.kind === 'unreadable') {
+      return { kind: 'refused', reason: 'unreadable-tip' }
+    }
+
+    const base = tip.kind === 'found' ? tip.tree : undefined
+    const tree = await api.createTree([entry], base)
+    if (tree === undefined) return { kind: 'refused', reason: 'push-failed' }
+    const parents = tip.kind === 'found' ? [tip.commit] : []
+    const commit = await api.createCommit(message, tree, parents)
+    if (commit === undefined) return { kind: 'refused', reason: 'push-failed' }
+
+    const write =
+      tip.kind === 'found'
+        ? await api.moveRef(commit, false)
+        : await api.createRef(commit)
+    if (write === 'failed') return { kind: 'refused', reason: 'push-failed' }
+    if (write === 'ok') {
+      return { kind: 'pushed', commit, path, created: tip.kind === 'missing' }
+    }
+  }
+  return { kind: 'refused', reason: 'ref-conflict' }
+}
+
+function folderNumber(entry: TreeEntry): number | undefined {
+  if (entry.type !== 'tree') return undefined
+  const match = FOLDER_PATTERN.exec(entry.path)
+  return match?.[1] === undefined ? undefined : Number(match[1])
+}
+
+async function readFolders(
+  api: FramesApi,
+): Promise<
+  | { readonly kind: 'read'; readonly entries: readonly TreeEntry[] }
+  | { readonly kind: 'missing' }
+  | { readonly kind: 'refused'; readonly reason: FramesRefusal }
+> {
+  const tip = await api.readTip()
+  if (tip.kind === 'missing') return { kind: 'missing' }
+  if (tip.kind === 'unreadable') {
+    return { kind: 'refused', reason: 'unreadable-tip' }
+  }
+  const entries = await api.listTree(tip.tree)
+  if (entries === undefined) {
+    return { kind: 'refused', reason: 'unreadable-tip' }
+  }
+  return { kind: 'read', entries }
+}
+
+/**
+ * Rewrites the branch without the named pull requests' folders, as one
+ * root commit the ref is force-moved to. A plain delete commit would
+ * keep every dropped image reachable through history. The rewrite builds from
+ * the tip it reads, and a branch left empty is deleted rather than holding an
+ * empty tree.
+ */
+async function rewriteWithout(
+  api: FramesApi,
+  entries: readonly TreeEntry[],
+  drop: ReadonlySet<number>,
+): Promise<DropResult> {
+  const removed = entries
+    .map(folderNumber)
+    .filter((n): n is number => n !== undefined && drop.has(n))
+    .sort((a, b) => a - b)
+  if (removed.length === 0) return { kind: 'dropped', removed: [] }
+
+  const kept = entries.filter((entry) => {
+    const n = folderNumber(entry)
+    return n === undefined || !drop.has(n)
+  })
+  if (kept.length === 0) {
+    return (await api.deleteRef())
+      ? { kind: 'dropped', removed, deleted: true }
+      : { kind: 'refused', reason: 'push-failed' }
+  }
+
+  const tree = await api.createTree(kept)
+  if (tree === undefined) return { kind: 'refused', reason: 'push-failed' }
+  const message = `chore(frames): drop ${removed.map((n) => `#${n}`).join(', ')}`
+  const commit = await api.createCommit(message, tree, [])
+  if (commit === undefined) return { kind: 'refused', reason: 'push-failed' }
+  const write = await api.moveRef(commit, true)
+  return write === 'ok'
+    ? { kind: 'dropped', removed, commit }
+    : { kind: 'refused', reason: 'push-failed' }
+}
+
+export async function dropFrames(
+  api: FramesApi,
+  numbers: readonly number[],
+): Promise<DropResult> {
+  const folders = await readFolders(api)
+  if (folders.kind === 'missing') return { kind: 'dropped', removed: [] }
+  if (folders.kind === 'refused') return folders
+  return rewriteWithout(api, folders.entries, new Set(numbers))
+}
+
+/**
+ * Whether a pull request's frames are past keeping. Only a pull request
+ * reading closed, with a close date strictly older than the window, expires,
+ * so a reopened one, an unread one, and one at the boundary all stay.
+ */
+export function isExpired(
+  closure: PullClosure | undefined,
+  days: number,
+  now: Date,
+): boolean {
+  if (closure?.state !== 'closed' || closure.closedAt === undefined) {
+    return false
+  }
+  const closed = Date.parse(closure.closedAt)
+  if (Number.isNaN(closed)) return false
+  return now.getTime() - closed > days * DAY_MS
+}
+
+/**
+ * Drops every pull request on the branch that closed more than `days` ago, in
+ * one rewrite. A pull request whose state could not be read is kept and
+ * listed under `unread`, so a failed read never deletes frames.
+ */
+export async function pruneFrames(
+  api: FramesApi,
+  days: number,
+  now: Date,
+): Promise<PruneResult> {
+  const folders = await readFolders(api)
+  if (folders.kind === 'missing') {
+    return { kind: 'dropped', removed: [], kept: [], unread: [] }
+  }
+  if (folders.kind === 'refused') return folders
+
+  const numbers = folders.entries
+    .map(folderNumber)
+    .filter((n): n is number => n !== undefined)
+  const closures = await Promise.all(numbers.map((n) => api.readPull(n)))
+  const expired = new Set<number>()
+  const kept: number[] = []
+  const unread: number[] = []
+  numbers.forEach((n, index) => {
+    const closure = closures[index]
+    if (closure === undefined) unread.push(n)
+    if (isExpired(closure, days, now)) expired.add(n)
+    else kept.push(n)
+  })
+
+  const result = await rewriteWithout(api, folders.entries, expired)
+  if (result.kind === 'refused') return result
+  return {
+    ...result,
+    kept: kept.sort((a, b) => a - b),
+    unread: unread.sort((a, b) => a - b),
+  }
+}

