Merge TODO.md with git's union merge (closes #98 )

Every PR adds an entry at the top of Completed Steps in TODO.md, so each merge to next left every other open PR conflicting there. A root .gitattributes now marks TODO.md merge=union: when two branches insert at the same place, git keeps the lines of both instead of reporting a conflict. The cost is that a real conflict elsewhere in TODO.md is no longer reported either; both versions of the line are kept. This applies to this repository only; nothing canonical changes. Model: opus-5-5
2026-10-04 09:33:13 +00:00
16 changed files with 80 additions and 290 deletions
@@ -18,16 +18,9 @@
 # does not need .git/config; that file can hold a credential, such as a
 # password in a remote URL or the token the CI checkout step stores there.
 # Each submodule keeps a config with the same exposure in its git directory
-# under .git/modules/, nested again for a submodule's own submodules, or in
-# its own .git directory when it keeps one.
-# KNOWN GAP: a submodule whose name has a `config` segment (`config`,
-# `deploy/config`, `config/lib`) loses its whole git directory, because
-# `**/.git/modules/**/config` also matches that segment's directory
-# under .git/modules/. Go's version stamping then fails the build;
-# nothing leaks. Name such a submodule without that segment:
-# `git submodule add --name`.
-**/.git/config
-**/.git/modules/**/config
+# under .git/modules/, nested again for a submodule's own submodules.
+.git/config
+.git/modules/**/config

 # Agent scratch: one full checkout of the repo per in-flight agent.
 # Anchored because it occurs once where agents run at the repo root.
@@ -10,9 +10,3 @@ insert_final_newline = true

 [Makefile]
 indent_style = tab
-
-[*.go]
-indent_style = tab
-
-# This repository's own sections, such as one for another language it
-# uses, go below this comment, and a re-vendor keeps them.
@@ -1,4 +1,2 @@
-# Every PR adds an entry at the top of TODO.md's Completed Steps; union keeps
-# both sides instead of conflicting. Git never reports a conflict here: read
-# the merged entries after every merge or rebase.
+# Every PR adds an entry at the top of Completed Steps; union keeps both sides.
 TODO.md merge=union
@@ -1,18 +1,9 @@
 name: check
 on: [push]
-# Free the shared runner: a new push cancels only the same branch's older run.
-concurrency:
-    group: ${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: true
 jobs:
    check:
        runs-on: ubuntu-latest
        steps:
            # actions/checkout v4.2.2, 2026-02-22
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-              # script/cibuild needs no token, so none is left in .git/config.
-              with:
-                  persist-credentials: false
-                  # All history and tags, so git describe finds the version tag.
-                  fetch-depth: 0
            - run: script/cibuild
@@ -27,7 +27,7 @@ node_modules/
 # Environment files. `*.env` covers bare `.env` and the `prod.env`
 # convention. Only the templates `example.env` and `sample.env` are
 # re-included below. A repository that commits any other template adds
-# its own negation at the end of this file, for example `!.env.example`.
+# its own negation after these lines, for example `!.env.example`.
 *.[eE][nN][vV]
 .[eE][nN][vV].*
 .[eE][nN][vV][rR][cC]
@@ -45,7 +45,3 @@ node_modules/
 [iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
 [iI][dD]_[eE][dD]25519
 [iI][dD]_[eE][dD]25519_[sS][kK]
-
-# This repository's own entries, such as its build outputs, go below
-# this comment, and a re-vendor keeps them. Anchor a binary built at the
-# root: `/myapp`, never `myapp`, which also ignores `cmd/myapp/`.
@@ -25,8 +25,6 @@ linters:
    # silenced by disabling that name, not by enabling the successor.
    - wsl              # Deprecated, replaced by wsl_v5
    - gomodguard       # Deprecated, replaced by gomodguard_v2
-    # Misses findings at random in v2.14.0; back once a pinned release fixes it
-    - canonicalheader
  settings:
    lll:
      line-length: 88
@@ -21,90 +21,12 @@ fmt-check, and commit.

