From 8eaf54d87f0f22241cee6b732d18af7caa2957bf Mon Sep 17 00:00:00 2001
From: vasilito <adminpupkin@gmail.com>
Date: Tue, 4 Aug 2026 19:30:37 +0300
Subject: [PATCH] verify-tracked-sources: first-party redbear-* drift is fatal

redbear-* recipes are not vendored upstream code -- they are Red Bear's own
programs and exist nowhere else. A vendored tree can be restored from its
tarball or git remote; first-party source cannot. If a recipe sed or an `rm`
damages it and that gets committed, the work is gone.

Not hypothetical. Seven redbear-* recipes rewrite their own source during the
build (greeter, btusb, btctl, ime, dnsd, accessibility, keymapd), and all seven
are exempt from out-of-tree staging because their cargo manifests carry path
dependencies escaping the source tree. They are simultaneously the least
protected and the most irreplaceable code here.

Uncommitted drift in them now fails preflight instead of printing a note that
scrolls past. Vendored trees keep the existing warn-by-default behaviour.
Override: REDBEAR_ALLOW_DIRTY_FIRSTPARTY=1.

Verified: gate is silent on a clean tree, fires on a one-line edit to
redbear-authd, and the tree restores cleanly.
---
 local/scripts/verify-tracked-sources.sh | 33 +++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/local/scripts/verify-tracked-sources.sh b/local/scripts/verify-tracked-sources.sh
index 073bc34525..57549d4171 100755
--- a/local/scripts/verify-tracked-sources.sh
+++ b/local/scripts/verify-tracked-sources.sh
@@ -203,6 +203,39 @@ for f in "${MODIFIED[@]}"; do
     [ -n "${known[$f]:-}" ] && baseline_dirty=$(( baseline_dirty + 1 ))
 done
 
+# 3a. FIRST-PARTY source is always fatal, never a note.
+#
+# redbear-* recipes are not vendored upstream code -- they are Red Bear's own
+# programs and exist NOWHERE ELSE. A vendored tree can be restored from its
+# upstream tarball or git remote; first-party source cannot. If a recipe sed or
+# an `rm` damages it and the damage is committed, the work is simply gone.
+#
+# This is not hypothetical: seven redbear-* recipes rewrite their own source
+# during the build (redbear-greeter, -btusb, -btctl, -ime, -dnsd,
+# -accessibility, -keymapd), and all seven are exempt from out-of-tree staging
+# because their cargo manifests carry path dependencies that escape the source
+# tree. They are therefore the LEAST protected and the MOST irreplaceable code
+# in the repository, so uncommitted drift in them stops the build outright
+# rather than printing a note that scrolls past.
+firstparty_dirty=0
+for f in "${MODIFIED[@]}" "${DELETED[@]}"; do
+    [ -z "$f" ] && continue
+    case "$f" in
+        */redbear-*/source/*) firstparty_dirty=$(( firstparty_dirty + 1 )) ;;
+    esac
+done
+
+if [ "$firstparty_dirty" -gt 0 ]; then
+    echo ">>> ERROR: $firstparty_dirty uncommitted change(s) in FIRST-PARTY redbear-* source." >&2
+    echo "    This code exists nowhere but this project -- there is no upstream to restore" >&2
+    echo "    from. Commit it, or revert it with: git checkout -- <path>" >&2
+    for f in "${MODIFIED[@]}" "${DELETED[@]}"; do
+        case "$f" in */redbear-*/source/*) echo "      $f" >&2 ;; esac
+    done
+    echo "    Override (accepts the risk): REDBEAR_ALLOW_DIRTY_FIRSTPARTY=1" >&2
+    [ "${REDBEAR_ALLOW_DIRTY_FIRSTPARTY:-0}" = "1" ] || rc=1
+fi
+
 if [ "$baseline_dirty" -gt 0 ]; then
     if [ "${REDBEAR_STRICT_TRACKED_SOURCES:-0}" = "1" ]; then
         echo ">>> ERROR: $baseline_dirty uncommitted change(s) in tracked source trees" \