@piercebarney/whs-eleventy 2026.9.2 → 2026.9.8

package/lib/_project.js

@@ -22,6 +22,20 @@ function tryProjectRequire(rel, fallback = null) {
   }
 }
 
+// The content-arm -> build-arm escalation drawer (core.md#content-model): one
+// `YYYY-MM-DD-<slug>.md` per blocked structural request, triaged and deleted by
+// the build arm. Returns the open notes' filenames (README.md excluded), sorted.
+function openRequests(root = ROOT) {
+  try {
+    return fs
+      .readdirSync(path.join(root, "requests"))
+      .filter((f) => f.endsWith(".md") && f.toLowerCase() !== "readme.md")
+      .sort();
+  } catch {
+    return [];
+  }
+}
+
 // Locate the standard's text (core.md, CHANGELOG.md) for the drift check:
 //   1. WHS_STANDARD env var (the authoring repo points this at itself)
 //   2. the copy bundled into this package at publish time (standard/)
@@ -39,4 +53,4 @@ function resolveStandard() {
   return null;
 }
 
-module.exports = { ROOT, projectRequire, tryProjectRequire, resolveStandard };
+module.exports = { ROOT, projectRequire, tryProjectRequire, openRequests, resolveStandard };

package/lib/compliance.js

@@ -152,7 +152,9 @@ const CHECKS = {
     }
     const protocol =
       has("CONTENT.md") && /"content-check"/.test(read("package.json") || "")
-        ? "agent content-ops protocol present"
+        ? has("requests")
+          ? "agent content-ops protocol present (CONTENT.md, content-check, requests/)"
+          : "CONTENT.md + content-check present, but no requests/ escalation drawer"
         : "no CONTENT.md / content-check — add it if content is agent-edited";
     return {
       status: MANUAL,
@@ -412,14 +414,22 @@ const CHECKS = {
   },
 
   privacy: () => {
-    const p = read("src/privacy.njk") || "";
-    if (!has("src/privacy.njk")) return { status: FAIL, note: "no privacy page" };
-    if (!/for\s+t\s+in\s+thirdparties/.test(p))
+    // The privacy page may be a standalone src/privacy.njk or a pages.json
+    // entry rendered by a src/pages/ shell — check the built output, with a
+    // source fallback for when _site isn't built yet.
+    const built = has("_site/privacy/index.html");
+    const source =
+      has("src/privacy.njk") ||
+      /["']slug["']\s*:\s*["']privacy["']/.test(read("src/content/pages.json") || "");
+    if (!built && !source) return { status: FAIL, note: "no privacy page" };
+    // The third-party disclosure must be generated from _data/thirdparties.js,
+    // never hand-maintained — the loop lives in the privacy shell or an include.
+    if (grepSrc(/for\s+t\s+in\s+thirdparties/).length === 0)
       return {
         status: FAIL,
         note: "privacy third-party list not rendered from _data/thirdparties.js",
       };
-    return { status: PASS, note: "third-party list rendered from the manifest" };
+    return { status: PASS, note: "privacy page present; third-party list from the manifest" };
   },
 
