Remove obsolete Python script allowlists from gitignore

.gitattributes

@@ -20,6 +20,12 @@
 .gitignore merge=generated-artifact
 DESIGN.md merge=generated-artifact
 ROADMAP.md merge=generated-artifact
+dag/examples/js_site/generated/about.html merge=generated-artifact
+dag/examples/js_site/generated/about.tsx merge=generated-artifact
+dag/examples/js_site/generated/browse.html merge=generated-artifact
+dag/examples/js_site/generated/browse.tsx merge=generated-artifact
+dag/examples/js_site/generated/home.html merge=generated-artifact
+dag/examples/js_site/generated/home.tsx merge=generated-artifact
 dag/gunbc/stage0/stage0_crate_layout_generated.dag merge=generated-artifact
 dag/gunbc/stage0/stage0_crate_partition_generated.dag merge=generated-artifact
 docs/plans/budget-tree.md merge=generated-artifact

.gitignore

@@ -1,135 +1,157 @@
-# gunbc .gitignore — generated from dag/gunbc/gitignore_authority.dag — do not hand-edit.
+# gunbc .gitignore — generated from gunbc.repo_workspace via gunbc.gitignore_emit — do not hand-edit.
 #
-# Rule: Ignore anything that is (a) reproducible from committed source-of-truth files, or (b) environment-specific and not shared across developers.
+# Every pattern is declared by its producer (an extdeps product's workspace footprint, or a repo tool's own declaration) with its meaning and a typed ignore reason; the trailing section is derived from gunbc.generated_artifact commit policy.
 
-# --- Cargo build artifacts (from cargo) ---
-# Reproducible from source via cargo build
+# --- Cargo build artifacts [cited: doc.rust-lang.org/cargo/] ---
+# regenerable from committed source — cargo build output tree (compiled artifacts, incremental state)
 /target/
+# regenerable from committed source — cargo build output tree (compiled artifacts, incremental state)
 /target-codex/
-
-# --- Cargo cache (local CARGO_HOME) (from tool/rust) ---
-# Local Cargo cache may include git checkouts; not project state
+# local cache; not project state — CARGO_HOME registry/cache; may include git checkouts
 /.cargo-home/
 
-# --- Codegen bin symlink (from codegen) ---
-# Symlink to target/release created by codegen
-/bin/
-
-# --- Coverage reports (from cargo-tarpaulin) ---
-# Generated, often large, reproducible
+# --- Coverage reports (cargo-tarpaulin) [cited: github.com/xd009642/tarpaulin] ---
+# regenerable from committed source — HTML coverage report (--out Html)
 tarpaulin-report.html
+# regenerable from committed source — JSON coverage report (--out Json)
 tarpaulin-report.json
+# regenerable from committed source — Cobertura XML coverage report (--out Xml)
 cobertura.xml
+# regenerable from committed source — LCOV coverage report (--out Lcov)
 lcov.info
+# regenerable from committed source — repo-chosen coverage output directory
 /coverage/
 
 # --- JetBrains IDE project state [cited: jetbrains.com/idea] ---
-# Per-developer configuration, not project state
+# per-developer state; not shared — per-project IDE workspace configuration
 .idea/
 
 # --- VS Code workspace state [cited: code.visualstudio.com] ---
-# Per-developer configuration, not project state
+# per-developer state; not shared — per-folder workspace settings
 .vscode/
 
 # --- Vim editor state [cited: vim.org] ---
-# Per-developer configuration, not project state
+# per-developer state; not shared — swap file for an open buffer
 *.swp
+# per-developer state; not shared — secondary swap file
 *.swo
 
 # --- Emacs backup convention [cited: gnu.org/software/emacs] ---
-# Per-developer configuration, not project state
+# per-developer state; not shared — backup of an edited file
 *~
 
-# --- Generic editor backup files [cited: cross-editor backup convention] ---
-# Per-developer configuration, not project state
-*.bak
-
 # --- macOS Finder metadata [cited: developer.apple.com (Finder metadata)] ---
-# OS-generated, not project state
+# host OS metadata; not project state — Finder folder-view metadata
 .DS_Store
 
