No warning when .claude/ is git-ignored, so the lint baseline, acceptance log and project-local rules are never versioned #523

Files: bin/init-project.sh lines 606-613 (ignores only .claude/settings.local.json), skills/lint-that-actually-runs.md:150 and project-bin/lint-gate.sh:321 (both assume lint-baseline.json is in git), bin/status.sh / bin/gate-check.sh (no check) · Toolkit: eec646e · Found: 21 Oct 2026

Summary

The toolkit keeps accepted lint debt in three files under .claude/: lint-baseline.json (the ratchet),
lint-acceptances.tsv (who accepted which rise, and why, including security-tier rises approved in chat) and
project-local rules in lint-rules/. Its docs treat the baseline as versioned ("Before this file existed the only
history was lint-baseline.json in git", lint-that-actually-runs.md:150; same in lint-gate.sh:321).

If a project's .gitignore excludes the whole .claude/ folder (here a line /.claude/ that came in with the first
commit, not from the toolkit), none of those files is in git. A fresh clone gets no baseline, so the first
lint-gate.sh run takes whatever it sees as a new baseline, and the record of accepted security rises is lost. No
toolkit check notices.

Note for any fix: git cannot re-include a file whose parent directory is excluded. /.claude/ plus
!/.claude/lint-baseline.json does not work; it has to be /.claude/* followed by the negations.

Reproduce

printf '/.claude/\n' >> .gitignore
git check-ignore -v .claude/lint-baseline.json .claude/lint-acceptances.tsv
  .gitignore:N:/.claude/   .claude/lint-baseline.json
  .gitignore:N:/.claude/   .claude/lint-acceptances.tsv
bin/status.sh <project> --brief      # no warning
bin/gate-check.sh <project>          # no warning

Expected

status.sh (or gate-check.sh, or lint-gate.sh --update-baseline) warns when lint-baseline.json,
lint-acceptances.tsv or an edited project-local rule is ignored or untracked:
lint debt is not versioned: .claude/lint-baseline.json is git-ignored (.gitignore:23 '/.claude/').

Suggested fix (ranked)

1. A check in status.sh --brief using git check-ignore -q on the three paths; one line, no block.
2. init-project.sh: when it finds a /.claude/ line, offer to rewrite it as /.claude/* plus
   !/.claude/lint-baseline.json, !/.claude/lint-acceptances.tsv, !/.claude/lint-rules/, keeping
   settings.local.json and per-machine state ignored. Ask; do not rewrite silently.
3. In lint-gate.sh --update-baseline, print the reminder to commit the baseline only when it is actually trackable.

How to retest

The repro above. Pass: status.sh --brief prints the warning.