guardian-framework 0.1.146 → 0.1.148

package/templates/pi/scripts/ci/stage_unit.sh

@@ -14,8 +14,8 @@ FAIL=0
 PASS=0
 COVERAGE_PCT=0
 
-log_pass() { echo "  ✓ PASS: $1"; ((PASS++)); }
-log_fail() { echo "  ✗ FAIL: $1 — $2"; ((FAIL++)); }
+log_pass() { echo "  ✓ PASS: $1"; PASS=$((PASS + 1)); }
+log_fail() { echo "  ✗ FAIL: $1 — $2"; FAIL=$((FAIL + 1)); }
 
 echo "  Running unit tests..."
 

package/templates/pi/scripts/ci/validate_agent_output.sh

@@ -48,13 +48,13 @@ check_section_present() {
     local section="$1"
     if echo "$CONTENT" | grep -qi "$section"; then
         RESULTS+=("{\"check\": \"$section\", \"status\": \"pass\"}")
-        ((CHECKS_PASSED++))
+        CHECKS_PASSED=$((CHECKS_PASSED + 1))
         if [[ "$JSON" == "false" ]]; then
             echo -e "  ${GREEN}✓${NC} Section present: $section"
         fi
     else
         RESULTS+=("{\"check\": \"$section\", \"status\": \"fail\", \"message\": \"Section '$section' not found\"}")
-        ((CHECKS_FAILED++))
+        CHECKS_FAILED=$((CHECKS_FAILED + 1))
         if [[ "$JSON" == "false" ]]; then
             echo -e "  ${RED}✗${NC} Missing section: $section"
         fi
@@ -73,20 +73,20 @@ check_no_contradictions() {
             must_count=$(echo "$CONTENT" | grep -ci "${topic}.*must " || echo 0)
             must_not_count=$(echo "$CONTENT" | grep -ci "${topic}.*must not\|${topic}.*must not " || echo 0)
             if [[ $must_count -gt 0 && $must_not_count -gt 0 ]]; then
-                ((contradictions++))
+                contradictions=$((contradictions + 1))
             fi
         fi
     done < <(echo "$CONTENT" | grep -E "^\s*[-*]\s+\*\*" || true)
 
     if [[ $contradictions -eq 0 ]]; then
         RESULTS+=("{\"check\": \"no_contradictions\", \"status\": \"pass\"}")
-        ((CHECKS_PASSED++))
+        CHECKS_PASSED=$((CHECKS_PASSED + 1))
         if [[ "$JSON" == "false" ]]; then
             echo -e "  ${GREEN}✓${NC} No internal contradictions"
         fi
     else
         RESULTS+=("{\"check\": \"no_contradictions\", \"status\": \"fail\", \"message\": \"Found $contradictions contradictions\"}")
-        ((CHECKS_FAILED++))
+        CHECKS_FAILED=$((CHECKS_FAILED + 1))
         if [[ "$JSON" == "false" ]]; then
             echo -e "  ${RED}✗${NC} Found $contradictions contradictions"
         fi
@@ -100,13 +100,13 @@ check_decision_consistency() {
 
     if [[ $decisions -eq 0 ]] || [[ $evidence -gt 0 ]]; then
         RESULTS+=("{\"check\": \"decision_consistency\", \"status\": \"pass\"}")
-        ((CHECKS_PASSED++))
+        CHECKS_PASSED=$((CHECKS_PASSED + 1))
         if [[ "$JSON" == "false" ]]; then
             echo -e "  ${GREEN}✓${NC} Decision consistency"
         fi
     else
         RESULTS+=("{\"check\": \"decision_consistency\", \"status\": \"fail\", \"message\": \"Decisions without supporting evidence\"}")
-        ((CHECKS_FAILED++))
+        CHECKS_FAILED=$((CHECKS_FAILED + 1))
         if [[ "$JSON" == "false" ]]; then
             echo -e "  ${RED}✗${NC} Decisions without supporting evidence"
         fi
@@ -120,13 +120,13 @@ check_acceptance_criteria() {
 
