storage: configure git and xet

.gitattributes

@@ -1,11 +1,107 @@
-testdata/** filter=lfs diff=lfs merge=lfs -text
-crates/**/tests/fixtures/** filter=lfs diff=lfs merge=lfs -text
-*.bin filter=lfs diff=lfs merge=lfs -text
-*.gif filter=lfs diff=lfs merge=lfs -text
-*.wsc filter=lfs diff=lfs merge=lfs -text
-*.pal filter=lfs diff=lfs merge=lfs -text
-*.wagame filter=lfs diff=lfs merge=lfs -text
-*.WAgame filter=lfs diff=lfs merge=lfs -text
-crates/*/data/** filter=lfs diff=lfs merge=lfs -text
-testdata/**/*.md !text -filter -merge -diff
-testdata/**/.gitignore !text -filter -merge -diff
+# Code, documentation and manifests remain ordinary Git text.
+* text=auto eol=lf filter=openwa-code
+# Payload directories include small textual test data and reference files.
+**/assets/** filter=lfs diff=lfs merge=lfs -text !eol
+**/references/** filter=lfs diff=lfs merge=lfs -text !eol
+**/assets-src/** filter=lfs diff=lfs merge=lfs -text !eol
+**/compiled-assets/** filter=lfs diff=lfs merge=lfs -text !eol
+**/compiled-shaders/** filter=lfs diff=lfs merge=lfs -text !eol
+testdata/** filter=lfs diff=lfs merge=lfs -text !eol
+crates/**/tests/fixtures/** filter=lfs diff=lfs merge=lfs -text !eol
+crates/*/data/** filter=lfs diff=lfs merge=lfs -text !eol
+# Payload formats outside these directories are also stored through Xet.
+*.7[zZ] filter=lfs diff=lfs merge=lfs -text !eol
+*.[aA] filter=lfs diff=lfs merge=lfs -text !eol
+*.[aA][aA][sS] filter=lfs diff=lfs merge=lfs -text !eol
+*.[aA][rR][eE][nN][aA] filter=lfs diff=lfs merge=lfs -text !eol
+*.[aA][sS][eE] filter=lfs diff=lfs merge=lfs -text !eol
+*.[bB][aA][nN][kK] filter=lfs diff=lfs merge=lfs -text !eol
+*.[bB][iI][nN] filter=lfs diff=lfs merge=lfs -text !eol
+*.[bB][lL][eE][nN][dD] filter=lfs diff=lfs merge=lfs -text !eol
+*.[bB][mM][pP] filter=lfs diff=lfs merge=lfs -text !eol
+*.[bB][oO][tT] filter=lfs diff=lfs merge=lfs -text !eol
+*.[bB][sS][pP] filter=lfs diff=lfs merge=lfs -text !eol
+*.[cC][rR][oO][sS][sS][hH][aA][iI][rR] filter=lfs diff=lfs merge=lfs -text !eol
+*.[cC][uU][bB][eE] filter=lfs diff=lfs merge=lfs -text !eol
+*.[dD][aA][tT] filter=lfs diff=lfs merge=lfs -text !eol
+*.[dD][dD][sS] filter=lfs diff=lfs merge=lfs -text !eol
+*.[dD][lL][lL] filter=lfs diff=lfs merge=lfs -text !eol
+*.[dD][oO][cC] filter=lfs diff=lfs merge=lfs -text !eol
+*.[dD][oO][cC][xX] filter=lfs diff=lfs merge=lfs -text !eol
+*.[dD][yY][lL][iI][bB] filter=lfs diff=lfs merge=lfs -text !eol
+*.[eE][xX][eE] filter=lfs diff=lfs merge=lfs -text !eol
+*.[eE][xX][rR] filter=lfs diff=lfs merge=lfs -text !eol
+*.[fF][bB][xX] filter=lfs diff=lfs merge=lfs -text !eol
+*.[fF][lL][aA][cC] filter=lfs diff=lfs merge=lfs -text !eol
+*.[gG][iI][fF] filter=lfs diff=lfs merge=lfs -text !eol
+*.[gG][lL][bB] filter=lfs diff=lfs merge=lfs -text !eol
+*.[gG][lL][tT][fF] filter=lfs diff=lfs merge=lfs -text !eol
+*.[gG][zZ] filter=lfs diff=lfs merge=lfs -text !eol
+*.[hH][dD][rR] filter=lfs diff=lfs merge=lfs -text !eol
+*.[iI][cC][nN][sS] filter=lfs diff=lfs merge=lfs -text !eol
+*.[iI][cC][oO] filter=lfs diff=lfs merge=lfs -text !eol
+*.[iI][qQ][mM] filter=lfs diff=lfs merge=lfs -text !eol
+*.[iI][xX][mM] filter=lfs diff=lfs merge=lfs -text !eol
+*.[iI][xX][pP][lL] filter=lfs diff=lfs merge=lfs -text !eol
+*.[jJ][pP][eE][gG] filter=lfs diff=lfs merge=lfs -text !eol
+*.[jJ][pP][gG] filter=lfs diff=lfs merge=lfs -text !eol
+*.[kK][tT][xX] filter=lfs diff=lfs merge=lfs -text !eol
+*.[kK][tT][xX]2 filter=lfs diff=lfs merge=lfs -text !eol
