@jenga-ai/agent 3.5.0 → 4.0.0

package/skills/j-examplify/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: j.examplify
-description: Polyfill alias of the examplify skill under a collision-safe directory name. Identical behavior to /examplify — Explains concepts, features, use cases, and patterns based on provided context — a description, scenario, code snippet, or file. Use when the user wants to understand what something is, how it works, when to use it, or wants a concrete example. Use when the bare /examplify form is shadowed by another tool's own built-in command of the same name.
+description: Explains concepts, features, use cases, and patterns based on provided context — a description, scenario, code snippet, or file. Use when the user wants to understand what something is, how it works, when to use it, or wants a concrete example.
 keywords:
   - examplify
   - explain
@@ -8,7 +8,6 @@ keywords:
   - how does
   - understand
   - j-examplify
-  - polyfill
 examples:
   - "explain how this works"
   - "give me an example of X"
@@ -17,9 +16,9 @@ examples:
 
 # Concept Explainer
 
-This skill is a literal-directory-name duplicate of `skills/examplify/`. It exists so that `/j-examplify` (and `j.j-examplify`) give a guaranteed-unshadowed way to reach the same flow as `/examplify`, even if a host tool's own built-in command of the same name would otherwise shadow or override the bare `/examplify` alias (Claude Code's native skill resolution is a literal-string, directory-name-based match — see `docs/skill-authoring.md`'s "Invocation Convention").
+`skills/j-examplify/` is the **canonical, hand-edited** directory for this skill, per CLAUDE.md's "The Canonical Naming Contract" (the `E50` reopening of 2026-09-09, which promoted `skills/j-examplify/` from generated twin to sole canonical form). The `j-` prefix is there for collision safety — a real directory under a distinct name, so a host tool shipping its own same-named built-in command cannot shadow it (Claude Code's native skill resolution is a literal-string, directory-name-based match; see `docs/skill-authoring.md`'s "Invocation Convention").
 
-This file is generated/synced by `scripts/generate-j-alias.sh examplify` from `skills/examplify/SKILL.md` — do not hand-edit it; re-run the generator instead to pick up source changes.
+> ⚠️ **`scripts/generate-j-alias.sh` was retired by `E50_S14` and no longer exists — there is nothing to run.** This file was previously generated from a bare `skills/examplify/SKILL.md` source; `E50_S15` deleted that directory. This file is now the sole canonical, hand-edited source for this skill — edit it directly.
 
 ## Instructions
 

package/skills/j-gitignore/SKILL.md

@@ -0,0 +1,157 @@
+---
+name: j.gitignore
+description: Retroactively repair an already-scaffolded project's Jenga gitignore state — strips the stray heredoc `EOF` line left by pre-fix /init scaffolds, adds or removes the Jenga-owned path entries via a managed block, and untracks those paths from git (and from origin) while leaving every file on disk.
+keywords:
+  - gitignore
+  - fix gitignore
+  - untrack jenga files
+  - remove from origin
+  - stray EOF
+  - jenga files committed
+  - stop tracking scaffold
+examples:
+  - "jenga files keep getting committed"
+  - "remove .claude and .agents from the repo but keep them locally"
+  - "my .gitignore has a stray EOF line"
+  - "untrack the jenga scaffold from origin"
+  - "j.gitignore"
+---
+
+# j.gitignore
+
+Repairs the Jenga-related git state of a project that was **already scaffolded**. `/init` does this
+correctly for new projects; this skill is the retroactive path for projects created before the fix,
+or projects whose ignore rules have drifted.
+
+## When to use this
+
+- `.gitignore` contains a stray `EOF` line (the signature of the botched `cat > .gitignore <<EOF` in
+  pre-fix `/init` scaffolds).
+- `.claude/`, `.agents/`, `jenga.config.json`, `.jenga-version` etc. are being committed even though
+  you expected Jenga to ignore them.
+- You want the Jenga scaffold gone from the remote, but still working locally.
+- You want to **reverse** any of the above and commit the scaffold deliberately.