     if [[ $has_criteria -gt 0 ]]; then
         RESULTS+=("{\"check\": \"acceptance_criteria\", \"status\": \"pass\"}")
-        ((CHECKS_PASSED++))
+        CHECKS_PASSED=$((CHECKS_PASSED + 1))
         if [[ "$JSON" == "false" ]]; then
             echo -e "  ${GREEN}✓${NC} Acceptance criteria present"
         fi
     else
         RESULTS+=("{\"check\": \"acceptance_criteria\", \"status\": \"fail\", \"message\": \"No acceptance criteria found\"}")
-        ((CHECKS_FAILED++))
+        CHECKS_FAILED=$((CHECKS_FAILED + 1))
         if [[ "$JSON" == "false" ]]; then
             echo -e "  ${RED}✗${NC} No acceptance criteria found"
         fi
@@ -138,13 +138,13 @@ check_canonical_references() {
 
     if [[ $has_refs -gt 0 ]]; then
         RESULTS+=("{\"check\": \"canonical_references\", \"status\": \"pass\"}")
-        ((CHECKS_PASSED++))
+        CHECKS_PASSED=$((CHECKS_PASSED + 1))
         if [[ "$JSON" == "false" ]]; then
             echo -e "  ${GREEN}✓${NC} Canonical references present"
         fi
     else
         RESULTS+=("{\"check\": \"canonical_references\", \"status\": \"fail\", \"message\": \"No canonical references found\"}")
-        ((CHECKS_FAILED++))
+        CHECKS_FAILED=$((CHECKS_FAILED + 1))
         if [[ "$JSON" == "false" ]]; then
             echo -e "  ${RED}✗${NC} No canonical references found"
         fi

package/templates/pi/scripts/epic-parallel.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# ============================================================================
+# epic-parallel.sh — start an epic in its own git worktree (parallel epics)
+# ============================================================================
+# Parallel epics work when (a) each module is isolated in its own worktree,
+# (b) there is one epic branch per module, and (c) the module's shared
+# contracts are FROZEN (merged) so the parallel work cannot redefine them.
+#
+# Run as: bash .pi/scripts/epic-parallel.sh <module> [--base main] [--dir <path>]
+# Exit:  0 worktree ready · 2 blocked by contract freeze · 1 error
+# ============================================================================
+set -uo pipefail
+
+MODULE="${1:-}"
+shift || true
+BASE="main"; DIR=""
+while [ $# -gt 0 ]; do
+	case "$1" in
+		--base) BASE="${2:-main}"; shift 2 ;;
+		--dir) DIR="${2:-}"; shift 2 ;;
+		*) shift ;;
+	esac
+done
+
+if [ -z "$MODULE" ]; then
+	echo "usage: epic-parallel.sh <module> [--base main] [--dir <path>]" >&2
+	exit 1
+fi
+
+slug() { echo "$1" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//'; }
+BRANCH="epic/$(slug "$MODULE")"
+
