szl-substrate 0.1.0__tar.gz

szl_substrate-0.1.0/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default code owner (mirrors szl-holdings/.github). Per-path owners can be added below.
+* @stephenlutar2-hash

szl_substrate-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,57 @@
+# Standard bug report form for the szl-holdings estate.
+# Installed by the szl-alignment engine; keep in sync with
+# alignment/templates/ISSUE_TEMPLATE/bug_report.yml.
+name: Bug report
+description: File a reproducible, receipt-backed bug report
+title: "[bug]: "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. Control before action, evidence after:
+        a bug is actionable when it is reproducible and receipt-backed.
+  - type: input
+    id: version
+    attributes:
+      label: Version / commit
+      description: What were you running? Tag, branch, or commit SHA.
+      placeholder: e.g. v14.2.0 or 1a2b3c4
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: Observed behavior, including the exact error text.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What should have happened instead?
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Minimal reproduction
+      description: Steps, commands, or a minimal repo case.
+      placeholder: "1. ...\n2. ...\n3. ..."
+    validations:
+      required: true
+  - type: textarea
+    id: receipts
+    attributes:
+      label: Receipts
+      description: Logs, CI links, screenshots. If unknown, say UNKNOWN — never guess.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-flight checks
+      options:
+        - label: I searched existing issues for duplicates
+          required: true
+        - label: This is not a security vulnerability (see SECURITY.md for private disclosure)
+          required: true

szl_substrate-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+# Issue-template routing for the szl-holdings estate.
+# Installed by the szl-alignment engine; keep in sync with
+# alignment/templates/ISSUE_TEMPLATE/config.yml.
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/szl-holdings
+    about: Report vulnerabilities privately via GitHub Security Advisories — see SECURITY.md. Never file public issues for undisclosed vulnerabilities.
+  - name: Org-wide questions
+    url: https://github.com/szl-holdings
+    about: Questions about the estate, doctrine, or alignment — start with the org profile.

szl_substrate-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## What
+
+<!-- What changed, and why. One paragraph, evidence-linked. -->
+
+## Receipts
+
+<!-- CI run links, test output, screenshots, audit artifacts.
+     UNKNOWN is never claimed as PASS. -->
+
+## Checklist
+
+- [ ] Control before action: the invariant (test / policy / assertion) landed before or with the behavior change
+- [ ] Evidence after: receipts updated and linked above
+- [ ] UNKNOWN is not claimed as PASS anywhere in this PR
+- [ ] No new a11oy.com references — the forbidden domain must never appear (gate: `forbidden-domain.yml`)
+- [ ] Docs updated (README / CHANGELOG) if behavior or surfaces changed
+- [ ] Commits are conventional and signed off (`Signed-off-by:`)

szl_substrate-0.1.0/.github/dependabot.yml

@@ -0,0 +1,50 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "America/New_York"
+    labels:
+      - "dependencies"
+    open-pull-requests-limit: 5
+    groups:
+      github_actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "America/New_York"
+    labels:
+      - "dependencies"
+    open-pull-requests-limit: 5
+    groups:
+      pip:
+        patterns:
+          - "*"
+
+  # Hash-locked CI requirements (requirements/ci/*.txt, compiled with
+  # `uv pip compile --universal --generate-hashes`; see the .in headers).
+  # tests/test_ci_requirements.py fails if a bump leaves a lock outside the
+  # pyproject.toml specifiers.
+  - package-ecosystem: "pip"
+    directory: "/requirements/ci"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "America/New_York"
+    labels:
+      - "dependencies"
+    open-pull-requests-limit: 5
+    groups:
+      pip-ci:
+        patterns:
+          - "*"

