hardening: freeze residual legacy scratch by exact blob identity

scripts/check_repository_hygiene.py

@@ -6,7 +6,7 @@ import sys
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
-BLOCKED_PREFIXES = (".codex-input/", ".codex-artifacts/")
+BLOCKED_PREFIXES = (".codex-artifacts/",)
 BLOCKED_SUFFIXES = (".db-wal", ".db-shm")
 LARGE_FILE_LIMIT = 20 * 1024 * 1024
 LARGE_FILE_ALLOWLIST_PREFIXES = (
@@ -15,6 +15,40 @@ LARGE_FILE_ALLOWLIST_PREFIXES = (
     "frontend/public/portfolio/",
     "output/pdf/",
 )
+LEGACY_CODEX_INPUT_BLOBS = {
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_licht_thema/code.html": "c88a8a0efb15cfd14c2e8e2ed7f5696cc9f20ce1",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_licht_thema/screen.png": "c2963e261fe2f1ca1e6cd1ea75d7bc5ff83fb987",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel/code.html": "989258e23a185c071e2ab11ba2971b265e7009ce",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel/screen.png": "79cf81d82260776c5672db4668b56b7074a071ed",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel_definitief/code.html": "b5eae728298e6a983e381097a1e0f5d24a4141f6",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel_definitief/screen.png": "0a2b3a0bb0cafdf186f715cfa91a5aca918e0756",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht/code.html": "56d03a4737e77fab6b3597f9058a2815a703fd19",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht/screen.png": "9704ddc764d2fc3c69410ba735d65500d6961909",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht_definitief/code.html": "f5a5f6ac2811f92a3d8f2eb7b027bdc9ac34a219",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht_definitief/screen.png": "5d700e451de80a9449b968101933b06226870d66",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_definitief_logo/screen.png": "e01d27618ff1583a76614d6a714d036d938b33e0",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_quick_launch_definitief/code.html": "c9d71c2a0d335922af956f8eb07f65f2a8edd584",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_quick_launch_definitief/screen.png": "dcb36ef137393e91a4122695dfb6a7c688aebb3b",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_zoeken/code.html": "678869ade78ce6423bd96a360f5515e0d1a00e54",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_zoeken/screen.png": "e253bd38bfa462fa7537988153a3f259fe02a7f0",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_app_editor_definitief/code.html": "eca901c78c0cd6d267a9e713249bf9707da635a5",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_app_editor_definitief/screen.png": "eb83c7df7154864ba255f53813770b2bfd089c25",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_apps_beheren_definitief/code.html": "c12e25f411fdbd9627c63e4d5b8ea3a1ef9060dc",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_apps_beheren_definitief/screen.png": "cade3f21d441b173e1a0d06e9cdee644f52d9029",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_back_up_definitief/code.html": "a4ca7e58f1dc416508abe7ed8e04417f766879dd",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_back_up_definitief/screen.png": "e1b448ce07a21ed6db7949b3aa73bef760834aa7",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_categorie_n_definitief/code.html": "3d527c4573ea6faa68ce61e237056a4be8d0483a",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_categorie_n_definitief/screen.png": "d162dfcb410e03e3958d36a78523a405ca380ad6",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_favorieten_definitief/code.html": "b9667a198f10ff98e1094ae2582c4f711b0f0e26",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_favorieten_definitief/screen.png": "a94da2e1c139156a4f318f9cf5db0b1178e9379c",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties/code.html": "4688fb1040a48fb75cc50b99a02a07e33e4a3c63",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties/screen.png": "3877e8c894ac2aa0aa13ffeec7be0a294d95e9aa",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties_definitief/code.html": "ed4deee5fa38c3ed42664d4e51eb4361378b6218",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties_definitief/screen.png": "78a561655467a34dd82d07081206e9546d81e114",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_weergave_definitief/code.html": "c493317031e6b034cbf5dff5d14aae5de64ea60a",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_weergave_definitief/screen.png": "ae5e98bc1ae3071f6ee2f90640226d72695bd9c8",
+    ".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/obsidian_control/DESIGN.md": "307f98d873009fb9b803186959ba7a67f073610a",
+}
 
 
 def tracked_files() -> list[str]:
@@ -27,10 +61,34 @@ def tracked_files() -> list[str]:
     return [item for item in result.stdout.decode("utf-8").split("\0") if item]
 
 
+def git_blob_sha(path: Path) -> str:
+    result = subprocess.run(
+        ["git", "hash-object", str(path)],
+        cwd=ROOT,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return result.stdout.strip()
+
+
 def main() -> int:
     violations: list[str] = []
     for relative in tracked_files():
         normalized = relative.replace("\\", "/")
+        path = ROOT / relative
+
+        if normalized.startswith(".codex-input/"):
+            expected_sha = LEGACY_CODEX_INPUT_BLOBS.get(normalized)
+            if expected_sha is None:
+                violations.append(f"{normalized}: local agent scratch must not be tracked")
+                continue
+            if not path.is_file() or git_blob_sha(path) != expected_sha:
+                violations.append(
+                    f"{normalized}: frozen legacy scratch changed; delete it instead of modifying it"
+                )
+            continue
+
         if normalized.startswith(BLOCKED_PREFIXES):
             violations.append(f"{normalized}: local agent scratch must not be tracked")
             continue
@@ -38,7 +96,6 @@ def main() -> int:
             violations.append(f"{normalized}: transient database state must not be tracked")
             continue
 
-        path = ROOT / relative
         if not path.is_file():
             continue
         size = path.stat().st_size