Generates .loom/orientation.md — what this repository depends on, where each copy
came from, and which facets sit beside it — for whoever arrives next, of any make.
One file rather than two, decided by loom's own rule. Generate what varies, adopt
what does not: the publishing half varies not at all and is already adopted, so
publication.md appears in the index like any other adopted document, in exactly the
repositories that adopted it. A second command would emit a file whose whole content
is a pointer to a file already in the tree, and would revive a noun declined when
published check went.
Restates no rule. The three moves are phrased as operations — what to run, what to
write, where — and every rule stays in the document that owns it. The .usages.md is
pointed at rather than summarised, because what depends on a document is free prose
and anything extracting a claim from prose eventually extracts it wrong. It says
nothing recorded when a document has no usages file, which is a finding rather than
an omission and is currently true of six of nine.
Byte-deterministic, pinned by a test that inserts records out of order and
generates three times. Written to .loom/orientation.md rather than inside
.loom/externals/, where check would report it as an unlocked external in every
repository using the feature.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
Closes the last unexercised assumption with a throwaway token: partial clone over
HTTPS with a token against a private repository, list through the tool, the
short-form raw URL redirecting to a resolved branch under auth, and a conditional
request returning 304 across that redirect. A private repository can adopt from
another private one, by name or by URL, and check works off the lock afterwards.
Fixes what would have shipped as noise. The warning fired whenever a fetch needed a
credential, which in a private repository adopting from a private repository is
every time and legitimate. add now resolves origin and makes one anonymous request
to learn whether this repository is public, so the warning fires when the source is
private and the destination is not. The limit is stated in the message rather than
implied away: the signal tells public from not-public and nothing finer, so two
repositories private to different people is the case that genuinely widens access
and the one this cannot see. No origin means cannot tell, which warns — cannot tell
must never read as not public.
Notes when an adopted document did not come from .loom/published/, without
refusing. What is not exported is not hidden, but a lock against it records a
dependency on something that was never a contract.
And records the framing that settles all of this: the tool is a mast, not a lock.
It grants no access, everything it does is possible with copy and paste, and the
locks mean nothing outside the tool and the discipline of the agreement — so it
makes the wrong thing deliberate rather than impossible. What it adds over a paste
is not restriction but provenance.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
The config becomes kubectl-shaped — named contexts with one current, each holding a
host, its flavor and a read-only token — and a bare owner/repo resolves against it.
The point is where the details live: a host's raw-file route belongs to the host so
it sits in the context, the published directory belongs to the convention so it
sits in the code, and what is left is which repository and which document, which is
the only part a person knows.
Measured rather than assumed, because the three hosts differ. Gitea redirects its
short raw form to the resolved branch, so the lock records a branch without anybody
naming one. GitHub and GitLab accept HEAD and do not redirect, which would put a
moving ref in the lock — the hazard already recorded and nearly built anyway — so
those resolve the default branch with git ls-remote --symref first, one round trip
and no clone.
That supersedes the claim that list is the only command needing git, which is now
wrong for two of three flavors and would otherwise read as still true.
Adds loomctl config, which says which context is current and where the credential
came from without printing it, so that "my token is not being used" is answerable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
The whole loop ran on a real change with a cart open for the first time: check
staged externals.md as a polad, apply moved it and its lock, and the new
confidentiality rule arrived through the tool rather than through somebody saying
so.
Answers loom's completeness case. A 200 says the document moved and nothing about
whether the casting still covers it — but the mechanism exists and we had not
built the thing it needs. check prints the document's .usages.md when it stages a
polad, and for an agreement that is the file the roles are cast in. It failed here
because externals.md had no facet at all. So both are written: externals.usages.md
naming which Go file implements which rule, and a v1 section on cart.usages.md
recording the casting, that we got it wrong before it was written down, and that
osprey and marmalade stay in history unrewritten.
Implements the adopted confidentiality rule as far as it can be implemented. add
warns when a fetch needed a credential, and says plainly that it cannot see who may
read the repository the copy lands in. Reference-only adoption is recorded as not
yet implemented rather than as a gap, because the gap is ours.
Adopts gitea.md, now that homelab-cluster is public — the document that cost three
tool calls and a guess this morning, with a facet recording that its :2222 fact is
a fact for people and not for the tool, whose every transport is HTTPS on 443.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
Restores something the specimen said and the round that discarded the specimen
lost with it: a changed external becomes a polad in the cart, and somebody
decides. check now stages what moved into .loom/cart/current/polad/ with the ETag
that was served alongside the bytes, and prints the .usages.md beside it, because
reconciliation runs the other way — the facets usually survive and what moves is
the code a usage named. It says so when there is no usages file, which is its own
finding.
With no cart open, check reports and stages nothing. The tool does not open a
round: a cart is a bounded exchange between two presences and starting one is
somebody's act, not a side effect of asking about freshness.
add now adopts what is not here and refuses what is already adopted, superseding
the entry that had it announce an overwrite — it no longer overwrites at all. The
one exception is the only way out of a dead end: a document present but unlocked
was fetched by hand, nothing records its origin, and the path does not round-trip,
so check cannot ask about it and a refusal would strand it forever. add accepts it
and the bytes decide — identical locks it without rewriting anything, which makes
the lock's assertion verified rather than assumed, and different stages a polad and
leaves the local copy alone because it is the only evidence anything moved.
apply exists because the lock is the half a person forgets: moving a polad by hand
leaves a lock describing the copy you just replaced. Recorded with its limit —
for an external, discard does not mean the change goes away, so discarding is
really knowingly stale and nothing yet records that choice.
Measured end to end on this repository: eight hand-fetched documents, all eight
locked, nothing rewritten.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
Go, standard library only, with git shelled out for list alone. list enumerates a
publisher's .loom/published by partial clone and ls-tree; add fetches one document,
writes it under .loom/externals and records the resolved origin and the publisher's
ETag in .loom/externals/.locks; check asks conditionally and reports.
The first real run did what the tool exists for. All eight documents adopted by
hand before it existed reported unlocked — the tool refuses to invent a lock by
adopting whatever the remote currently serves, since that would assert the local
copy is the one being served, which is the thing it was about to check. Locking
them fetched two that had moved: bedrock/starting.md, which now says the worked
example is private and will not link to something you cannot fetch, and cart.md,
which went to v1.
cart v1 changes a role we cast: a cart is not committed, because a committed cart
grows a third file by itself — version control does not require anybody to ask, so
the two-file rule is never invoked — and because ignored, gone means gone. Adds
.loom/cart/ to .gitignore and supersedes the isolation entry rather than editing
it. osprey and marmalade are already in history and are left there: rewriting to
honour a rule adopted afterwards costs more than it buys.
Records the conflict this creates rather than settling it: the annotation protocol
here says commit before dissolving because git is the only archive, and an ignored
cart has no archive, so dissolving would destroy the annotations outright.
Credentials are read-only, per host, and passed to git through the environment
rather than argv, because argv is visible to every process on the machine.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
jeffryandClaude Opus 5