szl_substrate-0.1.0/.github/scripts/szl_pypi_release_gate.py

@@ -0,0 +1,227 @@
+#!/usr/bin/env python3
+"""SZL PyPI release gate — build, verify, and bind a distribution to its git tag.
+
+Canonical file: identical bytes in every szl-holdings repository that publishes
+to PyPI. Runs in the `build` job of `.github/workflows/publish-pypi.yml`:
+
+  * on pull_request / push  -> builds and gates every declared package (readiness)
+  * on release (published)  -> selects the package named by the tag, requires
+                               tag == v{version} (single package) or
+                               {name}-v{version} (multi-package repo), refuses
+                               versions that already exist on PyPI, and emits
+                               `dist/` plus a JSON receipt for the publish job.
+
+Fails closed. Nothing here talks to PyPI with credentials; publication happens
+only in the separate `publish` job through Trusted Publishing (OIDC).
+"""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tomllib
+import urllib.error
+import urllib.request
+import zipfile
+from email.parser import HeaderParser
+from pathlib import Path
+
+FORBIDDEN_TOP_LEVEL = {"tests", "test", "docs", "examples", "example", "scripts", "benchmarks", "build", "dist", "out", "data", "payload", "fixtures"}
+PRIVATE_CLASSIFIER = "Private :: Do Not Upload"
+
+
+def norm(name: str) -> str:
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def sh(cmd: list[str], **kw) -> subprocess.CompletedProcess:
+    print("+", " ".join(cmd), flush=True)
+    return subprocess.run(cmd, check=True, text=True, **kw)
+
+
+def fail(msg: str) -> None:
+    print(f"::error::{msg}", flush=True)
+    sys.exit(1)
+
+
+def warn(msg: str) -> None:
+    print(f"::warning::{msg}", flush=True)
+
+
+def parse_packages(spec: str) -> list[dict]:
+    pkgs = []
+    for item in [s.strip() for s in spec.split(";") if s.strip()]:
+        name, _, rest = item.partition("=")
+        directory, _, env = rest.partition(":")
+        pkgs.append({"name": name.strip(), "dir": (directory or ".").strip(), "environment": (env or "pypi").strip()})
+    if not pkgs:
+        fail("SZL_PACKAGES is empty")
+    return pkgs
+
+
+def pypi_versions(name: str) -> set[str] | None:
+    req = urllib.request.Request(f"https://pypi.org/pypi/{norm(name)}/json", headers={"User-Agent": "szl-pypi-release-gate/1"})
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r:
+            return set(json.loads(r.read())["releases"].keys())
+    except urllib.error.HTTPError as e:
+        if e.code == 404:
+            return set()
+        warn(f"PyPI lookup for {name} failed: HTTP {e.code}")
+        return None
+    except Exception as e:  # network trouble is not a reason to publish blindly on release
+        warn(f"PyPI lookup for {name} failed: {e}")
+        return None
+
+
+def read_metadata(wheel: Path) -> dict:
+    with zipfile.ZipFile(wheel) as z:
+        meta_name = next(n for n in z.namelist() if n.endswith(".dist-info/METADATA"))
+        msg = HeaderParser().parsestr(z.read(meta_name).decode("utf-8", "replace"))
+        top = sorted({n.split("/")[0] for n in z.namelist() if not n.split("/")[0].endswith(".dist-info")})
+        py_files = [n for n in z.namelist() if n.endswith(".py")]
+    return {"msg": msg, "top_level": top, "py_count": len(py_files)}
+
+
+def gate_package(pkg: dict, repo: str, event: str, ref_type: str, ref_name: str, outdir: Path) -> dict:
+    pdir = Path(pkg["dir"]).resolve()
+    pyproject = pdir / "pyproject.toml"
+    if not pyproject.is_file():
+        fail(f"{pkg['name']}: {pyproject} not found")
+    with open(pyproject, "rb") as f:
+        pp = tomllib.load(f)
+    project = pp.get("project") or {}
+    release_cfg = ((pp.get("tool") or {}).get("szl") or {}).get("release") or {}
+
+    if norm(project.get("name", "")) != norm(pkg["name"]):
+        fail(f"{pkg['name']}: pyproject [project].name is {project.get('name')!r}, expected {pkg['name']!r}")
+    if PRIVATE_CLASSIFIER in (project.get("classifiers") or []):
+        fail(f"{pkg['name']}: carries '{PRIVATE_CLASSIFIER}' — not a publishable package")
+    if not (pp.get("build-system") or {}).get("build-backend"):
+        fail(f"{pkg['name']}: pyproject has no [build-system].build-backend (PEP 517 backend must be explicit)")
+    for key in ("description", "readme", "requires-python"):
+        if not project.get(key):
+            fail(f"{pkg['name']}: [project].{key} is required")
+    if not (project.get("license") or project.get("license-files")):
+        fail(f"{pkg['name']}: [project].license (or license-files) is required")
+    urls = project.get("urls") or {}
+    source_url = urls.get("Source") or urls.get("Repository") or urls.get("Source Code")
+    expected_source_url = f"https://github.com/{repo}"
+    if not isinstance(source_url, str) or source_url.rstrip("/").lower() != expected_source_url.lower():
+        fail(f"{pkg['name']}: [project.urls] must carry Source/Repository = {expected_source_url} (got {source_url!r}); PyPI verifies this against the Trusted Publisher")
+
+    # Build into a per-package staging dir, then verify.
+    stage = outdir.parent / f"stage-{norm(pkg['name'])}"
+    shutil.rmtree(stage, ignore_errors=True)
+    stage.mkdir(parents=True)
+    sh([sys.executable, "-m", "build", "--outdir", str(stage), str(pdir)])
+    files = sorted(stage.iterdir())
