@ikon85/agent-workflow-kit 0.24.0 → 0.25.0

package/.agents/skills/setup-workflow/workflow-advisories.md

@@ -1,10 +1,11 @@
 # Workflow Advisories setup contract
 
 Workflow Advisories is one opt-in capability backed by the consumer-owned
-`docs/agents/workflow-capabilities.json` profile. Enabling it activates
-non-blocking large-read, baseline, pre-refactor, and affected-surface Stop
-adapters. Every threshold, glob, branch rule, command, timeout, and output
-budget stays consumer-owned.
+`docs/agents/workflow-capabilities.json` profile. Enabling it activates seven
+non-blocking rows: large-read, baseline, pre-refactor, affected-surface Stop,
+convention freshness, migration-artifact reminder, and LoC forewarning. Every
+threshold, glob, branch rule, source map, command, timeout, and output budget
+stays consumer-owned.
 
 ## Choice matrix
 
@@ -52,7 +53,20 @@ key. Consumer values are never normalized on adoption.
       "timeoutSeconds": 15,
       "outputBudget": 1000
     },
-    "stopChecks": {"surfaces": [], "timeoutSeconds": 30, "outputBudget": 1000}
+    "stopChecks": {"surfaces": [], "timeoutSeconds": 30, "outputBudget": 1000},
+    "freshness": {"documents": [], "outputBudget": 1000},
+    "migration": {
+      "commandMatchers": [],
+      "artifact": "",
+      "refreshCommand": [],
+      "outputBudget": 500
+    },
+    "locForewarn": {
+      "branchRegex": "^(?:feat|fix)/(\\d+)-",
+      "issueCommand": ["gh", "issue", "view", "{issue}", "--json", "body", "-q", ".body"],
+      "timeoutSeconds": 5,
+      "outputBudget": 500
+    }
   }
 }
 ```
@@ -70,6 +84,14 @@ project commands from the tools already present, then asks before activating.
   `python3 "$CLAUDE_PROJECT_DIR/.claude/hooks/pre-refactor-sweep.py"`
 - Stop:
   `"$CLAUDE_PROJECT_DIR/.claude/hooks/typecheck-on-stop.sh"`
+- SessionStart convention freshness:
+  `python3 "$CLAUDE_PROJECT_DIR/.claude/hooks/convention-drift-hint.py"`
+- PostToolUse on Bash migration commands:
+  `python3 "$CLAUDE_PROJECT_DIR/.claude/hooks/migration-snapshot-reminder.py"`
+- SessionStart LoC forewarning:
+  `python3 "$CLAUDE_PROJECT_DIR/.claude/hooks/loc-offender-forewarn.py"`
 
 All adapters are non-blocking. A failed or timed-out configured command remains
-visibly failed in hook context; it is never reported as green.
+visibly failed in hook context; it is never reported as green. Issue lookup
+failures silence only the LoC forewarning: the existing pre-push gate remains
+the enforcing authority and stays fail-closed.

package/.claude/hooks/_hook_utils.py

@@ -31,6 +31,7 @@ from pathlib import Path
 LOG_DIR = Path(".claude/logs")
 _WORKTREE_CORE_MODULE = "_agent_workflow_kit_worktree_lifecycle"
 _ADVISORY_CORE_MODULE = "_agent_workflow_kit_workflow_advisories"
+_LOC_OFFENDER_GATE_MODULE = "_agent_workflow_kit_loc_offender_gate"
 
 
 def rotate_log_if_needed(log_path: Path, max_bytes: int = 100_000, generations: int = 3) -> None:
@@ -221,6 +222,24 @@ def load_workflow_advisories_core():
     return module
 
 
+def load_loc_offender_gate():
+    """Load the shipped LoC gate so advisories consume its contracts directly."""
+    existing = sys.modules.get(_LOC_OFFENDER_GATE_MODULE)
+    if existing is not None:
+        return existing
+    path = Path(__file__).resolve().parents[2] / "scripts" / "loc_offender_gate.py"
+    module_dir = str(path.parent)
+    if module_dir not in sys.path:
+        sys.path.insert(0, module_dir)
+    spec = importlib.util.spec_from_file_location(_LOC_OFFENDER_GATE_MODULE, path)
+    if spec is None or spec.loader is None:
+        raise ImportError(f"cannot load LoC offender gate from {path}")
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[_LOC_OFFENDER_GATE_MODULE] = module
+    spec.loader.exec_module(module)
+    return module
+
+
 def hook_event_output(event_name: str, context: str) -> dict:
     """Canonical non-blocking context payload for Claude hook events."""
     return {

package/.claude/hooks/_safety_guard.py

@@ -0,0 +1,24 @@
+"""Load the shipped Safety Guardrails core for thin hook adapters."""
