@zerwiz/ymir 0.1.4 → 0.1.7

package/bin/changelog-assemble.sh

@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# changelog-assemble.sh — fold CHANGELOG.d/ fragments into CHANGELOG.md.
+#
+# WHY THIS EXISTS
+#   CHANGELOG.md is one file, and every branch appends at the same position — the
+#   top. Git sees two branches inserting different lines at the same spot and
+#   calls it a conflict, so every merge re-conflicts every open branch. With N
+#   branches that is O(N^2) conflicts, all of them meaningless.
+#
+#   A fragment directory removes the collision at the root: each change adds ONE
+#   file with a UNIQUE name, so two branches never touch the same file and can
+#   never conflict. This script folds the fragments into the ledger.
+#
+# THE LAW (RULES/06-append-only.md)
+#   Append, never rewrite. Never truncate. Never lose one in a move.
+#   A fragment is a new file; the ledger only ever grows. Folding is an append.
+#   CHANGELOG.d/ joins the append-only set, so a move must carry it.
+#
+# FRAGMENT FORMAT
+#   CHANGELOG.d/<YYYY-MM-DD>-<slug>.md — the entry exactly as it should appear in
+#   CHANGELOG.md, starting with its `## YYYY-MM-DD — title` heading.
+#
+# USAGE
+#   bin/changelog-assemble.sh              # fold every fragment, newest first
+#   bin/changelog-assemble.sh --dry-run    # report what would fold
+#   bin/changelog-assemble.sh --check      # exit 1 if fragments are unfolded
+#
+# Exit: 0 ok, 1 error (or --check with fragments present), 2 usage.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+FRAG_DIR="$ROOT/CHANGELOG.d"
+LEDGER="$ROOT/CHANGELOG.md"
+
+DRY=0; CHECK=0
+for a in "$@"; do
+  case "$a" in
+    --dry-run) DRY=1 ;;
+    --check)   CHECK=1 ;;
+    -h|--help) sed -n '2,26p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    *) printf 'error: unknown flag %s\nhelp: bin/changelog-assemble.sh [--dry-run|--check]\n' "$a" >&2; exit 2 ;;
+  esac
+done
+
+[ -f "$LEDGER" ] || { printf 'error: no ledger at %s\n' "$LEDGER" >&2; exit 1; }
+
+# One python block owns the whole fold: regex, ordering, and the ledger's
+# structure are all easier to get right in one language than split across awk,
+# sed and shell — and an awk interval regex silently matched nothing, which
+# duplicated the entire ledger.
+ROOT="$ROOT" FRAG_DIR="$FRAG_DIR" LEDGER="$LEDGER" DRY="$DRY" CHECK="$CHECK" python3 - <<'PY'
+import os, re, sys, glob
+
+root = os.environ["ROOT"]
+frag_dir = os.environ["FRAG_DIR"]
+ledger = os.environ["LEDGER"]
+dry = os.environ["DRY"] == "1"
+check = os.environ["CHECK"] == "1"
+
+HEADING = re.compile(r"^## (\d{4}-\d{2}-\d{2}) ")
+
+# --- fragments -------------------------------------------------------------
+frags = []
+if os.path.isdir(frag_dir):
+    for p in sorted(glob.glob(os.path.join(frag_dir, "*.md"))):
+        if os.path.basename(p) == "README.md":
+            continue
+        frags.append(p)
+
+if not frags:
+    if check:
+        sys.exit(0)
+    print('changelog-assemble[1]{fragments,folded,state}:')
+    print('  "0","0","none pending"')
+    sys.exit(0)
+
+# A fragment must begin with its dated heading, or folding it would corrupt the
+# ledger's structure.
