Commit yarn 4 in the tree and install with --immutable (closes #149)

Follows sneak's ruling at
#149 (comment). This
repository now carries yarn 4.18.1 under .yarn/releases. The
distribution's yarn only starts that file, and that file does the work.
yarn.lock is converted once, and script/bootstrap installs with
--immutable instead of stopping on yarn's major version. Node is the
distribution's newest Node package: nodejs-current on Alpine and
nodejs_latest on nix. Every Dockerfile stage that needs yarn also copies
.yarnrc.yml and .yarn/releases/. The policies and both checklists say
so, with the steps for converting and for a new repository.

Model: opus-5-5

.dockerignore

@@ -76,7 +76,3 @@
 **/.idea
 **/.vscode
 **/*.sublime-*
-
-# This repository's own entries, such as its build outputs, go below
-# this comment, and a re-vendor keeps them. Anchor a binary built at the
-# root: `/myapp`, never `**/myapp`, which also matches `cmd/myapp/`.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks update-policy
+.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks
 
 # Makefile targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -30,6 +30,3 @@ docker:
 
 hooks:
 	@script/install-precommit
-
-update-policy:
-	@script/update-policy

README.md

@@ -141,9 +141,6 @@ alpine. We provide:
   `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own
   extension); `make hooks` shims to it
-- `script/update-policy` — fetch the vendored policy files from this repo,
-  commit them and push (our own extension); it is for the repos that vendor them
-  and stops when run here
 
 `make hooks` installs the pre-commit hook that runs `script/precommit`.
 

TODO.md

@@ -21,22 +21,6 @@ fmt-check, and commit.
 
 # Completed Steps
 
-- 2026-11-09: `script/update-policy` and `make update-policy` update a repo's
-  vendored policy files with one command
-  (https://git.eeqj.de/sneak/prompts/issues/162). They fetch the files from
-  `prompts`, keep the repo's own entries, commit and push. The canonical
-  `.dockerignore` now ends with the comment that the repo's own entries go
-  below. The template repositories get the script in their own issues.
-- 2026-11-07: Go code is now formatted with `gofmt` and then `golines -m 77`
-  (https://git.eeqj.de/sneak/prompts/issues/160). `prompts/REPO_POLICIES.md`
-  says how `script/fmt`, `script/fmt-check` and `script/bootstrap` do it and
-  pins `golines`. The Go style guide and both checklists say the same. `lll`
-  stays at 88, since `golines` leaves long strings and comments as they are.
-- 2026-11-06: The pinning rule in `prompts/REPO_POLICIES.md` now opens with its
-  scope: what we download and install ourselves in scripts and Dockerfiles
-  (https://git.eeqj.de/sneak/prompts/issues/154). Distribution packages are
-  outside the rule, and updating and upgrading them is allowed. Both checklists
-  say the same.
 - 2026-11-04: Each repository now commits yarn 4 and installs with
   `yarn install --immutable` (https://git.eeqj.de/sneak/prompts/issues/149), on
   sneak's ruling at

prompts/CODE_STYLEGUIDE_GO.md

@@ -1,16 +1,13 @@
 ---
 title: Code Styleguide — Go
-last_modified: 2026-11-07
+last_modified: 2026-10-18
 ---
 
-1.  Format Go code with `gofmt` and then `golines -m 77`, through `make fmt`.
-    Don't commit anything `make fmt` would change. The only exception is when
-    committing things that aren't yet syntactically valid, which should only
-    happen pre-v0.0.1 or on a non-`main` branch.
+1.  Try to hard wrap long lines at 77 characters or less.
 
-1.  Hard wrap long lines at 77 characters or less. `golines` does this for code.
-    Wrap comments and long string literals by hand, since `golines` leaves them
-    as they are.
+1.  Don't commit anything that hasn't been `go fmt`'d. The only exception is
+    when committing things that aren't yet syntactically valid, which should
+    only happen pre-v0.0.1 or on a non-`main` branch.
 
