@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/gdpr-gate/scripts/gdpr-gate.sh

@@ -0,0 +1,271 @@
+#!/usr/bin/env bash
+# gdpr-gate advisory pre-commit hook (lefthook).
+#
+# Always exits 0 — the hook is advisory, never blocking. Blocking enforcement
+# lives in /soleur:ship Phase 5.5 (post-PR). This hook prints a one-line
+# stderr breadcrumb when staged paths match the canonical regulated-data
+# regex (single source of truth: SKILL.md §"Path globs (canonical)").
+#
+# Telemetry: emits, via .claude/hooks/lib/incidents.sh, an
+# `hr-gdpr-gate-on-regulated-data-surfaces` event when a regulated-data path
+# is touched, plus `gdpr-gate-staleness` and `gdpr-gate-cron-binding` events
+# for the corpus-freshness signals. Telemetry survives even when the
+# operator's terminal swallows stderr.
+#
+# This block previously documented a `gdpr-gate-touch` event. No such event
+# has ever been emitted by this file (#7710). The name was corrected rather
+# than the emit: `hr-gdpr-gate-on-regulated-data-surfaces` is the rule this
+# gate enforces, and it is accepted by the incident allow-list via the
+# closed-corpus arm of `_valid_rule` (it is a real `[id: ...]` in
+# AGENTS.rules.md), not via the synthetic `gdpr-gate-*` prefix arm.
+#
+# Invoked from lefthook.yml:
+#   gdpr-gate-advisory:
+#     priority: 6
+#     run: bash plugins/soleur/skills/gdpr-gate/scripts/gdpr-gate.sh {staged_files}
+
+set -euo pipefail
+
+# Refuse to run under `set -x` while a live credential is in the environment
+# (#7797). An xtrace of this script echoes every expansion, and the token would
+# land in whatever captured that trace — a CI log, a `bash -x` debugging
+# session, a pasted transcript. Placed immediately after `set` so nothing
+# credential-bearing executes ahead of it.
+case "$-" in
+  *x*)
+    if [ -n "${GH_TOKEN:+x}${GITHUB_TOKEN:+x}" ]; then
+      printf '[FATAL] refusing to trace with a live credential set (see #7797)\n' >&2
+      exit 78
+    fi
+    ;;
+esac
+
+
+# REPO_ROOT was REMOVED here (#7450 round-2 review). After `NOTICE_PARSER` moved to
+# $BASH_SOURCE-relative resolution it had ZERO remaining expansions, leaving a bare
+# `git rev-parse --show-toplevel` as the only statement in this file that could abort the
+# run: it sits under `set -euo pipefail`, and this gate is documented at the top as
+# "always exits 0 ... never blocking". It fails on a non-repo CWD, a broken .git worktree
+# pointer, or a `safe.directory` ownership refusal — all routine on a fresh install or a
+# container mount — and would have aborted the operator's `git commit` via lefthook.
+
+# Source telemetry helper if present. Downstream installs of the Soleur plugin
+# may not ship .claude/hooks/lib/incidents.sh — preserve the always-exit-0
+# advisory contract by no-op'ing emit_incident in that case rather than
+# letting `set -e` abort before the breadcrumb.
+#
+# CODE ROOT, not a data root (#7450; ADR-179's classification). This path gets
+# SOURCED, so it executes in THIS shell — and it must therefore never be derived
+# from `git rev-parse --show-toplevel`, which on the review path resolves to the
+# contributor's checked-out tree. `review/SKILL.md` instructs `gh pr checkout`,
+# and this script is itself a compliance gate, so a same-named file in a hostile
+# PR would run with the gate's authority. CLAUDE_PROJECT_DIR is supplied by the
+# harness rather than by the tree under review.
+#
+# There is no `REPO_ROOT` in this file any more (see above). Two successive revisions of
+# this comment were wrong about it, and both are recorded because the second was written
+# to correct the first:
+#   1. It first claimed every remaining `REPO_ROOT` use was a data-root read. FALSE —
+#      `NOTICE_PARSER` below is EXECUTED (a code root by this ADR's classification) and was
+#      resolved from it, with `GH_TOKEN` exported into the child. On the review path that
+#      handed a GitHub token to a contributor-supplied script from inside the compliance
+#      gate, in the very file edited to remove that vector.
