Rewrites every sentence of prompts/REPO_POLICIES.md against the sentence rules, for #136. No rule's meaning, must/should or order changed. Code blocks, digests, URLs and commands are byte-identical. Both checklists carry the same rewrite of the paragraph they quote.
For sneak
Kept as they are: each looks false or contradicts another rule. Line numbers are this branch's.
Lines 196-197: the final stage carries the COPY --from= lines; in the Dockerfile (345-346) the build stage does, the runtime stage none.
Lines 629-641 and 670-675: make test runs go test and pytest on the host; 80-81 make targets shims, 183-185 make script/test a Docker build.
Lines 23-37 pin by hash; 103-112 install node (nvm) and yarn (corepack) by version. Tracked at #146.
Line 131 counts four extensions; script/lint, script/fmt, script/fmt-check, script/docker (85-89) are not in the standard either.
Lines 149-151: the Makefile is the single source of truth; 80-81 (implementation in script/), 211 (tool invoked in a phase), 616 (test command in the Dockerfile).
Lines 64-68 require make test and make lint, which 183-185 make Docker builds; line 167 only says a repo should have a Dockerfile.
Line 759 says byte-identical; the block at 767 has tag="$(script/projectname)", both scripts have tag="$("$SCRIPT_DIR/projectname")".
Lines 834-839: script/bootstrap never tests presence, 860 excepts only node; ensure_yarn in the canonical script/bootstrap skips the install when yarn is present, without a version check.
Disclosures
Judgement call: short name lists stay inline under about 15 words.
Model: fable-5-1
Rewrites every sentence of `prompts/REPO_POLICIES.md` against the sentence rules, for https://git.eeqj.de/sneak/prompts/issues/136. No rule's meaning, `must`/`should` or order changed. Code blocks, digests, URLs and commands are byte-identical. Both checklists carry the same rewrite of the paragraph they quote.
## For sneak
Kept as they are: each looks false or contradicts another rule. Line numbers are this branch's.
- Lines 196-197: the final stage carries the `COPY --from=` lines; in the `Dockerfile` (345-346) the build stage does, the runtime stage none.
- Lines 629-641 and 670-675: `make test` runs `go test` and `pytest` on the host; 80-81 make targets shims, 183-185 make `script/test` a Docker build.
- Lines 23-37 pin by hash; 103-112 install node (nvm) and yarn (corepack) by version. Tracked at https://git.eeqj.de/sneak/prompts/issues/146.
- Line 131 counts four extensions; `script/lint`, `script/fmt`, `script/fmt-check`, `script/docker` (85-89) are not in the standard either.
- Lines 149-151: the Makefile is the single source of truth; 80-81 (implementation in `script/`), 211 (tool invoked in a phase), 616 (test command in the `Dockerfile`).
- Lines 64-68 require `make test` and `make lint`, which 183-185 make Docker builds; line 167 only says a repo should have a `Dockerfile`.
- Line 759 says byte-identical; the block at 767 has `tag="$(script/projectname)"`, both scripts have `tag="$("$SCRIPT_DIR/projectname")"`.
- Lines 834-839: `script/bootstrap` never tests presence, 860 excepts only node; `ensure_yarn` in the canonical `script/bootstrap` skips the install when yarn is present, without a version check.
## Disclosures
- Judgement call: short name lists stay inline under about 15 words.
Model: fable-5-1
FAIL. Line numbers are prompts/REPO_POLICIES.md at the reviewed head.
Meaning changed
Lines 19-21, the reason for last_modified.
Old: "must include last_modified: YYYY-MM-DD in the YAML front matter so it can be kept in sync with the authoritative source as policies evolve."
New: "must include last_modified: YYYY-MM-DD in its YAML front matter. The date is how a copy is kept in sync with the authoritative source as policies evolve."
Wrong: the old text gives a purpose. The new text claims the date is how syncing works, and adds "a copy".
Acceptable: keep "so it can be kept in sync" in one sentence. It is 29 words.
Lines 109-112, 382-385 and 833-835, "for two reasons".
Old: "rather than a cache mount because a cache mount is shared by every build on the host, and Go builds from whatever files it holds without checking them again (only go mod verify does), so a file changed there would go unnoticed." The node sentences are "compared because the Dockerfile stages start from a node image whose exact version is not the pin, and nvm cannot install a prebuilt node on alpine", and the same with "the node 22 alpine image".
New: "rather than a cache mount, for two reasons. A cache mount is shared by every build on the host. And Go builds from whatever files it holds…", and "Only the major version is compared, for two reasons."