+*.[lL][iI][bB] filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][aA][pP] filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][bB]3[dD][aA][tT] filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][bB]3[tT][xX][tT] filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][dD]3 filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][dD]4 filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][dD]5[aA][nN][iI][mM] filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][dD]5[mM][eE][sS][hH] filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][dD][cC] filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][dD][sS] filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][eE][sS][hH] filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][oO][vV] filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][pP]3 filter=lfs diff=lfs merge=lfs -text !eol
+*.[mM][pP]4 filter=lfs diff=lfs merge=lfs -text !eol
+*.[oO][bB][jJ] filter=lfs diff=lfs merge=lfs -text !eol
+*.[oO][gG][gG] filter=lfs diff=lfs merge=lfs -text !eol
+*.[oO][tT][fF] filter=lfs diff=lfs merge=lfs -text !eol
+*.[pP][aA][lL] filter=lfs diff=lfs merge=lfs -text !eol
+*.[pP][dD][bB] filter=lfs diff=lfs merge=lfs -text !eol
+*.[pP][dD][fF] filter=lfs diff=lfs merge=lfs -text !eol
+*.[pP][kK]3 filter=lfs diff=lfs merge=lfs -text !eol
+*.[pP][lL][uU][gG][iI][nN] filter=lfs diff=lfs merge=lfs -text !eol
+*.[pP][nN][gG] filter=lfs diff=lfs merge=lfs -text !eol
+*.[pP][pP][tT][xX] filter=lfs diff=lfs merge=lfs -text !eol
+*.[pP][rR][tT] filter=lfs diff=lfs merge=lfs -text !eol
+*.[qQ][vV][mM] filter=lfs diff=lfs merge=lfs -text !eol
+*.[rR][aA][dD] filter=lfs diff=lfs merge=lfs -text !eol
+*.[rR][aA][rR] filter=lfs diff=lfs merge=lfs -text !eol
+*.[rR][oO][qQ] filter=lfs diff=lfs merge=lfs -text !eol
+*.[sS][hH][aA][dD][eE][rR] filter=lfs diff=lfs merge=lfs -text !eol
+*.[sS][kK][iI][nN] filter=lfs diff=lfs merge=lfs -text !eol
+*.[sS][nN][aA][pP][sS][hH][oO][tT] filter=lfs diff=lfs merge=lfs -text !eol
+*.[sS][oO] filter=lfs diff=lfs merge=lfs -text !eol
+*.[sS][pP][vV] filter=lfs diff=lfs merge=lfs -text !eol
+*.[sS][rR][fF] filter=lfs diff=lfs merge=lfs -text !eol
+*.[sS][vV][gG] filter=lfs diff=lfs merge=lfs -text !eol
+*.[tT][aA][rR] filter=lfs diff=lfs merge=lfs -text !eol
+*.[tT][eE][xX][tT][uU][rR][eE] filter=lfs diff=lfs merge=lfs -text !eol
+*.[tT][gG][aA] filter=lfs diff=lfs merge=lfs -text !eol
+*.[tT][iI][fF] filter=lfs diff=lfs merge=lfs -text !eol
+*.[tT][iI][fF][fF] filter=lfs diff=lfs merge=lfs -text !eol
+*.[tT][tT][fF] filter=lfs diff=lfs merge=lfs -text !eol
+*.[vV][oO][iI][cC][eE] filter=lfs diff=lfs merge=lfs -text !eol
+*.[wW][aA][gG][aA][mM][eE] filter=lfs diff=lfs merge=lfs -text !eol
+*.[wW][aA][vV] filter=lfs diff=lfs merge=lfs -text !eol
+*.[wW][eE][bB][mM] filter=lfs diff=lfs merge=lfs -text !eol
+*.[wW][eE][bB][pP] filter=lfs diff=lfs merge=lfs -text !eol
+*.[wW][oO][fF][fF] filter=lfs diff=lfs merge=lfs -text !eol
+*.[wW][oO][fF][fF]2 filter=lfs diff=lfs merge=lfs -text !eol
+*.[wW][sS][cC] filter=lfs diff=lfs merge=lfs -text !eol
+*.[xX][lL][sS][xX] filter=lfs diff=lfs merge=lfs -text !eol
+*.[xX][zZ] filter=lfs diff=lfs merge=lfs -text !eol
+*.[zZ][iI][pP] filter=lfs diff=lfs merge=lfs -text !eol
+*.[zZ][sS][tT] filter=lfs diff=lfs merge=lfs -text !eol
+*.so.* filter=lfs diff=lfs merge=lfs -text !eol
+# Test corpus documentation and ignore rules remain readable Git text.
+testdata/**/*.md text=auto eol=lf filter=openwa-code !diff !merge
+testdata/**/.gitignore text=auto eol=lf filter=openwa-code !diff !merge

