fix(checks): give every tracked text file LF on checkout

.gitattributes

@@ -1,16 +1,12 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-# test/starter-prompt-docs.test.ts asserts the exact working-tree bytes of these
-# files: the starter-prompt generator rejects a carriage return, the prompt
-# assets are byte-compared against their pinned Git blobs, and
-# local-credential-form.html is compared against the SHA-256 that users verify
-# before they run the local credential helper. A core.autocrlf checkout would
-# rewrite them and break those contracts, so pin the line endings here.
-/docs/resources/starter-prompt.md text eol=lf
-/docs/resources/prompt-assets/*.md text eol=lf
-/docs/resources/local-credential-form.html text eol=lf
-/tools/e2e/contracts/v1/jetson-dispatch.json text eol=lf
+# Repository checks and tests compare tracked files byte-for-byte against
+# pinned digests. The starter-prompt generator rejects a carriage return. A
+# Windows checkout with core.autocrlf=true rewrites those files to CRLF. The
+# checks then fail before a contributor changes a file.
+# text=auto keeps Git's binary detection, so Git does not convert a binary file.
+* text=auto eol=lf
 
 /skills/nemoclaw/** linguist-generated=true
 /skills/nemoclaw/**/*.md diff=markdown

CONTRIBUTING.md

@@ -98,21 +98,6 @@ Install the following before you begin.
 - Docker (running)
 - [hadolint](https://github.com/hadolint/hadolint) (Dockerfile linter — `brew install hadolint` on macOS)
 
-### Windows Line Endings
-
-`.gitattributes` pins the files whose exact bytes the repository checks assert, so a new clone keeps LF even when `core.autocrlf` is `true`.
-
-Git does not rewrite a file that is already in your working tree.
-If you cloned before that rule existed, the file keeps CRLF, `git status` reports no change, and `npm run checks:repository` reports `use LF line endings`.
-
-Commit or stash your work first, because the next commands discard uncommitted changes.
-Then normalize the checkout once:
-
-```bash
-git rm --cached -r .
-git reset --hard
-```
-
 ## Getting Started
 
 From the repository root, prepare the checkout with one command:
@@ -407,6 +392,27 @@ CI runs the complete type-check gates independently; local path selection is a f
 
 If you still have `core.hooksPath` set from an old Husky setup, Git will ignore `.git/hooks`. Run `git config --unset core.hooksPath` in this repo, then `npm install` so `prek install` (via `prepare`) can register the hooks.
 
+If you cloned this repo on Windows before `.gitattributes` set `* text=auto eol=lf`, your working tree can still contain CRLF line endings.
+The rule now keeps every tracked text file on LF while Git continues to detect binary files automatically.
+These line endings cause repository checks to fail.
+
+Warning: `git reset --hard` discards tracked changes.
+Commit all changes, or stash tracked and untracked changes with `git stash push --include-untracked`.
+Run `git status --short`, and continue only if the command produces no output.
+From the root of this repo, remove tracked files from the Git index:
+
+```bash
+git rm --cached -r .
+```
+
+Then restore the Git index and working tree from the current commit:
+
+```bash
+git reset --hard
+```
+
+Git checks out tracked text files with LF line endings.
+
 `npm run checks:repository` runs only the custom checks collected under `scripts/checks`; lint and the repository-check hook use it internally. The `npm run checks` alias remains available for compatibility and prints the canonical routine and narrow command names before delegating.
 
 `npm run check` is the whole-repository pre-commit and full CLI/plugin coverage baseline for broad changes to hooks, formatters, generated checks, or shared validation behavior.

test/starter-prompt-docs.test.ts

@@ -1338,9 +1338,8 @@ describe("starter prompt checkout line endings", () => {
     expect(readCheckoutEol(relativePath)).toContain(`${relativePath}: eol: lf`);
   });
 
-  // Asserts only the absence of the LF pin. Asserting "unspecified" would also
-  // forbid a repository-wide "* text=auto" rule, which is unrelated policy.
-  it("leaves a file without a byte-exact contract unpinned (#8648)", () => {
-    expect(readCheckoutEol("docs/resources/agent-skills.mdx")).not.toContain("eol: lf");
+  it("checks out a representative tracked text file with LF (#8648)", () => {
+    const relativePath = "docs/resources/agent-skills.mdx";
+    expect(readCheckoutEol(relativePath)).toContain(`${relativePath}: eol: lf`);
   });
 });