Carried files must not reference the template repo; mechanize the check

[ptr727]

The template is private, so any reference to it from a carried file 404s for that repo's readers and exposes template machinery a consumer should never have to see. Raised from downstream work where the references were being stripped by hand, repo by repo.

Scope of the leak

Swept every cataloged repo. 13 of 20 reference the template; 8 are public:

repo	public	files
Utilities	yes	copilot-instructions, HISTORY
LanguageTags	yes	copilot-instructions
aiopurpleair	yes	copilot-instructions
homeassistant-purpleair	yes	AGENTS, copilot-instructions
PlexCleaner	yes	copilot-instructions
VSCode-Server-DotNetCore	yes	copilot-instructions
NxWitness	yes	AGENTS, copilot-instructions
ESPHome-Config	yes	AGENTS
Financial-Modeling / HomeAutomation-Config / KiCadLibrary / HomeAssistant-Config / MediaTools	no	assorted

The dominant instance is a stale copilot-instructions.md paragraph telling agents to report drift upstream, which hard-links the private template twice - and one link targets an AGENTS.md#staying-in-sync-and-reporting-drift-upstream section the hub no longer has, so it 404s even for someone with access. The hub itself carries neither the paragraph nor that section: this is stale carried content that outlived its source (#305 territory, and exactly the "prose asserting the old behavior" rule from #356).

The rule

#344 barred sibling-repo references but arguably let the template through as "the subject". AGENTS.md now says explicitly:

This includes the template repo itself. A carried file names it in neither prose nor a link ... Where a carried file needs to express a template-level behavior - "report a rule discrepancy upstream" - state the behavior, not the destination; the maintainer supplies the destination out of band.

That preserves the agent-to-agent reporting flow (which is real and valuable) while keeping it out of a public file.

Mechanized, not left to review

This spread silently across 13 repos, so spec/audit.py now checks the two agent-instruction files for the template name and raises a drift finding.

The template name is derived from the git remote, not the checkout directory name - a clone into a differently-named folder would otherwise stop detecting with no signal, which is the fail-open case the check exists to prevent (AGENTS.md "Verification Discipline": gates fail loud, never narrow quietly).

PlexCleaner     -> DRIFT carried: .github/copilot-instructions.md references the template repo ...
ESPHome-Config  -> DRIFT carried: AGENTS.md references the template repo ...
Vantage-Config  -> clean

Downstream

Not fixed here - the 13 carried copies need the reference removed in their own repos. Raising the delivery shape (per-repo issues vs. folding into each repo's existing conformance issue) rather than filing 13 issues unilaterally.

spec/validate.py, markdownlint, editorconfig-checker: clean.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds an explicit governance rule that carried files must not reference the private template repo, and mechanizes enforcement by extending the fleet audit to detect template-name mentions in agent-instruction files.

Changes:

• Update the “no cross-repo references” rule to explicitly include the template repo itself.
• Extend spec/audit.py to flag template-repo references in AGENTS.md and .github/copilot-instructions.md across audited repos.
• Align the machine-readable audit spec (spec/project-types.json) with the new rule and enforcement mechanism.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
spec/project-types.json	Updates the recurring “no cross-repo references” rule text to explicitly include the template repo and mention the mechanized audit check.
spec/audit.py	Adds template-repo name derivation and a new audit finding when agent-instruction files reference the template repo name/link.
AGENTS.md	Clarifies documentation-style conventions to explicitly forbid references to the template repo in carried files.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

spec/audit.py:53

• hub_name() only reads remote.origin.url. If someone runs this audit from a fork (origin points to the fork), the template-reference check will scan for the fork repo name and can miss references to the upstream template repo with no warning (the docstring explicitly calls out forks as a fail-open scenario). Prefer upstream when available, then fall back to origin, and only then to ROOT.name (with the existing warning).

def hub_name():
    """This repo's name on the remote, and whether it came from the remote.

    Read from origin rather than the checkout directory, which a differently-named clone, a fork, or a
    worktree without an origin would silently break. The caller announces the directory-name fallback:
    a silently degraded match is the fail-open case this check exists to prevent.
    """
    r = subprocess.run(["git", "config", "--get", "remote.origin.url"], capture_output=True, text=True, cwd=ROOT)
    if r.returncode == 0 and r.stdout.strip():
        return r.stdout.strip().rstrip("/").removesuffix(".git").split("/")[-1], True
    return ROOT.name, False