aglium-ledger 0.1.0__tar.gz

aglium_ledger-0.1.0/.claude-plugin/marketplace.json

@@ -0,0 +1,17 @@
+{
+  "name": "aglium",
+  "owner": {
+    "name": "Aglium",
+    "url": "https://aglium.com"
+  },
+  "metadata": {
+    "description": "Plugins from Aglium. Ledger: cross-repository context for a change, before it merges."
+  },
+  "plugins": [
+    {
+      "name": "ledger",
+      "source": "./plugin",
+      "description": "Before you push: what this change affects in the repositories you are not looking at, and whether someone needs to decide something first."
+    }
+  ]
+}

aglium_ledger-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,46 @@
+name: ci
+on: [push, pull_request]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - name: The client, with no database library installed
+        run: |
+          pip install '.[mcp]' pytest pytest-asyncio respx
+          python -c "import importlib.util as u, sys; sys.exit(bool(u.find_spec('sqlalchemy') or u.find_spec('ledger_server')))"
+          pytest -q tests
+  clean-install:
+    # What a new user's machine does: no client installed, the plugin's runner
+    # fetches it with uvx (from this checkout instead of the tagged release).
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - name: Fetch with uvx, check prerequisites and coverage, replay
+        env:
+          # A directory, not git+file: a CI checkout has no origin/HEAD, and uv
+          # cannot resolve a git URL without a default branch.
+          LEDGER_PACKAGE: "aglium-ledger[mcp] @ file://${{ github.workspace }}"
+        run: |
+          set -eu
+          est=$(mktemp -d)
+          for r in orders billing; do
+            git init -q -b main "$est/$r"
+            git -C "$est/$r" -c user.email=a@example.com -c user.name=a commit -q --allow-empty -m start
+          done
+          printf 'org: acme\nproject_keys: [ABC]\n' > "$est/ledger.yml"
+          export LEDGER_CONFIG="$est/ledger.yml"
+          plugin/scripts/ledger-run.sh coverage --local-root "$est" --json > cov.json || true
+          python3 -c "
+          import json; d = json.load(open('cov.json'))
+          assert {r['repo'] for r in d['coverage']['repos']} == {'orders', 'billing'}, d
+          assert all(c['ok'] for c in d['prerequisites']), d['prerequisites']
+          "
+          plugin/scripts/ledger-run.sh replay --local-root "$est" --everyone --out "$est/r.md"
+          grep -q "## Nothing to replay" "$est/r.md"

aglium_ledger-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,44 @@
+name: release
+# Pushing a tag `vX.Y.Z` builds the package and attaches it to a GitHub release.
+# Publishing to PyPI is off until the repository variable PUBLISH_TO_PYPI is
+# `true` and PyPI trusted publishing is set up for `aglium-ledger` (workflow
+# `release.yml`, environment `pypi`).
+on:
+  push:
+    tags: ["v*"]
+permissions:
+  contents: write
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - name: Tag must match the package version
+        run: |
+          version=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
+            echo "tag $GITHUB_REF_NAME does not match pyproject version $version" >&2
+            exit 1
+          fi
+      - run: pip install build
+      # Only the client is released here. The server ships as an image, privately.
+      - run: python -m build --outdir dist
+      - uses: actions/upload-artifact@v4
+        with: { name: dist, path: dist/ }
+      - name: Create the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "$GITHUB_REF_NAME" dist/* --title "$GITHUB_REF_NAME" --generate-notes
+  pypi:
+    needs: build
+    if: vars.PUBLISH_TO_PYPI == 'true'
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { name: dist, path: dist/ }
+      - uses: pypa/gh-action-pypi-publish@release/v1

aglium_ledger-0.1.0/.gitignore

@@ -0,0 +1,9 @@
+__pycache__/
+*.pyc
+.venv/
+.pytest_cache/
+dist/
+build/
+*.egg-info/
+.DS_Store
+ledger-replay.md