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || { echo "not a git repo" >&2; exit 1; }
+REG="$(git rev-parse --git-common-dir 2>/dev/null || echo "$ROOT/.git")"
+[ -d "$REG" ] || REG="$ROOT/.git"
+REPO_NAME="$(basename "$ROOT")"
+[ -z "$DIR" ] && DIR="$(dirname "$ROOT")/${REPO_NAME}-$(slug "$MODULE")"
+
+echo "============================================"
+echo "  Parallel epic: $MODULE"
+echo "============================================"
+echo "  branch:   $BRANCH"
+echo "  worktree: $DIR"
+echo ""
+
+# ── Contract-freeze gate ────────────────────────────────────────────────────
+# An epic may only run in parallel once its shared contracts are frozen. The
+# registry is the source of truth (set by the contract-freeze issue / a human).
+REG_FILE="$REG/guardian/epics.json"
+FROZEN="unknown"
+if [ -f "$REG_FILE" ]; then
+	FROZEN=$(python3 - "$REG_FILE" "$MODULE" <<'PY' 2>/dev/null || echo unknown
+import json,sys
+d=json.load(open(sys.argv[1]))
+e=d.get("epics",{}).get(sys.argv[2],{})
+print("true" if e.get("contractFrozen") else ("false" if e else "unknown"))
+PY
+)
+fi
+
+if [ "$FROZEN" != "true" ]; then
+	# NOTE: block here (before worktree creation) and exit 2 — a non-zero,
+	# distinguishable code so callers/agents cannot mistake it for success.
+	echo "⛔ Blocked: contracts for '$MODULE' are not frozen (registry: $FROZEN)."
+	echo ""
+	echo "   Parallel epics must not redefine shared contracts. Freeze first:"
+	echo "     1. run the epic's Contract Freeze issue and merge it to $BASE"
+	echo "     2. record it:  bash .pi/scripts/epic-registry.sh freeze \"$MODULE\" --frozen"
+	echo ""
+	echo "   (single-epic work does not need this gate)"
+	exit 2
+fi
+
+# ── Worktree creation ───────────────────────────────────────────────────────
+if [ -e "$DIR" ]; then
+	echo "worktree path already exists: $DIR"
+elif git show-ref --verify --quiet "refs/heads/$BRANCH"; then
+	echo "branch exists — attaching worktree"
+	git worktree add "$DIR" "$BRANCH" || exit 1
+else
+	echo "creating branch + worktree from origin/$BASE"
+	git fetch origin "$BASE" --quiet 2>/dev/null || true
+	git worktree add -b "$BRANCH" "$DIR" "origin/$BASE" 2>/dev/null || \
+		git worktree add -b "$BRANCH" "$DIR" "$BASE" || exit 1
+fi
+
+# ── Register in the shared registry ─────────────────────────────────────────
+if [ -x "$ROOT/.pi/scripts/epic-registry.sh" ]; then
+	bash "$ROOT/.pi/scripts/epic-registry.sh" register "$MODULE" --branch "$BRANCH" --worktree "$DIR" --status running
+fi
+
+echo ""
+echo "✅ Worktree ready."
+echo "   Next: cd \"$DIR\" && /architect --epic \"$MODULE\""
+echo "   The epic runs in epic mode: one branch, local CI per issue, one PR at the end."

