@sebastienrousseau/dotfiles 0.2.501 → 0.2.503

package/dot_local/share/zsh/completions/_dot

@@ -1,283 +0,0 @@
-#compdef dot
-
-# Zsh completion for the dot CLI (dotfiles manager)
-# Installed to: ~/.local/share/zsh/completions/_dot
-
-_dot() {
-  local -a commands
-
-  commands=(
-    # Core
-    'apply:Apply dotfiles via chezmoi'
-    'sync:Apply dotfiles (alias of apply)'
-    'update:Pull latest changes and apply them'
-    'clean-cache:Clear shell initialization caches'
-    'prewarm:Regenerate shell caches for ultra-fast startup'
-    'cl:Claude CLI with context patterns'
-    'copilot:GitHub Copilot CLI with context patterns'
-    'gemini:Gemini CLI with context patterns'
-    'kiro:Kiro CLI with context patterns'
-    'sgpt:Shell-GPT with context patterns'
-    'ollama:Ollama with context patterns'
-    'opencode:OpenCode with context patterns'
-    'aider:Aider with context patterns'
-    'add:Add a file to chezmoi source'
-    'diff:Show chezmoi diff with exclusions'
-    'status:Show configuration drift'
-    'remove:Safely remove a managed file'
-    'cd:Print source directory path'
-    'edit:Open chezmoi source in \$EDITOR'
-    'commit:AI-powered conventional commit'
-    'patterns:Manage AI steering patterns'
-
-    # Diagnostics
-    'doctor:Check system health and configuration'
-    'heal:Auto-repair common dotfiles issues'
-    'health:Run comprehensive health check'
-    'smoke-test:Run automated toolchain verification'
-    'chaos:Simulate config corruption to test self-healing'
-    'scorecard:Unified health/security/performance scorecard'
-    'security-score:Analyze infrastructure security score'
-    'intelligence:Show Dotfiles Intelligence Surface'
-    'rollback:Rollback dotfiles to a previous state'
-    'drift:Drift dashboard (detailed chezmoi status)'
-    'history:Shell history analysis'
-    'benchmark:Run shell startup benchmark'
-    'perf:Show performance mode and timing'
-    'load:Preload heavy shell layers'
-    'load-bench:Measure time to heavy-layer readiness'
-    'load-bench-pty:Measure background prewarm via PTY'
-    'ai:Show AI helper status'
-    'ai-setup:Interactive setup for all AI CLI tools'
-    'ai-query:Context-aware RAG query over your dotfiles'
-    'conflicts:Report alias/command conflicts'
-    'locks:Show version locks for key tools'
-    'snapshot:Capture baseline system snapshot'
-    'verify:Run post-merge verification checks'
-
-    # Tools
-    'tools:Show or install nix packages'
-    'new:Create a new project from a template'
-    'sandbox:Launch a safe sandbox preview'
-    'keys:Show keybindings catalog'
-    'aliases:List/search/explain aliases and tiers'
-    'learn:Start the interactive tour'
-    'docs:Show repo README'
-    'log-rotate:Rotate dotfiles log'
-    'setup:Interactive setup (profile, features, secrets)'
-
-    # Appearance
-    'theme:Switch terminal theme'
-    'wallpaper:Apply a wallpaper'
-    'fonts:Install Nerd Fonts'
-    'tune:Apply OS tuning'
-
-    # Secrets
-    'secrets-init:Initialize age key for secrets'
-    'secrets:Manage secrets (edit|set|get|list|load|provider)'
-    'secrets-create:Create an encrypted secrets file'
-    'ssh-key:Encrypt an SSH key with age'
-    'ssh-cert:Manage short-lived SSH certificates'
-    'env:Load environment buckets from managed secrets'
-
-    # Security
-    'backup:Create a compressed backup of home'
-    'bundle:Create offline archive of dotfiles environment'
-    'encrypt-check:Check disk encryption status'
-    'firewall:Apply firewall hardening'
-    'telemetry:Disable OS telemetry'
-    'dns-doh:Enable DNS-over-HTTPS'
-    'lock-screen:Enforce lock screen idle settings'
-    'usb-safety:Disable automount for removable media'
-
-    # Meta
-    'upgrade:Update flake, plugins, and dotfiles'
-    'packages:List installed packages'
-    'version:Show version information'
-    '--version:Show version information'
-    'help:Show help message'
-  )
-
-  _arguments -C \
-    '1:command:->cmds' \
-    '*::arg:->args'
-
-  case "$state" in
-    cmds)
-      _describe -t commands 'dot command' commands
-      ;;
-    args)
-      case "$words[1]" in
-        new)
