bc-khoe.27.10: B7e-shipcheck — What this branch actually ships

[mordam]

Adds b7e-shipcheck (bc-khoe.27.10): one call that answers "what does this branch
actually ship, and would bin/deliver.js refuse it right now" — the question five prior
sessions (bc-khoe.27.5, bc-fh0sz, bc-xl7n.109, bc-gdub, bc-khoe.27.7) each answered by
hand, with a different git incantation each time, twice only finding out about a real
refusal after the delivery summary was already written.

lib/shipcheck.js resolves the base as a merge-base against a freshly fetched
origin/<base> (never a bare main...HEAD, which is exactly what read empty for
bc-gdub.1 against a stale local main), then reports the committed diff against that
base and reproduces bin/deliver.js's own three guard clauses verbatim — detached HEAD,
branch-equals-base, a dirty working tree — so the sentence this prints is the sentence
the real refusal would print, before a session has written a word of delivery prose.
bin/b7e-shipcheck is the thin CLI (--base, --dir, --json, -b for a cosmetic bead
label), the same split lib/blame.js/bin/b7e-blame already use.

Chose NOT to replicate lib/conflicted.js's inspectBranch (committed merge-conflict
markers, an unparseable commit) — that's a check on the committed blobs deliver.js runs
after these two, and a different question from "what does this branch ship and is the
tree clean enough to ship it"; the bead's own Returns section didn't ask for it either.
Also did not add a literal "here's the deliver.js invocation to run" printout — the
acceptance criteria's "prints an invocation that succeeds once it is gone" reads as the
same b7e-shipcheck call itself going from a refusal to a clean verdict, not a new
feature to generate a shell command, and the Command's own Returns spec doesn't mention
one.

Wired the usual four registrations: package.json + package-lock.json bin entries,
Bash(b7e-shipcheck:*) on DEFAULT_TOOL_LIST in lib/toolbelt.js (plus the matching
lib/grants.js {kind:'read'} classification test/grants.mjs enforces), a README section,
and test/b7eshipcheck.mjs — pure checks against deliverVerdict() plus real throwaway-git-repo
checks (bare origin + working clone/clone, same shape test/blame.mjs uses) proving: the
dirty-tree case names the offending file and clears once it's gone; the branch-equals-base
case refuses instead of printing a main-into-main invocation; and a checkout with no local
main ref at all (only origin/main) still resolves correctly where a bare
git diff main...HEAD throws outright.

Two sibling sessions are also editing lib/toolbelt.js right now (bc-68ou.14, bc-68ou.15) —
checked their diffs before editing; both land in different regions of the file (a
"NOT on this list" comment block, and a b7e-unlanded entry near b7e-brief), and mine is a
third, separate insertion right after b7e-owes, so a merge conflict there is unlikely but
worth flagging in case two of these land in the same sweep.

Tests: node bin/b7e-gate --log /tmp/shipcheck-gate.log — all 421 suites passed (full parallel gate, ~run of scripts/test.mjs's whole discovered set); also ran node test/b7eshipcheck.mjs (7 CLI checks + unit/fixture checks) directly, and node bin/b7e-shipcheck itself against this branch to confirm its own verdict reads clean.

Files changed — 8 files · +642 −0 · against `main`

test/b7eshipcheck.mjs  +315 −0
lib/shipcheck.js       +164 −0
bin/b7e-shipcheck      +98 −0
README.md              +55 −0
lib/toolbelt.js        +7 −0
lib/grants.js          +1 −0
package-lock.json      +1 −0
package.json           +1 −0

---

Opened by a beadcause worker session on bc-khoe.27.10 — b7e-shipcheck — What this branch actually ships, and whether the delivery will be refused. It merges itself once the checks report; merging is what closes the bead. If this is still open, something stopped that, and the reason is on bc-khoe.27.10 and in Adam's inbox.

bead: bc-khoe.27.10

[mordam]

A beadcause worker opened this and does not merge its own work. It is on the merge queue as bc-xkv7r.

[mordam]

The beadcause merge queue tried to merge this and could not: it has been tried 3 times and stopped at the same place each time. the branch still conflicts with main and no resolver is on it any more — the window that was opened on it ended without making it mergeable, so this one is yours to settle. Tried 3 times — that was the last. It is Adam's call now — see bc-xkv7r.

[NeanderthalMan]

beadcause-resolver: stood down — worktree-b7e-shipcheck-khoe2710 is locked by another live resolver window (resolver pid 91804 #644, started 08:25 ADT and still running in ps). I did not touch the tree or its lock; that session owns this resolution.