simt-dev 0.1.0 → 0.2.0

package/docs/decisions/ADR-027-the-one-gitattributes-line-that-is-neither-dangerous-nor-empty.md

@@ -19,8 +19,8 @@ empty", and deferred it to a record of its own.
 
 The estate confirms the first half and not the conclusion. Thirteen of sixteen repositories
 have no `.gitattributes` at all. The three that do disagree about almost everything:
-`simt-app` declares only LFS filters for `.tif` and `.zip`; `simt-garmin` declares line
-endings plus ConnectIQ binary markers; `simt-social-api` declares exactly one whitespace
+`repo-05` declares only LFS filters for `.tif` and `.zip`; `repo-07` declares line
+endings plus ConnectIQ binary markers; `repo-11` declares exactly one whitespace
 suppression for hash-locked vendored content. There is no divergence here of the kind a
 baseline fixes by being consistent. There is a file missing.
 
@@ -48,7 +48,7 @@ to be the line ruling 7 sent this file to make.
    because nothing in the pattern says those are binary. `text=auto` is a detection: git
    sniffs each path and applies normalisation only to files it concludes are text. This is
    the most common way a repository corrupts its own binaries, and it is invisible until
-   someone diffs an image. `simt-garmin` had independently arrived at `text=auto eol=lf` on
+   someone diffs an image. `repo-07` had independently arrived at `text=auto eol=lf` on
    its first line, which is the strongest available evidence that the estate would pick the
    cautious form if asked — this ruling does not ask, it supplies.
 
@@ -96,8 +96,8 @@ what any file is". A future baseline for a per-stack attribute would have to arr
 different row with its own record, which is what §3.2's keep-it-local rule asks for anyway.
 
 The repositories with an existing `.gitattributes` are the interesting case and they are not
-in conflict: `simt-app`'s LFS filters, `simt-garmin`'s binary markers and
-`simt-social-api`'s whitespace suppression all stay beneath the region and all keep winning,
+in conflict: `repo-05`'s LFS filters, `repo-07`'s binary markers and
+`repo-11`'s whitespace suppression all stay beneath the region and all keep winning,
 because git takes the last match. No repository loses a line it wrote.
 
 This repository adopts neither baseline for itself, and the reason is the same one that keeps

package/docs/decisions/ADR-028-a-base-file-is-a-floor-so-the-disagreement-it-cannot-repair-becomes-a-check.md

@@ -10,7 +10,7 @@ a copied byte range. Settles the `tsconfig.base.json` item of §3.1 row 5 and ro
 ## Context
 
 Row 5 promised eight baselines and named two problems among them that are not about a file
-being missing: simt-goto's seven absent strictness flags, and `moduleResolution` spelled
+being missing: repo-08's seven absent strictness flags, and `moduleResolution` spelled
 inconsistently across the workspace. ADR-025 ruled `tsconfig.base.json` out of the region
 mechanism because JSON has no comments, and its consequences promised that "the next fix is
 three more JSON files and therefore a different mechanism". ADR-026 supplied that mechanism
@@ -95,7 +95,7 @@ one an external document uses.
 
 A TypeScript repository now gets twelve flags it did not have, and one of them — the floor
 arriving through `extends` — is a behaviour change that can surface real type errors in
-`simt-goto`, which is the point of the record and also the reason adoption is one commit
+`repo-08`, which is the point of the record and also the reason adoption is one commit
 with a `tsc` run rather than a silent upgrade. A base file is a floor, and a repository
 that had not been standing on one is the case where raising it finds something.
 

package/docs/decisions/ADR-029-the-pins-a-repository-declares-are-its-own.md

@@ -104,7 +104,7 @@ nobody has been asked, and it is the record to read next for either.
 
 - **A shipped `.nvmrc` or an `engines` value in a shared baseline.** Rejected as
   unrulable: the value is per-repository and the tool can only guess it. Shipping `22` would
-  break `simt-social`, which pins 24.
+  break `repo-14`, which pins 24.
 - **Reporting cross-repository node divergence as a finding.** Rejected by the Context. The
   plan's premise was wrong and the correction is recorded here so it is not re-derived from
   the plan text.

package/docs/decisions/ADR-030-what-a-plan-does-not-ship-is-a-decision-with-a-record.md

@@ -56,7 +56,7 @@ correcting at all.
    detectable by reading the file. Corrected in the row.
 
