simt-dev 0.6.3 → 0.7.0

package/src/secrets.mjs

@@ -33,39 +33,73 @@ const ENTROPY_MIN_LENGTH = 32;
 export const ENTROPY_MIN_BITS = 4.5;
 
 /**
- * Value markers that mean "this string is here to be replaced". A pattern match
- * or entropy hit whose value carries one of these is documentation, not a leak.
+ * A value is a placeholder when the WHOLE value is placeholder-shaped, not when
+ * it contains a placeholder word: a real secret may contain "example" and still
+ * be a secret, and the substring test blocked exactly that commit (review 0003 Q24).
  */
-const PLACEHOLDER =
-  /(example|placeholder|changeme|dummy|redacted|notasecret|your[_-]|xxxx+|<[a-z-]*>|\{\{?[a-z_.-]+\}\}?)/i;
+const PLACEHOLDER_WORD = /^(?:example|sample|placeholder|changeme|change[-_]?me|dummy|fake|redacted|notasecret|undefined|null|none|true|false|x+)$/i;
+const PLACEHOLDER_SLOT = /^(?:<[^<>]*>|\{\{?[a-z0-9_.-]+\}\}?|your[-_][a-z0-9_-]*|my[-_][a-z0-9_-]*)$/i;
+
+/**
+ * @param {string} value the candidate secret
+ * @returns {boolean} true when the whole value is documentation, not a leak
+ */
+function isPlaceholder(value) {
+  const v = String(value).trim();
+  if (v === '') return true;
+  if (PLACEHOLDER_SLOT.test(v)) return true;
+  const words = v.split(/[^a-zA-Z]+/).filter(Boolean);
+  if (words.length === 0) return true; // punctuation only: `…`, `-`
+  return words.every((w) => PLACEHOLDER_WORD.test(w));
+}
 
 /**
  * The pattern library. Each row names itself so the finding tells the reader
  * WHICH shape matched — "a secret was found" sends them hunting for it;
  * "aws-access-key-id on line 12" says what to revoke.
  *
- * `group`, when set, is the capture holding the VALUE — what the placeholder
- * check and the redaction run on. Without it the whole match is the value.
+ * `groups`, when set, lists the captures that may hold the VALUE — what the
+ * placeholder check and the redaction run on; the first defined capture wins.
+ * Without it the whole match is the value.
  */
 const PATTERNS = [
   { id: 'aws-access-key-id', re: /\b(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g },
-  { id: 'private-key-block', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/g },
+  // The type word is not the discriminator, "PRIVATE KEY" is: RSA, EC, DSA,
+  // OPENSSH, PGP and ENCRYPTED all carry the same header shape (review 0003 Q24).
+  { id: 'private-key-block', re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g },
   { id: 'github-token', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g },
+  { id: 'gitlab-token', re: /\bglpat-[A-Za-z0-9_-]{20,}\b/g },
+  { id: 'npm-token', re: /\bnpm_[A-Za-z0-9]{36}\b/g },
   { id: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
   { id: 'stripe-live-key', re: /\b(?:sk|rk)_live_[0-9a-zA-Z]{24,}\b/g },
   { id: 'google-api-key', re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
   { id: 'openai-style-key', re: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
   { id: 'jwt', re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
+  // The key name is prefix-aware — DB_PASSWORD, aws_secret_access_key — and the
+  // value may be quoted or bare, because .env and YAML do not quote (review 0003 Q24).
   {
     id: 'assigned-secret',
-    re: /\b(?:password|passwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret)\b\s*[:=]\s*["']([^"']{8,})["']/gi,
-    group: 1,
+    re: /\b[A-Za-z0-9_.-]*(?:password|passwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret)\b\s*[:=]\s*(?:"([^"]{8,})"|'([^']{8,})'|([A-Za-z0-9+/=_-]{8,}))/gi,
+    groups: [1, 2, 3],
+  },
+  // The password half of https://user:pw@host: the only place a URL carries one.
+  {
+    id: 'url-userinfo',
+    re: /\b[a-z][a-z0-9+.-]*:\/\/[^:/\s@]+:([A-Za-z0-9._~+-]{8,})@/g,
+    groups: [1],
   },
 ];
 