-          if ((CURRENT == 2)); then
-            local -a templates=(python go node packer molecule)
-            _describe -t templates 'project template' templates
-          else
-            _files
-          fi
-          ;;
-        add | remove)
-          _files
-          ;;
-        keys)
-          _message 'search pattern (optional)'
-          ;;
-        perf)
-          local -a perf_opts=(
-            '--json:Output as JSON'
-            '-j:Output as JSON'
-            '--profile:Include profile output'
-            '-p:Include profile output'
-            '--runs:Set the number of runs'
-            '-r:Set the number of runs'
-            '--target:Set the timing target in milliseconds'
-            '-t:Set the timing target in milliseconds'
-          )
-          _describe -t options 'perf option' perf_opts
-          ;;
-        doctor)
-          local -a doctor_opts=(
-            '--heal:Auto-repair common issues'
-            '-H:Auto-repair common issues'
-            '--score:Show score output'
-            '-s:Show score output'
-            '--json:Emit JSON summary'
-            '-j:Emit JSON summary'
-            '--ai:Include AI diagnostics'
-            '-A:Include AI diagnostics'
-          )
-          _describe -t options 'doctor option' doctor_opts
-          ;;
-        attest)
-          local -a attest_opts=(
-            '--json:Emit JSON output'
-            '-j:Emit JSON output'
-            '--write:Write attestation to a file'
-            '-w:Write attestation to a file'
-          )
-          _describe -t options 'attest option' attest_opts
-          ;;
-        lint)
-          local -a lint_opts=(
-            '--check:Run check-only mode'
-            '-c:Run check-only mode'
-            '--fix:Apply safe fixes'
-            '-f:Apply safe fixes'
-          )
-          _describe -t options 'lint option' lint_opts
-          ;;
-        mcp)
-          local -a mcp_opts=(
-            'registry:Show the MCP registry'
-            '--strict:Treat policy warnings as errors'
-            '-s:Treat policy warnings as errors'
-            '--json:Emit JSON summary'
-            '-j:Emit JSON summary'
-          )
-          _describe -t options 'mcp option' mcp_opts
-          ;;
-        health)
-          local -a health_opts=(
-            '--verbose:Show detailed checks'
-            '-v:Show detailed checks'
-            '--json:Emit JSON summary'
-            '-j:Emit JSON summary'
-            '--fix:Apply common fixes'
-            '-f:Apply common fixes'
-            '--force:Apply fixes without prompts'
-            '-F:Apply fixes without prompts'
-          )
-          _describe -t options 'health option' health_opts
-          ;;
-        security-score)
-          local -a security_opts=(
-            '--verbose:Show detailed scoring'
-            '-v:Show detailed scoring'
-            '--quiet:Reduce output noise'
-            '-q:Reduce output noise'
-            '--json:Emit JSON summary'
-            '-j:Emit JSON summary'
-          )
-          _describe -t options 'security-score option' security_opts
-          ;;
-        snapshot)
-          local -a snapshot_opts=(
-            '--baseline:Capture the baseline snapshot'
-            '-b:Capture the baseline snapshot'
-            '--force:Overwrite an existing snapshot'
-            '-f:Overwrite an existing snapshot'
-          )
-          _describe -t options 'snapshot option' snapshot_opts
-          ;;
-        verify)
-          local -a verify_opts=(
-            '--security:Run security verification'
-            '-s:Run security verification'
-          )
-          _describe -t options 'verify option' verify_opts
-          ;;
-        restore)
-          local -a restore_opts=(
-            '--list:List available backups'
-            '-l:List available backups'
-            '--latest:Restore the latest backup'
-            '-L:Restore the latest backup'
-            '--git:Restore from a git ref'
-            '-g:Restore from a git ref'
-            '--diff:Show a diff for a git ref'
-            '-d:Show a diff for a git ref'
-            '--dry-run:Preview the restore'
