[PROOF-P1-S1] Build the publish guard

[d6veteran]

Stage P1-S1 of the staged plan docs/plan/2026-10-12-any-document-as-a-proof.md.

What it adds

scripts/proof-guard.py, run inside the project on one file: python3 scripts/proof-guard.py <file>.

Status	Meaning
0	The file may be published as a proof. Nothing is printed.
1	Refused. One sentence on stdout names the reason and repeats nothing from inside the file.
other	The guard could not answer: one line on stderr. Never a refusal, never a yes.

A path is read from the folder the command runs in, and where it leads counts, not how it is spelled: a link is judged by the file at its end, and on a file system that ignores case a path in another case leads to the same file.

Refused, in this order: outside the repository; not there, or a folder; inside .ck/ (the run cache) or .git/; written by a pipeline command (the nine documents /ck:next looks for, each named with its command, and anything under docs/plan/, named /ck:plan); ignored by git; not a .md file; not UTF-8 text; no words. The file is opened only for the last two, so a file refused for where it is or for its name is never read.

Two choices for the security read (P2-S1): a tracked file that matches an ignore rule counts as not ignored, which is git's own answer (check-ignore without --no-index); and .git/ is refused by path, since git does not report a file inside it as ignored.

Checks

tests/pending/P1-S1.sh moves to tests/checks/. The nine checks it was given are as they were, except that the link check now asks for the reason at the link's end instead of any reason. Eight are added for the choices the nine leave open: status 1 for a missing path or a folder and a failure for no file or two; an absolute path and one that wanders; a link to a folder, and a link judged by its end; a file holding only a byte order mark; a one-line sentence for a name with a line break in it; a plan deeper under docs/plan/; a path in another case; a file inside .git/; and that an unreadable file is still refused for where it is or for its name.

No tests/fixtures/guard/ folder was made: the check file builds its repository at run time, since a file git ignores and a file outside the repository cannot be committed as fixtures.

Tested

• bash tests/run.sh: 526 passed, 0 failed, 40 waiting for their three stages; Ruff clean over the five Python files.
• The check file against a stub guard that accepts everything: 16 of 17 fail. Against one that refuses everything without a reason: 16 of 17 fail (the one that passes is the plain accept check, as it should).

🤖 Generated with Claude Code