+bad = []
+for p in frags:
+    first = open(p, encoding="utf-8").readline()
+    if not HEADING.match(first):
+        bad.append(os.path.relpath(p, root))
+if bad:
+    for b in bad:
+        print(f'error: fragment has no dated heading: {b}', file=sys.stderr)
+    print('help: first line must be "## YYYY-MM-DD — title"', file=sys.stderr)
+    sys.exit(1)
+
+def frag_date(p):
+    m = re.match(r"^(\d{4}-\d{2}-\d{2})", os.path.basename(p))
+    return m.group(1) if m else "0000-00-00"
+
+# newest first; ties broken by name for determinism
+frags.sort(key=lambda p: (frag_date(p), os.path.basename(p)), reverse=True)
+
+if check:
+    print(f'changelog-assemble[{len(frags)}]{{fragment,state}}:')
+    for p in frags:
+        print(f'  "{os.path.relpath(p, root)}","unfolded"')
+    print(f'error: {len(frags)} changelog fragment(s) not folded into CHANGELOG.md', file=sys.stderr)
+    print('help: run bin/changelog-assemble.sh', file=sys.stderr)
+    sys.exit(1)
+
+if dry:
+    print(f'changelog-assemble[{len(frags)}]{{fragment,date}}:')
+    for p in frags:
+        print(f'  "{os.path.relpath(p, root)}","{frag_date(p)}"')
+    print('changelog-assemble: dry run — nothing written')
+    sys.exit(0)
+
+# --- the ledger ------------------------------------------------------------
+text = open(ledger, encoding="utf-8").read()
+lines = text.split("\n")
+
+# preamble = everything before the first dated entry (the `# CHANGELOG` head)
+split = None
+for i, ln in enumerate(lines):
+    if HEADING.match(ln):
+        split = i
+        break
+if split is None:
+    preamble = lines[:]          # no dated entry yet: the whole file is preamble
+    existing = []
+else:
+    preamble = lines[:split]
+    existing = lines[split:]
+
+# trim trailing blanks from the preamble, then one blank separator
+while preamble and preamble[-1].strip() == "":
+    preamble.pop()
+
+# --- assemble: fragments first (newest at top), then the existing ledger ----
+out = list(preamble)
+out.append("")
+for p in frags:
+    body = open(p, encoding="utf-8").read().rstrip("\n").split("\n")
+    out.extend(body)
+    out.append("")
+    out.append("")
+out.extend(existing)
+
+# collapse runs of 3+ blank lines to two (entry separation only — never content)
+t = "\n".join(out)
+t = re.sub(r"\n{3,}", "\n\n", t).rstrip("\n") + "\n"
+
+open(ledger, "w", encoding="utf-8").write(t)
+for p in frags:
+    os.remove(p)
+
+print('changelog-assemble[1]{fragments,folded,ledger}:')
+print(f'  "{len(frags)}","{len(frags)}","CHANGELOG.md"')
+PY

package/bin/changelog-guard.sh

@@ -0,0 +1,197 @@
+#!/usr/bin/env bash
+# changelog-guard.sh — every push must carry a CHANGELOG entry.
+#
+# The house law: a change that ships is a change that was told. CHANGELOG.md is
+# append-only (RULES/06-append-only.md) and is the record the operator reads
+# after the fact. This guard refuses a push whose range never touches it, so the
+# record can never lag silently behind the code.
+#
+# Two tiers, so a follow-up commit needs no micro-entry:
+#   1. the pushed range (remote..local) touches CHANGELOG.md, or
+#   2. the branch's whole range since it left the trunk does — the record is
+#      already told, and this push merely lands a file it describes.
+# What can never pass is a branch whose entire range leaves with no entry.
+#
+#   bin/changelog-guard.sh                 # pre-push: refs on stdin (hook mode)
+#   bin/changelog-guard.sh --range A..B    # check one explicit range
+#   bin/changelog-guard.sh --install       # wire pre-push (branch + changelog)
+#
+# Exit codes: 0 = a changelog entry is present (or nothing is being pushed),
+#             1 = blocked, 2 = usage.
+#
+# Override (deliberate, loud): YMIR_SKIP_CHANGELOG_GUARD=1 git push …
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+CHANGELOG="CHANGELOG.md"
+# A change may tell its story either way: an entry appended to the ledger, or a
+# fragment in CHANGELOG.d/ that the assembler will fold in. The fragment is the
+# preferred form — two branches never touch the same fragment file, so the duty
+# is met without the O(N^2) conflict every branch appending to one file causes.
