pactkit 4.0.0__tar.gz → 4.1.1__tar.gz

pactkit-4.1.1/.github/workflows/board-projection.yml

@@ -0,0 +1,83 @@
+name: Board projection
+
+# `docs/product/sprint_board.md` is a **projection** of the Story records under
+# `docs/product/stories/` — `pactkit board render` derives it, and nothing else
+# may write it.  It is not enforced by construction: the file is a tracked
+# document, so a hand edit or a Story update that never re-rendered leaves the
+# two disagreeing, and the board then reads as authority while being stale.
+#
+# Measured 2026-09-29 before this gate existed: STORY-slim-20260928c7b15e04a216
+# was `status: in_progress` with 8 of 9 tasks complete in its Story record,
+# while the board still listed it under Backlog with every box unchecked and
+# one task missing entirely.  `pactkit board render --check` reported the drift
+# correctly the whole time — it just had no reader.
+#
+# Why this is a repo-local workflow and NOT a step in the generated
+# `pactkit.yml`: that file ships to every project `pactkit init` touches, and
+# init does not scaffold `docs/`, so an unconditional check would turn CI red
+# for every project that has no board.  Widening it to users is a separate
+# decision that needs an applicability predicate ("does this project keep Story
+# records?"), not a copy of this job.
+#
+# `runs-on: slimmini` — the org `actions` budget is $0 with
+# `prevent_further_usage: true`, so a hosted runner is not merely slower, it
+# does not exist (runner_id=0).  See runner-heartbeat.yml for how to read a
+# job that never starts.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  projection:
+    runs-on: slimmini
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      # Same isolation as the other jobs here: a persistent self-hosted runner
+      # shares one toolcache, so a sibling job's `pip install` lands in this
+      # interpreter's site-packages (measured 2026-09-24, eight interpreters
+      # carrying stray adapters at three versions).
+      - name: Isolated environment
+        run: |
+          python -m venv "$RUNNER_TEMP/pactkit-venv"
+          echo "$RUNNER_TEMP/pactkit-venv/bin" >> "$GITHUB_PATH"
+
+      - name: Verify the environment is isolated
+        run: |
+          test "$(command -v python)" = "$RUNNER_TEMP/pactkit-venv/bin/python"
+          test "$(command -v pip)" = "$RUNNER_TEMP/pactkit-venv/bin/pip"
+          python -c "import sys; print('isolated venv:', sys.prefix)"
+
+      # Editable, on purpose: the check must run the renderer in the working
+      # tree.  A pinned release would compare the board against a *different*
+      # version's projection and call a correct change drift.
+      - name: Install PactKit
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+
+      # Non-empty precondition: with no Story records the projection is an
+      # empty board, and "current" would be vacuously true.  This repo keeps
+      # records, so the count is a real number — and printing it is what makes
+      # a silently-empty `docs/product/stories/` visible instead of green.
+      - name: There are Story records to project
+        run: |
+          count=$(ls -1 docs/product/stories/*.yaml 2>/dev/null | wc -l | tr -d ' ')
+          echo "story records: $count"
+          test "$count" -gt 0
+
+      - name: Board projection is current
+        run: pactkit board render --check

pactkit-4.1.1/.github/workflows/credentials.yml

@@ -0,0 +1,134 @@
+name: Credentials
+
+# The pre-commit hook scans **staged** files.  That is the right scope for a
+# commit, and the wrong scope for a repository: a credential that reached the
+# tree in an earlier commit, or that arrives through a merge, is invisible to a
+# staged-file scan.  This job scans what is actually in the checkout, reusing
+# the same `.secrets.baseline`, so the two coverages are reported separately
+# instead of one standing in for the other.
+#
+# Why this is a repo-local workflow and NOT a step in the generated
+# `pactkit.yml`: `.secrets.baseline` is created by the explicit
+# `pactkit secrets-baseline` command — `init` does not scaffold one — so an
+# unconditional scan would fail CI for every project that never opted in.
+# Shipping it is a separate decision that needs an applicability predicate.
+#
+# `runs-on: slimmini` — the org `actions` budget is $0 with
+# `prevent_further_usage: true`, so a hosted runner does not exist here
+# (runner_id=0).  See runner-heartbeat.yml for how to read a job that never
+# starts: queued-with-no-runner and blocked-by-budget look different.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    runs-on: slimmini
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      # Same isolation as the other jobs here: a persistent self-hosted runner
+      # shares one toolcache, so a sibling job's `pip install` lands in this
+      # interpreter's site-packages (measured 2026-09-24).