 /** Longest base64ish run worth measuring for entropy. */
 const ENTROPY_CANDIDATE = /[A-Za-z0-9+/=_-]{32,}/g;
 
+/**
+ * Subresource-integrity hashes: `sha256-<base64>` and kin. A deterministic
+ * digest of file content, present in every lockfile and build manifest —
+ * high-entropy bytes that are never a secret (review 0003 Q24).
+ */
+const SRI_HASH = /^sha(1|256|384|512)-[A-Za-z0-9+/]+={0,2}$/;
+
 /**
  * Shannon entropy of a string, in bits per character.
  *
@@ -92,27 +126,37 @@ function redact(value) {
 }
 
 /**
- * Scan one line's worth of added text.
+ * Every secret span in the text: pattern matches in library order, then entropy
+ * over whatever no pattern claimed. One function because the gate report and
+ * the redactor must agree on what a secret is: two matchers drift, and the
+ * drift is a token one of them stores (review 0003 Q36).
  *
- * @param {string} text the added line, without the leading `+`
- * @returns {{kind: string, preview: string, entropy?: number}[]} findings in
- *   pattern order, then entropy over whatever no pattern claimed
+ * @param {string} text
+ * @returns {{start: number, end: number, kind: string, preview: string, entropy?: number}[]}
  */
-export function scanText(text) {
+function findSpans(text) {
   const found = [];
   const claimed = [];
 
   for (const pattern of PATTERNS) {
     pattern.re.lastIndex = 0;
     for (const match of text.matchAll(pattern.re)) {
-      const value = pattern.group !== undefined ? match[pattern.group] : match[0];
-      if (PLACEHOLDER.test(value)) continue;
-      const at = match.index + (pattern.group !== undefined ? match[0].indexOf(value) : 0);
+      const groups = pattern.groups ?? [0];
+      let value = null;
+      for (const g of groups) {
+        if (match[g] !== undefined) {
+          value = match[g];
+          break;
+        }
+      }
+      if (value === null) continue;
+      if (isPlaceholder(value)) continue;
+      const at = match.index + match[0].indexOf(value);
       // Overlap, not equality: a token a pattern named is one finding, and the
       // entropy reading of the same bytes would double the count a gate reports.
       if (claimed.some(([a, b]) => at < b && a < at + value.length)) continue;
       claimed.push([at, at + value.length]);
-      found.push({ kind: pattern.id, preview: redact(value) });
+      found.push({ start: at, end: at + value.length, kind: pattern.id, preview: redact(value) });
     }
   }
 
@@ -120,16 +164,106 @@ export function scanText(text) {
   for (const match of text.matchAll(ENTROPY_CANDIDATE)) {
     const value = match[0];
     if (value.length < ENTROPY_MIN_LENGTH) continue;
-    if (PLACEHOLDER.test(value)) continue;
+    if (SRI_HASH.test(value)) continue;
+    if (isPlaceholder(value)) continue;
     if (claimed.some(([a, b]) => match.index < b && a < match.index + value.length)) continue;
     const bits = entropy(value);
     if (bits < ENTROPY_MIN_BITS) continue;
-    found.push({ kind: 'high-entropy', preview: redact(value), entropy: Number(bits.toFixed(1)) });
+    found.push({
+      start: match.index,
+      end: match.index + value.length,
+      kind: 'high-entropy',
+      preview: redact(value),
+      entropy: Number(bits.toFixed(1)),
+    });
   }
 