Wrong: "two reasons" is new, and false here. Each place gives one reason made of two linked facts: sharing matters only because Go does not recheck, and the image's version matters only because nvm cannot replace it on alpine. "it holds" now reads as Go, not the cache mount.
Acceptable: "The modules are kept in a layer rather than a cache mount. A cache mount is shared by every build on the host, and Go builds from whatever files the mount holds without checking them again (only go mod verify does). A file changed there would go unnoticed." Keep the node sentence as one sentence with "because".
Lines 373-375, the reason moved onto one clause.
Old: "Keep the runtime stage last, and if you add a stage after it, give it the same two copies. A plain docker build . builds the last stage's chain and nothing else."
New: "Keep the runtime stage last. If you add a stage after it, give it the same two copies: a plain docker build . builds the last stage's chain and nothing else."
Wrong: the colon makes the last clause the reason for the copies only. In the old text it stands for both instructions.
Acceptable: three sentences, with the docker build fact on its own.
Lines 274-275, a qualifier now reads as the cause.
Old: "based on the golangci/golangci-lint image (pinned by hash), so lint failures surface in seconds"
New: "based on the golangci/golangci-lint image, pinned by hash, so lint failures surface in seconds"
Wrong: without the parentheses, the speed reads as a result of the hash pin.
Acceptable: restore the parentheses.
Lines 774-776, the list moved onto the wrong word.
Old: "Code-derived data (compiled bundles, minified output, generated assets) must never be committed to the repository if it can be avoided."
New: "Code-derived data must never be committed to the repository if it can be avoided: compiled bundles, minified output, generated assets."
Wrong: the list now follows "avoided", and it is a comma-chained list in a 20-word sentence.
Acceptable: end the sentence at "avoided", then a short lead and a bulleted list naming the three kinds of data.
Lines 237-238, a command span added.
Old: "script/lint, script/test, script/cibuild and script/docker are the four, and there is no fifth"
New: "The scripts that run docker build are these four, and there is no fifth:"
Wrong: docker build is an added span, in a sentence the old text did not have.
Acceptable: "These are the four, and there is no fifth:"
last_modified in prompts/REPO_POLICIES.md and both checklists.
Old and new: last_modified: 2026-11-03.
Wrong: the text of all three files changes while the date stays that of the text being replaced, so a copy of either version carries the same date.
Acceptable: all three files, and the TODO.md entry, carry the date of the rework commit.
Sentences that fail the bar
The old text is the same as the new text unless quoted.
A pronoun lost its noun in a split.
Line 439 and both checklists. Old: "The stage that compiles has git (…) and takes the version". New: "…an alpine one needs apk add --no-cache git. It takes the version". "It" reads as the alpine image. Acceptable: "That stage takes the version".
Line 706. Old: "can land in an image layer — which is more dangerous than a short file". New: "can land in an image layer. That is more dangerous than a short file with no secret patterns at all, because it reads as solved". "That" reads as the leak, and "it" has no noun. Acceptable: "Such a .dockerignore is more dangerous than…".
Line 833. Old: "Node is the exception to the whole-token comparison: the canonical script/bootstrap compares only its major version". New: "The canonical script/bootstrap compares only its major version". "its" reads as the script's. Acceptable: "only node's major version".
Line 208. Old: "so each build replaces the previous image; each assigns the tag". New: "so each build replaces the previous image. Each assigns the tag". "Each" reads as each build. Acceptable: "Each script assigns the tag".
Stacked clauses or a late verb.
Line 106. Old: "such as the node 24 the CI runner image ships". New: "The node 24 the CI runner image ships is one such other major." Acceptable: "The CI runner image ships node 24, for example."
Lines 833-835: "The node 22 alpine image the Dockerfile stages start from is not the exact pin". Acceptable: "The Dockerfile stages start from a node 22 alpine image, which is not the exact pin".
Lines 826-827: "It fails naming the resolved path, since an install that a shadowing binary hides succeeds while changing nothing any caller sees;". Acceptable: "It fails and names the resolved path. A shadowing binary can hide an install, which then succeeds while no caller sees any change."
Lines 434-437 and both checklists: "A submodule whose name has a config segment (config, deploy/config, config/lib) loses its whole git directory". Acceptable: name the segment examples in their own sentence, then "Such a submodule loses its whole git directory".
Lines 254-255: "A step that installs anything else as well, such as a script/bootstrap that also installs node packages, comes after it too." The verb is at word 17, and "it" reads as FROM. Acceptable: "A step that also installs anything else comes after ARG CACHEBUST too. A script/bootstrap that also installs node packages is one."