 5. **Two of the four configurations are plain JavaScript with no TypeScript in them,**
-   `simt-api` and `simt-blog`. A "shared 6-rule ESLint block" cannot describe all four,
+   `repo-04` and `repo-06`. A "shared 6-rule ESLint block" cannot describe all four,
    because two of them have no rules to share — they differ in `ignores` and per-file
    `globals`, which are per-repository facts about paths.
 
@@ -67,7 +67,7 @@ correcting at all.
    may make on its own.
 
 7. **The fix for the two conflicts is one dependency each,** and it is not a shared block.
-   Installing `eslint-config-prettier` in `simt-social` and `simt-social-api` and spreading
+   Installing `eslint-config-prettier` in `repo-14` and `repo-11` and spreading
    it last in the config array resolves both. That is a command per repository, run by the
    repositories, and simt-dev has no business writing it.
 

package/docs/decisions/ADR-031-the-suite-stages-the-environment-it-needs.md

@@ -16,9 +16,9 @@ landed. Not intermittently: 22 of 543 tests failed on runs `37476671363` through
 Three separate causes, none of them recent:
 
 1. **`test/install.test.mjs:17` read the estate off the author's disk.**
-   `const WORKSPACE = resolve(HERE, '..', '..')` is `/Users/said.elimam/code/simt`, and the
-   install tests copied skill bodies out of it — `simt-social-api/.agents/skills/d1-safe-change`,
-   and `singleRepoClone()` out of `simt-social`. On a runner the checkout is
+   `const WORKSPACE = resolve(HERE, '..', '..')` is `/home/developer/code/simt`, and the
+   install tests copied skill bodies out of it — `repo-11/.agents/skills/d1-safe-change`,
+   and `singleRepoClone()` out of `repo-14`. On a runner the checkout is
    `/home/runner/work/simt-dev/simt-dev`, so `../..` is `/home/runner/work/simt-dev`,
    which contains this repository and nothing else. The bodies were not there,
    `skills install` exited 3, and nineteen tests asserted on a refusal they never asked for.

package/docs/decisions/ADR-033-three-plan-rows-closed-by-decision-not-by-authoring.md

@@ -25,7 +25,7 @@ Phase 6 asked to "collapse the 7 drifted Social skill twins to canonical + stub"
 answers the row directly. All three resolvers select `role === 'canonical'` and nothing else —
 `src/commands/skills.mjs` twice, `src/commands/skillsinstall.mjs:291`, `src/mcp/tools.mjs:192` — so
 a copy declared `duplicate` or `variant` is never installed. The one pair that genuinely had to be
-collapsed, `add-country-galaxy`, is already a stub in `simt-social` pointing at the API repo.
+collapsed, `add-country-galaxy`, is already a stub in `repo-14` pointing at the API repo.
 
 Phase 7 asked for a sweep of hardcoded absolute paths. The sweep found 17 tracked files. Six were
 fixed. The two Android `local.properties` files were not, and were nearly fixed by reflex.
@@ -47,7 +47,7 @@ fixed. The two Android `local.properties` files were not, and were nearly fixed
    because resolution never read those bytes. Phase 6's twin collapse is therefore closed as
    already answered, at `a9983c8`.
 
-3. **`local.properties` stays tracked.** Both `simt-app` and `wakt-app` commit it, and both
+3. **`local.properties` stays tracked.** Both `repo-05` and `repo-03` commit it, and both
    `.gitignore` files have the conventional `# local.properties` line commented out at lines 22 and
    24 — a deliberate override of Android's own convention, not an oversight. Untracking them would
    be a house-style change made while closing a plan, and a build machine that checks out without
@@ -74,8 +74,8 @@ unmade decision is not a gap to fill by invention.
 
 **Collapsing `graphify` and `parallel-feature-team`.** Both are declared `duplicate` with matching
 byte counts, so they look like the obvious candidates. `graphify` is `vendored: true` — an
-84 534-byte, ten-file, version-pinned tool present in both Social repos on purpose. Deleting
-simt-social's copy would leave nothing to detect the loss, because resolution only ever read the
+84 534-byte, ten-file, version-pinned tool present in both one repository on purpose. Deleting
+repo-14's copy would leave nothing to detect the loss, because resolution only ever read the
 canonical copy.
 
