@@ -0,0 +1 @@
+use flake
@@ -0,0 +1,68 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  # First and cheapest. There is no toolchain install step: the runner already
+  # has bash, jq, cargo and shellcheck, and a broken invariant should fail
+  # before anyone waits on a compiler.
+  ratchets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: shellcheck the ratchets
+        run: shellcheck scripts/ratchets/*.sh scripts/ratchets/fixtures/*.sh scripts/ratchets/fixtures/*/*.sh
+      - name: the ratchets hold
+        run: ./scripts/ratchets/all.sh
+      - name: every ratchet can fail
+        run: ./scripts/ratchets/test-ratchets.sh
+
+  build:
+    needs: ratchets
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # The workspace arrives with plan 02. Until then this job says so in the
+      # run summary instead of looking like a build that passed.
+      - id: gate
+        run: |
+          if [ -f Cargo.toml ]; then
+            echo "ready=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::notice::No Cargo workspace yet. The build turns on when plan 02 adds one."
+          fi
+      - if: steps.gate.outputs.ready == 'true'
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - if: steps.gate.outputs.ready == 'true'
+        run: cargo fmt --all -- --check
+      - if: steps.gate.outputs.ready == 'true'
+        run: cargo clippy --workspace --all-targets -- -D warnings
+      - if: steps.gate.outputs.ready == 'true'
+        run: cargo test --workspace
+
+  crash-recovery:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # Present from the first commit, so the crash test has a place waiting
+      # for it. It turns on when plan 04 adds the test.
+      - id: gate
+        run: |
+          if [ -f crates/ledgerd/tests/crash_recovery.rs ]; then
+            echo "ready=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::notice::No crash test yet. This job turns on when plan 04 adds it."
+          fi
+      - if: steps.gate.outputs.ready == 'true'
+        uses: dtolnay/rust-toolchain@stable
+      - if: steps.gate.outputs.ready == 'true'
+        run: cargo test -p ledgerd --test crash_recovery -- --ignored --nocapture
@@ -0,0 +1,2 @@
+/target
+/.direnv
@@ -0,0 +1,2 @@
+# Resolve `source` paths relative to the script that sources them.
+source-path=SCRIPTDIR
@@ -0,0 +1,12 @@
+# ratchets-before-code
+
+This repository is being built by the method it will describe: architectural
+invariants enforced as failing builds and landed before the code they protect,
+plus a brief → spec → plan → live-proof pipeline run with AI coding agents.
+
+The essay replaces this page when the build is done. Until then, the record is
+the point:
+
+- [The design](docs/pipeline/specs/2026-10-14-ratchets-before-code-design.md)
+- [The first decision](docs/decisions/0001-ratchets-land-before-code.md)
+- [The ratchets](scripts/ratchets/), which exist before any crate does
@@ -0,0 +1,64 @@
+# ADR 0001: The ratchets land before the code they protect
+
+**Status:** accepted
+**Date:** 2026-10-14
+**Decided by:** Andy
+
+## Context
+
+This repository is built mostly by AI coding agents working from written
+plans. Agents are fast, and they are obliging. Asked to make a test pass by the
+end of a task, a good agent finds the shortest path, and the shortest path
+through an architecture usually runs through one of its boundaries. A person
+under a deadline does the same, just less often.
+
+Each such exception is defensible on the day it is made. The damage is in the
+sum, and nobody ever approves the sum. A design document cannot stop it,
+because a document has no way to fail a build. Review does not reliably stop
+it either: the reviewer who should catch the fifth exception is the one who
+waved through the first four.
+
+## Decision
+
+Every structural rule this repository depends on is a script that fails the
+build, and those scripts are in the first commit, before any crate exists.
+
+So the first commit holds:
+- this decision
+- the design spec
+- five ratchets under `scripts/ratchets/`
+- a self-test that proves each ratchet can fail
+- the CI workflow that runs them before anything else
+
+## Why first
+
+- **Today they cost nothing.** Against an empty tree, every ratchet passes on
+  its first run. A ratchet introduced later arrives with every violation that
+  accumulated before it, and its first conversation is about which of those
+  really count.
+- **A rule that runs is a different thing from a rule that is written down.**
+  "The core is pure" is a sentence in the spec. `core-purity.sh` is the same
+  sentence, checked on every pull request, including the ones an agent opens at
+  3 a.m.
+- **A budget binds only when it starts below need.** `core-line-budget.sh`
+  allows 800 lines for a core expected to settle at 400-600. Starting at
+  whatever size the core reaches, plus some slack, would record the code's size
+  rather than limit it.
+
+## Consequences
+
+- **Dependency rules are allowlists.** A denylist blocks only the crate
+  someone thought of in advance.
+- **Source scans skip whole-line comments.** Otherwise the explanation of a
+  rule becomes its first violation, and people learn to silence the check.
+- **Loosening a rule is a visible diff.** Raising a budget or widening an
+  allowlist is allowed, and it is done by editing the ratchet in the same diff
+  as the code that needs it. The trade is then in front of the reviewer, not in
+  a setting nobody reads.
+- **Every ratchet ships with fixtures that prove it can fail**
+  (`test-ratchets.sh`). That also stops a ratchet from being weakened quietly:
+  an agent that "fixes" a red build by loosening the check turns the self-test
+  red instead.
+- **They are a floor, not a proof.** The ratchets are text scans and metadata
+  checks, and someone set on evading them can. What they catch is the
+  ordinary, reasonable shortcut.
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+# Resolve `source` paths relative to the script that sources them.
	`2`	`+source-path=SCRIPTDIR`