fix(distribution): absorb consumer deltas the first fleet sync surfaced

[kyle-sexton]

Summary

The first fleet-wide sync PRs surfaced three local consumer edits that a verbatim overwrite would have destroyed — each resolved at the SSOT per the Track B operating rule (route changes upstream), with the policy recorded where it applies:

• typos (modules/typos/_typos.toml): now carries the constellation-wide union of domain identifiers — provisioning's PnPCapabilities/FoD/BAAs, dotfiles' abd — each annotated. typos has no config layering, so repo-local exceptions cannot coexist with a synced file; the file's own comments now state the route-upstream policy (decided 2026-07-06, superseding the "adopters add them locally" guidance from the copy-adoption era). Each identifier only skips its exact token, so the union is inert elsewhere.
• shellcheck: removed from kyle-sexton/dotfiles' include list. Its .shellcheckrc is a documented deliberate minimal divergence (the SSOT's require-double-brackets — verified enabled — would flag the statusline's intentional [ ] graceful-degradation idiom), with SSOT alignment already tracked as FU4 in that repo. The manifest comment carries the re-add trigger. Notably dotfiles has no CI shellcheck lane, so the overwrite would have broken pre-commit hooks silently.
• lychee (provisioning's private-repo excludes): already upstream as fix(lychee): exclude private constellation repos from the online lane #58 — no change here.

Merging this re-fires the sync cascade (paths match), refreshing the open personal sync PRs so their deletions disappear.

Verification

Manifest parses (yq); typos lane runs in this PR's own CI against the updated config; SSOT require-double-brackets claim verified against modules/shellcheck/.shellcheckrc.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GbDWhcUtduCejgi7mcbMfy

---

Note

Low Risk
Config and manifest-only changes for spellcheck and sync scope; no runtime or auth paths, with typos union entries scoped to exact tokens.

Overview
Aligns Track B distribution with what the first fleet sync would have overwritten: typos config and the dotfiles shellcheck target.

typos (modules/typos/_typos.toml) now documents that the synced file is read-only downstream and holds a constellation-wide union of [default.extend-identifiers] (abd, BAAs, FoD, PnPCapabilities), each annotated, replacing the old “adopters extend locally” guidance.

kyle-sexton/dotfiles no longer includes shellcheck in distribution/sync-manifest.yml, with a comment that its local .shellcheckrc intentionally diverges (SSOT require-double-brackets vs statusline [ ] idiom, FU4) and should be re-added when that follow-up lands.

^{Reviewed by Cursor Bugbot for commit 83493e7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude finished @kyle-sexton's task in 1m 47s —— View job

---

PR Review

• Load tools
• Read CLAUDE.md and REVIEW.md guidelines
• Review PR diff
• Review distribution/sync-manifest.yml
• Review modules/typos/_typos.toml
• Post findings

---

Overall

Clean, well-reasoned PR. The two changes are internally consistent, the PR description matches the diff exactly, and the one factual claim I could verify independently checks out. No bugs, no security issues, no architectural concerns.

---

distribution/sync-manifest.yml

Shellcheck removal — correct and well-documented.

The comment block now placed above the kyle-sexton/dotfiles target (lines 157–160) accurately explains the exclusion. The require-double-brackets claim in that comment is verified — modules/shellcheck/.shellcheckrc line 47 has enable=require-double-brackets, confirming a verbatim overwrite would have silently broken the consumer's pre-commit hooks.

One minor observation: the re-add trigger references dot_claude/statusline/README.md — a path that lives in kyle-sexton/dotfiles, not this repo. Future readers of this manifest won't have that context without knowing where to look. Prepending the repo name (e.g., kyle-sexton/dotfiles: dot_claude/statusline/README.md) would make the pointer self-contained, but it's minor.

The "add shellcheck here when FU4 lands" trigger is soft — there's no mechanism (issue link, etc.) to ensure FU4 completion prompts an update here. Acceptable for this style of repo, just worth being aware of.