 **Untracking `local.properties`.** An Android SDK path is machine state, and two repos chose to

package/docs/decisions/ADR-041-the-suite-installs-the-package-in-order-to-test-it.md

@@ -21,7 +21,7 @@ Two facts about this repository make that gap harder to notice than it looks. `t
 reach outside the checkout (ADR-031), and this package has no dependencies (ADR-012). Together
 those mean the suite has no installed copy of itself to test, and the natural workaround —
 borrowing a formatter from a neighbouring checkout — is the one ADR-031 rules out. Prettier 3.8.1
-is sitting in `../simt-blog/node_modules/.bin` and is not available here.
+is sitting in `../repo-06/node_modules/.bin` and is not available here.
 
 ## Ruling
 
@@ -87,6 +87,6 @@ node, git and a POSIX shell; npm is in the same class. A conditional skip conver
 into an unverified one, which is the failure this file was written to stop.
 
 **Copying Prettier out of a sibling checkout.** It exists, it works, and ADR-031 rules it out for
-the same reason it rules out reading skill bodies from `../simt-social`: a suite that passes on
+the same reason it rules out reading skill bodies from `../repo-14`: a suite that passes on
 the author's machine and fails on a runner with only this checkout is evidence about the author's
 directory.

package/docs/decisions/ADR-045-a-dashboard-that-counts-a-defect.md

@@ -16,13 +16,13 @@ Measured over the 16 repositories at `~/code/simt`:
 ```
 staleRuleFiles: 17
 repos naming stale rule files in problems: 0
-simt-app problems:
+repo-05 problems:
   "the generated region was hand-edited; restore it with: simt-dev sync --yes"
   "core.hooksPath is \"hooks\", not the shared dispatcher; run: simt-dev hooks install --yes"
 ```
 
-Five adopted repositories have stale rule files — `simt-app`, `simt-blog` and `simt-social` at 0
-of 3 current, `simt-social-api` and `simt-social-media` at 0 of 4 — and not one of them said so in
+Five adopted repositories have stale rule files — `repo-05`, `repo-06` and `repo-14` at 0
+of 3 current, `repo-11` and `repo-13` at 0 of 4 — and not one of them said so in
 its problems list. The summary already said `staleRuleFiles: 17`, because `summarise` has always
 counted them. So the dashboard was reporting a count of a defect it refused to call a defect.
 

package/docs/decisions/ADR-046-one-rule-one-copy.md

@@ -14,11 +14,11 @@ Review 0001 §S12, marked P1 and "decision". Measured across the estate before a
 the five repositories selecting `opencode,cursor`:
 
 ```
-simt-app           folded=3  .mdc=3  0/3 current
-simt-blog          folded=3  .mdc=3  0/3 current
-simt-social        folded=3  .mdc=3  0/3 current
-simt-social-api    folded=4  .mdc=4  0/4 current
-simt-social-media  folded=4  .mdc=4  0/4 current
+repo-05           folded=3  .mdc=3  0/3 current
+repo-06          folded=3  .mdc=3  0/3 current
+repo-14        folded=3  .mdc=3  0/3 current
+repo-11    folded=4  .mdc=4  0/4 current
+repo-13  folded=4  .mdc=4  0/4 current
 ```
 
 Seventeen generated rule files. Every one of them byte-identical to the section already folded into

package/docs/decisions/ADR-047-a-profile-selects-on-what-a-repository-runs-on.md

@@ -50,7 +50,7 @@ other `react-native`, and neither receives both.
 **Two.** The Android and uv facts name a path at an unknown depth, which the two existing kinds
 (`file`, `dir`) cannot express. A third kind, `glob`, walks at most `GLOB_DEPTH` directory levels
 below the root. The bound is a convention, not a preference: the Android Gradle Plugin puts a
-module's manifest at `<module>/src/main/AndroidManifest.xml`, and simt-app's sits at
+module's manifest at `<module>/src/main/AndroidManifest.xml`, and repo-05's sits at
 `app/src/main/AndroidManifest.xml`. A shallower bound makes `has-android-manifest` the shape S07
 found — a fact no repository could have. A deeper one is a scan rather than a probe, and
 ADR-013's promise is that adding an ecosystem is data, so a fact must not cost a search.
@@ -78,11 +78,11 @@ repository loses coverage:
 