aglium_ledger-0.1.0/LICENSE

@@ -0,0 +1,96 @@
+Ledger client
+
+Required Notice: Copyright (c) 2026 Aglium (https://aglium.com)
+Licensor Line of Business: Ledger, cross-repository impact analysis for software changes (https://aglium.com)
+
+The terms below are the PolyForm Shield License 1.0.0, unmodified.
+
+# PolyForm Shield License 1.0.0
+
+<https://polyformproject.org/licenses/shield/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose.  However, you may only distribute the software according to [Distribution License](#distribution-license) and make changes or new works based on the software according to [Changes and New Works License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license to distribute copies of the software.  Your license to distribute covers distributing the software with changes and new works permitted by [Changes and New Works License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software.  For example:
+
+> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to make changes and new works based on the software for any permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+## Noncompete
+
+Any purpose is a permitted purpose, except for providing any product that competes with the software or any product the licensor or any of its affiliates provides using the software.
+
+## Competition
+
+Goods and services compete even when they provide functionality through different kinds of interfaces or for different technical platforms.  Applications can compete with services, libraries with plugins, frameworks with development tools, and so on, even if they're written in different programming languages or for different computer architectures.  Goods and services compete even when provided free of charge.  If you market a product as a practical substitute for the software or another product, it definitely competes.
+
+## New Products
+
+If you are using the software to provide a product that does not compete, but the licensor or any of its affiliates brings your product into competition by providing a new version of the software or another product using the software, you may continue using versions of the software available under these terms beforehand to provide your competing product, but not any later versions.
+
+## Discontinued Products
+
+You may begin using the software to compete with a product or service that the licensor or any of its affiliates has stopped providing, unless the licensor includes a plain-text line beginning with `Licensor Line of Business:` with the software that mentions that line of business.  For example:
+
+> Licensor Line of Business: YoyodyneCMS Content Management System (http://example.com/cms)
+
+## Sales of Business
+
+If the licensor or any of its affiliates sells a line of business developing the software or using the software to provide a product, the buyer can also enforce [Noncompete](#noncompete) for that product.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else.  These terms do not imply any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice.  Otherwise, all your licenses end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
+
+A **product** can be a good or service, or a combination of them.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all its affiliates.
+
+**Affiliates** means the other organizations than an organization has control over, is under the control of, or is under common control with.
+
+**Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.