-            '-n:Preview the restore'
-          )
-          _describe -t options 'restore option' restore_opts
-          ;;
-        load)
-          local -a load_opts=('--background:Load in background' '--status:Show load status')
-          _describe -t options 'load option' load_opts
-          ;;
-        tools)
-          local -a tool_cmds=('install:Enter Nix development shell')
-          _describe -t subcommands 'tools subcommand' tool_cmds
-          ;;
-        theme)
-          local -a themes=(dark light)
-          _describe -t themes 'theme mode' themes
-          ;;
-        ssh-cert)
-          local -a cert_cmds=(
-            'issue:Request a short-lived SSH certificate'
-            'status:Show current certificate status'
-            'revoke:Revoke an active certificate'
-          )
-          _describe -t subcommands 'ssh-cert subcommand' cert_cmds
-          ;;
-        secrets)
-          local -a secrets_cmds=(
-            'edit:Edit encrypted secrets'
-            'set:Set a secret value'
-            'get:Get a secret value'
-            'list:List secret keys'
-            'load:Load secrets into environment'
-            'provider:Show/switch secrets provider'
-          )
-          _describe -t subcommands 'secrets subcommand' secrets_cmds
-          ;;
-        cl | copilot | gemini | kiro | sgpt | ollama | opencode | aider)
-          _arguments -C \
-            '(--pattern -p)'{--pattern,-p}'[Specify steering pattern]:pattern:->patterns' \
-            '*:prompt: '
-          if [[ "$state" == "patterns" ]]; then
-            local -a patterns
-            patterns=($(ls -1 "${XDG_CONFIG_HOME:-$HOME/.config}/ai/patterns" 2>/dev/null | sed 's/\.md$//'))
-            _describe -t patterns 'AI pattern' patterns
-          fi
-          ;;
-        *)
-          _default
-          ;;
-      esac
-      ;;
-  esac
-}
-
-_dot "$@"

package/scripts/ci/check-dangerous-chmod.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# =============================================================================
-# check-dangerous-chmod.sh — block `chmod 777` / `chmod 666` patterns
-# from landing in shell scripts.
-#
-# Invoked as a pre-commit local hook (no filename args; scans the repo).
-# Extracted from `config/pre-commit-config.yaml` under #866.
-# =============================================================================
-
-set -euo pipefail
-
-PATTERN='^[[:space:]]*chmod[[:space:]]+(-R[[:space:]]+)?(777|666)'
-
-if grep -rn --include='*.sh' -E "$PATTERN" . 2>/dev/null | grep -v '^Binary'; then
-  echo "ERROR: Dangerous chmod patterns found (777 or 666)." >&2
-  echo "Use the minimum permissions actually required; document any exception." >&2
-  exit 1
-fi

package/scripts/ci/check-deps-dev.sh

@@ -1,236 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# =============================================================================
-# check-deps-dev.sh — Validate direct dependencies against the deps.dev
-# Insights API. Catches supply-chain risk a Grype-only scan misses:
-# stale-but-CVE-free packages, unattested artifacts, and packages with
-# advisories that haven't yet been mapped to a CVE.
-#
-# Scans:
-#   * `package.json` — direct `dependencies` + `devDependencies` (npm).
-#   * `pyproject.toml` — direct `[project.dependencies]` (Python).
-#   * `.github/workflows/*.yml` — `uses:` action references (GitHub Actions).
-#
-# Skips ecosystems with no matching manifest.
-#
-# Exit codes:
-#   0  no advisories found (or all under threshold).
-#   1  one or more direct deps have advisories at or above the threshold.
-#   2  prerequisites missing (jq / curl / python3).
-#
-# Closes part of #877.
-# =============================================================================
-
-set -uo pipefail
-
-REPO_ROOT="${REPO_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
-THRESHOLD="${DEPS_DEV_SEVERITY_THRESHOLD:-HIGH}" # LOW | MEDIUM | HIGH | CRITICAL
-DEPS_DEV_BASE="${DEPS_DEV_BASE:-https://api.deps.dev/v3}"
-EXCEPTIONS_FILE="$REPO_ROOT/docs/security/DEPS_DEV_EXCEPTIONS.md"
-SARIF_OUT="${DEPS_DEV_SARIF_OUT:-}"
-
-# Strict mode: bail on prerequisites.
