README.md opened with "twenty scripts that enforce both". The directory holds
23 -- Batch 01 added restore-check.sh, controls.sh and preflight.sh.
Fixed the way scaffold.sh's header was fixed earlier in this batch, which said
"thirteen documents" and was three behind: by carrying no number at all rather
than a fresh one that goes stale after the next script. doc-claims.sh verifies
that named paths exist, not that stated quantities are true, so nothing catches
this class and the only durable fix is not to make the claim.
The day-one table also predated all three new scripts. It now names backup.sh
and restore-check.sh together, since sending a reader to backup.sh alone points
them at a script whose own header says it is half the job, and adds preflight.sh
and controls.sh. The secrets.sh row gained --built.
closes#13
forgejo-issue.py warns that a milestone title starting with a version token has
everything after it dropped from the dashboard phase -- `0.2 Payments` displays
as `0.2`. README.md was teaching exactly that form, and two adopted repos
followed it: Closer-Couples and fruit-fall both carry version-first titles and
lose their batch names on the card. PrivacyLLC-Web uses `Batch 05 — ...` and
displays whole.
The guidance now names the working form, and carries the comma rule the script
also enforces: a comma breaks the `milestones=` filter and the card shows the
wrong next action.
WORK_CYCLE.md gains the trap the same script documents and no document did: the
dashboard's next action is the NEWEST open issue in the current milestone, not
the most severe -- severity labels have no influence at all. Filing a routine P2
into the active batch silently replaces what the project card shows.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
README.md's status header named a person; it now names _null.
healthcheck.sh's crontab example hard-coded one operator's home directory in
two lines. Those are now $HOME, rather than a literal /home/_null, because a
template copied into every project should not carry anyone's home path and an
invented one would be a path that does not exist -- which this tree refuses
everywhere else.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The basis for every project here was itself unversioned: no .git, no remote,
no history. Changes to it had no diff and no revert, and two of its own guards
could not run at all -- doc-claims.sh and doc-triggers.py both read git
history, so the script written to catch documentation drift could not be run
against the documents that define drift.
This is the tree as it stands, including work that until now existed only as
loose files on disk: WORK_CYCLE.md, TOOLS.md, the Portainer image-line fix in
deploy.py, the status vocabulary corrected to the four words the conformance
checker actually enforces, the Exempt: mechanism documented, and the Forgejo
instance named in README.md.
secrets.sh --tracked reports one candidate, migrate.sh:480. It is the comment
documenting the three Postgres credential shapes that script redacts, with
literal placeholders, and it is left alone deliberately: GUARDS.md section 2
is that a source-grep guard must tell code from the comment about code, and
deleting an explanation to quiet a scanner is the failure it names.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
null