 # Completed Steps

- 2026-10-06: The canonical `.gitea/workflows/check.yml` now sets
-  `fetch-depth: 0` on its checkout step (issue 110), so CI fetches the history
-  and tags that `git describe --tags --always` needs, and a tagged repository
-  stamps the same version in CI as in a local build. `REPO_POLICIES.md` and both
-  checklists name `fetch-depth: 0` among what the workflow does, next to
-  `persist-credentials: false` and the `concurrency` block, instead of asking
-  each tagged repository to add it. Not yet tried on the shared runner, which is
-  out of disk space. Repositories pick this up on their next re-vendor.
- 2026-10-06: The canonical `script/bootstrap` now runs `apt-get update` once,
-  before the first `apt-get install` of a run (issue 115). The Gitea runner
-  image starts with empty package lists, so installing anything it lacks, such
-  as Go, failed with `Unable to locate package`. A repository's own section no
-  longer needs a refresh of its own; `sneak/bsfirehose` and `sneak/dnswatcher`
-  drop theirs at their next re-vendor.
- 2026-10-06: `REPO_POLICIES.md` and both checklists now say that a checkout
-  whose `.git` is a file, a linked worktree or a repository checked out as a
-  submodule, is the exception to a plain `docker build .` succeeding (issue
-  111): that file points to a git directory outside the build context, so the
-  build cannot read the version and the version check in the canonical
-  `Dockerfile` stops it. Such a build is given its version with
-  `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already do.
-  The check itself is unchanged.
- 2026-10-06: The canonical `.gitea/workflows/check.yml` now has a `concurrency`
-  block, so a new push cancels the older run on the same branch and no other,
-  and its checkout step sets `persist-credentials: false`, so the job's token is
-  not left in `.git/config` (issue 107). `REPO_POLICIES.md` and both checklists
-  describe the workflow as it now is. Not yet tried on the shared runner, which
-  is out of disk space. Repositories pick this up on their next re-vendor.
- 2026-10-06: The canonical `.golangci.yml` now disables `canonicalheader`
-  (issue 105). In golangci-lint v2.14.0 it misses findings at random in a
-  package that also calls `ResponseWriter.Header()`, so the same tree can fail
-  lint on one run and pass on the next. It comes back once a pinned
-  golangci-lint release fixes it.
- 2026-10-06: The canonical `.gitignore` and `.editorconfig` now each end with a
-  comment saying the repository's own entries go below it and a re-vendor keeps
-  them (issue 103, which took in issue 104), as `.dockerignore`'s header already
-  does. `.editorconfig` gains a `[*.go]` section with tabs, since `gofmt`
-  decides Go indentation everywhere. `REPO_POLICIES.md` and both checklists say
-  that each of these two files is the canonical content followed by the
-  repository's own entries, which a re-vendor keeps, and the Go styleguide puts
-  `*.log`, `*.out`, `*.test` and binaries among those entries. Common outputs
-  stay out of the canonical `.gitignore`; each repository lists its own.
- 2026-10-05: `script/cibuild`, `script/docker`, `script/lint` and `script/test`
-  now assign the image tag from `script/projectname` on its own line before the
-  `docker build` (issue 101), so `set -e` stops the script where
-  `script/projectname` fails instead of running `docker build` with a broken
