feat(persona): unify system and code channel routes

scripts/audit-code-channel-route.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+
+const allowed = new Map([
+  [
+    "guanghu-ice-heart",
+    "https://guanghulab.com/code/bingshuo/guanghu-ice-heart.git",
+  ],
+  [
+    "hololake-system-architecture",
+    "https://guanghulab.com/code/bingshuo/hololake-system-architecture.git",
+  ],
+]);
+
+function classify(repositoryPath) {
+  const resolved = path.resolve(repositoryPath);
+  const gitMarker = path.join(resolved, ".git");
+  if (!fs.existsSync(gitMarker)) {
+    return { path: resolved, state: "NOT_GIT_WORKTREE" };
+  }
+  let remote;
+  try {
+    remote = execFileSync(
+      "git",
+      ["remote", "get-url", "--push", "origin"],
+      { cwd: resolved, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] },
+    ).trim();
+  } catch {
+    return { path: resolved, state: "ORIGIN_PUSH_URL_MISSING" };
+  }
+  let parsed;
+  try {
+    parsed = new URL(remote);
+  } catch {
+    return { path: resolved, state: "NON_CANONICAL_REMOTE_FORMAT" };
+  }
+  if (parsed.username || parsed.password) {
+    return { path: resolved, state: "CREDENTIAL_BEARING_REMOTE_FORBIDDEN" };
+  }
+  const slug = path.basename(parsed.pathname, ".git");
+  const expected = allowed.get(slug);
+  if (!expected || remote !== expected) {
+    return {
+      path: resolved,
+      state: remote.includes("/fifth-domain/")
+        ? "HISTORICAL_REMOTE_NO_PUSH"
+        : "NON_CANONICAL_REMOTE_NO_PUSH",
+    };
+  }
+  return {
+    path: resolved,
+    repository: slug,
+    state: "CANONICAL_PUSH_ROUTE",
+    remote: expected,
+  };
+}
+
+const targets = process.argv.slice(2);
+if (!targets.length) {
+  process.stderr.write(
+    "usage: node scripts/audit-code-channel-route.mjs <git-worktree> [...]\n",
+  );
+  process.exit(2);
+}
+
+const results = targets.map(classify);
+process.stdout.write(`${JSON.stringify(results, null, 2)}\n`);
+if (results.some((entry) => entry.state !== "CANONICAL_PUSH_ROUTE")) {
+  process.exitCode = 1;
+}
+