From 7247cf2328d3adaa494ace3da1d3536cef46c0e6 Mon Sep 17 00:00:00 2001 From: null Date: Mon, 17 Aug 2026 23:31:40 -0500 Subject: [PATCH] docs(readme): stop carrying a count the directory can contradict README.md opened with "twenty scripts that enforce both". The directory holds 23 -- Batch 01 added restore-check.sh, controls.sh and preflight.sh. Fixed the way scaffold.sh's header was fixed earlier in this batch, which said "thirteen documents" and was three behind: by carrying no number at all rather than a fresh one that goes stale after the next script. doc-claims.sh verifies that named paths exist, not that stated quantities are true, so nothing catches this class and the only durable fix is not to make the claim. The day-one table also predated all three new scripts. It now names backup.sh and restore-check.sh together, since sending a reader to backup.sh alone points them at a script whose own header says it is half the job, and adds preflight.sh and controls.sh. The secrets.sh row gained --built. closes #13 --- README.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 705e9e6..9b58abb 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # Project Template A working documentation skeleton, the tracker convention that goes with it, and -twenty scripts that enforce both. Copy `docs/` into a new project, replace the +the scripts that enforce both. Copy `docs/` into a new project, replace the angle-bracket placeholders, delete the paragraphs that do not apply — then create the labels and the first milestone in the repository's issue tracker. @@ -248,7 +248,10 @@ on day one: | `release.sh` | version bump, guards, build, verify, push. Refuses to build on a half-run test suite or a malformed public origin — both of which had shipped in every release of the project this came from. | | `verify.sh` | every check the project has, in one command, with one table saying which passed, which failed, and which did not run | | `check-env.sh` | which variables are set and which are missing, before anything reads them | -| `secrets.sh` | credential shapes in a staged diff, using the project's own patterns where it has written them down | +| `secrets.sh` | credential shapes in a staged diff, using the project's own patterns where it has written them down — and `--built`, the compiled bundle, which is the artifact users actually receive and the one the repository scan never sees | +| `backup.sh` `restore-check.sh` | a dump verified before it is trusted, and the restore that proves it is a backup rather than a file. The second exists because the first says so: *a backup nobody has restored is a guess.* | +| `preflight.sh` | headers, TLS, and — behind `--auth` — login rate limiting and account enumeration, against a live URL. Refuses any host but its configured origin. | +| `controls.sh` | which operational controls this project has, each row saying whether that is measured, declared, not applicable, or simply unknown | | `prove-guard.sh` | breaks what a guard protects and requires the guard to go red, then restores the file from a trap. `GUARDS.md` §1 as a command — the rule that a guard nobody has seen fail is not yet evidence. | | `doc-claims.sh` | every file a document names must exist — and `--covers`, whether every file that exists is named. The second is the one that catches a list quietly missing rows. | | `duplication.py` `dead-code.py` | code that exists twice; exports nothing imports and assets nothing renders |