-  tag. The comment above it in each script says why, and the snippets in
-  `REPO_POLICIES.md` show the same form. Repositories pick this up on their next
-  re-vendor.
- 2026-10-04: Went through the fleet findings recorded on 2026-08-09 (issue 62)
-  and added the two rules `REPO_POLICIES.md` did not yet state: a new or changed
-  check is proven by planting a defect it must catch; and a change to a separate
-  workflow limited to `main` is first run from the feature branch, added to that
-  workflow's `branches` list and removed again before merging. The other
-  findings were already stated, replaced by `--no-cache`, about git worktrees,
-  or about how agents work together. The warning against
-  `golangci-lint config verify` is dropped because sneak ruled on
-  https://git.eeqj.de/sneak/prompts/issues/40 (2026-08-10) that there is no
-  config check step and the config is assumed valid; a vendored `.golangci.yml`
-  stays byte-identical to the canonical copy. The issue gives each reason.
- 2026-10-04: `REPO_POLICIES.md` now says which `Dockerfile` stages run
-  `script/bootstrap` (issue 90). The gate phases and the build stage start from
-  their pinned base images and install what those images lack either inline, as
-  the canonical Go `Dockerfile` does for `git`, or by running
-  `script/bootstrap`, as this repo's own `Dockerfile` does for its yarn
-  packages. The development environment stage, the final stage of a non-server
-  repo, runs `script/bootstrap`. The new repo checklist says the same.
 - 2026-10-04: Added a root `.gitattributes` that merges `TODO.md` with git's
  union merge (issue 98), so two branches that each add an entry at the top of
-  Completed Steps merge without a conflict. Git now never reports a conflict in
-  `TODO.md`: a real conflict elsewhere keeps both versions of the line, and when
-  two new entries share an identical line, one is inserted into the middle of
-  the other, which a rebase can do to an entry already on `next`. Read the
-  merged entries after every merge or rebase. This applies to this repository
-  only; no canonical file changed.
- 2026-10-04: The canonical `.dockerignore` now also keeps out the git `config`
-  of a submodule that keeps its own `.git` directory, which still reached the
-  image (issue 88): both git patterns now carry the `**/` prefix. A submodule
-  whose name has a `config` segment (`config`, `deploy/config`, `config/lib`)
-  still loses its whole git directory, so Go's version stamping fails the build;
-  the file records this as a `KNOWN GAP:` with the remedy,
-  `git submodule add --name`. Closing it would take a wildcard re-include, which
-  makes BuildKit walk every excluded directory, such as `node_modules`, on every
-  build. `REPO_POLICIES.md` and both checklists say so in the same words.
+  Completed Steps merge with both entries kept instead of conflicting. The cost
+  is that a real conflict elsewhere in `TODO.md` is no longer reported: both
+  versions of the line are kept. It applies to this repository only; nothing
+  canonical changed.
 - 2026-10-04: The note under the canonical Go `Dockerfile` example in
  `REPO_POLICIES.md` now installs lint-phase system libraries with `apt-get`
  under their Debian package names (issue 83). The `golangci/golangci-lint`
@@ -1,6 +1,6 @@
 ---
 title: Code Styleguide — Go
-last_modified: 2026-10-06
+last_modified: 2026-10-04
 ---