 1.  Even if you are planning to deal with only positive integers, use
     `int`/`int64` types instead of `uint`/`uint64` types. This is for

prompts/EXISTING_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-11-09
+last_modified: 2026-11-04
 ---
 
 Use this checklist when beginning work in a repo that may not yet conform to our
@@ -205,17 +205,12 @@ with your task.
 - [ ] `Makefile` exists in root — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`
 - [ ] Has targets: `test`, `lint`, `fmt`, `fmt-check`, `check`, `docker`,
-      `hooks`, `update-policy`
+      `hooks`
 - [ ] Target implementations live in `script/` (scripts-to-rule-them-all);
       Makefile targets are thin shims calling them — model scripts at
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`
 - [ ] `script/precommit` exists and the pre-commit hook (installed by
       `script/install-precommit`, shimmed by `make hooks`) runs it
-- [ ] `script/update-policy` exists, identical to the model script, and
-      `make update-policy` shims to it. Before its first use, the repo's own
-      entries in `.gitignore`, `.editorconfig` and `.dockerignore` go below the
-      comment that ends each canonical file. Entries above that comment are
-      replaced.
 - [ ] README has an **Entrypoints** section documenting the `script/`
       entrypoints and linking the standard
 - [ ] `script/lint` and `script/test` each run
@@ -264,27 +259,22 @@ with your task.
 
 # Formatting
 
-- [ ] Platform-standard formatter is configured (`black`, `prettier`, and for Go
-      `gofmt` then `golines -m 77`)
-- [ ] Default formatter config, except four-space indents (not Go),
-      `proseWrap: always` for Markdown, and the Go 77-column limit
-- [ ] Go: `script/bootstrap` installs `golines` with `go install` pinned to a
-      commit hash; `script/fmt-check` fails when `gofmt` or `golines -m 77`
-      would change a file
+- [ ] Platform-standard formatter is configured (`black`, `prettier`, `go fmt`)
+- [ ] Default formatter config, only exception: four-space indents (except Go)
 - [ ] All files pass `make fmt-check`
 
 # Git Hygiene
 
 - [ ] Pre-commit hook is installed (`make hooks`)
 - [ ] No secrets in the repo (`.env`, keys, credentials)
-- [ ] No mutable references (tags, `@latest`) to what the repo downloads and
-      installs itself in scripts and Dockerfiles — all pinned by cryptographic
-      hash with version/date comment. Distribution packages are outside this
-      rule. They need no version and no hash, and updating and upgrading them is
-      fine too. In a `Dockerfile`, the distribution is the pinned base image's.
-      On a host, it is the host's, and the host's package manager stands for it,
-      nix and brew included. A package source that a `Dockerfile` adds itself is
-      not the distribution's own, so its packages are pinned
+- [ ] No mutable references in Dockerfiles or scripts (tags, `@latest`) — all
+      pinned by cryptographic hash with version/date comment. The one exception
+      is a package from the distribution's own package index, which needs no
+      version and no hash. Pulling that index is also allowed. In a
+      `Dockerfile`, the distribution is the pinned base image's. On a host, it
+      is the host's, and the host's package manager stands for it, nix and brew
+      included. A package source that a `Dockerfile` adds itself does not get
+      this exception
 - [ ] node, yarn, npm, python, pip and venv come from the distribution wherever
       possible, never from nvm, pyenv, corepack or `npm install -g yarn`. If the
       distribution's version is too old, use a newer distribution. node means

prompts/NEW_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-11-09
+last_modified: 2026-11-04
 ---
 
