fix(installer): ignore ritual runtime sentinels

[dbcall2]

Summary

• Add selective .gitignore coverage for .deft/ritual-state.json and .deft/last-session.json in the installer and relocator projections.
• Keep .deft/core/ intentionally trackable so consumer repos do not hide the vendored framework payload.
• Add parity/regression tests across the Go installer and Python relocator sources.

Related Issues

Closes #1609

Checklist

• /deft:change <name> — N/A; this was an ingested bug scope with an active/completed vBRIEF.
• CHANGELOG.md — added entry under [Unreleased].
• ROADMAP.md — N/A; release-time roadmap movement only.
• Tests pass locally.

Testing

• PATH="$PWD/.venv/bin:$PATH" go test ./cmd/deft-install
• .venv/bin/python3 -m pytest tests/relocate/test_self_bootstrap.py tests/relocate/test_state_matrix.py -q
• .venv/bin/python3 -m pytest tests/cli/test_session_start.py tests/cli/test_verify_session_ritual.py -q
• .venv/bin/python3 scripts/vbrief_validate.py --vbrief-dir vbrief
• .venv/bin/python3 -m pytest tests/content/test_pyproject_version_freshness.py -q
• git diff --check
• PATH="$PWD/.venv/bin:$PATH" UV_NO_SYNC=1 task check — collected 7703 items / 9 deselected / 7694 selected; result: 7688 passed, 5 skipped, 9 deselected, 1 xfailed.

Review Cycle

• Greptile review on 5b014b0 reported 0 P0, 0 P1, and 2 P2 findings with confidence 4/5.
• Commit 65322de addresses 2/2 P2 findings in one batch: tightened the runtime-sentinel parity filter and completed the vBRIEF acceptance-criteria items.
• GitHub MCP review tools were unavailable in this session; I used gh pr view --comments plus gh api repos/deftai/directive/pulls/1612/comments as the two review sources.

Post-Merge

• Verify issue auto-close: After squash merge, confirm referenced issues actually closed — gh issue view 1609 --json state --jq .state. If still open, close manually: gh issue close 1609 --comment "Closed by #<PR> (squash merge — auto-close did not trigger)"
• Enable branch protection on master requiring CI status check (one-time setup, see Add GitHub Actions CI workflow for linting and tests on PRs and pushes #57)

[greptile-apps]

Greptile Summary

This PR fixes a dirty-tree blocker where session-start writes .deft/ritual-state.json and .deft/last-session.json into consumer repos that were not gitignored, halting the story-start gate. The fix adds selective ignore coverage for these two runtime sentinels while intentionally preserving .deft/core/ as a tracked, reproducible framework payload.

• Single source of truth added: GITIGNORE_DEFT_RUNTIME_SENTINELS tuple in _triage_bootstrap_gitignore.py is imported by the Python relocator (via tuple-spread into GITIGNORE_LINES) and mirrored in the Go installer's canonicalGitignoreLines, with a cross-language parity test pinning both sides.
• Tests cover fresh install, idempotency, inline-comment tolerance, blanket-heal, and cross-source parity — the same pattern established by the prior #1464 eval-entries fix.
• vBRIEF items correctly reflect "completed" status, and the parity-filter in TestCanonicalGitignoreRuntimeSentinelsMatchPythonSource was tightened to drop the .json-suffix guard (addressing the previous review cycle's P2 finding).

Confidence Score: 5/5

Safe to merge — the change is additive (two new gitignore lines), uses an established single-source-of-truth pattern already proven by the #1464 eval-entries fix, and is guarded by cross-language parity tests on both the Python and Go rails.

The fix touches only .gitignore projection logic, with no behavioural changes to runtime paths. A dedicated source-of-truth constant in Python is imported by the relocator and mirrored in Go, with a parity test that will catch any future drift. Fresh-install, idempotency, inline-comment, heal-blanket, and state-matrix tests all cover the new entries. The vBRIEF items are correctly marked completed, and the previous review cycle's filter-tightening concern was addressed.

No files require special attention.

Important Files Changed

Filename	Overview
scripts/_triage_bootstrap_gitignore.py	Adds GITIGNORE_DEFT_RUNTIME_SENTINELS as the single source of truth for the two runtime sentinel paths; doc-fix removes the misleading .deft/ example from GITIGNORE_LINE's docstring.
scripts/relocate.py	Imports GITIGNORE_DEFT_RUNTIME_SENTINELS and spreads it into GITIGNORE_LINES before the eval entries; docstring updated accordingly.
cmd/deft-install/setup.go	Inserts .deft/ritual-state.json and .deft/last-session.json into canonicalGitignoreLines with a must-mirror comment; updates surrounding docblock and EnsureGitignoreLines comment.
cmd/deft-install/main_test.go	Adds three new tests (DoesNotIgnoreFrameworkPayload, RuntimeSentinelsMatchPythonSource, CreatesNew/AppendsToExisting coverage); refactors parsePythonEvalEntries into a shared parsePythonTupleEntries helper; parity filter tightened to prefix-only + no-slash + no-wildcard.
tests/relocate/test_self_bootstrap.py	Extends F2 constant-pins test, heal-blanket test, and idempotency test to assert presence of sentinel entries and absence of any blanket .deft/ line.
tests/relocate/test_state_matrix.py	Adds sentinel-presence and blanket-absence assertions to _assert_canonical_end_state, ensuring all state-matrix scenarios enforce the new gitignore contract.
scripts/ritual_sentinel.py	Comment-only update: replaces the stale ".deft/ is gitignored" assumption with the accurate "selectively gitignored" wording for both sentinel constants.
vbrief/completed/2026-06-13-1609-installer-ignore-deft-ritual-runtime-sentinels-in-consumer-p.vbrief.json	New completed vBRIEF for #1609; all four acceptance-criteria items carry "status": "completed" matching plan.status.
CHANGELOG.md	Adds concise [Unreleased] Fixed entry describing the selective gitignore fix and closing #1609.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    SOT["_triage_bootstrap_gitignore.py\nGITIGNORE_DEFT_RUNTIME_SENTINELS\n(.deft/ritual-state.json\n.deft/last-session.json)"]

    SOT -->|"imported + spread (*)"| PYLINES["scripts/relocate.py\nGITIGNORE_LINES\n.deft-cache/ + sentinels + eval entries"]
    SOT -->|"mirrored (parity test)"| GOLINES["cmd/deft-install/setup.go\ncanonicalGitignoreLines"]

    PYLINES --> ENSURE_PY["_ensure_gitignore_lines()\ndeposit / heal consumer .gitignore"]
    GOLINES --> ENSURE_GO["EnsureGitignoreLines()\ndeposit / heal consumer .gitignore"]

    ENSURE_PY --> GI[".gitignore\n.deft/ritual-state.json ✓\n.deft/last-session.json ✓\n.deft/core/ — NOT ignored ✓"]
    ENSURE_GO --> GI

    PTEST["TestCanonicalGitignoreRuntimeSentinels\nMatchPythonSource\n(parity pin)"] -.->|"validates SOT == Go mirror"| SOT
    PTEST -.-> GOLINES

Loading

_{Reviews (2): Last reviewed commit: "fix: address Greptile review findings" | Re-trigger Greptile}