.githooks/pre-commit

@@ -0,0 +1,3 @@
+#!/bin/sh
+set -eu
+exec python3 scripts/storage_policy.py check --require-setup

.githooks/pre-push

@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+updates=$(mktemp)
+trap 'rm -f "$updates"' EXIT HUP INT TERM
+cat > "$updates"
+python3 scripts/storage_policy.py check --require-setup
+python3 scripts/storage_policy.py push --require-setup < "$updates"
+git lfs pre-push "$@" < "$updates"

README.md

@@ -133,3 +133,11 @@ But it is true that this is one of the weirdest Rust codebases I've ever worked
 ## Disclaimer
 
 "Worms Armageddon" is a registered trademark of Team17 Software Limited in the EU and other countries. OpenWA is an independent and strictly non-commercial fan project, and is not affiliated with or endorsed by Team17 Software Limited. OpenWA does not include any of the original game's assets, and requires a legally acquired copy of "Worms Armageddon" to use.
+
+## Hugging Face checkout storage
+
+This fork keeps source code in ordinary Git and test/reference payloads in
+Git LFS backed by Xet at [nmarshall/wormz-a](https://huggingface.co/nmarshall/wormz-a).
+After cloning, run `python3 scripts/setup-repository.py` to install the required
+filters and hooks. See [Git and Xet storage](docs/storage.md) for setup, checks
+and the relationship between this fork's history and upstream.

docs/storage.md

@@ -0,0 +1,59 @@
+# Git and Xet storage
+
+The Hugging Face remote is `git@hf.co:nmarshall/wormz-a` (`hf`).
+The `main` branch contains the OpenWA master history with test payloads converted
+to Git LFS pointers. Original authorship and commit messages are preserved, but
+migration changes commit IDs. The original upstream history remains on local
+`master` and `origin/*`; publish `main` to `hf`, not those original refs.
+
+Source, scripts, manifests and documentation remain ordinary Git text.
+Test replays, expected logs, snapshots, scheme fixtures, images and other assets
+use Git LFS backed by Xet, including small textual test payloads.
+`.gitattributes` declares this policy; `scripts/storage_policy.py` enforces it.
+No original game installation or proprietary game assets are added by this setup.
+
+## Set up a checkout
+
+Install Git, Python 3, Git LFS and Git Xet (the local Nix environment already
+provides Git LFS and Git Xet), then run from the repository root:
+
+```sh
+python3 scripts/setup-repository.py
+git lfs pull hf
+python3 scripts/storage_policy.py check --require-setup
+```
+
+For a fresh clone, use:
+
+```sh
+git clone -o hf git@hf.co:nmarshall/wormz-a
+cd wormz-a
+python3 scripts/setup-repository.py
+```
+
+Setup is idempotent. It registers the required `openwa-code` clean filter,
+Git LFS, the Xet custom transfer agent and `.githooks`. It refuses to replace
+an existing local hooks path. The clean filter passes code through unchanged
+and rejects misplaced payloads, non-UTF-8/binary content and code over 2 MiB.
+Asset directory rules route even small text payloads through LFS. Documentation
+and `.gitignore` files in `testdata/` are explicit ordinary-Git exceptions.
+
+Commit and push normally:
+
+```sh
+git add <paths>
+git commit -m "area: short description"
+git push hf main
+```
+
+The pre-commit hook validates staged Git blobs and attributes. The pre-push hook
+validates newly reachable history and then runs `git lfs pre-push`; Git LFS uses
+its registered Xet transfer agent when negotiated with Hugging Face. Files remain
+fully materialized in the working tree, while Git stores only asset pointers.
+Do not bypass the hooks. If adding a new payload format or directory, update both
+`.gitattributes` and the classifier in `scripts/storage_policy.py`.
+
+Adding attributes affects future staging, not existing history. Do not merge the
+unmigrated upstream refs into `main`: that would reintroduce raw historical
+payloads. Future upstream synchronization needs the corresponding LFS conversion
+before integration. Do not rewrite published history or force-push implicitly.