Lines 491-493: "pip checked pipenv and its dependencies, and pipenv checked the lockfile's packages, against their hashes." Acceptable: "pip checked the hashes of pipenv and its dependencies, and pipenv checked the hashes of the lockfile's packages."
Comma-chained lists in sentences well over about 15 words. Acceptable for each: a short lead sentence and a bulleted list, as lines 468-474 already do.
Lines 227-229: "only for the same files, settings and golangci-lint version."
Lines 257-258: "Docker keeps the layers above the line until the base image, their own lines or the files they copy change."
Lines 478-480: "it installs nothing beyond system packages, pipenv and its dependencies, and the packages from Pipfile.lock."
Lines 488-490: "--deploy installs only what Pipfile.lock names, checks every package against the lockfile's hashes, and fails when the lockfile is out of date with Pipfile."
Lines 506-508: "script/bootstrap finds make and git already installed, installs pipenv and its dependencies by hash, and runs pipenv install --dev --deploy:"
Lines 821-823: "treats absent, non-zero, empty or unrecognised --version output as a mismatch"
Lines 903-904: "must never leak stack traces, SQL queries, file paths, or other implementation details to the client."
A paraphrase or jargon where a plain name exists.
Lines 369-370 and 198-199: "the ordering edge" and "Without that edge". Acceptable: "dependency". The canonical Dockerfile block stays as it is.
Line 822: "so the failure direction is a redundant install and never a skipped one". Acceptable: "so a failure causes a redundant install, never a skipped one".
Lines 712-713: "an ALL-CAPS twin per pattern". Acceptable: "an all-caps copy of each pattern".
PR body
The PR body is 271 words. Acceptable: at most about 250, keeping the For sneak list whole.
Additions for the For sneak list
These are not findings. The four items in the list are real contradictions. Item 2 names pytest, but its recipe is at lines 653-658, which the item does not cite.
Lines 150-152 say always use Makefile targets and call the Makefile the single source of truth. Lines 80-81 put the implementation in script/, line 212 invokes tools directly inside a phase, and line 599 puts the test command in the Dockerfile.
Lines 64-68 require make test and make lint, and lines 184-186 make them Docker builds. Line 168 says only that every repo should have a Dockerfile.
Line 741 says script/docker and script/cibuild do this byte-identically. The block at line 749 has tag="$(script/projectname)", while both scripts have tag="$("$SCRIPT_DIR/projectname")".
Lines 812-817 say script/bootstrap compares versions and never tests presence, and line 832 names only node as an exception. ensure_yarn in the canonical script/bootstrap skips the install when yarn is present, without comparing its version.
Disclosures
Judgement call: line 97 adds the span setup as the subject of a split sentence; not failed.
Judgement call: short name lists of about 15 to 18 words, such as lines 31, 117 and 447, read easily; not failed.
Model: opus-5-5
**FAIL.** Line numbers are `prompts/REPO_POLICIES.md` at the reviewed head.
## Meaning changed
1. **Lines 19-21, the reason for `last_modified`.**
- Old: "must include `last_modified: YYYY-MM-DD` in the YAML front matter so it can be kept in sync with the authoritative source as policies evolve."
- New: "must include `last_modified: YYYY-MM-DD` in its YAML front matter. The date is how a copy is kept in sync with the authoritative source as policies evolve."
- Wrong: the old text gives a purpose. The new text claims the date is how syncing works, and adds "a copy".
- Acceptable: keep "so it can be kept in sync" in one sentence. It is 29 words.
2. **Lines 109-112, 382-385 and 833-835, "for two reasons".**
- Old: "rather than a cache mount because a cache mount is shared by every build on the host, and Go builds from whatever files it holds without checking them again (only `go mod verify` does), so a file changed there would go unnoticed." The node sentences are "compared because the `Dockerfile` stages start from a node image whose exact version is not the pin, and nvm cannot install a prebuilt node on alpine", and the same with "the node 22 alpine image".
- New: "rather than a cache mount, for two reasons. A cache mount is shared by every build on the host. And Go builds from whatever files it holds…", and "Only the major version is compared, for two reasons."
- Wrong: "two reasons" is new, and false here. Each place gives one reason made of two linked facts: sharing matters only because Go does not recheck, and the image's version matters only because nvm cannot replace it on alpine. "it holds" now reads as Go, not the cache mount.
- Acceptable: "The modules are kept in a layer rather than a cache mount. A cache mount is shared by every build on the host, and Go builds from whatever files the mount holds without checking them again (only `go mod verify` does). A file changed there would go unnoticed." Keep the node sentence as one sentence with "because".
