@techgoblin/gobstack 0.0.0-stage → 0.4.4-beta.1

package/templates/goblin.yaml.tmpl

@@ -0,0 +1,138 @@
+# .goblin/goblin.yaml — the project config. Generated once by goblin-install, then YOURS.
+# It is never overwritten after the first install: edit it in place.
+#
+# Format: a flat, line-oriented YAML subset, parsed by .goblin/bin/goblin-lib.sh. No YAML
+# library, no network, no npm. Keep one key per line and keep comments on their own line.
+
+# Which class this project is (A|B|C|D|E). Selects the required parts (manifest/classes.tsv).
+class: {{CLASS}}
+
+# The default branch, DECLARED, never assumed. A preset that assumes the wrong branch
+# silently skips a repo.
+branch: {{BRANCH}}
+
+# The model mapping — the ONE install-time machine input. goblin-stack READS this file and
+# never writes it. Absent on another machine: every model-dependent check reports advisory.
+models_file: {{MODELS_FILE}}
+
+# The global engine (optional, W1). Where the ENGINE tier lives on this machine — an
+# absolute path or ~/-prefixed. Absent by default: a fresh per-repo install is
+# byte-compatible with today, and verify resolves its engine exactly as it always did.
+# Declared but unusable (relative path, missing directory, no manifest inside) is
+# verify exit 2 with NO fallback — a repo must not be judged by an engine it did not
+# declare. Authored by hand (or by `goblin upgrade`, W3); goblin-install never writes it.
+# engine_dir: ~/.goblin/engine
+
+# The referenced standard (optional). goblin-stack carries no copy of it; it pins its hash.
+practice: {{PRACTICE}}
+practice_sha256: {{PRACTICE_SHA}}
+
+# The commit identity this repo expects (CM-01).
+owner_email: {{OWNER_EMAIL}}
+
+# archive: true -> verify requires no HANDOFF and no gates, and says so.
+archive: {{ARCHIVE}}
+
+# Uncommitted entries allowed at verify time (CM-03). 0 means commit as you go.
+max_dirty: {{MAX_DIRTY}}
+
+# Unenforceable rules are counted; this is the cap that stops the matrix decaying into prose.
+advisory_ceiling: {{ADVISORY_CEILING}}
+
+# Whether this class requires a client-visible surface to be secret-free (SC-01..SC-09 read the
+# `security:` block below). Declared, never inferred: a stack-specific rule guessed from the
+# files on disk is how a matrix starts lying.
+security:
+  gitignore_family: {{SEC_GITIGNORE_FAMILY}}
+  build_output: {{SEC_BUILD_OUTPUT}}
+  audit_cmd: {{SEC_AUDIT_CMD}}
+  audit_max_age_days: {{SEC_AUDIT_MAX_AGE}}
+  waiver_max_age_days: {{SEC_WAIVER_MAX_AGE}}
+  write_routes: {{SEC_WRITE_ROUTES}}
+
+# The performance budget (PF-01). The NUMBER lives in `ratchet:` above — this block only names
+# the commit it was measured on, so "I raised the ceiling" cannot silently become "I never
+# measured again". An empty baseline_commit means "not measured yet" and PF-01 skips with that
+# reason; a baseline_commit that does not resolve to an ancestor of HEAD is a RED.
+perf:
+  metric: {{PERF_METRIC}}
+  cmd: {{PERF_CMD}}
+  baseline_commit: {{PERF_BASELINE_COMMIT}}
+  baseline_value: {{PERF_BASELINE_VALUE}}
+  measured: {{PERF_MEASURED}}
+  host_gate: {{PERF_HOST_GATE}}
+
+# Where the asserting harnesses live.
+harness_dir: {{HARNESS_DIR}}
+
+# Whether this class scaffolds that directory. A declared harness_dir that is absent FAILS
+# (HS-01) when this is yes; a class that ships no harness dir skips with a reason.
+scaffold_checks: {{SCAFFOLD_CHECKS}}
+
+# The feature map (P6's inventory, authored by skills/goblin-feature-map).
+# feature_map: the map's README, relative to this repo. EMPTY means "no map declared yet" and
+# makes FM-01/FM-02 SKIP with that reason - a fresh install has no map and must not be born RED.
+# source_root: entry paths in the map resolve against this.
+# verify_doctor: the command the map's own instructions say to run. EMPTY -> VA-01 SKIPs.
+feature_map: {{FEATURE_MAP}}
+source_root: {{SOURCE_ROOT}}
+verify_doctor: {{VERIFY_DOCTOR}}
+
+# The reference corpus (P15). `reference_manifest:` names the manifest RC-01/RC-02/RC-04 read: a
+# hash-only record of the quarantined corpus, never the corpus itself. EMPTY means "no reference
+# corpus is declared" and makes RC-01, RC-02 and RC-04 SKIP with that reason - a repo with no
+# corpus must not be born RED. A key that IS set but names a missing or unparseable file is a
+# FAIL, never a skip, so losing the manifest cannot read as "no corpus". RC-01 also reads the
+# `security: build_output:` list above: a file there whose sha256 appears in an entry fails the
+# build.
+# `quarantine_root:` is the quarantine directory the procedure extracts into (outside this repo).
+# No row reads it; it is declared so the procedure has a machine-readable anchor instead of a path
+# in prose.
+reference_manifest: {{REFERENCE_MANIFEST}}
+quarantine_root: {{QUARANTINE_ROOT}}
+
+# The loop ceiling (G2, LP-03). The most turns ONE loop record may declare in its budget, so a
+# runaway loop cannot buy itself unlimited iterations. 20 is the engine's own default for a
+# kanban goal loop, measured; a ceiling that does not match the engine's default is a number
+# someone made up. It bounds one loop's turns, never how many loops exist.
+loop_max_turns_ceiling: {{LOOP_MAX_TURNS}}
+
+# The gate set. DECLARED, never inferred from the stack. Replace the default below with the
+# real commands for this project; each must exit 0. The whole block is rendered by one
+# placeholder (a class may declare a second gate - A's TODO ceiling), so a second, empty
+# placeholder line below it leaked an unsubstituted token into every class's installed config
+# and nothing rendered it (Z1-3).
+gates:
+{{GATES}}
+
+# A count that must not rise, with its ceiling. The ceiling was measured at install time.
+ratchet:
+  name: {{RATCHET_NAME}}
+  cmd: {{RATCHET_CMD}}
+  ceiling: {{RATCHET_CEILING}}
+
+# Paths a probe must never write (DS-01/DS-02 hash them around every gate run).
+runtime_data:
+{{RUNTIME_DATA}}
+
+# The ban list (G5). Which bans this project turns on; an unlisted ban SKIPs with a reason.
+# A ban's mechanism lives in .goblin/manifest/bans.tsv; the engine is .goblin/bin/goblin-bans.
+bans: [{{BANS}}]
+
+# Narrow, explicit, reviewed exceptions (Dune rule 5): "- <ban id> <path prefix>".
+bans_exempt:
+{{BANS_EXEMPT}}
+
+# What BN-05 reads: "<from> <to>" layer pairs. Empty -> BN-05 SKIPs with a reason.
+layers:
+{{LAYERS}}
+
+# How a harness proves RED on the pre-change tree (HS-02). Set commit: to the pinned
+# pre-change SHA once the round it guards has landed; until then HS-02 is skipped with a reason.
+replay:
+  env: {{REPLAY_ENV}}
+  cmd: {{REPLAY_CMD}}
+  commit: ""
+
+# Parts recorded as opt-out. Their required checks report SKIP (opt-out) rather than passing.
+disabled: [{{DISABLED}}]

