Harden monorepo release gate

.llm/MONOREPO_1_0_0_BETA.md

@@ -35,5 +35,6 @@ standard-library APIs.
 ## Publication Rule
 
 The public repository must not contain machine-local paths, private checkout
-names, or generated PDFs that drift after regeneration. The release gate must
-fail if tracked PDFs change after `scripts/render-doc-pdfs.sh`.
+names, or private remote names. Generated PDFs are committed artifacts: render
+them explicitly with `scripts/render-doc-pdfs.sh`, then run the release gate,
+which must not mutate tracked files by default.

CONTRIBUTING.md

@@ -14,8 +14,9 @@ cargo test --manifest-path compiler/Cargo.toml
 ./scripts/release-gate.sh
 ```
 
-`./scripts/release-gate.sh` regenerates publication PDFs and fails if tracked
-PDFs drift after regeneration.
+Publication PDFs are committed artifacts. Regenerate them explicitly with
+`./scripts/render-doc-pdfs.sh` before a documentation release, then run the
+release gate to verify the repository without mutating tracked files.
 
 ## Standard Library
 

README.md

@@ -81,6 +81,8 @@ SLOVO_STD_PATH="$PWD/lib/std" ./compiler/target/debug/glagol build hello -o hell
 - [Glagol Whitepaper](docs/papers/GLAGOL_WHITEPAPER.md)
 
 Generated PDFs live beside their Markdown sources in `docs/papers/`.
+Regenerate them with `./scripts/render-doc-pdfs.sh` before documentation
+releases.
 
 ## License
 

scripts/release-gate.sh

@@ -7,9 +7,50 @@ compiler_dir="${repo_root}/compiler"
 
 cd "${repo_root}"
 git diff --check
+
+required_pdfs=(
+  "docs/papers/SLOVO_WHITEPAPER.pdf"
+  "docs/papers/SLOVO_MANIFEST.pdf"
+  "docs/papers/GLAGOL_WHITEPAPER.pdf"
+  "docs/papers/GLAGOL_COMPILER_MANIFEST.pdf"
+)
+
+for pdf in "${required_pdfs[@]}"; do
+  if [ ! -s "${pdf}" ]; then
+    echo "missing generated documentation artifact: ${pdf}" >&2
+    echo "run ./scripts/render-doc-pdfs.sh and commit the result" >&2
+    exit 1
+  fi
+done
+
+private_text_pattern='(/home/[[:alnum:]_.-]+|sanjin[0-9]+|[0-9]{1,3}\.64\.0\.1|git\.hermeticum\.io)'
+
+if git grep -nE "${private_text_pattern}" -- \
+  README.md CONTRIBUTING.md docs scripts compiler lib examples benchmarks tests .llm; then
+  echo "release gate found local/private publication text" >&2
+  exit 1
+fi
+
+if command -v pdftotext >/dev/null 2>&1; then
+  pdf_text_dir="$(mktemp -d)"
+  trap 'rm -rf "${pdf_text_dir}"' EXIT
+  for pdf in "${required_pdfs[@]}"; do
+    pdftotext "${pdf}" "${pdf_text_dir}/$(basename "${pdf}").txt"
+  done
+  if rg -n "${private_text_pattern}" "${pdf_text_dir}"; then
+    echo "release gate found local/private text inside generated PDFs" >&2
+    exit 1
+  fi
+fi
+
+if [ "${RENDER_DOC_PDFS:-0}" = "1" ]; then
   "${repo_root}/scripts/render-doc-pdfs.sh"
   git diff --check
-git diff --exit-code -- docs/papers
+  if ! git diff --quiet -- docs/papers; then
+    echo "documentation PDFs changed; review and commit generated artifacts before release" >&2
+    exit 1
+  fi
+fi
 
 cd "${compiler_dir}"
 cargo fmt --check