 | Repo | Before | After |
 | --- | --- | --- |
-| `app-ui`, `simt-app`, `wakt-app` | `core, jvm-android` | `core, android, jvm` |
-| `bunnyland-server` | `container, core, python` | `container, core, python, uv` |
+| `repo-01`, `repo-05`, `repo-03` | `core, jvm-android` | `core, android, jvm` |
+| `repo-02` | `container, core, python` | `container, core, python, uv` |
 
 The three Android repositories gain the profile whose body they actually needed and keep the JVM
-build rules; `simt-app` gaining `android` was the row's acceptance criterion. `bunnyland-server`
+build rules; `repo-05` gaining `android` was the row's acceptance criterion. `repo-02`
 carries a committed `uv.lock`, so its gain is the defect repaired, not a new selection.
 
 The rename is breaking in one narrow way: the id `jvm-android` no longer exists. A consumer that

package/docs/decisions/ADR-048-a-baseline-carries-only-keys-a-reader-honours.md

@@ -63,11 +63,11 @@ it.
 
 | Repository | Prettier config | States `singleQuote` | Adopting `quote_type = single` |
 | --- | --- | --- | --- |
-| `simt-api` | `.prettierrc` | `true` | no change |
-| `simt-blog` | `.prettierrc.json` | `true` | no change |
-| `simt-space` | `.prettierrc.json` | `true` | no change |
-| `simt-social-api` | `.prettierrc.json` | absent | **every source file reformatted** |
-| `simt-social` | `.prettierrc.json` | absent | **every source file reformatted** |
+| `repo-04` | `.prettierrc` | `true` | no change |
+| `repo-06` | `.prettierrc.json` | `true` | no change |
+| `repo-15` | `.prettierrc.json` | `true` | no change |
+| `repo-11` | `.prettierrc.json` | absent | **every source file reformatted** |
+| `repo-14` | `.prettierrc.json` | absent | **every source file reformatted** |
 
 Two repositories would have every source file rewritten on the day they adopted the
 tool, in a commit whose message says it adopted a rules projection. The measurement is

package/docs/decisions/ADR-057-an-identity-is-per-developer-and-a-repository-does-not-own-it.md