+
+import importlib.util
+import sys
+from pathlib import Path
+
+_CORE_MODULE = "_agent_workflow_kit_safety_guardrails"
+
+
+def load_core():
+    existing = sys.modules.get(_CORE_MODULE)
+    if existing is not None:
+        return existing
+    path = Path(__file__).resolve().parents[2] / "scripts" / "safety-guardrails" / "core.py"
+    module_dir = str(path.parent)
+    if module_dir not in sys.path:
+        sys.path.insert(0, module_dir)
+    spec = importlib.util.spec_from_file_location(_CORE_MODULE, path)
+    if spec is None or spec.loader is None:
+        raise ImportError(f"cannot load Safety Guardrails core from {path}")
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[_CORE_MODULE] = module
+    spec.loader.exec_module(module)
+    return module

package/.claude/hooks/block-bg-double-background.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+"""Thin PreToolUse adapter for profile-driven double-background prevention."""
+
+import json
+import sys
+from pathlib import Path
+
+from _hook_utils import log
+from _safety_guard import load_core
+
+HOOK_NAME = "block-bg-double-background"
+
+
+def main() -> int:
+    try:
+        payload = json.load(sys.stdin)
+        core = load_core()
+        profile = core.load_profile(Path("docs/agents/workflow-capabilities.json"))
+        decision = core.evaluate("double-background", profile, payload)
+    except Exception:
+        return 0
+    if decision.action == "block":
+        print(decision.message, file=sys.stderr)
+        log(HOOK_NAME, decision.log_message)
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/.claude/hooks/block-npm-install-in-pnpm.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+"""Thin PreToolUse adapter for profile-driven package-manager consistency."""
+
+import json
+import sys
+from pathlib import Path
+
+from _hook_utils import log
+from _safety_guard import load_core
+
+HOOK_NAME = "block-package-manager"
+
+
+def main() -> int:
+    try:
+        payload = json.load(sys.stdin)
+        core = load_core()
+        profile = core.load_profile(Path("docs/agents/workflow-capabilities.json"))
+        decision = core.evaluate("package-manager", profile, payload)
+    except Exception:
+        return 0
+    if decision.action == "block":
+        print(decision.message, file=sys.stderr)
+        log(HOOK_NAME, decision.log_message)
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/.claude/hooks/block-secrets.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+"""Thin PreToolUse adapter for the profile-driven secret guard."""
+
+import json
+import sys
+from pathlib import Path
+
+from _hook_utils import log
+from _safety_guard import load_core
+
+HOOK_NAME = "block-secrets"
+
+
+def main() -> int:
+    try:
+        payload = json.load(sys.stdin)
+        core = load_core()
+        profile = core.load_profile(Path("docs/agents/workflow-capabilities.json"))
+        decision = core.evaluate("secrets", profile, payload)
+    except Exception:
+        return 0
+    if decision.action == "block":
+        print(decision.message, file=sys.stderr)
+        log(HOOK_NAME, decision.log_message)
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/.claude/hooks/convention-drift-hint.py

@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+"""SessionStart convention freshness advisory over profile-owned source maps."""
+import json
+import sys
+from pathlib import Path
+
+from _hook_utils import hook_event_output, load_workflow_advisories_core
+
+
+def main() -> int:
+    try:
+        json.load(sys.stdin)
+    except Exception:
+        pass
+    try:
+        core = load_workflow_advisories_core()
+        profile = core.load_profile(Path("docs/agents/workflow-capabilities.json"))
+        decision = core.convention_freshness_decision(profile, Path.cwd())
+        if decision.context:
+            print(json.dumps(hook_event_output(decision.event_name, decision.context)))
+    except Exception:
+        pass