scripts/setup-repository.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Install the committed storage policy in this checkout's local Git config."""
+from pathlib import Path
+import shlex
+import subprocess
+import sys
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def main():
+    if not (ROOT / ".git").exists():
+        raise SystemExit("Run setup in a Git checkout, not a Nix store source copy.")
+    def git(*args):
+        return subprocess.check_output(["git", "-C", str(ROOT), *args], text=True).strip()
+    existing = subprocess.run(["git", "-C", str(ROOT), "config", "--local", "--get", "core.hooksPath"],
+                              text=True, capture_output=True).stdout.strip()
+    if existing and existing != ".githooks":
+        raise SystemExit(f"Existing hooksPath {existing!r}: integrate it before replacing hooks.")
+    git("lfs", "version")
+    git("xet", "--version")
+    git("lfs", "install", "--local", "--skip-repo")
+    git("xet", "install", "--local")
+    git("config", "--local", "lfs.basictransfersonly", "false")
+    python = shlex.quote(sys.executable)
+    script = shlex.quote(str(ROOT / "scripts/storage_policy.py"))
+    # Git shell-quotes its %f substitution. Keep it as a distinct argument.
+    git("config", "--local", "filter.openwa-code.clean", f"{python} {script} clean -- %f")
+    git("config", "--local", "filter.openwa-code.smudge", "cat")
+    git("config", "--local", "filter.openwa-code.required", "true")
+    git("config", "--local", "core.hooksPath", ".githooks")
+    for name in ("pre-commit", "pre-push"):
+        path = ROOT / ".githooks" / name
+        path.chmod(path.stat().st_mode | 0o111)
+    print("Installed local code/LFS filters, Xet transfers and commit/push guards.")
+
+
+if __name__ == "__main__":
+    main()