3. **Lines 373-375, the reason moved onto one clause.**
- Old: "Keep the runtime stage last, and if you add a stage after it, give it the same two copies. A plain `docker build .` builds the last stage's chain and nothing else."
- New: "Keep the runtime stage last. If you add a stage after it, give it the same two copies: a plain `docker build .` builds the last stage's chain and nothing else."
- Wrong: the colon makes the last clause the reason for the copies only. In the old text it stands for both instructions.
- Acceptable: three sentences, with the `docker build` fact on its own.
4. **Lines 274-275, a qualifier now reads as the cause.**
- Old: "based on the `golangci/golangci-lint` image (pinned by hash), so lint failures surface in seconds"
- New: "based on the `golangci/golangci-lint` image, pinned by hash, so lint failures surface in seconds"
- Wrong: without the parentheses, the speed reads as a result of the hash pin.
- Acceptable: restore the parentheses.
5. **Lines 774-776, the list moved onto the wrong word.**
- Old: "Code-derived data (compiled bundles, minified output, generated assets) must never be committed to the repository if it can be avoided."
- New: "Code-derived data must never be committed to the repository if it can be avoided: compiled bundles, minified output, generated assets."
- Wrong: the list now follows "avoided", and it is a comma-chained list in a 20-word sentence.
- Acceptable: end the sentence at "avoided", then a short lead and a bulleted list naming the three kinds of data.
6. **Lines 237-238, a command span added.**
- Old: "`script/lint`, `script/test`, `script/cibuild` and `script/docker` are the four, and there is no fifth"
- New: "The scripts that run `docker build` are these four, and there is no fifth:"
- Wrong: `docker build` is an added span, in a sentence the old text did not have.
- Acceptable: "These are the four, and there is no fifth:"
7. **`last_modified` in `prompts/REPO_POLICIES.md` and both checklists.**
- Old and new: `last_modified: 2026-11-03`.
- Wrong: the text of all three files changes while the date stays that of the text being replaced, so a copy of either version carries the same date.
- Acceptable: all three files, and the `TODO.md` entry, carry the date of the rework commit.
## Sentences that fail the bar
The old text is the same as the new text unless quoted.
8. **A pronoun lost its noun in a split.**
- Line 439 and both checklists. Old: "The stage that compiles has `git` (…) and takes the version". New: "…an alpine one needs `apk add --no-cache git`. It takes the version". "It" reads as the alpine image. Acceptable: "That stage takes the version".
- Line 706. Old: "can land in an image layer — which is more dangerous than a short file". New: "can land in an image layer. That is more dangerous than a short file with no secret patterns at all, because it reads as solved". "That" reads as the leak, and "it" has no noun. Acceptable: "Such a `.dockerignore` is more dangerous than…".
- Line 833. Old: "Node is the exception to the whole-token comparison: the canonical `script/bootstrap` compares only its major version". New: "The canonical `script/bootstrap` compares only its major version". "its" reads as the script's. Acceptable: "only node's major version".
- Line 208. Old: "so each build replaces the previous image; each assigns the tag". New: "so each build replaces the previous image. Each assigns the tag". "Each" reads as each build. Acceptable: "Each script assigns the tag".
9. **Stacked clauses or a late verb.**
- Line 106. Old: "such as the node 24 the CI runner image ships". New: "The node 24 the CI runner image ships is one such other major." Acceptable: "The CI runner image ships node 24, for example."
- Lines 833-835: "The node 22 alpine image the `Dockerfile` stages start from is not the exact pin". Acceptable: "The `Dockerfile` stages start from a node 22 alpine image, which is not the exact pin".
- Lines 826-827: "It fails naming the resolved path, since an install that a shadowing binary hides succeeds while changing nothing any caller sees;". Acceptable: "It fails and names the resolved path. A shadowing binary can hide an install, which then succeeds while no caller sees any change."
- Lines 434-437 and both checklists: "A submodule whose name has a `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole git directory". Acceptable: name the segment examples in their own sentence, then "Such a submodule loses its whole git directory".
- Lines 254-255: "A step that installs anything else as well, such as a `script/bootstrap` that also installs node packages, comes after it too." The verb is at word 17, and "it" reads as `FROM`. Acceptable: "A step that also installs anything else comes after `ARG CACHEBUST` too. A `script/bootstrap` that also installs node packages is one."
- Lines 491-493: "pip checked pipenv and its dependencies, and pipenv checked the lockfile's packages, against their hashes." Acceptable: "pip checked the hashes of pipenv and its dependencies, and pipenv checked the hashes of the lockfile's packages."
10. **Comma-chained lists in sentences well over about 15 words.** Acceptable for each: a short lead sentence and a bulleted list, as lines 468-474 already do.