package/src/tooling/manifest.ts

@@ -111,9 +111,8 @@ export function isStackExcluded(stack: string): boolean {
 }
 
 /**
- * Lists installable stack names, filtering the `claude` stack the way
- * `is_tooling_stack_excluded` in `scripts/lib/tooling.sh` did. Claude is
- * managed by `canon claude`, not `canon tooling`.
+ * Lists installable stack names, filtering the stacks in `EXCLUDED_STACKS`.
+ * Claude is managed by `canon claude`, not `canon tooling`.
  */
 export function listStacks(root: string): string[] {
   const dir = toolingDir(root)

package/src/tooling/seeds.ts

@@ -0,0 +1,37 @@
+import { existsSync, readdirSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+
+const TOOLING = 'tooling'
+const SURFACE_ROOTS = ['.claude', 'canon']
+
+/**
+ * Every `tooling/<stack>/seeds` holding a `.claude/` or a `canon/`, sorted and
+ * relative to the root.
+ *
+ * Both seed stages discover through this rather than naming a stack, so a stack
+ * seeding either root later reaches both and the two cannot disagree about which
+ * roots exist. A stack seeding only tracked surfaces carries `canon/` alone,
+ * which a `.claude/` test would drop from both stages. An absent `tooling/` is
+ * an empty answer, and each caller decides what an empty answer means.
+ */
+export function seedRoots(root: string): string[] {
+  const tooling = join(root, TOOLING)
+  if (!existsSync(tooling)) return []
+
+  return readdirSync(tooling)
+    .filter((name) => !name.startsWith('.'))
+    .sort()
+    .map((name) => `${TOOLING}/${name}/seeds`)
+    .filter((seeds) => isDirectory(join(root, seeds)))
+    .filter((seeds) =>
+      SURFACE_ROOTS.some((surface) => isDirectory(join(root, seeds, surface))),
+    )
+}
+
+function isDirectory(path: string): boolean {
+  try {
+    return statSync(path).isDirectory()
+  } catch {
+    return false
+  }
+}

package/tooling/claude/manifest.toml

@@ -1,5 +1,5 @@
 # Consumed only by `canon claude init`. Claude is not a discoverable tooling stack
-# and is excluded from `canon tooling` discovery via scripts/lib/tooling.sh.
+# and is excluded from `canon tooling` discovery via `EXCLUDED_STACKS` in src/tooling/manifest.ts.
 