   ads: () => {
@@ -654,16 +664,26 @@ const CHECKS = {
 
 // ---- standard-version drift -----------------------------------------
 
-// Every chapter slug the CHANGELOG records as changed after `pin`. `### core: a
-// · b · c` yields every slug on the line, not just the first; a
-// `### stacks/eleventy-netlify.md` heading yields the binding marker.
-function changelogSlugs(changelog, pin) {
-  const slugs = new Set();
-  let inRange = false;
+// Every CHANGELOG entry (`## <date> [breaking|non-breaking]`) dated after
+// `pin`, with the chapter slugs it touched. `### core: a · b · c` yields
+// every slug on the line, not just the first; a
+// `### stacks/eleventy-netlify.md` heading yields the binding marker. An
+// entry heading with no severity tag (a fixture, or a pre-2026-09-04
+// CHANGELOG snapshot) defaults to non-breaking — the real standard's own
+// CHANGELOG.md always carries the tag (bin/check's 6th check enforces it).
+function changelogEntries(changelog, pin) {
+  const entries = [];
+  let current = null;
   for (const line of (changelog || "").split("\n")) {
-    const dateM = line.match(/^##\s+([0-9]{4}-[0-9]{2}-[0-9]{2})/);
-    if (dateM) inRange = dateM[1] > pin;
-    if (!inRange) continue;
+    const dateM = line.match(
+      /^##\s+([0-9]{4}-[0-9]{2}-[0-9]{2}).*?(?:\[(breaking|non-breaking)\])?\s*$/,
+    );
+    if (dateM) {
+      current = dateM[1] > pin ? { severity: dateM[2] || "non-breaking", slugs: new Set() } : null;
+      if (current) entries.push(current);
+      continue;
+    }
+    if (!current) continue;
     const coreM = line.match(/^###\s+core:\s+(.+)/);
     if (coreM) {
       for (const part of coreM[1].split(/[·,]/)) {
@@ -677,15 +697,23 @@ function changelogSlugs(changelog, pin) {
           // not a literal slug named "all" — the registry has no such slug,
           // so emitting it as one would print a `MANUAL: re-check #all` row
           // that looks real but isn't.
-          slugs.add("(all core chapters)");
+          current.slugs.add("(all core chapters)");
           continue;
         }
         const slug = (cleaned.match(/^[a-z0-9-]+/) || [])[0];
-        if (slug) slugs.add(slug);
+        if (slug) current.slugs.add(slug);
       }
     }
-    if (/^###\s+stacks\/eleventy-netlify\.md/.test(line)) slugs.add("(eleventy binding)");
+    if (/^###\s+stacks\/eleventy-netlify\.md/.test(line)) current.slugs.add("(eleventy binding)");
   }
+  return entries.map((e) => ({ severity: e.severity, slugs: [...e.slugs] }));
+}
+
+// Every chapter slug the CHANGELOG records as changed after `pin`, flattened
+// (severity dropped) — kept for callers that only need the slug set.
+function changelogSlugs(changelog, pin) {
+  const slugs = new Set();
+  for (const e of changelogEntries(changelog, pin)) for (const s of e.slugs) slugs.add(s);
   return [...slugs];
 }
 
@@ -706,11 +734,22 @@ function versionDrift() {
   if (pin >= current) return { pin, current, rows: [] };
 
   const changelog = read("CHANGELOG.md", STANDARD) || "";
+  // Worst-case severity per slug: one breaking touch marks it breaking for
+  // good, even if a later (or earlier) entry touching the same slug since
+  // the pin was non-breaking.
+  const severityBySlug = new Map();
+  for (const entry of changelogEntries(changelog, pin)) {
+    for (const slug of entry.slugs) {
+      if (severityBySlug.get(slug) !== "breaking") severityBySlug.set(slug, entry.severity);
+    }
+  }
   return {
     pin,
     current,
-    rows: changelogSlugs(changelog, pin).map(
-      (s) => `MANUAL: re-check #${s} — changed since the pinned ${pin}`,
+    rows: [...severityBySlug.entries()].map(([slug, severity]) =>
+      severity === "breaking"
+        ? `BREAKING: re-check #${slug} — changed since the pinned ${pin}`
+        : `MANUAL: re-check #${slug} — changed since the pinned ${pin}`,
     ),
   };
 }
@@ -741,10 +780,11 @@ function runCompliance() {
 
 function summarize({ results, drift }) {
   const n = (s) => results.filter((r) => r.status === s).length;
+  const breakingDrift = drift.rows.filter((r) => r.startsWith("BREAKING:")).length;
   return {
     pass: n(PASS),
-    fail: n(FAIL),
-    manual: n(MANUAL) + drift.rows.length,
+    fail: n(FAIL) + breakingDrift,
+    manual: n(MANUAL) + (drift.rows.length - breakingDrift),
     na: n(NA),
   };
 }
@@ -783,7 +823,7 @@ function main() {
   writeCache({ ...payload, summary: s });
 
   if (strict && s.fail) {
-    console.error("compliance --strict: FAIL chapters present.");
+    console.error("compliance --strict: FAIL chapters or BREAKING standard-version drift present.");
     process.exit(1);
   }
 }
@@ -792,4 +832,4 @@ if (require.main === module) main();
 
