its-magic 0.1.2-42 → 0.1.2-48

package/template/scripts/check_downstream_ci_guard.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+"""
+Downstream CI drift guard CLI (BUG-0009 / DEC-0075).
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+
+_SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
+_REPO_ROOT = os.path.normpath(os.path.join(_SCRIPT_DIR, ".."))
+
+if _SCRIPT_DIR not in sys.path:
+    sys.path.insert(0, _SCRIPT_DIR)
+
+import downstream_ci_guard_lib as dci  # noqa: E402
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="Downstream CI drift guard (template forbidden scan + active inventory)."
+    )
+    parser.add_argument(
+        "--repo",
+        default=_REPO_ROOT,
+        help="Target repository root (default: parent of scripts/).",
+    )
+    parser.add_argument(
+        "--self-test",
+        action="store_true",
+        help="Run stable marker subtests.",
+    )
+    parser.add_argument(
+        "--report",
+        action="store_true",
+        help="Emit JSON inventory to stdout.",
+    )
+    args = parser.parse_args()
+
+    if args.self_test:
+        try:
+            dci.self_test()
+        except AssertionError as exc:
+            print(f"self-test failed: {exc}", file=sys.stderr)
+            return 2
+        print("[DOWNSTREAM_CI_GUARD_SELF_TEST_OK]")
+        return 0
+
+    target = os.path.abspath(args.repo)
+    report, stderr_lines = dci.build_report(target)
+
+    if args.report:
+        print(json.dumps(dci.report_to_dict(report), sort_keys=True, separators=(",", ":")))
+
+    for line in stderr_lines:
+        print(line, file=sys.stderr)
+
+    if not report.ok:
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/template/scripts/check_intake_template_parity.py

@@ -1,5 +1,14 @@
 #!/usr/bin/env python3
-"""Verify active vs template/scripts/ bytes match for DEC-0063 intake gate modules (BUG-0001)."""
+"""Verify active vs template/scripts/ bytes match for DEC-0063 intake gate modules (BUG-0001).
+
+Scoped modes (DEC-0073 §10 / US-0090):
+  --scope=intake          (default) DEC-0063 intake pair table.
+  --scope=caveman-compress DEC-0073 caveman input-compression pair table.
+  --scope=readme-feature-coverage DEC-0074 README feature-coverage pair table.
+  --scope=downstream-ci-guard   DEC-0075 downstream CI guard script pair table.
+  --scope=us-0092               DEC-0078 full-autonomy outer driver + probe surfaces.
+  --scope=all              union of all tables.
+"""
 
 from __future__ import annotations
 
@@ -7,7 +16,6 @@ import argparse
 import sys
 from pathlib import Path
 
-# Normative pairs: repo scripts/ (canonical dev) → template/scripts/ (packaged ship path).
 INTAKE_TEMPLATE_PAIRS: tuple[tuple[str, str], ...] = (
     ("scripts/intake_evidence_validate.py", "template/scripts/intake_evidence_validate.py"),
     ("scripts/intake_evidence_lib.py", "template/scripts/intake_evidence_lib.py"),
@@ -16,6 +24,86 @@ INTAKE_TEMPLATE_PAIRS: tuple[tuple[str, str], ...] = (
     ("scripts/check_intake_template_parity.py", "template/scripts/check_intake_template_parity.py"),
 )
 
