scriptlib/developer/assetorigin_check.tcl, sibling to goals_lint and
architecture_lint: plain Tcl, no external binaries, no rasterizer -
embedded sha256 (NIST-vector validated) plus a tolerant self-contained
flat-TOML subset reader (comments, basic and literal strings, bare
scalars; unknown keys skipped; root table ends at the first table
header; duplicate keys last-wins), resolving the open toml/hash
dependency posture from the pre-activation review in favour of
self-containment.
States evaluated in table order, first match wins: unrecorded,
artifact-absent, replaced, source-absent, stale, verified. Unrecognised
schema or a missing/unusable artifact hash means the record is ignored
(unrecorded), never an error; unrecognised hash-algorithm prefixes are
treated as not recorded, so a source claim without a usable hash is a
presence check only.
check mode defaults to src/ (minus buildsuites/), scriptlib/ and goals/
- 2.2s wall vs 116s for a whole-tree walk dominated by _build trees,
bin/tools zig installs and TEMP_REFERENCE (those walk only when named
explicitly; .git and _build always skipped). goals_lint-style exit: 0
clean, 1 with a line per finding; advisory - nothing gates a build on
it. status mode classifies named assets (a sidecar path names its
paired asset); selftest builds 13 fixtures demonstrating all six states,
the rule-3 precedence (replaced wins over missing source) and every
tolerance rule - 16/16 pass under mingw tclsh 8.6.11, native Tcl 9.0.3
and the punk91 kit runtime. Live tree: 8 records, 8 verified.
Root AGENTS.md scriptlib/developer enumeration gains the new tool.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
