deterministic-checks

# Deterministic Checks ## Overview A shell script that scans a repository for five specific, mechanically-detectable problems and reports file:line locations. Zero model cost — it never asks a model to "be careful" about something a regex can already prove. **Core principle:** If a check can be regex or `wc -c`, it should never be a paragraph of instructions asking the model to look carefully. Reserve judgment calls for the model; hand mechanical checks to the script. ## What it checks | Check | Catches | Misses (by design) | |---|---|---| | Conflict markers | `<<<<<<<`, `=======`, `>>>>>>>` at line start | Markers inside a fenced code block that's *documenting* conflict markers (a known false-positive class — see below) | | Live-looking credentials | AWS keys, GitHub tokens, PEM private keys, `sk-`-style API keys | Anything not matching those four shapes — this is not a general secret scanner | | Debug leftovers | `console.log`/`console.debug`, `debugger;`, `pdb.set_trace()`, `binding.pry` in JS/TS/Python/Go/Ruby files | Debug prints in languages/patterns not listed | | Untracked TODO/FIXME | `TODO`/`FIXME`/`XXX` with no `#123` or `TICKET-123` reference nearby | TODOs that reference a ticket — those are considered tracked | | Oversized files | Any file over 5MB, excluding lockfiles and `.min.js` | Nothing — this one has no heuristic gap | ## Usage ```bash bash ${CLAUDE_SKILL_DIR}/scripts/scan.sh [path] # defaults to . ``` Exit code 0 = clean, 1 = findings printed t...