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/.claude/hooks/grep-shim-guard.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+"""Thin PreToolUse adapter for configured search-shim breakers."""
+
+import json
+import sys
+from pathlib import Path
+
+from _hook_utils import log
+from _safety_guard import load_core
+
+HOOK_NAME = "grep-shim-guard"
+
+
+def main() -> int:
+    try:
+        payload = json.load(sys.stdin)
+        core = load_core()
+        profile = core.load_profile(Path("docs/agents/workflow-capabilities.json"))
+        decision = core.evaluate("search-shim", profile, payload)
+    except Exception:
+        return 0
+    if decision.action == "block":
+        print(decision.message, file=sys.stderr)
+        log(HOOK_NAME, decision.log_message)
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/.claude/hooks/loc-offender-forewarn.py

@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+"""SessionStart forewarning over the existing LoC gate and issue marker contracts."""
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+from _hook_utils import (
+    current_branch,
+    hook_event_output,
+    load_loc_offender_gate,
+    load_workflow_advisories_core,
+)
+
+
+def main() -> int:
+    try:
+        json.load(sys.stdin)
+    except Exception:
+        pass
+    try:
+        root = Path.cwd()
+        core = load_workflow_advisories_core()
+        profile = core.load_profile(root / "docs/agents/workflow-capabilities.json")
+        config = profile.get("locForewarn", {})
+        match = re.search(config.get("branchRegex", r"$^"), current_branch())
+        command = config.get("issueCommand", [])
+        if not match or not command:
+            return 0
+        issue = match.group(1)
+        argv = [str(part).replace("{issue}", issue) for part in command]
+        result = subprocess.run(
+            argv,
+            cwd=root,
+            capture_output=True,
+            text=True,
+            timeout=float(config.get("timeoutSeconds", 5)),
+        )
+        if result.returncode != 0:
+            return 0
+        gate = load_loc_offender_gate()
+        max_lines, offenders = gate.load_max_lines(root / "max-lines-allowlist.json")
+        context = gate.forewarning_context(result.stdout, max_lines, offenders)
+        if context:
+            budget = int(config.get("outputBudget", 500))
+            if budget > 0 and len(context) > budget:
+                context = context[: max(0, budget - 1)] + "…"
+            print(json.dumps(hook_event_output("SessionStart", context)))
+    except Exception:
+        pass
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/.claude/hooks/migration-snapshot-reminder.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+"""PostToolUse migration artifact refresh reminder over consumer profile data."""
+import json
+import sys
+from pathlib import Path
+
+from _hook_utils import hook_event_output, load_workflow_advisories_core
+
+
+def main() -> int:
+    try:
+        payload = json.load(sys.stdin)
+        core = load_workflow_advisories_core()
+        profile = core.load_profile(Path("docs/agents/workflow-capabilities.json"))
+        decision = core.migration_reminder_decision(profile, payload)
+        if decision.context:
+            print(json.dumps(hook_event_output(decision.event_name, decision.context)))
+    except Exception:
+        pass
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/.claude/hooks/skill-drift-hint.py

@@ -21,52 +21,21 @@ import json
 import sys
 from pathlib import Path
 
-from _hook_utils import log, run, repo_root
+from _hook_utils import (
+    hook_event_output,
+    load_workflow_advisories_core,
+    log,
+    repo_root,
+)
 
 HOOK_NAME = "skill-drift-hint"
 SKILLS_REL = ".claude/skills"
 
 
-def git_commit_time(root: str, rel_path: str) -> int | None:
-    """Unix ctime of the last commit touching rel_path; None if untracked/unknown."""
-    out = run(["git", "-C", root, "log", "-1", "--format=%ct", "--", rel_path])
-    return int(out) if out.isdigit() else None