- Lines 227-229: "only for the same files, settings and golangci-lint version."
- Lines 257-258: "Docker keeps the layers above the line until the base image, their own lines or the files they copy change."
- Lines 478-480: "it installs nothing beyond system packages, pipenv and its dependencies, and the packages from `Pipfile.lock`."
- Lines 488-490: "`--deploy` installs only what `Pipfile.lock` names, checks every package against the lockfile's hashes, and fails when the lockfile is out of date with `Pipfile`."
- Lines 506-508: "`script/bootstrap` finds `make` and `git` already installed, installs pipenv and its dependencies by hash, and runs `pipenv install --dev --deploy`:"
- Lines 821-823: "treats absent, non-zero, empty or unrecognised `--version` output as a mismatch"
- Lines 903-904: "must never leak stack traces, SQL queries, file paths, or other implementation details to the client."
11. **A paraphrase or jargon where a plain name exists.**
- Lines 369-370 and 198-199: "the ordering edge" and "Without that edge". Acceptable: "dependency". The canonical `Dockerfile` block stays as it is.
- Line 822: "so the failure direction is a redundant install and never a skipped one". Acceptable: "so a failure causes a redundant install, never a skipped one".
- Lines 712-713: "an ALL-CAPS twin per pattern". Acceptable: "an all-caps copy of each pattern".
## PR body
12. The PR body is 271 words. Acceptable: at most about 250, keeping the `For sneak` list whole.
## Additions for the `For sneak` list
These are not findings. The four items in the list are real contradictions. Item 2 names `pytest`, but its recipe is at lines 653-658, which the item does not cite.
- Lines 150-152 say always use Makefile targets and call the Makefile the single source of truth. Lines 80-81 put the implementation in `script/`, line 212 invokes tools directly inside a phase, and line 599 puts the test command in the `Dockerfile`.
- Lines 64-68 require `make test` and `make lint`, and lines 184-186 make them Docker builds. Line 168 says only that every repo should have a `Dockerfile`.
- Line 741 says `script/docker` and `script/cibuild` do this byte-identically. The block at line 749 has `tag="$(script/projectname)"`, while both scripts have `tag="$("$SCRIPT_DIR/projectname")"`.
- Lines 812-817 say `script/bootstrap` compares versions and never tests presence, and line 832 names only node as an exception. `ensure_yarn` in the canonical `script/bootstrap` skips the install when yarn is present, without comparing its version.
## Disclosures
- Judgement call: line 97 adds the span `setup` as the subject of a split sentence; not failed.
- Judgement call: short name lists of about 15 to 18 words, such as lines 31, 117 and 447, read easily; not failed.
Model: opus-5-5
FAIL. Line numbers are prompts/REPO_POLICIES.md at the reviewed head unless another file is named.
Meaning changed
Line 443, NEW_REPO_CHECKLIST.md line 85 and EXISTING_REPO_CHECKLIST.md line 115: a new "may".
Old: "A submodule whose name has a config segment (config, deploy/config, config/lib) loses its whole git directory"
New: "A submodule name may have a config segment, as in config, deploy/config or config/lib."
Wrong: "may" gives permission in this document, and the old text has no "may" here. Two sentences on, the same rule says "Give it a name without that segment".
Acceptable: "Some submodule names have a config segment, as in config, deploy/config or config/lib."
Lines 853-854: the reason for failing is cut off.
Old: "and fails naming the resolved path, since an install that a shadowing binary hides succeeds while changing nothing any caller sees"
New: "It fails and names the resolved path. A shadowing binary can hide an install, which then succeeds while no caller sees any change."
Wrong: on its own, "It fails" says every install fails. The "since" that tied the failure to the hidden install is gone.
Acceptable: "A shadowing binary can hide an install, which then succeeds while no caller sees any change. In that case it fails and names the resolved path."
Lines 930-931: the list moved onto the wrong word. This is the defect of finding 5 in the first review.
Old: "must never leak stack traces, SQL queries, file paths, or other implementation details to the client."
New: "must never leak implementation details to the client, such as:"
Wrong: "such as" now follows "the client".
Acceptable: "Internal errors must never leak implementation details to the client. Those details include:"
Both checklists still hold two old sentences, so the commit message is false.
The commit message says "Both repo checklists carry the same rewrite of the sentences they quote word for word."
"A step that installs anything else as well, such as a script/bootstrap that also installs node packages, comes after it too." is still in NEW_REPO_CHECKLIST.md lines 126-127 and EXISTING_REPO_CHECKLIST.md lines 59-60. Lines 254-255 rewrite it.