+#   2. The correction then claimed `REPO_ROOT` "stays for data-root reads". Also FALSE —
+#      once `NOTICE_PARSER` moved to $BASH_SOURCE-relative there were no reads left at all,
+#      so the assignment was dead code that could still abort the operator's commit.
+# Resolution, in trust order, and NEVER from `git rev-parse --show-toplevel`:
+#   1. CLAUDE_PROJECT_DIR — supplied by the harness, not by the tree under review.
+#      Measured 2026-08-12: unset in a plain Claude Code session and in git hooks,
+#      so it cannot be the ONLY arm without silently retiring this telemetry.
+#   2. This script's OWN location. Layout-invariant per ADR-178, and crucially NOT
+#      CWD-derived: a `gh pr checkout` cannot redirect it, because by the time this
+#      line runs the anchor decision has already been made — if a hostile script
+#      were executing, sourcing its sibling lib adds nothing. On a plugin INSTALL
+#      the walk lands somewhere with no such lib, so it no-ops, which is correct.
+# The `-f` test is the safety net for both arms: a wrong root simply no-ops.
+_incidents_root="${CLAUDE_PROJECT_DIR:-$(cd -P "$(dirname "${BASH_SOURCE[0]}")/../../../../.." 2>/dev/null && pwd -P)}"
+INCIDENTS_LIB="${_incidents_root:+${_incidents_root}/.claude/hooks/lib/incidents.sh}"
+if [[ -n "$INCIDENTS_LIB" && -f "$INCIDENTS_LIB" ]]; then
+  # shellcheck source=/dev/null
+  source "$INCIDENTS_LIB"
+else
+  emit_incident() { :; }
+fi
+
+# Runtime staleness check (FR6 / TR2 / TR6).
+#
+# The gdpr-gate skill is partially driven by detection rules lifted from
+# upstream gosprinto/compliance-skills (see plugins/soleur/skills/gdpr-gate/NOTICE).
+# When the cron-driven re-vendor pipeline silently breaks (workflow disabled,
+# GH outage, PR queued), the lifted rules go stale and the gate's
+# "no findings" output becomes a false-clean signal on regulated PRs.
+# The runtime banner is the load-bearing user-protection layer in that case.
+#
+# Banner emits to STDOUT (not stderr) — agent runtimes commonly swallow stderr.
+# Gate exits 0 in all paths (advisory contract preserved).
+# Subshell-exec (not source) so parser failure / deletion / future date all
+# resolve to days_stale=999 → banner fires → gate stays advisory.
+#
+# Trust-binding (#3535): invoke parser twice and compute MIN in the caller
+# frame. NOTICE last-verified is operator-controlled (a PR can backdate it);
+# the content-vendor-drift cron's run timestamp is not. Taking the MIN ensures
+# a fresh-looking last-verified cannot suppress a stale-cron banner.
+# NOTICE_FILE and GH_TOKEN propagate explicitly — Bash subshell-exec does NOT
+# inherit them otherwise. Operator-attested-mode banner fires only when the
+# cron binding is unavailable AND last-verified is parseable — when both are
+# 999 the existing 30d/90d banners cover the case.
+#
+# The cron half of this binding was inert from the Inngest migration until
+# #7255 fixed the probe: `cron_days_stale` then resolved to 999 on every call
+# because the query targeted a deleted GHA workflow, and the MIN below was
+# always MIN(notice, 999) == notice — the fail-safe direction, which is why
+# it went unnoticed. The probe now reads the check's own GitHub artifact
+# (the `ci/vendor-attest-*` PR the cron writes each run — see the DATA SOURCE
+# comment in `notice-frontmatter.sh` `cmd_cron_run_stale`), so the
+# anti-backdating property described above is in force again whenever a
+# token is present.
+# SIBLING of this script, so it needs no root at all: `$BASH_SOURCE`-relative is
+# layout-invariant (ADR-178) and leaves NO operand for a checked-out tree to shadow —
+# strictly better here than any root-anchored form, including CLAUDE_PROJECT_DIR.
+# It was `"$REPO_ROOT/plugins/soleur/…"` (i.e. `git rev-parse --show-toplevel`) until
+# #7450 review: EXECUTED below, three times, once with GH_TOKEN exported to the child.
