[codex] fix TS allowlist path normalization (#395)

## Root cause

The current compiled checker walks files as `./repo-relative/path`,
while exemptions parsed from `.claude/CLAUDE.md` are stored as
`repo-relative/path`. That meant exact-path exemptions such as
`rescript-ecosystem/packages/core/runtime-tools/bin/rrt.ts` did not
match the generated `.deno.js` runtime artifact even though the table
row was parsed.

The prime backtick hypothesis was not the full issue in the current
source: the row parser already extracted code-span contents. The fix
still normalizes parsed exemption cells by trimming and storing
repo-relative paths, and it normalizes candidate paths before exact/glob
matching.

## Fix

- Normalize exemption paths and matched file paths before comparison so
`./path` and `path` compare as the same repo-relative file.
- Keep exact entries exact and glob entries regex-backed; no substring
fallback was added.
- Keep header/separator rows out of the parsed exemption set.
- Treat `.ts.bak` / `.tsx.bak` as blocked TS artifacts so near-miss
exemption paths do not slip through.
- Expand the regression harness to run both
`scripts/check-ts-allowlist.ts` and the compiled
`scripts/check-ts-allowlist.deno.js` artifact.

## Validation

- `scripts/tests/check-ts-allowlist-test.sh` passes: 36 assertions
across both checker targets.
- Focused repro with
`rescript-ecosystem/packages/core/runtime-tools/bin/rrt.ts` and the
approved CLAUDE.md table is clean after the fix.
- `just check-ts-allowlist-drift` is not clean locally because the
current AffineScript compiler also fails to parse the unmodified HEAD
source, and the recipe mishandles its temp variables after that failure.
The committed `.deno.js` artifact was therefore patched and validated
directly.

## Consumer follow-up

New standards commit SHA to pin for this change:
`681373b30b3615460ac3c802d6ba8db893b48d45`.

Consumers that pin
`hyperpolymath/standards/.github/workflows/governance-reusable.yml@<sha>`
need a follow-up pin bump after this lands, including
`developer-ecosystem` and the k9 repos. Note that current `main` has
drifted from `861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613`; verify the
reusable workflow shape when bumping consumers.

Author: hyperpolymath

scripts/check-ts-allowlist.affine

@@ -88,6 +88,14 @@ fn globToRegex(g: String) -> String {
 
 type Exemption = { raw: String, rx: String }
 
+fn normalizeRepoPath(p: String) -> String {
+  let mut out = p;
+  while (len(out) > 0 && (string_sub(out, 0, 1) == "." || string_sub(out, 0, 1) == "/")) {
+    out = string_sub(out, 1, len(out) - 1);
+  }
+  return out;
+}
+
 fn loadExemptionsFromClaudeMd() -> [Exemption] {
   let mut exemptions = [];
   let text = try {
@@ -116,11 +124,11 @@ fn loadExemptionsFromClaudeMd() -> [Exemption] {
       i = i + 1;
       continue;
     }
-    if (inTable && len(line) > 0 && string_sub(line, 0, 1) == "|") {
-      if (regexMatch(line, "^\\|\\s*`[^`]+`")) {
+    if (inTable && len(line) > 0) {
+      if (regexMatch(line, "^\\s*\\|\\s*`[^`]+`")) {
         let parts = split(line, "`");
         if (len(parts) >= 3) {
-          let raw = parts[1];
+          let raw = normalizeRepoPath(trim(parts[1]));
           exemptions = exemptions ++ [#{ raw: raw, rx: globToRegex(raw) }];
         }
       }
@@ -144,7 +152,7 @@ fn loadExemptionsFromAllowlistFile() -> [Exemption] {
   let lines_len = len(lines);
   while (i < lines_len) {
     let rawLine = lines[i];
-    let line = trim(rawLine);
+    let line = normalizeRepoPath(trim(rawLine));
     if (line == "" || string_sub(line, 0, 1) == "#") {
       i = i + 1;
       continue;
@@ -160,22 +168,28 @@ fn loadExemptions() -> [Exemption] {
 }
 
 fn isExempt(p: String, exemptions: [Exemption]) -> Bool {
+  let target = normalizeRepoPath(trim(p));
   let mut i = 0;
   let ex_len = len(exemptions);
   while (i < ex_len) {
     let e = exemptions[i];
-    if (regexMatch(p, e.rx)) { return true; }
-    let mut bare = e.raw;
-    while (len(bare) > 0 && (string_sub(bare, 0, 1) == "." || string_sub(bare, 0, 1) == "/")) {
-      bare = string_sub(bare, 1, len(bare) - 1);
-    }
-    if (p == bare) { return true; }
-    if (ends_with(e.raw, "/") && regexMatch(p, "^" ++ bare)) { return true; }
+    if (regexMatch(target, e.rx)) { return true; }
+    let bare = normalizeRepoPath(trim(e.raw));
+    if (target == bare) { return true; }
+    if (ends_with(bare, "/") && regexMatch(target, "^" ++ bare)) { return true; }
     i = i + 1;
   }
   return false;
 }
 