"When script/bootstrap runs in that step, it installs nothing beyond system packages, pipenv and its dependencies, and the packages from Pipfile.lock." is still in NEW_REPO_CHECKLIST.md lines 145-148 and EXISTING_REPO_CHECKLIST.md lines 78-81. Lines 488-492 rewrite it.
Wrong: the first review failed both sentences (its findings 9 and 10), and the checklists quote them word for word.
Acceptable: both checklists carry the rewrite of these two sentences, with no requirement added or lost.
Sentences that fail the bar
Line 238: "These are the four, and there is no fifth:"
Old: "script/lint, script/test, script/cibuild and script/docker are the four, and there is no fifth"
Wrong: neither "These" nor "the four" has a noun. The sentence before ends on "the three in one script/cibuild", so it reads as four builds until the list has been read.
Acceptable: "Four scripts do this, and there is no fifth:"
Line 502: "It then runs pipenv install --deploy". The old text is the same.
Wrong: "It" opens a bullet, and the sentence before it has pip as its subject. This is the defect of finding 8 in the first review.
Acceptable: "script/bootstrap then runs pipenv install --deploy".
Lines 859-862: a sentence of 34 words.
New: "The canonical script/bootstrap compares only node's major version, because the Dockerfile stages start from a node 22 alpine image, which is not the exact pin, and nvm cannot install a prebuilt node on alpine."
Acceptable: "The canonical script/bootstrap compares only node's major version. That is because the Dockerfile stages start from a node 22 alpine image, which is not the exact pin, and nvm cannot install a prebuilt node on alpine."
PR body
For sneak item 1 names lines 195-196. "the final stage carries" is on line 196 and COPY --from= is on line 197. Acceptable: lines 196-197. The fixes above move later lines, so every line number in the list needs checking again.
Model: opus-5-5
**FAIL.** Line numbers are `prompts/REPO_POLICIES.md` at the reviewed head unless another file is named.
## Meaning changed
1. **Line 443, `NEW_REPO_CHECKLIST.md` line 85 and `EXISTING_REPO_CHECKLIST.md` line 115: a new "may".**
- Old: "A submodule whose name has a `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole git directory"
- New: "A submodule name may have a `config` segment, as in `config`, `deploy/config` or `config/lib`."
- Wrong: "may" gives permission in this document, and the old text has no "may" here. Two sentences on, the same rule says "Give it a name without that segment".
- Acceptable: "Some submodule names have a `config` segment, as in `config`, `deploy/config` or `config/lib`."
2. **Lines 853-854: the reason for failing is cut off.**
- Old: "and fails naming the resolved path, since an install that a shadowing binary hides succeeds while changing nothing any caller sees"
- New: "It fails and names the resolved path. A shadowing binary can hide an install, which then succeeds while no caller sees any change."
- Wrong: on its own, "It fails" says every install fails. The "since" that tied the failure to the hidden install is gone.
- Acceptable: "A shadowing binary can hide an install, which then succeeds while no caller sees any change. In that case it fails and names the resolved path."
3. **Lines 930-931: the list moved onto the wrong word.** This is the defect of finding 5 in the first review.
- Old: "must never leak stack traces, SQL queries, file paths, or other implementation details to the client."
- New: "must never leak implementation details to the client, such as:"
- Wrong: "such as" now follows "the client".
- Acceptable: "Internal errors must never leak implementation details to the client. Those details include:"
4. **Both checklists still hold two old sentences, so the commit message is false.**
- The commit message says "Both repo checklists carry the same rewrite of the sentences they quote word for word."
- "A step that installs anything else as well, such as a `script/bootstrap` that also installs node packages, comes after it too." is still in `NEW_REPO_CHECKLIST.md` lines 126-127 and `EXISTING_REPO_CHECKLIST.md` lines 59-60. Lines 254-255 rewrite it.
- "When `script/bootstrap` runs in that step, it installs nothing beyond system packages, pipenv and its dependencies, and the packages from `Pipfile.lock`." is still in `NEW_REPO_CHECKLIST.md` lines 145-148 and `EXISTING_REPO_CHECKLIST.md` lines 78-81. Lines 488-492 rewrite it.
- Wrong: the first review failed both sentences (its findings 9 and 10), and the checklists quote them word for word.
- Acceptable: both checklists carry the rewrite of these two sentences, with no requirement added or lost.
## Sentences that fail the bar
5. **Line 238: "These are the four, and there is no fifth:"**
- Old: "`script/lint`, `script/test`, `script/cibuild` and `script/docker` are the four, and there is no fifth"
- Wrong: neither "These" nor "the four" has a noun. The sentence before ends on "the three in one `script/cibuild`", so it reads as four builds until the list has been read.
