use actual em-dashes in checklist examples

.dockerignore

@@ -1,97 +1,3 @@
-# Docker matches this file with moby/patternmatcher: Go filepath.Match
-# semantics plus a `**` extension, compiled to a regexp. Plain
-# filepath.Match has no `**` at all. What follows from that: `*` does not
-# cross `/`, and a pattern without a leading `**/` is anchored at the
-# build-context root. Every depth-independent pattern therefore needs the
-# `**/` prefix — without it `config/.env` and `certs/server.key` still
-# ship while the file reads as solved.
-#
-# Root-anchored entries are for paths that occur exactly once, at the
-# context root. A host-built binary is the usual case, and it must be
-# written anchored: `/myapp`, never `**/myapp`. The prefixed form also
-# matches `cmd/myapp/`, which deletes the package directory from the
-# context. In-repo agent scratch is the other case, for the same reason
-# — with the caveat recorded at that entry: anchoring is exact only
-# where agents run at the repo root, and a repo where they do not must
-# add its own entries.
-#
-# Matching is case-sensitive, so `**/*.key` does not match
-# `certs/SERVER.KEY`, which is reachable on the case-insensitive
-# filesystems most laptops use. Adding an ALL-CAPS twin per pattern is
-# not the fix: it still misses `Server.Key` while reading as though case
-# were handled. Character ranges cover every spelling in one line, so
-# every secret name below is written that way — including the
-# extensionless SSH keys and `.envrc`, because on those same
-# case-insensitive filesystems direnv reads `.ENVRC` and ssh reads
-# `ID_RSA`.
-#
-# `**/*.[eE][nN][vV]` also excludes a committed env template such as
-# `example.env`. If the build genuinely needs one, re-include it with a
-# negation after the pattern: `!docs/example.env`.
-#
-# Extend this file with the repo's own host-built artifacts (compiled
-# binaries, test binaries, coverage output); those are per-repo and
-# belong here because a host build otherwise drops them into the
-# context.
-
-# Repository metadata: exactly one, at the context root. Excluding it
-# means `git describe` cannot run in any build stage, and it fails
-# quietly there rather than erroring, so a version embedded that way
-# comes out empty. Compute the version on the host and pass it in with
-# `--build-arg VERSION=...`; see the version rule in REPO_POLICIES.md.
 .git
-
+node_modules
-# In-repo agent scratch: a directory holding a full additional checkout
+.DS_Store
-# of the repo for each in-flight agent. Anchored because it occurs
-# exactly once *where agents run at the repo root*, which is the
-# convention this file assumes; the `**/` form would also match any
-# nested directory of that name and delete it from the build.
-#
-# KNOWN GAP, and it is not hypothetical: the directory is created in the
-# agent's working directory. If agents in this repo run in
-# subdirectories — a monorepo with a per-service agent, say — then
-# `services/api/.claude/` is NOT excluded by the line below and still
-# reaches the build context and the image, which is the exposure this
-# entry exists to close. A repo in that shape adds its own anchored
-# entries (`/services/api/.claude`), or `**/.claude` after confirming no
-# legitimately named nested directory would be caught.
-#
-# Not case-folded, unlike the secret patterns below: tooling creates
-# this directory in exactly one spelling, so a folded pattern would add
-# no coverage.
-.claude
-
-# Environment files. `*.env` covers both the bare `.env` name (`*` matches
-# the empty string) and the `prod.env` convention.
-**/*.[eE][nN][vV]
-**/.[eE][nN][vV].*
-**/.[eE][nN][vV][rR][cC]
-
-# Private keys and the bundles that carry them. Public certificates
-# (*.crt, *.cer) are deliberately absent: they are not secrets and are
-# sometimes a legitimate build input.
-**/*.[pP][eE][mM]
-**/*.[kK][eE][yY]
-**/*.[pP]12
-**/*.[pP][fF][xX]
-**/[iI][dD]_[rR][sS][aA]
-**/[iI][dD]_[dD][sS][aA]
-**/[iI][dD]_[eE][cC][dD][sS][aA]
-**/[iI][dD]_[eE][dD]25519
-
-# Dependencies: restored inside the image, never copied in.
-**/node_modules
-
-# OS metadata.
-**/.DS_Store
-**/Thumbs.db
-
-# Editor state. Never a build input, and it churns under a developer's
-# hands, so it invalidates COPY for reasons unrelated to the source.
-**/*.swp
-**/*.swo
-**/*~
-**/*.bak
-**/.idea
-**/.vscode
-**/*.sublime-*

.gitea/workflows/check.yml

@@ -6,4 +6,4 @@ jobs:
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/cibuild
+            - run: docker build .

.gitignore

@@ -11,12 +11,6 @@ Thumbs.db
 .vscode/
 *.sublime-*
 
-# Agent scratch (worktrees of this repo, created and destroyed by
-# in-flight tooling). Unanchored: .gitignore patterns already match at
-# every depth, so no prefix is wanted here. This is not a .dockerignore
-# entry and must not be given a `**/` prefix on the way into one.
-.claude/
-
 # Node
 node_modules/
 

.golangci.yml

@@ -1,9 +1,5 @@
 version: "2"
 
-# Config schema uses the golangci-lint v2 layout (settings live under
-# linters.settings, not top-level linters-settings) so that the
-# thresholds below are actually applied by golangci-lint >= v2.
-
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -18,17 +14,19 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-  settings:
+
-    lll:
+linters-settings:
-      line-length: 88
+  lll:
-    funlen:
+    line-length: 88
-      lines: 80
+  funlen:
-      statements: 50
+    lines: 80
-    cyclop:
+    statements: 50
-      max-complexity: 15
+  cyclop:
-    dupl:
+    max-complexity: 15
-      threshold: 100
+  dupl:
+    threshold: 100
 
 issues:
+  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

Dockerfile

@@ -1,28 +1,11 @@
 # node 22-alpine, 2026-02-22
 FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34
 
+RUN apk add --no-cache make
+
 WORKDIR /app
-
-# script/bootstrap installs all prerequisites (make via apk here; node
-# and yarn are already in the base image, so those steps are skipped).
-# Dependency manifests are copied first so the bootstrap layer is
-# cached until they change.
-COPY script/ script/
 COPY package.json yarn.lock ./
-RUN script/bootstrap
+RUN yarn install --frozen-lockfile
-
 COPY . .
 