+# DEC-0073 §10 / US-0090 — Caveman input-compression surface pairs. Contents
+# must be byte-identical between active and template paths; installer delivers
+# template copies (BUG-0003 / DEC-0066).
+CAVEMAN_COMPRESS_PAIRS: tuple[tuple[str, str], ...] = (
+    ("scripts/caveman_compress_input.py", "template/scripts/caveman_compress_input.py"),
+    ("docs/engineering/context/installer-owned-paths.manifest",
+     "template/docs/engineering/context/installer-owned-paths.manifest"),
+    ("docs/engineering/runbook.md", "template/docs/engineering/runbook.md"),
+    ("docs/engineering/auto-orchestration-reference.md",
+     "template/docs/engineering/auto-orchestration-reference.md"),
+)
+
+README_FEATURE_COVERAGE_PAIRS: tuple[tuple[str, str], ...] = (
+    (
+        "scripts/validate_readme_feature_coverage.py",
+        "template/scripts/validate_readme_feature_coverage.py",
+    ),
+    (
+        "scripts/readme_feature_coverage_lib.py",
+        "template/scripts/readme_feature_coverage_lib.py",
+    ),
+    (
+        "docs/engineering/context/readme-section-affinity.json",
+        "template/docs/engineering/context/readme-section-affinity.json",
+    ),
+    (".cursor/commands/release.md", "template/.cursor/commands/release.md"),
+    ("docs/engineering/runbook.md", "template/docs/engineering/runbook.md"),
+    (
+        "docs/engineering/context/installer-owned-paths.manifest",
+        "template/docs/engineering/context/installer-owned-paths.manifest",
+    ),
+    (
+        "scripts/check_intake_template_parity.py",
+        "template/scripts/check_intake_template_parity.py",
+    ),
+)
+
+US0092_PAIRS: tuple[tuple[str, str], ...] = (
+    ("scripts/auto_outer_driver.py", "template/scripts/auto_outer_driver.py"),
+    ("scripts/uat_probe_lib.py", "template/scripts/uat_probe_lib.py"),
+    (
+        "docs/engineering/context/installer-owned-paths.manifest",
+        "template/docs/engineering/context/installer-owned-paths.manifest",
+    ),
+    (".cursor/commands/auto.md", "template/.cursor/commands/auto.md"),
+    (".cursor/commands/verify-work.md", "template/.cursor/commands/verify-work.md"),
+    (".cursor/commands/qa.md", "template/.cursor/commands/qa.md"),
+    (
+        "docs/engineering/auto-orchestration-reference.md",
+        "template/docs/engineering/auto-orchestration-reference.md",
+    ),
+    ("docs/engineering/runbook.md", "template/docs/engineering/runbook.md"),
+)
+
+DOWNSTREAM_CI_GUARD_PAIRS: tuple[tuple[str, str], ...] = (
+    (
+        "scripts/check_downstream_ci_guard.py",
+        "template/scripts/check_downstream_ci_guard.py",
+    ),
+    (
+        "scripts/downstream_ci_guard_lib.py",
+        "template/scripts/downstream_ci_guard_lib.py",
+    ),
+)
+
+SCOPES: dict[str, tuple[tuple[str, str], ...]] = {
+    "intake": INTAKE_TEMPLATE_PAIRS,
+    "caveman-compress": CAVEMAN_COMPRESS_PAIRS,
+    "readme-feature-coverage": README_FEATURE_COVERAGE_PAIRS,
+    "downstream-ci-guard": DOWNSTREAM_CI_GUARD_PAIRS,
+    "us-0092": US0092_PAIRS,
+    "all": (
+        INTAKE_TEMPLATE_PAIRS
+        + CAVEMAN_COMPRESS_PAIRS
+        + README_FEATURE_COVERAGE_PAIRS
+        + DOWNSTREAM_CI_GUARD_PAIRS
+        + US0092_PAIRS
+    ),
+}
+
 
 def main() -> int:
     p = argparse.ArgumentParser(description=__doc__)
@@ -25,10 +113,17 @@ def main() -> int:
         default=Path(__file__).resolve().parent.parent,
         help="Repository root",
     )
+    p.add_argument(
+        "--scope",
+        choices=sorted(SCOPES.keys()),
+        default="intake",
+        help="Parity pair table to verify.",
+    )
     args = p.parse_args()
     root: Path = args.repo
+    pairs = SCOPES[args.scope]
     failed = False
-    for rel_active, rel_tpl in INTAKE_TEMPLATE_PAIRS:
+    for rel_active, rel_tpl in pairs:
         a = root / rel_active
         t = root / rel_tpl
         if not a.is_file() or not t.is_file():
@@ -45,7 +140,7 @@ def main() -> int:
             failed = True
     if failed:
         return 2
-    print("[INTAKE_TEMPLATE_PARITY_OK]")
+    print(f"[INTAKE_TEMPLATE_PARITY_OK] scope={args.scope}")
     return 0
 
