← back to Hollywood Import
Hollywood generator: positive SKU shape-guard at write choke-point (TK-11054)
3c85ec7b6a149bf17f95bd9810591ecd47c03f45 · 2026-08-31 15:37:03 -0700 · Steve Abrams
Replace the narrow /^(DWHW2?|DWHD)-/ reject with a positive allow-list at the
--apply choke-point in hollywood-create.mjs: write ONLY when dw_sku is a valid
original line code (ORIG) and is neither a fabricated DW-vendor code (FABRICATED)
nor a bare Momentum number (BARE_NUMBER). Fail-loud SKIP + SKIP_BAD_SKU_SHAPE
audit line otherwise; never mint, never allocate a new DWHD/DWHW sequential.
Regexes byte-identical to the dw-hollywood-sku-canary detection. assign-sku.mjs
staging minter gets a matching fabricated/bare-number assertion. This is the
^DWHD shape-guard the ~/.dw-fixer-stop fleet freeze required as its lift-condition.
Verified: dry-run flags 2203/2203 uncreated acoustic DWHD-* as would-SKIP;
--apply simulation CREATE=0 SKIP=2203; 14/14 allow/block unit cases (incl.
DWHV/DWYX/DWKK families the old narrow guard missed); canary steady WARN=4089
(no new violations).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Files touched
M hollywood-create.mjsM momentum-feed/assign-sku.mjs
Diff
commit 3c85ec7b6a149bf17f95bd9810591ecd47c03f45
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Mon Aug 31 15:37:03 2026 -0700
Hollywood generator: positive SKU shape-guard at write choke-point (TK-11054)
Replace the narrow /^(DWHW2?|DWHD)-/ reject with a positive allow-list at the
--apply choke-point in hollywood-create.mjs: write ONLY when dw_sku is a valid
original line code (ORIG) and is neither a fabricated DW-vendor code (FABRICATED)
nor a bare Momentum number (BARE_NUMBER). Fail-loud SKIP + SKIP_BAD_SKU_SHAPE
audit line otherwise; never mint, never allocate a new DWHD/DWHW sequential.
Regexes byte-identical to the dw-hollywood-sku-canary detection. assign-sku.mjs
staging minter gets a matching fabricated/bare-number assertion. This is the
^DWHD shape-guard the ~/.dw-fixer-stop fleet freeze required as its lift-condition.
Verified: dry-run flags 2203/2203 uncreated acoustic DWHD-* as would-SKIP;
--apply simulation CREATE=0 SKIP=2203; 14/14 allow/block unit cases (incl.
DWHV/DWYX/DWKK families the old narrow guard missed); canary steady WARN=4089
(no new violations).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
hollywood-create.mjs | 38 ++++++++++++++++++++++++++++++++------
momentum-feed/assign-sku.mjs | 9 +++++++++
2 files changed, 41 insertions(+), 6 deletions(-)
diff --git a/hollywood-create.mjs b/hollywood-create.mjs
index 78b2cf7..82a2698 100644
--- a/hollywood-create.mjs
+++ b/hollywood-create.mjs
@@ -13,6 +13,27 @@ const REST = `https://${STORE}/admin/api/2024-10`;
const GQL = `${REST}/graphql.json`;
const H = { 'X-Shopify-Access-Token': TOKEN, 'Content-Type': 'application/json' };
const APPLY = process.argv.includes('--apply');
+
+// ── SKU SHAPE-GUARD (TK-11054, 2026-08-31) ────────────────────────────────
+// Hollywood Wallcoverings is a DW private-label BRAND, not an external vendor.
+// The customer-facing variant SKU + dw_sku MUST be a real ORIGINAL line code
+// (XWH-52359, NOC-105, HWC-61000, XJP-####, …) — NEVER a fabricated DW-vendor
+// code (DWHD-*, DWHW2-*, DWHV-*, DWYX-* …) and NEVER a bare Momentum supplier
+// number (raw digits leak the private-label vendor). These three regexes are
+// kept BYTE-FOR-BYTE identical to the canary's canonical detection at
+// ~/.claude/skills/dw-hollywood-sku-canary/lib.mjs (FABRICATED, ORIG) + scan.mjs
+// (isBareNumber) — the canary is the consumer; drift here would let a bad code
+// slip past it. If a real original code ever falls outside ORIG, widen it in
+// BOTH places in the same change.