 1.  Try to hard wrap long lines at 77 characters or less.
@@ -148,9 +148,8 @@ last_modified: 2026-10-06
    handle HTTP requests. Don't use methods or your top level functions as
    handlers.

-1.  The repository's own entries at the end of `.gitignore`, which a re-vendor
-    keeps, ignore at least `*.log`, `*.out`, and `*.test` files, as well as any
-    binaries.
+1.  Provide a .gitignore file that ignores at least `*.log`, `*.out`, and
+    `*.test` files, as well as any binaries.

 1.  Constructors **must** be called `New()`. `modulename.New()` works great if
    you name the packages properly. If the constructor creates an instance from
@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-10-06
+last_modified: 2026-10-04
 ---

 Use this checklist when beginning work in a repo that may not yet conform to our
@@ -28,18 +28,13 @@ with your task.
      root — never a file or directory named after one agent tool, such as
      `CLAUDE.md` or `.claude/`, and never separate memory files. Move what any
      such committed file says into `AGENTS.md` and delete it.
- [ ] `.gitignore` is comprehensive (OS, editor, agent scratch, secrets, the
-      repo's own build outputs) — fetch from
+- [ ] `.gitignore` is comprehensive (OS, editor, agent scratch, language
+      artifacts, secrets) — fetch from
      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` if missing.
      An existing repo usually has a hand-written one that is never re-fetched,
-      so check the entries rather than the file's presence. The file is the
-      canonical content followed by the repo's own entries, such as its
-      binaries; a re-vendor replaces the canonical part and keeps those entries.
+      so check the entries rather than the file's presence.
 - [ ] `.editorconfig` exists — fetch from
-      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig`. The
-      file is the canonical content followed by the repo's own sections, such as
-      one for another language it uses; a re-vendor replaces the canonical part
-      and keeps those sections.
+      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig`
 - [ ] `Dockerfile` and `.dockerignore` exist; the Dockerfile carries a `lint`
      phase and a `test` phase, and the final stage carries a `COPY --from=` of
      a harmless file from each — fetch `.dockerignore` from
@@ -68,15 +63,10 @@ with your task.
      here run anywhere other than the repo root, the anchored entry misses
      `services/api/.claude/`: add anchored entries for those directories.
 - [ ] If the repo embeds a version in a binary: `.dockerignore` lets `.git` into
-      the build context. It keeps out every git `config` at any depth
-      (`**/.git/config`, `**/.git/modules/**/config`): the repository's own,
-      each submodule's under `.git/modules/`, and that of a submodule keeping
-      its own `.git` directory. `git describe` does not need them, and each can
-      hold a credential: a password in a remote URL, or the token the CI
-      checkout step stores there. A submodule whose name has a `config` segment
-      (`config`, `deploy/config`, `config/lib`) loses its whole git directory to
-      `**/.git/modules/**/config`, and Go's version stamping then fails the
-      build: give it a name without that segment (`git submodule add --name`).
+      the build context. It keeps out `.git/config` and each submodule's
+      `config` under `.git/modules/` at any depth (`.git/modules/**/config`),
+      which `git describe` does not need and which can hold a credential: a
+      password in a remote URL, or the token the CI checkout step stores there.
      The stage that compiles has `git` (the Debian Go image has it; an alpine
      one needs `apk add --no-cache git`) and takes the version from the
      `VERSION` build argument when one is given, otherwise from
@@ -91,20 +81,12 @@ with your task.
      version still comes out empty, `dev` or `unknown`. A plain
      `docker build .` with no build arguments must succeed; a Dockerfile that
      refuses an empty build argument drops that refusal and keeps the argument.
-      A checkout whose `.git` is a file (a linked worktree, or a repository
-      checked out as a submodule) is the exception: that file points to a git
-      directory outside the build context, so the build cannot read the version
-      and a plain `docker build .` fails; pass the version with
-      `--build-arg VERSION=...`. `script/docker` and `script/cibuild` already
-      pass the version they compute on the host; it takes precedence. The
-      canonical `.gitea/workflows/check.yml` sets `fetch-depth: 0` on its
-      checkout step, which otherwise clones shallow and fetches no tags, so a CI
-      build finds the tag too.
+      `script/docker` and `script/cibuild` pass the version they compute on the
+      host; it takes precedence. A tag-derived version additionally needs
+      `fetch-depth: 0` on the CI checkout step, which clones shallow and fetches
+      no tags by default.
 - [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
-      push, checks out with `persist-credentials: false` and with
-      `fetch-depth: 0` (which fetches the tags `git describe` needs), and
-      carries the `concurrency` block that lets a new push cancel only the same
-      branch's older run — reference
+      push — reference
      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific config:
    - [ ] Go: `go.mod`, `go.sum`, `.golangci.yml` (fetch from
@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-10-06
+last_modified: 2026-10-04
 ---

 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -34,17 +34,14 @@ Template files can be fetched from:
 ## Fetch Template Files