+NOTICE_PARSER="$(cd -P "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd -P)/notice-frontmatter.sh"
+notice_days_stale=$(NOTICE_FILE="${NOTICE_FILE:-}" \
+  bash "$NOTICE_PARSER" days-stale 2>/dev/null || echo 999)
+cron_days_stale=$(NOTICE_FILE="${NOTICE_FILE:-}" \
+  GH_TOKEN="${GH_TOKEN:-${GITHUB_TOKEN:-}}" \
+  bash "$NOTICE_PARSER" cron-run-stale 2>/dev/null || echo 999)
+
+# MIN-of-both compute (caller frame — Bash env exports drop across the
+# subshell-exec boundary, so the comparison must live here).
+if [[ "$cron_days_stale" != "999" && "$notice_days_stale" != "999" ]]; then
+  if (( cron_days_stale < notice_days_stale )); then
+    days_stale="$cron_days_stale"
+    emit_incident gdpr-gate-cron-binding min-wins \
+      "cron=${cron_days_stale} notice=${notice_days_stale}" \
+      2>/dev/null || true
+  else
+    days_stale="$notice_days_stale"
+    emit_incident gdpr-gate-cron-binding applied \
+      "cron=${cron_days_stale} notice=${notice_days_stale}" \
+      2>/dev/null || true
+  fi
+elif [[ "$cron_days_stale" != "999" ]]; then
+  days_stale="$cron_days_stale"
+  emit_incident gdpr-gate-cron-binding applied \
+    "cron-only=${cron_days_stale}" 2>/dev/null || true
+else
+  days_stale="$notice_days_stale"
+fi
+
+last_verified=$(NOTICE_FILE="${NOTICE_FILE:-}" \
+  bash "$NOTICE_PARSER" field last-verified 2>/dev/null || echo "unknown")
+[[ -n "$last_verified" ]] || last_verified="unknown"
+if (( days_stale > 30 )); then
+  printf '⚠ gdpr-gate rules %s days stale (last verified %s) — output is advisory only and may miss recently-patched detection rules. Refresh: see "Corpus freshness" in this skill'"'"'s SKILL.md.\n' \
+    "$days_stale" "$last_verified"
+  emit_incident gdpr-gate-staleness warn "${days_stale}-days-stale" \
+    2>/dev/null || true
+fi
+if (( days_stale > 90 )); then
+  printf 'POSTURE_FAIL: gdpr-gate rules >90 days stale — compliance/critical posture row required. Operator chain: see "POSTURE_FAIL operator chain" in this skill'"'"'s SKILL.md.\n'
+  emit_incident gdpr-gate-staleness deny "${days_stale}-days-stale-posture-fail" \
+    2>/dev/null || true
+fi
+
+# Single source of truth — mirrors SKILL.md §"Path globs (canonical)".
+CANONICAL_REGEX='^(apps/web-platform/supabase/migrations/|apps/web-platform/lib/auth/|apps/web-platform/server/.*auth.*\.(ts|tsx|js)|apps/web-platform/app/api/.*\.(ts|tsx)$|.*\.sql$)'
+
+matched=()
+examined=0
+# DEDUPE BY PATH. lefthook passes a path once PER MATCHING GLOB, not once per
+# staged file, and the `gdpr-gate-advisory` stanza carries overlapping globs by
+# construction: in gobwas a single `*` CROSSES `/`, so
+# `apps/web-platform/lib/auth/*.ts` already matches a nested file that
+# `apps/web-platform/lib/auth/**/*.ts` also matches, and bare `*.sql` already
+# matches `apps/web-platform/supabase/migrations/*.sql`.
+#
+# Measured against real lefthook 2 on the real stanza's shape: three staged
+# files — one SQL migration, one nested auth module, one nested API route —
+# arrive as SIX arguments. The two most common regulated shapes in this repo
+# are therefore ALWAYS doubled, so the un-deduped line told a customer who
+# staged one migration that two paths were examined. That is the wrong number
+# on the one artifact this change exists to produce.
+#
+# Deduping HERE rather than by trimming the glob list is deliberate: the
+# script must report what it examined whatever it is handed, and a future
+# overlapping glob must not be able to re-break the count. `seen` is keyed on
+# the literal argument, so a genuine repeat on one command line collapses too
+# — which is correct, it is the same file.
+declare -A _gdpr_seen=()
+for f in "$@"; do
+  [[ -n "${_gdpr_seen[$f]+x}" ]] && continue
+  _gdpr_seen["$f"]=1
+  examined=$((examined + 1))
+  if [[ "$f" =~ $CANONICAL_REGEX ]]; then
+    matched+=("$f")
+  fi
+done
+
+# Scan-completion line (#7710). UNCONDITIONAL and AFTER the loop, reporting
+# what the loop actually counted.
