tools/

Package main implements the release-time changelog tool (plans 27 and 28): `assemble` folds the changelog.d/ fragments — plus any legacy [Unreleased] body — into a new dated section of CHANGELOG.md, `notes` extracts a released section's body for GitHub Release notes — rewriting its relative links absolute at the tag, since that body is also served raw, where nothing supplies the repository base github.com's own renderer applies on the release page — and `archive` moves a released section to docs/changelog/<version>.md behind an index stub, post-release — byte-reversibly: relative links are re-based for the new location and the inverse rewrite must reproduce the moved section.

Package main implements kmsrole, the guard that holds each GCP identity's key-level KMS role to the Encrypt/Decrypt its binary's packages name (#750).

Package main implements registrycheck, the guard over docs/DIVERGENCES.md's pointers (#452).

Command ripgrepfetch puts the ripgrep archives internal/ripgrep pins into its assets directory, where the next build embeds them (`make ripgrep`).

Package main implements sdkref, the guard over how this repository cites the Anthropic SDK and the other sources it reads at a tag (#722, plan 51).

Command thirdpartylicenses writes THIRD_PARTY_LICENSES at the repository root (`make third-party-licenses`): the license texts of what the ripgrep binaries internal/ripgrep embeds were statically built from, which the worker tarballs and the server image ship beside NOTICE.