 

package/template/scripts/downstream_ci_guard_lib.py

@@ -0,0 +1,222 @@
+"""
+Downstream CI drift guard — template forbidden-pattern scan + active inventory (BUG-0009 / DEC-0075).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Optional, Set, Tuple
+
+JOB_KEY_RE = re.compile(r"^\s{2}(\w[\w-]*):", re.MULTILINE)
+
+FORBIDDEN_JOB_IDS = frozenset({"npm-test", "brew-test", "choco-test"})
+ALLOWED_TEMPLATE_JOBS = frozenset({"checks", "auto-fix"})
+REQUIRED_ACTIVE_JOBS = frozenset(
+    {"checks", "auto-fix", "npm-test", "brew-test", "choco-test"}
+)
+
+FORBIDDEN_SUBSTRINGS: Tuple[str, ...] = (
+    "npm-test",
+    "brew-test",
+    "choco-test",
+    "npm pack",
+    "its-magic-*.tgz",
+    "installer.sh",
+    "packaging/chocolatey",
+    "packaging/homebrew",
+    "choco pack",
+    "brew style",
+)
+
+REASON_FORBIDDEN_PATTERN = "DOWNSTREAM_CI_FORBIDDEN_PATTERN"
+REASON_JOB_LEAK = "DOWNSTREAM_CI_JOB_LEAK"
+REASON_PACKAGING_MISSING = "KIT_CI_PACKAGING_JOBS_MISSING"
+
+REPORT_SCHEMA_VERSION = 1
+
+
+@dataclass
+class GuardViolation:
+    reason_code: str
+    detail: str
+
+
+@dataclass
+class GuardReport:
+    template_job_keys: List[str] = field(default_factory=list)
+    active_job_keys: List[str] = field(default_factory=list)
+    forbidden_hits: List[str] = field(default_factory=list)
+    violations: List[GuardViolation] = field(default_factory=list)
+    ok: bool = True
+
+
+def read_utf8(path: str) -> str:
+    with open(path, "r", encoding="utf-8") as f:
+        return f.read()
+
+
+def extract_job_keys(yaml_text: str) -> List[str]:
+    """Extract top-level job ids from a GitHub Actions workflow (stdlib regex only)."""
+    keys: List[str] = []
+    in_jobs = False
+    for line in yaml_text.splitlines():
+        if re.match(r"^jobs:\s*$", line):
+            in_jobs = True
+            continue
+        if not in_jobs:
+            continue
+        m = JOB_KEY_RE.match(line)
+        if m:
+            keys.append(m.group(1))
+        elif line and not line.startswith(" ") and not line.startswith("#"):
+            break
+    return keys
+
+
+def scan_forbidden_patterns(yaml_text: str) -> List[str]:
+    hits: List[str] = []
+    for pattern in FORBIDDEN_SUBSTRINGS:
+        if pattern in yaml_text:
+            hits.append(pattern)
+    return hits
+
+
+def check_template_ci(yaml_text: str) -> List[GuardViolation]:
+    violations: List[GuardViolation] = []
+    job_keys = extract_job_keys(yaml_text)
+    extra_jobs = set(job_keys) - ALLOWED_TEMPLATE_JOBS
+    if extra_jobs:
+        violations.append(
+            GuardViolation(
+                REASON_JOB_LEAK,
+                f"template ci.yml job keys {sorted(job_keys)!r} exceed allowed "
+                f"{sorted(ALLOWED_TEMPLATE_JOBS)!r}",
+            )
+        )
+    forbidden = scan_forbidden_patterns(yaml_text)
+    if forbidden:
+        violations.append(
+            GuardViolation(
+                REASON_FORBIDDEN_PATTERN,
+                f"template ci.yml contains forbidden pattern(s): {forbidden}",
+            )
+        )
+    return violations
+
+
+def check_active_ci(yaml_text: str) -> List[GuardViolation]:
+    violations: List[GuardViolation] = []
+    job_keys = set(extract_job_keys(yaml_text))
