@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/gdpr-gate/scripts/repo-scan.sh

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# gdpr-gate `--repo-scan` walker.
+#
+# Operator-initiated only — never auto-fires from /soleur:plan, /soleur:work,
+# or lefthook. Resolves the canonical regulated-data regex and the path
+# deny-list, then emits surviving candidate paths to stdout. The dispatching
+# agent reads stdout, batches 25 files per Haiku call (ADR-026 TR3), and
+# summarises findings inline.
+#
+# Defenses (named in the v2 plan §"User-Brand Impact"):
+#   D1  Path deny-list before any read           (path-denylist.txt)
+#   D2  git ls-files -c -o --exclude-standard    (no working-tree rename laundering)
+#   D3  Path-allowlist env var, two-clause typo  (GDPR_GATE_REPO_SCAN_ALLOW_PATHS)
+#       defense + CI-environment refusal         (CI + ALLOW_PATHS → exit 1)
+#   D4  Inline-only output                       (no disk persistence here)
+#   D5  Schema-only invariant                    (carried by the prompt template)
+#   D6  Symlink refusal                          (path-typed `-L` guard before stdout)
+#
+# Outputs:
+#   stdout — surviving candidate paths, one per line
+#   stderr — `# blocked: <path>` for denied paths, `# bypass: <path>` for
+#            denied-but-allow-listed paths, `# blocked: <path> (symlink)`
+#            for symlinks, plus error messages on exit 1
+
+set -euo pipefail
+LC_ALL=POSIX
+export LC_ALL
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+SKILL_MD="$SKILL_DIR/SKILL.md"
+DENYLIST_FILE="$SCRIPT_DIR/path-denylist.txt"
+
+# CI-environment refusal must trip BEFORE we touch git or read SKILL.md, so
+# misconfigured CI runbooks fail loudly at the script boundary. Empty / "0" /
+# "false" are treated as "not in CI" so a developer who explicitly exports
+# `CI=` does not silently re-enable allow-list bypass under the false belief
+# that CI-refusal protects them.
+ci_active=0
+case "${CI:-}" in
+  ""|"0"|"false"|"FALSE") ci_active=0 ;;
+  *) ci_active=1 ;;
+esac
+if (( ci_active == 1 )) && [[ -n "${GDPR_GATE_REPO_SCAN_ALLOW_PATHS:-}" ]]; then
+  echo "gdpr-gate repo-scan: allow-list bypass refused in CI environment" >&2
+  exit 1
+fi
+
+if [[ ! -f "$SKILL_MD" ]]; then
+  echo "gdpr-gate repo-scan: SKILL.md not found at $SKILL_MD" >&2
+  exit 1
+fi
+
+if [[ ! -f "$DENYLIST_FILE" ]]; then
+  echo "gdpr-gate repo-scan: deny-list not found at $DENYLIST_FILE" >&2
+  exit 1
+fi
+
+# Extract the canonical regex from SKILL.md §"Path globs (canonical)".
+# Layout: a `## Path globs (canonical)` heading, prose, then a fenced ```
+# block whose first non-blank line is the regex (starts with `^`).
+canonical_regex="$(awk '
+  /^## Path globs \(canonical\)/ { found = 1; next }
+  found && /^```/ { in_block = !in_block; next }
+  found && in_block && /^[[:space:]]*\^/ { print; exit }
+' "$SKILL_MD")"
+
+if [[ -z "$canonical_regex" ]]; then
+  echo "gdpr-gate repo-scan: canonical regex not found in SKILL.md" >&2
+  exit 1
+fi
+
+# Load deny-list patterns (skip blanks and `#` comments).
+declare -a denylist_patterns=()
+while IFS= read -r raw_line || [[ -n "$raw_line" ]]; do
+  line="${raw_line%$'\r'}"
+  [[ -z "${line// /}" ]] && continue
+  [[ "$line" =~ ^[[:space:]]*# ]] && continue
+  denylist_patterns+=("$line")
+done < "$DENYLIST_FILE"
+
+if (( ${#denylist_patterns[@]} == 0 )); then
+  echo "gdpr-gate repo-scan: deny-list is empty" >&2
+  exit 1
+fi
+
+# `path_is_denied` is the single source of truth for deny-list matching.