+FRAGMENT_DIR="CHANGELOG.d"
+ZERO="0000000000000000000000000000000000000000"
+
+usage() {
+  sed -n '2,16p' "$0" | sed 's/^# \{0,1\}//'
+  exit 2
+}
+
+# changes_touch_changelog <base> <head> — exit 0 when the change TELLS ITS STORY,
+# either by appending to CHANGELOG.md or by adding a CHANGELOG.d/ fragment.
+changes_touch_changelog() {
+  local base=${1-} head=${2-} f
+  [ -n "$head" ] || return 1
+  if [ -z "$base" ]; then
+    # No base to compare against (root commit range): look at every commit.
+    f="$(git -C "$ROOT" ls-tree -r --name-only "$head" -- "$CHANGELOG" 2>/dev/null)"
+    [ -n "$f" ] && return 0
+    f="$(git -C "$ROOT" ls-tree -r --name-only "$head" -- "$FRAGMENT_DIR" 2>/dev/null | grep -v '/README.md$' | grep '\.md$')"
+    [ -n "$f" ] && return 0
+    return 1
+  fi
+  git -C "$ROOT" diff --name-only "$base" "$head" -- "$CHANGELOG" 2>/dev/null | grep -q . && return 0
+  # A fragment ADDED in the range satisfies the duty. A fragment merely deleted
+  # (the assembler folding it into the ledger) does not count on its own — but in
+  # that same push the ledger changed, which the test above already caught.
+  git -C "$ROOT" diff --name-only --diff-filter=A "$base" "$head" -- "$FRAGMENT_DIR" 2>/dev/null \
+    | grep -v '/README.md$' | grep -q '\.md$' && return 0
+  return 1
+}
+
+# branch_touches_changelog <sha> — the branch's own range since it left the trunk.
+# The fallback for a follow-up push: a commit that merely lands a file already
+# told by an earlier entry is not a new untold change. What must never happen is
+# a branch whose whole range leaves without an entry.
+branch_touches_changelog() {
+  local sha=${1-} default_ref base
+  [ -n "$sha" ] || return 1
+  for default_ref in "origin/HEAD" "origin/main" "origin/master"; do
+    git -C "$ROOT" rev-parse --verify --quiet "$default_ref" >/dev/null 2>&1 || continue
+    base="$(git -C "$ROOT" merge-base "$sha" "$default_ref" 2>/dev/null || true)"
+    [ -n "$base" ] && { changes_touch_changelog "$base" "$sha" && return 0; return 1; }
+  done
+  return 1
+}
+
+# check_ref <local_sha> <remote_sha> — resolve the range and test it
+check_ref() {
+  local local_sha=${1-} remote_sha=${2-} base="" default_ref=""
+  [ -n "$local_sha" ] || return 1
+  case "$local_sha" in "$ZERO") return 1 ;; esac   # a deletion pushes no content
+
+  if [ -n "$remote_sha" ] && [ "$remote_sha" != "$ZERO" ]; then
+    base="$remote_sha"
+  else
+    # A brand-new remote branch: measure from where it forked off the trunk.
+    for default_ref in "origin/HEAD" "origin/main" "origin/master"; do
+      git -C "$ROOT" rev-parse --verify --quiet "$default_ref" >/dev/null 2>&1 || continue
+      base="$(git -C "$ROOT" merge-base "$local_sha" "$default_ref" 2>/dev/null || true)"
+      [ -n "$base" ] && break
+    done
+  fi
+  changes_touch_changelog "$base" "$local_sha" && return 0
+  # Nothing in THIS push told the record; the branch may yet have told it.
+  branch_touches_changelog "$local_sha"
+}
+
+verdict() {  # <ok|blocked>
+  if [ "$1" = "ok" ]; then
+    printf 'changelog-guard[1]{gate,result}:\n  "push","ok"\n'
+    exit 0
+  fi
+  cat >&2 <<'EOF'
+changelog-guard: blocked — this push carries no CHANGELOG entry.