-# CHECK_EPOCH is a per-invocation nonce supplied by script/cibuild and
+RUN make check
-# script/docker. Without it an unchanged tree serves this layer from
-# cache and the build reports a green it never ran. ARG is stage-scoped,
-# so it must be redeclared in every stage that runs checks. The guard
-# makes a bare `docker build .` fail loudly instead of silently reusing
-# the empty (and therefore stable) cache key. Expand the value into the
-# command so the cache miss does not depend on BuildKit's handling of an
-# unreferenced ARG. Both the guard and the check RUN reference the value,
-# so both are value-keyed: there are two independent invalidation points
-# here, not one. Keep both.
-ARG CHECK_EPOCH
-RUN [ -n "$CHECK_EPOCH" ] || exit 1
-RUN echo "check epoch: ${CHECK_EPOCH}" && make check

Makefile

@@ -1,32 +1,31 @@
-.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks
+.PHONY: test lint fmt fmt-check check docker hooks
 
-# Makefile targets are thin shims; the implementations live in script/
+# flags are repeated here (also in .prettierrc) so this Makefile works
-# per the scripts-to-rule-them-all pattern (see the Entrypoints section
+# standalone when copied as a template
-# of README.md).
+PRETTIER := yarn run prettier
-
-bootstrap:
-	@script/bootstrap
-
-setup:
-	@script/setup
 
 test:
-	@script/test
+	@echo "No tests defined."
 
 lint:
-	@script/lint
+	@echo "Linting markdown files..."
+	@$(PRETTIER) --check '**/*.md' --tab-width 4 --prose-wrap always
 
 fmt:
-	@script/fmt
+	@$(PRETTIER) --write '**/*.md' --tab-width 4 --prose-wrap always
 
 fmt-check:
-	@script/fmt-check
+	@$(PRETTIER) --check '**/*.md' --tab-width 4 --prose-wrap always
 
-check:
+check: test lint fmt-check
-	@script/check
 
 docker:
-	@script/docker
+	docker build -t prompts .
 
 hooks:
-	@script/install-precommit
+	@printf '#!/bin/sh\nset -e\n' > .git/hooks/pre-commit
+	@if [ -f go.mod ]; then \
+		printf 'go mod tidy\ngo fmt ./...\ngit diff --exit-code -- go.mod go.sum || { echo "go mod tidy changed files; please stage and retry"; exit 1; }\n' >> .git/hooks/pre-commit; \
+	fi
+	@printf 'make check\n' >> .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit

README.md

@@ -102,41 +102,6 @@ cd prompts
 Prompts are stored as Markdown files in `prompts/`. Copy or reference them as
 needed in your projects.
 
-## Entrypoints
-
-This repository adheres to the
-[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-standard: normalized scripts in `script/` are the entrypoints for the
-development workflow, and the Makefile targets are thin shims that call them.
-The scripts are POSIX sh (not bash) so they run in minimal containers such as
-alpine. We provide:
-
-- `script/bootstrap` — install all dependencies (yarn install)
-- `script/setup` — set up the repo for development after a fresh clone: runs
-  `script/bootstrap`, then `script/install-precommit`
-- `script/projectname` — output the project name (our own extension); used by
-  `script/docker` for the image tag
-- `script/test` — run the test suite (no tests defined here)
-- `script/lint` — lint the markdown files with prettier
-- `script/fmt` — format all markdown files with prettier (writes)
-- `script/fmt-check` — check formatting (read-only)
-- `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own
-  extension)
-- `script/docker` — build the Docker image, tagged via `script/projectname`
-  (byte-identical across repos); passes the same `CHECK_EPOCH` nonce as
-  `script/cibuild`
-- `script/cibuild` — cd to the repo root, assign `epoch="$(date +%s%N)$$"`, then
-  `docker build --build-arg CHECK_EPOCH="$epoch" .` (what CI runs; the image
-  build runs `script/check`, and the per-invocation `CHECK_EPOCH` nonce is what
-  stops Docker serving that check from cache on an unchanged tree — a bare
-  `docker build .` fails closed on purpose)
-- `script/precommit` — run by the git pre-commit hook (our own extension); calls
-  `script/check`
-- `script/install-precommit` — installs the git pre-commit hook (our own
-  extension); `make hooks` shims to it
-
-`make hooks` installs the pre-commit hook that runs `script/precommit`.
-
 ## Rationale
 