aglium_ledger-0.1.0/PKG-INFO

@@ -0,0 +1,161 @@
+Metadata-Version: 2.5
+Name: aglium-ledger
+Version: 0.1.0
+Summary: Cross-repo impact brief for a change: the client, with no database
+Project-URL: Homepage, https://aglium.com/platform/ledger-server.html
+Project-URL: Source, https://github.com/Aglium/ledger-client
+Author: Aglium
+License-Expression: LicenseRef-PolyForm-Shield-1.0.0
+License-File: LICENSE
+Requires-Python: >=3.12
+Requires-Dist: httpx>=0.27
+Requires-Dist: pydantic>=2.7
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: typer>=0.12
+Provides-Extra: mcp
+Requires-Dist: mcp<3,>=2.2; extra == 'mcp'
+Description-Content-Type: text/markdown
+
+# Aglium Ledger client
+
+**Your coding agent sees your repository. Ledger sees what your changes might affect elsewhere.**
+
+Claude Code can work on the repository in front of it. The change often reaches further: another
+team's branch on the same ticket, a service that reads the table you are changing, a design
+decision whose open question this change quietly answers. Ledger reads the rest of your
+organisation's repositories on your own machine and answers, for a branch: a recommendation,
+the evidence behind it, and the people or decisions to involve.
+
+Source-available · No Aglium account · No model calls by the client · Nothing sent to Aglium
+
+## Would it have warned you? Replay your last merges
+
+The quickest way to find out whether Ledger is useful to you is to run it on changes your team
+already merged, as they were on the day each one started.
+
+In Claude Code:
+
+```text
+/plugin marketplace add Aglium/ledger-client
+/plugin install ledger@aglium
+/ledger:setup       # writes a config, checks prerequisites, says which repositories Ledger can see
+/ledger:replay      # your merged changes from the last 90 days; --everyone for your team's
+```
+
+From a terminal (Python 3.12+ and [uv](https://docs.astral.sh/uv/)):
+
+```bash
+uv tool install 'aglium-ledger[mcp]'
+cd ~/src/your-org/one-of-your-repos
+aglium-ledger init          # a config from this checkout; contacts nothing
+aglium-ledger mirrors       # optional: the rest of the organisation, as bare mirrors
+aglium-ledger coverage      # which repositories Ledger can see, and the gaps
+aglium-ledger replay --everyone
+```
+
+The replay writes `ledger-replay.md`. For each change it keeps three outcomes apart:
+
+- **something to say**: other work or contracts this change affected, each with links to the
+  commits and files you can open to check it, and how strong the claim is (a *conflict*: it
+  removes something another repository reads, or cannot land with another change in flight; a
+  *dependency*: it faces another repository over a named topic or route; or a *correlation*,
+  such as a shared ticket);
+- **nothing found**, by a replay that could see enough to say so;
+- **could not see enough to tell**, which is never the same as safe.
+
+There is no hindsight in it: every other repository is read at the commit its default branch
+had on the day the change started, so nothing merged later can make a finding look smarter
+than it was. More in [docs/replay.md](docs/replay.md).
+
+You then say, for each finding, whether it was **useful**, **already known**, a **false
+positive**, or something you **can't verify**. The answers stay on your machine
+(`aglium-ledger feedback import ledger-replay.md`). If you want to share the result,
+`aglium-ledger feedback summary --share` writes a file with the verdicts and hashed names, no
+code, for you to read and send.
+
+## The recommendation
+
+| Verdict | Meaning |
+|---|---|
+| `proceed` | Nothing found in what Ledger could see |
+| `review_with` | Other work overlaps: name these repositories, branches and people in your review |
+| `decision_needed` | An open decision governs this change; a person with authority decides first |
+| `insufficient_data` | Ledger could not see enough. Unknown, never safe |
+
+`aglium-ledger brief <repo> <branch>` gives it for any branch; `--json` for a CI gate or an
+agent. Every answer names the repositories it read, so a quiet answer from a small estate is
+not mistaken for a clean one.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `init` | Write a config from the current checkout |
+| `mirrors` | Discover the organisation's repositories and keep bare mirrors of them |
+| `coverage` | Which repositories Ledger can see, their history, the gaps, and the prerequisites |
+| `replay` | Brief your recent merged changes as they were, to see whether Ledger would have helped |
+| `feedback record / import / summary` | Your verdicts on findings, kept locally |
+| `brief <repo> <ref>` | What a branch affects elsewhere |
+| `explain <repo> <ref>` | Other in-flight work on a branch's ticket |
+| `scan` | What the estate holds: repositories, contracts, work in flight |
+| `comment` | Post a sibling comment on a pull request (used by the GitHub Action) |
+| `mcp` | Run the MCP server for coding agents |
+| `hook` | The push-time hook for Claude Code |
+| `server` | What an organisation server adds, and how to connect to one |
+
+## Use it from a coding agent
+
+- **Claude Code:** the plugin in [`plugin/`](plugin/README.md) adds the skill, the MCP server,
+  a push-time hook and `/ledger:setup`, `/ledger:coverage`, `/ledger:brief`, `/ledger:replay`.
+- **Any MCP client:** run `aglium-ledger mcp` as a stdio server. Tools: `brief`, `who_owns`,
+  `inflight_for`, `decisions_for`, `feedback`.
+
+Installation on a clean machine, permissions and troubleshooting:
+[docs/install.md](docs/install.md).
+
+## On a pull request
+
+The GitHub Action in this repository runs the client statelessly on each pull request and
+comments with the full brief: a field or contract the change removes that another repository
+reads, another change in flight that cannot land with it, who is on the other side of each
+topic or route, and other work linked by ticket, by what it touches or by author. A branch
+with no ticket key is briefed like any other. It is advisory and never fails a build; set
+`mode: siblings` for the old ticket-only comment.
+
+```yaml
+- uses: Aglium/ledger-client@v0.1.0
+  continue-on-error: true
+  with:
+    github-token: ${{ secrets.LEDGER_TOKEN }}
+    config: .github/ledger.yml
+```
+
+## Trust and data
+
+The client runs on your machine. It reads your repositories with the credential git already
+has, sends nothing to Aglium, makes no model calls, and puts no file contents in its answers:
+they carry names, contracts, decisions and paths. Exactly what it reads, contacts and stores
+is in [docs/trust.md](docs/trust.md).
+
+## Client and server
+
+The client is complete by itself and free to use. It reads the estate live, on demand, from
+what is on your machine. What it does not do, alone:
+
+- see repositories or branches that are not on this machine;
+- answer in about 2 seconds (it reads again each time: seconds to tens of seconds);
+- read topic wiring declared in infrastructure (ACLs, Terraform, AsyncAPI), only code and config;
+- check every field of a contract (it checks the names a change removes, in consumers' code);
+- see work merged to an integration branch and not released, or decisions on unmerged branches;
+- say anything before code exists, or notice documentation a change leaves wrong;
+- share findings and feedback with your team, or learn which verdicts were right.
+
+An organisation server does all of these, for everyone, through the same plugin and commands.
+Side by side: [docs/client-vs-server.md](docs/client-vs-server.md). `aglium-ledger server`
+says the same from the command line.
+
+## Licence
+
+[PolyForm Shield License 1.0.0](LICENSE): source-available, not open source. Free to use,
+change and redistribute, at work too; not to build a product that competes with Ledger. The
+licence text is what counts. Copyright (c) 2026 Aglium, [aglium.com](https://aglium.com).

