simt-dev 0.1.1 → 0.2.0

package/src/compare/row.mjs

@@ -78,8 +78,8 @@ export async function buildRow(path, context) {
   // Adoption is settled BEFORE any problem is collected. Every gate below asks
   // `row.adoption`, and this block used to run after them - so the stale-rule-file gate
   // below compared against the initialiser's `'unmanaged'` and could never fire. In the
-  // estate that made `simt-app`, with 0 of 3 rule files current, report a problems list
-  // that mentioned neither the rule files nor anything the exit code could see. A gate
+  // estate, with 0 of 3 rule files current, report a problems list that mentioned
+  // neither the rule files nor anything the exit code could see. A gate
   // that reads a field the line above has not set yet is not a gate.
   //
   // An absent manifest is not a defect; it is the pre-adoption state, which is the normal

package/src/decisions/index.mjs

@@ -445,8 +445,29 @@ const section = (name) => {
  *
  * Not global: callers reuse it with `exec`, and a `/g` flag would remember `lastIndex`.
  */
+/**
+ * Identifiers that belong to the repositories this tool was built against, rather than
+ * to anything a reader has.
+ *
+ * This used to be a list of names, and that was the defect: the guard that exists to
+ * keep those names out of shipped text was itself shipped, carrying them. Every
+ * adopting repository could read the portfolio out of `src/`.
+ *
+ * So it matches shapes instead:
+ *
+ *   - `simt-<something>` that is not `simt-dev`, which is most of the estate
+ *   - `repo-NN`, the pseudonyms the decision records now use in place of a name. These
+ *     must not leak either: a label that identifies nothing publicly is still a label
+ *     that joins one record to another, and shipping it into a consumer's repository
+ *     would carry that join with it.
+ *
+ * What this no longer catches, stated plainly: three estate repositories whose names
+ * do not begin `simt-`, which a shape-based rule cannot recognise without enumerating
+ * them - which is what this file used to do. Detection of those now depends on a name
+ * never being written into shipped text, rather than on a check.
+ */
 export const ESTATE_NAME =
-  /\b(?:simt-(?!dev\b)[\w-]+|bunnyland(?:-server)?|wakt-app|app-ui|garmin|(?:the )?Social repos?)\b/;
+  /\b(?:simt-(?!dev\b)[\w-]+|repo-\d{2})\b/;
 
 /** Replace estate repository names with a phrase a reader who does not have them can use. */
 export function redactEstate(text) {
@@ -477,12 +498,15 @@ export function redactCommand(text) {
 }
 
 /**
- * Repositories the records were written about. Kept on the summary so a maintainer can
- * see which decisions cite which repos. `rules why` redacts them before printing:
- * the names are not actionable in a repository that does not contain those files.
+ * Repositories the records were written about, so a maintainer can see which decisions
+ * cite which. `rules why` redacts them before printing: the names are not actionable in
+ * a repository that does not contain those files.
+ *
+ * Same shape rule as {@link ESTATE_NAME} and for the same reason - this shipped too, so
+ * enumerating the names here put the portfolio in every adopting repository. The records
+ * themselves now carry `repo-NN` labels, so that is what this matches in practice.
  */
-const ESTATE =
-  /\b(?:app-ui|bunnyland(?:-server)?|wakt-app|simt-[\w-]+|(?:the )?(?:Social|garmin) repos?)\b/gi;
+const ESTATE = /\b(?:simt-(?!dev\b)[\w-]+|repo-\d{2})\b/gi;
 
 /** Trim to whole sentences within a budget, never leaving a stub fragment. */
 function sentence(text, limit = 260) {

package/src/graph/load.mjs

@@ -478,7 +478,7 @@ async function lintSourcesOnDisk(registry, workspaceRoot) {
 /**
  * SKILL.md plus every file beneath the skill directory.
  * Handles both layouts: a directory containing SKILL.md, and the flat
- * `skills/<name>.md` form bunnyland-server still uses (ADR-009 says that will be
+ * `skills/<name>.md` form one repository still uses (ADR-009 says that will be
  * wrapped, so lint reports it rather than accepting it silently).
  */
 export async function measureSkill(full) {

package/src/hooks/capability.mjs

@@ -2,7 +2,7 @@
 //
 // This exists because the first real adoption declared five gates and could run two.
 // The stack table proposes a formatter, a linter and an i18n check for any Node repo;
-// simt-social-media has no prettier installed, no `lint` script and no declared command
+// a repository with no prettier installed, no `lint` script and no declared command
 // for the i18n check. Every one of those gates fails closed by design, so installing the
 // dispatcher on that manifest blocks every commit and teaches the team to reach for
 // `--no-verify`. The dispatcher was right; the declaration was wrong.

