null
/
Project-Template
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

docs(readme): stop carrying a count the directory can contradict 

README.md opened with "twenty scripts that enforce both". The directory holds
23 -- Batch 01 added restore-check.sh, controls.sh and preflight.sh.

Fixed the way scaffold.sh's header was fixed earlier in this batch, which said
"thirteen documents" and was three behind: by carrying no number at all rather
than a fresh one that goes stale after the next script. doc-claims.sh verifies
that named paths exist, not that stated quantities are true, so nothing catches
this class and the only durable fix is not to make the claim.

The day-one table also predated all three new scripts. It now names backup.sh
and restore-check.sh together, since sending a reader to backup.sh alone points
them at a script whose own header says it is half the job, and adds preflight.sh
and controls.sh. The secrets.sh row gained --built.

closes #13
This commit is contained in:
null 2026-08-17 23:31:40 -05:00
parent bbf2a0a1ac
commit 7247cf2328
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@ -1,7 +1,7 @@
# Project Template
A working documentation skeleton, the tracker convention that goes with it, and
twenty scripts that enforce both. Copy `docs/` into a new project, replace the
the scripts that enforce both. Copy `docs/` into a new project, replace the
angle-bracket placeholders, delete the paragraphs that do not apply — then
create the labels and the first milestone in the repository's issue tracker.
@ -248,7 +248,10 @@ on day one:
| `release.sh` | version bump, guards, build, verify, push. Refuses to build on a half-run test suite or a malformed public origin — both of which had shipped in every release of the project this came from. |
| `verify.sh` | every check the project has, in one command, with one table saying which passed, which failed, and which did not run |
| `check-env.sh` | which variables are set and which are missing, before anything reads them |
| `secrets.sh` | credential shapes in a staged diff, using the project's own patterns where it has written them down |
| `secrets.sh` | credential shapes in a staged diff, using the project's own patterns where it has written them down — and `--built`, the compiled bundle, which is the artifact users actually receive and the one the repository scan never sees |
| `backup.sh` `restore-check.sh` | a dump verified before it is trusted, and the restore that proves it is a backup rather than a file. The second exists because the first says so: *a backup nobody has restored is a guess.* |
| `preflight.sh` | headers, TLS, and — behind `--auth` — login rate limiting and account enumeration, against a live URL. Refuses any host but its configured origin. |
| `controls.sh` | which operational controls this project has, each row saying whether that is measured, declared, not applicable, or simply unknown |
| `prove-guard.sh` | breaks what a guard protects and requires the guard to go red, then restores the file from a trap. `GUARDS.md` §1 as a command — the rule that a guard nobody has seen fail is not yet evidence. |
| `doc-claims.sh` | every file a document names must exist — and `--covers`, whether every file that exists is named. The second is the one that catches a list quietly missing rows. |
| `duplication.py` `dead-code.py` | code that exists twice; exports nothing imports and assets nothing renders |