Re-converge drift check on CultureMech hub; extend to mech_shared; retire schema-pin

justfile

@@ -223,26 +223,13 @@ research-provider provider:
 # Composite: refresh METPO → seed → build embeddings → render pages.
 gen-site: seed-apply build-embeddings gen-pages
 
-# Durability guard for the shared LinkML module (Discussion + Dataset), vendored
-# byte-identical across the Mech repos — see culturebotai-claw#7.
-SHARED_SCHEMA_MODULE := "src/traitmech/schema/mech_shared.yaml"
-verify-schema-pin:
-    #!/usr/bin/env bash
-    set -euo pipefail
-    if command -v sha256sum >/dev/null 2>&1; then
-        sha256sum -c src/traitmech/schema/.mech_shared.sha256
-    else
-        shasum -a 256 -c src/traitmech/schema/.mech_shared.sha256
-    fi
-
-# Intentional sync only: re-pin after a deliberate, all-repos byte-identical update.
-refresh-schema-pin:
-    #!/usr/bin/env bash
-    set -euo pipefail
-    f={{SHARED_SCHEMA_MODULE}}
-    if command -v sha256sum >/dev/null 2>&1; then h=$(sha256sum "$f" | cut -d' ' -f1); else h=$(shasum -a 256 "$f" | cut -d' ' -f1); fi
-    printf '%s  %s\n' "$h" "$f" > src/traitmech/schema/.mech_shared.sha256
-    echo "re-pinned $f to $h"
+# NOTE: the shared LinkML module (mech_shared.yaml) is vendored byte-identical
+# across the Mech repos (package-namespaced path per repo). Its self-generated
+# sha256 pin (verify-/refresh-schema-pin) was retired — same self-referential
+# flaw as the id-label pin. It is now covered by the shared-reference drift check
+# (scripts/check_vendored_sync.sh diffs src/*/schema/mech_shared.yaml against the
+# hub's copy at CultureBotAI/CultureMech@<scripts/.vendored_canon_ref>) plus the
+# hub's nightly vendored-fleet-audit.yml.
 
 # Run tests with coverage
 test:

scripts/.vendored_canon_ref

@@ -1 +1 @@
-1ad5d4088bd460f069d797a6ef0ff910e7eada1a
+6be694f3d6308ac0f4c2e0dcf196e2ff73f6468f

scripts/check_vendored_sync.sh

@@ -1,24 +1,24 @@
 #!/usr/bin/env bash
-# Drift check for the vendored byte-identical id↔label files.
+# Drift check for vendored byte-identical files (hub-and-spoke model).
 #
-# Canonical source: culturebotai-claw, shared/idlabel/. claw is private, so
-# rather than a network fetch this diffs against a LOCAL sibling checkout of
-# claw. A Mech that edits its vendored copy fails this check because the
-# reference lives in another repo.
+# THE FIX for the self-referential-pin blind spot: instead of hashing a file
+# against a hash generated FROM THE SAME REPO, this fetches the authoritative
+# copy from the canonical hub at a pinned commit and diffs. A repo that edits
+# its vendored copy now fails CI, because the reference lives elsewhere.
 #
-# Resolution order for the claw checkout:
-#   1. $CLAW_ROOT (if set) — must contain shared/idlabel/
-#   2. the usual sibling locations (../culturebotai-claw, ../../…) so this works
-#      from a flat Mech (TraitMech/) and a nested one (CommunityMech/CommunityMech/)
-#
-# If no claw checkout is found (e.g. a CI runner without it), the check SKIPS
-# and exits 0 — enforcement is LOCAL, for anyone doing cross-Mech work with the
-# sibling checkout. It is NOT enforced in CI while claw is private. Making claw
-# public again lets this revert to a pinned raw-fetch that CI can run.
-#
-# Dependency-free: bash + diff only.
+# The hub is the PUBLIC CultureBotAI/CultureMech (culturebotai-claw is private,
+# so public Mech CI cannot fetch raw content from it). Dependency-free: bash +
+# curl + diff only (no uv/OAK), so it runs as a fast blocking CI job before any
+# heavy setup. The pinned canonical commit lives in scripts/.vendored_canon_ref;
+# the file list is embedded (this script is itself vendored byte-identical across
+# the spokes). Bump .vendored_canon_ref in the same PR that syncs a changed file
+# from the hub — that bump is the deliberate propagation act.
 set -euo pipefail
 
+CANON_REPO="CultureBotAI/CultureMech"
+REF_FILE="scripts/.vendored_canon_ref"
+
+# Same-path vendored files: identical relative path in the hub and here.
 FILES=(
   scripts/validate_id_label_correspondence.py
   scripts/chem_formula.py
@@ -27,54 +27,54 @@ FILES=(
   tests/test_id_label_plausibility.py
 )
 