-for cmd in jq curl python3; do
-  if ! command -v "$cmd" >/dev/null 2>&1; then
-    echo "::warning::check-deps-dev: $cmd not available — skipping." >&2
-    exit 0
-  fi
-done
-
-# -----------------------------------------------------------------------------
-# Helpers
-# -----------------------------------------------------------------------------
-
-# severity_rank — map deps.dev severity strings to integers so we can
-# compare against THRESHOLD numerically.
-severity_rank() {
-  case "${1:-}" in
-    CRITICAL) echo 4 ;;
-    HIGH) echo 3 ;;
-    MEDIUM | MODERATE) echo 2 ;;
-    LOW) echo 1 ;;
-    *) echo 0 ;;
-  esac
-}
-
-THRESHOLD_RANK=$(severity_rank "$THRESHOLD")
-
-# is_excepted — check if a (system, name) pair has an active exception
-# entry in DEPS_DEV_EXCEPTIONS.md. Exceptions look like:
-#   `npm:lodash` (expires 2026-12-31): <reason>
-is_excepted() {
-  local system="$1" name="$2"
-  [[ -f "$EXCEPTIONS_FILE" ]] || return 1
-  grep -Eq "^\s*\`${system}:${name}\`" "$EXCEPTIONS_FILE"
-}
-
-# fetch_advisories — query deps.dev for advisories on a (system, name,
-# version) triple. Prints one advisory-key per line; empty if none.
-fetch_advisories() {
-  local system="$1" name="$2" version="$3"
-  local encoded_name
-  encoded_name=$(python3 -c 'import urllib.parse, sys; print(urllib.parse.quote(sys.argv[1], safe=""))' "$name")
-  local url="$DEPS_DEV_BASE/systems/$system/packages/$encoded_name/versions/$version"
-  curl -fsSL --max-time 15 "$url" 2>/dev/null |
-    jq -r '.advisoryKeys[]?.id // empty' 2>/dev/null ||
-    true
-}
-
-# fetch_advisory_severity — given an advisory ID, return its highest
-# severity rating. Returns empty string when the API doesn't expose
-# severity (older advisories sometimes lack it).
-fetch_advisory_severity() {
-  local advisory_id="$1"
-  local encoded
-  encoded=$(python3 -c 'import urllib.parse, sys; print(urllib.parse.quote(sys.argv[1], safe=""))' "$advisory_id")
-  curl -fsSL --max-time 15 "$DEPS_DEV_BASE/advisories/$encoded" 2>/dev/null |
-    jq -r '.severity[]?.type // empty' 2>/dev/null |
-    head -1 ||
-    true
-}
-
-# -----------------------------------------------------------------------------
-# Manifest readers
-# -----------------------------------------------------------------------------
-
-# Each reader prints one "system\tname\tversion" line per direct dep.
-
-read_npm() {
-  local pkg="$REPO_ROOT/package.json"
-  [[ -f "$pkg" ]] || return 0
-  jq -r '
-    [.dependencies // {}, .devDependencies // {}]
-    | add // {}
-    | to_entries[]
-    | "NPM\t\(.key)\t\(.value | sub("^[~^>=<]+"; ""))"
-  ' "$pkg"
-}
-
-read_pypi() {
-  local pyproj="$REPO_ROOT/pyproject.toml"
-  [[ -f "$pyproj" ]] || return 0
-  python3 - "$pyproj" <<'PY'
-import sys
-try:
-    import tomllib
-except ImportError:
-    try:
-        import tomli as tomllib  # type: ignore
-    except ImportError:
-        sys.exit(0)
-data = tomllib.load(open(sys.argv[1], "rb"))
-deps = data.get("project", {}).get("dependencies", [])
-for spec in deps:
-    # spec is like "requests>=2.28.0"; pull name + version.