 - [ ] `.gitignore` — fetch from
-      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore`, then add
-      the repo's own build outputs, such as its binaries, at the end of the
-      file, where a re-vendor keeps them. Extensions are written to
-      `.gitignore`'s own semantics, where an unanchored pattern already matches
-      at every depth: never add a `**/` prefix here, which is a `.dockerignore`
-      form. The canonical file already carries `.claude/` so agent worktrees
-      cannot be committed by accident.
+      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore`, extend for
+      language-specific artifacts. Extensions are written to `.gitignore`'s own
+      semantics, where an unanchored pattern already matches at every depth:
+      never add a `**/` prefix here, which is a `.dockerignore` form. The
+      canonical file already carries `.claude/` so agent worktrees cannot be
+      committed by accident.
 - [ ] `.editorconfig` — fetch from
-      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig`, then
-      add the repo's own sections, such as one for another language it uses, at
-      the end of the file, where a re-vendor keeps them.
+      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig`
 - [ ] `Makefile` — fetch from
      `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`, adapt
      targets for the project's language and tools
@@ -74,15 +71,10 @@ Template files can be fetched from:
      will run them in subdirectories, `services/api/.claude/` needs its own
      anchored entry.
    - If the image embeds a version in a binary: `.dockerignore` lets `.git`
-      into the build context. It keeps out every git `config` at any depth
-      (`**/.git/config`, `**/.git/modules/**/config`): the repository's own,
-      each submodule's under `.git/modules/`, and that of a submodule keeping
-      its own `.git` directory. `git describe` does not need them, and each can
-      hold a credential: a password in a remote URL, or the token the CI
-      checkout step stores there. A submodule whose name has a `config` segment
-      (`config`, `deploy/config`, `config/lib`) loses its whole git directory to
-      `**/.git/modules/**/config`, and Go's version stamping then fails the
-      build: give it a name without that segment (`git submodule add --name`).
+      into the build context. It keeps out `.git/config` and each submodule's
+      `config` under `.git/modules/` at any depth (`.git/modules/**/config`),
+      which `git describe` does not need and which can hold a credential: a
+      password in a remote URL, or the token the CI checkout step stores there.
      The stage that compiles has `git` (the Debian Go image has it; an alpine
      one needs `apk add --no-cache git`) and takes the version from the
      `VERSION` build argument when one is given, otherwise from
@@ -97,12 +89,6 @@ Template files can be fetched from:
      version still comes out empty, `dev` or `unknown`. A plain
      `docker build .` with no build arguments must succeed; a Dockerfile that
      refuses an empty build argument drops that refusal and keeps the argument.
-      A checkout whose `.git` is a file (a linked worktree, or a repository
-      checked out as a submodule) is the exception: that file points to a git
-      directory outside the build context, so the build cannot read the version
-      and a plain `docker build .` fails; pass the version with
-      `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already
-      do.
    - The Dockerfile carries a `lint` phase and a `test` phase, each invoking
      its tool directly rather than through `make` or `script/`, and the final
      stage carries a `COPY --from=` of a harmless file from each so the image
@@ -112,10 +98,7 @@ Template files can be fetched from:
    - Non-server: the final stage brings up the dev environment
    - Image pinned by sha256 hash with version/date comment
 - [ ] Gitea Actions workflow at `.gitea/workflows/check.yml` that runs
-      `script/cibuild` on push, checks out with `persist-credentials: false` and
-      with `fetch-depth: 0` (which fetches the tags `git describe` needs), and
-      carries the `concurrency` block that lets a new push cancel only the same
-      branch's older run — reference
+      `script/cibuild` on push — reference
      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific:
    - [ ] Go: `go mod init sneak.berlin/go/<name>`, `.golangci.yml` (fetch from
@@ -136,10 +119,8 @@ are thin shims calling them. Model scripts:
 - [ ] `script/bootstrap` / `make bootstrap` — installs all dependencies,
      idempotently, assuming nothing (pkg manager detection nix/apt/brew/apk;
      node used if present, else pinned version via nvm from a hash-verified
-      archive; pinned yarn via corepack); a non-server repo's development
-      environment stage runs it instead of inline installs; a gate phase or the
-      build stage installs what its base image lacks either inline or by running
-      it
+      archive; pinned yarn via corepack); Dockerfile runs it instead of inline
+      installs
 - [ ] `script/setup` / `make setup` — readies a fresh clone: runs `bootstrap`,
      then `install-precommit`, plus repo-specific init
 - [ ] `script/test` / `make test` — `docker build --no-cache --target test .`,
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-06
+last_modified: 2026-10-04
 ---

