Single-source the shape-check path from the template (leg 1 of #405)

[StarshipSuperjam]

A green mechanical check below shows this change conforms to the engine's rules — not that it is correct. What covers correctness is the behavioural steps in Review and your own read of the change; a green check is never a substitute for that. Your merge is the binding gate.

Purpose

Make the validator read a surface's required shape from its template, so the thing the AI authors from is the thing the validator checks — one source, no drift.

• Until now a surface's shape (which sections are required, which allowed, the length budget) lived in two places: the template frontmatter the AI writes from, and a hand-mirrored copy inlined in the check rule the validator reads. They were kept in step only by a per-surface "no-drift" test.
• This wires the validator's intended path — catalog → template → shape → instance — so the template is the single source, and adds a standing check that every template's shape settings are well-formed. It also fixes two measurement bugs in the shape check.

<Impact: a surface's shape can no longer silently diverge between what the AI writes and what the engine checks; a new or edited template with malformed shape settings is caught at the gate.>

Scope

Leg 1 of #405 (F0224, F0222, F0223, F0227, F0232).

• kind_shape now resolves a target's shape settings from its surface's catalog template reference → the template frontmatter (_template_shape_spec). The six shape rules' now-dead inlined copies are removed; the six per-surface drift tests are retired (nothing left to drift); the shape-logic tests are migrated to the template-sourced model.
• New engine/check/template-shape-spec (hard, CI) validates every template that declares shape settings against template.v1, with a negative fixture proving it bites. It catches the orphan risk-assessment.md too.
• conduct.md: its inert, instance-false shape-spec frontmatter is removed (conduct's shape is data-driven — each code's own title — and governed by conduct-shape, not a fixed-section rule).
• F0232 measurement fixes: the length budget and section detection now exclude YAML frontmatter and fenced code blocks (a ## inside a ``` block is code, not a section).

<Impact: delivers the single-source shape path and its standing guard; behaviour over the real repo is unchanged (verified below).>

Out of scope

Legs 2 and 3 of #405.

• Leg 2 — local-trigger wiring (pre-commit / pre-close / touched-file validator runs) and the operator-honesty lines. Part of #405.
• Leg 3 — the module check-kind by-presence seam. Part of #405.
• These land in later PRs; the last carries Closes #405. Split out from the originally-planned single PR to keep context and each consent surface manageable.

<Impact: this PR is the self-contained shape-path slice; the remaining legs are independent and follow separately.>

Risk

Low and behaviour-preserving; two guardrail-relevant points to note plainly.

• A deliberate, spec-faithful de-guarding (your call, already made): the authoritative shape settings move from the check rule (under the guarded .engine/check/) to the unguarded template frontmatter. So loosening a governance-critical surface's shape — e.g. dropping a contract's required Anti-choice section — would no longer trip engine-guard/an ack; it relies on the new well-formedness check plus your merge review. This follows the locked design's "shape is data, not code" intent, and you chose it over guarding the templates. Flagged on its own line so it is not lost among the mechanical changes.
• Guarded files touched → engine-guard will be red pending guardrail-ack: validate.py (the validator) and the six *-shape.json rules (edited to remove the inlined spec). Surfaced for you to apply the ack deliberately; the engine does not apply it.
• Enforcement is unchanged: all six live shape checks produce zero findings over the real repo on both this commit and its base (verified in a throwaway worktree).

<Impact: bounded to the merge gate; no generated repo behaves differently, and the guard-posture change is a disclosed, consented trade, not a silent one.>

Validation

Full suite and the CI validator are green; the change is behaviour-preserving over the real repo.

• python -m unittest discover -s tools -p 'test_*.py' -b — 3003 tests, OK (2 skipped), on the current origin/main base.
• python tools/validate.py --suite CI — passes clean with a token (the sole local red is the documented token-less artifact on an unrelated network check).
• The new template-shape-spec check is wired into the checker-of-checkers and its fixture bites; the six live shape checks are green over the real repo.

<Impact: an approver can rely on the mechanical floor being green in CI; correctness is covered by the Review below.>

Review

A four-lens cold plan-review ran before building, and a two-lens deliverable review on the built leg; verdict: conforms, no blocking or serious findings.

• Plan-gate (before build, four independent lenses): reshaped the design — most importantly, resolve the template via the catalog's existing template field rather than a duplicate pointer, and surface the shape-spec de-guarding as a decision (resolved as above).
• Deliverable-gate (on the built leg, two independent lenses — spec-conformance and technical-integrity): both ran the real code (including comparing enforcement against the base commit in a throwaway worktree). All five leg-1 criteria verified; no blocking or serious findings. Three nits, all "awareness only, no action": a test uses raw vs frontmatter-stripped section detection (immaterial — templates carry no ## in frontmatter); mixed ```/~~~ fence strictness (zero live impact — no ~~~ fences in the repo); a per-target catalog re-read (pre-existing pattern, sub-second).
• No post-review changes were made, so the reviewed and merged versions are the same.
• spec_referent.py review-steps --issue 405: "Nothing here is something you can run yourself — there's no settled description for this project yet."

<Impact: the engine's own account of the review — your merge is the binding gate.>

Files of interest

The validator's shape path and the new standing check.

• .engine/tools/validate.py — _template_shape_spec, the rewritten kind_shape, _body_without_frontmatter, fence-aware section_blocks/section_order.
• .engine/tools/template_shape_spec_check.py + .engine/check/template-shape-spec.json — the standing template-shape guard.
• .engine/templates/conduct.md and the six *-shape.json rules — the conduct fix and the stripped inlined specs.

<Impact: these determine the new single-source behaviour and its guard.>

Claude involvement

Design decisions were AI-made under a cold plan-review; edits are mechanical.

• The load-bearing judgments: routing through the catalog template field (spec-faithful single source), accepting the shape-spec de-guarding (your decision), the standing check's scope (every frontmatter-bearing template, conduct exempt), and removing conduct.md's inert spec. Recorded here and in the build record.
• Grounded in the locked templates/ontology/validation READMEs and [conformance] Wire the validation/templates layer: single-source shape-check path, local triggers, module check-kind seam, and fail-closed gates #405's F0224/F0222/F0223/F0227/F0232.

<Impact: the catalog-routing and de-guarding are the load-bearing AI judgments; the refactor and test migration are mechanical.>