 # --- Windows Explorer cache [cited: microsoft.com (Explorer thumbnail cache)] ---
-# OS-generated, not project state
+# host OS metadata; not project state — Explorer thumbnail cache
 Thumbs.db
 
-# --- tmux terminal multiplexer logs [cited: github.com/tmux/tmux (pipe-pane log naming)] ---
-# Session log; not project state
+# --- tmux pipe-pane session logs [cited: github.com/tmux/tmux (pipe-pane)] ---
+# session/runtime state; not source-of-truth — captured pane output from a local session
 tmux-*.log
 
 # --- Secrets and local config [cited: github.com/motdotla/dotenv] ---
-# Environment-specific, may contain secrets
+# may contain secrets; never committed — environment-specific configuration, commonly secrets
 .env
+# may contain secrets; never committed — local override of .env
 .env.local
+# may contain secrets; never committed — per-environment local overrides
 .env.*.local
 
-# --- Generator stamp files (from generators) ---
-# Producer-centric model stamps
+# --- npm installed dependency tree [cited: docs.npmjs.com/cli/configuring-npm/folders] ---
+# regenerable from committed source — installed packages materialized from the lockfile
+node_modules/
+
+# --- CPython bytecode cache [cited: python.org/peps/pep-3147] ---
+# regenerable from committed source — PEP 3147 per-directory bytecode cache
+__pycache__/
+# regenerable from committed source — compiled bytecode (legacy layout)
+*.pyc
+
+# --- Codegen bin symlink [owner: gunbc.repo_workspace] ---
+# regenerable from committed source — symlink to target/release created by codegen
+/bin/
+
+# --- Generator stamp files [owner: gunbc.generated_artifact] ---
+# regenerable from committed source — producer-centric generator stamps
 .*-stamp
 
-# --- Workflow runtime state (from workflow) ---
-# Local execution ledger and config; not source-of-truth
+# --- Workflow runtime state [owner: v2.workflow.required_floor] ---
+# session/runtime state; not source-of-truth — local execution ledger and config
 /.gunbc/
 
-# --- testgen outputs (from testgen) ---
-# Generated by testgen; not source-of-truth
+# --- testgen outputs [owner: v1.10_test] ---
+# regenerable from committed source — tests generated by testgen; not source-of-truth
 src/v1/10_test/generated-tests/src/generated/
 
-# --- Node.js [cited: github/gitignore/Node.gitignore] ---
-# Not part of this project
-node_modules/
-
-# --- Claude Code session state ---
+# --- Claude Code session state [cited: code.claude.com] ---
+# session/runtime state; not source-of-truth — per-clone agent session state
 .claude/
 
-# --- Stage0 regeneration temp dirs ---
+# --- Stage0 regeneration temp dirs [owner: v1_compiler.required_regen_host] ---
+# regenerable from committed source — regen input snapshot
 .regen-sources/
+# regenerable from committed source — regen emitted candidate
 .regen-output/
+# regenerable from committed source — regen generated source root
 .regen-generated-source-root/
+# regenerable from committed source — staleness-check scratch tree
 .freshness-check/
 
-# --- Interactive auth/session transcripts ---
-# Should never be committed; may contain OAuth URLs or session state
+# --- Interactive auth/session transcripts [owner: gunbc.auth.credentials] ---
+# may contain secrets; never committed — interactive auth transcript; may contain OAuth URLs or session state
 out.txt
 
-# --- OpenClaw workspace artifacts ---
-# The OpenClaw control plane lives in ~/ctrl, not in this repo
+# --- OpenClaw workspace artifacts [owner: gunbc.repo_workspace] ---
+# session/runtime state; not source-of-truth — OpenClaw control dir; the control plane lives in ~/ctrl, not this repo
 /.openclaw/
+# session/runtime state; not source-of-truth — OpenClaw agent roster projection
 /AGENTS.md
+# session/runtime state; not source-of-truth — OpenClaw heartbeat projection
 /HEARTBEAT.md
+# session/runtime state; not source-of-truth — OpenClaw identity projection
 /IDENTITY.md
+# session/runtime state; not source-of-truth — OpenClaw soul projection
 /SOUL.md
+# session/runtime state; not source-of-truth — OpenClaw tools projection
 /TOOLS.md
+# session/runtime state; not source-of-truth — OpenClaw user projection
 /USER.md
+# session/runtime state; not source-of-truth — OpenClaw workboard projection
 /WORKBOARD.md
+# session/runtime state; not source-of-truth — OpenClaw-managed scripts dir
 /scripts/openclaw/
+
+# --- v2 compiler inspect output [owner: gunbc.repo_workspace] ---
+# session/runtime state; not source-of-truth — v2 compiler inspect output
 .v2-inspect
+# session/runtime state; not source-of-truth — v2 compiler inspect error output
 .v2-inspect-errors.txt
 