+#
+# Before this line existed, "the scan ran and matched nothing" and "the scan
+# never ran" produced byte-identical output — nothing at all. On a corpus
+# past the 90-day threshold the gate printed a staleness banner and a
+# POSTURE_FAIL and no evidence that any path had been examined, so the
+# refusal read as the whole output and a reader could not tell a healthy
+# no-findings scan from a gate that never looked. That is the defect #7710
+# reported, and it is why this line must NOT be gated on
+# `${#matched[@]} > 0`: the zero-match case is precisely the state the
+# property forbids being silent about.
+#
+# STDOUT, because agent runtimes commonly swallow stderr — the same reason
+# the staleness banners are on stdout. The path-naming breadcrumb below stays
+# on stderr.
+#
+# COUNTS ONLY, never path names: this line goes to a customer's terminal, and
+# path structure is third-party-content-adjacent
+# (hr-third-party-content-grep-on-undertaking; #7331 is the live scar). The
+# stderr breadcrumb already names paths for the local operator.
+#
+# It carries neither `days stale` nor `POSTURE_FAIL`, so its presence is
+# independent of the corpus's freshness state. That independence is the
+# point: the evidence that a scan occurred must not be entangled with the
+# age of the rules the scan used. It also keeps the existing negative
+# assertions on those two strings able to witness a banner regression.
+printf 'gdpr-gate: path scan complete — %d examined, %d matched\n' \
+  "$examined" "${#matched[@]}"
+
+if (( ${#matched[@]} > 0 )); then
+  echo "gdpr-gate: regulated-data path touched (${matched[*]}); run /soleur:gdpr-gate" >&2
+  emit_incident hr-gdpr-gate-on-regulated-data-surfaces applied \
+    "regulated-data path touched: ${matched[0]}" 2>/dev/null || true
+
+  # Operator-attested-mode banner — fires ONLY when (a) a regulated path is
+  # being judged this commit AND (b) the cron binding is unavailable but
+  # NOTICE last-verified is parseable.
+  #
+  # The #3541 relevance property is real, but this conditional is not what
+  # delivers it, and the previous wording here was false (#7710). It claimed
+  # that without the matched-path gate the banner "would fire on every
+  # commit". It would not: lefthook invokes this script only when a staged
+  # path matches the `gdpr-gate-advisory` glob, so on the pre-commit path
+  # relevance is already bought by the glob and this conditional is a second,
+  # narrower filter over an already-filtered set.
+  #
+  # What the conditional actually buys is relevance on the paths the glob does
+  # NOT gate: direct invocation, the CI self-test, and `/soleur:gdpr-gate`,
+  # where arbitrary arguments reach the script. That is a real property and
+  # worth keeping — it is simply a different one from the claim it replaced.
+  #
+  # Banner literal is load-bearing: the self-test asserts it verbatim. See
+  # review finding from user-impact-reviewer #3541.
+  if [[ "$cron_days_stale" == "999" && "$notice_days_stale" != "999" ]]; then
+    printf 'ℹ gdpr-gate: operator-attested mode (no GH_TOKEN available — cron-run timestamp unverified, falling back to NOTICE last-verified)\n'
+    emit_incident gdpr-gate-cron-binding unavailable \
+      "no-token-or-gh-cli" 2>/dev/null || true
+  fi
+fi
+
+exit 0

package/skills/gdpr-gate/scripts/notice-frontmatter.sh

@@ -0,0 +1,337 @@
+#!/usr/bin/env bash
+# notice-frontmatter.sh — pure-bash parser for the NOTICE YAML frontmatter.
+#
+# Subcommands:
+#   field <name>      Print scalar value (upstream, pinned-commit,
+#                     last-verified, registry).
+#   days-stale        Integer days since last-verified. Future date / parse
+#                     fail / missing frontmatter all return 999 (treat as
+#                     stale immediately, per plan TR2 + SpecFlow P1.5).
+#                     Always exits 0 — the gdpr-gate hook subshell-execs this
+#                     and depends on the always-exit-0 advisory contract.