 // CHECKS is exported for the "coverage" test — nothing else should read it as
 // data (call runCompliance() for results).
-module.exports = { runCompliance, summarize, changelogSlugs, CHECKS };
+module.exports = { runCompliance, summarize, changelogSlugs, changelogEntries, CHECKS };

package/lib/content-check.js

@@ -4,42 +4,94 @@
 //
 //   whs content-check
 //
-// Also warns — does not block — when the working tree has changes outside the
-// content set, so a stray code edit doesn't ride along in a `content:` commit.
+// A **staged** file outside the reserved content set is an error — a `content:`
+// commit can't carry a code/structure change. An unstaged stray only warns (it
+// won't be in the commit unless staged). Also reports the open requests/ notes
+// (the content-arm → build-arm escalation channel, core.md#content-model).
 
 const { execSync } = require("node:child_process");
+const { openRequests } = require("./_project.js");
 
-// Files an agent following CONTENT.md is expected to touch.
-const CONTENT_SET = [/^src\/content\//, /^src\/_data\/nav\.js$/, /^src\/_data\/glossary\.js$/];
+// Files an agent following CONTENT.md may touch — the reserved content set plus
+// its own escalation drawer. Everything else (the *.schema.json editor aids,
+// schema.js, the page shells, the includes, config) is a build-arm change.
+const RESERVED_SET = [
+  /^src\/content\/(?!.*\.schema\.json$)[^/]+\.json$/,
+  /^src\/_data\/nav\.js$/,
+  /^src\/_data\/glossary\.js$/,
+  /^requests\//,
+];
 
-function changedFiles() {
+// One `git status --porcelain` line → { path, staged }. `staged` is true when
+// the index column (X) holds a real status letter — i.e. the change is part of
+// the next commit. Untracked ("??") and worktree-only (" M") are not staged.
+function parsePorcelain(out) {
+  return out
+    .split("\n")
+    .filter(Boolean)
+    .map((l) => {
+      const x = l[0];
+      const rest = l.slice(3);
+      const path = rest.includes(" -> ") ? rest.split(" -> ")[1] : rest;
+      return { path: path.trim(), staged: x !== " " && x !== "?" };
+    });
+}
+
+function changedEntries() {
   try {
-    const out = execSync("git status --porcelain", { encoding: "utf8" });
-    return out
-      .split("\n")
-      .map((l) => l.slice(3).trim())
-      .filter(Boolean)
-      .map((f) => (f.includes(" -> ") ? f.split(" -> ")[1] : f));
+    return parsePorcelain(execSync("git status --porcelain", { encoding: "utf8" }));
   } catch {
     return [];
   }
 }
 
-const stray = changedFiles().filter((f) => !CONTENT_SET.some((re) => re.test(f)));
-if (stray.length) {
-  console.warn("\n⚠  changes outside the content set — these are code changes, not content:");
-  for (const f of stray) console.warn(`     ${f}`);
-  console.warn("   Commit them separately (a Claude Code task), or confirm they're intentional.\n");
+function strayFiles(paths) {
+  return paths.filter((f) => !RESERVED_SET.some((re) => re.test(f)));
 }
 