+    missing = REQUIRED_ACTIVE_JOBS - job_keys
+    if missing:
+        violations.append(
+            GuardViolation(
+                REASON_PACKAGING_MISSING,
+                f"active ci.yml missing required job id(s): {sorted(missing)!r}; "
+                f"found {sorted(job_keys)!r}",
+            )
+        )
+    return violations
+
+
+def build_report(repo_root: str) -> Tuple[GuardReport, List[str]]:
+    report = GuardReport()
+    stderr_lines: List[str] = []
+
+    template_ci = os.path.join(
+        repo_root, "template", ".github", "workflows", "ci.yml"
+    )
+    active_ci = os.path.join(repo_root, ".github", "workflows", "ci.yml")
+
+    if not os.path.isfile(template_ci):
+        stderr_lines.append(f"missing template ci.yml: {template_ci}")
+        report.ok = False
+        return report, stderr_lines
+    if not os.path.isfile(active_ci):
+        stderr_lines.append(f"missing active ci.yml: {active_ci}")
+        report.ok = False
+        return report, stderr_lines
+
+    template_text = read_utf8(template_ci)
+    active_text = read_utf8(active_ci)
+
+    report.template_job_keys = extract_job_keys(template_text)
+    report.active_job_keys = extract_job_keys(active_text)
+    report.forbidden_hits = scan_forbidden_patterns(template_text)
+
+    for v in check_template_ci(template_text):
+        report.violations.append(v)
+        stderr_lines.append(f"{v.reason_code}: {v.detail}")
+    for v in check_active_ci(active_text):
+        report.violations.append(v)
+        stderr_lines.append(f"{v.reason_code}: {v.detail}")
+
+    report.ok = len(report.violations) == 0
+    return report, stderr_lines
+
+
+def report_to_dict(report: GuardReport) -> Dict[str, Any]:
+    return {
+        "schema_version": REPORT_SCHEMA_VERSION,
+        "template_job_keys": report.template_job_keys,
+        "active_job_keys": report.active_job_keys,
+        "forbidden_hits": report.forbidden_hits,
+        "violations": [
+            {"reason_code": v.reason_code, "detail": v.detail}
+            for v in report.violations
+        ],
+        "ok": report.ok,
+    }
+
+
+def self_test() -> None:
+    sample_template = """name: ci
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+  auto-fix:
+    runs-on: ubuntu-latest
+"""
+    keys = extract_job_keys(sample_template)
+    assert keys == ["checks", "auto-fix"], keys
+
+    bad_template = """name: ci
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+  npm-test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: npm pack
+"""
+    v = check_template_ci(bad_template)
+    assert any(x.reason_code == REASON_JOB_LEAK for x in v)
+    assert any(x.reason_code == REASON_FORBIDDEN_PATTERN for x in v)
+
+    good_active = """name: ci
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+  auto-fix:
+    runs-on: ubuntu-latest
+  npm-test:
+    runs-on: ubuntu-latest
+  brew-test:
+    runs-on: ubuntu-latest
+  choco-test:
+    runs-on: ubuntu-latest
+"""
+    assert not check_active_ci(good_active)
+
+    bad_active = """name: ci
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+  auto-fix:
+    runs-on: ubuntu-latest
+"""
+    v2 = check_active_ci(bad_active)
+    assert len(v2) == 1 and v2[0].reason_code == REASON_PACKAGING_MISSING