+
+  Every change that ships is a change that was told. Tell it either way:
+
+    PREFERRED — add a fragment (no conflict with any other branch):
+      CHANGELOG.d/<YYYY-MM-DD>-<slug>.md   starting with "## YYYY-MM-DD — title"
+      bin/changelog-assemble.sh folds it into CHANGELOG.md
+
+    OR — append an entry to CHANGELOG.md under the current date
+    (append-only — never rewrite an existing entry; RULES/06-append-only.md).
+
+  Commit it, and push again.
+
+  Deliberate override, when an entry truly does not belong:
+    YMIR_SKIP_CHANGELOG_GUARD=1 git push ...
+EOF
+  printf 'error: changelog-guard blocked the push (no CHANGELOG entry or fragment in range)\n' >&2
+  printf 'help: add a CHANGELOG.d/ fragment (preferred), or append to CHANGELOG.md; override with YMIR_SKIP_CHANGELOG_GUARD=1\n' >&2
+  exit 1
+}
+
+case "${1:-}" in
+  -v|-V|--version) printf '1.0.0\n'; exit 0 ;;
+  -h|--help) usage ;;
+  --install)
+    hook="$ROOT/.git/hooks/pre-push"
+    mkdir -p "$(dirname "$hook")" || exit 1
+    cat >"$hook" <<EOF
+#!/usr/bin/env bash
+# pre-push hook — the delivery gate. Installed by bin/changelog-guard.sh --install.
+#   0. changelog-assemble — fold CHANGELOG.d/ fragments into CHANGELOG.md, so the
+#      ledger is never behind what the fragments already tell. Folding is an
+#      append: existing entries are copied verbatim, never reordered.
+#   1. branch-guard   — Rule 08: never push a protected branch
+#   2. changelog-guard — every push carries a CHANGELOG entry (or a fragment)
+set -u
+refs="\$(mktemp)"
+trap 'rm -f "\$refs"' EXIT
+cat >"\$refs"
+if [ -x "$SCRIPT_DIR/changelog-assemble.sh" ]; then
+  "$SCRIPT_DIR/changelog-assemble.sh" >/dev/null 2>&1 || true
+  # If folding changed the ledger, it is now a working-tree change the push does
+  # not carry. Say so loudly rather than pushing a ledger the fragments are not in.
+  if ! git -C "$ROOT" diff --quiet -- "$CHANGELOG" 2>/dev/null; then
+    printf 'changelog-assemble[1]{state}:\n  "folded fragments into %s — commit it, then push again"\n' "$CHANGELOG" >&2
+    exit 1
+  fi
+fi
+"$SCRIPT_DIR/branch-guard.sh" <"\$refs" || exit 1
+"$SCRIPT_DIR/changelog-guard.sh" <"\$refs" || exit 1
+exit 0
+EOF
+    chmod +x "$hook"
+    printf 'changelog-guard[1]{action,path}:\n  "install","%s"\n' "$hook"
+    exit 0 ;;
+  --range)
+    rng="${2:-}"; [ -n "$rng" ] || usage
+    base="${rng%%..*}"; head="${rng##*..}"
+    changes_touch_changelog "$base" "$head" || verdict blocked
+    verdict ok ;;
+  --all)
+    # Every tracked CHANGELOG must exist and be non-empty.
+    [ -s "$ROOT/$CHANGELOG" ] || verdict blocked
+    verdict ok ;;
+  "") : ;;
+  *) usage ;;
+esac
+
+[ "${YMIR_SKIP_CHANGELOG_GUARD:-0}" = "1" ] && {
+  printf 'changelog-guard[1]{gate,result}:\n  "push","skipped (YMIR_SKIP_CHANGELOG_GUARD=1)"\n'
+  exit 0
+}
+
+# Hook mode: the refs git hands a pre-push hook, one per line:
+#   <local_ref> <local_sha> <remote_ref> <remote_sha>
+pushed=0
+while read -r local_ref local_sha remote_ref remote_sha; do
+  [ -n "${local_ref:-}" ] || continue
+  case "$local_ref" in "$ZERO"|"") continue ;; esac
+  pushed=1
+  check_ref "$local_sha" "$remote_sha" && verdict ok
+done
+
+# Nothing pushable on stdin (a manual run): measure HEAD against the trunk.