-    name = spec.split("[")[0].split(">")[0].split("<")[0].split("=")[0].strip()
-    version = ""
-    for op in (">=", "<=", "==", ">", "<"):
-        if op in spec:
-            version = spec.split(op, 1)[1].strip().split(",")[0]
-            break
-    print(f"PYPI\t{name}\t{version}")
-PY
-}
-
-read_actions() {
-  local f
-  for f in "$REPO_ROOT"/.github/workflows/*.yml; do
-    [[ -f "$f" ]] || continue
-    # Match `uses: owner/repo@<40-hex-sha> # vX.Y.Z`
-    grep -Eo 'uses:[[:space:]]+[a-zA-Z0-9._-]+/[a-zA-Z0-9._/-]+@[a-f0-9]{40}[[:space:]]*#[[:space:]]*v[0-9.]+' "$f" |
-      sed -E 's/uses:[[:space:]]+([^@]+)@[a-f0-9]{40}[[:space:]]+#[[:space:]]+v([0-9.]+).*/GITHUB_ACTIONS\t\1\t\2/' ||
-      true
-  done | sort -u
-}
-
-# -----------------------------------------------------------------------------
-# Main scan
-# -----------------------------------------------------------------------------
-
-findings=()
-total_scanned=0
-
-scan_one() {
-  local system="$1" name="$2" version="$3"
-  [[ -z "$name" || -z "$version" ]] && return 0
-  total_scanned=$((total_scanned + 1))
-
-  if is_excepted "$system" "$name"; then
-    echo "  - skip $system:$name@$version (excepted)" >&2
-    return 0
-  fi
-
-  local advs
-  advs=$(fetch_advisories "$system" "$name" "$version")
-  [[ -z "$advs" ]] && return 0
-
-  while IFS= read -r adv; do
-    [[ -z "$adv" ]] && continue
-    local sev
-    sev=$(fetch_advisory_severity "$adv")
-    local rank
-    rank=$(severity_rank "$sev")
-    if ((rank >= THRESHOLD_RANK)); then
-      findings+=("$system:$name@$version :: $adv ($sev)")
-      echo "::warning::deps.dev advisory $sev: $system $name $version → $adv" >&2
-    fi
-  done <<<"$advs"
-}
-
-echo "Scanning manifests under $REPO_ROOT ..." >&2
-
-# 1. npm
-while IFS=$'\t' read -r system name version; do
-  scan_one "$system" "$name" "$version"
-done < <(read_npm)
-
-# 2. pypi
-while IFS=$'\t' read -r system name version; do
-  scan_one "$system" "$name" "$version"
-done < <(read_pypi)
-
-# 3. GitHub Actions (best-effort — deps.dev coverage is partial)
-while IFS=$'\t' read -r system name version; do
-  scan_one "$system" "$name" "$version"
-done < <(read_actions)
-
-echo "Scanned $total_scanned direct dependencies." >&2
-
-# Optional SARIF emission for Code Scanning upload.
-if [[ -n "$SARIF_OUT" ]]; then
-  python3 - "$SARIF_OUT" "${findings[@]+"${findings[@]}"}" <<'PY'
-import json, sys
-out = sys.argv[1]
-findings = sys.argv[2:]
-runs = [{
-    "tool": {"driver": {
-        "name": "check-deps-dev",
-        "version": "1.0.0",
-        "informationUri": "https://deps.dev",
-    }},
-    "results": [
-        {
-            "ruleId": "deps-dev-advisory",
-            "level": "error",
-            "message": {"text": f},
-        }
-        for f in findings
-    ],
-}]
-with open(out, "w") as fp:
-    json.dump({"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": runs}, fp)
-print(f"SARIF written: {out}")
-PY
-fi
-
-if [[ "${#findings[@]}" -gt 0 ]]; then
-  echo "" >&2
-  echo "::error::${#findings[@]} dep(s) flagged at or above ${THRESHOLD}." >&2
-  printf '  %s\n' "${findings[@]}" >&2
-  echo "" >&2
-  echo "Document exceptions at docs/security/DEPS_DEV_EXCEPTIONS.md with expiry dates." >&2
-  exit 1
-fi
-
-echo "deps.dev validation: clean." >&2
-exit 0

package/scripts/ci/check-insecure-tls.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# =============================================================================
-# check-insecure-tls.sh — block `curl -k` / `curl --insecure` /
-# `wget --no-check-certificate` patterns from landing.
-#
-# Invoked as a pre-commit local hook (no filename args; scans the repo).
-# Extracted from `config/pre-commit-config.yaml` under #866 so the line
-# is yamllint-clean and the matcher can be tested in isolation.