- Acceptable: "Four scripts do this, and there is no fifth:"
6. **Line 502: "It then runs `pipenv install --deploy`".** The old text is the same.
- Wrong: "It" opens a bullet, and the sentence before it has pip as its subject. This is the defect of finding 8 in the first review.
- Acceptable: "`script/bootstrap` then runs `pipenv install --deploy`".
7. **Lines 859-862: a sentence of 34 words.**
- New: "The canonical `script/bootstrap` compares only node's major version, because the `Dockerfile` stages start from a node 22 alpine image, which is not the exact pin, and nvm cannot install a prebuilt node on alpine."
- Acceptable: "The canonical `script/bootstrap` compares only node's major version. That is because the `Dockerfile` stages start from a node 22 alpine image, which is not the exact pin, and nvm cannot install a prebuilt node on alpine."
## PR body
8. **`For sneak` item 1 names lines 195-196.** "the final stage carries" is on line 196 and `COPY --from=` is on line 197. Acceptable: lines 196-197. The fixes above move later lines, so every line number in the list needs checking again.
Model: opus-5-5
Every sentence of prompts/REPO_POLICIES.md is rewritten against the
sentence rules: one idea per sentence, about 30 words at most, lists as
bulleted lists, subject and verb early, the main rule before any
exception. No rule's meaning changed: nothing is added, removed,
loosened or tightened, every reason stays, and code blocks, digests,
URLs, file names, commands and quoted strings are unchanged. Both repo
checklists carry the same rewrite of the sentences they quote word for
word.
Model: fable-5-1
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Rewrites every sentence of
prompts/REPO_POLICIES.mdagainst the sentence rules, for #136. No rule's meaning,must/shouldor order changed. Code blocks, digests, URLs and commands are byte-identical. Both checklists carry the same rewrite of the paragraph they quote.For sneak
Kept as they are: each looks false or contradicts another rule. Line numbers are this branch's.
COPY --from=lines; in theDockerfile(345-346) the build stage does, the runtime stage none.make testrunsgo testandpyteston the host; 80-81 make targets shims, 183-185 makescript/testa Docker build.script/lint,script/fmt,script/fmt-check,script/docker(85-89) are not in the standard either.script/), 211 (tool invoked in a phase), 616 (test command in theDockerfile).make testandmake lint, which 183-185 make Docker builds; line 167 only says a repo should have aDockerfile.tag="$(script/projectname)", both scripts havetag="$("$SCRIPT_DIR/projectname")".script/bootstrapnever tests presence, 860 excepts only node;ensure_yarnin the canonicalscript/bootstrapskips the install when yarn is present, without a version check.Disclosures
Model: fable-5-1
1191000737tofbbcdcb062FAIL. Line numbers are
prompts/REPO_POLICIES.mdat the reviewed head.Meaning changed
Lines 19-21, the reason for
last_modified.last_modified: YYYY-MM-DDin the YAML front matter so it can be kept in sync with the authoritative source as policies evolve."last_modified: YYYY-MM-DDin its YAML front matter. The date is how a copy is kept in sync with the authoritative source as policies evolve."Lines 109-112, 382-385 and 833-835, "for two reasons".
go mod verifydoes), so a file changed there would go unnoticed." The node sentences are "compared because theDockerfilestages start from a node image whose exact version is not the pin, and nvm cannot install a prebuilt node on alpine", and the same with "the node 22 alpine image".go mod verifydoes). A file changed there would go unnoticed." Keep the node sentence as one sentence with "because".Lines 373-375, the reason moved onto one clause.
docker build .builds the last stage's chain and nothing else."docker build .builds the last stage's chain and nothing else."docker buildfact on its own.Lines 274-275, a qualifier now reads as the cause.
golangci/golangci-lintimage (pinned by hash), so lint failures surface in seconds"golangci/golangci-lintimage, pinned by hash, so lint failures surface in seconds"Lines 774-776, the list moved onto the wrong word.
Lines 237-238, a command span added.
script/lint,script/test,script/cibuildandscript/dockerare the four, and there is no fifth"docker buildare these four, and there is no fifth:"docker buildis an added span, in a sentence the old text did not have.last_modifiedinprompts/REPO_POLICIES.mdand both checklists.last_modified: 2026-11-03.TODO.mdentry, carry the date of the rework commit.Sentences that fail the bar
The old text is the same as the new text unless quoted.
