chore(repo): move the maintainer's process tooling out of the public repo

[kevintseng]

Summary

Moves one maintainer's personal development-process tooling (git commit/push gates, AI stage runners and their five workflows, prompts, Claude Code project hooks, eval cases, the intent/spec/plan artifacts) out of the public repository. What protects the repository stays: npm run verify / verify:journeys / verify:receipt, scripts/verify*.mjs, and the required check SDLC verify (same job id and name). The code those need moved from scripts/sdlc/lib.mjs to scripts/lib/verify-core.mjs.

Also fixes the verification audit, which crawled the disk and went red on a machine that keeps private, git-ignored files at the departed paths: it now skips git-ignored paths (a file in the index is never dropped; if git fails it says so on stderr and never scans less).

Closes #364. Refs #355 (filed by the hourly monitor this change removes; to be closed once merged), #362 (separate follow-up).

Type of change

• Feature (feat)
• Bug fix (fix)
• Refactor (refactor)
• Docs only (docs)
• Test only (test)
• Build / CI / chore
• Release (release)

Docs synced (project doc-sync rule — CLAUDE.md)

• CHANGELOG.md updated for this change (under [Unreleased] or current [X.Y.Z] section)
• docs/ARCHITECTURE.md updated if module structure or counts changed (incl. version header)
• docs/api/API_REFERENCE.md updated if MCP / HTTP / CLI surface changed (incl. version header)
• README.md updated if user-facing features, installation, or collaboration framing changed
• README locales (README.de.md / README.zh-TW.md) re-synced if README.md changed
• Version anchors listed in CONTRIBUTING.md updated consistently if bumping a version
• dist/skills-manifest.json regenerated via npm run build (required after ANY change to .claude-plugin/, scripts/hooks/, skills/, or version files)
• memesh doctor reports Overall: PASS

No product surface, module structure or version changed, so the unticked boxes do not apply.

Verification

• npm run typecheck clean (exit=0)
• npm run build clean (step 1 of npm run verify)
• node scripts/run-tests-isolated.mjs passing (step 3 of npm run verify, exit=0)

npm run verify on the committed tree, closing lines:

[verify] ok build (4s)
[verify] ok release-gates (22s)
[verify] ok unit (196s)
[verify] ok packaged (12s)
[verify] ok dashboard-e2e (23s)
[verify] tree 0964676ffac65d848b3dfd147579e593f385f6b0 (full)
[verify] GREEN. Receipt for tree 0964676ffac6 written to .verify/receipt.json.

Re-run AFTER the commit existed (the receipt is tree-keyed, so a HEAD-dependent test could otherwise hide): six affected test files 195/195 exit=0, node --test scripts/verify.test.mjs scripts/lib/verify-core.test.mjs exit=0, node scripts/audit/verification-audit.mjs exit=0.

What is removed from the public repo, stated plainly

The AI pull-request review workflow, the hourly monitor, the post-release smoke-receipt workflow, the evals workflow, the loop workflow, the prepare script that installed git hooks into clones, and the in-repo list of required check names (the requirement itself is GitHub branch protection and is unchanged). No job in ci.yml lost a step, a condition, a matrix cell or a timeout; the published npm file list is identical (402 files).

Test plan

• node scripts/run-tests-isolated.mjs tests/audit/verification-audit.test.ts tests/gitignore-scope.test.ts --maxWorkers=1 → exit 0
• node --test scripts/verify.test.mjs scripts/lib/verify-core.test.mjs → 8 pass
• node scripts/audit/verification-audit.mjs → exit 0, every detector new=0
• Create a git-ignored file at scripts/sdlc/anything.sh, run the audit again → still exit 0; create the same file at a path that is not ignored → exit 1 naming it

Known limitations / follow-ups

• Not verified on Windows from the development machine: whether git accepts the null device (\\.\nul) as a config path, and whether the symlink regression test runs or skips there. The windows-latest legs of this PR answer both; the temp-repo commit is protected three independent ways regardless.
• Pre-existing, outside this diff: the audit's closing sentence is printed from a loop that only visits detectors that reported, so a detector that stopped reporting would not be noticed; npm run lint globs directories rather than the git tree. Both noted for a follow-up.
• .gitignore: unanchored directory patterns can hide new source from git and from the verify receipt #362 (anchoring the older, pre-existing .gitignore patterns) is not part of this change.