scripts/storage_policy.py

@@ -0,0 +1,227 @@
+#!/usr/bin/env python3
+"""Fail-closed checks for code Git objects and asset LFS pointers."""
+import argparse
+from contextlib import contextmanager
+import os
+from pathlib import Path, PurePosixPath
+import re
+import subprocess
+import sys
+import shutil
+
+MAX_CODE_BYTES = 2 * 1024 * 1024
+PAYLOAD_SUFFIXES = frozenset(
+    ".png .jpg .jpeg .webp .gif .bmp .tga .tif .tiff .exr .hdr .svg .ico "
+    ".dds .ktx .ktx2 .texture .glb .gltf .obj .fbx .blend .mesh "
+    ".wav .ogg .mp3 .flac .bank .mp4 .webm .mov .ttf .otf .woff .woff2 "
+    ".exe .dll .pdb .so .dylib .a .lib .bin .spv .snapshot .cube "
+    ".zip .7z .rar .tar .gz .xz .zst .pdf .doc .docx .pptx .xlsx "
+    ".pk3 .bsp .aas .md3 .md4 .mdc .mds .md5mesh .md5anim .iqm .ase "
+    ".wagame .wsc .pal .ixpl .plugin .ixm .mb3dat .mb3txt .qvm .roq .icns .dat .map .prt .srf .rad .skin .shader .arena .bot .voice .crosshair".split()
+)
+PAYLOAD_DIRS = frozenset({"assets", "assets-src", "compiled-assets", "compiled-shaders",
+                          ".cache", ".work", "target", "captures", "references", "packages"})
+POINTER = re.compile(rb"version https://git-lfs.github.com/spec/v1\noid sha256:[0-9a-f]{64}\nsize [0-9]+\n")
+
+
+def git(*args, input=None):
+    return subprocess.check_output(["git", *args], input=input)
+
+
+def check_code(path, data):
+    name = PurePosixPath(path)
+    if is_asset(path) or any(part.lower() in PAYLOAD_DIRS for part in name.parts):
+        raise ValueError(f"{path}: asset/build/cache directory is not allowed in code Git")
+    if name.suffix.lower() in PAYLOAD_SUFFIXES or ".so." in name.name.lower():
+        raise ValueError(f"{path}: asset or binary extension belongs under assets/")
+    if len(data) > MAX_CODE_BYTES:
+        raise ValueError(f"{path}: exceeds the {MAX_CODE_BYTES}-byte code limit")
+    if b"\0" in data:
+        raise ValueError(f"{path}: binary data belongs under assets/")
+    try:
+        data.decode("utf-8")
+    except UnicodeDecodeError as exc:
+        raise ValueError(f"{path}: code/documentation must be UTF-8 text") from exc
+    if data.startswith(b"version https://git-lfs.github.com/spec/v1\n"):
+        raise ValueError(f"{path}: LFS pointers belong under assets/")
+
+
+def check_asset(path, data):
+    # Git LFS specifies that an empty file is its own empty pointer.
+    # This contains no payload bytes and must still have filter=lfs attributes.
+    if data and not POINTER.fullmatch(data):
+        raise ValueError(f"{path}: asset Git object is not a canonical LFS pointer; run setup and git add --renormalize")
+
+
+def is_asset(path):
+    name = PurePosixPath(path)
+    parts = name.parts
+    if parts[0] == "testdata":
+        return name.suffix.lower() != ".md" and name.name != ".gitignore"
+    if "fixtures" in parts[:-1] and "tests" in parts[:-1]:
+        return True
+    if parts[0] == "crates" and "data" in parts[:-1]:
+        return True
+    return (any(part in {"assets", "references", "assets-src", "compiled-assets", "compiled-shaders"}
+                for part in parts[:-1]) or name.suffix.lower() in PAYLOAD_SUFFIXES
+            or ".so." in name.name.lower())
+
+
+@contextmanager
+def blob_reader():
+    # One bounded streaming process, rather than two Git launches per asset.
+    process = subprocess.Popen(["git", "cat-file", "--batch"], stdin=subprocess.PIPE,
+                               stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
+    try:
+        yield process
+    finally:
+        process.stdin.close()
+        process.stdout.close()
+        if process.poll() is None:
+            process.terminate()
+        process.wait()
+
+
+def validate_blob(path, oid, reader):
+    reader.stdin.write(oid.encode() + b"\n")
+    reader.stdin.flush()
+    header = reader.stdout.readline().split()
+    if len(header) != 3 or header[1] != b"blob":
+        raise ValueError(f"{path}: invalid or missing Git blob")
+    size = int(header[2])
+    limit = 256 if is_asset(path) else MAX_CODE_BYTES
+    if size > limit:
+        raise ValueError(f"{path}: Git blob is {size} bytes; limit is {limit}")
+    data = reader.stdout.read(size)
+    if len(data) != size or reader.stdout.read(1) != b"\n":
+        raise ValueError(f"{path}: truncated Git batch output")
+    (check_asset if is_asset(path) else check_code)(path, data)
+
+
+def check_index():
+    paths = []
+    with blob_reader() as reader:
+        for entry in git("ls-files", "--stage", "-z").split(b"\0"):
+            if not entry:
+                continue
+            header, path_bytes = entry.split(b"\t", 1)
+            permissions, oid, stage = header.decode().split()
+            path = os.fsdecode(path_bytes)
+            if stage != "0" or permissions not in {"100644", "100755"}:
+                raise ValueError(f"{path}: unresolved, symlink or nested repository entry is not allowed")
+            validate_blob(path, oid, reader)