-
-
-def read_sources(sources_file: Path) -> list[str]:
-    """Repo-relative source paths from a SOURCES.txt — skips blanks and `#` comments."""
-    try:
-        lines = sources_file.read_text(encoding="utf-8").splitlines()
-    except Exception:
-        return []
-    out: list[str] = []
-    for line in lines:
-        s = line.strip()
-        if not s or s.startswith("#"):
-            continue
-        out.append(s)
-    return out
-
-
 def collect_stale(root: str) -> list[tuple[str, list[str]]]:
     """For each skill with a SOURCES.txt, list sources newer (in git) than its SKILL.md."""
-    skills_dir = Path(root) / SKILLS_REL
-    results: list[tuple[str, list[str]]] = []
-    if not skills_dir.is_dir():
-        return results
-    for sources_file in sorted(skills_dir.glob("*/SOURCES.txt")):
-        skill_name = sources_file.parent.name
-        skill_ct = git_commit_time(root, f"{SKILLS_REL}/{skill_name}/SKILL.md")
-        if skill_ct is None:
-            continue  # skill not committed yet → nothing to compare against
-        stale = [
-            src
-            for src in read_sources(sources_file)
-            if (src_ct := git_commit_time(root, src)) is not None and src_ct > skill_ct
-        ]
-        if stale:
-            results.append((skill_name, stale))
-    return results
+    core = load_workflow_advisories_core()
+    return core.collect_skill_stale(Path(root), SKILLS_REL)
 
 
 def build_context(root: str) -> str | None:
@@ -107,12 +76,7 @@ def main() -> int:
     if context is None:
         return 0
 
-    payload = {
-        "hookSpecificOutput": {
-            "hookEventName": "SessionStart",
-            "additionalContext": context,
-        }
-    }
+    payload = hook_event_output("SessionStart", context)
     print(json.dumps(payload))
     log(HOOK_NAME, f"emitted: {context.count(chr(0x26A0))} skill(s) flagged")
     return 0

package/.claude/skills/setup-workflow/workflow-advisories.md

@@ -1,10 +1,11 @@
 # Workflow Advisories setup contract
 
 Workflow Advisories is one opt-in capability backed by the consumer-owned
-`docs/agents/workflow-capabilities.json` profile. Enabling it activates
-non-blocking large-read, baseline, pre-refactor, and affected-surface Stop
-adapters. Every threshold, glob, branch rule, command, timeout, and output
-budget stays consumer-owned.
+`docs/agents/workflow-capabilities.json` profile. Enabling it activates seven
+non-blocking rows: large-read, baseline, pre-refactor, affected-surface Stop,
+convention freshness, migration-artifact reminder, and LoC forewarning. Every
+threshold, glob, branch rule, source map, command, timeout, and output budget
+stays consumer-owned.
 
 ## Choice matrix
 
@@ -52,7 +53,20 @@ key. Consumer values are never normalized on adoption.
       "timeoutSeconds": 15,
       "outputBudget": 1000
     },
-    "stopChecks": {"surfaces": [], "timeoutSeconds": 30, "outputBudget": 1000}
+    "stopChecks": {"surfaces": [], "timeoutSeconds": 30, "outputBudget": 1000},
+    "freshness": {"documents": [], "outputBudget": 1000},
+    "migration": {
+      "commandMatchers": [],
+      "artifact": "",
+      "refreshCommand": [],
+      "outputBudget": 500
+    },
+    "locForewarn": {
+      "branchRegex": "^(?:feat|fix)/(\\d+)-",
+      "issueCommand": ["gh", "issue", "view", "{issue}", "--json", "body", "-q", ".body"],
+      "timeoutSeconds": 5,
+      "outputBudget": 500
+    }
   }
 }
 ```
@@ -70,6 +84,14 @@ project commands from the tools already present, then asks before activating.
   `python3 "$CLAUDE_PROJECT_DIR/.claude/hooks/pre-refactor-sweep.py"`
 - Stop:
   `"$CLAUDE_PROJECT_DIR/.claude/hooks/typecheck-on-stop.sh"`
+- SessionStart convention freshness:
+  `python3 "$CLAUDE_PROJECT_DIR/.claude/hooks/convention-drift-hint.py"`
+- PostToolUse on Bash migration commands:
+  `python3 "$CLAUDE_PROJECT_DIR/.claude/hooks/migration-snapshot-reminder.py"`
+- SessionStart LoC forewarning:
+  `python3 "$CLAUDE_PROJECT_DIR/.claude/hooks/loc-offender-forewarn.py"`
 