package/template/scripts/enforce-triad-hot-surface.py

@@ -45,7 +45,9 @@ PO_ARCH_DIR = Path("handoffs/archive")
 ARCH_ARCH_DIR = Path("docs/engineering/architecture-archive")
 
 CHECKPOINT_HEADING = re.compile(r"^## .*\bcheckpoint\b.*$", re.I)
-STORY_HEADING = re.compile(r"^# US-\d{4}\s*[:\u2014\-].+$")
+STORY_HEADING_H1 = re.compile(r"^# (?:US|BUG)-\d{4}\s*[:\u2014\-].+$")
+STORY_HEADING_H2 = re.compile(r"^## US-\d{4}\s*[:\u2014\-].+$")
+_STORY_ID_FROM_LINE = re.compile(r"(?:US|BUG)-\d{4}")
 
 
 class PolicyError(Exception):
@@ -135,9 +137,34 @@ def split_po_sections(text: str) -> List[str]:
     return sections
 
 
+def _story_boundary_candidates(text: str) -> List[Tuple[int, str, int]]:
+    """Collect (line_idx, story_id, level) for H1/H2 story-heading matches."""
+    lines = text.splitlines(keepends=True)
+    candidates: List[Tuple[int, str, int]] = []
+    for i, ln in enumerate(lines):
+        stripped = ln.rstrip("\r\n")
+        if STORY_HEADING_H1.match(stripped):
+            m = _STORY_ID_FROM_LINE.search(stripped)
+            if m:
+                candidates.append((i, m.group(0), 1))
+        elif STORY_HEADING_H2.match(stripped):
+            m = _STORY_ID_FROM_LINE.search(stripped)
+            if m:
+                candidates.append((i, m.group(0), 2))
+    return candidates
+
+
 def split_arch_stories(text: str) -> Tuple[str, List[str]]:
     lines = text.splitlines(keepends=True)
-    idxs = [i for i, ln in enumerate(lines) if STORY_HEADING.match(ln.rstrip("\r\n"))]
+    candidates = _story_boundary_candidates(text)
+    if not candidates:
+        return text, []
+    h1_ids = {story_id for _, story_id, level in candidates if level == 1}
+    idxs = sorted(
+        idx
+        for idx, story_id, level in candidates
+        if not (level == 2 and story_id in h1_ids)
+    )
     if not idxs:
         return text, []
     preamble = "".join(lines[: idxs[0]])
@@ -148,6 +175,18 @@ def split_arch_stories(text: str) -> Tuple[str, List[str]]:
     return preamble, blocks
 
 
+def count_h2_story_headings(text: str) -> int:
+    return sum(
+        1 for ln in text.splitlines() if STORY_HEADING_H2.match(ln.rstrip("\r\n"))
+    )
+
+
+def check_arch_heading_policy(text_after: str, baseline_h2_count: int) -> Optional[str]:
+    if count_h2_story_headings(text_after) > baseline_h2_count:
+        return "ARCH_STORY_HEADING_LEVEL_INVALID"
+    return None
+
+
 def next_pack_path(repo: Path, archive_dir: Path, stem: str) -> Path:
     archive_dir.mkdir(parents=True, exist_ok=True)
     day = datetime.now(timezone.utc).strftime("%Y%m%d")
@@ -352,7 +391,7 @@ def rollover_architecture(repo: Path, policy: Dict[str, str], dry_run: bool) ->
             return None
         raise PolicyError(
             "STATE_ARCHIVE_BOUNDARY_AMBIGUOUS",
-            "architecture file exceeds line cap but has no US story headings to archive",
+            "architecture file exceeds line cap but has no story headings to archive",
         )
     moved = 0
     work = list(stories)
@@ -491,11 +530,43 @@ def cmd_self_test() -> int:
     if [line_count(s) for s in secs] != [3, 3, 3]:
         fail("po section split line counts unexpected")
 
-    # --- arch stories ---
+    # --- arch stories (H1 non-regression) ---
     arch = "# Preamble line\n\n# US-0001: One\nx\n# US-0002: Two\ny\n"
     apre, stories = split_arch_stories(arch)
     if "Preamble" not in apre or len(stories) != 2:
-        fail("architecture story split failed")
+        fail("architecture H1 story split failed")
+
+    # --- mixed H1+H2 same id: H1 wins ---
+    mixed = "# US-0067: Alpha\nbody\n## US-0067: Legacy\nmore\n# US-0068: Next\nz\n"
+    _, mixed_stories = split_arch_stories(mixed)
+    if len(mixed_stories) != 2:
+        fail("mixed H1+H2 same id should yield two blocks (H1-wins)")
+    if not mixed_stories[0].startswith("# US-0067"):
+        fail("mixed file first block should start at H1 US-0067")
+
+    # --- inner ## subheading inside # US- block is not a boundary ---
+    inner = "# US-0001: Story\n## Details\nnested\n# US-0002: Two\ny\n"
+    _, inner_stories = split_arch_stories(inner)
+    if len(inner_stories) != 2:
+        fail("inner ## Details must not create extra story boundary")
+    if "## Details" not in inner_stories[0]:
+        fail("inner subheading should remain inside first story block")
+
+    # --- BUG H1 parity ---
+    bug_arch = "# BUG-0009: Defect\nbody\n# US-0010: Story\nmore\n"
+    _, bug_stories = split_arch_stories(bug_arch)
+    if len(bug_stories) != 2 or not bug_stories[0].startswith("# BUG-0009"):
+        fail("BUG H1 story boundary not recognized")
+
+    # --- heading policy enforcement delta ---
+    baseline_text = "## US-0001: A\nx\n"
+    increased = baseline_text + "## US-0099: New H2\ny\n"
+    if check_arch_heading_policy(baseline_text, 1) is not None:
+        fail("stable H2 count should not fail policy")
+    if check_arch_heading_policy(increased, 1) != "ARCH_STORY_HEADING_LEVEL_INVALID":
+        fail("H2 count increase must return ARCH_STORY_HEADING_LEVEL_INVALID")
+    if check_arch_heading_policy(increased, 2) is not None:
+        fail("count decrease/normalization should pass policy")
 
