Externalize emitted-artifact templates and the CLI command table into data files

[open-coder-ai]

What

Applies the owner's "externalize, don't hardcode" standard (plan/coding-standards.md §2) to
every emitted-artifact template that was previously a Python string literal. Three fronts, one
PR (per brief plan/spine-a/briefs/w48-chock-templates-to-data.md):

1. Templates out of Python source, into a single src/chock/data/templates/ tree (the
   brief's suggested path), read via chock.resources.template_text/render_template and
   rendered with __TOKEN__ + str.replace (never .format()), so each template file is valid
   in its own language as committed:

   • compile/emitters/ci.py (CI-gate step YAML), git_hook.py (git-hook shim, bash)
   • compile/emitters/in_agent.py (bash + PowerShell one-liners)
   • hooks/installers.py (dispatcher + two wrapper scripts, sh)
   • scaffold/install_ci.py (scaffolded CI workflow YAML), templates.py (three config-file
     scaffolds), agents_md.py (pointer block)
   • scaffold/skills_bridge.py (the bridge-directory marker body)
   • gate/runtime_bundle.py (vendored-runtime Python-source fragments, as .py.tmpl)

   Out of scope by owner decision: error/diagnostic message strings (stay beside the condition
   that raises them) and plugin posture prose (plugin/posture.py and per-store descriptions —
   C1/C3 derive those).

2. AGENTS.md gains a compact externalized_text hard rule recording the standard, beside
   code_comments.

3. cli.py's COMMANDS table becomes data. The name → (module, help/alias) table moves to
   data/commands.json (grouped, order preserved), read once at import time; lazy-import
   (_module_main/_module_fn) behaviour is unchanged.

Proof of byte-identical output

• tests/test_template_data.py: every template renders, every __TOKEN__ round-trips between
  file and renderer (no orphan, no missing), Python .tmpl fragments parse, ownership markers
  survive.
• tests/test_emitter_stability.py (existing goldens) and the runtime-bundle goldens pass
  unchanged.
• Full C2-recipe artifact diff, run independently as part of reconciling this PR: chock sync, then .chock/, .claude/, .cursor/, .github/hooks/ compared byte-for-byte between
  this repo's pre-change state (25d9e96) and this branch, plus chock plugin build --format all and chock marketplace build (all three vendor trees) compared the same way — zero
  bytes differ anywhere (gate-events.jsonl excluded, as specified).
• chock --help output is byte-identical, golden-pinned (tests/fixtures/cli_help.txt); every
  module path in commands.json imports and exposes its entry point
  (tests/test_cli_commands.py).

Package-data / frozen-binary coverage

• pyproject.toml: "chock" = ["data/*.json", "data/templates/**/*"].
• tests/test_wheel_install.py: the built wheel ships every file under data/templates/
  (verified directly against a real wheel build).
• packaging/chock.spec's existing collect_data_files("chock") needed no changes — verified
  directly (not assumed) that it already reaches every file under data/templates/; the CI
  binary smoke greps the rendered pointer block to prove a frozen-binary template read.

CI linting of templates

New template-lint job: shellcheck (via the shellcheck-py PyPI wheel, hash-pinned like every
other tool in this repo) on the shell templates, actionlint (via actionlint-py) on the
complete scaffolded CI workflow template — not the ci-gate step fragment, since actionlint needs
a complete workflow; the fragment is unit-tested instead.

Note on how this PR came together

This PR's first three commits continue a predecessor session's branch
(feat/w48-templates-to-data, corrected into my spawn via an orchestrator amendment after I'd
already built an independent, differently-structured implementation of the same brief). I
verified the predecessor's work critically rather than trusting it — reran the full test suite,
chock check, chock sync --check, ruff, the acceptance suite, a real wheel build, a real
PyInstaller build/collection check, and the full C2 artifact diff myself from scratch — before
building on it. The one issue I found and fixed on top (last commit): CodeQL flagged
_GITATTRIBUTES_TEMPLATE as an unused global (its leading underscore reads as module-private,
but it's genuinely consumed from scaffold/init.py); renamed to match its two siblings in the
same file, which already use no underscore for the identical cross-module usage.

Definition of done

• chock check → 0 errors, 0 warnings, 0 infos
• chock check --only matrix passes (no behavior change)
• chock sync --repo . --check clean
• chock check --only verify clean
• Registry rescanned; no stale entries
• pytest -q green (1047 passed, 1 skipped, pre-existing)
• pytest acceptance/ -c acceptance/pytest.ini --rootdir=acceptance green (packaging touched)
• No version bump (byte-identical emitted output; brief explicitly asks for no version bump)
• CHANGELOG Unreleased entry added
• ruff check . and ruff format --check . clean

Claims

• No surface is described as enforcing more than it installs — this PR changes how
  templates are stored, not what is emitted or installed; INSTALLED_SURFACES and the
  coverage table are unaffected.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[open-coder-ai]

The CodeQL finding on _GITATTRIBUTES_TEMPLATE (unused global) above, plus one more emitted-artifact template this wave's inventory missed (scaffold/skills_bridge.py's bridge-marker text), are fixed in a small follow-up: #101.

---

Generated by Claude Code