aglium_ledger-0.1.0/README.md

@@ -0,0 +1,143 @@
+# Aglium Ledger client
+
+**Your coding agent sees your repository. Ledger sees what your changes might affect elsewhere.**
+
+Claude Code can work on the repository in front of it. The change often reaches further: another
+team's branch on the same ticket, a service that reads the table you are changing, a design
+decision whose open question this change quietly answers. Ledger reads the rest of your
+organisation's repositories on your own machine and answers, for a branch: a recommendation,
+the evidence behind it, and the people or decisions to involve.
+
+Source-available · No Aglium account · No model calls by the client · Nothing sent to Aglium
+
+## Would it have warned you? Replay your last merges
+
+The quickest way to find out whether Ledger is useful to you is to run it on changes your team
+already merged, as they were on the day each one started.
+
+In Claude Code:
+
+```text
+/plugin marketplace add Aglium/ledger-client
+/plugin install ledger@aglium
+/ledger:setup       # writes a config, checks prerequisites, says which repositories Ledger can see
+/ledger:replay      # your merged changes from the last 90 days; --everyone for your team's
+```
+
+From a terminal (Python 3.12+ and [uv](https://docs.astral.sh/uv/)):
+
+```bash
+uv tool install 'aglium-ledger[mcp]'
+cd ~/src/your-org/one-of-your-repos
+aglium-ledger init          # a config from this checkout; contacts nothing
+aglium-ledger mirrors       # optional: the rest of the organisation, as bare mirrors
+aglium-ledger coverage      # which repositories Ledger can see, and the gaps
+aglium-ledger replay --everyone
+```
+
+The replay writes `ledger-replay.md`. For each change it keeps three outcomes apart:
+
+- **something to say**: other work or contracts this change affected, each with links to the
+  commits and files you can open to check it, and how strong the claim is (a *conflict*: it
+  removes something another repository reads, or cannot land with another change in flight; a
+  *dependency*: it faces another repository over a named topic or route; or a *correlation*,
+  such as a shared ticket);
+- **nothing found**, by a replay that could see enough to say so;
+- **could not see enough to tell**, which is never the same as safe.
+
+There is no hindsight in it: every other repository is read at the commit its default branch
+had on the day the change started, so nothing merged later can make a finding look smarter
+than it was. More in [docs/replay.md](docs/replay.md).
+
+You then say, for each finding, whether it was **useful**, **already known**, a **false
+positive**, or something you **can't verify**. The answers stay on your machine
+(`aglium-ledger feedback import ledger-replay.md`). If you want to share the result,
+`aglium-ledger feedback summary --share` writes a file with the verdicts and hashed names, no
+code, for you to read and send.
+
+## The recommendation
+
+| Verdict | Meaning |
+|---|---|
+| `proceed` | Nothing found in what Ledger could see |
+| `review_with` | Other work overlaps: name these repositories, branches and people in your review |
+| `decision_needed` | An open decision governs this change; a person with authority decides first |
+| `insufficient_data` | Ledger could not see enough. Unknown, never safe |
+
+`aglium-ledger brief <repo> <branch>` gives it for any branch; `--json` for a CI gate or an
+agent. Every answer names the repositories it read, so a quiet answer from a small estate is
+not mistaken for a clean one.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `init` | Write a config from the current checkout |
+| `mirrors` | Discover the organisation's repositories and keep bare mirrors of them |
+| `coverage` | Which repositories Ledger can see, their history, the gaps, and the prerequisites |
+| `replay` | Brief your recent merged changes as they were, to see whether Ledger would have helped |
+| `feedback record / import / summary` | Your verdicts on findings, kept locally |
+| `brief <repo> <ref>` | What a branch affects elsewhere |
+| `explain <repo> <ref>` | Other in-flight work on a branch's ticket |
+| `scan` | What the estate holds: repositories, contracts, work in flight |
+| `comment` | Post a sibling comment on a pull request (used by the GitHub Action) |
+| `mcp` | Run the MCP server for coding agents |
+| `hook` | The push-time hook for Claude Code |
+| `server` | What an organisation server adds, and how to connect to one |
+
+## Use it from a coding agent
+
+- **Claude Code:** the plugin in [`plugin/`](plugin/README.md) adds the skill, the MCP server,
+  a push-time hook and `/ledger:setup`, `/ledger:coverage`, `/ledger:brief`, `/ledger:replay`.
+- **Any MCP client:** run `aglium-ledger mcp` as a stdio server. Tools: `brief`, `who_owns`,
+  `inflight_for`, `decisions_for`, `feedback`.
+
+Installation on a clean machine, permissions and troubleshooting:
+[docs/install.md](docs/install.md).
+
+## On a pull request
+
+The GitHub Action in this repository runs the client statelessly on each pull request and
+comments with the full brief: a field or contract the change removes that another repository
+reads, another change in flight that cannot land with it, who is on the other side of each
+topic or route, and other work linked by ticket, by what it touches or by author. A branch
+with no ticket key is briefed like any other. It is advisory and never fails a build; set
+`mode: siblings` for the old ticket-only comment.
+
+```yaml
+- uses: Aglium/ledger-client@v0.1.0
+  continue-on-error: true
+  with:
+    github-token: ${{ secrets.LEDGER_TOKEN }}
+    config: .github/ledger.yml
+```
+
+## Trust and data
+
+The client runs on your machine. It reads your repositories with the credential git already
+has, sends nothing to Aglium, makes no model calls, and puts no file contents in its answers:
+they carry names, contracts, decisions and paths. Exactly what it reads, contacts and stores
+is in [docs/trust.md](docs/trust.md).
+
+## Client and server
+
+The client is complete by itself and free to use. It reads the estate live, on demand, from
+what is on your machine. What it does not do, alone:
+
+- see repositories or branches that are not on this machine;
+- answer in about 2 seconds (it reads again each time: seconds to tens of seconds);
+- read topic wiring declared in infrastructure (ACLs, Terraform, AsyncAPI), only code and config;
+- check every field of a contract (it checks the names a change removes, in consumers' code);
+- see work merged to an integration branch and not released, or decisions on unmerged branches;
+- say anything before code exists, or notice documentation a change leaves wrong;
+- share findings and feedback with your team, or learn which verdicts were right.
+
+An organisation server does all of these, for everyone, through the same plugin and commands.
+Side by side: [docs/client-vs-server.md](docs/client-vs-server.md). `aglium-ledger server`
+says the same from the command line.
+
+## Licence
+
+[PolyForm Shield License 1.0.0](LICENSE): source-available, not open source. Free to use,
+change and redistribute, at work too; not to build a product that competes with Ledger. The
+licence text is what counts. Copyright (c) 2026 Aglium, [aglium.com](https://aglium.com).