 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -62,8 +62,6 @@ Template files can be fetched from:
       `CLAUDE.md` or `.claude/`, and never separate memory files
 - [ ] `Dockerfile` and `.dockerignore` — fetch `.dockerignore` from
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore`
-    - The repo's own entries go at the end of the file, where a re-vendor keeps
-      them.
     - Extend `.dockerignore` with the repo's own host-built artifacts, giving
       every depth-independent pattern a `**/` prefix — but write a repo-root
       binary anchored, `/myapp` and never `**/myapp`, which would also match
@@ -235,11 +233,9 @@ are thin shims calling them. Model scripts:
       which writes no image. No lint verdict may come from a host invocation of
       the linter.
 - [ ] `script/fmt` / `make fmt` — formats code (writes; native, never in a
-      container). Go code gets `gofmt`, then `golines -m 77`.
+      container)
 - [ ] `script/fmt-check` / `make fmt-check` — checks formatting (read-only;
-      native). Fails when `gofmt` or `golines -m 77` would change a Go file.
-- [ ] Go: `script/bootstrap` installs `golines` with `go install` pinned to a
-      commit hash
+      native)
 - [ ] `script/check` / `make check` — runs `test`, `lint`, `fmt-check`; must not
       modify files
 - [ ] `script/projectname` — outputs the project name (used by `script/docker`
@@ -266,9 +262,6 @@ are thin shims calling them. Model scripts:
 - [ ] `script/install-precommit` — installs the pre-commit hook that runs
       `script/precommit`
 - [ ] `make hooks` — shims to `script/install-precommit`
-- [ ] `script/update-policy` / `make update-policy` — fetches the vendored
-      policy files from the `prompts` repo, commits them and pushes; identical
-      across repos
 - [ ] README **Entrypoints** section documents the scripts and links the
       standard
 
@@ -292,13 +285,12 @@ are thin shims calling them. Model scripts:
       final stage is missing its `COPY --from=` edge to the gate phases.
 - [ ] No secrets in repo, and none in the build context: enumerate a probe image
       rather than reading `.dockerignore`
-- [ ] No mutable references to what the repo downloads and installs itself in
-      scripts and Dockerfiles. Distribution packages are outside this rule. They
-      need no version and no hash, and updating and upgrading them is fine too.
-      In a `Dockerfile`, the distribution is the pinned base image's. On a host,
-      it is the host's, and the host's package manager stands for it, nix and
-      brew included. A package source that a `Dockerfile` adds itself is not the
-      distribution's own, so its packages are pinned
+- [ ] No mutable image/package references. The one exception is a package from
+      the distribution's own package index, which needs no version and no hash.
+      Pulling that index is also allowed. In a `Dockerfile`, the distribution is
+      the pinned base image's. On a host, it is the host's, and the host's
+      package manager stands for it, nix and brew included. A package source
+      that a `Dockerfile` adds itself does not get this exception
 - [ ] node, yarn, npm, python, pip and venv come from the distribution wherever
       possible, never from nvm, pyenv, corepack or `npm install -g yarn`. If the
       distribution's version is too old, use a newer distribution. node means

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-11-09
+last_modified: 2026-11-04
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -21,28 +21,13 @@ style conventions are in separate documents:
   with the authoritative source as policies evolve.
 
 - **External references must be pinned by cryptographic hash.** This is the
-  single most important rule in this document. It covers what we download and
-  install ourselves in scripts and Dockerfiles:
+  single most important rule in this document. It covers everything fetched from
+  a remote source, including:
     - Docker base images
     - Go modules
-    - Python packages from PyPI
+    - Python packages
     - npm packages
     - GitHub Actions
-    - release archives fetched with `curl` or `wget`
-
-    Packages from the distribution's own package manager are outside this rule.
-    They need no version and no hash, because the distribution is trusted. In a
-    `Dockerfile`, it is the pinned base image's distribution. On a host, it is
-    the host's. The host's package manager stands for its distribution, and that
-    includes nix and brew. Updating the package index and upgrading installed
-    packages are fine too. This command, for example, is allowed:
-
-    ```sh
-    apt update && apt upgrade -y && apt install -y build-essential
-    ```
-
-    A package source that a `Dockerfile` adds itself is not the distribution's
-    own, so its packages are pinned like any other download.
 