package/templates/install-hooks.allowlist.tmpl

@@ -0,0 +1,9 @@
+# .goblin/install-hooks.allowlist — dependencies whose install-time script is accepted (SC-08).
+#
+# One package name per line. SC-08 enumerates package-lock.json for "hasInstallScript": true and
+# requires every one of them to appear here. An install hook is arbitrary code that runs on every
+# `npm ci` (and on every CI job), so the list is short and each entry is a decision, not a default.
+#
+# example:
+# esbuild
+# sharp

package/templates/loop/decisions.tsv.tmpl

@@ -0,0 +1 @@
+ts	phase	decision	why	evidence	result

package/templates/loop/predicate.tmpl

@@ -0,0 +1,16 @@
+# .goblin/loop/predicate — the loop's exit condition. Copy this file to that path and edit it.
+#
+# ONE command. Exits 0 == the loop is finished. Comments are allowed here; the command is the
+# single non-blank, non-comment line (LP-01 checks exactly that).
+#
+# A duration is NOT a finish condition, and neither is a description of one.
+# Run it once BEFORE iteration 1 and record the result in .goblin/loop/first-run as
+# "exit=<n> ts=<ISO8601>": the run-once rule is how you know the command is runnable and
+# currently red, which is what makes a later green mean anything.
+# Then pin it: sha256sum .goblin/loop/predicate | cut -d' ' -f1 > .goblin/loop/predicate.sha256
+# Never edit the predicate mid-loop — archive it under .goblin/loop/closed-<date>/ together with
+# the pin it was closed under, then open a new loop whose predicate.sha256 names the archived
+# digest on a `previous: <digest>` line (LP-02: a silent relaxation FAILs; the chain is the record).
+#
+# Replace the line below with the real condition. Example shape only:
+node tools/check-cycles.mjs

package/templates/report.yaml.tmpl

@@ -0,0 +1,16 @@
+# reports/<slug>/report.yaml — one report, one file, one schema.
+#
+# A report is a file with a schema, not prose in a card body: prose invites the agent to fill
+# the gaps by guessing, and a guess at intake poisons everything downstream. The validator is
+# `automations/bugreporter-intake.sh`; the schema it enforces is `automations/report.schema.tsv`.
+
+repo:                 # REQUIRED. path or remote of the repository the defect is in
+symptom:              # REQUIRED. one line, observable
+expected:             # REQUIRED. one line
+observed:             # REQUIRED. one line
+repro_steps:          # REQUIRED. ordered list, one item per line, 4-space indented
+  -
+revision:             # REQUIRED. a commit that exists in that repository
+dedup_key:            # REQUIRED. bug:<repo>:<sha256(normalised symptom)[:12]> - content only
+environment:          # optional. platform/version; absent is recorded as unknown, never guessed
+evidence:             # optional. paths to captures; evidence for a human, never harness proof