@@ -0,0 +1,115 @@
+# An identity is per-developer, and a repository does not own it
+
+Status: **accepted** · 2026-10-11
+
+Affects: `simt init`, `src/identity.mjs`, `test/identity.test.mjs`
+
+## Context
+
+Two repositories in the estate carried a `git.config` file in their tracked files.
+It holds a name and an email address:
+
+```ini
+[user]
+	name = <one developer's name>
+	email = <that developer's email address>
+```
+
+Both had a local `include.path` pointing at it, and both worked. Both were also
+wrong in ways that had nothing to do with each other.
+
+**It was a tracked file.** A repository has more than one person in it. Committed,
+one developer's name and email is published to every other developer and to
+everybody who can read the repository. This repository's own release review had
+already said so, in the table of findings, as: *"`git.config` tracked at the root
+with a personal name and email — Identity file in a public tree, read by nothing
+— Remove it from the tree."* The finding was recorded and the file stayed.
+
+**It pointed somewhere else.** Both `include.path` values named
+`../../simt-dev/git.config` — another repository's identity file, resolved through
+the git directory rather than the working tree. Including the git config's own
+file from a relative path three directories up means one repository's commits
+depend on a sibling checkout existing at an expected path, which fails the moment
+anybody clones without it. It went unnoticed because every developer here has a
+global identity configured, so the include resolved to the same person the
+include would have skipped to, and the file it never read was the reason nothing
+broke.
+
+The interesting part is that these are opposite mistakes with the same root.
+`git.config` is not the repository's to own, and treating it as the repository's
+produced both: a file that should have been ignored got committed, and an
+`include` that should have named the repository's own file named a stranger's.
+
+## Ruling
+
+1. **`simt init` writes `git.config` when the repository has none.** It is planned
+   like everything else `init` writes, so it appears in the same preview that lists
+   the rest, and its source is named on the line — writing somebody's name is a
+   statement about a person and the plan says where the name came from.
+
+2. **An existing `git.config` is left exactly as it is.** Not updated, not merged,
+   not reformatted. It may have been written by a person, by an older version of
+   this tool, or by hand years ago, and none of those are this tool's to
+   second-guess.
+
+3. **The identity is derived, in this order, and the first answer wins:**
+   the repository's **last commit author**, then the identity **git would use on
+   this machine anyway**, then nothing.
+
+   Last commit first because it is a fact rather than a default: it is who has
+   actually been working here. It is read from `git log`, not from
+   `git config user.email`, because at that moment the configured value is what the
+   file is about to be derived from, and the step would be circular.
+
+   The second is `--get` rather than `--global`, so it resolves through git's own
+   precedence and returns what a commit would have used had this file never
+   existed. That is the fallback's whole point: it must not be a second opinion
+   about what identity means.
+
+4. **When nothing is available, no file is written.** A placeholder is an identity
+   git would use on the next commit, and an adopting command is the last thing that
+   should invent one. The refusal is printed with its reason rather than swallowed.
+
+5. **Only the keys that were found are written.** A partial identity is written as a
+   partial identity, for the same reason.
+
+6. **`init` adds `git.config` to `.gitignore`** when it creates one, and points
+   `include.path` at `../git.config` — the repository's own file.
+
+   `--replace-all`, not `--add`: a value naming *another* repository's identity file
+   is not an addition to keep, it is a link to break.
+
+   A repository that already *tracks* `git.config` is not untracked by `init`.
+   Removing a tracked file is not something an adopting command should do silently,
+   and doing it would be a change to that repository's history rather than to its
+   working tree.
+
+## Consequences
+
+`src/identity.mjs` is new and is the single answer to "whose identity is this, and
+may we write it". `init` plans it, writes it, gitignores it and repoints the
+include; the four refusals are asserted in `test/identity.test.mjs` rather than
+described, because each of them is the correct answer rather than a failure to try
+harder.
+
+One test scrubs `HOME` and `GIT_CONFIG_GLOBAL` before asserting the "nothing
+anywhere" case. That is not tidiness: a developer with a global `user.email` — which
+is most of them — makes the identity resolvable, so without scrubbing the test
+would pass for the wrong reason on that machine and nowhere else. ADR-031 is about
+a result depending on the author's environment; this test would have been the next
+instance of it.
+
+## Rejected
+
+- **Write `git.config` into the tracked tree, as a shared record of who works
+  here.** This is what the two repositories did, and it is a publication of a
+  person's email address with a commit attached.
+- **Take the identity from the OS (the login name, the home directory).** It
+  produces `<login-name>@example.com` and similar: an identity nobody configured,
+  used for authorship. Ruling 4's refusal covers it.
+- **Overwrite an existing `git.config` when it differs from the derived one.**
+  Difference is not error. A file that has been there for years and disagrees with
+  the last commit author is a decision somebody made.
+- **Fix the `include` only when it is wrong.** The include is only written when it
+  is missing or does not name this repository's own file. Rewriting it when it is
+  already correct would be a no-op that reads as a change.

package/docs/decisions/ADR-058-one-tool-three-channels-and-the-order-is-forced.md