+if [ "$pushed" = "0" ]; then
+  for default_ref in "origin/main" "origin/master" "origin/HEAD"; do
+    git -C "$ROOT" rev-parse --verify --quiet "$default_ref" >/dev/null 2>&1 || continue
+    base="$(git -C "$ROOT" merge-base HEAD "$default_ref" 2>/dev/null || true)"
+    changes_touch_changelog "$base" "HEAD" && verdict ok
+    break
+  done
+fi
+
+verdict blocked

package/bin/crash-sense.sh

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+# crash-sense.sh — surface machine crashes to the Allfather on Omarchy.
+#
+# A crash nobody sees is a crash nobody fixes. This watches systemd-coredump for
+# NEW crashes since the last look, records each one, and raises an Omarchy desktop
+# notification so the Allfather learns about it the moment it happens.
+#
+# It is a sensor: it reads coredumpctl and notifies. It never fixes, deletes, or
+# changes anything on the machine.
+#
+# Usage:
+#   bin/crash-sense.sh check [--quiet] [--no-notify]
+#   bin/crash-sense.sh status
+#   bin/crash-sense.sh --version
+#
+# State: state/crash-seen.json  (gitignored — per machine)
+# Output: Galdr TOON.
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+STATE_DIR="${BROKK_STATE_OVERRIDE:-$YMIR_STATE_DIR}"
+SEEN="$STATE_DIR/crash-seen.json"
+QUIET=0; NOTIFY=1
+
+case "${1-}" in
+  -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;
+  -h|--help|"") sed -n '2,16p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+esac
+ACTION="${1:-check}"; shift || true
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --quiet) QUIET=1; shift ;;
+    --no-notify) NOTIFY=0; shift ;;
+    *) shift ;;
+  esac
+done
+
+have() { command -v "$1" >/dev/null 2>&1; }
+have coredumpctl || { printf 'crash-sense[1]{state,detail}:\n  "skip","no coredumpctl (not a systemd host)"\n'; exit 0; }
+
+# Collect recent crashes as: <boot-id>|<pid>|<comm>|<sig>|<time>
+collect() {
+  coredumpctl list --no-pager --since "7 days ago" 2>/dev/null \
+    | awk 'NR>1 && NF>=5 {print $NF"|"$5"|"$1" "$2" "$3}' \
+    | head -200
+}
+
+# Use a stable identity for a crash: the executable name + pid + signal.
+fingerprints() {
+  coredumpctl list --no-pager --since "7 days ago" 2>/dev/null | awk 'NR>1 {print $NF"|"$1"|"$2"|"$3"|"$4"|"$5}' | head -200
+}
+
+notify() {  # <headline> <body> [urgency]
+  local h="$1" b="$2" u="${3:-normal}"
+  [ "$NOTIFY" = 1 ] || return 0
+  # One voice: bin/ymir-say.sh owns the desktop manner.
+  if [ -x "$ROOT/bin/ymir-say.sh" ]; then
+    local mark=note
+    [ "$u" = critical ] && mark=alarm
+    "$ROOT/bin/ymir-say.sh" --mark "$mark" "$h" "$b" >/dev/null 2>&1 || true
+    return 0
+  fi
+  if have omarchy-notification-send; then
+    omarchy-notification-send -u "$u" -g "" "$h" "$b" >/dev/null 2>&1 || true
+  elif have notify-send; then
+    notify-send -u "$u" "$h" "$b" >/dev/null 2>&1 || true
+  fi
+}
+
+case "$ACTION" in
+  check)
+    mkdir -p "$STATE_DIR"
+    local_prev="{}"
+    [ -r "$SEEN" ] && local_prev="$(cat "$SEEN")"
+
+    # New fingerprints = anything not in the seen set.