+            paths.append(path)
+    if paths:
+        raw = git("check-attr", "--cached", "-z", "--stdin", "filter",
+                  input=b"\0".join(os.fsencode(p) for p in paths) + b"\0").split(b"\0")
+        for i in range(0, len(raw) - 1, 3):
+            path, _, value = raw[i:i + 3]
+            path = os.fsdecode(path)
+            expected = b"lfs" if is_asset(path) else b"openwa-code"
+            if value != expected:
+                raise ValueError(f"{path}: expected filter={expected.decode()}, found {value.decode()}")
+        asset_paths = [p for p in paths if is_asset(p)]
+        if asset_paths:
+            raw = git("check-attr", "--cached", "-z", "--stdin", "text", "diff", "merge",
+                      input=b"\0".join(os.fsencode(p) for p in asset_paths) + b"\0").split(b"\0")
+            for i in range(0, len(raw) - 1, 3):
+                path, attr, value = raw[i:i + 3]
+                expected = b"unset" if attr == b"text" else b"lfs"
+                if value != expected:
+                    raise ValueError(f"{os.fsdecode(path)}: incorrect asset {attr.decode()} attribute")
+
+
+def check_push_with_reader(reader):
+    # Validate all newly reachable commits, including files deleted later.
+    # A new remote branch checks its entire reachable history.
+    seen = set()
+    for line in sys.stdin:
+        _, local_oid, _, remote_oid = line.split()
+        if set(local_oid) == {"0"}:
+            continue
+        revisions = [local_oid]
+        if set(remote_oid) != {"0"}:
+            exists = subprocess.run(["git", "cat-file", "-e", remote_oid],
+                                    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+            if exists.returncode == 0:
+                revisions.append("^" + remote_oid)
+        for commit in git("rev-list", *revisions).decode().splitlines():
+            for entry in git("ls-tree", "-rz", commit).split(b"\0"):
+                if not entry:
+                    continue
+                header, path = entry.split(b"\t", 1)
+                permissions, kind, oid = header.decode().split()
+                if permissions not in {"100644", "100755"} or kind != "blob":
+                    raise ValueError(f"{os.fsdecode(path)}: unsupported Git tree entry")
+                key = (os.fsdecode(path), oid)
+                if key not in seen:
+                    validate_blob(*key, reader)
+                    seen.add(key)
+
+
+def check_push():
+    with blob_reader() as reader:
+        check_push_with_reader(reader)
+
+
+def check_setup():
+    if not shutil.which("git-xet"):
+        raise ValueError("git-xet is missing; enter nix develop")
+    required = {
+        "filter.openwa-code.required": "true",
+        "filter.lfs.required": "true",
+        "lfs.customtransfer.xet.path": "git-xet",
+        "lfs.customtransfer.xet.args": "transfer",
+        "lfs.basictransfersonly": "false",
+        "core.hooksPath": ".githooks",
+    }
+    for key, value in required.items():
+        if git("config", "--local", "--get", key).decode().strip() != value:
+            raise ValueError(f"{key}: rerun scripts/setup-repository.py")
+    for key in ("filter.openwa-code.clean", "filter.lfs.clean", "filter.lfs.process"):
+        if not git("config", "--local", "--get", key).strip():
+            raise ValueError(f"{key}: missing filter driver")
+
+
+def check_tree(directory):
+    """Check the asset-free source used by Nix validation/build derivations."""
+    if not directory:
+        raise ValueError("check-tree requires a source directory")
+    root = Path(directory)
+    for path in root.rglob("*"):
+        if path.is_symlink():
+            raise ValueError(f"{path}: source symlink is not allowed")
+        if path.is_file():
+            with path.open("rb") as stream:
+                check_code(path.relative_to(root).as_posix(), stream.read(MAX_CODE_BYTES + 1))
+    if "* text=auto eol=lf filter=openwa-code" not in (root / ".gitattributes").read_text().splitlines():
+        raise ValueError("Code export lacks the required default clean filter")
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("command", choices=["clean", "check", "push", "check-tree"])
+    parser.add_argument("--require-setup", action="store_true")
+    parser.add_argument("path", nargs="?")
+    args = parser.parse_args()
+    try:
+        if args.require_setup:
+            check_setup()
+        if args.command == "clean":
+            data = sys.stdin.buffer.read(MAX_CODE_BYTES + 1)
+            check_code(args.path or "<stdin>", data)
+            sys.stdout.buffer.write(data)
+        elif args.command == "check-tree":
+            check_tree(args.path)
+        elif args.command == "push":
+            check_push()
+        else:
+            check_index()
+    except (ValueError, subprocess.CalledProcessError) as exc:
+        print(f"Storage policy: {exc}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())