Checks (i) and (j) decided what counts as "shipped content" from a hardcoded
list of local-only file names (REMEMBER.md, TODO.md, NEXT-SESSION-PROMPT.local.md).
That list was written before the STATE.md convention replaced those three, so
STATE.md fell through it and was scanned as if it shipped. It does not: it is
gitignored and has zero tracked entries.
The resulting false positive was self-reproducing. Any STATE.md note explaining
why the check was red had to name the banned token, which made the check red.
Removing the offending line closed nothing; the next session that documented
the finding recreated it.
Two fixes were considered:
(a) add STATE.md to the exclude list. One name, but the list stays a name
list -- it rots again the next time a local-only file is renamed, which
is precisely how this defect arrived.
(b) derive the scope from git. No gitignored file can reopen the hole,
whatever it is called.
(b) is implemented, via `git check-ignore` rather than `git ls-files`. Both
answer "is this shipped", but ls-files also drops untracked Markdown that is
NOT ignored -- new content on its way into the plugin, which is exactly when a
leak check should be looking. check-ignore keeps that in scope and excludes
only what git ignores. When git cannot answer (no repo, no binary) every file
is treated as shipped, so the checks fail loudly instead of passing on an
empty file list.
Verified both directions, denominators reported:
known-positive: a real shipped reference/*.md carrying the banned token
-> FAIL, exit 1 (proves the check can still fire)
known-negative: STATE.md, gitignored, carrying the same token
-> not flagged
check (j) known-positive: shipped .md with Norwegian diacritics -> WARN
scope: 22 shipped Markdown files of 31 on disk (9 gitignored: STATE.md +
8 under .claude/)
validate-plugin.sh: Pass 16 / Fail 0 / Warn 0, exit 0 (was 14 / 1 / 23, exit 1)
verify.sh roll-up: Pass 41 / Fail 0 / Warn 1, exit 0
Both re-run under /bin/bash 3.2.57 as well as bash 5.3.
The 23 warnings that disappeared were all STATE.md diacritics; they were never
shipped content, and check (j) carried the same name-list defect that (i) did.
Closes ORDRE 64.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ToLVakwASPe3pXsdEiothC
Kjell Tore Guttormsen
3696b8e283