+    wheels = [f for f in files if f.suffix == ".whl"]
+    sdists = [f for f in files if f.name.endswith(".tar.gz")]
+    if len(wheels) != 1 or len(sdists) != 1:
+        fail(f"{pkg['name']}: expected exactly one wheel and one sdist, got {[f.name for f in files]}")
+    sh([sys.executable, "-m", "twine", "check", "--strict", *[str(f) for f in files]])
+
+    meta = read_metadata(wheels[0])
+    msg = meta["msg"]
+    version = msg["Version"]
+    if norm(msg["Name"]) != norm(pkg["name"]):
+        fail(f"{pkg['name']}: built metadata Name={msg['Name']!r} does not match")
+    if meta["py_count"] == 0:
+        fail(f"{pkg['name']}: wheel contains no Python files — packaging is misconfigured")
+    bad_top = sorted(set(meta["top_level"]) & FORBIDDEN_TOP_LEVEL)
+    if bad_top:
+        fail(f"{pkg['name']}: wheel leaks non-package top-level entries {bad_top}; fix package discovery")
+    declared = release_cfg.get("import_names")
+    if declared:
+        actual = {t[:-3] if t.endswith(".py") else t for t in meta["top_level"]}
+        if actual != set(declared):
+            fail(f"{pkg['name']}: wheel top-level names {sorted(actual)} != declared [tool.szl.release].import_names {sorted(declared)}")
+    if not msg.get_all("Project-URL"):
+        fail(f"{pkg['name']}: built metadata has no Project-URL entries")
+
+    # Tag binding (release only) and PyPI collision check.
+    tag_expect_single = f"v{version}"
+    tag_expect_multi = f"{norm(pkg['name'])}-v{version}"
+    if event == "release":
+        if ref_type != "tag":
+            fail(f"release event on non-tag ref {ref_type}:{ref_name}")
+        if ref_name not in (tag_expect_single, tag_expect_multi):
+            fail(f"{pkg['name']}: tag {ref_name!r} does not match built version {version!r} (expected {tag_expect_single!r} or {tag_expect_multi!r})")
+    existing = pypi_versions(pkg["name"])
+    if existing is None and event == "release":
+        fail(f"{pkg['name']}: could not confirm PyPI release list; refusing to publish blind")
+    if existing and version in existing:
+        if event == "release":
+            fail(f"{pkg['name']}=={version} already exists on PyPI; bump [project].version before releasing")
+        warn(f"{pkg['name']}=={version} already exists on PyPI; a release will require a version bump")
+
+    # Smoke-install the wheel in isolation and import-check the declared names.
+    venv = outdir.parent / f"venv-{norm(pkg['name'])}"
+    shutil.rmtree(venv, ignore_errors=True)
+    sh([sys.executable, "-m", "venv", str(venv)])
+    vpy = venv / ("Scripts" if os.name == "nt" else "bin") / "python"
+    sh([str(vpy), "-m", "pip", "install", "--disable-pip-version-check", "-q", str(wheels[0])])
+    sh([str(vpy), "-c", f"import importlib.metadata as m; assert m.version({pkg['name']!r}) == {version!r}, m.version({pkg['name']!r})"])
+    for mod in declared or []:
+        sh([str(vpy), "-c", f"import importlib; importlib.import_module({mod!r})"])
+
+    outdir.mkdir(parents=True, exist_ok=True)
+    receipt = {"package": pkg["name"], "version": version, "environment": pkg["environment"], "event": event, "ref": f"{ref_type}:{ref_name}",
+               "repository": repo, "source_sha": os.environ.get("GITHUB_SHA"), "run_id": os.environ.get("GITHUB_RUN_ID"),
+               "files": {}, "top_level": meta["top_level"]}
+    for f in files:
+        receipt["files"][f.name] = hashlib.sha256(f.read_bytes()).hexdigest()
+        shutil.copy2(f, outdir / f.name)
+    print(json.dumps(receipt, indent=2))
+    return receipt
+
+
+def main() -> None:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--packages", required=True, help="name=dir[:environment];name2=dir2[:environment]")
+    ap.add_argument("--repo", required=True)
+    ap.add_argument("--event", required=True)
+    ap.add_argument("--ref-type", required=True)
+    ap.add_argument("--ref-name", required=True)
+    ap.add_argument("--outdir", default="dist")
+    args = ap.parse_args()
+
+    pkgs = parse_packages(args.packages)
+    outdir = Path(args.outdir).resolve()
+    shutil.rmtree(outdir, ignore_errors=True)
+
+    if args.event == "release":
+        if len(pkgs) == 1:
+            selected = pkgs
+        else:
+            m = re.match(r"^(?P<name>.+?)-v(?P<ver>\d.*)$", args.ref_name)
+            if not m:
+                fail(f"multi-package repository: tag must be <package>-v<version>, got {args.ref_name!r}")
+            selected = [p for p in pkgs if norm(p["name"]) == norm(m.group("name"))]
+            if len(selected) != 1:
+                fail(f"tag {args.ref_name!r} names no declared package; declared: {[p['name'] for p in pkgs]}")
+    else:
+        selected = pkgs
+
+    receipts = []
+    for pkg in selected:
+        pkg_out = outdir if args.event == "release" else outdir / norm(pkg["name"])
+        receipts.append(gate_package(pkg, args.repo, args.event, args.ref_type, args.ref_name, pkg_out))
+
+    (outdir.parent / "release-gate.json").write_text(json.dumps(receipts, indent=2))
+    gh_out = os.environ.get("GITHUB_OUTPUT")
+    if gh_out and args.event == "release":
+        r = receipts[0]
+        with open(gh_out, "a") as f:
+            f.write(f"package={r['package']}\nversion={r['version']}\nenvironment={r['environment']}\n")
+    print(f"release gate PASS for {[r['package'] + '==' + r['version'] for r in receipts]}")
+
+
+if __name__ == "__main__":
+    main()