+
+## Why /init cannot do this
+
+`skills/j-init/SKILL.md` hard-stops on `already-scaffolded`, and for good reason: `init.sh` does an
+unconditional `cp "$ASSETS_DIR/.gitignore_template" .gitignore`, which would clobber the project's
+existing `.gitignore`, and later steps overwrite `PROJECT_SUMMARY.md`, `workflow.json` and
+`test-config.json` with fresh stubs. The upstream fixes (`E31_S07_T02`/`T03`, `E42_S06_T01`) repaired
+the **template**, which is forward-only. Nothing repairs a project already on disk. That is this
+skill's entire reason to exist.
+
+`apply-project-visibility.sh` and `apply-scaffold-visibility.sh` remain the **init-time** path and are
+not replaced. They only ever append `project/`, `.claude/` and `.agents/` as loose lines — they do not
+remove a stray `EOF`, do not cover the file-level paths, and cannot untrack anything.
+
+## Scripts
+
+All three ship without the executable bit — invoke via `bash`. All are bash 3.2 compatible (macOS).
+
+| Script | Role |
+|---|---|
+| `scripts/audit-gitignore.sh` | Read-only. Reports stray terminators, per-path entry/ignored/tracked state, and what is present on origin. Exit `10` means findings, `0` means clean. |
+| `scripts/repair-gitignore.sh` | Strips stray `EOF` lines, then adds (`ignored`) or removes (`visible`) the entries inside a managed block. Atomic write, verified after. |
+| `scripts/untrack-jenga-files.sh` | `git rm -r --cached` — stops tracking, never deletes from disk. Optional `--commit`, opt-in `--push`. |
+| `assets/jenga-paths.txt` | The single catalog of Jenga-owned paths, tiered. All three scripts read it. |
+
+## Path tiers
+
+`--tiers` selects what to act on. Default is `scaffold` — the safe set.
+
+| Tier | Contents | Default |
+|---|---|---|
+| `scaffold` | `.claude/`, `.agents/`, `.jenga/`, `.jenga-version`, `jenga.config.json`, `.github/hooks/jenga.json`, `J-CLAUDE.md`, `J-AGENTS.md` — entirely Jenga-owned, regenerated by postinstall/`/distribute`. | ✅ on |
+| `hybrid` | `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md` — Jenga writes a *managed block* and preserves your content around it. Ignoring these hides **your** prose too. | opt-in |
+| `board` | `project/` — governed by `project_files_visibility`. Teams sharing a board want it tracked. | opt-in |
+| `optional` | `.copilot/` — not generated by any current Jenga version. Defensive only. | opt-in |
+
+## Procedure
+
+### 1. Audit
+
+```bash
+bash <skill>/scripts/audit-gitignore.sh . --tiers scaffold
+```
+
+Present the three summary counts to the user. If `AUDIT_RESULT=clean`, say so and stop — there is
+nothing to repair.
+
+### 2. Confirm scope
+
+The audit's per-path table shows what is tracked. Before changing anything, ask:
+
+    Which Jenga paths should this project ignore?
+    1. Scaffold only — .claude/, .agents/, jenga.config.json, .jenga-version, hook + J- files (recommended)
+    2. Scaffold + the board (project/) — adds your scrum board, todo.md, queue, rapports, logs
+    3. Scaffold + CLAUDE.md / AGENTS.md / copilot-instructions.md — note these may contain your own prose
+    4. Everything, including the defensive .copilot/ entry
+    5. Other (describe below)
+
+Two warnings to surface if they are in scope:
+
+- **`jenga.config.json`** holds `project_files_visibility` and `scaffold_visibility`. Ignoring it
+  means a fresh clone loses those settings and the next `/init`-style run re-prompts for them.
+- **`hybrid` tier** files contain user-authored content outside Jenga's managed block. Ignoring them
+  removes that content from the repo too.