@@ -0,0 +1,148 @@
+# One tool, three channels, and the order is forced
+
+Status: **accepted** · 2026-10-11
+
+Affects: `pyproject.toml`, `python/simt_dev/`, `Formula/simt-dev.rb`,
+`.github/workflows/publish.yml`, `scripts/release-formula.mjs`,
+`scripts/verify-wheel.mjs`, `test/packaging.test.mjs`
+
+## Context
+
+simt-dev is a Node program. It is also a *repository* tool: somebody adopting a
+repository runs `simt init` inside it, and the places people run that from are
+not all Node projects. A python developer in a repository that has no
+`package.json` has no reason to install a package manager to get a command that
+adopts their repository, and a Homebrew user has no reason to install Node to
+install a tool that needs Node.
+
+So the tool is published to three channels:
+
+| Channel | What it installs |
+| --- | --- |
+| npm | a tarball of `.mjs` files |
+| PyPI | a wheel carrying those same files, plus a `simt` entry point |
+| Homebrew | a formula that downloads the npm tarball at install time |
+
+The design constraint that decided all of it: the tool has **zero runtime
+dependencies and no build step**. The whole thing is ~1.3 MB of text. That makes
+the "packaging for a second language" problem a *copying* problem rather than a
+build one, and copying is a problem with a right answer.
+
+## Ruling
+
+1. **The Python wheel carries the tool's own source, byte for byte.** `files` in
+   `package.json` and `force-include` in `pyproject.toml` name the same paths,
+   and `scripts/verify-wheel.mjs` builds both artefacts and hashes every file in
+   both, failing the release when a single byte differs.
+
+   The wheel is not a wrapper around `npm install`. A wrapper would fetch code
+   at install time - unpinned, unsigned by anything the installer can check, and
+   absent the moment somebody runs `pip install` on a train.
+
+2. **The version is one number, read rather than written.**
+   `pyproject.toml` declares `dynamic = ["version"]` and reads it from
+   `package.json` with a regex. A second literal would drift, and the drift
+   would be invisible until somebody ran `pip show` beside `simt --version` and
+   got two answers about which release they are running.
+
+3. **The Python launcher is standard library only, and has no required
+   dependencies.** The `[node]` extra is optional and imports `nodejs_wheel`
+   *inside a `try`, at the point of use* - never at module level - so the
+   default install cannot fail on a package it never asked for.
+
+   ADR-012 rules out runtime dependencies for the npm package. The reasoning
+   transfers without modification: a dependency is a runtime this package cannot
+   verify and its owner cannot patch, and this package exists to be the thing
+   people run in a repository rather than the thing they have to curate.
+
+4. **`simt` is the one command, on every channel.** `bin` in `package.json` and
+   `[project.scripts]` in `pyproject.toml` are asserted equal, and the formula's
+   `test do` block runs it. A second name under the package name would be a
+   convenience that forks the documentation the first time somebody documents
+   one channel and not the other.
+
+5. **Homebrew installs the npm tarball, and does not use `std_npm_args`.**
+   `depends_on "node"` declares the runtime; the entry point's shebang is
+   rewritten to that node rather than left at `#!/usr/bin/env node`, so the
+   command works from a cron job and from a shell that has moved node out of
+   the way, both of which look identical to a broken install.
+
+   `std_npm_args` invokes npm at build time, which needs the registry at build
+   time. This package has nothing to install, so that would add a network fetch
+   to installing the one thing in the estate that provably needs none.
+
+6. **`Formula/simt-dev.rb` is the source of truth, and `scripts/release-formula.mjs`
+   patches two lines in it.** It does not regenerate the formula from a
+   template: a template would mean the bytes a reader sees in this repository
+   are not the bytes a tap serves, which is the defect ADR-023 ruled out for the
+   gate file. The two lines are matched by content, not by line number, because
+   a line number would make the formula a file that cannot be edited - adding a
+   comment above the `sha256` line would silently write the checksum to the
+   wrong place.
+
+7. **The npm version must be live before `publish-pypi` and `publish-brew`
+   succeed, and both jobs say so when it is not.** The order is not a
+   preference. Homebrew downloads from the npm registry at install time, so a
+   formula naming a version that is still in npm's staging area installs a
+   404 - on somebody else's machine, at a tap, from a release this workflow
+   already declared done.
+
+   Those two jobs are the ones a maintainer runs again after
+   `npm stage approve`. "Re-run failed jobs" carries the tag context, which a
+   `workflow_dispatch` does not: on a dispatch, `github.ref_name` is the branch,
+   and the version guard would compare a tag against a branch.
+
+## Consequences
+
+The invariants split in two, and the split is deliberate.
+
+`test/packaging.test.mjs` holds the **static** ones: that `files` and
+`force-include` name the same paths, that the version is not written twice, that
+the command is one name, that the launcher imports nothing outside the standard
+library, that no second build system sits at the repository root. Every one of
+those is checkable from this checkout with no network and no interpreter, which
+is what lets it run in `npm test`.
+
+`scripts/verify-wheel.mjs` holds the one that is not: that the paths, once
+built, contain the same bytes. It runs in the release workflow, where a Python
+and a registry are available by construction.
+
+That split is ADR-031 applied. A test that needed `pip` would not run for the
+next person who clones this repository, and would run differently on the
+machine that wrote it - which is the failure that suite is about.
+
+Two findings from building it are recorded because they are the kind that only
+appear when a check is real:
+
+- The first run of `verify-wheel.mjs` reported `LICENSE` and `README.md` as
+  differences. They are not defects: npm adds both to every tarball, and the
+  wheel carries them as *distribution metadata* rather than as files. The
+  comparison is now scoped to what `files` names, which is the content the tool
+  reads.
+- The first run of that same comparison reported every one of `bin`, `src`,
+  `graph` and `rules` as missing from both, because `files` names **directories**
+  and npm includes them recursively. The expansion happens in the script now,
+  with the reason stated where the code is.
+
+The check was also tampered with deliberately - a wheel-only `README.md` was
+injected into `force-include` and it failed - because a parity check that has
+never failed is not evidence that it works.
+
+## Rejected
+
+- **A Python wrapper that runs `npm install -g simt-dev` on first use.** This is
+  what the unofficial `pyright` package does, and it has the properties it is
+  reputed to have: a download on first run, unpinned, uncacheable, and a failure
+  mode that reads as a broken package rather than as a missing runtime.
+- **Requiring node, with no bundled fallback.** The reader who installs from
+  PyPI is frequently the reader with no node, which is the whole reason the
+  channel exists. The failure message therefore names the `[node]` extra first,
+  because it is the one remedy that is the same command on every platform.
+- **Guessing where node is.** A hardcoded list of `/opt/homebrew/bin/node`,
+  `/usr/local/bin/node` and `~/.nvm/...` is three guesses and a surprise: it
+  prefers a guess over the reader's own `PATH`, and it is already out of date
+  for anyone who installs node differently. `shutil.which` asks the question
+  instead of answering it.
+- **`std_npm_args`.** See ruling 5.
+- **Publishing all three channels simultaneously.** Rejected by the ordering in
+  ruling 7 - Homebrew cannot name a version npm has not released.

