the private path is exercised, and the guardrail stops crying wolf

Closes the last unexercised assumption with a throwaway token: partial clone over
HTTPS with a token against a private repository, list through the tool, the
short-form raw URL redirecting to a resolved branch under auth, and a conditional
request returning 304 across that redirect. A private repository can adopt from
another private one, by name or by URL, and check works off the lock afterwards.

Fixes what would have shipped as noise. The warning fired whenever a fetch needed a
credential, which in a private repository adopting from a private repository is
every time and legitimate. add now resolves origin and makes one anonymous request
to learn whether this repository is public, so the warning fires when the source is
private and the destination is not. The limit is stated in the message rather than
implied away: the signal tells public from not-public and nothing finer, so two
repositories private to different people is the case that genuinely widens access
and the one this cannot see. No origin means cannot tell, which warns — cannot tell
must never read as not public.

Notes when an adopted document did not come from .loom/published/, without
refusing. What is not exported is not hidden, but a lock against it records a
dependency on something that was never a contract.

And records the framing that settles all of this: the tool is a mast, not a lock.
It grants no access, everything it does is possible with copy and paste, and the
locks mean nothing outside the tool and the discipline of the agreement — so it
makes the wrong thing deliberate rather than impossible. What it adds over a paste
is not restriction but provenance.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

internal/external/visibility.go

@@ -0,0 +1,97 @@
+package external
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"os/exec"
+	"strings"
+)
+
+// selfVisibility reports whether the repository we are adopting into can be read
+// anonymously.
+//
+// This is the half of the confidentiality rule the tool was previously blind to.
+// Knowing only that a source is private makes the warning fire on every adoption
+// a private repository performs, which is the legitimate case — and a warning
+// that always fires is a warning nobody reads.
+//
+// The signal is coarse on purpose. It distinguishes public from not-public and
+// nothing finer, so it cannot see that two repositories are private to different
+// groups. That case widens access and this check will miss it.
+func selfVisibility(root string) (public bool, known bool) {
+	out, err := exec.Command("git", "-C", root, "remote", "get-url", "origin").Output()
+	if err != nil {
+		return false, false
+	}
+	host, ownerRepo, ok := splitRemote(strings.TrimSpace(string(out)))
+	if !ok {
+		return false, false
+	}
+	req, err := http.NewRequest(http.MethodHead, "https://"+host+"/"+ownerRepo, nil)
+	if err != nil {
+		return false, false
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return false, false
+	}
+	defer resp.Body.Close()
+	return resp.StatusCode == http.StatusOK, true
+}
+
+// splitRemote pulls a host and owner/repo out of a git remote, whether it is
+// ssh, ssh:// or https.
+func splitRemote(remote string) (host, ownerRepo string, ok bool) {
+	s := remote
+	if i := strings.Index(s, "://"); i >= 0 {
+		s = s[i+3:]
+	}
+	if at := strings.Index(s, "@"); at >= 0 {
+		s = s[at+1:]
+	}
+	// scp-style "host:owner/repo.git" and url-style "host:port/owner/repo.git"
+	var rest string
+	if i := strings.IndexAny(s, ":/"); i >= 0 {
+		host, rest = s[:i], s[i+1:]
+	} else {
+		return "", "", false
+	}
+	if j := strings.Index(rest, "/"); j >= 0 && isPort(rest[:j]) {
+		rest = rest[j+1:]
+	}
+	rest = strings.TrimSuffix(strings.Trim(rest, "/"), ".git")
+	if host == "" || strings.Count(rest, "/") != 1 {
+		return "", "", false
+	}
+	return host, rest, true
+}
+
+func isPort(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, r := range s {
+		if r < '0' || r > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+// notePublishedSurface says when an adopted document did not come from the
+// publisher's published surface.
+//
+// What is not exported is not hidden — the rest of a repository is there to read.
+// It is simply not what you depend on, and a lock against it records a dependency
+// on something that was never a contract.
+func notePublishedSurface(rawURL string, out interface{ Write([]byte) (int, error) }) {
+	if strings.Contains(rawURL, "/"+PublishedDir+"/") {
+		return
+	}
+	var b bytes.Buffer
+	fmt.Fprintf(&b, "  NOTE   not from %s — what is not exported is not hidden, but it is\n", PublishedDir)
+	fmt.Fprintf(&b, "         not what you depend on. Nothing promises this path will still\n")
+	fmt.Fprintf(&b, "         be there, or still mean this, tomorrow.\n")
+	out.Write(b.Bytes())
+}