szl_substrate-0.1.0/.github/workflows/base-python-ci.yml

@@ -0,0 +1,67 @@
+# Standard Python gate for the szl-holdings estate: ruff + pytest on the two
+# supported interpreters. Installed by the szl-alignment engine (only into
+# repos where Python is detected) from
+# alignment/templates/workflows/base-python-ci.yml. Local deviation from that
+# template: the toolchain, the core dependency and the dev extra install from
+# the hash-locked requirements/ci/base.txt (OpenSSF Scorecard
+# Pinned-Dependencies), the package installs with --no-deps, and the
+# template's requirements*.txt probes are dropped because this repository has
+# no such files. The web extra stays uninstalled on purpose, so this gate
+# keeps proving that the suite runs without fastapi/starlette/httpx.
+name: base-python-ci
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      # Org policy: every action is pinned to a full-length commit SHA.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      # Regenerate with the command in requirements/ci/base.in.
+      - name: Install toolchain (hash-locked)
+        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements/ci/base.txt
+
+      - name: Install the package (no dependency resolution)
+        run: python -m pip install --disable-pip-version-check --no-deps --no-build-isolation -e .
+
+      # Blocking scope is the classes that indicate real breakage (syntax
+      # errors, undefined names, unused imports). The full default ruleset runs
+      # non-blocking so repos keep visibility without a forced flag day; repos
+      # with their own ruff config in pyproject.toml already get stricter
+      # behavior from their primary CI.
+      - name: "Ruff (blocking: E9/F)"
+        run: ruff check . --output-format github --select E9,F
+
+      - name: Ruff (full ruleset, informational)
+        run: ruff check . --statistics --exit-zero
+
+      # The base gate owns tests/ only. Suites living elsewhere (scripts/,
+      # tools/) are exercised by each repo's dedicated workflows with their
+      # own dependency pins; collecting them here would fail on imports this
+      # minimal install does not provide. Repos with no tests/ skip honestly.
+      - name: Pytest (blocking)
+        run: |
+          if [ -d tests ]; then
+            pytest -q tests
+          else
+            echo "::notice::No tests/ directory; base gate defers to repo-specific suites."
+          fi