---

modules/typos/_typos.toml

Header rewrite — accurate and necessary.

The old header's "adopters extend locally" guidance was no longer valid once Track B made the file a verbatim sync. Removing it prevents adopters from following now-incorrect guidance. The new header correctly frames the file as read-only downstream. (lines 5–7)

New [default.extend-identifiers] entries — technically correct.

The extend-identifiers table uses exact, case-sensitive whole-token matching, so:

Token	Risk of cross-repo false-suppress
abd	Low — short but exact-case match only
BAAs	Negligible — specific enough
FoD	Negligible
PnPCapabilities	Negligible — very specific

The claim that "each entry only skips its exact token, so the union is inert outside the repos that need it" holds for identifiers. If domain words (case-insensitive [default.extend-words]) are ever added to the union in the future, that inertness guarantee weakens — worth keeping in mind as the list grows.

Each entry is annotated with its origin repo and use case (lines 33–40), which is exactly the right pattern for a union that will keep growing.

Example comment block removal — intentional and correct. Keeping the old commented-out extend-words/extend-identifiers examples would have been misleading now that local extension is prohibited.

---

Summary

No changes needed. Both diffs are correct. The minor observations above (external path reference, soft re-add trigger) are informational — not blockers.

[claude]

Claude finished @kyle-sexton's task in 1m 28s —— View job

---

• Load tools
• Read CLAUDE.md and REVIEW.md guidelines (none present in repo)
• Review PR diff
• Review changed files
• Post findings

---

Overall

This is a re-review triggered by the merge of main into the branch (commit 83493e7). The diff against origin/main is unchanged from the prior review — only distribution/sync-manifest.yml and modules/typos/_typos.toml are modified by this PR. No new issues found.

---

distribution/sync-manifest.yml

Shellcheck removal — correct. (lines 157–169)

The comment accurately reflects the deliberate exclusion, and shellcheck is absent from the kyle-sexton/dotfiles include list. The prior claim is still verified: modules/shellcheck/.shellcheckrc has enable=require-double-brackets, so a verbatim overwrite would silently break the consumer's pre-commit hooks.

Minor (informational, not a blocker): dot_claude/statusline/README.md in the FU4 re-add trigger is a path inside kyle-sexton/dotfiles. Prefixing the repo name (e.g., kyle-sexton/dotfiles: dot_claude/statusline/README.md) would make the pointer self-contained for readers who don't know which repo to look in.

---

modules/typos/_typos.toml

Header — accurate. (lines 5–7) Removes the now-incorrect "adopters extend locally" guidance; replaces it with the read-only downstream framing.

[default.extend-identifiers] — technically correct. (lines 32–40)

• TOML sub-table syntax ([default.extend-identifiers] after [default]'s direct keys) is valid.
• Identity mappings (token = "token") are the correct form for "allow this token as-is."
• extend-identifiers matching is case-sensitive and whole-token — the abd entry skips exactly the token abd; cross-repo false-suppression risk is negligible for all four entries.
• Each entry is annotated with origin repo and use case, which is the right pattern for a growing shared union.

No new issues vs. the prior review. Both changes are correct.

---

Summary

No blockers. The two minor observations from the previous review (external path reference in the FU4 comment, soft re-add trigger) remain informational. PR is ready to merge.

[cursor]

Risk: low. Cursor Bugbot completed successfully with no findings requiring human review. Approved; no additional reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 83493e78b4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update typos docs for upstream-only exceptions

This policy change makes _typos.toml the synced union and tells consumers to route repo-specific exceptions upstream, but modules/typos/README.md still says the config ships no domain words and tells adopters to extend it locally (lines 9-12 and 48-50). For any consumer following the module README, that creates exactly the downstream-only edits the sync will overwrite, so the new route-upstream rule won't prevent repeated drift PRs unless the README is updated with the same policy.

Useful? React with 👍 / 👎.