     A version tag such as `@v4`, `@latest` or `:3.21` is server-mutable, and
     therefore a remote code execution vulnerability. Reference an external
@@ -59,6 +44,17 @@ style conventions are in separate documents:
     Unverified install scripts are arbitrary remote code execution. Double-check
     every external reference in every file before committing.
 
+    There is one exception: a package from the distribution's own package index
+    needs no version and no hash. Pulling that index is also allowed. The
+    distribution is trusted. In a `Dockerfile`, it is the pinned base image's
+    distribution. On a host, it is the host's. The host's package manager stands
+    for its distribution, and that includes nix and brew. These commands are
+    examples:
+    - `apt-get update`
+    - `apt-get install`
+    - `apk update`
+    - `apk add`
+
     These come from the distribution wherever possible:
     - node, meaning the distribution's newest Node package, such as
       `nodejs-current` on Alpine 3.24
@@ -83,6 +79,9 @@ style conventions are in separate documents:
     - the npm registry
     - `go get`
 
+    A package source that a `Dockerfile` adds itself is not the distribution's
+    own, so the exception does not cover it.
+
 - Every repo with software must have a root `Makefile` with these targets:
     - `make bootstrap`
     - `make setup`
@@ -109,7 +108,6 @@ style conventions are in separate documents:
     - `script/fmt-check`
     - `script/check`
     - `script/docker`
-    - `script/update-policy`
 
     The scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they
     run in minimal containers; alpine images, for example, have no bash. Locate
@@ -201,15 +199,14 @@ style conventions are in separate documents:
     README must document the provided scripts in an **Entrypoints** section (see
     the README requirements below).
 
-- Run the repo's own entrypoints, never the underlying tools directly. The
-  `script/` scripts are the single source of truth for how each operation runs.
-  Calling them directly is fine, and so is calling the Makefile targets. The
-  Makefile targets must still exist, as the thin shims described above.
+- Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
+  instead of invoking the underlying tools directly. The Makefile is the single
+  source of truth for how these operations are run.
 
     An agent whose work is confined to one package may run `go test` directly on
     that package's suite, or on individual tests in it, while iterating. This is
     the only exception to this rule. `go build`, `go vet` and the linter still
-    go through the entrypoints. A run while iterating is not a gate, so the full
+    go through make targets. A run while iterating is not a gate, so the full
     `make check` is still required before every push.
 
 - The Makefile is authoritative documentation for how the repo is used. Beyond
@@ -676,31 +673,11 @@ style conventions are in separate documents:
 - Use platform-standard formatters:
     - `black` for Python
     - `prettier` for JS/CSS/Markdown/HTML
-    - `gofmt`, then `golines -m 77`, for Go
+    - `go fmt` for Go
 
-    Always use default configuration, with three exceptions:
+    Always use default configuration, with two exceptions:
     - four-space indents (except Go)
     - `proseWrap: always` for Markdown (hard-wrap at 80 columns)
-    - a 77-column limit for Go, set by `golines -m 77`
-
-    `script/fmt` runs `gofmt` and then `golines -m 77` on Go code.
-    `script/fmt-check` fails when either of them would change a file. `golines`
-    comes from `github.com/segmentio/golines`. `script/bootstrap` installs it
-    with `go install`, pinned to a commit hash as below:
-
-    ```sh
-    # golines v0.13.0, 2025-08-21
-    go install github.com/segmentio/golines@8f32f0f7e89c30f572c7f2cd3b2a48016b9d8bbf
-    ```
-
-    `script/bootstrap` reads the installed version from the `mod` line of
-    `go version -m "$(command -v golines)"`, which reports `v0.13.0`. It does
-    not use `golines --version`, which prints `golines vdev` for a binary that
-    `go install` built.
-
-    `golines` cannot shorten every line: long string literals and comments stay
-    as they are. golangci-lint's `lll` limit therefore stays at 88 columns, so
-    it fails only lines far past the formatter's limit.
 