+      - name: Isolated environment
+        run: |
+          python -m venv "$RUNNER_TEMP/pactkit-venv"
+          echo "$RUNNER_TEMP/pactkit-venv/bin" >> "$GITHUB_PATH"
+
+      - name: Verify the environment is isolated
+        run: |
+          test "$(command -v python)" = "$RUNNER_TEMP/pactkit-venv/bin/python"
+          test "$(command -v pip)" = "$RUNNER_TEMP/pactkit-venv/bin/pip"
+          python -c "import sys; print('isolated venv:', sys.prefix)"
+
+      - name: Install PactKit
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+
+      # Non-vacuity: a scan that reports "clean" because it read nothing looks
+      # identical to a clean tree, and the baseline it compares against is the
+      # whole of its evidence.  Both are asserted before the scan runs.
+      - name: The scan has something to scan and something to compare against
+        run: |
+          test -f .secrets.baseline || { echo "no .secrets.baseline — nothing to compare against"; exit 1; }
+          count=$(git ls-files | wc -l | tr -d ' ')
+          echo "tracked files: $count"
+          test "$count" -gt 0
+
+      - name: The scan catches a synthetic finding
+        run: |
+          # The teeth check.  The string is generated here rather than written
+          # into the repo: a literal credential in a workflow is exactly what
+          # this job exists to prevent, and a random hex string is the same
+          # detector class ("Hex High Entropy String") without being
+          # credential-shaped.
+          python3 -c "import pathlib,secrets,sys; pathlib.Path(sys.argv[1]).write_text('X = \"' + secrets.token_hex(32) + '\"\n')" "$RUNNER_TEMP/synthetic.py"
+          if pactkit commit-gate --secrets-entry --baseline .secrets.baseline "$RUNNER_TEMP/synthetic.py"; then
+            echo "::error::the credential scan did not catch a synthetic high-entropy string"
+            exit 1
+          fi
+          echo "the scan caught the synthetic finding, as it must"
+
+      - name: Credential scan (whole checkout, not just the diff)
+        run: |
+          # `.secrets.baseline` is excluded: its `hashed_secret` values are sha1
+          # hex strings, so the file is itself full of what the scan looks for.
+          # The invariant is `scan_input ∩ scan_output = ∅` — the artifact a
+          # scan maintains must not be one of the files it scans.
+          #
+          # `xargs` rather than an array builtin: this step must be runnable and
+          # verifiable with the bash a developer has (macOS ships 3.2, which has
+          # no `mapfile`), not only with the runner's.
+          git ls-files | grep -v '^\.secrets\.baseline$' | tr '\n' '\0' \
+            | xargs -0 pactkit commit-gate --secrets-entry --baseline .secrets.baseline
+
+      - name: The baseline exclusion is asserted, and is not vacuous
+        run: |
+          # An exclusion that is only written down is one refactor away from
+          # silently disappearing, so it is measured here.  Two things, because
+          # either alone proves nothing:
+          #
+          # 1. The file IS scan-dirty.  Without this, "the scan came back clean"
+          #    would be true for a reason that has nothing to do with the
+          #    exclusion — an absence assertion over a corpus that cannot
+          #    produce the finding is always green.
+          #
+          #    The probe is a COPY: `.secrets.baseline` must stay out of the
+          #    input set, and copying it is what keeps this control from being
+          #    the very thing it guards against.  It is also scanned WITHOUT
+          #    `--baseline`, because passing the file as its own baseline makes
+          #    it self-suppress (measured 2026-09-29: exit 1 without, exit 0
+          #    with) and the control would go quiet.
+          cp .secrets.baseline "$RUNNER_TEMP/baseline-probe.json"
+          if pactkit commit-gate --secrets-entry "$RUNNER_TEMP/baseline-probe.json"; then
+            echo "::error::.secrets.baseline is not scan-dirty — the exclusion control would be vacuous"
+            exit 1
+          fi
+          echo "the baseline is scan-dirty, so keeping it out of the input set does work"
+
+          # 2. The input set really does not contain it.  Asserted rather than
+          #    assumed: the pipeline above is a shell expression, and a `grep`
+          #    that stops matching silently widens the scan instead of failing.
