Sweep stamp — .local/selftest-stamp/ (2026-09-07; push gate removed 2026-09-30, hook removed 2026-10-02)

A full npm run sweep (no --only / --security) records its verdict in .local/selftest-stamp/<host>/<HEAD sha>.json. From 2026-09-07 a tracked pre-push hook refused a push to main without an ok: true stamp from THIS host; the operator removed that check on 2026-09-30 because the sweep made every push wait ~15 minutes, and the hook itself left with the CI on 2026-10-02. The sweep runs on the operator's word (/test-policy, or npm run promote:check -- --sweep), and the stamp is the record of what was swept.

git commit ...                 # the stamp is keyed by the COMMITTED sha
npm run sweep                  # ... sweep stamp: .local/selftest-stamp/<host>/<sha>.json (ok -- ...)
node scripts/sweep-stamp.mjs host                           # the host token the stamp is keyed by
node scripts/sweep-stamp.mjs verify "$(git rev-parse HEAD)"  # was this sha swept clean on this host (the skill's --sha-check)

The stamp carries sha, host, platform, at, the PASS/SKIP/FAIL counts, unexpectedSkips, staleExpectations, dirty and ok. ok is true only for a clean pass on a clean tree (git status --porcelain --untracked-files=no empty): a dirty tree still gets a stamp, marked ok: false, so the reason is visible rather than silently absent.

The stamp is bound to the machine that swept it (kr0q2, 2026-09-16). .local/ is rsync-mirrored between machines, so a stamp arriving from another machine would otherwise vouch for a SHA this one never swept. host is os.hostname() lowercased with anything outside [a-z0-9._-] replaced by -; sweep-stamp.mjs verify refuses, naming the host involved, a stamp that exists only under another host's directory, a legacy flat .local/selftest-stamp/<sha>.json from before this change, a stamp in this host's directory whose recorded host is another machine's or missing, and a stamp whose recorded sha differs from its filename. Guarded by npm run selftest:stamp-host-binding, which drives sweep-stamp.mjs verify in a throwaway repo and checks that no pre-push hook exists.

Known limitations and deferred work: a push to main can land code no sweep and no promotion check has run on; that is the accepted cost of the dev-phase decision. Nothing verifies that the sweep ran on THIS machine's real environment rather than a stripped one — the stamp records the platform and host, not the installed CLI set. The host binding trusts os.hostname(): two machines sharing a hostname share a stamp directory, and a machine whose hostname changes must re-sweep before its stamps verify. Stamps written before 2026-09-16 sit flat in .local/selftest-stamp/ and are never accepted again; nothing deletes them.