 This document covers repository structure, tooling, and workflow standards. Code
@@ -104,23 +104,18 @@ style conventions are in separate documents:
  `lint` phase and a `test` phase, with the final stage depending on both so the
  image cannot be built unless they pass. For non-server repos the final stage
  brings up a development environment; for server repos it is the runtime image.
-  The gate phases and the build stage start from their pinned base images and
-  install what those images lack either inline, as the canonical Go `Dockerfile`
-  below does for `git`, or by running `script/bootstrap`, as the `prompts`
-  repo's own `Dockerfile` does for its yarn packages. The development
-  environment stage installs development prerequisites by running
-  `script/bootstrap` rather than duplicating its installs inline. A stage that
-  runs `script/bootstrap` COPYs `script/` and the dependency manifests
-  (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it.
+  Dockerfiles install development prerequisites by running `script/bootstrap`
+  rather than duplicating installs inline; COPY `script/` and the dependency
+  manifests (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before
+  running it.

 - **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
  no separate lint file. `script/lint` and `script/test` each build one phase
  and nothing else:

    ```sh
-    tag="$(script/projectname)"
-    docker build --no-cache --target lint -t "$tag-lint" .
-    docker build --no-cache --target test -t "$tag-test" .
+    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
+    docker build --no-cache --target test -t "$(script/projectname)-test" .
    ```

    **A stage that is not the last one in the file is built only when the final
@@ -133,9 +128,7 @@ style conventions are in separate documents:
    **Every `docker build` in `script/` is tagged**, here and in
    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
    image behind on every invocation, on every developer host and every CI
-    runner; a tagged one replaces the previous image. Each script assigns the
-    tag on its own line before the build, so `set -e` stops it where
-    `script/projectname` fails.
+    runner; a tagged one replaces the previous image.

    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
@@ -163,9 +156,6 @@ style conventions are in separate documents:
  not evidence that anything ran: a sub-second build reporting success is a
  cache hit, not a result. Never invalidate by pruning — `docker builder prune`
  and friends destroy a build cache shared with every other build on the host.
-  When a check is added or changed, prove it works by planting a defect it must
-  catch and watching the run fail on it, then revert the defect. A green run
-  alone shows neither that the check ran nor that it covers what it should.

 - **The gate phases are separate stages, and the build stage depends on both.**
  The lint phase is based on the `golangci/golangci-lint` image (pinned by
@@ -258,16 +248,11 @@ style conventions are in separate documents:
            && rm -rf /var/lib/apt/lists/*
        ```

-    - `.dockerignore` lets `.git` into the build context. It keeps out every git
-      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
-      repository's own, each submodule's under `.git/modules/`, and that of a
-      submodule keeping its own `.git` directory. `git describe` does not need
-      them, and each can hold a credential: a password in a remote URL, or the
-      token the CI checkout step stores there. A submodule whose name has a
-      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
-      git directory to `**/.git/modules/**/config`, and Go's version stamping
-      then fails the build: give it a name without that segment
-      (`git submodule add --name`). The stage that compiles has `git` (the
+    - `.dockerignore` lets `.git` into the build context. It keeps out
+      `.git/config` and each submodule's `config` under `.git/modules/` at any
+      depth (`.git/modules/**/config`), which `git describe` does not need and
+      which can hold a credential: a password in a remote URL, or the token the
+      CI checkout step stores there. The stage that compiles has `git` (the
      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
      takes the version from the `VERSION` build argument when one is given,
      otherwise from `git describe --tags --always`. That gives the tag on a
@@ -281,35 +266,15 @@ style conventions are in separate documents:
      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
      `docker build .` with no build arguments must succeed; a Dockerfile that
      refuses an empty build argument drops that refusal and keeps the argument.
-      A checkout whose `.git` is a file (a linked worktree, or a repository
-      checked out as a submodule) is the exception: that file points to a git
-      directory outside the build context, so the build cannot read the version
-      and a plain `docker build .` fails; pass the version with
-      `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already
-      do.