szl_substrate-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,45 @@
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: pytest (${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      # Every distribution comes from the hash-locked file (core + dev + web
+      # extras, plus the build backend); the package itself then installs
+      # without resolving anything. Regenerate with the command in
+      # requirements/ci/test.in.
+      - name: Install hash-locked test dependencies
+        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements/ci/test.txt
+
+      - name: Install the package (no dependency resolution)
+        run: python -m pip install --disable-pip-version-check --no-deps --no-build-isolation -e .
+
+      - name: Check installed requirements are consistent
+        run: python -m pip check
+
+      - name: Run pytest
+        run: python -m pytest -q

szl_substrate-0.1.0/.github/workflows/codeql.yml

@@ -0,0 +1,53 @@
+name: CodeQL
+
+# Self-contained CodeQL SAST for Python. This repository is public, so code
+# scanning results upload to the Security tab (the action's default) and pull
+# requests get the code-scanning check. The earlier private-repo pattern ran with
+# upload:false, which only failed on analysis errors and never surfaced a
+# finding. All actions SHA-pinned (org policy).
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '27 4 * * 1'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python]
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          category: "/language:${{ matrix.language }}"

szl_substrate-0.1.0/.github/workflows/commit-lint.yml

@@ -0,0 +1,43 @@
+name: Conventional Commits PR title lint
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  commitlint:
+    name: Lint PR title (Conventional Commits)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check PR title follows Conventional Commits
+        env:
+          # Passed via env (never interpolated into the script) to avoid injection.
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          set -euo pipefail
+
+          # Conventional Commits types allowed
+          types='feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert'
+
+          # <type>(optional-scope)(optional !): <subject>
+          header_re="^(${types})(\([a-z0-9._/-]+\))?(!)?: .+$"
+
+          if [[ ! "${PR_TITLE}" =~ ${header_re} ]]; then
+            echo "::error::PR title \"${PR_TITLE}\" is not a valid Conventional Commit."
+            echo "Expected format: <type>(optional-scope): <subject>"
+            echo "Allowed types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert"
+            exit 1
+          fi
+
+          # Subject must not start with an upper-case letter
+          subject="${PR_TITLE#*: }"
+          if [[ "${subject}" =~ ^[A-Z] ]]; then
+            echo "::error::The subject \"${subject}\" does not match the required pattern. Please use lower-case for the subject."
+            exit 1
+          fi
+
+          echo "PR title OK: ${PR_TITLE}"

szl_substrate-0.1.0/.github/workflows/doctrine.yml

@@ -0,0 +1,12 @@
+name: Doctrine
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: szl-holdings/.github/.github/workflows/doctrine-check.yml@79cb06b79d6a3156a5796948295617ff6b207683  # main

szl_substrate-0.1.0/.github/workflows/forbidden-domain.yml

@@ -0,0 +1,39 @@
+# Release-blocking CRITICAL gate for the szl-holdings estate.
+#
+# Rule (validated on the live org): a line matching
+#     (?<!-)a11oy\.com
+# is a violation UNLESS the same line is a prohibition/guard context, i.e. it
+# also matches /(never|forbidden|not in|assertNotIn|does not appear|is not a
+# surface|blocklist)/i — guard assertions, blocklists, and doctrine notes are
+# legitimate. Canonical surfaces are a-11-oy.com (product) and a11oy.net
+# (proof).
+#
+# Installed by the szl-alignment engine; keep in sync with
+# alignment/templates/workflows/forbidden-domain.yml.
+name: forbidden-domain
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Scan for forbidden domain references
+        shell: bash
+        run: |
+          set -euo pipefail
+          hits="$(rg -n --no-heading --hidden -P '(?<!-)a11oy\.com' --glob '!.git' . || true)"
+          violations="$(printf '%s' "$hits" | rg -v -i 'never|forbidden|not in|assertNotIn|does not appear|is not a surface|blocklist' || true)"
+          if [ -n "$violations" ]; then
+            echo "::error::Forbidden domain references found (release-blocking CRITICAL)."
+            echo "::error::Replace with a-11-oy.com or remove; guard contexts must say so on the same line."
+            printf '%s\n' "$violations"
+            exit 1
+          fi
+          echo "OK: no forbidden domain references outside guard contexts."