+          if ! git ls-files | grep -q '^\.secrets\.baseline$'; then
+            echo "::error::.secrets.baseline is not tracked — this exclusion has nothing to exclude, and the control above no longer describes the scan"
+            exit 1
+          fi
+          if git ls-files | grep -v '^\.secrets\.baseline$' | grep -q '^\.secrets\.baseline$'; then
+            echo "::error::the exclusion did not remove .secrets.baseline from the input set"
+            exit 1
+          fi
+          echo "the baseline stays out of the input set"

pactkit-4.1.1/.github/workflows/release-acceptance.yml

@@ -0,0 +1,330 @@
+name: Release Acceptance
+
+# STORY-slim-20260911b2bbd79889e0 C2/R8 + 2026-09-11 reviews: install the
+# ACTUAL core wheel that is about to ship in a clean environment and prove
+# the package-level surface. The ordinary CI tests the editable checkout;
+# it cannot see packaging-level breaks (missing files in the wheel,
+# dependency misdeclaration). This job can. publish.yml waits for this
+# workflow's conclusion before publishing a tag.
+#
+# Zero-credential split (2026-09-11, first real runner run 34607922520):
+# GITHUB_TOKEN cannot read the private adapter repos, and the owner chose
+# no PAT/secrets. The core wheel + adapter COMBO acceptance therefore runs
+# in each adapter repo's own release-acceptance workflow — it checks out
+# ITSELF (its token suffices) and installs the RELEASED core from PyPI,
+# which the resolver pins for real. Each adapter repo covers classic + its
+# own host; the union covers all three. What remains here is the core-only
+# quality gate: wheel build/install/version, documented extras, wheel-mode
+# prompt snapshots (classic; the host assertion scales with installed
+# adapters), and the classic journey.
+
+on:
+  push:
+    branches: [main]
+    # Same inert-doc set as PactKit CI — spec/acceptance docs are not in the
+    # wheel, so the packaging assertions cannot see them.  Tags always run
+    # (publish gate) regardless of paths.
+    paths-ignore:
+      - "docs/specs/**"
+      - "docs/acceptance/**"
+    tags: ["v*"]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: "daily (3.11 single version) or release (3.10-3.13 full matrix)"
+        type: choice
+        options: [daily, release]
+        default: daily
+
+# STORY-slim-20260917c943d7aaeb7c (CI cost): same rationale as PactKit CI —
+# cancel superseded branch runs.  Tag runs are excluded from the group name
+# so a push to main can never cancel an in-flight tag acceptance that
+# publish.yml is waiting on.
+concurrency:
+  group: release-acceptance-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # R4 (STORY-slim-20260917c18f4a962b70): the acceptance matrix is layered
+  # by event — daily (PR / push main / manual daily) proves the 3.11
+  # baseline cheaply; release (tag v* / manual release) proves the full
+  # supported range.  The assertions are IDENTICAL in both configs — only
+  # the version dimension shrinks (降低版本维度不删验收断言).  PRs and main
+  # both run: a PR green light never skips the final main integration run;
+  # an opened PR's branch pushes fire `synchronize` and rerun this workflow.
+  config:
+    # 2026-09-24: the org `actions` budget is $0 with prevent_further_usage, so
+    # a job that asks for `ubuntu-latest` gets no runner at all (runner_id=0,
+    # seconds to fail) — see the runner migration in the sibling workflow. The
+    # org-level runner carries the `slimmini` label. The budget blocks hosted
+    # jobs for private repos only; public repos are unaffected.
+    runs-on: slimmini
+    outputs:
+      versions: ${{ steps.pick.outputs.versions }}
+      config_name: ${{ steps.pick.outputs.config_name }}
+    steps:
+      - name: Pick the acceptance matrix for this event
+        id: pick
+        run: |
+          if [[ "${{ github.ref }}" == refs/tags/v* ]] \
+             || [[ "${{ inputs.mode }}" == "release" ]]; then
+            echo 'versions=["3.10","3.11","3.12","3.13"]' >> "$GITHUB_OUTPUT"
+            echo "config_name=release (full 3.10-3.13 matrix)" >> "$GITHUB_OUTPUT"
+          else
+            echo 'versions=["3.11"]' >> "$GITHUB_OUTPUT"
+            echo "config_name=daily (3.11 single version)" >> "$GITHUB_OUTPUT"
+          fi
+
+  core-wheel:
+    needs: config
+    # See the `config` job above for why this is not `ubuntu-latest`.