 LLM prompts, especially development policies, benefit from version control and a

TODO.md

@@ -1,137 +0,0 @@
-# Workflow
-
-- branch (from `main`)
-- do the work in Next Step
-- move Next Step to the top of Completed Steps
-- move the top item of Future Steps into Next Step
-- commit (`TODO.md` changes in the same commit as the work)
-- merge to `main` if the branch is not protected, otherwise open a PR
-- push
-
-# Status
-
-pre-1.0
-
-# Next Step
-
-Finish the two draft prompt documents in the working tree and commit them:
-prompts/FIXUP_CLEAN.md (currently a near-empty stub) and prompts/FIXUP_REPORT.md
-(a rough draft). Write the missing content, run `make fmt` so they pass
-fmt-check, and commit.
-
-# Completed Steps
-
-- 2026-08-09: Made a golangci-lint result belong to the tree that asked for it.
-  REPO_POLICIES.md now carries the canonical Go `script/lint`, which gives the
-  linter per-checkout `GOLANGCI_LINT_CACHE` and per-checkout `TMPDIR`. The two
-  are separate defects and the second is the one that gets dropped: the result
-  cache is keyed on file content rather than location, so checkouts holding
-  identical files serve each other's findings under the other's path, while the
-  concurrency lock is `$TMPDIR/golangci-lint.lock` — host-global, independent of
-  the cache, and unaffected by isolating it. Moving workers from worktrees to
-  their own clones does not help either half; it only removes the foreign-path
-  artefact that made the defect visible. The lock error is retried rather than
-  surfaced, because it is not a result: it exits non-zero exactly as findings
-  do, and reporting it as findings sends a correct branch back for rework.
-  Detection is on the stderr stream and never on exit status, so a finding
-  quoting the lock message in source cannot be retried away, and exhaustion
-  exits 75 with a VOID message rather than passing or failing quietly.
-  `--allow-serial-runners` (which keeps the guard and queues) covers the
-  same-checkout overlap that `TMPDIR` scoping cannot; `--allow-parallel-runners`
-  is rejected outright. The stdout and stderr capture files are per invocation
-  rather than per checkout, because serialising the linter does not serialise
-  the shell's redirections: two runs in one checkout — the overlap the flag
-  exists to support — would otherwise truncate and read each other's output,
-  which is the same defect one layer above where it was fixed. Both checklists
-  gained the corresponding items, since a half-fix that sets only the cache
-  reads as complete. `GOCACHE` was measured and does not need isolating.
-  Verified with the snippet extracted from the committed document and executed
-  as a consuming repo would adopt it, against paired controls: contamination
-  reproduced on the pre-fix form and absent on the adopted one, retry engaged,
-  exhaustion loud, a genuine finding still reported, and a held host lock
-  failing the pre-fix script while leaving the adopted one untouched.
-- 2026-08-09: Kept in-repo agent scratch out of the Docker build context and out
-  of version control. `.claude/` holds one worktree — an entire additional
-  checkout of the repo — per in-flight agent, and under `COPY . .` all of it was
-  reaching the image: another session's unreviewed, sometimes uncommitted work,
-  inflating the context by a multiple of the repo and invalidating `COPY` for
-  reasons unrelated to the repo's own content. The `.dockerignore` entry is
-  root-anchored, because the directory occurs exactly once where agents run at
-  the repo root and the `**/` form additionally deletes any nested directory of
-  that name — with the residual gap that follows from anchoring (a monorepo
-  running agents in subdirectories still ships `services/api/.claude/`) stated
-  in the canonical `.dockerignore`, the policy and the existing-repo checklist,
-  since consuming repos receive the files rather than the tracker; the
-  `.gitignore` entry is unanchored, because `.gitignore` patterns already match
-  at every depth, and each file is written to its own semantics rather than
-  derived from the other. Also closed the consequence that ships broken
-  silently: excluding `.git` means `git describe` cannot run in any build stage
-  and yields an empty version without erroring, so `script/docker` and
-  `script/cibuild` now compute the version on the host and pass
-  `--build-arg VERSION`, and `REPO_POLICIES.md` states where `VERSION` comes
-  from instead of leaving the reader to fill the gap with `git describe` inside
-  the build. The two Go documents that carry the `GOLDFLAGS` pattern were
-  corrected in the same pass, from `:=` to `?=`, since a `$(shell git describe)`
-  evaluated inside a build stage is exactly the empty version this closes.
-  Verified by enumerating a probe image before, after, and against the
-  `**/`-prefixed form, with a positive control and the `CHECK_EPOCH` cache
-  verification re-run under the changed build context.
-- 2026-08-09: Closed the secret exposure in the canonical `.dockerignore`: a
-  developer's local `.env`, `*.pem` or `*.key` was reaching the Docker build
-  context under `COPY . .`, invisible to every git-based check because
-  `.gitignore` covers it. The patterns are written to `.dockerignore`'s own
-  `moby/patternmatcher` semantics — `**/`-prefixed so they hold at every depth,
-  which also fixes nested `node_modules` — rather than transplanted from
-  `.gitignore`, whose unprefixed form protects only the repository root while
-  reading as solved. Coverage extends past the `.env`/`.pem`/`.key` trio to the
-  `prod.env` convention, `.envrc`, PKCS#12 bundles and extensionless SSH keys,
-  every one of them case-folded with character ranges because matching is
-  case-sensitive and an ALL-CAPS twin per pattern still misses `Server.Key`.
-  `REPO_POLICIES.md` and both repo checklists now state that asymmetry and
-  require verification by enumerating the image rather than by reading the
-  patterns. Verified with a probe image before, against three naive forms
-  (unprefixed, lowercase-only, ALL-CAPS-doubled), and after.
-- 2026-08-09: Made the pinned golangci-lint actually propagate: REPO_POLICIES.md
-  now carries the canonical `script/bootstrap` snippet for Go repos, which
-  installs when the installed version does not match the pin (the old
-  `if missing` guard tested PATH presence only, so pins were inert on any
-  provisioned machine and CI silently disagreed with local) and then re-resolves
-  the binary through `PATH` and fails loudly, naming the shadowing path, when
-  the install did not take effect — the failure mode the naive
-  compare-then-install fix leaves behind while reporting success.
-- 2026-08-09: Fixed the false green in the canonical CI gate: `script/cibuild`
-  and `script/docker` now pass a per-invocation `CHECK_EPOCH` nonce, and the
-  `Dockerfile` (plus the Go multistage template in REPO_POLICIES.md, in both its
-  lint and builder stages) declares `ARG CHECK_EPOCH` with a guard that makes a
-  bare `docker build .` fail closed. Corrected the org-canonical text that
-  asserted a successful build implies all checks pass, across every document
-  carrying it: `REPO_POLICIES.md`, both repo checklists (which still told agents
-  to write the pre-fix `script/cibuild` and ended on an acceptance item the
-  guard makes unsatisfiable), and the Go styleguide.
-- 2026-08-07: Set the canonical `.golangci.yml` to the org-standard v2-schema
-  config already deployed byte-identical across the org's Go repos (settings
-  under `linters.settings` so thresholds like lll/funlen/cyclop/dupl actually
-  apply under golangci-lint v2). Recorded the canonical golangci-lint version
-  (v2.12.2, commit-pinned) in REPO_POLICIES.md.
-- 2026-03-20: Strengthened constructor naming and Params struct rules in the Go
-  styleguide.
-- 2026-03-18: Documented fail-fast Dockerfile lint stage and conditional -v test
-  rerun patterns in REPO_POLICIES.md.
-- 2026-03-11: Added HTTP service hardening policy for 1.0 releases.
-- 2026-03-10: Added policy: no build artifacts in repos.
-- 2026-03-04: Added LLM prose tells reference and copyediting checklist, then
-  several self-applied revision passes.
-- 2026-02-28: Expanded the pre-1.0 schema migration rule; added clawpub
-  reference.
-- 2026-02-23: Added Go style rules (no type-only packages, Stringer for
-  string-based types); template repos section in README.
-- 2026-02-22: Initial policy corpus: REPO_POLICIES.md, code styleguides
-  (general, Go, JS, Python), repo checklists, CI policy, hash pinning, Go HTTP
-  server conventions, repo scaffolding.
-
-# Future Steps
-
-- Finish, format, and commit FIXUP_CLEAN.md and FIXUP_REPORT.md (the Next Step).
-- Commit this TODO.md at the repo root; it is the last missing policy file.
-- Decide the fate of untracked resume.sh: commit it or delete it.
-- Add more prompt templates for common development tasks (from README TODO).