 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` on push, and checks out the repo as its only other step,
-  with `persist-credentials: false`: `script/cibuild` needs no token, and
-  without it the checkout leaves the job's token in `.git/config` for every
-  later step. The checkout step also sets `fetch-depth: 0`, which fetches the
-  tags `git describe` needs: by default it clones shallow with no tags, and a
-  tagged repository's CI build would stamp a bare short commit id. The
-  workflow's `concurrency` block groups runs by workflow and branch
-  (`${{ github.workflow }}-${{ github.ref }}`) with `cancel-in-progress: true`,
-  so a new push cancels the older run on the same branch, queued or running, and
-  no other: runs for replaced commits do not hold up the shared runner.
-  `script/cibuild` bootstraps, runs the gate phases, and then builds the image,
-  so a successful run means every check passed; a bare `docker build .` does not
+  runs `script/cibuild` on push, and checks out the repo as its only other step.
+  That script bootstraps, runs the gate phases, and then builds the image, so a
+  successful run means every check passed; a bare `docker build .` does not
  carry the same guarantee, because its gate phases may come from the cache. The
  image build is uncached and so runs the gate phases a second time. That is the
  price of the rule above, and it is worth paying: the image that ships is built
-  from a run of its own gates rather than from a cache entry. A separate
-  workflow limited to `main` by a `branches` list under `on: push` cannot be
-  checked by review: to try a change to it, add the feature branch to that list
-  and push, then remove the branch from the list again before merging. Keep any
-  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
-  from the feature branch publishes nothing.
+  from a run of its own gates rather than from a cache entry.

 - Use platform-standard formatters: `black` for Python, `prettier` for
  JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -402,12 +367,9 @@ style conventions are in separate documents:

 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
-  `node_modules/`, and the repo's own build outputs. Fetch the standard
-  `.gitignore` from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  a new repo. A repo's `.gitignore` is the standard file followed by the repo's
-  own entries, such as its binaries; a re-vendor replaces the standard part and
-  keeps those entries. These patterns are written to `.gitignore`'s own
+  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
+  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
+  setting up a new repo. These patterns are written to `.gitignore`'s own
  semantics, in which an unanchored pattern already matches at every depth; they
  are not a `.dockerignore` and must not be transplanted into one unmodified.

@@ -455,15 +417,13 @@ style conventions are in separate documents:
  byte-identically across repos:

    ```sh
-    # The version and the tag each get their own line: a failing command
-    # substitution inside an argument does not trip `set -e`, so the inline
-    # form degrades to an empty constant.
+    # Own line: a failing command substitution inside an argument does not
+    # trip `set -e`, so the inline form degrades to an empty constant.
    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
    [ -n "$version" ] || version="unknown"
-    tag="$(script/projectname)"
    docker build --no-cache \
        --build-arg VERSION="$version" \
-        -t "$tag" .
+        -t "$(script/projectname)" .
    ```

    `--always` makes an untagged repo yield an abbreviated commit hash rather
@@ -475,8 +435,8 @@ style conventions are in separate documents:
    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
    the scripts stay byte-identical. One consequence for CI: the standard
-    checkout action clones shallow and fetches no tags, so the canonical
-    `.gitea/workflows/check.yml` sets `fetch-depth: 0` on its checkout step.
+    checkout action clones shallow and fetches no tags, so a repo that embeds a
+    tag-derived version must set `fetch-depth: 0` on its checkout step.