-# --- GitHub CLI local cache (dashboard / gh API) ---
+# --- GitHub CLI local cache [owner: gunbc.repo_workspace] ---
+# local cache; not project state — local gh API response cache (dashboard tooling)
 .gh-cache/
 
-# --- Python local dev scripts ---
-# Python is used only for local dev tooling; never committed to the .dag/.rs substrate
+# --- Python local dev scripts [owner: gunbc.repo_workspace] ---
+# outside the committed substrate — local dev tooling only; never committed to the .dag/.rs substrate
 *.py
-!docs/plans/witness-subject-execution-audit.py
-!docs/probes/e0369_b1_operator_classify.py
-!docs/probes/floor_cut_name_resolution_partition.py
-!docs/probes/shadow_direct_call_arg_conformance_2026-08-22/summarize.py
-!docs/probes/shadow_direct_call_arg_conformance_2026-08-22/adjudicate.py
-!docs/probes/shadow_direct_call_arg_conformance_2026-08-22/join_board.py
-!docs/probes/e0308_classify_sites.py
-
-# --- CPython bytecode cache (PEP 3147) [cited: python.org/peps/pep-3147] ---
-__pycache__/
-*.pyc
 
-# --- claim-corpus execution-map output ---
+# --- Generic editor backup files [cited: cross-editor backup convention] ---
+# per-developer state; not shared — editor backup copy
+*.bak
+
+# --- claim-corpus execution-map output [owner: v1_compiler.cli_run] ---
+# regenerable from committed source — claim execution map output
 .claim-map/
+# session/runtime state; not source-of-truth — scratch probe written by manual claim runs
 src/v2/test/claim/manual/sg2_scratch_probe.dag
 
-# --- Superseded planning scratch directories (canonical home: docs/plans/ or DESIGN.md) ---
-# Superseded by docs/plans/ (generated PlanArtifact) and DESIGN.md/ROADMAP.md as canonical authorities
+# --- Superseded planning scratch directories [owner: gunbc.plan] ---
+# superseded; canonical home: docs/plans/ (generated PlanArtifact) and DESIGN.md — pre-plan-carrier planning scratch
 /gunbc-planning/
+# superseded; canonical home: docs/plans/ (generated PlanArtifact) and DESIGN.md — pre-plan-carrier fixture scratch
 /scripts/fixtures/
 
 # --- Generated artifacts (gitignored-by-default, derived from generated_artifact_registry) ---

dag/extdeps/bmc/pid_control_program.dag

@@ -319,5 +319,5 @@ fn decimal_measures_agree<Q, S>(a: Measure<Q, S, ExactDecimal>, b: Measure<Q, S,
 fn curve_points_agree(a: DemandCurvePoint, b: DemandCurvePoint) -> Bool {
   a.index == b.index
     && decimal_measures_agree(a: a.reading, b: b.reading)
-    && decimal_measures_agree(a: a.output, b: b.output)
+    && exact_decimal_equal(a: a.output.magnitude, b: b.output.magnitude)
 }