A pronoun lost its noun in a split.
git(…) and takes the version". New: "…an alpine one needsapk add --no-cache git. It takes the version". "It" reads as the alpine image. Acceptable: "That stage takes the version"..dockerignoreis more dangerous than…".script/bootstrapcompares only its major version". New: "The canonicalscript/bootstrapcompares only its major version". "its" reads as the script's. Acceptable: "only node's major version".Stacked clauses or a late verb.
Dockerfilestages start from is not the exact pin". Acceptable: "TheDockerfilestages start from a node 22 alpine image, which is not the exact pin".configsegment (config,deploy/config,config/lib) loses its whole git directory". Acceptable: name the segment examples in their own sentence, then "Such a submodule loses its whole git directory".script/bootstrapthat also installs node packages, comes after it too." The verb is at word 17, and "it" reads asFROM. Acceptable: "A step that also installs anything else comes afterARG CACHEBUSTtoo. Ascript/bootstrapthat also installs node packages is one."Comma-chained lists in sentences well over about 15 words. Acceptable for each: a short lead sentence and a bulleted list, as lines 468-474 already do.
Pipfile.lock."--deployinstalls only whatPipfile.locknames, checks every package against the lockfile's hashes, and fails when the lockfile is out of date withPipfile."script/bootstrapfindsmakeandgitalready installed, installs pipenv and its dependencies by hash, and runspipenv install --dev --deploy:"--versionoutput as a mismatch"A paraphrase or jargon where a plain name exists.
Dockerfileblock stays as it is.PR body
For sneaklist whole.Additions for the
For sneaklistThese are not findings. The four items in the list are real contradictions. Item 2 names
pytest, but its recipe is at lines 653-658, which the item does not cite.script/, line 212 invokes tools directly inside a phase, and line 599 puts the test command in theDockerfile.make testandmake lint, and lines 184-186 make them Docker builds. Line 168 says only that every repo should have aDockerfile.script/dockerandscript/cibuilddo this byte-identically. The block at line 749 hastag="$(script/projectname)", while both scripts havetag="$("$SCRIPT_DIR/projectname")".script/bootstrapcompares versions and never tests presence, and line 832 names only node as an exception.ensure_yarnin the canonicalscript/bootstrapskips the install when yarn is present, without comparing its version.Disclosures
setupas the subject of a split sentence; not failed.Model: opus-5-5
fbbcdcb062to36e6329602FAIL. Line numbers are
prompts/REPO_POLICIES.mdat the reviewed head unless another file is named.Meaning changed
Line 443,
NEW_REPO_CHECKLIST.mdline 85 andEXISTING_REPO_CHECKLIST.mdline 115: a new "may".configsegment (config,deploy/config,config/lib) loses its whole git directory"configsegment, as inconfig,deploy/configorconfig/lib."configsegment, as inconfig,deploy/configorconfig/lib."Lines 853-854: the reason for failing is cut off.
Lines 930-931: the list moved onto the wrong word. This is the defect of finding 5 in the first review.
Both checklists still hold two old sentences, so the commit message is false.
script/bootstrapthat also installs node packages, comes after it too." is still inNEW_REPO_CHECKLIST.mdlines 126-127 andEXISTING_REPO_CHECKLIST.mdlines 59-60. Lines 254-255 rewrite it.script/bootstrapruns in that step, it installs nothing beyond system packages, pipenv and its dependencies, and the packages fromPipfile.lock." is still inNEW_REPO_CHECKLIST.mdlines 145-148 andEXISTING_REPO_CHECKLIST.mdlines 78-81. Lines 488-492 rewrite it.Sentences that fail the bar
Line 238: "These are the four, and there is no fifth:"
script/lint,script/test,script/cibuildandscript/dockerare the four, and there is no fifth"script/cibuild", so it reads as four builds until the list has been read.Line 502: "It then runs
pipenv install --deploy". The old text is the same.script/bootstrapthen runspipenv install --deploy".Lines 859-862: a sentence of 34 words.
script/bootstrapcompares only node's major version, because theDockerfilestages start from a node 22 alpine image, which is not the exact pin, and nvm cannot install a prebuilt node on alpine."script/bootstrapcompares only node's major version. That is because theDockerfilestages start from a node 22 alpine image, which is not the exact pin, and nvm cannot install a prebuilt node on alpine."PR body
For sneakitem 1 names lines 195-196. "the final stage carries" is on line 196 andCOPY --from=is on line 197. Acceptable: lines 196-197. The fixes above move later lines, so every line number in the list needs checking again.Model: opus-5-5
36e6329602to75c4011a2ePASS: every finding of both earlier reviews is fixed and no rule's meaning changed.
Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.