 - **Verify `.dockerignore` by enumerating the image, not by reading the
  patterns.** Plant files at the root _and_ at least two directories deep, build
@@ -659,11 +619,7 @@ style conventions are in separate documents:
      Never edit existing migrations after release.

 - All repos should have an `.editorconfig` enforcing the project's indentation
-  settings: the standard file from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig`, which sets
-  tabs for `Makefile` and Go files, followed by the repo's own sections, such as
-  one for another language it uses. A re-vendor replaces the standard part and
-  keeps those sections.
+  settings.

 - Avoid putting files in the repo root unless necessary. Root should contain
  only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,
@@ -19,7 +19,6 @@ YARN_VERSION="1.22.22"

 PKGMGR=""
 SUDO=""
-APT_UPDATED=""

 detect_pkgmgr() {
    [ -n "$PKGMGR" ] && return 0
@@ -48,14 +47,7 @@ pkg_install() {
    detect_pkgmgr
    case "$PKGMGR" in
        nix) nix-env -iA "nixpkgs.$1" ;;
-        apt)
-            # Package lists may be empty (fresh images); refresh once per run.
-            if [ -z "$APT_UPDATED" ]; then
-                $SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
-                APT_UPDATED=1
-            fi
-            $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2"
-            ;;
+        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
        brew) brew install "$3" ;;
        apk) apk add --no-cache "$4" ;;
    esac
@@ -14,17 +14,15 @@ main() {
    cd "$ROOT"
    "$SCRIPT_DIR/bootstrap"
    "$SCRIPT_DIR/check"
-    # The version and the tag each get their own line: a failing
-    # command substitution inside an argument does not trip `set -e`,
-    # so the inline form degrades silently to an empty constant. The
-    # VERSION build argument takes precedence over the version a build
-    # stage derives from the .git in the context.
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
    [ -n "$version" ] || version="unknown"
-    tag="$("$SCRIPT_DIR/projectname")"
    docker build --no-cache \
        --build-arg VERSION="$version" \
-        -t "$tag" .
+        -t "$("$SCRIPT_DIR/projectname")" .
 }

 main "$@"
@@ -10,17 +10,15 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"

 main() {
    cd "$ROOT"
-    # The version and the tag each get their own line: a failing
-    # command substitution inside an argument does not trip `set -e`,
-    # so the inline form degrades silently to an empty constant. The
-    # VERSION build argument takes precedence over the version a build
-    # stage derives from the .git in the context.
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
    [ -n "$version" ] || version="unknown"
-    tag="$("$SCRIPT_DIR/projectname")"
    docker build --no-cache \
        --build-arg VERSION="$version" \
-        -t "$tag" .
+        -t "$("$SCRIPT_DIR/projectname")" .
 }

 main "$@"
@@ -15,13 +15,9 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"

 main() {
    cd "$ROOT"
-    # The tag gets its own line: a failing command substitution inside
-    # an argument does not trip `set -e`, so the inline form degrades
-    # silently to an empty constant.
-    tag="$("$SCRIPT_DIR/projectname")"
    docker build --no-cache \
        --target lint \
-        -t "$tag-lint" .
+        -t "$("$SCRIPT_DIR/projectname")-lint" .
 }

 main "$@"
@@ -11,13 +11,9 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"

 main() {
    cd "$ROOT"
-    # The tag gets its own line: a failing command substitution inside
-    # an argument does not trip `set -e`, so the inline form degrades
-    # silently to an empty constant.
-    tag="$("$SCRIPT_DIR/projectname")"
    docker build --no-cache \
        --target test \
-        -t "$tag-test" .
+        -t "$("$SCRIPT_DIR/projectname")-test" .
 }

 main "$@"