+    new_rows="$(python3 - "$SEEN" <<'PY'
+import json, os, subprocess, sys
+seen_path = sys.argv[1]
+seen = set()
+if os.path.exists(seen_path):
+    try:
+        seen = set(json.load(open(seen_path)).get("fingerprints", []))
+    except Exception:
+        seen = set()
+out = subprocess.run(["coredumpctl", "list", "--no-pager", "--since", "7 days ago"],
+                     capture_output=True, text=True).stdout.splitlines()[1:]
+new = []
+all_fp = []
+for line in out:
+    parts = line.split()
+    if len(parts) < 5:
+        continue
+    # TIME is 3 tokens (date, clock, tz); then PID UID GID SIG COREFILE EXE
+    date, clock, tz = parts[0], parts[1], parts[2]
+    rest = parts[3:]
+    pid = rest[0] if rest else "?"
+    comm = os.path.basename(rest[-1]) if rest else "?"
+    sig = rest[3] if len(rest) > 3 else "?"
+    fp = f"{pid}|{comm}|{sig}|{date} {clock}"
+    all_fp.append(fp)
+    if fp not in seen:
+        new.append({"pid": pid, "comm": comm, "sig": sig, "when": f"{date} {clock}", "fp": fp})
+print(json.dumps({"new": new, "all": all_fp}))
+PY
+)"
+    count="$(printf '%s' "$new_rows" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["new"]))' 2>/dev/null || echo 0)"
+
+    if [ "$count" -gt 0 ]; then
+      # One notification per crash, newest first, capped so we never spam.
+      printf '%s' "$new_rows" | python3 -c '
+import json, sys
+d = json.load(sys.stdin)["new"]
+for c in d[-3:]:
+    print(c["comm"] + "\t" + c["sig"] + "\t" + c["when"] + "\t" + c["pid"])
+' | while IFS=$'\t' read -r comm sig when pid; do
+        notify "Process crashed: $comm" "$sig at $when (pid $pid) — run bin/crash-sense.sh status, or ask Brokk to diagnose." "critical"
+      done
+    fi
+
+    # Persist the union as the new seen set (feed the captured string, not a pipe).
+    printf '%s' "$new_rows" >"$STATE_DIR/.crash-new.json"
+    python3 - "$SEEN" "$STATE_DIR/.crash-new.json" <<'PY'
+import json, sys, tempfile, os, datetime
+path, src = sys.argv[1], sys.argv[2]
+d = json.load(open(src))
+payload = {
+    "fingerprints": d["all"],
+    "updated_at": datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+}
+fd, tmp = tempfile.mkstemp(dir=os.path.dirname(path) or ".")
+with os.fdopen(fd, "w") as f:
+    json.dump(payload, f, indent=2)
+os.replace(tmp, path)
+PY
+    rm -f "$STATE_DIR/.crash-new.json"
+
+    [ "$QUIET" = 1 ] && exit 0
+    printf 'crash-sense[1]{new_crashes,notified,since}:\n  %s,"%s","7 days"\n' "$count" "$([ "$count" -gt 0 ] && echo yes || echo no)"
+    if [ "$count" -gt 0 ]; then
+      printf '%s' "$new_rows" | python3 -c '
+import json, sys
+for c in json.load(sys.stdin)["new"][-5:]:
+    print(f'"'"'  "{c["comm"]}","{c["sig"]}","{c["when"]}","pid {c["pid"]}"'"'"')
+' 2>/dev/null | sed '1i crashes[]:' || true
+    fi
+    ;;
+
+  status)
+    if have coredumpctl; then
+      total="$(coredumpctl list --no-pager --since "7 days ago" 2>/dev/null | awk 'NR>1' | wc -l | tr -d ' ')"
+      printf 'crash-sense[1]{window,total_crashes,state_file}:\n  "7 days",%s,"%s"\n' "$total" "${SEEN#"$ROOT"/}"
+      coredumpctl list --no-pager --since "7 days ago" 2>/dev/null | awk 'NR>1 {print $NF}' | sort | uniq -c | sort -rn | head -5 | \
+        awk '{printf "  \"%s\",%s\n", $2, $1}'
+    fi
+    ;;
+  *) printf 'error: unknown action %s\nhelp: bin/crash-sense.sh [check|status]\n' "$ACTION" >&2; exit 2 ;;
+esac

package/bin/design-check.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# design-check.sh — one identity, two renderers: they must agree.
