Address Milestone C audit findings

.github/scripts/makefile_guard.py

@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+#
+# Copyright 2026 The Ethos maintainers
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+MAKEFILE = ROOT / "Makefile"
+
+
+def makefile_text() -> str:
+    return MAKEFILE.read_text(encoding="utf-8")
+
+
+def target_block(target: str) -> str:
+    lines = makefile_text().splitlines()
+    start = None
+    for index, line in enumerate(lines):
+        if line == f"{target}:":
+            start = index + 1
+            break
+    if start is None:
+        raise AssertionError(f"{target} target is missing")
+
+    block: list[str] = []
+    for line in lines[start:]:
+        if line and not line.startswith(("\t", " ")):
+            break
+        block.append(line)
+    return "\n".join(block)

.github/scripts/test_milestone_b_internal_checks.py

@@ -18,33 +18,8 @@
 from __future__ import annotations
 
 import unittest
-from pathlib import Path
 
-
-ROOT = Path(__file__).resolve().parents[2]
-MAKEFILE = ROOT / "Makefile"
-
-
-def makefile_text() -> str:
-    return MAKEFILE.read_text(encoding="utf-8")
-
-
-def target_block(target: str) -> str:
-    lines = makefile_text().splitlines()
-    start = None
-    for index, line in enumerate(lines):
-        if line == f"{target}:":
-            start = index + 1
-            break
-    if start is None:
-        raise AssertionError(f"{target} target is missing")
-
-    block: list[str] = []
-    for line in lines[start:]:
-        if line and not line.startswith(("\t", " ")):
-            break
-        block.append(line)
-    return "\n".join(block)
+from makefile_guard import makefile_text, target_block
 
 
 class MilestoneBInternalCheckTests(unittest.TestCase):

.github/scripts/test_milestone_c_closeout_record.py

@@ -44,7 +44,8 @@ def test_record_is_indexed(self) -> None:
     def test_record_names_internal_validation_command(self) -> None:
         text = record_text()
 
-        self.assertIn("Validated `main` HEAD: `4e3adbb`", text)
+        self.assertIn("Validated source HEAD before this record: `4e3adbb`", text)
+        self.assertIn("Closeout record commit on `main`: `21d1810`", text)
         self.assertIn(
             "make milestone-c-internal-checks PYTHON=<jsonschema-venv>/bin/python",
             text,

.github/scripts/test_milestone_c_internal_checks.py

@@ -18,33 +18,8 @@
 from __future__ import annotations
 
 import unittest
-from pathlib import Path
 
-
-ROOT = Path(__file__).resolve().parents[2]
-MAKEFILE = ROOT / "Makefile"
-
-
-def makefile_text() -> str:
-    return MAKEFILE.read_text(encoding="utf-8")
-
-
-def target_block(target: str) -> str:
-    lines = makefile_text().splitlines()
-    start = None
-    for index, line in enumerate(lines):
-        if line == f"{target}:":
-            start = index + 1
-            break
-    if start is None:
-        raise AssertionError(f"{target} target is missing")
-
-    block: list[str] = []
-    for line in lines[start:]:
-        if line and not line.startswith(("\t", " ")):
-            break
-        block.append(line)
-    return "\n".join(block)
+from makefile_guard import makefile_text, target_block
 
 
 class MilestoneCInternalCheckTests(unittest.TestCase):

.github/scripts/test_rag_chunk_alpha.py

@@ -18,33 +18,8 @@
 from __future__ import annotations
 
 import unittest
-from pathlib import Path
 
-
-ROOT = Path(__file__).resolve().parents[2]
-MAKEFILE = ROOT / "Makefile"
-
-
-def makefile_text() -> str:
-    return MAKEFILE.read_text(encoding="utf-8")
-
-
-def target_block(target: str) -> str:
-    lines = makefile_text().splitlines()
-    start = None
-    for index, line in enumerate(lines):
-        if line == f"{target}:":
-            start = index + 1
-            break
-    if start is None:
-        raise AssertionError(f"{target} target is missing")
-
-    block: list[str] = []
-    for line in lines[start:]:
-        if line and not line.startswith(("\t", " ")):
-            break
-        block.append(line)
-    return "\n".join(block)
+from makefile_guard import makefile_text, target_block
 
 
 class RagChunkAlphaTests(unittest.TestCase):

.github/scripts/test_security_report_alpha.py

@@ -18,33 +18,8 @@
 from __future__ import annotations
 
 import unittest
-from pathlib import Path
 
-
-ROOT = Path(__file__).resolve().parents[2]
-MAKEFILE = ROOT / "Makefile"
-
-
-def makefile_text() -> str:
-    return MAKEFILE.read_text(encoding="utf-8")
-
-
-def target_block(target: str) -> str:
-    lines = makefile_text().splitlines()
-    start = None
-    for index, line in enumerate(lines):
-        if line == f"{target}:":
-            start = index + 1
-            break
-    if start is None:
-        raise AssertionError(f"{target} target is missing")
-
-    block: list[str] = []
-    for line in lines[start:]:
-        if line and not line.startswith(("\t", " ")):
-            break
-        block.append(line)
-    return "\n".join(block)
+from makefile_guard import makefile_text, target_block
 
 
 class SecurityReportAlphaTests(unittest.TestCase):