package/docs/decisions/README.md

@@ -64,6 +64,8 @@ record's status line — never by editing the ruling in place.
 | [054](ADR-054-the-digest-covers-every-byte-that-leaves-the-package.md) | The digest covers every byte that leaves the package, and a cause is read off the body | accepted · amends ADR-032 |
 | [055](ADR-055-a-status-line-travels-so-it-may-not-name-a-location.md) | A status line travels, so it may not name a location; prose is the record's own argument | accepted |
 | [056](ADR-056-three-names-one-of-which-is-cheap-to-move.md) | The command, the package and the project are three names, and only one of them is cheap to move | accepted · amends ADR-023 |
+| [057](ADR-057-an-identity-is-per-developer-and-a-repository-does-not-own-it.md) | An identity is per-developer, and a repository does not own it | accepted |
+| [058](ADR-058-one-tool-three-channels-and-the-order-is-forced.md) | One tool, three channels, and the order is forced | accepted |
 
 ADR-001 to ADR-010 resolve the contradictions found across the 16 repos in the 2026-10-05
 audit; each record names the repos whose text it replaces. ADR-011 and ADR-012 are the
@@ -418,7 +420,7 @@ ADR-018's guard could not see the default hooks directory because it looked only
 key, and `hooks status` carried its own copy of the read logic the shared module already had.
 
 A fourth joins them. ADR-019 is the same shape one layer over: `simt init` dropped all
-five gates on `simt-app` and told the reader to add a script to a `package.json` the
+five gates on `repo-05` and told the reader to add a script to a `package.json` the
 repository will never have. The facts were right, the remedy was not followable, and once
 the repository declared what it does have, the dispatcher, `check` and `hooks status`
 gave three different answers about one manifest. Every one of these shipped green because