package/src/hooks/dispatcher.mjs

@@ -3,7 +3,7 @@
 // Design commitments, all of them load-bearing:
 //
 //   Fail closed, never fail open. A gate that cannot run is a failure, not a
-//   skip. simt-space removed tests from pre-commit because they were slow, and
+//   skip. A repository removed tests from pre-commit because they were slow, and
 //   the documented consequence was that authors reached for --no-verify. A
 //   dispatcher that skips what it cannot do reproduces exactly that.
 //

package/src/hooks/gates.mjs

@@ -100,7 +100,7 @@ export function getGate(name) {
  * This is the load-bearing decision of the whole dispatcher. A gate that
  * silently does nothing is indistinguishable from a gate that passed, and the
  * documented consequence in this estate is an agent reaching for
- * `--no-verify` - simt-space removed its tests from pre-commit precisely
+ * `--no-verify` - a repository removed its tests from pre-commit precisely
  * because they were slow, and slow-plus-silent is what teaches everyone that
  * hooks are advisory.
  */

package/src/hooks/where.mjs

@@ -55,7 +55,7 @@ export async function resolveHooksDir(root) {
   }
 
   // Rule 1: core.hooksPath wins. A relative value resolves against the top level
-  // of the working tree, which is what makes simt-app's `hooks` work.
+  // of the working tree, which is what makes a `hooks` directory work.
   if (configured !== null) {
     return {
       dir: isAbsolute(configured) ? configured : resolve(top, configured),