prompts/CODE_STYLEGUIDE_GO.md

@@ -1,6 +1,6 @@
 ---
 title: Code Styleguide — Go
-last_modified: 2026-08-09
+last_modified: 2026-02-22
 ---
 
 1.  Try to hard wrap long lines at 77 characters or less.
@@ -49,20 +49,7 @@ last_modified: 2026-08-09
     ```
 
     ```make
-    # ?= rather than := because this `$(shell git describe ...)` is only
+    VERSION := $(shell git describe --always --dirty)
-    # correct on the host. `.dockerignore` excludes `.git`, so evaluated
-    # inside a build stage it expands to the empty string without failing
-    # and the binary reports no version at all. The version is computed on
-    # the host by `script/docker` / `script/cibuild` and passed with
-    # `--build-arg VERSION=...`. If this repo's Dockerfile compiles by
-    # invoking make (`RUN make build`), `ARG VERSION` in that stage puts the
-    # value in the environment and `?=` defers to it. The canonical Go
-    # template in REPO_POLICIES.md instead runs `go build` directly with
-    # `-ldflags "... -X main.Version=${VERSION}"`, so there this Makefile is
-    # a host-only path — but it is still `?=`, because a repo that later
-    # moves the build behind make must not silently start shipping an empty
-    # version. See the git-describe rule in REPO_POLICIES.md.
-    VERSION ?= $(shell git describe --always --dirty)
     BUILDARCH := $(shell uname -m)
 
     GOLDFLAGS += -X main.Version=$(VERSION)
@@ -114,16 +101,9 @@ last_modified: 2026-08-09
     `golangci-lint`.
 
 1.  Write a `Dockerfile` for every repo, even if it only runs the tests and
-    linting. `script/cibuild` and `script/docker` should always make sure that
+    linting. `docker build .` should always make sure that the code is in an
-    the code is in an able-to-be-compiled state, linted, and any tests run, and
+    able-to-be-compiled state, linted, and any tests run. The Docker build
-    the build should fail if linting doesn't pass. That guarantee holds only
+    should fail if linting doesn't pass.
-    because those scripts pass a per-invocation `CHECK_EPOCH` build arg that
-    busts the check layers out of the Docker cache; without it an unchanged tree
-    serves those layers from cache and the build reports a green it never ran. A
-    bare `docker build .` fails closed by design, on the `[ -n "$CHECK_EPOCH" ]`
-    guard — always go through `script/cibuild` or `script/docker`. See
-    [Repository Policies](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md)
-    for the canonical form.
 
 1.  Every repo must have a `Makefile`. See
     [Repository Policies](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md)
@@ -156,15 +136,8 @@ last_modified: 2026-08-09
 1.  Provide a .gitignore file that ignores at least `*.log`, `*.out`, and
     `*.test` files, as well as any binaries.
 
-1.  Constructors **must** be called `New()`. `modulename.New()` works great if
+1.  Constructors should be called `New()` whenever possible. `modulename.New()`
-    you name the packages properly. If the constructor creates an instance from
+    works great if you name the packages properly.
-    an existing value or representation, `From<Something>()` (e.g.
-    `FromBytes()`, `FromConfig()`) is also acceptable. If the package contains
-    multiple types and `New()` is ambiguous, `NewThing()` is occasionally
-    acceptable — but prefer restructuring packages so each type gets its own
-    package and a plain `New()`. Do not invent creative constructor names like
-    `Create()`, `Make()`, `Build()`, `Open()` (unless wrapping an OS resource),
-    or `Init()`. If you see a constructor with a non-standard name, rename it.
 
 1.  Don't make packages too big. Break them up.
 
@@ -176,15 +149,9 @@ last_modified: 2026-08-09
 1.  Use descriptive names for modules and filenames. Avoid generic names like
     `server`. `util` is banned.
 
-1.  Constructors **must** take a `Params` struct (or `ThingParams` when
+1.  Constructors should take a Params struct if they need more than 1-2
-    `NewThing()` is used), even for a single argument. Named fields in a Params
+    arguments. Positional arguments are an endless source of bugs and should be
-    struct are always clearer than positional arguments. Positional arguments
+    avoided whenever possible.
-    for constructors are an endless source of bugs — they make call sites
-    unreadable, invite wrong-order errors that the compiler can't catch when
-    types coincide, and force every caller to update when a new field is added.
-    The only exception is when the single argument is stupidly obvious from
-    context — e.g. `featureflag.New(true)` or `thing.NewFromReader(r)`. When in
-    doubt, use a Params struct.
 