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "simt-dev",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Shared agent rules, skills and git hooks for a repository: one command adopts a repo, and every gate it declares is probed before it is written.",
   "license": "Apache-2.0",
   "author": "Said Elimam",
@@ -39,7 +39,5 @@
   "scripts": {
     "test": "node --test test/*.test.mjs",
     "lint": "node bin/simt-dev.mjs doctor"
-  },
-  "dependencies": {},
-  "devDependencies": {}
-}
+  }
+}

package/src/commands/hooks.mjs

@@ -6,11 +6,11 @@
 //
 // Installing is the only mutating command, it is idempotent, it previews unless
 // told to write, and it refuses to clobber an existing core.hooksPath without
-// --yes. The estate has four incompatible conventions and one of them (simt-app)
-// points at a directory whose pre-push is 0 bytes, so overwriting silently would
-// be the worst available outcome. simt-space keeps its hook in the DEFAULT
-// location, which core.hooksPath being unset does not reveal, so a foreign hook
-// is found by asking git rather than by reading config.
+// --yes. Repositories in the wild use incompatible conventions, including a
+// hooksPath pointing at a directory whose pre-push is 0 bytes, so overwriting
+// silently would be the worst available outcome. Others keep their hook in the
+// DEFAULT location, which core.hooksPath being unset does not reveal, so a
+// foreign hook is found by asking git rather than by reading config.
 
 import { execFile } from 'node:child_process';
 import { chmod, mkdir, readFile, realpath, writeFile } from 'node:fs/promises';
@@ -169,19 +169,33 @@ async function installHooks(root, flags) {
   // stop running - and they stop running silently, which is why they are planned here
   // rather than left to the operator to notice (ADR-018, as amended).
   //
-  // A gate-type foreign hook is deliberately NOT chained: it belongs in the manifest
-  // as a declared command, so the dispatcher runs it and its verdict is visible in the
-  // gate output. Chaining it would run it after a gate passed, outside the report.
+  // "Does not gate" is a fact about THIS repository: `gateCount` asks what its manifest
+  // declares for that event, so an event outside the known vocabulary (post-commit) and
+  // an event the repo simply leaves empty (a pre-push with no gates) are both chained,
+  // while an event the repo does gate is left to the manifest's gates.commands - there
+  // the hook runs as a gate and its verdict appears in the report beside the others,
+  // rather than after the gates passed where an author cannot see it.
+  //
+  // Keying this on the event vocabulary instead of on the manifest cost a repository
+  // git-lfs hook: pre-push is a gated event in general, but this repo declares no
+  // pre-push gate, so nothing replaces its hook and routing would have dropped it.
   const chained = [
     // Already chained by an earlier install, read back off disk: re-rendered from the
     // file's own contents so the bytes cannot drift on a second run.
     ...(await Promise.all(
       state.chained.map(async (c) => ({ event: c.event, target: await relativeTarget(root, c.target) })),
     )),
-    // Newly found foreign hooks on events this tool does not gate.
+    // Foreign hooks on events THIS repo has no gate for.
+    //
+    // Per repository, not per event vocabulary - and the difference is not academic.
+    // declares no pre-push gate, and its pre-push is git-lfs: routing without a
+    // shim for that event means git finds no pre-push hook at all and LFS objects stop
+    // being uploaded, silently, with nothing to notice it. An event this repo gates is
+    // different: the dispatcher replaces the hook there by design, and the hook's real
+    // place is gates.commands.
     ...(await Promise.all(
       state.foreign
-        .filter((f) => !EVENTS.includes(f.event))
+        .filter((f) => gateCount(manifest, f.event) === 0)
         .map(async (f) => ({ event: f.event, target: await relativeTarget(root, f.path) })),
     )),
   ].reduce((all, c) => (all.some((x) => x.event === c.event) ? all : [...all, c]), []);
@@ -214,9 +228,9 @@ async function installHooks(root, flags) {
 
   // Refuse to take over routing git is already using without explicit consent.
   // Two cases, and the second one is the one that bites: core.hooksPath already
-  // pointing elsewhere (simt-app points at a directory whose pre-push is 0 bytes),
-  // and core.hooksPath being unset while a hook sits in the default location
-  // (simt-space, 4 KB of real logic in .git/hooks/pre-commit). Reading unset as
+  // pointing elsewhere (a hooksPath whose pre-push is 0 bytes), and core.hooksPath
+  // being unset while a hook sits in the default location (4 KB of real logic in
+  // .git/hooks/pre-commit). Reading unset as
   // "no hooks" is what let install replace a working gate with no warning.
   const takeover = (current !== null && current !== wants) || state.foreign.length > 0;
   if (takeover && !flags.yes) {