     Documentation and writing repos (Markdown, HTML, CSS) should also have
     `.prettierrc` and `.prettierignore`.
@@ -928,17 +905,6 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- A repo updates its policy files with one command: `make update-policy`. It
-  runs `script/update-policy`, which fetches each vendored file the repo carries
-  from the `prompts` repo, commits them and pushes. It uses the head of `main`,
-  or the commit given by a full hash: `script/update-policy <hash>`. The list of
-  vendored files is at the top of that script. The script replaces each file and
-  keeps only the repo's own entries:
-    - in `.gitignore`, `.editorconfig` and `.dockerignore`: the lines below the
-      comment that ends the canonical file
-    - in `.golangci.yml`: the entries the repo added to the `deny` list of the
-      `test-support` depguard rule
-
 - `.golangci.yml` is standardized. The vendored copy in a consuming repo must
   _NEVER_ be modified by an agent. Fetch it from
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
@@ -1164,7 +1130,7 @@ style conventions are in separate documents:
     - `Makefile`
     - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
       `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
-      `install-precommit`, `update-policy`)
+      `install-precommit`)
     - `Dockerfile`, `.dockerignore`
     - `.gitea/workflows/check.yml`
     - Go: `go.mod`, `go.sum`, `.golangci.yml`

script/update-policy

@@ -1,188 +0,0 @@
-#!/bin/sh
-# script/update-policy: replace this repo's vendored policy files with
-# the canonical ones from the prompts repo, commit them and push.
-# Identical in all repos. Our own extension to
-# scripts-to-rule-them-all.
-#
-# Usage: script/update-policy [full commit hash of prompts]
-# Without a hash it uses the head of the prompts main branch.
-#
-# The script writes nothing until every file has been fetched and
-# merged. A repo's own entries are kept:
-#   - .gitignore, .editorconfig, .dockerignore: the lines below the
-#     canonical file's last line
-#   - .golangci.yml: the entries the repo added to the deny list of the
-#     test-support rule
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-PROMPTS_URL="https://git.eeqj.de/sneak/prompts"
-
-# Paths in the prompts repo. A file this repo does not carry is skipped.
-VENDORED_FILES="
-.dockerignore
-.editorconfig
-.gitea/workflows/check.yml
-.gitignore
-.golangci.yml
-.prettierrc
-prompts/API_POLICIES.md
-prompts/CODE_STYLEGUIDE.md
-prompts/CODE_STYLEGUIDE_GO.md
-prompts/CODE_STYLEGUIDE_JS.md
-prompts/CODE_STYLEGUIDE_PYTHON.md
-prompts/EXISTING_REPO_CHECKLIST.md
-prompts/GO_HTTP_SERVER_CONVENTIONS.md
-prompts/LLM_PROSE_TELLS.md
-prompts/NEW_REPO_CHECKLIST.md
-prompts/REPO_POLICIES.md
-"
-
-die() {
-    echo "update-policy: $*" >&2
-    exit 1
-}
-
-# local_path <path in prompts>: print where this repo keeps the file, or
-# nothing if git does not track it here. A prompts/NAME.md lands at
-# docs/NAME.md or NAME.md.
-local_path() {
-    name="${1#prompts/}"
-    if [ "$name" != "$1" ] && [ -n "$(git ls-files -- "docs/$name")" ]; then
-        echo "docs/$name"
-    elif [ -n "$(git ls-files -- "$name")" ]; then
-        echo "$name"
-    fi
-}
-
-# keep_lines_below_last <fetched> <local>: append to the fetched file
-# whatever follows its last line in the local file.
-keep_lines_below_last() {
-    last="$(tail -n 1 "$1")"
-    number="$(grep -n -F -x -- "$last" "$2" | head -n 1 | cut -d: -f1)"
-    if [ -z "$last" ] || [ -z "$number" ]; then
-        die "$2 lacks this line; add it and put the repo's own entries below it: $last"
-    fi
-    tail -n "+$((number + 1))" "$2" >> "$1"
-}
-
-# keep_deny_entries <fetched> <local>: add to the deny list of the