+
+### 3. Repair the .gitignore
+
+Always dry-run first and show the diff:
+
+```bash
+bash <skill>/scripts/repair-gitignore.sh ignored . --tiers <tiers> --dry-run
+```
+
+Then apply without `--dry-run`. This step is purely local and reversible (`visible` mode removes the
+block again), so it does not need separate confirmation beyond the scope choice in step 2.
+
+If the user genuinely wants to ignore a file literally named `EOF`, pass `--keep-eof`.
+
+### 4. Untrack
+
+`.gitignore` has no effect on files git already tracks, so step 3 alone changes nothing for anything
+already committed. Dry-run first:
+
+```bash
+bash <skill>/scripts/untrack-jenga-files.sh . --tiers <tiers> --dry-run
+```
+
+Then choose how far to go:
+
+    The .gitignore is fixed. How far should I take the untracking?
+    1. Stage the removals only — I review `git status` and commit myself
+    2. Stage and commit locally — nothing reaches the remote until I push
+    3. Stage, commit, and push — removes them from origin's branch tip
+    4. Stop here — just the .gitignore change
+    5. Other (describe below)
+
+Map to `--commit` / `--commit --push` accordingly. **Never pass `--push` without the user explicitly
+choosing option 3** — it is the only outward-facing step and cannot be undone by re-running the skill.
+
+### 5. Report
+
+Re-run the audit to confirm `AUDIT_RESULT=clean`, then state plainly what changed, and always
+include the history caveat below.
+
+## What this does NOT do
+
+- **It does not rewrite history.** `--push` removes the paths from the branch *tip*. Every earlier
+  commit still contains them, and the blobs stay reachable. A fresh clone is clean; `git log` is not.
+- **It is not a secret scrubber.** If a `.env` or credential was committed, treat it as compromised,
+  rotate it, and use `git-filter-repo` separately. Say this out loud if the audit shows anything
+  credential-shaped.
+- **It never deletes from disk.** Every removal is `git rm --cached`, and the script re-verifies each
+  path is still present before reporting success.
+
+## Edge cases
+
+| Situation | Behavior |
+|---|---|
+| No `.gitignore` at the root | `ignored` creates one; `visible` exits 0 as a no-op. |
+| No git repo | All three exit 1 with a clear message — this skill needs git. |
+| No upstream branch | Audit says nothing was ever pushed. `--push` refuses rather than guessing a remote; the commit is already safe locally. |
+| Unrelated staged changes | `untrack-jenga-files.sh` refuses (exit 4) so it cannot sweep your work into its commit. A staged `.gitignore` alone is allowed through and folded in, since it is the companion change. |
+| Unterminated managed block | `repair-gitignore.sh` refuses to write (exit 3) rather than risk eating the rest of the file. |
+| Path tracked but absent from disk | Reported as a warning; nothing was lost, git simply tracked something the working tree did not have. |

package/skills/j-gitignore/assets/jenga-paths.txt

@@ -0,0 +1,50 @@
+# skills/j-gitignore/assets/jenga-paths.txt
+#
+# The canonical catalog of Jenga-owned paths a consuming project may end up
+# with on disk. Consumed by audit-gitignore.sh, repair-gitignore.sh and
+# untrack-jenga-files.sh — all three read this one file, so the path surface
+# is defined in exactly one place.
+#
+# Format: <tier>TAB<path>TAB<description>
+# Blank lines and lines starting with '#' are ignored.
+#
+# Trailing '/' marks a directory entry and is preserved verbatim into
+# .gitignore (git treats 'foo/' as directory-only, which is what we want).
+#
+# ─── Tiers ───────────────────────────────────────────────────────────────────
+#
+#   scaffold  Entirely Jenga-owned. Regenerated wholesale by `npm postinstall`
+#             or `/distribute`, so nothing of yours is ever lost by ignoring
+#             them. Safe default.
+#
+#   hybrid    A Jenga-managed block inside a file that ALSO holds your own
+#             content. lib/generate-agent-context.js and
+#             lib/generate-copilot-instructions.js both replace only their
+#             managed block and preserve everything outside it. Ignoring these
+#             therefore also hides YOUR prose from the repo. Opt-in, never
+#             applied without the user saying so.