Coverage (one row per changed file)

Surface	QA	Review	Simplification
.claude/agents/journey-verifier.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/hooks/hooks.test.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/hooks/lib.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/hooks/pre-bash-gate.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/hooks/protect-verify-dir.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/hooks/session-start.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/hooks/stop-receipt.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/sdlc/PR_TEMPLATE.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/sdlc/prompts/build.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/sdlc/prompts/diagnose.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/sdlc/prompts/plan.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/sdlc/prompts/review.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/sdlc/prompts/spec.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.claude/settings.json (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.github/pull_request_template.md	read; one heading lost its link to the departed REVIEW.md	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	—
.github/workflows/ci.yml	job id sdlc-verify / name SDLC verify byte-identical; only its test step and the comment above it changed	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	test step narrowed to the two files that still exist here
.github/workflows/sdlc-evals.yml (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.github/workflows/sdlc-loop.yml (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.github/workflows/sdlc-monitor.yml (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.github/workflows/sdlc-release.yml (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.github/workflows/sdlc-review.yml (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
.gitignore	tests/gitignore-scope.test.ts exit=0 — departed paths ignored, nested look-alikes and future sdlc-*.yml not	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	13 root-anchored patterns; five workflow files named one by one instead of a glob
CHANGELOG.md	node scripts/check-doc-claims.mjs exit=0; npm pack --dry-run file list 402 before and after	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	—
CLAUDE.md	read; definition of done still npm run verify	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	sentences describing the departed gates removed
REVIEW.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
docs/plans/README.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
docs/plans/TEMPLATE.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
docs/plans/release-v4.10.1.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
docs/sdlc/LOOP.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
docs/specs/README.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
docs/specs/TEMPLATE.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
evals/README.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
evals/cases/no-plan-no-build.json (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
evals/cases/verify-before-done.json (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
evals/checks/consulted-receipt.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
evals/checks/mentions-plan-proof.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
evals/lib.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
evals/run.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
intent/README.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
intent/TEMPLATE.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
intent/observation-forget-survives-stop.md (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
package.json	npm run verify exit=0	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	five maintainer-only scripts and prepare removed
scripts/audit/baseline.json	node scripts/audit/verification-audit.mjs exit=0, new=0, zero stale	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	entries for departed files removed; one stale entry pruned with --prune-stale
scripts/audit/verification-audit.mjs	audit exit=0; end-to-end test with private files on disk exit=0	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	hand-written docs/internal/docs/plans prefix filter removed — the ignore filter covers it
scripts/check-doc-claims.mjs	exit=0	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	comment only
scripts/lib/git-ignored-paths.mjs	tests/audit/verification-audit.test.ts 18/18, exit=0; mutations (return all / return none / --no-index / drop a routing variable / drop the env) all red	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	—
scripts/lib/verify-core.mjs	node --test scripts/verify.test.mjs scripts/lib/verify-core.test.mjs exit=0 (8/8); two guards break-tested red	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	only what the verify runner needs was extracted
scripts/lib/verify-core.test.mjs	same run, exit=0	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	—
scripts/lib/verify-test-helpers.mjs	same run, exit=0	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	—
scripts/sdlc/agent.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/agent.test.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/bootstrap.sh (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/cli.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/git-gate.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/git-gate.test.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/git-hooks/pre-commit (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/git-hooks/pre-push (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/host.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/install-git-hooks.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/lib.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/lib.test.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/monitor.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/monitor.test.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/next-stage.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/next-stage.test.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/review.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/run-stage.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/run-stage.test.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/smoke-public.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/sdlc/smoke-public.test.mjs (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
scripts/upgrade-plugin.sh	tests/cli/upgrade-plugin*.test.ts exit=0	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	one rm -rf argument for a directory no longer tracked
scripts/verify-receipt.mjs	node scripts/verify-receipt.mjs prints a state, exit 0 fresh / 1 not	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	two imports became one
scripts/verify.config.json	field-by-field equal to the verify part of the departed config; npm run verify exit=0	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	only the keys the runner reads
scripts/verify.mjs	npm run verify exit=0	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	two imports became one
scripts/verify.test.mjs	exit=0 (8/8)	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	—
sdlc/config.json (deleted)	tests/gitignore-scope.test.ts pins the path as ignored (suite exit=0); git grep at HEAD finds no tracked referrer	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	removed from the public repo
tests/audit/verification-audit.test.ts	18/18 exit=0, also under hostile GIT_DIR / GIT_INDEX_FILE / GIT_CONFIG_PARAMETERS / GIT_TEMPLATE_DIR with a throwaway victim repo unchanged	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	—
tests/gitignore-scope.test.ts	19/19 exit=0; putting the glob back turns it red	three independent reviewers, two model families, each with a complete per-file table; final round PASS on this sha	—