+# Used by both the D3 first-clause check (allow-list entries must match a
+# deny pattern) and the walker. `shopt -s nocasematch` is scoped here so
+# `.PEM` / `.KEY` files match `.pem` / `.key` patterns — defense-in-depth
+# against case-variant filenames on macOS or Windows checkouts. Importantly,
+# `nocasematch` is reset before return so it does NOT leak into `is_allowed`
+# (which uses `[[ == ]]` and must remain byte-exact for allow-list entries).
+path_is_denied() {
+  local path="$1" dp
+  shopt -s nocasematch
+  for dp in "${denylist_patterns[@]}"; do
+    if [[ "$path" =~ $dp ]]; then
+      shopt -u nocasematch
+      return 0
+    fi
+  done
+  shopt -u nocasematch
+  return 1
+}
+
+# Parse GDPR_GATE_REPO_SCAN_ALLOW_PATHS (D3 two-clause defense).
+declare -a allow_paths=()
+allow_paths_raw="${GDPR_GATE_REPO_SCAN_ALLOW_PATHS:-}"
+if [[ -n "$allow_paths_raw" ]]; then
+  IFS=':' read -ra allow_paths <<< "$allow_paths_raw"
+  for ap in "${allow_paths[@]}"; do
+    if ! path_is_denied "$ap"; then
+      echo "gdpr-gate repo-scan: bypass references non-blocked path: $ap (did you mean a path under the deny-list?)" >&2
+      exit 1
+    fi
+    if ! git ls-files -c -o --exclude-standard --error-unmatch -- "$ap" >/dev/null 2>&1; then
+      echo "gdpr-gate repo-scan: bypass references nonexistent path: $ap" >&2
+      exit 1
+    fi
+  done
+fi
+
+is_allowed() {
+  local path="$1"
+  local ap
+  for ap in "${allow_paths[@]+"${allow_paths[@]}"}"; do
+    [[ "$path" == "$ap" ]] && return 0
+  done
+  return 1
+}
+
+# Walk: candidate paths after canonical-regex filter, then deny/allow check
+# and symlink guard. `|| true` on `grep -E` keeps `pipefail` from tripping
+# when the canonical regex matches zero files (a legitimate "no regulated-
+# data paths in this repo" outcome — fail-open here is safe because the
+# downstream consumer simply receives an empty path list).
+git ls-files -c -o --exclude-standard \
+  | { grep -E "$canonical_regex" || true; } \
+  | while IFS= read -r path; do
+      if path_is_denied "$path"; then
+        if is_allowed "$path"; then
+          echo "# bypass: $path" >&2
+        else
+          echo "# blocked: $path" >&2
+        fi
+        continue
+      fi
+      # D6 symlink refusal — the deny-list cannot anticipate every link
+      # target, so we refuse symlinks unconditionally. A contributor who
+      # adds e.g. `apps/web-platform/lib/auth/foo.ts -> ../../.env` would
+      # otherwise leak the link target's content to the dispatching agent.
+      if [[ -L "$path" ]]; then
+        echo "# blocked: $path (symlink)" >&2
+        continue
+      fi
+      printf '%s\n' "$path"
+    done

package/skills/gdpr-gate/scripts/vendor-drift-classify.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# vendor-drift-classify.sh — severity classifier for an upstream content diff.
+#
+# Reads a unified diff on stdin. Optional positional args are the SHA pair
+# `<old-sha> <new-sha>` (used for rollback detection). Optional flags:
+#   --archived   exit 12 (upstream archived; signaled by drift workflow)
+#   --renamed    exit 16 (upstream renamed; signaled by drift workflow)
+#
+# Priority chain (exit-code wins go highest→lowest):
+#   15 rollback         new-sha is ancestor of old-sha
+#   12 archived         --archived flag set
+#   16 renamed          --renamed flag set
+#   11 license          diff touches a path containing LICENSE
+#   10 security         security-relevant regex hits in diff body
+#   13 batched          non-empty diff with no security signal
+#    0 no-op            empty / whitespace-only diff
+#
+# Security regex set (from plan §Phase 1.3 — additions only, hence ^\+):
+#   ^\+.*\|.*\|.*$         added markdown table row
+#   ^\+.*\[CRITICAL\]      criticality marker
+#   ^\+.*\bMUST\b          RFC-2119 normative
+#   ^\+.*Art\. [0-9]+      GDPR/CCPA article reference
+#   ^\+.*§\s*[0-9]+        section symbol
+#   ^\+\+\+ b/.*/layers/   new file under references/layers/
+#
+# Stdout contract (review #3521 — multi-category fix):
+#   For every category that matches, one line is emitted on stdout in the
+#   form `category=<name>` where <name> ∈ {rollback,archived,renamed,license,
+#   security,batched,no-op}. The workflow consumer accumulates labels from
+#   the full set, while routing (auto-PR vs issue) uses the exit code.