+#
+#   board     The project/ working tree (scrum board, todo.md, queue/,
+#             rapports/, logs/). Governed by jenga.config.json's
+#             `project_files_visibility`. Teams that share a board want this
+#             tracked; solo users usually do not. Opt-in.
+#
+#   optional  Defensive entries for paths no current Jenga version generates.
+#             Costs nothing to ignore, guards against a future or third-party
+#             agent surface appearing. Opt-in.
+#
+# ─────────────────────────────────────────────────────────────────────────────
+
+scaffold	.claude/	Claude Code skill/agent mirror — rewritten by every postinstall and /distribute run (scripts/postinstall.js targetRoots). Contains .jenga-postinstall-manifest.json.
+scaffold	.agents/	Copilot/Codex skill/agent mirror — the second of postinstall.js's two targetRoots. Contains .jenga-postinstall-manifest.json.
+scaffold	.jenga/	`jenga` CLI state directory. lib/commands/init.js already appends this entry itself; listed here so the audit reports it consistently.
+scaffold	.jenga-version	Installed-version stamp written at consumer root by scripts/postinstall.js.
+scaffold	jenga.config.json	Jenga project config (project_files_visibility, scaffold_visibility). SEE THE WARNING IN SKILL.md — ignoring this means a fresh clone loses your visibility settings.
+scaffold	.github/hooks/jenga.json	Copilot CLI hook wiring. "Entirely Jenga-owned output" per scripts/postinstall.js — no user content, unlike copilot-instructions.md.
+scaffold	J-CLAUDE.md	Collision-case copy written only when you already had your own CLAUDE.md. A J- file can only ever have been created by Jenga.
+scaffold	J-AGENTS.md	Collision-case copy written only when you already had your own AGENTS.md. Jenga-created by definition.
+hybrid	CLAUDE.md	Jenga writes a managed block here and preserves content outside it. May contain your own instructions.
+hybrid	AGENTS.md	Same managed-block treatment as CLAUDE.md, for Codex and generic AGENTS.md consumers.
+hybrid	.github/copilot-instructions.md	Managed-block bootstrap. postinstall.js explicitly notes this one is NOT entirely Jenga-owned.
+board	project/	The whole Jenga working tree. Mirrors what apply-project-visibility.sh's JENGA_WORKING_PATHS appends at init time.
+optional	.copilot/	Not generated by any current Jenga version (grepped across lib/, scripts/, skills/). Defensive only.

package/skills/j-gitignore/scripts/_catalog.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# -----------------------------------------------------------------------------
+# skills/j-gitignore/scripts/_catalog.sh
+#
+# Shared helpers for the j-gitignore scripts. Sourced, never run directly:
+#
+#   source "$(dirname "${BASH_SOURCE[0]}")/_catalog.sh"
+#
+# Provides:
+#   CATALOG_FILE            absolute path to assets/jenga-paths.txt
+#   MANAGED_BEGIN/_END      the managed-block markers
+#   load_catalog <tiers>    populates CATALOG_PATHS/_TIERS/_DESCS arrays
+#   validate_tiers <csv>    rejects an unknown tier name
+#   resolve_root <dir>      cd's to a project root, verifying it is a git repo
+#
+# The leading underscore marks this as internal to the skill — it is not an
+# entry point and takes no arguments of its own.
+# -----------------------------------------------------------------------------
+
+# Deliberately no `set -e` — callers handle their own errors, matching the
+# convention in skills/j-init/scripts/apply-scaffold-visibility.sh.
+set -uo pipefail
+
+_CATALOG_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CATALOG_FILE="${_CATALOG_LIB_DIR}/../assets/jenga-paths.txt"
+
+MANAGED_BEGIN="# >>> jenga:gitignore >>>"
+MANAGED_END="# <<< jenga:gitignore <<<"
+
+VALID_TIERS="scaffold hybrid board optional"
+
+# Populated by load_catalog.