   return found;
 }
 
+/**
+ * Scan one line's worth of added text.
+ *
+ * @param {string} text the added line, without the leading `+`
+ * @returns {{kind: string, preview: string, entropy?: number}[]} findings in
+ *   pattern order, then entropy over whatever no pattern claimed
+ */
+export function scanText(text) {
+  return findSpans(text).map(({ kind, preview, entropy }) =>
+    entropy === undefined ? { kind, preview } : { kind, preview, entropy },
+  );
+}
+
+/**
+ * Replace every secret span with `[redacted:<kind>]`, leaving the rest of the
+ * text byte-identical. Lesson candidates store the commands that failed, and a
+ * command can carry a token (`curl -H "Authorization: Bearer …"`); storing it
+ * verbatim writes the secret into a JSONL file that is then read, rendered and
+ * injected into prompts (review 0003 Q36).
+ *
+ * @param {string} text
+ * @returns {string} the text with secret values replaced
+ */
+export function redactText(text) {
+  const spans = findSpans(String(text ?? '')).sort((a, b) => b.start - a.start);
+  let out = String(text ?? '');
+  for (const span of spans) {
+    out = `${out.slice(0, span.start)}[redacted:${span.kind}]${out.slice(span.end)}`;
+  }
+  return out;
+}
+
+/**
+ * Lockfiles are skipped by default (review 0003 Q24): their high-entropy bytes
+ * are integrity hashes and version pins, and a dependency bump is a commit the
+ * gate must not block. The SRI allow-list above covers the same shapes wherever
+ * they appear outside a lockfile.
+ */
+const LOCKFILES = new Set([
+  'package-lock.json',
+  'npm-shrinkwrap.json',
+  'yarn.lock',
+  'bun.lockb',
+  'pnpm-lock.yaml',
+  'Cargo.lock',
+  'go.sum',
+  'composer.lock',
+  'Gemfile.lock',
+  'Pipfile.lock',
+  'poetry.lock',
+  'uv.lock',
+  'pubspec.lock',
+  'mix.lock',
+]);
+
+/** A line carrying this marker is the author's explicit exemption for that line. */
+const PRAGMA = 'simt:allow-secret';
+
+/**
+ * One glob to one anchored regex: `**` crosses separators, `*` and `?` do not.
+ * The same small matcher the ignore lists render with, because a repository
+ * that writes `vendor/**` in `.simtignore` expects the same reading here.
+ */
+function globToRegExp(glob) {
+  let re = '';
+  for (let i = 0; i < glob.length; i += 1) {
+    const c = glob[i];
+    if (c === '*') {
+      if (glob[i + 1] === '*') {
+        re += '.*';
+        i += 1;
+      } else {
+        re += '[^/]*';
+      }
+    } else if (c === '?') {
+      re += '[^/]';
+    } else {
+      re += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+
 /**
  * Scan the staged diff: the added lines of what the next commit would record.
  *
@@ -141,12 +275,18 @@ export function scanText(text) {
  * one a line is.
  *
  * @param {string} root repository root
+ * @param {{ignore?: string[]}} [options] `ignore` is the manifest's
+ *   `gates.secretScan.ignore`: globs of repository paths to skip (review 0003 Q24)
  * @returns {Promise<{findings: {file: string, line: number, kind: string,
  *   preview: string, entropy?: number}[], lines: number, error: string|null}>}
  *   `error` is set only when git itself could not answer; callers fail closed on
  *   it rather than reading silence as a clean diff.
  */
-export async function scanStaged(root) {
+export async function scanStaged(root, options = {}) {
+  const ignore = (Array.isArray(options.ignore) ? options.ignore : [])
+    .filter((g) => typeof g === 'string' && g !== '')
+    .map(globToRegExp);
+
   let stdout;
   try {
     // Every flag here defeats a way a repository can keep the scan from seeing its
@@ -183,6 +323,7 @@ export async function scanStaged(root) {
   let file = null;
   let lineNo = 0;
   let inHunk = false;
+  let fileSkipped = false;
 
   for (const raw of stdout.split('\n')) {
     if (raw.startsWith('diff --git ')) {
@@ -203,12 +344,14 @@ export async function scanStaged(root) {
       if (raw.startsWith('+++ ')) {
         const path = raw.slice(4).trim();
         file = path === '/dev/null' ? null : path.replace(/^b\//, '');
+        const name = file === null ? '' : file.slice(file.lastIndexOf('/') + 1);
+        fileSkipped = file !== null && (LOCKFILES.has(name) || ignore.some((re) => re.test(file)));
       }
       continue;
     }
     if (!raw.startsWith('+')) continue; // -U0 has no context; this is `\ No newline…`
     lines += 1;
-    if (file !== null) {
+    if (file !== null && !fileSkipped && !raw.includes(PRAGMA)) {
       for (const hit of scanText(raw.slice(1))) {
         findings.push({ file, line: lineNo, ...hit });
       }

