generator-oracle-zero-diff-verifylisted

# Generator Oracle: Zero-Diff Verify ## Overview When you build a generator/sanitizer/transform whose output **already exists as a maintained artifact** (e.g. a public template repo's `main` branch generated from a private source), use that artifact as the **oracle**: iterate the manifest + transforms + overlay until `generate()` produces a **zero git-diff** against it. One assertion subsumes the narrower grep/leak gate and proves both completeness (nothing missing) and determinism in a single test. ## When to Use - Building an export / template / codegen / sanitisation pipeline - The target output already exists as a hand-maintained reference - You're tempted to write a per-file "is this leaked?" classification by hand ## Steps 1. Identify that the target output already exists as a maintained artifact — that's the oracle. 2. Build the generator to a clean output directory. 3. `git diff --no-index <generated> <oracle>` — every residual diff line drives the next transform or overlay rule. 4. Loop until the diff is empty. An empty diff ⊇ any narrower content/leak gate, so you can drop the hand-maintained grep checklist. **Determinism sub-check:** if you prove idempotence with "regenerate, then `git diff <generated-file>`", the diff is **vacuous while the file is untracked** — diffing an untracked path always shows clean, a false pass. `git add <file>` to establish a baseline first, *then* regenerate and `git diff --stat` (staged vs working). Distinguish genuinel