+CATALOG_PATHS=()
+CATALOG_TIERS=()
+CATALOG_DESCS=()
+
+validate_tiers() {
+  local csv="$1" tier valid found
+  [ -n "$csv" ] || { echo "ERROR: --tiers was given an empty value." >&2; return 2; }
+  # Split on commas into an array FIRST, then restore IFS. Setting IFS=',' for
+  # the duration of both loops would stop the space-separated $VALID_TIERS from
+  # splitting, making every tier look invalid.
+  local -a requested=()
+  local old_ifs="$IFS"
+  IFS=','; read -r -a requested <<< "$csv"; IFS="$old_ifs"
+  for tier in "${requested[@]}"; do
+    found=0
+    for valid in $VALID_TIERS; do
+      [ "$tier" = "$valid" ] && found=1 && break
+    done
+    if [ "$found" -eq 0 ]; then
+      echo "ERROR: Unknown tier '${tier}'. Valid tiers: ${VALID_TIERS// /, }" >&2
+      return 2
+    fi
+  done
+  return 0
+}
+
+# load_catalog <comma-separated-tiers>
+# Reads CATALOG_FILE, keeping only rows whose tier is in the requested set.
+load_catalog() {
+  local want="$1"
+  CATALOG_PATHS=(); CATALOG_TIERS=(); CATALOG_DESCS=()
+
+  if [ ! -f "$CATALOG_FILE" ]; then
+    echo "ERROR: Path catalog not found: $CATALOG_FILE" >&2
+    return 1
+  fi
+
+  local tier path desc
+  while IFS=$'\t' read -r tier path desc || [ -n "${tier:-}" ]; do
+    [ -z "${tier// /}" ] && continue
+    case "$tier" in \#*) continue ;; esac
+    [ -n "${path:-}" ] || continue
+    case ",${want}," in
+      *",${tier},"*)
+        CATALOG_PATHS+=("$path")
+        CATALOG_TIERS+=("$tier")
+        CATALOG_DESCS+=("${desc:-}")
+        ;;
+    esac
+  done < "$CATALOG_FILE"
+
+  if [ "${#CATALOG_PATHS[@]}" -eq 0 ]; then
+    echo "ERROR: No catalog entries matched tiers '${want}'." >&2
+    return 1
+  fi
+  return 0
+}
+
+# resolve_root <dir> — cd into it and confirm it is the root of a git work tree.
+resolve_root() {
+  local root="$1"
+  if [ ! -d "$root" ]; then
+    echo "ERROR: Project root does not exist: $root" >&2
+    return 1
+  fi
+  cd "$root" || { echo "ERROR: Cannot enter project root: $root" >&2; return 1; }
+  if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    echo "ERROR: Not a git repository: $root" >&2
+    echo "       This skill repairs a project's tracked/ignored state, so it needs git." >&2
+    return 1
+  fi
+  return 0
+}

package/skills/j-gitignore/scripts/audit-gitignore.sh

@@ -0,0 +1,194 @@
+#!/usr/bin/env bash
+# -----------------------------------------------------------------------------
+# skills/j-gitignore/scripts/audit-gitignore.sh
+#
+# Read-only. Reports the Jenga-related git state of an already-scaffolded
+# project. Changes nothing — this is the "check" half of the skill, safe to run
+# anywhere, any number of times.
+#
+# Reports three independent things per catalog path:
+#
+#   entry     Is the exact entry literally present in .gitignore?
+#   ignored   Does git actually ignore the path (`git check-ignore`)? This can
+#             be true via a broader rule even when `entry` is no — and is
+#             ALWAYS reported as "no" for a tracked path, because .gitignore
+#             has no effect on a file git already tracks. That divergence is
+#             the single most common cause of "I ignored it and it still keeps
+#             getting committed".
+#   tracked   Does git currently track anything under the path?
