Publish scripts/sync-metrics.sh — the public tree referenced a file it did not ship

[ib823]

The public branch shipped tooling that pointed at a file it excluded.

sync-metrics.sh sat in sync-public.sh's INTERNAL_PATHS under "internal sync/verification scripts (not needed by external users)". That rationale does not hold for this one: twelve published files reference it.

Not just prose

File	How it breaks
00_SETUP/hooks/pre-commit	invokes it — a public clone's pre-commit hook called a missing script
riinac/tests/metrics_doc_consistency.rs	fails with "run bash scripts/sync-metrics.sh and stage the result" — advice a public clone could not follow
scripts/audit-docs.sh, scripts/godzilla-pipeline.sh	reference it in their own guidance
.cursorrules, .github/copilot-instructions.md, AGENTS.md, COPILOT.md, llms.txt	tell agents to run it
00_SETUP/MAINTAINER_ONBOARDING.md, DOMAIN_R5_CHECKLIST_v1_0_0.md, scripts/generate-metrics.sh	same

How it surfaced

While back-merging riina's #15, which adds a mirror-local scripts/mirror-propagate-metrics.sh. That commit exists precisely because the mirror lacks this script, and its message records the consequence:

the last three metrics refreshes (#10, #12, #14) propagated the test count into the docs BY HAND, matching the file set by reading what the previous refresh happened to touch. That works until a new document starts quoting the number and silently misses the sweep.

The workaround was the symptom. The exclusion was the cause. (I deliberately did not back-merge that script — proof has the real one, and its author named it distinctly to avoid exactly that collision.)

Safe to publish — verified, not assumed

• No secrets, tokens, or container-absolute paths — grepped for token|secret|password|api_key|/home/…|/workspaces/|ghp_: zero hits
• No gate depends on the exclusion — verify-public.sh and public-quality-gates.sh never mention it
• It degrades gracefully. Every target is guarded by if [ -f ], so the internal-only files it also knows about (CLAUDE.md, PROGRESS.md) are skipped on a tree that lacks them

The last point is the load-bearing one, so I ran it against a public-shaped tree — metrics.json plus only the published docs, deliberately no CLAUDE.md and no PROGRESS.md:

Files updated: 5      (README, CHANGELOG, CONTRIBUTING, CERTIFICATION, COMPLIANCE_GUIDE)
Files skipped: 0
exit 0, no error output

The two internal files were skipped silently, exactly as the guards promise.

What stays internal

The four scripts left in that block genuinely are internal — sync-public.sh, verify-public.sh, verify-riina-deploy.sh, generate-full-stack.py. They act on the public/riina remotes or on the private generator; an external clone can neither run them nor need them. The comment now records that distinction so the next person doesn't re-add this one by pattern-matching.

---

Generated by Claude Code