Untrack the cascaded fleet payload

[John-David Dalton (jdalton)]

socket-facts stops git-tracking the shared tooling payload. 2,600 files leave the repo; a fresh clone fetches them from the published tooling bundle during pnpm install. Tracked files go from 2,768 to 165.

This is the pilot for the wider move — one repo already works this way, and five more follow this one.

What changed

The payload (scripts/fleet, .claude, .config/fleet, .git-hooks, docs/agents.md, test/fleet) is shared tooling, not repo content. It now arrives only in the bundle and is gitignored here, so a tooling update no longer lands as a 2,600-file review-noise commit.

The repo's tooling config names the bundle version this repo tracks. package.json gained sync-fleet and fleet:status; its prepare already ran the bootstrap fetch first, so no change was needed there.

What stays tracked

Anything a tool reads before our fetch can run has to be in the commit. That was already understood for .github/workflows and .github/actions/fleet — GitHub reads those from the committed default branch before any job starts. Three more files turned out to be in the same class, and the untrack list was swallowing all three:

File	Who reads it first	What breaks without it
.npmrc	pnpm, at install time	ignore-scripts and min-release-age silently lapse
patches/*.patch	pnpm, during resolution	cold clone dies with ENOENT
.github/dependabot.yml	GitHub, no job runs	Dependabot stops opening update PRs

Receipts

A cold clone before the fix:

$ pnpm install
[ENOENT] ENOENT: no such file or directory, open '/tmp/facts-cold/patches/minimatch@10.2.6.patch'

.npmrc carries ignore-scripts=true and min-release-age=7. Without it on disk, the very first install of a fresh clone runs every dependency's lifecycle scripts and skips the release-age soak.

The Dependabot failure is already visible in the wild. The repo that converted before this one had its .github/dependabot.yml untracked the same way, and it now sits on 12 open Dependabot alerts with no update PR since 2026-05-21.

Proof

A fresh clone of this branch, with nothing but pnpm install:

$ git clone --branch jdalton/thin-fleet-payload … /tmp/facts-cold && cd /tmp/facts-cold
pre-install: scripts/fleet absent | .npmrc present | patches 3
$ pnpm install
. prepare: install-fleet: placed 2701 file(s) + 2 segment(s) → /tmp/facts-cold
Done in 12.4s
$ git status --short          # clean — the ignore list covers the payload exactly
$ node scripts/fleet/check/paths-are-canonical.mts
✔ Path-hygiene check passed (1 path, 1 reference)

pnpm run lint --all, pnpm run type, and pnpm test are green locally (135 tests, 17 files).

Also in here

A tooling update rides along, because no bundle release exists at this repo's previous tooling level and the untrack needs a release to fetch from. It refreshes the tracked CI surface and the CLAUDE.md / pnpm-workspace.yaml merged sections, and the lockfile is regenerated to match the new catalog so CI's --frozen-lockfile install stays happy.

Three files under scripts/fleet survived the untrack because the bundle no longer ships them under those names — strip-ai-attribution.mts, check/prose-em-dash-chains-are-absent.mts, and collapse-bot-comments.mts. Each was orphaned by an upstream rename and never cleaned up, since the cleanup only covers files a previous bundle install recorded and this repo had never installed one. Nothing referenced them, and the bundle ships a successor for each, so they are deleted. Git-tracked scripts/fleet is now zero files.

Needs an upstream follow-up

The .npmrc / patches / dependabot.yml fix above is local to this repo, and the next conversion run would undo it — the ignore list is rebuilt from the bundle manifest every time. The durable fix belongs upstream, extending the always-tracked set beyond .github/workflows and .github/actions/fleet. Land that before converting the remaining five repos, or each one repeats these three regressions.

The patches regression is new since the first repo converted: that one escapes it only because it tracks an older bundle that did not ship patches/. Anything converting against a current bundle hits it.

---

Note

High Risk
Large structural change to how tooling is sourced (git vs bundle) with cold-clone, CI hydration, and pnpm/Dependabot dependencies; mistakes in ignore rules or tracked bootstrap files can break installs or security automation across the fleet pilot.

Overview
Untracks the shared fleet tooling payload (~2,600 paths under scripts/fleet, .claude, .config/fleet, .git-hooks, docs/agents.md, test/fleet) so they are gitignored and materialized from the published fleet bundle on pnpm install / CI checkout instead of living in every commit.

The repo now pins that bundle in .config/repo/socket-wheelhouse.json (bundle.ref / cascadeSha) and exposes sync-fleet and fleet:status for manual fetch/status. prepare still bootstraps via scripts/repo/bootstrap/prepare.mts, which pulls the bundle when needed and reconciles workspace wiring after the first install.

Pre-install surfaces stay committed so tools that read the tree before bootstrap can run: .github/workflows and .github/actions/fleet (including thin-checkout hydration and the expose-actions-runtime bridge for cache credentials), plus .npmrc, patches/, and .github/dependabot.yml so cold clones do not lose install policy, patch resolution, or Dependabot.

Also removes three orphaned scripts/fleet files the bundle no longer ships under those names, refreshes merged tooling sections and lockfile for the new bundle/catalog, and notes an upstream follow-up to extend the always-tracked set so future repo conversions do not re-break those three files.

^{Reviewed by Cursor Bugbot for commit 8db956e. Configure here.}