 [stack]
 name = "claude"
@@ -8,8 +8,8 @@ runtime = ""
 scaffold = ""
 
 # Checked against this repository's own `.gitignore` by
-# scripts/core/check-ignore-parity.sh, which carries no sanctioned divergence
-# now that both sides ship the same two entries.
+# the Ignore parity stage of `bun run check`, which carries no sanctioned
+# divergence now that both sides ship the same two entries.
 #
 # One root entry rather than a folder apiece, so a target that gains a record
 # folder later receives no manifest edit and no sync. `.claude/worktrees/` is

package/scripts/core/check-capability-seeding.sh

@@ -1,134 +0,0 @@
-#!/usr/bin/env bash
-set -e
-set -o pipefail
-shopt -s nullglob
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-
-TOOLING_ROOT="$PROJECT_ROOT/tooling"
-MARKER="canon-no-seed:"
-
-# `find` writes to stderr and returns non-zero for a missing root, inside a
-# process substitution whose status nothing reads. Without this the walk covers
-# nothing and the check reports every capability seeded having never read one.
-if [ ! -d "$TOOLING_ROOT" ]; then
-  echo "No tooling root at ${TOOLING_ROOT#"$PROJECT_ROOT/"}, capability seeding unverifiable." >&2
-  exit 1
-fi
-
-failures=""
-
-# A comment naming the marker anywhere in the source file is the recorded
-# reason a capability withholds itself from every destination it was compared
-# against. The reason's own prose is free-form, so only the marker is tested.
-has_reason() {
-  grep -q "$MARKER" "$1"
-}
-
-# Compares one source directory's files against the basenames already
-# expanded from a set of destination paths. Presence on either side clears a
-# name; a source file reaching neither the destination nor a marked reason is
-# a capability answered on one side of the seed or config boundary and not
-# the other.
-check_capability() {
-  local label="$1" src_dir="$2"
-  shift 2
-
-  [ -d "$src_dir" ] || return 0
-
-  local dest_names=" "
-  local dest
-  for dest in "$@"; do
-    [ -f "$dest" ] || continue
-    dest_names="$dest_names$(basename "$dest") "
-  done
-
-  local src_file name
-  for src_file in "$src_dir"/*; do
-    [ -f "$src_file" ] || continue
-    name=$(basename "$src_file")
-    case "$dest_names" in
-    *" $name "*) continue ;;
-    esac
-    has_reason "$src_file" && continue
-    failures="$failures  $label: ${src_file#"$PROJECT_ROOT/"} reaches no seed or config and carries no $MARKER reason"$'\n'
-  done
-}
-
-check_capability "Hooks" "$PROJECT_ROOT/.claude/hooks" \
-  "$PROJECT_ROOT"/tooling/claude/seeds/.claude/hooks/*
-
-check_capability "Workflows" "$PROJECT_ROOT/.github/workflows" \
-  "$PROJECT_ROOT"/tooling/*/configs/.github/workflows/* \
-  "$PROJECT_ROOT"/tooling/*/seeds/.github/workflows/*
-
-check_capability "Husky" "$PROJECT_ROOT/.husky" \
-  "$PROJECT_ROOT"/tooling/base/configs/.husky/*
-
-# The reverse direction: a destination file whose source here is gone reaches