aglium_ledger-0.1.0/action.yml

@@ -0,0 +1,63 @@
+name: "Ledger — what this change affects elsewhere"
+description: >
+  Comment on a pull request with what it affects in OTHER repositories: fields or
+  contracts it removes that another repository reads, changes in flight that cannot
+  land with it, who is on the other side of each topic or route, and other work
+  linked by ticket, by what it touches or by author. Works without a ticket key.
+  Stateless: queries the forges directly, needs no database or service.
+inputs:
+  github-token:
+    description: "Token with read access to the org's repos and write access to PR comments."
+    required: true
+  config:
+    description: "Path to your ledger.yml, relative to the calling repository."
+    required: true
+  post:
+    description: "Post the comment. Set to 'false' to render it into the log only."
+    required: false
+    default: "true"
+  mode:
+    description: "'brief' (default): the full brief. 'siblings': only work sharing the ticket, as before."
+    required: false
+    default: "brief"
+runs:
+  using: composite
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.12"
+    - name: Install
+      shell: bash
+      # A composite action already has its own files at action_path, so it never
+      # needs to check itself out -- which also means no org or repo name is
+      # hardcoded here. Whoever hosts the action, it installs from itself.
+      run: pip install -e "${{ github.action_path }}"
+    - name: Remember scans between runs
+      # What each repository's default branch says is read again only when
+      # that branch moves. Names and directions only; no code is cached.
+      uses: actions/cache@v4
+      with:
+        path: ~/.cache/ledger/scan
+        key: ledger-scan-${{ github.run_id }}
+        restore-keys: ledger-scan-
+    - name: Comment
+      shell: bash
+      env:
+        LEDGER_GITHUB_TOKEN: ${{ inputs.github-token }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+        HEAD_REF: ${{ github.event.pull_request.head.ref }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        REPO: ${{ github.repository }}
+      run: |
+        # --live keeps this a single step with no infrastructure behind it.
+        # Failure here must never fail someone else's PR: this is advisory, and
+        # a tool that red-builds a branch on its own outage gets removed.
+        aglium-ledger comment "$REPO" "$PR_NUMBER" \
+          --ref "$HEAD_REF" \
+          --head-sha "$HEAD_SHA" \
+          --config "${{ github.workspace }}/${{ inputs.config }}" \
+          --live \
+          $([ "${{ inputs.mode }}" = "siblings" ] && echo "--siblings-only" || echo "--brief") \
+          $([ "${{ inputs.post }}" = "true" ] && echo "--post" || echo "--dry-run") \
+          || echo "::warning::ledger could not produce a comment; continuing"