+#   cron-run-stale    Integer days since the content-vendor-drift check last
+#                     produced its attestation artifact — the weekly
+#                     `ci/vendor-attest-*` PR the Inngest cron writes on every
+#                     completed run (ADR-203), read via `gh pr list --search
+#                     head:ci/vendor-attest`. 999 on any failure mode (no
+#                     GH_TOKEN, no gh CLI, network blocked, empty result,
+#                     malformed timestamp, timeout). The `gdpr-gate.sh` caller
+#                     computes MIN(days-stale, cron-run-stale) to defend
+#                     against a backdated last-verified field (issue #3535).
+#   lifted-files      One `<path>:<local-blob-sha>` per line. Local blob SHAs
+#                     pin the file as it exists in this repo (post-attribution
+#                     header) and are consumed by `vendor-pin-integrity.sh`.
+#   soleur-authored   One `<path>:<local-blob-sha>` per line, for the reference
+#                     files written from scratch for this plugin. Same record
+#                     shape and same consumer as `lifted-files`, but no
+#                     upstream provenance: these never appear in
+#                     `upstream-files`. Pinning them keeps a tamper check on
+#                     the files the gate's own GDPR framing depends on while
+#                     leaving them editable through the normal update-the-pin
+#                     flow (#7710).
+#   record-count <block>
+#                     Integer count of `- path:` records DECLARED in the named
+#                     block, regardless of whether each record is complete.
+#
+#                     This exists because every other view here is a FILTERED
+#                     projection: `_emit_files` flushes a record only when BOTH
+#                     its path key and its sha key are non-empty, so a record
+#                     that loses `upstream-blob-sha` is silently absent from
+#                     `upstream-files`. A consumer that derives "how many files
+#                     should I have compared?" from that view is comparing the
+#                     parser's output against itself — the denominator shrinks
+#                     with the numerator and a partial comparison reads as
+#                     complete (#7710 review). `record-count` is the
+#                     unfiltered denominator.
+#   upstream-files    One `<upstream-path>:<upstream-blob-sha>` per line.
+#                     Upstream blob SHAs pin the file as it exists at
+#                     `pinned-commit` and are consumed by the drift workflow.
+#
+# NOTICE location: $NOTICE_FILE if set, else <script-dir>/../NOTICE.
+#
+# `set -euo pipefail` is internal; subcommand wrappers catch failures so the
+# caller (`gdpr-gate.sh`) can `bash notice-frontmatter.sh days-stale 2>/dev/null
+# || echo 999` without aborting the gate on parser death.
+#
+# TR2: target p95 <50ms over 100 invocations of `days-stale`.
+
+set -euo pipefail
+
+# Refuse to run under `set -x` while a live credential is in the environment
+# (#7797). An xtrace of this script echoes every expansion, and the token would
+# land in whatever captured that trace — a CI log, a `bash -x` debugging
+# session, a pasted transcript. Placed immediately after `set` so nothing
+# credential-bearing executes ahead of it.
+case "$-" in
+  *x*)
+    if [ -n "${GH_TOKEN:+x}${GITHUB_TOKEN:+x}" ]; then
+      printf '[FATAL] refusing to trace with a live credential set (see #7797)\n' >&2
+      exit 78
+    fi
+    ;;
+esac
+
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NOTICE_FILE="${NOTICE_FILE:-$SCRIPT_DIR/../NOTICE}"
+
+# Print only the YAML body between the first two `---` lines.
+# Returns empty + exit 1 if no frontmatter.
+extract_frontmatter() {
+  [[ -f "$NOTICE_FILE" ]] || return 1
+  awk '
+    BEGIN { count=0; in_fm=0 }
+    /^---[[:space:]]*$/ {
+      count++
+      if (count == 1) { in_fm = 1; next }
+      if (count == 2) { in_fm = 0; exit }
+    }
+    in_fm { print }
+    END { if (count < 2) exit 1 }
+  ' "$NOTICE_FILE"
+}
+
+cmd_field() {
+  local name="$1"
+  local fm
+  fm=$(extract_frontmatter) || return 1
+  [[ -n "$fm" ]] || return 1
+  # Match top-level scalar lines (`<name>: <value>`); skip indented (nested).
+  printf '%s\n' "$fm" | awk -v key="$name" '
+    /^[[:space:]]/ { next }
+    {
+      idx = index($0, ":")
+      if (idx == 0) next
+      k = substr($0, 1, idx - 1)
+      v = substr($0, idx + 1)
+      sub(/^[[:space:]]+/, "", v)
+      sub(/[[:space:]]+$/, "", v)
+      if (k == key) { print v; exit }
+    }
+  '
+}
+
+cmd_days_stale() {
+  local last_verified last_epoch today_epoch days
+  last_verified=$(cmd_field last-verified 2>/dev/null) || { echo 999; return 0; }
+  [[ -n "$last_verified" ]] || { echo 999; return 0; }
+  # Strict ISO-8601 date guard. `date -d` otherwise accepts "now",
+  # "yesterday", etc., letting a malicious NOTICE PR set last-verified to
+  # any natural-language value and pin days-stale at 0 forever.