+#   The single-exit-code contract previously under-labeled co-occurring
+#   security + license drift.
+#
+# On unexpected argument shape the script writes to stderr and exits 2.
+
+set -euo pipefail
+
+ARCHIVED=0
+RENAMED=0
+OLD_SHA=""
+NEW_SHA=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --archived) ARCHIVED=1; shift ;;
+    --renamed)  RENAMED=1;  shift ;;
+    --) shift; break ;;
+    -*)
+      echo "vendor-drift-classify: unknown flag: $1" >&2
+      exit 2
+      ;;
+    *)
+      if [[ -z "$OLD_SHA" ]]; then
+        OLD_SHA="$1"
+      elif [[ -z "$NEW_SHA" ]]; then
+        NEW_SHA="$1"
+      else
+        echo "vendor-drift-classify: unexpected positional arg: $1" >&2
+        exit 2
+      fi
+      shift
+      ;;
+  esac
+done
+
+DIFF=$(cat)
+
+# Accumulate every matching category to stdout. Exit code retains the
+# first-match-wins priority for routing; stdout is used by the consumer for
+# label accumulation (review #3521 multi-category contract).
+exit_code=0
+
+# 1. Rollback: new-sha is an ancestor of old-sha (and not the same commit).
+if [[ -n "$OLD_SHA" && -n "$NEW_SHA" && "$OLD_SHA" != "$NEW_SHA" ]]; then
+  if git merge-base --is-ancestor "$NEW_SHA" "$OLD_SHA" 2>/dev/null; then
+    echo "category=rollback"
+    exit 15
+  fi
+fi
+
+# 2. Upstream-disambiguation flags (signaled by the workflow's gh-api step).
+if (( ARCHIVED )); then
+  echo "category=archived"
+  exit_code=12
+fi
+if (( RENAMED )); then
+  echo "category=renamed"
+  (( exit_code == 0 )) && exit_code=16
+fi
+
+# 3. LICENSE diff (basename anchored, optionally with extension). The
+# anchor prevents false-positives on paths like docs/LICENSE-DISCUSSION.md
+# or src/license_parser.py where `LICENSE` is a substring but the file is
+# not a license document.
+if grep -qE '^(\+\+\+|---) [ab]/(.*/)?LICENSE(\.[^/]+)?$' <<<"$DIFF"; then
+  echo "category=license"
+  (( exit_code == 0 )) && exit_code=11
+fi
+
+# 4. Security-relevant regex set.
+if grep -qE '^\+.*\|.*\|.*$|^\+.*\[CRITICAL\]|^\+.*\bMUST\b|^\+.*Art\. [0-9]+|^\+.*§[[:space:]]*[0-9]+|^\+\+\+ b/.*/layers/' <<<"$DIFF"; then
+  echo "category=security"
+  (( exit_code == 0 )) && exit_code=10
+fi
+
+# If any category fired (archived/renamed/license/security), exit with the
+# highest-priority code we accumulated.
+if (( exit_code != 0 )); then
+  exit "$exit_code"
+fi
+
+# 5. Batched (non-empty diff, no security signal).
+if [[ -n "$(printf '%s' "$DIFF" | tr -d '[:space:]')" ]]; then
+  echo "category=batched"
+  exit 13
+fi
+
+# 6. No-op.
+echo "category=no-op"
+exit 0

package/skills/gdpr-gate/scripts/vendor-pin-integrity.sh

@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+# vendor-pin-integrity.sh — pre-commit lefthook target (FR5, TR1).
+#
+# For each file argument: compute `git hash-object --no-filters` against the
+# working-tree contents and compare to the blob-sha pinned in NOTICE
+# frontmatter. Exit 1 on any mismatch (or on a staged file that is in neither
+# NOTICE registry — silent local addition).