package/src/state.mjs

@@ -0,0 +1,76 @@
+// Machine-local state lives here, not in the tree (review 0003 Q19).
+//
+// Everything this tool writes for itself — the ledger, the check cache, the
+// index, leases, the journal, briefs, gate logs, bench runs — used to live
+// directly under `.simt/`, so `simt check` changed the tree id its own
+// evidence was measured against, and a slice worktree landed in the main
+// checkout as an embedded gitlink. The fix is one directory: local state
+// goes under `.simt/local/`, which is ignored and excluded from the tree,
+// while committed content (`packs/`, `bin/`, `bench/tasks/`, profiles) stays
+// where it was.
+//
+// Readers try the new path first and fall back to the old one for one
+// release, so a repository whose state predates the move keeps working until
+// the next write migrates it. Writers always write the new path.
+
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+import { STATE_DIR } from './name.mjs';
+
+/** The ignored directory every machine-local write goes under. */
+export const LOCAL_DIR = join(STATE_DIR, 'local');
+
+/** A machine-local path, relative to the repository root. */
+export function localRel(...parts) {
+  return join(LOCAL_DIR, ...parts);
+}
+
+/**
+ * Where a machine-local file is read from: the new path first, then each
+ * legacy path in order. Writers use only the first entry.
+ */
+function readCandidates(root, rel, legacy = []) {
+  return [join(root, rel), ...legacy.map((l) => join(root, l))];
+}
+
+/** The first readable candidate, or null when none exists. */
+export async function readStateFile(root, rel, legacy = []) {
+  for (const path of readCandidates(root, rel, legacy)) {
+    try {
+      return { text: await readFile(path, 'utf8'), path };
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+    }
+  }
+  return { text: null, path: join(root, rel) };
+}
+
+/**
+ * Every machine-local path the tree id must exclude: the whole local area
+ * plus the legacy paths a pre-move checkout may still carry, so an old
+ * `check.json` or worktree can neither change the id nor be committed.
+ */
+export const TREE_EXCLUDES = [
+  LOCAL_DIR,
+  join(STATE_DIR, 'ledger.jsonl'),
+  join(STATE_DIR, 'lessons.jsonl'),
+  join(STATE_DIR, 'leases.json'),
+  join(STATE_DIR, 'check.json'),
+  join(STATE_DIR, 'index.sqlite'),
+  join(STATE_DIR, 'index.jsonl'),
+  join(STATE_DIR, 'brief.md'),
+  join(STATE_DIR, 'journal'),
+  join(STATE_DIR, 'worktrees'),
+  join(STATE_DIR, 'gate'),
+  join(STATE_DIR, 'distilled'),
+  join(STATE_DIR, 'reviews'),
+  join(STATE_DIR, 'proposals'),
+  join(STATE_DIR, 'compiled'),
+  join(STATE_DIR, 'critic-labels.jsonl'),
+  join(STATE_DIR, 'bench', 'runs'),
+  join(STATE_DIR, 'bench', 'vault'),
+  join(STATE_DIR, 'bench', 'prices.json'),
+  join(STATE_DIR, 'bench', 'ablation.json'),
+  join(STATE_DIR, 'bench', 'probes'),
+];

package/src/status.mjs

@@ -31,11 +31,12 @@ import { join } from 'node:path';
 import { promisify } from 'node:util';
 
 import { readHooksState, wantsShim } from './compare/hooksstate.mjs';
-import { STATE_DIR } from './name.mjs';
+import { LOCAL_DIR } from './state.mjs';
 
 const exec = promisify(execFile);
 
-const CACHE_FILE = join(STATE_DIR, 'check.json');
+const CACHE_FILE = join(LOCAL_DIR, 'check.json');
+const CACHE_FILE_LEGACY = '.simt/check.json';
 const CACHE_VERSION = 1;
 