 1.  Use `context.Context` for all functions that need it. If you don't need it,
     you can pass `context.Background()`. Anything long-running should get and

prompts/EXISTING_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-08-09
+last_modified: 2026-02-22
 ---
 
 Use this checklist when beginning work in a repo that may not yet conform to our
@@ -24,57 +24,15 @@ with your task.
 - [ ] `LICENSE` file exists and matches the README
 - [ ] `REPO_POLICIES.md` exists and version date is current — fetch from
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md`
-- [ ] `.gitignore` is comprehensive (OS, editor, agent scratch, language
+- [ ] `.gitignore` is comprehensive (OS, editor, language artifacts, secrets) —
-      artifacts, secrets) — fetch from
+      fetch from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore`
-      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` if missing.
+      if missing
-      An existing repo usually has a hand-written one that is never re-fetched,
-      so check the entries rather than the file's presence: `.claude/` in
-      particular, unanchored, so agent worktrees cannot be committed by
-      accident. Do not give it a `**/` prefix — that is a `.dockerignore` form
-      and is wrong here.
 - [ ] `.editorconfig` exists — fetch from
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig`
-- [ ] `Dockerfile` and `.dockerignore` exist (fetch `.dockerignore` from
+- [ ] `Dockerfile` and `.dockerignore` exist; Dockerfile runs `make check` as a
-      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore`);
+      build step — fetch `.dockerignore` from
-      Dockerfile runs `make check` as a build step, and every stage containing a
+      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore`
-      check-running `RUN` declares `ARG CHECK_EPOCH` with the
+- [ ] Gitea Actions workflow in `.gitea/workflows/` runs `docker build .` on
-      `RUN [ -n "$CHECK_EPOCH" ] || exit 1` guard immediately below it — see the
-      `CHECK_EPOCH` rule in `REPO_POLICIES.md`. Without them the check layer is
-      served from cache on an unchanged tree and the build reports a green it
-      never ran.
-- [ ] `.dockerignore` excludes the repo's own host-built artifacts (compiled
-      binaries, test binaries, coverage output), written root-anchored —
-      `/myapp`, never `**/myapp`, which would also match `cmd/myapp/`. An
-      existing repo is where such a binary is likeliest to already be sitting in
-      the build context, invisible to git.
-- [ ] `.dockerignore` excludes `.claude`, root-anchored and with no `**/`
-      prefix. Agent worktrees are entire checkouts of the repo, so they inflate
-      the context by a multiple of it and can copy another session's unreviewed
-      work into an image layer. Confirm by enumerating the image, not by reading
-      the file — `.gitignore` hides these from `git status` too.
-- [ ] **Do agents in this repo run anywhere other than the repo root?** The
-      scratch directory is created in the agent's working directory, so the
-      canonical anchored entry misses `services/api/.claude/` in a monorepo with
-      a per-service agent — it still reaches the build context and the image. An
-      existing repo is where such a layout already exists, so check it here
-      rather than assuming the canonical entry covers you: add anchored entries
-      for the subdirectories that have one (`/services/api/.claude`), or
-      `**/.claude` once you have confirmed no legitimately named nested
-      directory would be caught.
-- [ ] If the repo embeds a version in a binary, that version is computed on the
-      host and passed with `--build-arg VERSION=...` by `script/docker` and
-      `script/cibuild`. No stage calls `git describe`: `.dockerignore` excludes
-      `.git`, so it yields an empty version without failing the build. A
-      tag-derived version additionally needs `fetch-depth: 0` on the CI checkout
-      step, which clones shallow and fetches no tags by default.
-- [ ] Every depth-independent pattern in `.dockerignore` carries a `**/` prefix;
-      only genuinely root-anchored entries such as `.git` are unprefixed, and
-      `.gitignore`'s patterns have not been transplanted unmodified.
-      `.dockerignore` anchors an unprefixed pattern at the context root, so the
-      transplanted form leaves `config/.env` and `certs/server.key` in the build
-      context while reading as solved — see the `.dockerignore` rule in
-      `REPO_POLICIES.md`.
-- [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
       push — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific config:
@@ -87,26 +45,12 @@ with your task.
     - [ ] Python: `pyproject.toml`
     - [ ] Docs/writing: `.prettierrc`, `.prettierignore` (same URLs as above)
 
-# Makefile and script/ Entrypoints
+# Makefile
 
 - [ ] `Makefile` exists in root — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`
 - [ ] Has targets: `test`, `lint`, `fmt`, `fmt-check`, `check`, `docker`,
       `hooks`
-- [ ] Target implementations live in `script/` (scripts-to-rule-them-all);
-      Makefile targets are thin shims calling them — model scripts at
-      `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`
-- [ ] `script/precommit` exists and the pre-commit hook (installed by
-      `script/install-precommit`, shimmed by `make hooks`) runs it
-- [ ] README has an **Entrypoints** section documenting the `script/`
-      entrypoints and linking the standard
-- [ ] Go: `script/lint` isolates golangci-lint per checkout —
-      `GOLANGCI_LINT_CACHE` and `TMPDIR` both exported into `.lint-cache/`
-      (which is in `.gitignore` and `.dockerignore`), `--allow-serial-runners`
-      passed, and the lock error retried rather than reported as findings. Copy
-      the canonical block from `REPO_POLICIES.md`. Setting only the cache is the
-      common half-fix and leaves `parallel golangci-lint is running` failing
-      runs red.
 - [ ] `make check` does not modify any files in the repo
 - [ ] `make test` has a 30-second timeout
 - [ ] `make test` runs real tests, not a no-op (at minimum, import/compile
@@ -134,25 +78,8 @@ with your task.
       `internal/`, `static/`, etc.)
 - [ ] Go migrations in `internal/db/migrations/` and embedded in binary
 
-# HTTP Service Hardening (if targeting 1.0 and the repo is an HTTP/web service)
-
-- [ ] Security headers set on all responses (HSTS, CSP, X-Frame-Options,
-      X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
-- [ ] Request body size limits enforced on all endpoints
-- [ ] Read/write/idle timeouts configured on the HTTP server (slowloris defense)
-- [ ] Per-handler execution time limits in place
-- [ ] Password-based auth endpoints are rate-limited
-- [ ] CSRF tokens on all state-mutating HTML forms
-- [ ] Passwords hashed with bcrypt, scrypt, or argon2
-- [ ] Session cookies use HttpOnly, Secure, and SameSite attributes
-- [ ] True client IP correctly detected behind reverse proxy (trusted proxy
-      allowlist configured)
-- [ ] CORS restricted to explicit origin allowlist for authenticated endpoints
-- [ ] Error responses do not leak stack traces, SQL queries, or internal paths
-
 # Final
 
 - [ ] `make check` passes
-- [ ] `script/cibuild` succeeds (a bare `docker build .` fails closed by design,
+- [ ] `docker build` succeeds
-      on the `CHECK_EPOCH` guard)
 - [ ] Commit and merge fixes before starting your actual task

prompts/GO_HTTP_SERVER_CONVENTIONS.md

@@ -1,6 +1,6 @@
 ---
 title: Go HTTP Server Conventions
-last_modified: 2026-08-09
+last_modified: 2026-02-22
 ---
 