package/src/identity.mjs

@@ -0,0 +1,218 @@
+// The per-developer git identity, as a file the repository does not track.
+//
+// A repository has more than one person in it, and each of them may already have an
+// identity this tool has no business choosing. So the rules here are conservative in
+// that order:
+//
+//   1. If `git.config` already exists, it is left exactly as it is. Not updated, not
+//      merged, not reformatted. It may have been written by a person, by an older
+//      version of this tool, or by hand years ago, and none of those are this tool's
+//      to second-guess.
+//   2. Otherwise the identity comes from the repository's own last commit author.
+//      That is the person who has been working here, which is the best available
+//      answer to "who commits here" and requires no guessing: it is a fact, not a
+//      default.
+//   3. Otherwise from the git identity configured for this machine or this user,
+//      which is what would have been used anyway had this file never existed.
+//   4. Otherwise nothing is written. An identity nobody configured is not one to
+//      invent, and a file with a placeholder in it is worse than no file: git would
+//      use the placeholder.
+//
+// The file is deliberately NOT written into the repository's tracked files. It holds
+// whoever is committing, and committing it publishes one developer's name and email
+// to everybody else in the repository. `init` adds it to .gitignore when it creates
+// one; a repository that already tracks it is left that way, because removing a
+// tracked file is not something an adopting command should do silently.
+
+import { execFile } from 'node:child_process';
+import { readFile, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+
+const exec = promisify(execFile);
+
+/** The file, at the repository root. Named for what it is: a git config fragment. */
+export const IDENTITY_FILE = 'git.config';
+
+/** The git config key that pulls the file in. */
+export const INCLUDE_KEY = 'include.path';
+
+/**
+ * Run a git command and return trimmed stdout, or null if it fails.
+ *
+ * Null rather than an exception for every case: a repository that is not a git
+ * repository, a version of git that does not know a flag, a machine with no
+ * configured identity. None of those is an error worth refusing an adoption over.
+ *
+ * @param {string} cwd
+ * @param {string[]} args
+ * @returns {Promise<string|null>}
+ */
+async function git(cwd, args) {
+  try {
+    const { stdout } = await exec('git', args, { cwd });
+    return stdout.trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Who last committed here.
+ *
+ * `%an` and `%ae` rather than the configured identity on purpose: this is what
+ * actually happened, which is the answer to the question being asked. Reading
+ * `git config user.email` here would return the value this file is about to be
+ * derived from, and the step would be circular.
+ *
+ * @param {string} root
+ * @returns {Promise<{name: string|null, email: string|null}>}
+ */
+export async function lastCommitAuthor(root) {
+  const line = await git(root, ['log', '-1', '--format=%an <%ae>']);
+  if (!line) return { name: null, email: null };
+  // The name may itself contain angle brackets, so the address is split off the
+  // LAST one rather than the first.
+  const at = line.lastIndexOf('<');
+  const close = line.lastIndexOf('>');
+  if (at === -1 || close < at) return { name: line || null, email: null };
+  return {
+    name: line.slice(0, at).trim() || null,
+    email: line.slice(at + 1, close).trim() || null,
+  };
+}
+
+/**
+ * The identity this machine would use anyway.
+ *
+ * `--get` rather than `--global`: it resolves through system, global and local in
+ * git's own order, so what it returns is what a commit would have used had this file
+ * never been created. That is the fallback's whole point - it must not be a second
+ * opinion about what identity means.
+ *
+ * @param {string} root
+ * @returns {Promise<{name: string|null, email: string|null}>}
+ */
+export async function configuredIdentity(root) {
+  const read = async (key) => {
+    const value = await git(root, ['config', '--get', key]);
+    return value && value !== '' ? value : null;
+  };
+  return { name: await read('user.name'), email: await read('user.email') };
+}
+
+/**
+ * The identity to write, and where it came from.
+ *
+ * @param {string} root
+ * @returns {Promise<{name: string|null, email: string|null, from: 'last-commit'|'configured'|null,
+ *                    exists: boolean, bytes: number}>}
+ */
+export async function resolveIdentity(root) {
+  const path = join(root, IDENTITY_FILE);
+  try {
+    const info = await stat(path);
+    if (info.isFile()) {
+      return { name: null, email: null, from: null, exists: true, bytes: info.size };
+    }
+  } catch {
+    // Absent is the case this whole module exists for.
+  }
+
+  const committed = await lastCommitAuthor(root);
+  if (committed.name && committed.email) {
+    return { ...committed, from: 'last-commit', exists: false, bytes: 0 };
+  }
+  const configured = await configuredIdentity(root);
+  if (configured.name || configured.email) {
+    return { ...configured, from: 'configured', exists: false, bytes: 0 };
+  }
+  return { name: null, email: null, from: null, exists: false, bytes: 0 };
+}
+
+/**
+ * The file's bytes.
+ *
+ * Only the keys that were found are written. A partial identity is written as a
+ * partial identity rather than padded with a placeholder, because a placeholder is
+ * an identity git would use.
+ *
+ * @param {{name: string|null, email: string|null}} identity
+ * @returns {string} LF-terminated
+ */
+export function renderIdentityFile({ name, email }) {
+  const lines = ['[user]'];
+  if (name) lines.push(`\tname = ${name}`);
+  if (email) lines.push(`\temail = ${email}`);
+  return `${lines.join('\n')}\n`;
+}
+
+/**
+ * Whether `include.path` already names this repository's own file.
+ *
+ * @param {string} root
+ * @returns {Promise<boolean>}
+ */
+export async function includesOwnIdentity(root) {
+  const values = (await git(root, ['config', '--local', '--get-all', INCLUDE_KEY])) ?? '';
+  return values.split('\n').map((v) => v.trim()).filter(Boolean).includes(`../${IDENTITY_FILE}`);
+}
+
+/**
+ * Point `core.hooksPath`-style local config at this repository's own identity file.
+ *
+ * `--replace-all` rather than `--add`, and that is the whole point: a value naming
+ * ANOTHER repository's identity file is not an addition to keep, it is a link to
+ * break. Two of the repositories here had exactly that, and both worked only because
+ * the sibling checkout happened to exist at the expected relative path.
+ *
+ * @param {string} root
+ * @returns {Promise<void>}
+ */
+export async function includeOwnIdentity(root) {
+  await git(root, ['config', '--local', '--replace-all', INCLUDE_KEY, `../${IDENTITY_FILE}`]);
+}
+
+/**
+ * Whether the repository tracks the identity file, which it should not.
+ *
+ * @param {string} root
+ * @returns {Promise<boolean>}
+ */
+export async function tracksIdentity(root) {
+  const listed = await git(root, ['ls-files', '--error-unmatch', IDENTITY_FILE]);
+  return listed === IDENTITY_FILE;
+}
+
+/**
+ * Add the identity file to .gitignore, if it is not already there.
+ *
+ * Matching on the exact line rather than a substring, because a `.gitignore`
+ * entry of `/git.config` or `git.config` both mean it while a comment mentioning
+ * it means nothing, and appending a duplicate of an entry that is already present
+ * is how a file ends up listed twice.
+ *
+ * @param {string} root
+ * @returns {Promise<boolean>} whether the file was changed
+ */
+export async function ignoreIdentity(root) {
+  const path = join(root, '.gitignore');
+  let text;
+  try {
+    text = await readFile(path, 'utf8');
+  } catch {
+    text = '';
+  }
+  const already = text.split('\n').map((l) => l.trim()).includes(IDENTITY_FILE);
+  if (already) return false;
+  const prefix = text === '' || text.endsWith('\n') ? '' : '\n';
+  const block =
+    `${prefix}\n` +
+    '# Per-developer git identity, written by `simt init`. Not a file to share:\n' +
+    '# it carries whoever is committing into the tree, and a repository has more than\n' +
+    '# one of those.\n' +
+    `${IDENTITY_FILE}\n`;
+  const { writeFile } = await import('node:fs/promises');
+  await writeFile(path, text + block);
+  return true;
+}