 /**
@@ -79,7 +80,7 @@ export async function buildCacheRecord(root, summary) {
 /** Atomically replace the cache. A killed `check` leaves the previous record, not half of one. */
 export async function writeCheckCache(root, record) {
   const path = cachePath(root);
-  await mkdir(join(root, STATE_DIR), { recursive: true });
+  await mkdir(join(root, LOCAL_DIR), { recursive: true });
   const body = `${JSON.stringify(record)}\n`;
   const tmp = `${path}.tmp-${process.pid}`;
   await writeFile(tmp, body, 'utf8');
@@ -88,9 +89,13 @@ export async function writeCheckCache(root, record) {
 
 /** The last record `check` wrote, or null when it never ran (or a writer invalidated it). */
 export async function readCheckCache(root) {
+  // The pre-move path is a fallback for one release (review 0003 Q19).
   let raw;
   try {
-    raw = await readFile(cachePath(root), 'utf8');
+    raw = await readFile(cachePath(root), 'utf8').catch(async (error) => {
+      if (error.code !== 'ENOENT') throw error;
+      return readFile(join(root, CACHE_FILE_LEGACY), 'utf8');
+    });
   } catch (error) {
     if (error.code === 'ENOENT') return null;
     throw error;

package/src/toolwords.mjs

@@ -22,6 +22,7 @@ import { VARIANTS_MARKER } from './kernel/variants.mjs';
 import { LESSON_KEYS } from './memory/lessons.mjs';
 import { DECISION_KEYS } from './memory/decide.mjs';
 import { PROMPT_WORDS } from './mcp/prompts.mjs';
+import { AGENT_STEM, SKILL_STEM } from './agents/render.mjs';
 
 /**
  * `simt-` names that belong to this tool and never to a repository.
@@ -45,6 +46,10 @@ export const TOOL_WORDS = new Set([
   'simt-dev',
   'simt-dev-check',
   'simt-hooks',
+  // The one agent this tool ships, named by the stem every harness's agents file shares.
+  AGENT_STEM,
+  // The companion skill the agent reads on demand; its stem is the directory name.
+  SKILL_STEM,
 ]);
 
 /**

package/src/tsconfig.mjs

@@ -1,73 +1,36 @@
-// `tsconfig.base.json`: the strictness floor every TypeScript repo in the estate agrees on.
+// `tsconfig.base.json`: the strictness floor a TypeScript repo writes for itself.
 //
-// This is ADR-026's mechanism — a config whose grammar has no comments is a whole file the
-// repo owns from the first commit — pointed at the file ADR-025 ruled out by name. Two
-// consequences shape everything here, and both are easy to get wrong:
+// ADR-026's mechanism — a config whose grammar has no comments is a whole file the
+// repo owns from the first commit — pointed at the file ADR-025 ruled out by name.
+// `init` used to create it (review 0003 Q28 stopped that): a floor the tool writes
+// into a fresh repo is a file nothing extends, because the repo's own `tsconfig.json`
+// is the repo's to write — and a base that nothing points at is a floor with no
+// effect, which `check` then reported as drift on every fresh adoption.
 //
-//   1. A base file is a FLOOR, not a policy. `extends` lets a child override any key, so a
-//      base can only repair a repo that is *missing* a flag. It can never repair one that
-//      spells a flag differently — the child wins and the base is inert for that key. Every
-//      key below is therefore one the estate already agrees on, and the one place the estate
-//      disagrees is a check instead (see `checkTsconfig`).
-//   2. The bytes cannot explain themselves. JSON has no comments, so this file ships with no
-//      header saying who wrote it or what a reader must do next, which is normally the one
-//      thing a shipped file owes its reader. `init` prints the `extends` line it requires
-//      and `check` reports a repo that has not adopted it, so the obligation is met by the
-//      tool's output rather than the file's.
+// What is left here is the reporting side of ADR-026, and it reports exactly the two
+// states a base file can be in that no file can fix:
 //
-// The whole file is owned by `init` alone. It is not in `src/ci/` and not in
-// `src/projection/baselines.mjs` because it is neither a `.github` file that `simt ci`
-// refreshes nor a marker region: `simt check` reports its absence and never its contents.
+//   1. `inert` — the base exists and `tsconfig.json` does not extend it, so the floor
+//      is in the repository and not in effect. `extends` lets a child override any key,
+//      so a base can only repair a repo that is *missing* a flag; it can never repair
+//      one that does not point at it.
+//   2. `inconsistent` — `moduleResolution` is spelled the way the parser accepts but
+//      the documentation does not. The parser is case-insensitive, which is the whole
+//      reason the estate drifted: both spellings work, so nothing ever said so.
+//
+// Both are non-blocking findings (review 0003 Q28): the base file is repo-owned, and
+// a gate that fails a repository over a policy decision is a gate whose remedy is a
+// choice, not a command. An existing base file stays exactly as the repo wrote it:
+// this tool does not own its bytes, so a repo that edited them is not drift.
 