-const steps = ["lint", "validate", "build", "links"];
-for (const s of steps) {
-  process.stdout.write(`content-check: npm run ${s}\n`);
-  try {
-    execSync(`npm run ${s}`, { stdio: "inherit" });
-  } catch {
-    console.error(`\ncontent-check: '${s}' failed — fix it before committing.`);
+function splitStray(entries) {
+  return {
+    staged: strayFiles(entries.filter((e) => e.staged).map((e) => e.path)),
+    unstaged: strayFiles(entries.filter((e) => !e.staged).map((e) => e.path)),
+  };
+}
+
+function main() {
+  const { staged: stagedStray, unstaged: unstagedStray } = splitStray(changedEntries());
+
+  if (stagedStray.length) {
+    console.error("\n✗ staged changes outside the reserved content set (CONTENT.md):");
+    for (const f of stagedStray) console.error(`     ${f}`);
+    console.error(
+      "\n  A `content:` commit can't carry a code or structure change. Unstage them\n" +
+        "  (git restore --staged <file>), or file a requests/ note for the build arm.\n",
+    );
     process.exit(1);
   }
+  if (unstagedStray.length) {
+    console.warn("\n⚠  uncommitted changes outside the reserved set (not staged):");
+    for (const f of unstagedStray) console.warn(`     ${f}`);
+    console.warn("   They won't ride a `content:` commit unless you stage them.\n");
+  }
+
+  const reqs = openRequests();
+  if (reqs.length) {
+    console.log(`\nℹ  ${reqs.length} open request(s) in requests/ awaiting the build arm.\n`);
+  }
+
+  const steps = ["lint", "validate", "build", "links"];
+  for (const s of steps) {
+    process.stdout.write(`content-check: npm run ${s}\n`);
+    try {
+      execSync(`npm run ${s}`, { stdio: "inherit" });
+    } catch {
+      console.error(`\ncontent-check: '${s}' failed — fix it before committing.`);
+      process.exit(1);
+    }
+  }
+  console.log("\ncontent-check: ok — lint · validate · build · links");
 }
-console.log("\ncontent-check: ok — lint · validate · build · links");
+
+module.exports = { strayFiles, parsePorcelain, splitStray, RESERVED_SET };
+
+if (require.main === module) main();

package/lib/doctor.js

@@ -21,7 +21,7 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const { execSync } = require("node:child_process");
-const { ROOT, projectRequire } = require("./_project.js");
+const { ROOT, projectRequire, openRequests } = require("./_project.js");
 const { asRegexMap } = require("./header-expect.js");
 
 const CACHE = path.join(ROOT, ".cache", "doctor.json");
@@ -376,6 +376,26 @@ function main() {
   }
 
   if (preflight) {
+    // Open content-arm → build-arm requests gate the deploy: a conditional
+    // hard stop (core.md#content-model). Zero → ship; one or more → refuse
+    // unless --ack-requests says the operator has reviewed them.
+    const reqs = openRequests();
+    if (reqs.length && !args.includes("--ack-requests")) {
+      console.error(
+        `\ndoctor: ${reqs.length} open request(s) in requests/ — the content arm is ` +
+          `waiting on\nthe build arm. Clear them, or re-run the deploy with ` +
+          `--ack-requests to ship anyway:`,
+      );
+      reqs.forEach((r) => console.error(`  - requests/${r}`));
+      console.error("\nRefusing to continue.");
+      process.exit(1);
+    }
+    console.log(
+      reqs.length
+        ? `\nOpen requests: ${reqs.length} — acknowledged (--ack-requests).`
+        : "\nOpen requests: 0.",
+    );
+
     const cr = complianceRegressions();
     if (!cr.checked) {
       console.log(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piercebarney/whs-eleventy",
-  "version": "2026.9.2",
+  "version": "2026.9.8",
   "description": "The web house style's Eleventy + Netlify tooling — the compliance sweep, the infra doctor, the link/CSP integrity check, and the a11y scan, shared by every project on the stack.",
   "bin": {
     "whs": "cli.js"
@@ -36,8 +36,8 @@
     "sirv": "^3.0.2"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.5",
-    "eslint": "^9.39.5",
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.9.1",
     "globals": "^17.11.0",
     "prettier": "^3.9.6"
   }