package/src/projection/baselines.mjs

@@ -93,7 +93,7 @@ indent_style = tab`;
  * every path as text and is the single most common way to corrupt a binary in a
  * repository, because nothing tells git it is wrong. `auto` makes git decide per path
  * from its own content sniffing, so a `.tif`, a `.zip` and a `.mc` file are left exactly
- * as they are and only files that genuinely are text get normalised. simt-garmin
+ * as they are and only files that genuinely are text get normalised. One
  * already worked this out on its own, which is the strongest evidence available that
  * the conservative form is the one the estate would have picked.
  *

package/src/projection/conflicts.mjs

@@ -6,7 +6,7 @@
 // the same rule restated in prose outside a generated region - prohibited by the
 // anti-duplication doctrine, but not a contradiction.
 //
-// The distinction is not academic. bunnyland's AGENTS.md says "Do not use `uv run
+// The distinction is not academic. One AGENTS.md says "Do not use `uv run
 // pytest`" - which contains the forbidden string `uv run pytest` verbatim. A naive
 // substring scan reports that file as violating the very rule it is correctly
 // restating. So every match is checked for prohibition context first.

package/src/projection/manifest.mjs

@@ -397,7 +397,7 @@ function defaultId(root) {
  * 1. A STALE GENERATED FIELD. `buildManifest` emits `$comment` and
  *    `projection.simtDevSha`; the repo owns everything else. `upgrade` spreads the
  *    existing manifest and refreshes only the SHA, so a field added to the writer
- *    after a repo was adopted never appears — simt-space had been projecting for
+ *    after a repo was adopted never appears — one repository had been projecting for
  *    several versions with no `surfaces` key, and nothing said so. Every parse-based
  *    comparison passes, because the file is valid and the values in it are all true.
  *

package/src/projection/markers.mjs

@@ -217,7 +217,7 @@ export function compose(body, { sha, sources = [] } = {}, style) {
   );
   const trimmed = body.replace(/\n+$/, '');
   // Two lines here exist only because a real repo proved they are needed. A
-  // formatter that runs on commit - simt-space has one, and three of the estate's
+  // formatter that runs on commit - several repositories have one, and three of the
   // other repos do too - rewrote the region on the very first commit: it inserted a
   // blank line after the header comment and added the trailing newline. Both edits
   // are things prettier considers correct, and either one alone makes `check`
@@ -226,7 +226,7 @@ export function compose(body, { sha, sources = [] } = {}, style) {
   // projection emits the formatter's shape in the first place. The blank line before
   // END is the same class: prettier treats an HTML comment after a paragraph as a
   // new block and inserts the separating blank line itself, which made
-  // simt-blog's `format:check` fail on a file whose generated region was correct.
+  // a `format:check` fail on a file whose generated region was correct.
   const out =
     trimmed === ''
       ? [s.begin, ...header, s.end]
@@ -293,7 +293,7 @@ export function inject(text, body, meta, opts = {}) {
     // terminates the region with one; adding a second left every adopted file
     // ending in a blank line. Nothing in this tool noticed, because `check`
     // compares region bodies and the byte after END is not part of the region —
-    // but bunnyland-server's own `git diff --check` gate did, and it is a gate
+    // but a repository's own `git diff --check` gate did, and it is a gate
     // that repo runs before every commit. The `updated` branch below has always
     // been correct for exactly this reason.
     //

package/src/projection/mdc.mjs

@@ -201,7 +201,7 @@ function stripFrontmatter(text) {
  *
  * An empty-string default is a deliberate "this repo has nothing to add here"
  * and the line it sits on is DROPPED. That is how `preview-postflight` reaches
- * `simt-social-media` without printing an empty bullet, and how a repo with no
+ * a repository without printing an empty bullet, and how a repo with no
  * production-domain note gets a clean document instead of a blank one.
  *
  * A placeholder with neither a declared nor a default value is a defect: the
@@ -218,7 +218,7 @@ export function renderMdc(rule, declared = {}) {
 