+#
+# NOTE the script iterates only over its ARGUMENTS and never walks the tree,
+# so it cannot detect a reference file that is absent from both registries
+# unless lefthook happens to stage it. The symmetric-difference property
+# (disk(references/**) == lifted-files U soleur-authored) is bought by
+# plugins/soleur/test/vendor-pin-integrity.test.sh, which does walk. That is
+# the chokepoint; this script is not (#7710).
+#
+# `--no-filters` is load-bearing per TR1: skips gitattributes line-ending
+# conversion that would otherwise diverge from upstream blob SHAs on
+# Windows/CRLF setups.
+#
+# Modes:
+#   default            local pin check (per-file hash vs NOTICE local-blob-sha)
+#   --verify-upstream  for every NOTICE lifted-files record, call
+#                      `gh api repos/$UPSTREAM/contents/<upstream-path>?ref=<pinned-commit>`
+#                      and assert the returned .sha equals the record's
+#                      upstream-blob-sha. Binds path + pinned commit + blob in
+#                      one call (#8181): the pre-#8181 `git/blobs/<sha>` check
+#                      proved only that the object exists SOMEWHERE in the
+#                      upstream store, so a NOTICE pinning a real blob under
+#                      the wrong path passed while attesting content upstream
+#                      never published there. Closes the NOTICE co-edit bypass
+#                      (review #3521) — local hash + NOTICE-SHA match alone is
+#                      tautological if the PR edits both.
+#
+# Invoked from lefthook.yml (local mode) and
+# `.github/workflows/vendor-pin-verify.yml` (--verify-upstream mode).
+#
+# NOTICE_FILE env var overrides the parser's default NOTICE path so tests can
+# point at fixture frontmatter without mutating the live skill NOTICE.
+
+set -euo pipefail
+
+VERIFY_UPSTREAM=0
+ARGS=()
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --verify-upstream) VERIFY_UPSTREAM=1; shift ;;
+    --) shift; ARGS+=("$@"); break ;;
+    *) ARGS+=("$1"); shift ;;
+  esac
+done
+set -- "${ARGS[@]}"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Resolve the root with every inherited GIT_* variable stripped (by prefix, not a
+# name list). A pre-commit hook in a worktree inherits GIT_DIR, and with GIT_DIR
+# set and no GIT_WORK_TREE, `--show-toplevel` answers the -C directory itself, so
+# REPO_ROOT became this scripts dir and every staged file read as "missing from
+# working tree" (#8150, measured on a merge that staged legal-generate templates).
+_git_env_unset=()
+while IFS='=' read -r _name _; do
+  [[ "$_name" == GIT_* ]] && _git_env_unset+=(-u "$_name")
+done < <(env)
+REPO_ROOT="$(env "${_git_env_unset[@]}" git -C "$SCRIPT_DIR" rev-parse --show-toplevel)"
+PARSER="$SCRIPT_DIR/notice-frontmatter.sh"
+# SKILL_PREFIX + NOTICE_FILE env overrides parameterize the script for a
+# second vendored bundle (ADR-095 shared-engine precedent: the scripts stay
+# gdpr-gate-owned; each bundle's lefthook stanza and CI step export both).
+# The --verify-upstream arm reads only NOTICE_FILE + the NOTICE-internal
+# upstream coordinate, so it needs no SKILL_PREFIX.
+SKILL_PREFIX="${SKILL_PREFIX:-plugins/soleur/skills/gdpr-gate}"
+
+if (( VERIFY_UPSTREAM )); then
+  UPSTREAM=$(bash "$PARSER" field upstream 2>/dev/null || true)
+  if [[ -z "$UPSTREAM" ]]; then
+    echo "vendor-pin-integrity: NOTICE frontmatter missing 'upstream' field; cannot verify upstream blobs" >&2
+    exit 1
+  fi
+  # NOTICE upstream field is `github.com/<owner>/<repo>`; strip the host.
+  OWNER_REPO="${UPSTREAM#github.com/}"
+  if [[ -z "$OWNER_REPO" || "$OWNER_REPO" == "$UPSTREAM" ]]; then
+    echo "vendor-pin-integrity: NOTICE upstream field '$UPSTREAM' is not in github.com/<owner>/<repo> form" >&2
+    exit 1
+  fi
+  if ! command -v gh >/dev/null 2>&1; then
+    echo "vendor-pin-integrity: --verify-upstream requires gh CLI" >&2
+    exit 1
+  fi
+  # pinned-commit is the ref under verification. Empty or non-40-hex must
+  # fail closed — a malformed ref silently degrading to a default-branch
+  # read would attest a binding never checked (#8181).