package/templates/pi/scripts/epic-registry.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+# ============================================================================
+# epic-registry.sh — project-level epic registry shared across git worktrees
+# ============================================================================
+# Worktrees each have their own .pi/ directory, so epic state is invisible
+# across parallel /architect sessions. The registry lives in the git COMMON
+# dir (shared by all worktrees) and records: module, branch, worktree path,
+# status, contract-freeze state and the shared dependencies the module needs.
+#
+# Run as:
+#   epic-registry.sh register <module> [--branch B] [--worktree P] [--status S]
+#   epic-registry.sh status <module> <status>
+#   epic-registry.sh freeze   <module> [--frozen|--pending]
+#   epic-registry.sh list
+#   epic-registry.sh get <module>
+#   epic-registry.sh path                 # registry file path
+# ============================================================================
+set -uo pipefail
+
+common_dir() {
+	git rev-parse --git-common-dir 2>/dev/null || echo ".git"
+}
+COMMON="$(common_dir)"
+[ -d "$COMMON" ] || COMMON=".git"
+# Absolute path: the registry must be addressable from any worktree/cwd.
+COMMON_ABS="$(cd "$COMMON" 2>/dev/null && pwd || echo "$COMMON")"
+REG="$COMMON_ABS/guardian/epics.json"
+mkdir -p "$(dirname "$REG")" 2>/dev/null || true
+
+now() { date -u +"%Y-%m-%dT%H:%M:%SZ"; }
+
+ensure() {
+	[ -f "$REG" ] || echo '{"version":1,"epics":{}}' > "$REG"
+}
+
+read_epic() {
+	local mod="$1"
+	python3 - "$REG" "$mod" <<'PY' 2>/dev/null || echo "{}"
+import json,sys
+path,mod=sys.argv[1],sys.argv[2]
+try:
+    d=json.load(open(path))
+except Exception:
+    d={"version":1,"epics":{}}
+print(json.dumps(d.get("epics",{}).get(mod,{})))
+PY
+}
+
+write_epic() {
+	local mod="$1"; shift
+	python3 - "$REG" "$mod" "$@" <<'PY'
+import json,sys,os
+path,mod=sys.argv[1],sys.argv[2]
+pairs=sys.argv[3:]
+try:
+    d=json.load(open(path))
+except Exception:
+    d={"version":1,"epics":{}}
+d.setdefault("epics",{})
+e=d["epics"].get(mod,{})
+for p in pairs:
+    k,_,v=p.partition("=")
+    if v in ("true","false"):
+        e[k]=v=="true"
+    else:
+        e[k]=v
+e.setdefault("module",mod)
+d["epics"][mod]=e
+os.makedirs(os.path.dirname(path),exist_ok=True)
+json.dump(d,open(path,"w"),indent=2)
+print(json.dumps(e))
+PY
+}
+
+cmd="${1:-}"; shift || true
+case "$cmd" in
+	path) ensure; echo "$REG" ;;
+	register)
+		MOD="${1:?usage: register <module> [--branch B] [--worktree P]}"; shift || true
+		BRANCH=""; WT=""; STATUS="running"
+		while [ $# -gt 0 ]; do
+			case "$1" in
+				--branch) BRANCH="${2:-}"; shift 2 ;;
+				--worktree) WT="${2:-}"; shift 2 ;;
+				--status) STATUS="${2:-}"; shift 2 ;;
+				*) shift ;;
+			esac
+		done
+		[ -z "$BRANCH" ] && BRANCH="epic/$(echo "$MOD" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//')"
+		[ -z "$WT" ] && WT="$(cd "$(dirname "$0")/../.." 2>/dev/null && git rev-parse --show-toplevel 2>/dev/null || pwd)"
+		FNOW="$(now)"
+		# Preserve an already-frozen contract: re-registering (e.g. a worktree
+		# restarted) must never silently un-freeze a module.
+		PRESENT=$(read_epic "$MOD")
+		KEEP_FROZEN=$(python3 - "$PRESENT" <<'PY' 2>/dev/null || echo ""
+import json,sys
+try:
+    e=json.loads(sys.argv[1])
+except Exception:
+    e={}
+print("true" if e.get("contractFrozen") else "false")
+PY
+)
+		[ -z "$KEEP_FROZEN" ] && KEEP_FROZEN="false"
+		write_epic "$MOD" "branch=$BRANCH" "worktree=$WT" "status=$STATUS" "registeredAt=$FNOW" "updatedAt=$FNOW" "contractFrozen=$KEEP_FROZEN" >/dev/null
+		echo "registered $MOD -> $BRANCH ($WT)"
+		;;
+	status)
+		MOD="${1:?usage: status <module> <status>}"; ST="${2:?}"
+		write_epic "$MOD" "status=$ST" "updatedAt=$(now)" >/dev/null
+		echo "$MOD: $ST"
+		;;
+	freeze)
+		MOD="${1:?usage: freeze <module> [--frozen|--pending]}"; shift || true
+		V="true"; [ "${1:-}" = "--pending" ] && V="false"
+		write_epic "$MOD" "contractFrozen=$V" "updatedAt=$(now)" >/dev/null
+		echo "$MOD: contractFrozen=$V"
+		;;
+	list|get)
+		MOD="${1:-}"
+		ensure
+		python3 - "$REG" "$cmd" "$MOD" <<'PY'
+import json,sys
+path,mode,mod=sys.argv[1],sys.argv[2],sys.argv[3]
+d=json.load(open(path))
+epics=d.get("epics",{})
+if mode=="get":
+    print(json.dumps(epics.get(mod,{}),indent=2))
+else:
+    if not epics: print("(no epics registered)")
+    for m,e in sorted(epics.items()):
+        print(f"{m:32} {e.get('status','?'):12} frozen={'yes' if e.get('contractFrozen') else 'no ':3} branch={e.get('branch','?')} worktree={e.get('worktree','?')}")
+PY
+		;;
+	*)
+		echo "usage: epic-registry.sh register|status|freeze|list|get|path ..." >&2
+		exit 1 ;;
+esac