+  [[ "$last_verified" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]] || { echo 999; return 0; }
+  # Anchor to UTC midnight so the comparison against `date -u +%s` is
+  # consistent across timezones (otherwise a UTC+12 host computes a day
+  # off the UTC-anchored today_epoch).
+  last_epoch=$(date -u -d "${last_verified}T00:00:00Z" +%s 2>/dev/null) || { echo 999; return 0; }
+  today_epoch=$(date -u +%s)
+  days=$(( (today_epoch - last_epoch) / 86400 ))
+  # Future date → treat as stale immediately (per SpecFlow P1.5).
+  if (( days < 0 )); then
+    echo 999
+  else
+    echo "$days"
+  fi
+}
+
+_emit_files() {
+  # Args: $1 = block-key ("lifted-files" | "soleur-authored"), $2 = path-key
+  # ("path" | "upstream-path"), $3 = sha-key ("local-blob-sha" |
+  # "upstream-blob-sha"). Walks the named block and prints
+  # `<path-value>:<sha-value>` per entry.
+  #
+  # The block key is a parameter rather than a literal because the registry
+  # has TWO lists with the same record shape and opposite provenance
+  # (#7710): upstream-derived files in `lifted-files`, Soleur-authored files
+  # in `soleur-authored`. Both are pinned by `local-blob-sha` and both are
+  # checked by vendor-pin-integrity.sh; only the former carries an upstream
+  # SHA, so only the former is a valid input to `upstream-files`.
+  local block_key="$1"
+  local path_key="$2"
+  local sha_key="$3"
+  local fm
+  fm=$(extract_frontmatter) || return 0
+  [[ -n "$fm" ]] || return 0
+  printf '%s\n' "$fm" | awk -v block_key="$block_key" -v path_key="$path_key" -v sha_key="$sha_key" '
+    BEGIN { in_block=0; cur_path=""; cur_sha="" }
+    $0 ~ "^" block_key ":[[:space:]]*$" { in_block=1; next }
+    /^[A-Za-z]/ { in_block=0 }
+    in_block {
+      line = $0
+      sub(/^[[:space:]]+/, "", line)
+      n = split(line, tok, /[[:space:]]+/)
+      # New entry sentinel: `- path: <value>` always opens a record. Flush
+      # the previous record before starting the new one.
+      # Normalize `key : value` (YAML-legal space-before-colon) to `key:`.
+      # Without this, tok[1] is the bare key and tok[2] is `:`, silently
+      # dropping the entry from the registry view.
+      sub(/[[:space:]]+:[[:space:]]+/, ": ", line)
+      n = split(line, tok, /[[:space:]]+/)
+      if (n >= 3 && tok[1] == "-" && tok[2] == "path:") {
+        if (cur_path != "" && cur_sha != "") print cur_path ":" cur_sha
+        cur_path = ""
+        cur_sha = ""
+        if (path_key == "path") cur_path = tok[3]
+      } else if (n >= 2 && tok[1] == path_key ":") {
+        # tok layout for `path:` and `upstream-path:` lines without leading dash.
+        cur_path = tok[2]
+      } else if (n >= 2 && tok[1] == sha_key ":") {
+        cur_sha = tok[2]
+      }
+    }
+    END {
+      if (cur_path != "" && cur_sha != "") print cur_path ":" cur_sha
+    }
+  '
+}
+
+cmd_cron_run_stale() {
+  # Days since the content-vendor-drift check last produced its attestation
+  # artifact. Always exits 0 — any failure mode (no token, no gh, network
+  # blocked, empty result, malformed timestamp, non-zero clock skew) resolves
+  # to 999 so the caller's subshell-exec contract holds. Wrap the network call
+  # with `timeout 5s` to bound the runtime-banner wall clock.