+    runs-on: slimmini
+    strategy:
+      fail-fast: false
+      # R8: the accepted Python range must match what the package claims
+      # (pyproject requires-python >=3.10) — proven IN FULL on release
+      # events; daily events prove the 3.11 baseline only.
+      matrix:
+        python-version: ${{ fromJSON(needs.config.outputs.versions) }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Isolated environment
+        run: |
+          python -m venv "$RUNNER_TEMP/pactkit-venv"
+          echo "$RUNNER_TEMP/pactkit-venv/bin" >> "$GITHUB_PATH"
+
+      - name: Verify the environment is isolated
+        run: |
+          test "$(command -v python)" = "$RUNNER_TEMP/pactkit-venv/bin/python"
+          test "$(command -v pip)" = "$RUNNER_TEMP/pactkit-venv/bin/pip"
+          python -c "import sys; print('isolated venv:', sys.prefix)"
+
+      - name: Build the core wheel
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build --wheel --outdir dist/ .
+          python -m build --sdist --outdir dist/ .
+
+      # STORY-slim-20260917beaa87bc5d27: the dev repo is private and the
+      # public mirror is curated docs only — for a procurement review the
+      # PyPI artifacts ARE the source of record for license and code.  A
+      # packaging regression that drops LICENSE from the wheel/sdist would
+      # otherwise surface as a customer-side legal question, not a red build.
+      - name: Built artifacts carry LICENSE and sources (procurement)
+        run: |
+          python -m pip install --upgrade pip build > /dev/null 2>&1 || true
+          WHEEL=$(ls dist/pactkit-*.whl)
+          SDIST=$(ls dist/pactkit-*.tar.gz)
+          python - "$WHEEL" "$SDIST" <<'PY'
+          import sys, tarfile, zipfile
+          wheel, sdist = sys.argv[1], sys.argv[2]
+          names = zipfile.ZipFile(wheel).namelist()
+          assert any(n.endswith("LICENSE") for n in names), "wheel is missing LICENSE"
+          py = [n for n in names if n.endswith(".py")]
+          assert len(py) >= 90, f"wheel source count suspicious: {len(py)} files"
+          tarnames = tarfile.open(sdist).getnames()
+          assert any(n.endswith("LICENSE") for n in tarnames), "sdist is missing LICENSE"
+          assert any(n.endswith("src/pactkit/__init__.py") for n in tarnames), "sdist is missing sources"
+          print(f"LICENSE + sources verified: wheel {len(py)} .py, sdist ok")
+          PY
+
+      - name: The runner provides a per-job temp directory
+        run: |
+          # Every path below lives under $RUNNER_TEMP, not /tmp. On a hosted
+          # runner /tmp is a fresh VM per run, so a leftover venv was
+          # impossible; on a persistent self-hosted runner it survives, and
+          # the AC11 assertion below would then be checking a venv built by an
+          # earlier run — a clean-environment guarantee that quietly stopped
+          # holding. Assert the runner supplies the directory rather than
+          # discovering it as a stray `/accept`.
+          test -n "$RUNNER_TEMP" \
+            || { echo "::error::RUNNER_TEMP is unset — this job needs a runner that provides one"; exit 1; }
+
+      - name: Install from the wheel into a clean environment (AC11)
+        run: |
+          python -m venv "$RUNNER_TEMP/accept"
+          # Direct wheel path: the package under acceptance comes from the
+          # local dist/ (never PyPI, never editable); third-party deps
+          # (pyyaml) resolve from the index.
+          "$RUNNER_TEMP/accept/bin/pip" install dist/pactkit-*.whl
+          ! "$RUNNER_TEMP/accept/bin/pip" list | grep -q '\-e '
+          "$RUNNER_TEMP/accept/bin/pactkit" version
+
+      - name: Base wheel + documented extras resolve (AC11)
+        run: |
+          python -m venv "$RUNNER_TEMP/extras"
+          # The extras README documents must actually resolve from the built
+          # wheel. Adapter extras are deliberately excluded here: they pin
+          # the released core from the index, which during release prep is
+          # older than this build (core-first publish order).