 This document defines the architectural patterns, design decisions, and
@@ -991,14 +991,7 @@ func main() {
 Use ldflags to inject version information at build time:
 
 ```makefile
-# ?= rather than := because this `$(shell git describe ...)` is only correct
+VERSION := $(shell git describe --tags --always)
-# on the host: `.dockerignore` excludes `.git`, so evaluated inside a build
-# stage it expands to the empty string without failing and the binary reports
-# no version. The version is computed on the host by `script/docker` /
-# `script/cibuild` and passed with `--build-arg VERSION=...`; where the build
-# stage invokes make, `ARG VERSION` puts it in the environment and `?=` defers
-# to it. See the git-describe rule in REPO_POLICIES.md.
-VERSION ?= $(shell git describe --tags --always)
 BUILDARCH := $(shell go env GOARCH)
 
 build:

prompts/LLM_PROSE_TELLS.md

@@ -1,6 +1,7 @@
 # LLM Prose Tells
 
-A catalog of patterns found in LLM-generated prose.
+A catalog of structural, lexical, and rhetorical patterns found in LLM-generated
+prose.
 
 ---
 
@@ -17,7 +18,7 @@ A negation followed by an em-dash and a reframe.
 
 Even outside the "not X but Y" pivot, models substitute em-dashes for commas,
 semicolons, parentheses, colons, and periods. The em-dash can replace any other
-punctuation mark, so models default to it.
+punctuation mark, and models default to it for that reason.
 
 ### The Colon Elaboration
 
@@ -78,7 +79,8 @@ zero information. The actual point is always in the next paragraph.
 
 > "This is, of course, a simplification." "There are, to be fair, exceptions."
 
-Parenthetical asides inserted to perform nuance without changing the argument.
+Parenthetical asides inserted to perform nuance without ever changing the
+argument.
 
 ### The Unnecessary Contrast
 
@@ -125,10 +127,10 @@ precedent), "navigate," "foster," "underscores," "resonates," "embark,"
 
 ### Elevated Register Drift
 
-Models write one register above where a human would, replacing "use" with
+Models write one register above where a human would. "Use" becomes "utilize."
-"utilize," "start" with "commence," "help" with "facilitate," "show" with
+"Start" becomes "commence." "Help" becomes "facilitate." "Show" becomes
-"demonstrate," "try" with "endeavor," "change" with "transform," and "make" with
+"demonstrate." "Try" becomes "endeavor." "Change" becomes "transform." "Make"
-"craft."
+becomes "craft."
 
 ### Filler Adverbs
 
@@ -441,6 +443,12 @@ roughly like this:
 >
 > **model:** _(rewrites entire document without em-dashes while describing
 > em-dash overuse)_
+>
+> **human:** this whole document seems to be making the case for FREQUENCY of
+> use being important. we don't care about frequency, remove all that
+> persuasion.
+>
+> **model:** _(strips out every "humans do this too but less often" comparison)_
 
 The human compared this process to the deleted scene in Terminator 2 where John
 Connor switches the T-800's CPU to learning mode. The model compared it to a

prompts/NEW_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-08-09
+last_modified: 2026-02-22
 ---
 
 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -35,11 +35,7 @@ Template files can be fetched from:
 
 - [ ] `.gitignore` — fetch from
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore`, extend for
-      language-specific artifacts. Extensions are written to `.gitignore`'s own
+      language-specific artifacts
-      semantics, where an unanchored pattern already matches at every depth:
-      never add a `**/` prefix here, which is a `.dockerignore` form. The
-      canonical file already carries `.claude/` so agent worktrees cannot be
-      committed by accident.
 - [ ] `.editorconfig` — fetch from
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig`
 - [ ] `Makefile` — fetch from
@@ -56,34 +52,12 @@ Template files can be fetched from:
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md`
 - [ ] `Dockerfile` and `.dockerignore` — fetch `.dockerignore` from
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore`
-    - Extend `.dockerignore` with the repo's own host-built artifacts, giving
+    - All Dockerfiles must run `make check` as a build step
-      every depth-independent pattern a `**/` prefix — but write a repo-root
-      binary anchored, `/myapp` and never `**/myapp`, which would also match
-      `cmd/myapp/` and delete the package directory. Do not transplant
-      `.gitignore`'s patterns: `.dockerignore` anchors an unprefixed pattern at
-      the context root, so the copied form leaves `config/.env` in the build
-      context while reading as solved. See the `.dockerignore` rule in
-      `REPO_POLICIES.md`. The canonical file's `.claude` entry is anchored for
-      the same reason as a repo-root binary; leave it that way, but note it only
-      covers agents running at the repo root — if this repo will run them in
-      subdirectories, `services/api/.claude/` is not excluded and needs its own
-      anchored entry.
-    - If the image embeds a version in a binary, the version is computed on the
-      host and passed with `--build-arg VERSION=...`. `ARG VERSION=dev` is
-      declared in the stage that compiles, and **no stage calls `git describe`**
-      — `.dockerignore` excludes `.git`, so it yields an empty version without
-      failing the build.
-    - All Dockerfiles must run `make check` as a build step, and every stage
-      containing a check-running `RUN` must declare `ARG CHECK_EPOCH` with the
-      `RUN [ -n "$CHECK_EPOCH" ] || exit 1` guard immediately below it — see the
-      `CHECK_EPOCH` rule in `REPO_POLICIES.md`. Without them the check layer is
-      served from cache on an unchanged tree and the build reports a green it
-      never ran.
     - Server: also builds and runs the application
     - Non-server: brings up dev environment and runs `make check`
     - Image pinned by sha256 hash with version/date comment
 - [ ] Gitea Actions workflow at `.gitea/workflows/check.yml` that runs
-      `script/cibuild` on push — reference
+      `docker build .` on push — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific:
     - [ ] Go: `go mod init sneak.berlin/go/<name>`, `.golangci.yml` (fetch from
@@ -91,72 +65,15 @@ Template files can be fetched from:
     - [ ] JS: `yarn init`, `yarn add --dev prettier`
     - [ ] Python: `pyproject.toml`
 
-## Configure script/ Entrypoints and Makefile
+## Configure Makefile
 
-Implementations live in `script/` (scripts-to-rule-them-all); Makefile targets
