One CI step beside the self-ref pin, and test/vendored.test.sh covering
both directions: the manifest -> tree scan (missing, symlink, directory,
empty, ../ escape, absolute, untracked) and the closed-world root rule
(neither list, vendored, exempted, prose is not an input, no recursion
below the root), plus the real tree unmodified and the RELEASES.md
regression both ways.
The one-off `grep -Fx RELEASES.md` row at test/docs-sync.test.sh is
deleted (#251 D4): two spellings of "the manifest is right" is the drift
the manifest exists to prevent. Its intent is now a guard case, which the
next doctrine file inherits for free.
Refs #251
Round 1 (PR #43): codex-bot + kimi-bot reproduced cp writing through a
committed symlink and cmp/find resolving through or skipping link nodes —
both modes now refuse any non-regular node (.ceremony itself, anything
under it, the root AGENTS.md incl. dangling links and non-file nodes)
before touching the tree. kimi-bot also found .ceremony/README.md was
machine-written but never machine-verified: --check now cmps it against
the generated text (missing or drifted -> red). 22 regression rows; every
symlink row asserts the victim untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fake source trees (not the real five docs) so a hardcoded list fails;
consumer trees per pin shape, including the commented-pin row ceremony's
own release.yml header motivates. Also fixes the EXIT-trap exit-status
clobber the smoke run surfaced.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