+          WHEEL=$(ls dist/pactkit-*.whl)
+          "$RUNNER_TEMP/extras/bin/pip" install "$WHEEL[lint,visualize]"
+          "$RUNNER_TEMP/extras/bin/pactkit" version
+
+      - name: Prompt-body snapshots from the wheel (AC10/R7)
+        env:
+          PACTKIT_SNAPSHOT_FROM_WHEEL: "1"
+          # The runner is persistent, so /tmp is shared across jobs: a pytest
+          # tmp_path under it can walk up into host markers an earlier job left
+          # behind. runner.temp is created and cleaned per job. Step-level, not
+          # workflow-level — the `runner` context is not available there and
+          # GitHub rejects the whole file for it.
+          TMPDIR: ${{ runner.temp }}
+        run: |
+          # Wheel mode: the deploy subprocesses must import the WHEEL — no
+          # checkout PYTHONPATH, provenance asserted (site-packages origin),
+          # and every installed host participates in the comparison (this
+          # core-only environment compares classic; each adapter repo's
+          # acceptance adds its own host). A skip fails the step. The empty
+          # `-c` ini keeps the checkout's pyproject (pythonpath=src) from
+          # shadowing the installed wheel.
+          "$RUNNER_TEMP/accept/bin/pip" install pytest
+          printf '[pytest]\n' > "$RUNNER_TEMP/acceptance-pytest.ini"
+          cd "$RUNNER_TEMP"
+          "$RUNNER_TEMP/accept/bin/pytest" \
+            "$GITHUB_WORKSPACE/tests/unit/test_c1_body_snapshots.py" \
+            -c "$RUNNER_TEMP/acceptance-pytest.ini" -p no:cacheprovider \
+            --junitxml="$RUNNER_TEMP/snap-results.xml" -q \
+            || { echo "::error::prompt-body snapshot comparison failed"; exit 1; }
+          # The heredoc is quoted, so the path is passed as an argument rather
+          # than interpolated.
+          "$RUNNER_TEMP/accept/bin/python" - "$RUNNER_TEMP/snap-results.xml" <<'EOF'
+          import sys
+          import xml.etree.ElementTree as ET
+
+          root = ET.parse(sys.argv[1]).getroot()
+          skipped = sum(int(s.get("skipped", 0)) for s in root.iter("testsuite"))
+          errors = sum(int(s.get("errors", 0)) for s in root.iter("testsuite"))
+          if skipped or errors:
+              print(f"::error::snapshot step: {skipped} skipped, {errors} errors — "
+                    "skip is failure under release acceptance")
+              sys.exit(1)
+          print("snapshots: 0 skipped, 0 errors")
+          EOF
+
+      - name: Classic journey from the wheel (AC12, CLI layer)
+        run: |
+          # The CLI is invoked by ABSOLUTE PATH from the acceptance venv
+          # (review round 2, F3): a bare `pactkit` would resolve against
+          # whatever the runner has preinstalled — or nothing at all.
+          # OpenCode/Codex journeys run in their own adapter repos'
+          # acceptance workflows (zero-credential split).
+          PACTKIT="$RUNNER_TEMP/accept/bin/pactkit"
+          command -v "$PACTKIT" >/dev/null 2>&1 \
+            || { echo "::error::acceptance venv has no pactkit entry point"; exit 1; }
+          export HOME="$RUNNER_TEMP/journey-home"
+          export XDG_CONFIG_HOME="$RUNNER_TEMP/journey-home/.config"
+          rm -rf "$HOME" "$RUNNER_TEMP/journey-proj"
+          mkdir -p "$HOME" "$RUNNER_TEMP/journey-proj"
+          cd "$RUNNER_TEMP/journey-proj"
+          git init -q .