 All adapters are non-blocking. A failed or timed-out configured command remains
-visibly failed in hook context; it is never reported as green.
+visibly failed in hook context; it is never reported as green. Issue lookup
+failures silence only the LoC forewarning: the existing pre-push gate remains
+the enforcing authority and stays fail-closed.

package/README.md

@@ -332,6 +332,19 @@ still reference. Flags: `--force` (overwrite pre-existing files on `init`),
 
 ## Release notes
 
+### 0.25.0
+
+- added: `.claude/hooks/convention-drift-hint.py`
+- added: `.claude/hooks/loc-offender-forewarn.py`
+- added: `.claude/hooks/migration-snapshot-reminder.py`
+- added: `scripts/workflow-advisories/capabilities.json`
+- changed: `.agents/skills/setup-workflow/workflow-advisories.md`
+- changed: `.claude/hooks/_hook_utils.py`
+- changed: `.claude/hooks/skill-drift-hint.py`
+- changed: `.claude/skills/setup-workflow/workflow-advisories.md`
+- changed: `scripts/loc_offender_gate.py`
+- changed: `scripts/workflow-advisories/core.py`
+
 ### 0.24.0
 
 - added: `.agents/skills/setup-workflow/workflow-advisories.md`

package/agent-workflow-kit.package.json

@@ -1,5 +1,5 @@
 {
-  "kitVersion": "0.24.0",
+  "kitVersion": "0.25.0",
   "files": [
     {
       "path": ".agents/skills/ask-matt/SKILL.md",
@@ -618,7 +618,7 @@
       "kind": "skill",
       "ownerSkill": "setup-workflow",
       "surface": "codex",
-      "sha256": "320f893a6e148f0bfabe1f1be81112728ae4fed84f7505dc630e5b0d931ec32c",
+      "sha256": "81ce0f5573d5f062adbc87149172e74ab322315bf348025c0ff2c27f8d8ec67b",
       "mode": 420,
       "origin": "kit"
     },
@@ -886,7 +886,7 @@
     {
       "path": ".claude/hooks/_hook_utils.py",
       "kind": "hook",
-      "sha256": "26c645eaa7cb87e899ab3900e9f6711658848cab8a18a29656ae3ca30736d172",
+      "sha256": "9ad70fa80a57c7712df78718c578b58295f446c13a0f1863c69680f3889dd387",
       "mode": 420,
       "origin": "kit"
     },
@@ -911,6 +911,13 @@
       "mode": 493,
       "origin": "kit"
     },
+    {
+      "path": ".claude/hooks/convention-drift-hint.py",
+      "kind": "hook",
+      "sha256": "f89fc3f3f9d9b7508e3cdeeedd0e522af11ae10e638457da3910bfe4e43579f2",
+      "mode": 493,
+      "origin": "kit"
+    },
     {
       "path": ".claude/hooks/drift-guard.py",
       "kind": "hook",
@@ -939,6 +946,20 @@
       "mode": 493,
       "origin": "kit"
     },
+    {
+      "path": ".claude/hooks/loc-offender-forewarn.py",
+      "kind": "hook",
+      "sha256": "28ba5edb1898345fd852d1f420bb64c5a2e0dfd66aa8d2b752899fc28a6f80dd",
+      "mode": 493,
+      "origin": "kit"
+    },
+    {
+      "path": ".claude/hooks/migration-snapshot-reminder.py",
+      "kind": "hook",
+      "sha256": "693227fae1aa3e782ed5b61a9e8c3fc8c1880a617efd14cb86ca7f38d9a8f204",
+      "mode": 493,
+      "origin": "kit"
+    },
     {
       "path": ".claude/hooks/pre-refactor-sweep.py",
       "kind": "hook",
@@ -956,7 +977,7 @@
     {
       "path": ".claude/hooks/skill-drift-hint.py",
       "kind": "hook",
-      "sha256": "4842e1c6dfd1042eb924d9cc36a8aa5d0c5a1e95f71e33a82db3322dc9d13fd0",