+#
+# The design language is the landing page's cloth (stone · bone · bronze ·
+# blood). It is carried in TWO places, on purpose:
+#
+#   midgard/design-system/tokens.css     the CSS variables every web surface imports
+#   apps/sessrumnir/…/themes/fensalir.json   the seven SEEDS the seat derives ~40
+#                                            tokens from (the reference form)
+#
+# Two carriers of one identity drift the moment someone edits one. This is the
+# guard: the same value must appear in both, or the build says so.
+#
+# Usage:
+#   bin/design-check.sh          # compare, TOON, exit 0/1
+#   bin/design-check.sh --fix-hint
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+TOKENS="$ROOT/midgard/design-system/tokens.css"
+SEEDS="$ROOT/apps/sessrumnir/src/renderer/src/themes/fensalir.json"
+
+case "${1-}" in
+  -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;
+  -h|--help) sed -n '2,18p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+esac
+
+[ -r "$TOKENS" ] || { printf 'error: tokens not found: %s\n' "${TOKENS#"$ROOT"/}" >&2; exit 1; }
+# The seat's cloth lives in the Sessrúmnir app repo (the apps split moved it out
+# of the monorepo; `step_apps` clones it). In a fresh clone or a worktree it is
+# absent until that step runs — so an absent seat is a clean SKIP, not a failure.
+# Two carriers can only be compared when both are present; demanding the app's
+# file would fail every worktree for a reason that is not drift.
+if [ ! -r "$SEEDS" ]; then
+  printf 'design[1]{state,reason}:\n'
+  printf '  "SKIP","the seat'"'"'s cloth is app-provided (%s) — run bin/ymir-install.sh step_apps"\n' "${SEEDS#"$ROOT"/}"
+  exit 0
+fi
+
+# the pairs that MUST agree: CSS token <-> seed
+python3 - "$TOKENS" "$SEEDS" <<'PY'
+import json, re, sys
+
+tokens_path, seeds_path = sys.argv[1], sys.argv[2]
+css = open(tokens_path).read()
+seeds = json.load(open(seeds_path))["seeds"]
+
+def token(name):
+    m = re.search(r"--%s:\s*([^;]+);" % re.escape(name), css)
+    return m.group(1).strip() if m else None
+
+PAIRS = [
+    ("ymir-bg-0",     "app",     "the ground"),
+    ("ymir-bg-1",     "surface", "the panel"),
+    ("ymir-text-0",   "text",    "the bone"),
+    ("ymir-cyan-1",   "accent",  "the bronze"),
+    ("ymir-ok",       "success", "the metal proved true"),
+    ("ymir-warn",     "warning", "hot, heed it"),
+    ("ymir-danger",   "error",   "the wound"),
+]
+
+bad = []
+print("design[%d]{css_token,seed,value,agreement}:" % len(PAIRS))
+for tok, seed, label in PAIRS:
+    a, b = token(tok), (seeds.get(seed) or "").lower()
+    ok = a is not None and a.lower() == b
+    if not ok:
+        bad.append((tok, seed, a, b))
+    print('  "%s","%s","%s","%s"' % (tok, seed, a or "-", "ok" if ok else "MISMATCH (seed %s)" % (b or "-")))
+
+if bad:
+    print("error: the two carriers of the cloth disagree", file=sys.stderr)
+    for tok, seed, a, b in bad:
+        print("  --%s = %s   ≠   seeds.%s = %s" % (tok, a, seed, b), file=sys.stderr)
+    print("help: change the value in midgard/design-system/tokens.css AND fensalir.json, or neither", file=sys.stderr)
+    sys.exit(1)
+print("design-check: the cloth is one — %d pairs agree" % len(PAIRS))
+PY