+- [ ] `make test` — runs real tests, not a no-op (30-second timeout)
-are thin shims calling them. Model scripts:
+- [ ] `make lint` — runs linter
-`https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`
+- [ ] `make fmt` — formats code (writes)
-
+- [ ] `make fmt-check` — checks formatting (read-only)
-- [ ] scripts are POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run on
+- [ ] `make check` — prereqs: `test`, `lint`, `fmt-check`; must not modify files
-      alpine images without bash
+- [ ] `make docker` — builds Docker image
-- [ ] `script/bootstrap` / `make bootstrap` — installs all dependencies,
+- [ ] `make hooks` — installs pre-commit hook
-      idempotently, assuming nothing (pkg manager detection nix/apt/brew/apk;
-      node used if present, else pinned version via nvm from a hash-verified
-      archive; pinned yarn via corepack); Dockerfile runs it instead of inline
-      installs
-- [ ] `script/setup` / `make setup` — readies a fresh clone: runs `bootstrap`,
-      then `install-precommit`, plus repo-specific init
-- [ ] `script/test` / `make test` — runs real tests, not a no-op (30-second
-      timeout)
-- [ ] `script/lint` / `make lint` — runs linter
-    - [ ] Go: exports `GOLANGCI_LINT_CACHE` **and** `TMPDIR` into a
-          `.lint-cache/` directory inside the checkout, above any
-          container-versus-host branch so every path that reaches the linter
-          gets them; passes `--allow-serial-runners` (never
-          `--allow-parallel-runners`); retries on
-          `parallel golangci-lint is running` detected on **stderr** and exits
-          75 with a VOID message on exhaustion. Copy the canonical block from
-          `REPO_POLICIES.md` rather than writing your own: a version that sets
-          only the cache leaves the false-red half live, and one that detects
-          the collision by exit status can retry a real finding away.
-    - [ ] Go: `.lint-cache/` is in both `.gitignore` and `.dockerignore`
-- [ ] `script/fmt` / `make fmt` — formats code (writes)
-- [ ] `script/fmt-check` / `make fmt-check` — checks formatting (read-only)
-- [ ] `script/check` / `make check` — runs `test`, `lint`, `fmt-check`; must not
-      modify files
-- [ ] `script/projectname` — outputs the project name (used by `script/docker`
-      for the image tag)
-- [ ] `script/docker` / `make docker` — builds Docker image, tagged via
-      `script/projectname` (byte-identical across repos); carries the same three
-      version lines as `script/cibuild` below, and passes
-      `--build-arg CHECK_EPOCH="$epoch"` and `--build-arg VERSION="$version"`
-- [ ] `script/cibuild` — cd to repo root, then, each on its own line:
-
-    ```sh
-    epoch="$(date +%s%N)$$"
-    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
-    [ -n "$version" ] || version="unknown"
-    docker build \
-        --build-arg CHECK_EPOCH="$epoch" \
-        --build-arg VERSION="$version" \
-        .
-    ```
-
-    (what CI runs). Both build args are mandatory, and both assignments must be
-    on their own line: a failing command substitution inside an argument does
-    not trip `set -e`, so the inline form degrades silently to an empty
-    constant. The `[ -n "$version" ]` line is a live check that fires on an
-    export with no `.git` and on a repo with no commits — keep it, and do not
-    collapse it into `|| echo unknown`, which makes it unreachable. See the
-    `CHECK_EPOCH` and git-describe rules in `REPO_POLICIES.md` for why each
-    element is load-bearing. A bare `docker build .` fails closed by design.
-
-- [ ] `script/precommit` — called by the pre-commit hook; runs `script/check`
-- [ ] `script/install-precommit` — installs the pre-commit hook that runs
-      `script/precommit`
-- [ ] `make hooks` — shims to `script/install-precommit`
-- [ ] README **Entrypoints** section documents the scripts and links the
-      standard
 
 # 4. Verify
 

script/bootstrap

@@ -1,136 +0,0 @@
-#!/bin/sh
-# script/bootstrap: install all dependencies needed to build and develop
-# this repo. Idempotent: every install is guarded by a check so already
-# installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes nothing is present. Node is
-# used directly if installed; otherwise it is installed at a pinned
-# version via nvm (installing nvm itself first, from a hash-verified
-# release archive, never curl | sh).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Pinned versions, 2026-07-06
-NODE_VERSION="22.17.0"
-NVM_VERSION="0.40.3"
-# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
-NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
-YARN_VERSION="1.22.22"
-
-PKGMGR=""
-SUDO=""
-
-detect_pkgmgr() {
-    [ -n "$PKGMGR" ] && return 0
-    if command -v nix-env >/dev/null 2>&1; then
-        PKGMGR="nix"
-    elif command -v apt-get >/dev/null 2>&1; then
-        PKGMGR="apt"
-    elif command -v brew >/dev/null 2>&1; then
-        PKGMGR="brew"
-    elif command -v apk >/dev/null 2>&1; then
-        PKGMGR="apk"
-    else
-        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
-        exit 1
-    fi
-    if [ "$PKGMGR" = "apt" ]; then
-        export DEBIAN_FRONTEND=noninteractive
-        if [ "$(id -u)" != "0" ]; then
-            SUDO="sudo"
-        fi
-    fi
-}
-
-# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
-pkg_install() {
-    detect_pkgmgr
-    case "$PKGMGR" in
-        nix) nix-env -iA "nixpkgs.$1" ;;
-        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
-        brew) brew install "$3" ;;
-        apk) apk add --no-cache "$4" ;;
-    esac
-}
-
-missing() {
-    ! command -v "$1" >/dev/null 2>&1
-}
-
-# verify_sha256 <file> <expected-hash>
-verify_sha256() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        actual="$(sha256sum "$1" | cut -d' ' -f1)"
-    else
-        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
-    fi
-    if [ "$actual" != "$2" ]; then
-        echo "bootstrap: sha256 mismatch for $1" >&2
-        echo "  expected: $2" >&2
-        echo "  actual:   $actual" >&2
-        exit 1
-    fi
-}
-
-# nvm is a bash script; run a command in a bash with nvm loaded
-nvm_sh() {
-    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
-}
-
-ensure_nvm() {
-    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
-    # nvm prerequisites; nvm itself requires bash
-    if missing bash; then pkg_install bash bash bash bash; fi
-    if missing curl; then pkg_install curl curl curl curl; fi
-    if missing git; then pkg_install git git git git; fi