+      "sha256": "2ce5c8cfc85dc76cf93abf1cd061440b8030109231a45a0920e36a5f1c06694a",
       "mode": 493,
       "origin": "kit"
     },
@@ -1731,7 +1752,7 @@
       "kind": "skill",
       "ownerSkill": "setup-workflow",
       "surface": "claude",
-      "sha256": "320f893a6e148f0bfabe1f1be81112728ae4fed84f7505dc630e5b0d931ec32c",
+      "sha256": "81ce0f5573d5f062adbc87149172e74ab322315bf348025c0ff2c27f8d8ec67b",
       "mode": 420,
       "origin": "kit"
     },
@@ -2159,7 +2180,7 @@
     {
       "path": "scripts/loc_offender_gate.py",
       "kind": "script",
-      "sha256": "3e96b180bbe922c85ea511da94f118b6d8d8937bc000c8a31b1a88bac211545e",
+      "sha256": "a66650b3b194a00ecc3ba37acae4bbb1aeeb57762d27fb2dfd3bb1fc2734a8a5",
       "mode": 493,
       "origin": "kit"
     },
@@ -2247,10 +2268,17 @@
       "mode": 420,
       "origin": "kit"
     },
+    {
+      "path": "scripts/workflow-advisories/capabilities.json",
+      "kind": "doc",
+      "sha256": "04c731394fa458c141870fb89f2432092b3749955eccbda9b9b8db09636526c9",
+      "mode": 420,
+      "origin": "kit"
+    },
     {
       "path": "scripts/workflow-advisories/core.py",
       "kind": "script",
-      "sha256": "7923d328f2a4e8b0ac8823cba5779003a52c6fabeb012157af49c3c5e13ccfc9",
+      "sha256": "dc47bc20ed1107d230f45ff7158e4fd81d6473be515e03cbd52274f3e87d840d",
       "mode": 420,
       "origin": "kit"
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikon85/agent-workflow-kit",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Portable AI-agent workflow skills (plan → execute → land → learn) for Claude Code & Codex — grilling, TDD, diagnosis, two-axis code review, cross-model Codex review, design & domain-modeling, plus a skill router (ask-matt). npx init/update/diff/uninstall.",
   "type": "module",
   "bin": {

package/scripts/loc_offender_gate.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import re
 import subprocess
 import sys
 from pathlib import Path
@@ -25,6 +26,29 @@ class GateError(RuntimeError):
     """A condition the gate cannot evaluate → fail-closed (exit 1)."""
 
 
+_ISSUE_MARKER_RE = re.compile(r"<!--\s*loc-offender:\s*([^>]+?)\s*-->")
+
+
+def parse_issue_marker(body: str) -> list[str]:
+    """Read the machine marker planted by board-sync at buildability transition."""
+    match = _ISSUE_MARKER_RE.search(body or "")
+    return [
+        path.strip() for path in match.group(1).split(",") if path.strip()
+    ] if match else []
+
+
+def forewarning_context(body: str, max_lines: int, offenders: set[str]) -> str | None:
+    """Render a non-blocking SessionStart warning from the gate-owned contracts."""
+    hits = sorted(set(parse_issue_marker(body)) & offenders)
+    if not hits:
+        return None
+    paths = ", ".join(hits)
+    return (
+        f"LoC offender advisory: {paths} is named by the issue marker and remains "
+        f"above the gate threshold ({max_lines} lines). The pre-push gate stays authoritative."
+    )
+
+
 def _git(args, cwd=None) -> str:
     r = subprocess.run(["git", *args], cwd=cwd, capture_output=True, text=True)
     if r.returncode != 0: