Skip to content

Commit c0928e6

Browse files
author
saiganakato
committed
feat: gitignore consistency check and delta re-audit orchestrator (v1.1.6)
1 parent 8ef0fd5 commit c0928e6

18 files changed

Lines changed: 711 additions & 4 deletions

CHANGELOG.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,25 @@ All notable changes to this regulation shelf are documented here.
44

55
The detailed shelf changelog lives in `regulation/shelf/SHELF_CHANGELOG.md`.
66

7+
## [1.1.6] - 2026-06-17
8+
9+
### Added
10+
11+
- `scripts/check-gitignore-consistency.*` — tracked vs `.gitignore` index checks (`G-04`)
12+
- `scripts/run-delta-audit.*` — delta re-audit orchestrator per `RE_AUDIT_POLICY.md`
13+
- `regulation/reference/GITIGNORE_CONSISTENCY.md`
14+
- `templates/delta-audit-record.md.template`
15+
16+
### Changed
17+
18+
- `collect-audit-evidence.*` includes gitignore consistency output
19+
- `OUTPUT_PATHS.md` documents `delta-audit-record.md`
20+
21+
### Fixed
22+
23+
- `run-delta-audit.*` sensitive-path detection uses `--name-only` (Windows `Mpath` format)
24+
- `run-delta-audit.*` `Open Blockers: 0` no longer false-positive invalidates delta
25+
726
## [1.1.5] - 2026-06-17
827

928
### Added

README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,10 @@ Orchestrator: `scripts/run-full-audit.*` (shelf validate + scaffold + evidence)
4444

4545
Tracked-file screening: `scripts/check-tracked-files.*` (flags unnecessary `git ls-files` entries)
4646

47+
Gitignore consistency: `scripts/check-gitignore-consistency.*` (tracked vs ignore rules)
48+
49+
Delta re-audit: `scripts/run-delta-audit.*` (changed-file scope per `RE_AUDIT_POLICY.md`)
50+
4751
Optional accelerators: `scripts/`, `audit.manifest.yml` in target repo
4852

4953
Human role: optional publication approval, not default command execution.

regulation/REGULATION_INDEX.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ Completeness proof: `regulation/REGULATION_COMPLETENESS.md`
4040

4141
- `regulation/reference/REPO_CONTENT_CLASSIFICATION.md`
4242
- `regulation/reference/TRACKED_FILE_SCREENING.md`
43+
- `regulation/reference/GITIGNORE_CONSISTENCY.md`
4344
- `regulation/reference/TOOL_VERIFICATION_MATRIX.md`
4445
- `regulation/reference/TOOL_REVIEW_CADENCE.md`
4546
- `regulation/reference/EVIDENCE_COMMANDS.md`
@@ -86,11 +87,16 @@ Completeness proof: `regulation/REGULATION_COMPLETENESS.md`
8687
- `templates/tier2-defer-record.md.template`
8788
- `templates/accepted-risk-record.md.template`
8889
- `templates/audit.manifest.yml.template`
90+
- `templates/delta-audit-record.md.template`
8991

9092
### Automation scripts
9193

9294
- `scripts/check-tracked-files.ps1`
9395
- `scripts/check-tracked-files.sh`
96+
- `scripts/check-gitignore-consistency.ps1`
97+
- `scripts/check-gitignore-consistency.sh`
98+
- `scripts/run-delta-audit.ps1`
99+
- `scripts/run-delta-audit.sh`
94100
- `scripts/collect-audit-evidence.ps1`
95101
- `scripts/collect-audit-evidence.sh`
96102
- `scripts/run-audit-quickstart.ps1`

regulation/execution/RE_AUDIT_POLICY.md

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,19 @@ git ls-files --others --exclude-standard
6767
- every file referenced by changed gates in the prior report
6868
- every file in the dependency cone of changed runtime or workflow paths
6969

70-
5. Re-run machine evidence (`scripts/collect-audit-evidence.*`)
70+
Preferred orchestrator:
71+
72+
```powershell
73+
& "$Shelf/scripts/run-delta-audit.ps1" -RepoPath <repo> -HostedRepo owner/repo -AuditSlug <slug> -AuditMode release
74+
```
75+
76+
```bash
77+
"$Shelf/scripts/run-delta-audit.sh" <repo> owner/repo release <slug>
78+
```
79+
80+
The orchestrator writes `audits/<slug>/delta-audit-record.md` and runs machine evidence.
81+
82+
5. Re-run machine evidence (`scripts/collect-audit-evidence.*`) when not using `run-delta-audit.*`
7183
6. Re-score every gate row affected by the change set
7284
7. Copy forward unchanged gate rows only when evidence still applies and assigner allows carry-forward
7385

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Gitignore Consistency
2+
3+
Status: Active
4+
5+
## Purpose
6+
7+
Detect mismatch between `.gitignore` rules and what Git still tracks.
8+
9+
Supports `G-04` and complements `scripts/check-tracked-files.*`.
10+
11+
## Script
12+
13+
```powershell
14+
& "$Shelf/scripts/check-gitignore-consistency.ps1" -RepoPath <target-repo>
15+
```
16+
17+
```bash
18+
"$Shelf/scripts/check-gitignore-consistency.sh" <target-repo>
19+
```
20+
21+
`collect-audit-evidence.*` runs this automatically.
22+
23+
## Checks
24+
25+
| Check | Severity | Meaning |
26+
|---|---|---|
27+
| tracked-but-ignored | blocked | path is in the index but matches `.gitignore` (`git ls-files -ci --exclude-standard`) |
28+
| missing-recommended-rule | review | `templates/gitignore.public-prep.template` pattern absent from `.gitignore` |
29+
| no-gitignore | review | repository has no `.gitignore` at root |
30+
31+
## Fix Guidance
32+
33+
Tracked-but-ignored rows usually need:
34+
35+
```bash
36+
git rm --cached <path>
37+
```
38+
39+
Then confirm the path stays ignored locally.
40+
41+
## Gate Mapping
42+
43+
| Gate | Role |
44+
|---|---|
45+
| G-04 | proves ignore boundaries are enforced in the index |
46+
| G-03 | complements developer-only screening |
47+
48+
Read: `regulation/reference/TRACKED_FILE_SCREENING.md`

regulation/shelf/OUTPUT_PATHS.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ Replace `<slug>` with the audited repository slug (`adop`, `veil`, etc.):
1717
| Artifact | Path |
1818
|---|---|
1919
| audit report | `audits/<slug>/audit-report.md` |
20+
| delta audit record | `audits/<slug>/delta-audit-record.md` |
2021
| publication decision record | `audits/<slug>/publication-decision-record.md` |
2122
| Tier 2 defer record | `audits/<slug>/tier2-defer-record.md` |
2223
| accepted risk record | `audits/<slug>/accepted-risk-record.md` |

regulation/shelf/SHELF_CHANGELOG.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,21 @@
22

33
All notable changes to the generic regulation shelf.
44

5+
## 1.1.6 — 2026-06-17
6+
7+
### Added
8+
9+
- gitignore consistency checker (`git ls-files -ci --exclude-standard`)
10+
- delta re-audit orchestrator and `delta-audit-record.md.template`
11+
12+
### Changed
13+
14+
- evidence bundle includes gitignore consistency screening
15+
16+
### Fixed
17+
18+
- delta orchestrator: Windows name-status parse, Open Blockers count parse
19+
520
## 1.1.5 — 2026-06-17
621

722
### Added

regulation/shelf/SHELF_VERSION.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Status: Active
55
## Current
66

77
```text
8-
1.1.5
8+
1.1.6
99
```
1010

1111
## Meaning

scripts/README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ Output is designed to paste into `templates/audit-report.md.template`.
1818
| `validate-regulation-index.sh` | Linux/macOS bash — shelf self-check |
1919
| `check-tracked-files.ps1` | Windows PowerShell — unnecessary tracked-file scan |
2020
| `check-tracked-files.sh` | Linux/macOS bash — unnecessary tracked-file scan |
21+
| `check-gitignore-consistency.ps1` | Windows PowerShell — `.gitignore` vs index consistency |
22+
| `check-gitignore-consistency.sh` | Linux/macOS bash — `.gitignore` vs index consistency |
23+
| `run-delta-audit.ps1` | Windows PowerShell — delta re-audit orchestrator |
24+
| `run-delta-audit.sh` | Linux/macOS bash — delta re-audit orchestrator |
2125
| `collect-audit-evidence.ps1` | Windows PowerShell |
2226
| `collect-audit-evidence.sh` | Linux/macOS bash |
2327
| `run-audit-quickstart.ps1` | Windows PowerShell |
@@ -51,6 +55,7 @@ Output is designed to paste into `templates/audit-report.md.template`.
5155

5256
- `git ls-files` count
5357
- tracked-file screening for developer-only, internal-management, cache, and misplaced audit paths
58+
- gitignore consistency (`git ls-files -ci --exclude-standard`)
5459
- HEAD and describe
5560
- root/github file presence
5661
- latest CI run summary when `gh` is available
Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
param(
2+
[Parameter(Mandatory = $true)]
3+
[string]$RepoPath
4+
)
5+
6+
$ErrorActionPreference = "Stop"
7+
$RepoPath = (Resolve-Path -LiteralPath $RepoPath).Path
8+
Push-Location $RepoPath
9+
10+
$findings = New-Object System.Collections.Generic.List[object]
11+
12+
function Add-Finding {
13+
param(
14+
[string]$Path,
15+
[string]$Category,
16+
[string]$Severity,
17+
[string]$Reason
18+
)
19+
$script:findings.Add([pscustomobject]@{
20+
Path = $Path
21+
Category = $Category
22+
Severity = $Severity
23+
Reason = $Reason
24+
}) | Out-Null
25+
}
26+
27+
$recommended = @(
28+
"__pycache__/",
29+
"*.pyc",
30+
".pytest_cache/",
31+
".env",
32+
"AGENTS.md",
33+
"CLAUDE.md",
34+
".claudeignore"
35+
)
36+
37+
$gitignorePath = Join-Path $RepoPath ".gitignore"
38+
$gitignoreText = ""
39+
if (Test-Path $gitignorePath) {
40+
$gitignoreText = Get-Content $gitignorePath -Raw
41+
} else {
42+
Add-Finding ".gitignore" "missing-file" "review" "No root .gitignore file"
43+
}
44+
45+
foreach ($pattern in $recommended) {
46+
$escaped = [regex]::Escape($pattern)
47+
if ($gitignoreText -and ($gitignoreText -notmatch $escaped)) {
48+
Add-Finding $pattern "missing-recommended-rule" "review" "Recommended public-prep ignore rule not present in .gitignore"
49+
}
50+
}
51+
52+
$ignoredTracked = @(git ls-files -ci --exclude-standard 2>$null)
53+
foreach ($rel in $ignoredTracked) {
54+
if (-not $rel) { continue }
55+
$rule = (git check-ignore -v $rel 2>$null | Select-Object -First 1)
56+
Add-Finding $rel "tracked-but-ignored" "blocked" "Tracked file matches ignore rule: $rule"
57+
}
58+
59+
Write-Output "=== Gitignore Consistency ==="
60+
Write-Output "Repository: $RepoPath"
61+
Write-Output "Tracked files: $((git ls-files | Measure-Object).Count)"
62+
63+
$blocked = @($findings | Where-Object { $_.Severity -eq "blocked" })
64+
$review = @($findings | Where-Object { $_.Severity -eq "review" })
65+
66+
if ($findings.Count -eq 0) {
67+
Write-Output "Findings: none"
68+
Write-Output "result: PASS"
69+
Pop-Location
70+
exit 0
71+
}
72+
73+
Write-Output "Findings: $($findings.Count) (blocked: $($blocked.Count), review: $($review.Count))"
74+
foreach ($item in $findings) {
75+
Write-Output "[$($item.Severity)/$($item.Category)] $($item.Path)$($item.Reason)"
76+
}
77+
78+
if ($blocked.Count -gt 0) {
79+
Write-Output "result: BLOCKED"
80+
Pop-Location
81+
exit 1
82+
}
83+
84+
Write-Output "result: PASS_WITH_REVIEW"
85+
Pop-Location
86+
exit 0

0 commit comments

Comments
 (0)