-    tmp="$(mktemp -d)"
-    curl -fsSL -o "$tmp/nvm.tar.gz" \
-        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
-    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
-    mkdir -p "$HOME/.nvm"
-    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
-    rm -rf "$tmp"
-}
-
-ensure_node() {
-    if ! missing node; then return 0; fi
-    ensure_nvm
-    nvm_sh "nvm install $NODE_VERSION"
-}
-
-ensure_yarn() {
-    if ! missing yarn; then return 0; fi
-    if ! missing corepack; then
-        corepack enable
-        corepack prepare "yarn@$YARN_VERSION" --activate
-    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
-            corepack prepare yarn@$YARN_VERSION --activate"
-    else
-        npm install -g "yarn@$YARN_VERSION"
-    fi
-}
-
-install_js_deps() {
-    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
-            yarn install --frozen-lockfile"
-    else
-        yarn install --frozen-lockfile
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    if missing make; then pkg_install gnumake make make make; fi
-    if missing git; then pkg_install git git git git; fi
-
-    ensure_node
-    ensure_yarn
-    install_js_deps
-
-    echo "bootstrap complete"
-}
-
-main "$@"

script/check

@@ -1,14 +0,0 @@
-#!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/lint"
-    "$SCRIPT_DIR/fmt-check"
-}
-
-main "$@"

script/cibuild

@@ -1,33 +0,0 @@
-#!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile runs script/check, but
-# that only proves anything because CHECK_EPOCH is a fresh nonce on every
-# invocation: without it Docker serves the check layer from cache on an
-# unchanged tree and the build exits 0 without running the suite.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    # Assign on its own line: a failing command substitution inside an
-    # argument does not trip `set -e`, which would silently degrade the
-    # nonce to an empty constant. `$$` is required because busybox `date`
-    # drops %N without erroring.
-    epoch="$(date +%s%N)$$"
-    # VERSION must be computed here, on the host: .dockerignore excludes
-    # .git, so `git describe` cannot run in any build stage and fails
-    # quietly there rather than erroring. Same own-line discipline as the
-    # epoch. `|| true` keeps a failing describe from tripping `set -e`
-    # and leaves the value empty; the guard below is then the single
-    # place the fallback is applied, and it does fire — on an export with
-    # no .git, or a repo with no commits yet. `unknown` is visibly wrong
-    # in a binary in a way that an empty version is not.
-    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
-    [ -n "$version" ] || version="unknown"
-    docker build \
-        --build-arg CHECK_EPOCH="$epoch" \
-        --build-arg VERSION="$version" \
-        .
-}
-
-main "$@"

script/docker

@@ -1,35 +0,0 @@
-#!/bin/sh
-# script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname. The
-# Dockerfile's checks only actually run because CHECK_EPOCH is a fresh
-# nonce on every invocation; without it a warm cache turns this into a
-# green that proves nothing.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    # Assign on its own line: a failing command substitution inside an
-    # argument does not trip `set -e`, which would silently degrade the
-    # nonce to an empty constant. `$$` is required because busybox `date`
-    # drops %N without erroring.
-    epoch="$(date +%s%N)$$"
-    # VERSION must be computed here, on the host: .dockerignore excludes
-    # .git, so `git describe` cannot run in any build stage and fails
-    # quietly there rather than erroring. Same own-line discipline as the
-    # epoch. `|| true` keeps a failing describe from tripping `set -e`
-    # and leaves the value empty; the guard below is then the single
-    # place the fallback is applied, and it does fire — on an export with
-    # no .git, or a repo with no commits yet. `unknown` is visibly wrong
-    # in a binary in a way that an empty version is not.
-    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
-    [ -n "$version" ] || version="unknown"
-    docker build \
-        --build-arg CHECK_EPOCH="$epoch" \
-        --build-arg VERSION="$version" \
-        -t "$("$SCRIPT_DIR/projectname")" .
-}
-
-main "$@"

script/fmt

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/fmt: format all files (writes).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    yarn run prettier --write '**/*.md' --tab-width 4 --prose-wrap always
-}
-
-main "$@"

script/fmt-check

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/fmt-check: check formatting (read-only).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
-}
-
-main "$@"

script/install-precommit

@@ -1,16 +0,0 @@
-#!/bin/sh
-# script/install-precommit: install the git pre-commit hook that runs
-# script/precommit. Our own extension to scripts-to-rule-them-all.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    hook=".git/hooks/pre-commit"
-    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
-    chmod +x .git/hooks/pre-commit
-    echo "pre-commit hook installed: runs script/precommit"
-}
-
-main "$@"

script/lint

@@ -1,13 +0,0 @@
-#!/bin/sh
-# script/lint: run the linter.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    echo "Linting markdown files..."
-    yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
-}
-
-main "$@"

script/precommit

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/precommit: run by the git pre-commit hook; fails the commit if
-# checks fail. Our own extension to scripts-to-rule-them-all.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/check"
-}
-
-main "$@"

script/projectname

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/projectname: output the name of this project. Our own
-# extension to scripts-to-rule-them-all. Other scripts that need the
-# name (e.g. script/docker) call this, so they can stay identical
-# across all repos.
-set -eu
-
-main() {
-    echo "prompts"
-}
-
-main "$@"

script/setup

@@ -1,13 +0,0 @@
-#!/bin/sh
-# script/setup: set up the repo for development after a fresh clone:
-# installs dependencies and the git pre-commit hook.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/bootstrap"
-    "$SCRIPT_DIR/install-precommit"
-}
-
-main "$@"

script/test

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/test: run the test suite.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    echo "No tests defined."
-}
-
-main "$@"