+#
+# Plus the stray-heredoc-terminator check: a bare `EOF` line left behind by the
+# botched `cat > .gitignore <<EOF` in pre-fix /init scaffolds (fixed for NEW
+# projects by E31_S07_T02/T03 and E42_S06_T01, which replaced the heredoc with
+# a `cp` from assets/.gitignore_template — forward-only, so already-scaffolded
+# projects still carry the damage).
+#
+# Invoked via `bash`, not executed directly — ships without the executable bit,
+# same convention as skills/j-cloud-connect/scripts/install-rclone.sh.
+#
+# Usage:
+#   audit-gitignore.sh [project_root] [--tiers scaffold,hybrid,board,optional]
+#
+# Exit codes:
+#   0   Audit ran; nothing to fix
+#   1   Bad usage or missing prerequisite (not a git repo, catalog missing)
+#   2   Invalid tier name
+#   10  Audit ran; findings exist (stray terminators, missing entries, or
+#       tracked paths). Not an error — this is the signal to run the repair.
+# -----------------------------------------------------------------------------
+
+set -uo pipefail
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/_catalog.sh"
+
+PROJECT_ROOT=""
+TIERS="scaffold"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --tiers)   TIERS="${2:-}"; shift 2 ;;
+    --tiers=*) TIERS="${1#*=}"; shift ;;
+    -h|--help)
+      echo "Usage: $(basename "$0") [project_root] [--tiers scaffold,hybrid,board,optional]"
+      exit 0 ;;
+    -*)
+      echo "ERROR: Unknown option: $1" >&2
+      echo "Usage: $(basename "$0") [project_root] [--tiers <csv>]" >&2
+      exit 1 ;;
+    *)
+      if [ -n "$PROJECT_ROOT" ]; then
+        echo "ERROR: More than one project root given: '$PROJECT_ROOT' and '$1'" >&2
+        exit 1
+      fi
+      PROJECT_ROOT="$1"; shift ;;
+  esac
+done
+
+PROJECT_ROOT="${PROJECT_ROOT:-$PWD}"
+validate_tiers "$TIERS" || exit 2
+resolve_root "$PROJECT_ROOT" || exit 1
+load_catalog "$TIERS" || exit 1
+
+GITIGNORE=".gitignore"
+FINDINGS=0
+
+echo "═══════════════════════════════════════════════════════════════════════"
+echo " Jenga gitignore audit — $(pwd)"
+echo " Tiers: ${TIERS}"
+echo "═══════════════════════════════════════════════════════════════════════"
+echo
+
+# ─── 1. Stray heredoc terminators ───────────────────────────────────────────
+echo "── 1. Stray heredoc terminators ───────────────────────────────────────"
+STRAY_COUNT=0
+if [ ! -f "$GITIGNORE" ]; then
+  echo "  No .gitignore at this root — nothing to check."
+else
+  # A line that is exactly EOF (tolerating trailing whitespace). Reported with
+  # line numbers so a human can eyeball it before anything is removed.
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    echo "  ✗ line ${hit%%:*}: stray '${hit#*:}' terminator"
+    STRAY_COUNT=$((STRAY_COUNT + 1))
+  done < <(grep -nE '^[[:space:]]*EOF[[:space:]]*$' "$GITIGNORE" 2>/dev/null)
+
+  if [ "$STRAY_COUNT" -eq 0 ]; then
+    echo "  ✓ Clean — no stray terminator lines."
+  else
+    echo
+    echo "  → ${STRAY_COUNT} stray line(s). repair-gitignore.sh removes these."
+    FINDINGS=$((FINDINGS + STRAY_COUNT))
+  fi
+fi
+echo
+
+# ─── 2. Managed block ────────────────────────────────────────────────────────
+echo "── 2. Managed block ───────────────────────────────────────────────────"
+if [ -f "$GITIGNORE" ] && grep -qxF -- "$MANAGED_BEGIN" "$GITIGNORE"; then
+  echo "  ✓ Present — this project has been through repair-gitignore.sh before."
+else
+  echo "  · Absent — entries (if any) are loose, e.g. appended by /init's"
+  echo "    apply-project-visibility.sh / apply-scaffold-visibility.sh."