+  PINNED_COMMIT=$(bash "$PARSER" field pinned-commit 2>/dev/null || true)
+  if [[ ! "$PINNED_COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
+    echo "vendor-pin-integrity: NOTICE pinned-commit '$PINNED_COMMIT' is missing or not a 40-hex SHA — cannot bind path/commit/blob" >&2
+    exit 1
+  fi
+  fails=0
+  checked=0
+  while IFS= read -r line; do
+    [[ -z "$line" ]] && continue
+    upstream_path="${line%%:*}"
+    upstream_sha="${line##*:}"
+    checked=$((checked + 1))
+    # The path is interpolated into the request URL's path segment —
+    # unvalidated, a NOTICE-supplied `?`/`&`/`#`/space/`%` would split the
+    # segment early and smuggle a second `ref` (or truncate the binding to
+    # whatever precedes it), attesting a path the check never read (#8185
+    # review). Repo paths are constrained to a portable charset; anything
+    # else fails closed rather than constructing a malformed request.
+    if [[ ! "$upstream_path" =~ ^[A-Za-z0-9._/-]+$ ]]; then
+      echo "vendor-pin-integrity: upstream path '$upstream_path' contains characters unsafe for URL interpolation — refusing to bind" >&2
+      fails=$((fails + 1))
+      continue
+    fi
+    # The contents endpoint binds all three fields in one answer: the PATH
+    # at the pinned COMMIT must resolve to the pinned BLOB. A 404 (path
+    # absent at that commit) yields empty actual_sha -> fail; a directory
+    # path yields a JSON array whose .sha is null -> fail. `ref` travels as
+    # a -f field so gh percent-encodes it — the pinned commit can never be
+    # re-sliced by a metacharacter in the path argument. -X GET is
+    # REQUIRED: gh api defaults to POST whenever a -f field is present, and
+    # POST on the contents endpoint 404s (measured on PR #8185 CI).
+    actual_sha=$(gh api -X GET "repos/$OWNER_REPO/contents/$upstream_path" -f "ref=$PINNED_COMMIT" --jq '.sha' 2>/dev/null || true)
+    if [[ "$actual_sha" != "$upstream_sha" ]]; then
+      echo "vendor-pin-integrity: $upstream_path at pinned-commit $PINNED_COMMIT resolves to blob '${actual_sha:-<unresolved>}' but NOTICE pins $upstream_sha — path/commit/blob binding failed" >&2
+      fails=$((fails + 1))
+    fi
+  done < <(bash "$PARSER" upstream-files)
+  # "0 checked, 0 failed" must NOT read as success — an empty lifted-files
+  # registry (or a parser that yields nothing) would otherwise print the
+  # verified message and exit 0 having verified no blob at all.
+  if (( checked == 0 )); then
+    echo "vendor-pin-integrity: NOTICE declares no lifted-files records — nothing was verified; refusing to pass vacuously" >&2
+    exit 1
+  fi
+  if (( fails > 0 )); then
+    echo "vendor-pin-integrity: $fails upstream binding(s) failed verification" >&2
+    exit 1
+  fi
+  echo "vendor-pin-integrity: all $checked NOTICE upstream-blob-sha bindings verified against $OWNER_REPO at pinned-commit ${PINNED_COMMIT:0:12}"
+  exit 0
+fi
+
+# Build expected map (rel_path → blob-sha) from NOTICE.
+#
+# TWO registries feed this map, with the same record shape and opposite
+# provenance (#7710):
+#   lifted-files    — upstream-derived, pinned against the NOTICE's declared
+#                     upstream (goSprinto MIT for gdpr-gate; General-Legal CC0
+#                     for legal-generate via the SKILL_PREFIX/NOTICE_FILE
+#                     overrides).
+#   soleur-authored — written from scratch for this plugin, no upstream.
+# Both are tamper-checked identically; only the ORIGIN map below differs, and
+# it exists so a mismatch names the list the file actually belongs to. Before
+# #7710 only `lifted-files` was consulted, so every Soleur-authored reference
+# file was rejected as a "silent local addition" and could not be committed
+# without `--no-verify` — which blocked the documented v2->v3 lifecycle of
+# `legal-consent.md`.