-#
-# Matcher uses awk for proper tokenization (the previous inline grep
-# regex false-positive'd `-k` inside package names like `-keyring`).
-# =============================================================================
-
-set -euo pipefail
-
-ROOT="${1:-.}"
-
-# Awk body intentionally lives in a variable. The $i / $NF / FILENAME /
-# NR references inside are awk's own field/record variables — NOT shell
-# variables — so the whole body must stay literal (single-quoted). The
-# SC2016 suppression is the canonical signal to readers + linters that
-# this is intentional.
-# shellcheck disable=SC2016
-AWK_BODY='
-  # Each input line tokenized on whitespace. Flag if the line uses
-  # curl/wget and a known insecure flag appears as a standalone token.
-  {
-    has_curl = 0; has_wget = 0
-    bad = ""
-    for (i = 1; i <= NF; i++) {
-      tok = $i
-      if (tok == "curl") has_curl = 1
-      if (tok == "wget") has_wget = 1
-      if (has_curl && (tok == "-k" || tok == "--insecure" || tok ~ /^--insecure=/)) {
-        bad = tok
-      }
-      if (has_wget && (tok == "--no-check-certificate" || tok ~ /^--no-check-certificate=/)) {
-        bad = tok
-      }
-    }
-    if (bad != "") printf "%s:%d:%s\n", FILENAME, NR, bad
-  }
-'
-
-matches=$(
-  grep -rln \
-    --include='*.sh' --include='*.bash' --include='*.zsh' --include='*.tmpl' \
-    --exclude-dir='.git' \
-    --exclude='check-insecure-tls.sh' \
-    -E '\b(curl|wget)\b' \
-    "$ROOT" 2>/dev/null |
-    xargs -I{} awk "$AWK_BODY" {} 2>/dev/null
-)
-
-if [[ -n "$matches" ]]; then
-  echo "ERROR: Insecure TLS patterns found." >&2
-  echo "$matches" >&2
-  echo "Remove the flag or, if absolutely required, pin the cert and document the why." >&2
-  exit 1
-fi

package/scripts/ci/check-regression-traceability.sh

@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# =============================================================================
-# check-regression-traceability.sh — enforce a `# Regression for:` header on
-# every file under `tests/regression/`, with one of three accepted forms:
-#
-#   # Regression for: GH-1234
-#   # Regression for: <7-or-more-char-sha-prefix>
-#   # Regression for: pre-history
-#
-# The first two are required for any test introduced as part of fixing a
-# known issue or shipping a known commit. The third is an explicit "we
-# couldn't trace it" marker — still trackable, just not auto-resolvable.
-#
-# Invocation:
-#   * pre-commit local hook (files passed as args)
-#   * standalone: ./scripts/ci/check-regression-traceability.sh
-# =============================================================================
-
-set -euo pipefail
-
-PATTERN='^# *Regression for: *(GH-[0-9]+|[0-9a-f]{7,40}|pre-history)\b'
-
-check_one() {
-  local f="$1"
-  [[ -f "$f" ]] || return 0
-
-  # Only check files under tests/regression/
-  case "$f" in
-    tests/regression/*) ;;
-    */tests/regression/*) ;;
-    *) return 0 ;;
-  esac
-
-  if ! head -15 "$f" | grep -Eq "$PATTERN"; then
-    echo "MISSING trace header: $f"
-    return 1
-  fi
-}
-
-fail=0
-if [[ $# -gt 0 ]]; then
-  for f in "$@"; do
-    check_one "$f" || fail=1
-  done
-else
-  while IFS= read -r f; do
-    check_one "$f" || fail=1
-  done < <(git ls-files "tests/regression/*.sh")
-fi
-
-if [[ $fail -ne 0 ]]; then
-  cat >&2 <<'MSG'
-
-Every file under tests/regression/ must include a trace header within
-the first 15 lines, in one of these forms:
-
-  # Regression for: GH-1234            (preferred — link to GitHub issue)
-  # Regression for: <sha-prefix>       (link to introducing commit)
-  # Regression for: pre-history        (no traceable origin)
-
-Why: regressions pinned years ago without context are forensic dead-ends
-when they fire. See docs/operations/TESTING.md and #868.
-
-MSG
-  exit 1
-fi