-# neither check_capability above nor the wiring pass below, both of which read
-# forward from the source, and it ships a target a hook, workflow, or husky
-# script this repository has already deleted. A destination carrying the same
-# marker clears just as a source does, which is the escape hatch a target-only
-# capability needs, such as a stack-specific workflow with no root counterpart
-# by design.
-check_orphans() {
-  local label="$1" src_dir="$2" dest_dir="$3"
-
-  [ -d "$dest_dir" ] || return 0
-
-  local dest_file name
-  for dest_file in "$dest_dir"/*; do
-    [ -f "$dest_file" ] || continue
-    name=$(basename "$dest_file")
-    [ -f "$src_dir/$name" ] && continue
-    has_reason "$dest_file" && continue
-    failures="$failures  $label: ${dest_file#"$PROJECT_ROOT/"} is seeded or configured with no source at ${src_dir#"$PROJECT_ROOT/"}/$name"$'\n'
-  done
-}
-
-check_orphans "Hooks" "$PROJECT_ROOT/.claude/hooks" \
-  "$PROJECT_ROOT/tooling/claude/seeds/.claude/hooks"
-
-for dir in "$PROJECT_ROOT"/tooling/*/configs/.github/workflows \
-  "$PROJECT_ROOT"/tooling/*/seeds/.github/workflows; do
-  check_orphans "Workflows" "$PROJECT_ROOT/.github/workflows" "$dir"
-done
-
-check_orphans "Husky" "$PROJECT_ROOT/.husky" \
-  "$PROJECT_ROOT/tooling/base/configs/.husky"
-
-# A hook that reached the seed tree with no wiring in the seeded settings.json
-# is installed dead, which fails the same way an unseeded hook does.
-SEED_HOOKS_DIR="$PROJECT_ROOT/tooling/claude/seeds/.claude/hooks"
-SEED_SETTINGS="$PROJECT_ROOT/tooling/claude/seeds/.claude/settings.json"
-
-if [ -d "$SEED_HOOKS_DIR" ]; then
-  if [ ! -f "$SEED_SETTINGS" ]; then
-    failures="$failures  Seed settings: no settings.json at ${SEED_SETTINGS#"$PROJECT_ROOT/"} to confirm a seeded hook is wired"$'\n'
-  elif ! command -v jq >/dev/null 2>&1; then
-    failures="$failures  Seed settings: jq is not installed, seeded-hook wiring unverifiable"$'\n'
-  else
-    # Every wired command as its own path segment set, rather than a substring
-    # search over the raw file, so a hook name that is a substring of another
-    # hook's filename (`log.sh` inside `pr-create-log.sh`) cannot pass on a
-    # neighbor's wiring.
-    wired=" $(jq -r '.. | .command? // empty' "$SEED_SETTINGS" | tr '/\n' '  ') "
-    for hook_file in "$SEED_HOOKS_DIR"/*.sh; do
-      [ -f "$hook_file" ] || continue
-      name=$(basename "$hook_file")
-      case "$wired" in
-      *" $name "*) continue ;;
-      esac
-      failures="$failures  Seed settings: $name is seeded and wired into no command in ${SEED_SETTINGS#"$PROJECT_ROOT/"}"$'\n'
-    done
-  fi
-fi
-
-if [ -n "$failures" ]; then
-  echo "A capability reaches one side of the seed or config boundary and not the other:" >&2
-  printf '%s' "$failures" >&2
-  echo "Seed or configure the capability, or mark the source line with # $MARKER <reason>." >&2
-  exit 1
-fi

