boshu 8f95643b64 feat(membrane): seed 1 more real published constraint — shellcheck-disable-inline (age-tbvy) ...

Populate the constraint corpus with a real, ungated, already-followed anti-pattern
(source="standards", 0 existing violations, gate-verified enforcing):
- std-shellcheck-disable-inline (**/*.sh): a `shellcheck disable=<codes> -- comment`
  INLINE is invalid (the `--` comment must be a separate line). Regex `[ \t]+--`
  (NOT `[[:space:]]` — would cross a newline and match the valid separate-line form;
  cross-family council caught that).

DROPPED bare-except (std-python-bare-except), which the council had approved: a
verification pawl caught that a regex over WHOLE-FILE text can't distinguish a real
bare `except:` statement from one in a docstring / triple-quoted string / code
example — so a BLOCKING gate would false-positive a legit push. Distinguishing them
needs a Python AST, not a regex; bare-except is not a sound regex-gate rule. (Kept
nosemgrep + shellcheck-inline, where the pattern rarely appears in strings.)

The published surface now enforces 2 real repo rules (with qualified-nosemgrep from
age-az6n). Verified: clean repo + a docstring containing `except:` PASS; a
shellcheck-inline / qualified-nosemgrep violation FAILs.

Bead: age-tbvy

2026-06-22 10:42:51 -04:00

..

published.json

feat(membrane): seed 1 more real published constraint — shellcheck-disable-inline (age-tbvy)

2026-06-22 10:42:51 -04:00