+          git config user.email journey@example.invalid
+          git config user.name journey
+
+          fail() { echo "::error::journey: $1"; exit 1; }
+          root="$HOME/.claude"
+          "$PACTKIT" version
+          "$PACTKIT" init --format classic > init.log 2>&1 \
+            || { cat init.log; fail "classic init failed"; }
+          [ -f "$root/.pactkit-deployed.json" ] || fail "no deployment manifest"
+          entry="$root/skills/project-plan/SKILL.md"
+          [ -f "$entry" ] || fail "method entry point missing ($entry)"
+
+          mkdir -p "$root/rules"
+          printf '# My team conventions\n- ours, not PactKit\x27s\n' > "$root/rules/my-team.md"
+          "$PACTKIT" update --format classic > update.log 2>&1 \
+            || { cat update.log; fail "classic update failed"; }
+          [ -f "$root/rules/my-team.md" ] || fail "user rule file lost by update"
+
+          "$PACTKIT" uninstall --target "$root" > uninstall.log 2>&1 \
+            || { cat uninstall.log; fail "classic uninstall failed"; }
+          [ -f "$root/rules/my-team.md" ] || fail "user file deleted by uninstall"
+          [ ! -f "$root/skills/pactkit-board/scripts/board.py" ] \
+            || fail "manifest-owned file survived uninstall"
+          echo "classic journey OK (CLI layer)"
+          # Real-host runtime sessions are NOT exercised here — recorded as
+          # UNVERIFIED per R8: 自动化 CLI/产物检查与真实宿主运行记录 MUST
+          # 分开标注.
+
+      # R8 (STORY-slim-20260917c18f4a962b70): every CI summary states the
+      # event, SHA, verification config, Python/host coverage and the
+      # actual run/skip reasons — a green core-only acceptance must never
+      # read as "all hosts verified".
+      - name: CI summary (R8)
+        if: always()
+        run: |
+          ALL='${{ needs.config.outputs.versions }}'
+          {
+            echo "## Release Acceptance — ${{ needs.config.outputs.config_name }}"
+            echo ""
+            echo "| field | value |"
+            echo "|---|---|"
+            echo "| event | \`${{ github.event_name }}\` |"
+            echo "| ref | \`${{ github.ref }}\` |"
+            echo "| sha | \`${{ github.sha }}\` |"
+            echo "| config | ${{ needs.config.outputs.config_name }} |"
+            echo "| versions this config | $ALL |"
+            echo "| this runner | ${{ matrix.python-version }} |"
+            echo "| host coverage | core-only: classic prompt snapshots compared; opencode/codex adapters are NOT verified here (their own repos' release-acceptance covers them) |"
+            echo "| skip policy | a skip in the snapshot step fails the step (skip = failure, never a pass) |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  credentials:
+    # The same whole-checkout scan the standalone `Credentials` workflow runs
+    # on every push, repeated here because this workflow is the gate publish.yml
+    # waits on: a tag whose tree carries a credential must not reach PyPI, and
+    # "the push-time job was green" is not evidence about the tagged tree.
+    #
+    # Coverage differs from the local hook on purpose and the difference is
+    # reported, not merged: the hook scans STAGED files (what this commit
+    # changes), this scans the CHECKOUT (what the tag actually contains).
+    runs-on: slimmini
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Isolated environment
+        run: |
+          python -m venv "$RUNNER_TEMP/pactkit-venv"
+          echo "$RUNNER_TEMP/pactkit-venv/bin" >> "$GITHUB_PATH"
+
+      - name: Install PactKit
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+
+      - name: The scan has something to scan and something to compare against
+        run: |
+          test -f .secrets.baseline || { echo "no .secrets.baseline — nothing to compare against"; exit 1; }
+          count=$(git ls-files | wc -l | tr -d ' ')
+          echo "tracked files: $count"
+          test "$count" -gt 0
+
+      - name: The scan catches a synthetic finding
+        run: |
+          python3 -c "import pathlib,secrets,sys; pathlib.Path(sys.argv[1]).write_text('X = \"' + secrets.token_hex(32) + '\"\n')" "$RUNNER_TEMP/synthetic.py"
+          if pactkit commit-gate --secrets-entry --baseline .secrets.baseline "$RUNNER_TEMP/synthetic.py"; then
+            echo "::error::the credential scan did not catch a synthetic high-entropy string"
+            exit 1
+          fi
+          echo "the scan caught the synthetic finding, as it must"
+
+      - name: Credential scan (whole checkout)
+        run: |
+          # `.secrets.baseline` is excluded: its `hashed_secret` values are sha1
+          # hex strings, so scanning it adds an entry per existing entry.