     with tempfile.TemporaryDirectory() as tmp:
         root = Path(tmp)
@@ -543,14 +614,33 @@ def cmd_self_test() -> int:
         (root / ARCH_REL).write_text(arch_big, encoding="utf-8")
         a1 = rollover_architecture(root, policy_arch, dry_run=False)
         if not a1:
-            fail("architecture rollover expected")
+            fail("architecture H1 rollover expected")
         a2 = rollover_architecture(root, policy_arch, dry_run=False)
         if a2 is not None:
-            fail("architecture idempotent")
+            fail("architecture H1 idempotent")
         merged_arch = dict(DEFAULTS)
         merged_arch.update(policy_arch)
         if run_check(root, merged_arch):
-            fail("architecture check should pass")
+            fail("architecture H1 check should pass")
+
+        # --- ##-only rollover (legacy H2 sections) ---
+        policy_h2 = dict(DEFAULTS)
+        policy_h2["ARCH_HOT_MAX_LINES"] = "12"
+        policy_h2["ARCH_HOT_MAX_STORY_SECTIONS"] = "2"
+        h2_big = "# Top\n\n" + "".join(
+            f"## US-100{i}: Legacy\nL{i}\n\n" for i in range(4)
+        )
+        (root / ARCH_REL).write_text(h2_big, encoding="utf-8")
+        h2_1 = rollover_architecture(root, policy_h2, dry_run=False)
+        if not h2_1 or h2_1.get("moved", 0) < 1:
+            fail("##-only architecture rollover should move at least one block")
+        h2_2 = rollover_architecture(root, policy_h2, dry_run=False)
+        if h2_2 is not None:
+            fail("##-only architecture rollover should be idempotent")
+        merged_h2 = dict(DEFAULTS)
+        merged_h2.update(policy_h2)
+        if run_check(root, merged_h2):
+            fail("##-only architecture check should pass after rollover")
 
     if errors:
         for e in errors:
@@ -566,6 +656,16 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
     mx.add_argument("--check", action="store_true", help="verify caps, no writes")
     mx.add_argument("--rollover", action="store_true", help="archive oldest units when over cap")
     mx.add_argument("--self-test", action="store_true", help="internal regression fixtures")
+    mx.add_argument(
+        "--check-arch-heading-policy",
+        action="store_true",
+        help="fail when H2 story-heading count increased vs baseline",
+    )
+    p.add_argument(
+        "--baseline-h2-count",
+        type=int,
+        help="baseline H2 story-heading count (required with --check-arch-heading-policy)",
+    )
     p.add_argument(
         "--json",
         action="store_true",
@@ -603,6 +703,33 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
             return 1
         return 0
 
+    if args.check_arch_heading_policy:
+        if args.baseline_h2_count is None:
+            print(
+                "STATE_ARCHIVE_VERIFICATION_FAILED "
+                "missing --baseline-h2-count for --check-arch-heading-policy",
+                file=sys.stderr,
+            )
+            return 2
+        try:
+            arch_text = (repo / ARCH_REL).read_text(encoding="utf-8")
+        except OSError as exc:
+            print(
+                f"STATE_ARCHIVE_WRITE_FAILED could_not_read_architecture detail={exc}",
+                file=sys.stderr,
+            )
+            return 2
+        code = check_arch_heading_policy(arch_text, args.baseline_h2_count)
+        if code:
+            print(
+                f"{code} h2_story_heading_count_increased "
+                f"baseline={args.baseline_h2_count} "
+                f"after={count_h2_story_headings(arch_text)}",
+                file=sys.stderr,
+            )
+            return 1
+        return 0
+
     if args.rollover:
         try:
             outs = run_rollover_all(repo, policy, dry_run=args.dry_run)