-# Locate the canonical claw checkout.
-canon_dir=""
-if [ -n "${CLAW_ROOT:-}" ] && [ -d "${CLAW_ROOT}/shared/idlabel" ]; then
-  canon_dir="${CLAW_ROOT}/shared/idlabel"
-else
-  for cand in ../culturebotai-claw ../../culturebotai-claw ../../../culturebotai-claw; do
-    if [ -d "$cand/shared/idlabel" ]; then canon_dir="$cand/shared/idlabel"; break; fi
-  done
-fi
+# Package-namespaced shared files: same bytes, but the local path is namespaced
+# by this repo's package while the hub's is culturemech. Format "local_glob|hub".
+MAPPED=(
+  "src/*/schema/mech_shared.yaml|src/culturemech/schema/mech_shared.yaml"
+)
 
-if [ -z "$canon_dir" ]; then
-  echo "SKIP: culturebotai-claw checkout not found (set CLAW_ROOT to its path)."
-  echo "  Cross-repo vendored-drift is NOT enforced here (claw is private)."
-  echo "  Run locally alongside a claw checkout to enforce."
-  exit 0
-fi
-
-# If the checkout is a git repo, report which claw commit we're comparing to,
-# and warn (do not fail) when it differs from the recorded ref.
-ref_note=""
-if command -v git >/dev/null 2>&1 && git -C "$canon_dir" rev-parse HEAD >/dev/null 2>&1; then
-  head="$(git -C "$canon_dir" rev-parse --short HEAD)"
-  ref_note=" (claw@${head})"
-  if [ -f scripts/.vendored_canon_ref ]; then
-    want="$(tr -d '[:space:]' < scripts/.vendored_canon_ref)"
-    have="$(git -C "$canon_dir" rev-parse HEAD)"
-    if [ -n "$want" ] && [ "$want" != "$have" ]; then
-      echo "NOTE: local claw is at ${have:0:8}, .vendored_canon_ref pins ${want:0:8}."
-      echo "  Comparing against the local checkout; 'git -C <claw> checkout ${want:0:8}' to match the pin."
-    fi
-  fi
-fi
+[ -f "$REF_FILE" ] || { echo "ERROR: $REF_FILE missing (pinned canonical commit)"; exit 2; }
+REF="$(tr -d '[:space:]' < "$REF_FILE")"
+[ -n "$REF" ] || { echo "ERROR: $REF_FILE is empty"; exit 2; }
 
+tmp="$(mktemp)"
+trap 'rm -f "$tmp"' EXIT
 fail=0
+checked=0
 for f in "${FILES[@]}"; do
   [ -f "$f" ] || { echo "MISSING: $f not present locally"; fail=1; continue; }
-  canon="$canon_dir/$f"
-  [ -f "$canon" ] || { echo "ERROR: canonical $canon missing in claw checkout"; fail=1; continue; }
-  if ! cmp -s "$canon" "$f"; then
-    echo "DRIFT: $f differs from claw canonical$ref_note"; fail=1
+  url="https://raw.githubusercontent.com/${CANON_REPO}/${REF}/${f}"
+  if ! curl -fsSL "$url" -o "$tmp"; then
+    echo "ERROR: could not fetch $f from ${CANON_REPO}@${REF:0:8} ($url)"; fail=1; continue
+  fi
+  # byte-exact comparison (temp file preserves the trailing newline that $() would strip)
+  if ! cmp -s "$tmp" "$f"; then
+    echo "DRIFT: $f differs from ${CANON_REPO}@${REF:0:8}"; fail=1
+  fi
+  checked=$((checked + 1))
+done
+
+# Path-mapped files: resolve the single local match via glob, diff the hub copy.
+for entry in "${MAPPED[@]}"; do
+  glob="${entry%%|*}"; hubf="${entry#*|}"
+  local=""
+  for cand in $glob; do [ -f "$cand" ] && local="$cand" && break; done
+  if [ -z "$local" ]; then echo "MISSING: no local file matching $glob"; fail=1; continue; fi
+  url="https://raw.githubusercontent.com/${CANON_REPO}/${REF}/${hubf}"
+  if ! curl -fsSL "$url" -o "$tmp"; then
+    echo "ERROR: could not fetch $hubf from ${CANON_REPO}@${REF:0:8} ($url)"; fail=1; continue
+  fi
+  if ! cmp -s "$tmp" "$local"; then
+    echo "DRIFT: $local differs from ${CANON_REPO}@${REF:0:8}:$hubf"; fail=1
   fi
+  checked=$((checked + 1))
 done
 
 if [ "$fail" -eq 0 ]; then
-  echo "OK: all ${#FILES[@]} vendored files match claw canonical$ref_note"
+  echo "OK: all ${checked} vendored files match ${CANON_REPO}@${REF:0:8}"
 else
   echo ""
-  echo "To resolve: copy the canonical files from ${canon_dir}/, and if claw"
-  echo "intentionally changed them, bump scripts/.vendored_canon_ref to the new claw commit."
+  echo "To resolve: copy the canonical files from ${CANON_REPO}@${REF:0:8}, and if the"
+  echo "hub intentionally changed them, bump ${REF_FILE} to the new hub commit."
   exit 1
 fi