package/scripts/core/check-ignore-parity.sh

@@ -1,141 +0,0 @@
-#!/usr/bin/env bash
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-
-GITIGNORE="$PROJECT_ROOT/.gitignore"
-MANIFEST="$PROJECT_ROOT/tooling/claude/manifest.toml"
-SECTION="# Claude"
-
-# Parity is exact, with no exception list behind it, and the move to `.canon/`
-# is what removed the one there was. Its two members each named a path inside
-# `.claude/` that this repository ignored and the manifest withheld, so a target
-# kept tracking it. A single root entry can withhold nothing inside itself: git
-# does not descend into an excluded directory, so a re-inclusion like
-# `!.canon/diagrams/` matches nothing. Retiring both is what buys the one line.
-#
-# The diagrams divergence is the one that cost something. A target used to track
-# its diagrams and keep the context audit's default coverage of them, and it now
-# ignores them with the rest of its records, so that coverage is gone unless the
-# project names the folder itself. `canon/context/tooling/manifests.md` carries the
-# narrative.
-#
-# An exception mechanism is not kept against a future divergence, because an
-# empty one cannot be exercised and a check nobody can test is a check nobody
-# should trust. It comes back with its first real member or not at all.
-
-if [ ! -f "$GITIGNORE" ]; then
-  echo "No .gitignore at ${GITIGNORE#"$PROJECT_ROOT/"}, ignore parity unverifiable." >&2
-  exit 1
-fi
-
-if [ ! -f "$MANIFEST" ]; then
-  echo "No claude manifest at ${MANIFEST#"$PROJECT_ROOT/"}, ignore parity unverifiable." >&2
-  exit 1
-fi
-
-# A gitignore pattern and a manifest entry describe the same folder whether or
-# not either spells the trailing slash, so presence is compared with it dropped.
-# No live pair differs that way now that both lists carry the same two entries,
-# and the normalization stays because either side may be written without one.
-normalize() {
-  printf '%s\n' "${1%/}"
-}
-
-# Every pattern the file carries, comments and blank lines dropped. The whole
-# file rather than one header, since a claude-scoped entry filed under a header
-# of its own would otherwise read as missing from a list that carries it.
-gitignore_patterns() {
-  awk '{ sub(/[[:space:]]+$/, "") } $0 ~ /^[[:space:]]*#/ || $0 == "" { next } { print }' "$GITIGNORE"
-}
-
-# Every entry of the named array in the manifest's `[gitignore]` table. The
-# array is accumulated to its closing bracket before the quoted strings are read
-# out, so a formatter wrapping it across lines does not silently empty this.
-manifest_entries() {
-  awk -v key="\"$SECTION\"" '
-    /^\[/ { table = $0 }
-    table != "[gitignore]" { next }
-    index($0, key) == 1 { collecting = 1; buf = "" }
-    collecting { buf = buf $0 }
-    collecting && index($0, "]") > 0 {
-      collecting = 0
-      buf = substr(buf, index(buf, "["))
-      count = split(buf, parts, "\"")
-      for (i = 2; i <= count; i += 2) print parts[i]
-    }
-  ' "$MANIFEST"
-}
-
-contains() {
-  local needle=$1
-  shift
-  local candidate
-  for candidate in "$@"; do
-    [ "$candidate" = "$needle" ] || continue
-    return 0
-  done
-  return 1
-}
-
-ignored=()
-while IFS= read -r pattern; do
-  [ -n "$pattern" ] || continue
-  ignored+=("$(normalize "$pattern")")
-done < <(gitignore_patterns)
-
-shipped=()
-while IFS= read -r entry; do
-  [ -n "$entry" ] || continue
-  shipped+=("$(normalize "$entry")")
-done < <(manifest_entries)
-
-# An empty read on either side is a parse that failed rather than a repository
-# ignoring nothing, and reporting parity off it would say the two lists agree
-# having compared none of their entries.
-if [ ${#ignored[@]} -eq 0 ]; then
-  echo "No patterns read from .gitignore, ignore parity unverifiable." >&2
-  exit 1
-fi
-
-if [ ${#shipped[@]} -eq 0 ]; then
-  echo "No entries read from the \"$SECTION\" array in ${MANIFEST#"$PROJECT_ROOT/"}, ignore parity unverifiable." >&2
-  exit 1
-fi
-
-failures=""
-
-# Entries the manifest ships that this repository does not ignore. A target is
-# told to ignore a folder the toolkit itself tracks, which no decision sanctions,
-# so this direction carries no exception list.
-for entry in "${shipped[@]}"; do
-  contains "$entry" "${ignored[@]}" && continue
-  failures="$failures  $entry is shipped by the manifest and absent from .gitignore"$'\n'
-done
-
-# Claude-scoped patterns this repository ignores that the manifest does not
-# ship. Scoped to the two record roots because the manifest is the claude stack
-# and says nothing about `node_modules/` or `.env`.
-#
-# `.canon` is read as a bare root as well as a prefix, since it is one line
-# covering a whole tree where `.claude/` names a folder inside a root that also
-# holds tracked content. Leaving it out is what would let a new entry sit outside
-# the only stage comparing the two lists, which is the direction that goes
-# silently blind.
-for pattern in "${ignored[@]}"; do
-  case "$pattern" in
-  .claude/* | .canon | .canon/*) ;;
-  *) continue ;;
-  esac
-  contains "$pattern" "${shipped[@]}" && continue
-  failures="$failures  $pattern is ignored here and absent from the manifest"$'\n'
-done
-
-if [ -n "$failures" ]; then
-  echo "The ignore set a target receives disagrees with this repository's own:" >&2
-  printf '%s' "$failures" >&2
-  echo "Add the entry to the \"$SECTION\" array in ${MANIFEST#"$PROJECT_ROOT/"} and to .gitignore. The two lists are compared exactly, and nothing here records an exception." >&2
-  exit 1
-fi