fix: stop spawn stamping live registry entries into the public templates

[Jammy2211]

Closes #118.

Overview

scripts/spawn.py::empty_body() implemented the spec's EMPTY action as "keep line 1 of the live file" rather than "keep the header line". Registry ledgers with no H1 therefore had a live registry entry copied into the public fresh-slate templates, violating the hard privacy invariant at docs/pyautobrain/spawn_spec.md:61.

One leak had already shipped: PyAutoMind-template commit 3424dba1 (2026-07-27) carries a live ideas.md line. A second would have shipped on the next regenerate. The canary scan reported clean throughout because CANARY_TOKENS held dataset names only — the spec's own example list names Nightingale, but no name token was ever implemented, and the spec-mandated privacy test did not exist.

What was wrong

empty_body() returned splitlines()[0]. Neither planned.md nor ideas.md contains an H1 anywhere, so that is never a header for them:

EMPTY-ruled file	live line 1	verdict
active.md / parked.md / condemned.md	a real H1	fine
queue.md	# Pytree variant queue	H1, but instance-flavoured
planned.md	a live task slug written as ##	leak
ideas.md	a raw idea bullet	leak

A heading-shape test would not have helped: a task slug written as ## is a structurally valid heading. Only an explicit map separates a title from a registry entry.

Changes

• empty_body() never opens the source. Named ledgers take a generated title from EMPTY_TITLES; glob-matched bibliography files take a generated comment header (spec rule 2). An unmapped EMPTY file raises, same doctrine as UNMATCHED. Keyed by repo-relative path, so a glob-matched file sharing a root ledger's name (bibliography/active.md) cannot inherit its title.
• CANARY_TOKENS gains nightingale and rhayes, with a narrow per-file, per-token CANARY_EXEMPT for LICENSE (copyright attribution is the point of a licence).
• New tests/ + spec rule 1b (KEEP) so the privacy test travels with the generator it guards.
• spawn_drift.yml runs the invariant on PRs touching spawn. The drift job is skipped on PRs, since it diffs the published templates against main and would otherwise report unrelated pre-existing drift.

Review round 2 — the fix reintroduced the leak, then hid it

An independent review (Codex) caught that the first pass republished the exact same strings through a different door. tests/** and scripts/spawn.py are both KEEP-copied verbatim into the public template; the test quoted the real slug and idea line as fixtures, a spawn.py comment quoted the slug, and the first pass had exempted both files wholesale from the canary scan. Confirmed against a generated tree before fixing.

Fixed by removing the cause rather than widening the exemption:

• every fixture is fictional, and every canary token is derived from CANARY_TOKENS at run time, so the test file scans clean on its own merits and needs no exemption;
• only scripts/spawn.py stays exempt — the token list has to live somewhere — and test_only_spawn_py_is_exempt_wholesale fails if that hole ever grows back;
• end-to-end tests now drive generate_all() over a synthetic Mind/Memory and assert no live marker reaches the tree. The original suite unit-tested empty_body() alone, which is precisely why it stayed green while the template leaked.

Verification

• 52 tests pass; the suite fails behaviourally against the pre-fix spawn.py (not merely at import), including the two decisive leak tests.
• Regenerated against live sources: the live slug and idea line are absent from the generated tree, canary clean, unmatched: none.
• Post-merge --check shows 13 expected drifts and nothing else: 3 leak fixes (ideas/planned/queue), 2 bibliography header changes, the new tests/ dir, the 2 files changed here, and 5 pre-existing source drifts.

API Changes

None. spawn.py is a repo-local generator script with no importers outside this repo; no PyAuto library API is touched. empty_body() gained an optional second parameter and is not called anywhere else in the workspace.

Follow-ups filed (not in this PR)

• draft/maintenance/pyautomind/spawn_drift_has_no_generator.md — Spawn Drift detects drift but nothing regenerates. Every green run in its history was a manual dispatch fired seconds after a human ran --apply (16 s and 19 s gaps), so that leg cannot fail and is not an independent check.
• draft/bug/pyautomind/spawn_keep_rules_export_instance_state.md — two further pre-existing holes surfaced by the same review: .github/** exports live incident history through owner-only substitution, and SPECIAL:autonomy_log still parses live bytes (the same hazard fixed here).

Ship notes

Heart was YELLOW at ship time on three reasons, all unrelated to this change (workspace validation, tenant-firewall manifest drift, stale release rehearsal); acknowledged by the human.

Do not run /spawn --apply until this merges — regenerating from live main beforehand runs the old, leaking generator.

🤖 Generated with Claude Code