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
 import { fingerprint } from './resolve/fingerprint.mjs';
-import { CLI } from './name.mjs';
 
 export const TSCONFIG_BASE_FILE = 'tsconfig.base.json';
 export const TSCONFIG_FILE = 'tsconfig.json';
 
-/**
- * The strictness floor.
- *
- * Every key here is already set, and set the same way, by every `tsconfig.json` in the
- * estate that could afford it. One repository is the outlier and it is not one on purpose: it
- * is missing the seven flags below that the three social repos share, which is the gap
- * plan section 3.1 row 5 named. Nothing in this object is a value anybody has argued about;
- * it is the intersection of what four repositories independently wrote.
- *
- * Absent, and each for a reason that would be invisible to the next reader:
- *
- *   - `noEmit`. node.md:36 wants it for "any project that bundles elsewhere", and it would
- *     be harmless to inherit here because a child can set `false`. It is left out because a
- *     base that hands `noEmit` to a repo nobody looked at is a build that stops emitting,
- *     and the two repositories that bundle elsewhere did not ask for it. A floor nobody
- *     opted into is not a floor.
- *   - `moduleResolution`. All four repositories set it; three write `Bundler` and one writes
- *     `bundler`. Shipping either would change nothing, because the child overrides the base
- *     and the disagreement is precisely that the child sets it. `check` reports the spelling
- *     instead.
- *   - `target`, `lib`, `module`. Genuinely per-repo: `lib` is DOM+DOM.Iterable in two
- *     repositories and DOM+WebWorker in the other two, and a base that chose would silence
- *     one of them. These describe the platform, not the estate.
- *   - `include`, `exclude`, `paths`, `types`, `jsx`. What a project is made of.
- */
-export const STRICTNESS_FLOOR = {
-  strict: true,
-  noUncheckedIndexedAccess: true,
-  exactOptionalPropertyTypes: true,
-  noImplicitOverride: true,
-  useUnknownInCatchVariables: true,
-  noFallthroughCasesInSwitch: true,
-  noImplicitReturns: true,
-  isolatedModules: true,
-  verbatimModuleSyntax: true,
-  allowJs: false,
-  resolveJsonModule: true,
-  skipLibCheck: true,
-};
-
 /**
  * `moduleResolution` as TypeScript documents it.
  *
@@ -87,19 +50,6 @@ export const DOCUMENTED_RESOLUTIONS = new Set([
   'bundler',
 ]);
 
-/**
- * The base file, as bytes.
- *
- * Key order is the order of `STRICTNESS_FLOOR` and not alphabetical, because the object
- * literal is the readable form and reordering it here would mean the file and the reason
- * disagree. `JSON.stringify` preserves insertion order, so the two cannot drift.
- *
- * @returns {string} JSON, LF-terminated
- */
-export function renderTsconfigBase() {
-  return `${JSON.stringify({ compilerOptions: STRICTNESS_FLOOR }, null, 2)}\n`;
-}
-
 /**
  * Parse a file that TypeScript allows to carry comments.
  *
@@ -170,21 +120,19 @@ export function readJsonc(text) {
 }
 