package/templates/pi/scripts/languages/python/validate-canonical.sh

@@ -55,7 +55,7 @@ if [ -d ".pi/architecture/modules" ]; then
             if [ -n "$impl_path" ]; then
                 if [ ! -f "$impl_path" ]; then
                     warn "Architecture references $impl_path but file does not exist"
-                    ((MISSING++))
+                    MISSING=$((MISSING + 1))
                 fi
             fi
         done < <(grep -oE '`[a-z_/]+\.py`' "$module_file" 2>/dev/null || true)
@@ -76,9 +76,9 @@ INIT_DOCS=0
 INIT_WITHOUT_DOCS=0
 for init_file in $(find "$SRC_DIR" -name "__init__.py" 2>/dev/null | head -20); do
     if grep -qE '"""|"""' "$init_file" 2>/dev/null; then
-        ((INIT_DOCS++))
+        INIT_DOCS=$((INIT_DOCS + 1))
     else
-        ((INIT_WITHOUT_DOCS++))
+        INIT_WITHOUT_DOCS=$((INIT_WITHOUT_DOCS + 1))
     fi
 done
 if [ "$INIT_DOCS" -gt 0 ]; then

package/templates/pi/scripts/validate-coverage-floors.sh

@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-coverage-floors.sh — a coverage floor may not be lowered (ADR-010)
+# ============================================================================
+# `.pi/coverage-floors.tsv` is a ratchet: raise a floor when a layer improves,
+# never lower one to make a build pass. A rule that only lives in prose is not
+# a control, so this script makes it executable.
+#
+# Two failure modes, both named:
+#
+#   1. a floor DECREASED relative to the base ref — the ratchet moved backwards
+#      and the layer's real coverage is now unguarded below where it had reached;
+#   2. a layer DISAPPEARED — a removed row stops gating, and a missing row reads
+#      as "no floor" rather than "this layer lost its floor".
+#
+# Table (tab-separated): layer<TAB>floor<TAB>measured<TAB>target<TAB>note
+#   floor     the value that gates (ratchet; never decreases)
+#   measured  last measured line/region coverage (informational)
+#   target    the criterion from the roadmap (gap printed when unmet)
+#
+# Usage:
+#   bash .pi/scripts/validate-coverage-floors.sh              # vs the base ref
+#   bash .pi/scripts/validate-coverage-floors.sh --base main
+#   bash .pi/scripts/validate-coverage-floors.sh --self-test
+# ============================================================================
+set -uo pipefail
+
+# Resolve the project root: the nearest ancestor of this script that looks like
+# a project (has .git or package.json). Works whether the script is invoked from
+# the canonical tree (templates/pi/scripts) or the shipped copy (.pi/scripts).
+resolve_root() {
+	local d
+	d="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+	while [ "$d" != "/" ]; do
+		if [ -e "$d/.git" ] || [ -e "$d/package.json" ]; then
+			echo "$d"
+			return
+		fi
+		d="$(dirname "$d")"
+	done
+	echo "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+}
+ROOT="$(resolve_root)"
+TABLE_REL=".pi/coverage-floors.tsv"
+TABLE="$ROOT/$TABLE_REL"
+BASE=""
+MODE="check"
+
+while [ $# -gt 0 ]; do
+	case "$1" in
+	--base) BASE="${2:-}"; shift 2 ;;
+	--self-test) MODE="self-test"; shift ;;
+	--base-file) MODE="base-file"; BASE="${2:-}"; shift 2 ;;
+	--new-file) NEWFILE="${2:-}"; shift 2 ;;
+	*) shift ;;
+	esac
+done
+
+compare() {
+	# $1 = base table file, $2 = new table file
+	python3 - "$1" "$2" <<'PY'
+import sys
+
+def parse(path):
+    rows = {}
+    for lineno, line in enumerate(open(path, encoding="utf-8"), 1):
+        if line.startswith("#") or not line.strip():
+            continue
+        parts = line.rstrip("\n").split("\t")
+        if len(parts) < 2:
+            print(f"{path}:{lineno}: malformed row (need layer<TAB>floor...)", file=sys.stderr)
+            sys.exit(2)
+        layer, floor = parts[0], parts[1]
+        # An uncommented header row is the column name, not a floor.
+        if layer.strip().lower() == "layer":
+            continue
+        try:
+            rows[layer] = float(floor)
+        except ValueError:
+            print(f"{path}:{lineno}: floor is not a number: {floor!r}", file=sys.stderr)
+            sys.exit(2)
+    return rows
+
+base = parse(sys.argv[1])
+new = parse(sys.argv[2])
+problems = []
+
+for layer, b in sorted(base.items()):
+    if layer not in new:
+        problems.append(f"layer '{layer}' disappeared — its floor ({b:g}) no longer gates")
+    elif new[layer] < b - 1e-9:
+        problems.append(f"layer '{layer}' floor decreased {b:g} -> {new[layer]:g} "
+                        f"(a floor is a ratchet; never lower it)")
+
+if problems:
+    print("coverage floors regressed:", file=sys.stderr)
+    for p in problems:
+        print(f"  {p}", file=sys.stderr)
+    sys.exit(1)
+
+raised = [f"{l} {base[l]:g}->{new[l]:g}" for l in base if l in new and new[l] > base[l] + 1e-9]
+print(f"coverage floors OK — {len(new)} layer(s), no floor lowered"
+      + (f"; raised: {', '.join(raised)}" if raised else ""))
+PY
+}
+
+if [ "$MODE" = "--self-test" ] || [ "$MODE" = "self-test" ]; then
+	TD="$(mktemp -d "${TMPDIR:-/tmp}/floors-selftest.XXXXXX")"
+	ok=0
+	fail=0
+	bump() { if [ "$1" -eq 0 ]; then ok=$((ok + 1)); else fail=$((fail + 1)); fi; }
+
+	tbl() { printf 'layer\tfloor\tmeasured\ttarget\n%s\n' "$2" >"$TD/$1.tsv"; }
+
+	# 1. unchanged -> pass
+	tbl base 'domain	90	92	95'
+	tbl same 'domain	90	92	95'
+	compare "$TD/base.tsv" "$TD/same.tsv" >/dev/null 2>&1
+	bump $?
+
+	# 2. raised -> pass
+	tbl raised 'domain	95	96	95'
+	compare "$TD/base.tsv" "$TD/raised.tsv" >/dev/null 2>&1
+	bump $?
+
+	# 3. lowered -> fail
+	tbl lowered 'domain	80	92	95'
+	compare "$TD/base.tsv" "$TD/lowered.tsv" >/dev/null 2>&1
+	[ $? -ne 0 ]
+	bump $?
+
+	# 4. layer removed -> fail
+	tbl removed 'application	90	91	90'
+	compare "$TD/base.tsv" "$TD/removed.tsv" >/dev/null 2>&1
+	[ $? -ne 0 ]
+	bump $?
+
+	echo "self-test: $ok ok, $fail failed"
+	[ "$fail" -eq 0 ]
+	exit $?
+fi
+
+if [ "$MODE" != "--self-test" ] && [ "$MODE" != "self-test" ] && [ ! -f "$TABLE" ]; then
+	echo "no coverage floors table ($TABLE_REL) — nothing to ratchet (OK)"
+	exit 0
+fi
+
+if [ -n "$BASE" ]; then
+	git rev-parse --verify --quiet "$BASE" >/dev/null || {
+		echo "unknown base ref: $BASE" >&2
+		exit 2
+	}
+	BASE_COPY="$(mktemp "${TMPDIR:-/tmp}/floors-base.XXXXXX")"
+	if ! git show "$BASE:$TABLE_REL" >"$BASE_COPY" 2>/dev/null; then
+		echo "no $TABLE_REL at $BASE — first ratchet commit (OK)"
+		exit 0
+	fi
+	compare "$BASE_COPY" "$TABLE"
+else
+	# Default: compare against the merge base with the default branch when known.
+	DEFAULT_BRANCH="$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null | sed 's|^origin/||')"
+	[ -z "$DEFAULT_BRANCH" ] && DEFAULT_BRANCH="main"
+	MB="$(git merge-base HEAD "origin/$DEFAULT_BRANCH" 2>/dev/null || git merge-base HEAD "$DEFAULT_BRANCH" 2>/dev/null || true)"
+	if [ -z "$MB" ]; then
+		echo "no base commit available — floors unchanged in this checkout (OK)"
+		exit 0
+	fi
+	BASE_COPY="$(mktemp "${TMPDIR:-/tmp}/floors-base.XXXXXX")"
+	if ! git show "$MB:$TABLE_REL" >"$BASE_COPY" 2>/dev/null; then
+		echo "no $TABLE_REL at merge base — first ratchet commit (OK)"
+		exit 0
+	fi
+	compare "$BASE_COPY" "$TABLE"
+fi