+          git ls-files | grep -v '^\.secrets\.baseline$' | tr '\n' '\0' \
+            | xargs -0 pactkit commit-gate --secrets-entry --baseline .secrets.baseline

pactkit-4.1.1/.gitignore

@@ -0,0 +1,90 @@
+# Python
+*.pyc
+__pycache__/
+.coverage
+*.py[cod]
+*$py.class
+.pytest_cache/
+*.egg-info/
+dist/
+build/
+.eggs/
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+*.tmp
+*.log
+
+# PactKit - generated artifacts (auto-regenerated; not versioned).
+# Named files, NOT the whole directory: the authored diagrams
+# (system_design.mmd, workflow_graph.mmd, reverse_call_graph.mmd) live in the
+# same directory and MUST stay tracked. A directory-wide rule is what let 7
+# generated files stay tracked for four months — .gitignore does not apply to
+# already-tracked paths (STORY-slim-2026091893aad6f3d8ac R3).
+docs/architecture/graphs/call_graph.mmd
+docs/architecture/graphs/class_graph.mmd
+docs/architecture/graphs/code_graph.mmd
+docs/architecture/graphs/module_graph.mmd
+docs/architecture/graphs/report.html
+docs/architecture/graphs/call_graph.db
+docs/architecture/graphs/focus_file_graph.mmd
+# Whole directory is safe HERE (unlike graphs/ above): every file is a
+# version-stamped machine artifact ({version}_{mode}.mmd) — no authored
+# asset lives here. Untracked 2026-09-18; 53 files were tracked while the
+# rule said otherwise (STORY-slim-2026091893aad6f3d8ac).
+docs/architecture/snapshots/
+
+# PactKit - previously excluded for IP protection (repo is now private, all tracked)
+
+# Claude Code local config
+.claude/
+
+# Codex CLI local config
+.codex/
+
+# GitHub Copilot deployment artifacts (generated by pactkit update).
+# `.github/*` rather than `.github/`: git cannot re-include a file whose
+# parent *directory* is excluded, so `!.github/workflows/` matched nothing
+# and every new workflow file silently needed `git add -f` — the shape that
+# would have dropped this repo's own drift gate without a word.
+.github/*
+!.github/workflows/
+
+# Office files
+~$*
+*.pptx
+
+# Secrets
+.pypirc
+
+# Playwright MCP
+.playwright-mcp/
+
+# Backup
+*.bak
+.mcp.json
+.pactkit/
+coder/
+docker/
+docs/slides/
+
+
+# Call graph SQLite output (STORY-slim-121)
+docs/architecture/graphs/*.db
+
+# 准入的**待审内容**是中间产物，不是记录——`--prepare` 的产物每次都会被重写，
+# 而它内嵌回执摘要（高熵串，会被 secrets 门当成凭据）。进 git 的是签核后的
+# `<id>.json` 记录，那才是长期证据。
+docs/architecture/governance/contract-admissions/*.proposed.json

pactkit-4.1.1/.pre-commit-config.yaml

@@ -0,0 +1,35 @@
+# PactKit integration — managed by `pactkit commit-gate --pre-commit-setup`.
+# pre-commit owns hook installation and scheduling; edit hook ORDER
+# here if you need to, but keep the pactkit hook ids (health check keys on them).
+#
+# Order is the pre-commit stage's order, and it is deliberate: the credential
+# scan runs BEFORE the domain check.  The domain check runs the test suite on
+# some changes, so a credential staged alongside them would be reported only
+# after minutes of tests — and the credential is the finding that must not wait,
+# because it is the one that reaches the remote if the commit goes through.
+# (Measured 2026-09-29: the scan was third, behind a check that can run tests.)
+repos:
+  - repo: local
+    hooks:
+      - id: pactkit-detect-secrets
+        name: detect-secrets (staged files)
+        entry: pactkit commit-gate --secrets-entry
+        language: system
+        stages: [pre-commit]
+        # baseline of reviewed findings (synthetic test creds + snapshot
+        # digests) — the hook does NOT auto-discover it (measured, 1.5.0)
+        args: [--baseline, .secrets.baseline]
+      - id: pactkit-domain-check
+        name: pactkit domain check
+        entry: pactkit commit-gate --pre-commit-entry
+        language: system
+        stages: [pre-commit]
+        pass_filenames: false
+        always_run: true
+      - id: pactkit-push-policy
+        name: pactkit push policy
+        entry: pactkit commit-gate --pre-push-entry
+        language: system
+        stages: [pre-push]
+        pass_filenames: false
+        always_run: true