+  #
+  # DATA SOURCE (#7255). The check is the Inngest cron
+  # `apps/web-platform/server/inngest/functions/cron-content-vendor-drift.ts`
+  # — it has no GitHub Actions run, so a `gh run list` query can never see it
+  # (that is exactly how this probe once went dead at 999 with nobody
+  # noticing). What the run DOES leave behind on every completed execution is
+  # a GitHub artifact: the self-merging attestation PR on head branch
+  # `ci/vendor-attest-*` (`ATTEST_BRANCH_PREFIX` in the function file;
+  # ADR-203's unchanged-attestation machinery creates one even when zero
+  # files drift). "Days since the newest such PR was CREATED" is the honest
+  # "days since the check last ran to completion" — PR creation is the run's
+  # output, whereas mergedAt lags days behind the run and is unrelated to
+  # cron health.
+  #
+  # Query notes, both measured: `--state all` is load-bearing (the search
+  # treats merged/closed PRs correctly; a `--state merged` variant of this
+  # same query returned empty while the merged attest PR exists); and the
+  # `max` aggregation over `--limit 10` removes any dependence on
+  # search-result ordering. If this job's artifact moves again — new branch
+  # prefix, different substrate — the probe goes back to 999; the
+  # `TS-cron-argv` case in the notice-frontmatter suites pins the query shape
+  # so that regression is loud.
+  local token raw ts cron_epoch today_epoch days
+  token="${GH_TOKEN:-${GITHUB_TOKEN:-}}"
+  [[ -n "$token" ]] || { echo 999; return 0; }
+  command -v gh >/dev/null 2>&1 || { echo 999; return 0; }
+  # `// empty` collapses the empty result set to empty string.
+  # Belt-and-suspenders with the strict-ISO regex below — a softened guard
+  # alone would silently slip a null through.
+  raw=$(GH_TOKEN="$token" timeout 5s gh pr list \
+          --search "head:ci/vendor-attest" --state all --limit 10 \
+          --json createdAt --jq '[.[].createdAt] | max // empty' \
+          2>/dev/null) || { echo 999; return 0; }
+  ts="${raw%%[[:space:]]*}"
+  [[ -n "$ts" ]] || { echo 999; return 0; }
+  [[ "$ts" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]] \
+    || { echo 999; return 0; }
+  cron_epoch=$(date -u -d "$ts" +%s 2>/dev/null) || { echo 999; return 0; }
+  today_epoch=$(date -u +%s)
+  days=$(( (today_epoch - cron_epoch) / 86400 ))
+  if (( days < 0 )); then echo 999; else echo "$days"; fi
+}
+
+cmd_lifted_files() {
+  _emit_files lifted-files path local-blob-sha
+}
+
+cmd_upstream_files() {
+  _emit_files lifted-files upstream-path upstream-blob-sha
+}
+
+cmd_record_count() {
+  # Count `- path:` record openers in the named block. Deliberately does NOT
+  # require the record to be complete: the whole point is to expose records
+  # that the filtered views drop.
+  local block_key="${1:-lifted-files}"
+  local fm
+  fm=$(extract_frontmatter) || { echo 0; return 0; }
+  [[ -n "$fm" ]] || { echo 0; return 0; }
+  printf '%s\n' "$fm" | awk -v block_key="$block_key" '
+    BEGIN { in_block=0; n=0 }
+    $0 ~ "^" block_key ":[[:space:]]*$" { in_block=1; next }
+    /^[A-Za-z]/ { in_block=0 }
+    in_block {
+      line = $0
+      sub(/^[[:space:]]+/, "", line)
+      sub(/[[:space:]]+:[[:space:]]+/, ": ", line)
+      n_tok = split(line, tok, /[[:space:]]+/)
+      if (n_tok >= 3 && tok[1] == "-" && tok[2] == "path:") n++
+    }
+    END { print n+0 }
+  '
+}
+
+cmd_key_count() {
+  # Count occurrences of a KEY inside the named block, independent of record
+  # boundaries.
+  #
+  # This exists as a SECOND, differently-derived view of the registry's size.
+  # `record-count` counts `- path:` openers, so it shares its record-opener
+  # predicate with `_emit_files` — which means deleting an OPENER line shrinks
+  # both views together and a completeness check comparing them holds while a
+  # record was silently absorbed into its predecessor (measured: declared 7,
+  # emitted 7, one record lost, #7710 review). Counting a key that every record
+  # carries but the opener predicate does NOT consume breaks that coupling.
