[mikestankavich]

Closes platform's share of TRA-1219 item 3 — the last of the four repos. Items 1 and 2 fixed the file in #623; nothing stopped it rotting again.

It rotted because no gate, no session and no CI read it. Platform's README.md stayed correct while CONTRIBUTING.md three directories away did not: same repo, same vintage, different consumers. This is the consumer.

What it checks

Two claims, both chosen because they are the ones that actually broke and because neither can fire on a correct file:

1. Every just recipe the doc names still exists — root and workspace forms both.
2. Every repo path it names is tracked.

Tracked, not merely present. existsSync passes on a file that exists only on the author's machine, which is a false green for precisely the audience a contributor guide is written for. .env and .env.local are named in the doc, exist locally, and are correctly absent from a fresh clone — the tracked test handles them with no skip list.

Verified by deliberate breakage

A check that has not been shown to fail has not been shown to work. Five injected faults, five caught:

Injected fault	Caught
the original cp backend/.env.example bug	✓
dead root recipe (just bootstrap-everything)	✓
dead workspace recipe (just backend migrate-checksum)	✓
moved path (backend/api/routes.go)	✓
file present locally but untracked	✓

That process found two bugs, either of which would have shipped a check that passed on the exact fault it was built for:

• .example was outside the extension whitelist, so the historical backend/.env.example fault was invisible on the first run.
• The no-workspace case emitted a leading empty field, and read strips leading IFS whitespace — so with either a space or a tab delimiter the recipe name landed in $ws and $name came back empty, which the -z guard then skipped. Every single-word recipe was silently unchecked while the workspace form kept working, which is why one break test fired and the other didn't. Now an explicit - sentinel.

Two deliberate omissions

pnpm script names are not checked. The root package.json has no scripts, so that rule would have nothing to catch here — and a rule with nothing to catch is unexercised surface that breaks unnoticed.

The path rule requires the first segment to be a real top-level entry. trakrf/docs rejected that rule for its repo and was right to; it has no vocabulary needing it. Platform does — /api/v1/, ghcr.io/trakrf/backend:sha-<short>, ${assetId} and a frontend-relative services/ all appear in this file and must be skipped. The rule set belongs to the repo, not to the idea, and all three repos ended up with genuinely different ones.

Wiring

Hung off lint rather than given its own job, so it runs inside the existing lint-test required check instead of adding a context the main-branch-protection ruleset would have to be taught. Same reasoning as the changelog gate, and just validate picks it up locally for free.

just validate — exit 0.

Refs: TRA-1219

🤖 Generated with Claude Code

https://claude.ai/code/session_01W7p2hFrE6ZFWS91XvyFQcV

[github-actions]

🚀 Preview Deployment Update

✅ This PR has been successfully merged into the preview branch.

The preview environment will update shortly at: https://app.preview.trakrf.id