From d1bc24d61e775aa7e3f4a8d11709dc474e5fe0d1 Mon Sep 17 00:00:00 2001
From: vasilito <adminpupkin@gmail.com>
Date: Tue, 4 Aug 2026 19:33:55 +0300
Subject: [PATCH] verify-tracked-sources: cub and tlc are first-party too

Extends the fatal first-party check beyond redbear-* to cub (system) and tlc
(tui). Both are Red Bear's own programs with no upstream anywhere, so the
"restore it from the tarball" recovery that makes vendored drift a warning does
not exist for them.

They sit on opposite sides of the staging boundary, which is why both need the
gate for different reasons:
  cub  is staged out of tree (no escaping cargo path deps), so staging already
       keeps recipe seds off the tracked copy.
  tlc  is EXEMPT from staging: its manifest has a path dependency escaping the
       source tree, so nothing keeps a sed off the real files. For tlc this
       gate is the only protection.

The check is now a redbear_is_firstparty() helper rather than an inline glob, so
adding the next internal program is one line.

Verified: silent on a clean tree; fires on a one-line edit to cub and to tlc;
both restore cleanly.
---
 local/scripts/verify-tracked-sources.sh | 27 ++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/local/scripts/verify-tracked-sources.sh b/local/scripts/verify-tracked-sources.sh
index 57549d4171..afe78a9bf3 100755
--- a/local/scripts/verify-tracked-sources.sh
+++ b/local/scripts/verify-tracked-sources.sh
@@ -217,20 +217,37 @@ done
 # tree. They are therefore the LEAST protected and the MOST irreplaceable code
 # in the repository, so uncommitted drift in them stops the build outright
 # rather than printing a note that scrolls past.
+# FIRST-PARTY recipes. Everything here is Red Bear's own code with no upstream
+# anywhere. Add new internal programs to this list -- if it is ours and it is
+# not a fork of something external, it belongs here.
+#   redbear-*  the redbear-prefixed daemons, drivers and tools
+#   cub        internal
+#   tlc        internal
+# Note the two shapes: `cub` is staged out of tree (no escaping path deps, so
+# staging protects it), while `tlc` is exempt because its cargo manifest has a
+# path dependency that escapes its source tree -- so for tlc this gate is the
+# ONLY thing standing between a bad sed and unrecoverable loss.
+redbear_is_firstparty() {
+    case "$1" in
+        */redbear-*/source/*) return 0 ;;
+        */cub/source/*)       return 0 ;;
+        */tlc/source/*)       return 0 ;;
+    esac
+    return 1
+}
+
 firstparty_dirty=0
 for f in "${MODIFIED[@]}" "${DELETED[@]}"; do
     [ -z "$f" ] && continue
-    case "$f" in
-        */redbear-*/source/*) firstparty_dirty=$(( firstparty_dirty + 1 )) ;;
-    esac
+    redbear_is_firstparty "$f" && firstparty_dirty=$(( firstparty_dirty + 1 ))
 done
 
 if [ "$firstparty_dirty" -gt 0 ]; then
-    echo ">>> ERROR: $firstparty_dirty uncommitted change(s) in FIRST-PARTY redbear-* source." >&2
+    echo ">>> ERROR: $firstparty_dirty uncommitted change(s) in FIRST-PARTY source (redbear-*, cub, tlc)." >&2
     echo "    This code exists nowhere but this project -- there is no upstream to restore" >&2
     echo "    from. Commit it, or revert it with: git checkout -- <path>" >&2
     for f in "${MODIFIED[@]}" "${DELETED[@]}"; do
-        case "$f" in */redbear-*/source/*) echo "      $f" >&2 ;; esac
+        redbear_is_firstparty "$f" && echo "      $f" >&2
     done
     echo "    Override (accepts the risk): REDBEAR_ALLOW_DIRTY_FIRSTPARTY=1" >&2
     [ "${REDBEAR_ALLOW_DIRTY_FIRSTPARTY:-0}" = "1" ] || rc=1