Ultron's REQUEST_CHANGES finding B1 on PR #1195: a bare operator manifest entry
such as `tools/git` was matched as an implicit directory prefix, so declaring one
directory silently exempted every framework file beneath it from drift detection.
A drift blind spot is exactly what #1194 exists to close.
An exact entry is now a file carve-out. Subtree ownership must be declared
explicitly as `dir/**`. The same rule is applied on both sides of the Bash/TS
parity boundary: `_mo_matches` in tools/_lib/manifest.sh drops its prefix clause,
and `resolveOwnership` in src/framework/manifest.ts routes operator globs through
a new `matchesOperatorGlob` that requires equality when the pattern has no `*`.
Verified by measurement rather than by report. The new regression declares
operator entry `tools/git`, drifts `tools/git/guard.sh` beneath it, and asserts
the checker exits 1 with `STALE git/guard.sh`:
at c59a55f8 (broken): FAILED (failures=1) -- rc 0, summary `stale=0`
at this tree (fixed): Ran 6 tests, OK
The failure at the old head is the point. A fixture that passes on the broken
tree measures nothing, and this file's neighbour (#1174) has spent ten rounds
proving it.
Also two shellcheck-only mechanical fixes in manifest.sh: SC1087 (brace the
expansion before `[`) and SC2155 (split `local` from the assignment so the
return status is not masked).
Not validated here: the full package typecheck could not be run in this
workspace -- node_modules is absent and the host filesystem is full. CI covers it.
Reviewed-by: gate-ultron-01 (finding B1)
coder-mos1
jason.woltje