+fn isTypeScriptArtifact(name: String) -> Bool {
+  if (ends_with(name, ".ts")) { return true; }
+  if (ends_with(name, ".tsx")) { return true; }
+  if (ends_with(name, ".ts.bak")) { return true; }
+  if (ends_with(name, ".tsx.bak")) { return true; }
+  return false;
+}
+
 pub fn main() -> Int {
   let exemptions = loadExemptions();
   let mut found = [];
@@ -189,7 +203,7 @@ pub fn main() -> Int {
   let af_len = len(all_files);
   while (i < af_len) {
     let f = all_files[i];
-    if (ends_with(f, ".ts") || ends_with(f, ".tsx")) {
+    if (isTypeScriptArtifact(f)) {
       let mut skip = false;
       let segs = split(f, "/");
       let mut j = 0;

scripts/check-ts-allowlist.deno.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MPL-2.0
-// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
+// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 //
 // check-ts-allowlist.ts — Deno port of the inline python3 heredoc that used
 // to live in `.github/workflows/governance-reusable.yml` step
@@ -12,7 +12,8 @@
 // self-loop fixed in hypatia#328. This script eliminates the violation.
 //
 // Behaviour MUST stay byte-identical to the previous Python implementation:
-//   * Walk every `*.ts` / `*.tsx` file under cwd, skipping dotted dirs.
+//   * Walk every `*.ts` / `*.tsx` file under cwd, skipping dotted dirs
+//     and treating `.ts.bak` / `.tsx.bak` backups as banned TS artifacts.
 //   * Allow files in the built-in directory/path allowlist
 //     (bindings/tests/scripts/vendor/examples/ffi/benchmarks/cli, plus any
 //     segment containing 'vscode' or starting with 'deno-').
@@ -72,6 +73,27 @@ function globToRegex(g: string): RegExp {
 
 interface Exemption { raw: string; rx: RegExp; }
 
+function normalizeRepoPath(p: string): string {
+  let out = p.trim();
+  while (out.length > 0 && (out[0] === "." || out[0] === "/")) {
+    out = out.slice(1);
+  }
+  return out;
+}
+
+function normalizeExemptionCell(cell: string): string {
+  let out = cell.trim();
+  const codeSpan = out.match(/^`([^`]+)`$/) ?? out.match(/^`([^`]+)`/);
+  if (codeSpan) {
+    out = codeSpan[1].trim();
+  }
+  return normalizeRepoPath(out);
+}
+
+function nonExemptionCell(cell: string): boolean {
+  return cell === "" || /^:?-{3,}:?$/.test(cell) || /^path\b/i.test(cell);
+}
+
 async function loadExemptionsFromClaudeMd(): Promise<Exemption[]> {
   // Layer 2 — heading-table exemptions parsed from `.claude/CLAUDE.md`.
   //
@@ -110,10 +132,14 @@ async function loadExemptionsFromClaudeMd(): Promise<Exemption[]> {
       inTable = false;
       continue;
     }
-    if (inTable && line.startsWith("|")) {
-      const m = line.match(/^\|\s*`([^`]+)`/);
-      if (m) {
-        exemptions.push({ raw: m[1], rx: globToRegex(m[1]) });
+    const tableLine = line.trim();
+    if (inTable && tableLine.startsWith("|")) {
+      const cells = tableLine.split("|");
+      if (cells.length >= 3) {
+        const raw = normalizeExemptionCell(cells[1]);
+        if (!nonExemptionCell(raw)) {
+          exemptions.push({ raw, rx: globToRegex(raw) });
+        }
       }
     }
   }
@@ -135,7 +161,7 @@ async function loadExemptionsFromAllowlistFile(): Promise<Exemption[]> {
     return exemptions;
   }
   for (const rawLine of text.split("\n")) {
-    const line = rawLine.trim();
+    const line = normalizeExemptionCell(rawLine);
     if (line === "" || line.startsWith("#")) continue;
     exemptions.push({ raw: line, rx: globToRegex(line) });
   }
@@ -149,16 +175,21 @@ async function loadExemptions(): Promise<Exemption[]> {
 }
 
 function exempt(p: string, exemptions: Exemption[]): boolean {
+  const target = normalizeRepoPath(p);
   for (const e of exemptions) {
-    if (e.rx.test(p)) return true;
-    let bare = e.raw;
-    while (bare.length > 0 && (bare[0] === "." || bare[0] === "/")) bare = bare.slice(1);
-    if (p === bare) return true;
-    if (e.raw.endsWith("/") && p.startsWith(bare)) return true;
+    if (e.rx.test(target)) return true;
+    const bare = normalizeRepoPath(e.raw);
+    if (target === bare) return true;
+    if (bare.endsWith("/") && target.startsWith(bare)) return true;
   }
   return false;
 }
 
+function isTypeScriptArtifact(name: string): boolean {
+  return name.endsWith(".ts") || name.endsWith(".tsx") ||
+    name.endsWith(".ts.bak") || name.endsWith(".tsx.bak");
+}
+
 async function* walkTs(dir: string): AsyncIterable<string> {
   for await (const entry of Deno.readDir(dir)) {
     const name = entry.name;
@@ -168,7 +199,7 @@ async function* walkTs(dir: string): AsyncIterable<string> {
     if (entry.isDirectory) {
       yield* walkTs(full);
     } else if (entry.isFile) {
-      if (name.endsWith(".ts") || name.endsWith(".tsx")) {
+      if (isTypeScriptArtifact(name)) {
         yield full;
       }
     }