     if (has && provided === '') {
       // A repo declared this key and declared it empty: the line it sits on is
-      // removed. This is how preview-postflight reaches simt-social-media without
+      // removed. This is how preview-postflight reaches a repository without
       // printing a blank bullet.
       body = dropOrReplace(body, sub.key, '');
       continue;

package/src/projection/surfaces.mjs

@@ -17,7 +17,7 @@
 //
 //   1. A POINTER IS NOT A COPY. `CLAUDE.md` and `GEMINI.md` are symlinks to
 //      `AGENTS.md`. A copy is the corpus's one true content duplicate
-//      (bunnyland-server's `CLAUDE.md` is byte-identical to its `AGENTS.md`), and
+//      (one repository's `CLAUDE.md` is byte-identical to its `AGENTS.md`), and
 //      the DeepSeek harness explicitly rejects loading both in one directory
 //      because "repositories in transition commonly duplicate guidance" — and
 //      *its* dedup is content-based, so a symlink collapses to one while a
@@ -32,7 +32,7 @@
 //      mode bit. So those get machine-written copies — and because every byte is
 //      derived from `rules/mdc/*.mdc` and `simt-dev check` compares each against
 //      that same derivation, they are not duplication, they are a build output.
-//      The difference from bunnyland's duplicate is that nobody can hand-edit one
+//      The difference from that duplicate is that nobody can hand-edit one
 //      and have it survive a sync.
 //
 //   3. AN ALWAYS-ON RULE EMITS NO SCOPING FRONTMATTER. Claude Code's `paths:` key

package/src/resolve/fingerprint.mjs

@@ -41,7 +41,7 @@ const MARKERS = [
 /**
  * Extensions are weaker evidence than marker files: a stray script must not
  * define a repo's stack. `python` is deliberately absent here because
- * simt-app carries .py tooling scripts inside a Gradle project - a marker file
+ * a repository carries .py tooling scripts inside a Gradle project - a marker file
  * is required for that tag. `kotlin` has no marker file, so it stays here.
  */
 const EXTENSION_TAGS = new Map([
@@ -83,7 +83,7 @@ const DEP_TAGS = new Map([
  *
  * Three, and the reason is a convention rather than a preference: the Android Gradle
  * Plugin puts a module's manifest at `<module>/src/main/AndroidManifest.xml`, and
- * simt-app's sits at `app/src/main/AndroidManifest.xml`. A bound shallower than the
+ * one common layout sits at `app/src/main/AndroidManifest.xml`. A bound shallower than the
  * convention makes `has-android-manifest` the shape S07 found - a fact no repository
  * could ever have. Deeper would be a scan rather than a probe, and ADR-013's promise
  * is that adding an ecosystem is data, so a fact must not cost a search.
@@ -300,7 +300,7 @@ export async function fingerprint(root) {
     }
   }
 
-  // simt-app and wakt-app both carry a wear/ module; wakt-app is the wearable.
+  // two repositories both carry a wear/ module; only one of them is the wearable.
   if (names.has('wear') && (await isDir(join(root, 'wear')))) {
     stack.add('wear-os');
     evidence.push('wear/');

package/src/resolve/source.mjs

@@ -8,7 +8,7 @@
 //
 // The second location is the one nobody wrote down: **the repository being operated
 // on is itself a location for a declared source**. Someone who cloned only
-// `simt-social` has the `simt-social` body on disk at `.agents/skills/slice-commit`
+// one repository has its body on disk at `.agents/skills/slice-commit`
 // with no workspace anywhere. The registry entry is satisfied by that file.
 //
 // Bytes are what make this safe rather than hopeful. Every source declares its size,

package/src/tsconfig.mjs

@@ -32,7 +32,7 @@ export const TSCONFIG_FILE = 'tsconfig.json';
  * The strictness floor.
  *
  * Every key here is already set, and set the same way, by every `tsconfig.json` in the
- * estate that could afford it. `simt-goto` is the outlier and it is not one on purpose: it
+ * estate that could afford it. One repository is the outlier and it is not one on purpose: it
  * is missing the seven flags below that the three social repos share, which is the gap
  * plan section 3.1 row 5 named. Nothing in this object is a value anybody has argued about;
  * it is the intersection of what four repositories independently wrote.