-# test-support rule in the fetched file the entries only the local file
-# has. An entry is a "- pkg:" line, the lines under it and any comment
-# above it.
-keep_deny_entries() {
-    awk '
-        function indent(line) { return match(line, /[^ ]/) - 1 }
-        function print_local_entries(i) {
-            for (i = 1; i <= count; i++)
-                if (!(pkg[i] in fetched_pkg))
-                    printf "%s", entry[i]
-        }
-
-        FNR == 1 { in_rule = 0; in_list = 0 }
-
-        in_list && /[^ ]/ && indent($0) <= list_indent {
-            in_list = 0
-            if (FILENAME == ARGV[2]) print_local_entries()
-        }
-
-        in_list {
-            is_entry = ($1 == "-" && $2 == "pkg:")
-            if (FILENAME == ARGV[2]) {
-                if (is_entry) fetched_pkg[$3]
-                print
-            } else if (is_entry) {
-                count++
-                pkg[count] = $3
-                entry[count] = comment $0 "\n"
-                comment = ""
-            } else if (/^ *#/) {
-                comment = comment $0 "\n"
-            } else if (count) {
-                entry[count] = entry[count] $0 "\n"
-            }
-            next
-        }
-
-        /^ *test-support:/ { in_rule = 1 }
-        in_rule && /^ *deny:/ {
-            in_rule = 0
-            in_list = 1
-            list_indent = indent($0)
-            if (FILENAME == ARGV[2]) found = 1
-        }
-        FILENAME == ARGV[2] { print }
-
-        END {
-            if (in_list) print_local_entries()
-            exit !found
-        }
-    ' "$2" "$1" > "$1.merged" ||
-        die "the fetched $2 has no deny list in its test-support rule"
-    mv "$1.merged" "$1"
-}
-
-main() {
-    cd "$ROOT"
-
-    [ "$#" -le 1 ] || die "usage: script/update-policy [full commit hash]"
-
-    project="$(script/projectname)"
-    if [ "$project" = "prompts" ]; then
-        die "this repo is the source of the policy files"
-    fi
-
-    commit="${1:-}"
-    if [ -z "$commit" ]; then
-        head_line="$(git ls-remote "$PROMPTS_URL.git" refs/heads/main)"
-        commit="${head_line%%[[:space:]]*}"
-    fi
-    printf '%s\n' "$commit" | grep -Eqx '[0-9a-f]{40}' ||
-        die "not a full commit hash: '$commit'"
-
-    tmp="$(mktemp -d)"
-    trap 'rm -rf "$tmp"' EXIT
-
-    carried=""
-    for file in $VENDORED_FILES; do
-        path="$(local_path "$file")"
-        [ -n "$path" ] || continue
-        if [ -n "$(git status --porcelain -- "$path")" ]; then
-            die "$path has uncommitted changes"
-        fi
-        mkdir -p "$tmp/$(dirname "$path")"
-        curl --fail --silent --show-error --max-time 60 \
-            --output "$tmp/$path" \
-            "$PROMPTS_URL/raw/commit/$commit/$file" ||
-            die "cannot fetch $file at $commit"
-        carried="$carried $path"
-    done
-    [ -n "$carried" ] || die "this repo carries none of the vendored files"
-
-    for path in $carried; do
-        case "$path" in
-            .gitignore | .editorconfig | .dockerignore)
-                keep_lines_below_last "$tmp/$path" "$path"
-                ;;
-            .golangci.yml)
-                keep_deny_entries "$tmp/$path" "$path"
-                ;;
-        esac
-    done
-
-    for path in $carried; do
-        cp "$tmp/$path" "$path"
-        git add -- "$path"
-    done
-
-    if git diff --cached --quiet -- $carried; then
-        echo "update-policy: already at prompts $commit, nothing to commit"
-        exit 0
-    fi
-
-    git commit -m "Update policy files from prompts $commit" -- $carried
-    git push origin HEAD ||
-        die "push failed; the commit exists locally, so fix that and run git push"
-}
-
-main "$@"