+declare -A EXPECTED=()
+declare -A ORIGIN=()
+while IFS= read -r line; do
+  [[ -z "$line" ]] && continue
+  rel_path="${line%%:*}"
+  sha="${line##*:}"
+  EXPECTED["$SKILL_PREFIX/$rel_path"]="$sha"
+  ORIGIN["$SKILL_PREFIX/$rel_path"]="lifted-files"
+done < <(bash "$PARSER" lifted-files)
+
+while IFS= read -r line; do
+  [[ -z "$line" ]] && continue
+  rel_path="${line%%:*}"
+  sha="${line##*:}"
+  # A path in BOTH registries is a provenance falsification, not a duplicate
+  # pin: it would attest MIT provenance for Soleur's own writing. Refuse
+  # rather than let one map silently win.
+  if [[ -n "${EXPECTED["$SKILL_PREFIX/$rel_path"]:-}" ]]; then
+    echo "vendor-pin-integrity: $SKILL_PREFIX/$rel_path appears in BOTH lifted-files and soleur-authored — provenance is ambiguous; a file is upstream-derived or Soleur-authored, never both." >&2
+    exit 1
+  fi
+  EXPECTED["$SKILL_PREFIX/$rel_path"]="$sha"
+  ORIGIN["$SKILL_PREFIX/$rel_path"]="soleur-authored"
+done < <(bash "$PARSER" soleur-authored)
+
+mismatches=0
+for f in "$@"; do
+  # Normalise to canonical repo-relative for registry lookup. `realpath -m`
+  # resolves `..` segments without requiring the file to exist (covers the
+  # synthetic-deletion case below).
+  if [[ "$f" == /* ]]; then
+    abs="$(realpath -m "$f" 2>/dev/null || echo "$f")"
+    rel="${abs#"$REPO_ROOT"/}"
+  else
+    rel="$f"
+  fi
+
+  # NOTICE itself is in the lefthook glob (any byte change should re-run the
+  # integrity gate) but is not a lifted-files registry entry. Skip the
+  # registry check for it; its content is governed by the workflow's
+  # NOTICE-bump step + reviewer eyes.
+  if [[ "$rel" == "$SKILL_PREFIX/NOTICE" ]]; then
+    continue
+  fi
+
+  expected="${EXPECTED[$rel]:-}"
+  if [[ -z "$expected" ]]; then
+    echo "vendor-pin-integrity: $rel is staged but appears in neither NOTICE lifted-files nor soleur-authored — silent local addition? Add it to lifted-files if it is vendored from upstream, or to soleur-authored if it is written for this plugin, or remove the file." >&2
+    mismatches=$((mismatches + 1))
+    continue
+  fi
+
+  if [[ ! -f "$REPO_ROOT/$rel" ]]; then
+    echo "vendor-pin-integrity: $rel listed in NOTICE but missing from working tree" >&2
+    mismatches=$((mismatches + 1))
+    continue
+  fi
+
+  actual="$(git hash-object --no-filters "$REPO_ROOT/$rel")"
+  if [[ "$actual" != "$expected" ]]; then
+    # Name the list the file belongs to AND a mechanism that exists. The
+    # previous text sent a blocked contributor to "the vendor-drift
+    # workflow", deleted in #4483 — the only exit offered at the moment
+    # their commit is refused, and a dead end.
+    origin="${ORIGIN[$rel]:-lifted-files}"
+    echo "vendor-pin-integrity: BLOB SHA mismatch on $rel (registry $origin: expected $expected, got $actual)." >&2
+    if [[ "$origin" == "soleur-authored" ]]; then
+      echo "  This file is Soleur-authored, so editing it is expected. Update its local-blob-sha in the soleur-authored block of $SKILL_PREFIX/NOTICE to: $actual" >&2
+    else
+      echo "  This file is vendored from upstream. Either revert the local edit, or — if this is a deliberate re-vendor — update its local-blob-sha in the lifted-files block of $SKILL_PREFIX/NOTICE to: $actual and record the upstream delta in the NOTICE table." >&2
+    fi
+    mismatches=$((mismatches + 1))
+  fi
+done
+
+if (( mismatches > 0 )); then
+  exit 1
+fi
+
+exit 0