dag/extdeps/dotenv.dag

@@ -0,0 +1,26 @@
+module extdeps.dotenv
+
+import std.types { String, List }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+import std.workspace_artifact { WorkspaceFootprint, WorkspaceArtifact, CitedUpstream, MayContainSecrets }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "github.com/motdotla/dotenv"
+  }
+}
+
+// WORKSPACE FOOTPRINT. The dotenv convention stores environment-specific configuration —
+// commonly credentials — in .env files that must never be committed.
+fn dotenv_footprint() -> WorkspaceFootprint {
+  WorkspaceFootprint {
+    provenance: CitedUpstream { display: "Secrets and local config", upstream: "github.com/motdotla/dotenv" },
+    artifacts: [
+      WorkspaceArtifact { pattern: ".env", meaning: "environment-specific configuration, commonly secrets", reason: MayContainSecrets },
+      WorkspaceArtifact { pattern: ".env.local", meaning: "local override of .env", reason: MayContainSecrets },
+      WorkspaceArtifact { pattern: ".env.*.local", meaning: "per-environment local overrides", reason: MayContainSecrets }
+    ]
+  }
+}

dag/extdeps/editor/gnu_emacs.dag

@@ -0,0 +1,23 @@
+module extdeps.editor.gnu_emacs
+
+import std.types { String, List }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+import std.workspace_artifact { WorkspaceFootprint, WorkspaceArtifact, CitedUpstream, PerDeveloperState }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "gnu.org/software/emacs"
+  }
+}
+
+// WORKSPACE FOOTPRINT. Emacs writes backup files beside edited files.
+fn emacs_backup_footprint() -> WorkspaceFootprint {
+  WorkspaceFootprint {
+    provenance: CitedUpstream { display: "Emacs backup convention", upstream: "gnu.org/software/emacs" },
+    artifacts: [
+      WorkspaceArtifact { pattern: "*~", meaning: "backup of an edited file", reason: PerDeveloperState }
+    ]
+  }
+}

dag/extdeps/editor/jetbrains_ide.dag

@@ -0,0 +1,23 @@
+module extdeps.editor.jetbrains_ide
+
+import std.types { String, List }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+import std.workspace_artifact { WorkspaceFootprint, WorkspaceArtifact, CitedUpstream, PerDeveloperState }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "jetbrains.com/idea"
+  }
+}
+
+// WORKSPACE FOOTPRINT. JetBrains IDEs keep per-project workspace state in .idea/.
+fn jetbrains_workspace_footprint() -> WorkspaceFootprint {
+  WorkspaceFootprint {
+    provenance: CitedUpstream { display: "JetBrains IDE project state", upstream: "jetbrains.com/idea" },
+    artifacts: [
+      WorkspaceArtifact { pattern: ".idea/", meaning: "per-project IDE workspace configuration", reason: PerDeveloperState }
+    ]
+  }
+}

dag/extdeps/editor/vim.dag

@@ -0,0 +1,24 @@
+module extdeps.editor.vim
+
+import std.types { String, List }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+import std.workspace_artifact { WorkspaceFootprint, WorkspaceArtifact, CitedUpstream, PerDeveloperState }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "vim.org"
+  }
+}
+
+// WORKSPACE FOOTPRINT. Vim writes swap files beside edited files.
+fn vim_swap_footprint() -> WorkspaceFootprint {
+  WorkspaceFootprint {
+    provenance: CitedUpstream { display: "Vim editor state", upstream: "vim.org" },
+    artifacts: [
+      WorkspaceArtifact { pattern: "*.swp", meaning: "swap file for an open buffer", reason: PerDeveloperState },
+      WorkspaceArtifact { pattern: "*.swo", meaning: "secondary swap file", reason: PerDeveloperState }
+    ]
+  }
+}

dag/extdeps/editor/visual_studio_code.dag

@@ -0,0 +1,23 @@
+module extdeps.editor.visual_studio_code
+
+import std.types { String, List }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+import std.workspace_artifact { WorkspaceFootprint, WorkspaceArtifact, CitedUpstream, PerDeveloperState }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "code.visualstudio.com"
+  }
+}
+
+// WORKSPACE FOOTPRINT. VS Code keeps per-folder workspace settings in .vscode/.
+fn vscode_workspace_footprint() -> WorkspaceFootprint {
+  WorkspaceFootprint {
+    provenance: CitedUpstream { display: "VS Code workspace state", upstream: "code.visualstudio.com" },
+    artifacts: [
+      WorkspaceArtifact { pattern: ".vscode/", meaning: "per-folder workspace settings", reason: PerDeveloperState }
+    ]
+  }
+}