docs: replace nonexistent repository references

scripts/verify-public-repository-links.ts

@@ -1,4 +1,4 @@
-/** Reject tracked files that expose the internal repository identity outside audited publishing declarations. */
+/** Reject tracked files that reference an unavailable legacy repository. */
 
 import { execFileSync } from 'node:child_process'
 import { existsSync, lstatSync, readFileSync, readlinkSync } from 'node:fs'
@@ -6,22 +6,13 @@ import { resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
 const root = resolve(import.meta.dirname, '..')
-const internalOwner = ['deepseek', 'harness'].join('-')
-const internalRepository = [internalOwner, internalOwner].join('/')
-const internalIssueShorthand = `${internalOwner}#`
-const trustedPublishingRepositoryUrl = `git+https://github.com/${internalRepository}.git`
-
-/** Exact declarations that intentionally expose the source repository for trusted publishing. */
-const allowedInternalRepositoryLineByFile: Readonly<Record<string, string>> = {
-  'native/landlock-run/packages/entry/package.json': `"url": "${trustedPublishingRepositoryUrl}",`,
-  'native/landlock-run/packages/linux-arm64/package.json': `"url": "${trustedPublishingRepositoryUrl}",`,
-  'native/landlock-run/packages/linux-x64/package.json': `"url": "${trustedPublishingRepositoryUrl}",`,
-  'scripts/check-workspace-constraints.ts': `const repositoryUrl = '${trustedPublishingRepositoryUrl}'`,
-}
+const unavailableOwner = ['deepseek', 'ai'].join('-')
+const unavailableRepositoryName = ['deepseek', 'harness', 'sdk'].join('-')
+const unavailableRepository = `${unavailableOwner}/${unavailableRepositoryName}`
+const archivedAgentNotePrefix = '.agents/notes/archived/'
 
 const namedReferenceCharacters: Readonly<Record<string, string>> = {
   hyphen: '-',
-  num: '#',
   sol: '/',
 }
 
@@ -40,8 +31,8 @@ function canonicalReferenceText(source: string): string {
     .toLowerCase()
 }
 
-/** One tracked reference to the internal repository. */
-export interface InternalRepositoryReference {
+/** One tracked reference to the unavailable repository. */
+export interface UnavailableRepositoryReference {
   /** Repository-relative file path. */
   file: string
   /** One-based source line. */
@@ -49,20 +40,18 @@ export interface InternalRepositoryReference {
 }
 
 /**
- * Locate unaudited internal-repository references in one text file.
+ * Locate unavailable-repository references in one active text file.
  * @param file - Repository-relative path used in diagnostics.
  * @param source - Text to inspect.
- * @returns every matching source line.
+ * @returns every matching source line, excluding frozen archived Agent Notes.
  */
-export function findInternalRepositoryReferences(file: string, source: string): InternalRepositoryReference[] {
-  const references: InternalRepositoryReference[] = []
+export function findUnavailableRepositoryReferences(file: string, source: string): UnavailableRepositoryReference[] {
+  if (file.startsWith(archivedAgentNotePrefix)) return []
+
+  const references: UnavailableRepositoryReference[] = []
   for (const [index, line] of source.split('\n').entries()) {
     const canonicalLine = canonicalReferenceText(line)
-    const isAllowedPublishingDeclaration = line.trim() === allowedInternalRepositoryLineByFile[file]
-    if (!isAllowedPublishingDeclaration
-      && (canonicalLine.includes(internalRepository) || canonicalLine.includes(internalIssueShorthand))) {
-      references.push({ file, line: index + 1 })
-    }
+    if (canonicalLine.includes(unavailableRepository)) references.push({ file, line: index + 1 })
   }
   return references
 }
@@ -73,8 +62,8 @@ function trackedFiles(repoRoot: string): string[] {
     .filter(file => file !== '')
 }
 
-function scanRepository(repoRoot: string): InternalRepositoryReference[] {
-  const references: InternalRepositoryReference[] = []
+function scanRepository(repoRoot: string): UnavailableRepositoryReference[] {
+  const references: UnavailableRepositoryReference[] = []
   for (const file of trackedFiles(repoRoot)) {
     const path = resolve(repoRoot, file)
     if (!existsSync(path)) continue
@@ -82,7 +71,7 @@ function scanRepository(repoRoot: string): InternalRepositoryReference[] {
     if (!stat.isFile() && !stat.isSymbolicLink()) continue
     const source = stat.isSymbolicLink() ? readlinkSync(path) : readFileSync(path, 'utf8')
     if (source.includes('\0')) continue
-    references.push(...findInternalRepositoryReferences(file, source))
+    references.push(...findUnavailableRepositoryReferences(file, source))
   }
   return references
 }
@@ -92,9 +81,9 @@ const isMain = invokedPath !== undefined && import.meta.url === pathToFileURL(re
 if (isMain) {
   const references = scanRepository(root)
   if (references.length === 0) {
-    console.log('verify-public-repository-links: tracked files expose no unexpected internal repository identity.')
+    console.log('verify-public-repository-links: tracked files reference no unavailable repository.')
   } else {
-    console.error('verify-public-repository-links: unexpected internal repository references found:')
+    console.error('verify-public-repository-links: unavailable repository references found:')
     for (const reference of references) console.error(`  ${reference.file}:${String(reference.line)}`)
     process.exitCode = 1
   }