 /**
- * What this repo's base file should be, and what should happen to it.
+ * What this repo's base file is, and what `init` will do about it.
  *
- * There is no `refresh`. ADR-026 gave simt-dev's own `.github` files a refresh path because
- * this repository is the template's only author; a base file has the same argument, and it
- * is deliberately not extended to it. `simt check` in this repository reports the
- * baseline files as unmanaged by design, so a refresh path here would be a way to make this
- * repository's own gate green by rewriting the file it is judging — which is the same
- * mistake as a gate that edits its own expectations.
+ * There is no `refresh`, and since review 0003 Q28 there is no `create` either: the
+ * file is the repo's to write, and a floor the tool created was one nothing extended.
+ * `init`'s whole contribution is now to say so in the plan — a file that appears after
+ * the run without being in the plan is a silent write, and "init will not write this"
+ * is a plan line, not an absence of one.
  *
- * The skip case is detection, not politeness: a repository with no TypeScript has nothing to
- * extend the base, and a `tsconfig.base.json` in a JavaScript repository is a file that
- * claims to be an authority and is read by nothing.
+ * `unchanged` means the file exists and is left exactly as it is: this tool does not
+ * own its bytes (ADR-026), so a repo that edited them is not drift.
  *
  * @param {string} root repo root
- * @returns {Promise<{file:string, path:string, action:'create'|'unchanged'|'skip',
+ * @returns {Promise<{file:string, path:string, action:'unchanged'|'skip',
  *                    exists:boolean, bytes:number, current:boolean, typescript:boolean,
  *                    reason:string|null}>}
  */
@@ -212,16 +160,19 @@ export async function planTsconfigBase(root) {
       reason: null,
     };
   }
+  // Absent is a skip in every case: init no longer creates the file (review 0003 Q28),
+  // so the plan states what it will not write and why, rather than leaving a floor
+  // behind that nothing extends.
   return {
     file: TSCONFIG_BASE_FILE,
     path,
-    action: typescript ? 'create' : 'skip',
+    action: 'skip',
     exists,
     bytes: 0,
-    current: false,
+    current: true,
     typescript,
     reason: typescript
-      ? null
+      ? 'init no longer creates the base file; a floor is a policy the repo writes for itself'
       : 'no TypeScript in this repository, so nothing would extend the base',
   };
 }
@@ -249,23 +200,12 @@ export async function checkTsconfig(root) {
     baseExists = false;
   }
 
-  const { stack } = await fingerprint(root);
-  const typescript = stack.includes('typescript');
-  if (typescript && !baseExists) {
-    findings.push({
-      file: TSCONFIG_BASE_FILE,
-      status: 'absent',
-      detail:
-        'this repo is TypeScript and has no base file, so every strictness flag is whatever ' +
-        'one person happened to write',
-      remedy: `${CLI} init --yes`,
-    });
-  }
-
   // Nothing below reads the base file's contents, and that is deliberate. This tool does not
   // own those bytes (ADR-026), so a repo that edited them is not drift — and a finding that
   // compared them would report somebody's work as an error. Only the question of whether
-  // `tsconfig.json` points at the base is this tool's to ask.
+  // `tsconfig.json` points at the base is this tool's to ask. A missing base file raises
+  // no finding at all (review 0003 Q28): writing one is the repo's decision, and a gate
+  // whose remedy is a policy choice is a gate nothing can satisfy.
   let own = null;
   try {
     own = readJsonc(await readFile(join(root, TSCONFIG_FILE), 'utf8'));

package/templates/plan/tracker.json

@@ -17,7 +17,7 @@
   },
   "states": [
     { "id": "queued", "write": "Queued", "read": ["queued"] },
-    { "id": "in-progress", "write": "In progress", "read": ["in progress", "in-progress"] },
+    { "id": "in-progress", "write": "In progress", "read": ["in progress", "in-progress"], "role": "started" },
     { "id": "complete", "write": "Complete", "read": ["complete", "completed", "done"], "satisfies": true },
     { "id": "accepted", "write": "Accepted", "read": ["accepted"] }
   ],