+fi
+echo
+
+# ─── 3. Per-path state ───────────────────────────────────────────────────────
+echo "── 3. Per-path state ──────────────────────────────────────────────────"
+printf "  %-34s %-7s %-8s %-8s %s\n" "PATH" "ENTRY" "IGNORED" "TRACKED" "TIER"
+printf "  %-34s %-7s %-8s %-8s %s\n" "----" "-----" "-------" "-------" "----"
+
+MISSING_ENTRIES=0
+TRACKED_PATHS=()
+
+for i in "${!CATALOG_PATHS[@]}"; do
+  path="${CATALOG_PATHS[$i]}"
+  tier="${CATALOG_TIERS[$i]}"
+
+  entry="no"
+  if [ -f "$GITIGNORE" ] && grep -qxF -- "$path" "$GITIGNORE"; then
+    entry="yes"
+  fi
+
+  # check-ignore works on paths that do not exist on disk, so a not-yet-created
+  # scaffold dir is still evaluated against the rules.
+  ignored="no"
+  if git check-ignore -q -- "$path" 2>/dev/null; then
+    ignored="yes"
+  fi
+
+  tracked="no"
+  if [ -n "$(git ls-files -- "$path" 2>/dev/null | head -n 1)" ]; then
+    tracked="yes"
+    TRACKED_PATHS+=("$path")
+  fi
+
+  flag=""
+  if [ "$entry" = "no" ];   then flag="  ← no entry"; MISSING_ENTRIES=$((MISSING_ENTRIES + 1)); fi
+  if [ "$tracked" = "yes" ]; then flag="${flag}  ← TRACKED"; fi
+
+  printf "  %-34s %-7s %-8s %-8s %s%s\n" "$path" "$entry" "$ignored" "$tracked" "$tier" "$flag"
+done
+echo
+
+# ─── 4. Origin state ─────────────────────────────────────────────────────────
+echo "── 4. Origin ──────────────────────────────────────────────────────────"
+BRANCH="$(git rev-parse --abbrev-ref HEAD 2>/dev/null)"
+UPSTREAM="$(git rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null)"
+
+if [ -z "$UPSTREAM" ]; then
+  echo "  · Branch '${BRANCH}' has no upstream — nothing has been pushed from it."
+  echo "    Untracking here only ever affects local history."
+else
+  echo "  Upstream: ${UPSTREAM}"
+  ON_ORIGIN=0
+  for path in "${TRACKED_PATHS[@]:-}"; do
+    [ -z "$path" ] && continue
+    if [ -n "$(git ls-tree -r --name-only "$UPSTREAM" -- "$path" 2>/dev/null | head -n 1)" ]; then
+      echo "  ✗ ${path} — present on ${UPSTREAM}"
+      ON_ORIGIN=$((ON_ORIGIN + 1))
+    fi
+  done
+  if [ "$ON_ORIGIN" -eq 0 ]; then
+    echo "  ✓ No catalog path is present on ${UPSTREAM}."
+  else
+    echo
+    echo "  → ${ON_ORIGIN} path(s) live on the remote. untrack-jenga-files.sh"
+    echo "    --commit --push removes them from the branch TIP. It does NOT"
+    echo "    rewrite history — earlier commits still contain them."
+  fi
+fi
+echo
+
+# ─── Summary ─────────────────────────────────────────────────────────────────
+FINDINGS=$((FINDINGS + MISSING_ENTRIES + ${#TRACKED_PATHS[@]}))
+echo "═══════════════════════════════════════════════════════════════════════"
+echo " Stray terminators : ${STRAY_COUNT}"
+echo " Missing entries   : ${MISSING_ENTRIES}"
+echo " Tracked paths     : ${#TRACKED_PATHS[@]}"
+echo "═══════════════════════════════════════════════════════════════════════"
+
+if [ "$FINDINGS" -gt 0 ]; then
+  echo "AUDIT_RESULT=findings"
+  exit 10
+fi
+echo "AUDIT_RESULT=clean"
+exit 0