+  local block_key="${1:-lifted-files}"
+  local want_key="${2:-status}"
+  local fm
+  fm=$(extract_frontmatter) || { echo 0; return 0; }
+  [[ -n "$fm" ]] || { echo 0; return 0; }
+  printf '%s\n' "$fm" | awk -v block_key="$block_key" -v want_key="$want_key" '
+    BEGIN { in_block=0; n=0 }
+    $0 ~ "^" block_key ":[[:space:]]*$" { in_block=1; next }
+    /^[A-Za-z]/ { in_block=0 }
+    in_block {
+      line = $0
+      sub(/^[[:space:]]+/, "", line)
+      sub(/[[:space:]]+:[[:space:]]+/, ": ", line)
+      split(line, tok, /[[:space:]]+/)
+      if (tok[1] == want_key ":") n++
+    }
+    END { print n+0 }
+  '
+}
+
+cmd_soleur_authored() {
+  # Soleur-authored reference files. These are NOT upstream-derived, so they
+  # carry a `local-blob-sha` only and never appear in `upstream-files` — a
+  # `lifted-files` row for one of them would attest goSprinto MIT provenance
+  # for Soleur's own writing, falsifying provenance in both directions.
+  _emit_files soleur-authored path local-blob-sha
+}
+
+case "${1:-}" in
+  field)
+    cmd_field "${2:-}" || true
+    ;;
+  days-stale)
+    cmd_days_stale
+    ;;
+  cron-run-stale)
+    cmd_cron_run_stale
+    ;;
+  lifted-files)
+    cmd_lifted_files
+    ;;
+  soleur-authored)
+    cmd_soleur_authored
+    ;;
+  record-count)
+    cmd_record_count "${2:-lifted-files}"
+    ;;
+  key-count)
+    cmd_key_count "${2:-lifted-files}" "${3:-status}"
+    ;;
+  upstream-files)
+    cmd_upstream_files
+    ;;
+  *)
+    echo "Usage: $0 {field <name>|days-stale|cron-run-stale|lifted-files|soleur-authored|upstream-files|record-count [block]|key-count [block] [key]}" >&2
+    exit 2
+    ;;
+esac
+
+exit 0

package/skills/gdpr-gate/scripts/path-denylist.txt

@@ -0,0 +1,39 @@
+# gdpr-gate `--repo-scan` path deny-list.
+#
+# Single source of truth for paths the repo-scan walker MUST NOT read or
+# forward to the model. Every pattern below is a bash `[[ =~ ]]` extended
+# regex — NOT a shell glob. Patterns that look like globs (e.g. `*.pem`)
+# silently fail to match.
+#
+# `repo-scan.sh` sets `LC_ALL=POSIX` for locale-determinism, but contributors
+# editing patterns should still verify on both Linux and macOS — character
+# classes for non-ASCII bytes still differ between bash builds.
+#
+# Format:
+#   - One pattern per line.
+#   - `#` lines are comments. Blank lines ignored.
+#   - Patterns are matched against the path as `git ls-files` reports it
+#     (relative to the repo root, forward-slash-separated, no leading `./`).
+#
+# v2 surface (7 patterns, verified at plan-write time per AC-DENYLIST-2):
+#   1. .env* / .envrc at any depth — NFR-014 explicit. Pattern covers
+#                                   `.env`, `.env.local`, `.env.production`,
+#                                   `.envrc` (direnv files often hold
+#                                   `export KEY=...` lines).
+#   2. secrets/ at any depth       — defense-in-depth; intent-driven name.
+#   3. .pem / .key / .crt / etc.   — defense-in-depth; private-key shapes.
+#                                   Matched case-insensitively by repo-scan.sh
+#                                   (`shopt -s nocasematch`) so `.PEM`/`.KEY`
+#                                   filenames are also blocked.
+#   4. test snapshot/golden dirs   — realistic-shape fixtures.
+#   5. web-platform test fixtures  — known fixture root.
+#   6. skill reference catalogues  — gate's own layer files.
+#   7. plan / spec markdown        — design docs, not regulated data.
+
+(^|/)\.env(\.[^/]*|rc)?$
+(^|/)secrets/
+\.(pem|key|crt|p8|pfx|jks|keystore|asc|ppk)$
+(^|/)__synthesized__/|(^|/)__goldens__/|(^|/)__snapshots__/|\.snap$
+^apps/web-platform/test/fixtures/
+^plugins/soleur/skills/[^/]+/references/
+^knowledge-base/(project/)?(plans|specs)/.*\.md$