+const FABRICATED = /^DW[A-Z]{1,4}\d?-\d/i; // any DW-prefixed base = fabricated for this brand
+const ORIG = /^([A-Z]{2,5})-?(\d{2,})$/i; // a valid original private-label line code
+const BARE_NUMBER = /^\d{5,}$/; // raw Momentum number → private-label leak
+// A dw_sku passes ONLY if it is a valid original code, not fabricated, not a bare number.
+// Positive allow-list (not a deny-list): a brand-new DWxx- family can never slip through.
+function skuShapeOk(dwSku) {
+ const base = String(dwSku || '').replace(/-(sample|yard|roll)$/i, '').trim();
+ return ORIG.test(base) && !FABRICATED.test(base) && !BARE_NUMBER.test(base);
+}
const LIMIT = parseInt((process.argv.find(a => a.startsWith('--limit=')) || '').split('=')[1] || '0', 10);
const AUDIT = new URL('hollywood-create-audit.jsonl', import.meta.url).pathname;
const MANIFEST = (process.argv.find(a => a.startsWith('--manifest=')) || '').split('=')[1] || '';
@@ -129,18 +150,23 @@ for (const it of todo) {
const leakText = pl.product.title + ' ' + pl.product.tags + ' ' + pl.product.body_html + ' ' +
pl.product.metafields.filter(m => !(m.namespace === 'dwc' && m.key === 'real_vendor')).map(m => m.value).join(' ');
const leak = /\b(momentum|versa|innovations|muratto)\b/i.test(leakText);
+ const shapeOk = skuShapeOk(it.dw_sku);
if (!APPLY) {
- console.log(`\n${it.dw_sku} "${pl.product.title}" ${leak ? '⚠LEAK' : 'clean'}`);
+ console.log(`\n${it.dw_sku} "${pl.product.title}" ${leak ? '⚠LEAK' : 'clean'} ${shapeOk ? 'shape✓' : '⛔BAD-SKU-SHAPE (would SKIP)'}`);
console.log(` variants: [${pl.product.variants.map(v => v.option1 + ' ' + v.sku + ' $' + v.price).join(' | ')}]`);
console.log(` tags: ${pl.product.tags.slice(0, 90)} · img: ${pl.product.images[0]?.src ? 'yes' : 'NONE'}`);
continue;
}
if (leak) { console.error(` SKIP LEAK ${it.dw_sku}`); err++; continue; }
- // TK-10679 SKU-shape guard: Hollywood is a private-label BRAND, never a vendor — refuse to stamp a
- // fabricated DWHW2-*/DWHD-* code even if the manifest still carries one. Fail-loud SKIP (belt-and-
- // suspenders with the ~/.dw-fixer-stop kill-switch). Real identity = HW-<hash> / original line code.
- if (/^(DWHW2?|DWHD)-/i.test(String(it.dw_sku || ''))) {
- console.error(` SKIP FABRICATED-SKU-SHAPE ${it.dw_sku} (brand-as-vendor code — TK-10679 guard)`); err++; continue;
+ // TK-11054 SKU shape-guard (supersedes the narrow TK-10679 /^(DWHW2?|DWHD)-/ reject).
+ // Hollywood is a private-label BRAND, never a vendor. POSITIVE allow-list: write ONLY when the
+ // dw_sku is a valid ORIGINAL line code (not a fabricated DWxx- code, not a bare Momentum number).
+ // Fail-loud SKIP — never mint, never allocate a new DWHD/DWHW sequential. This is the ^DWHD
+ // shape-guard the fleet kill-switch (~/.dw-fixer-stop) requires; the kill-switch stays too.
+ if (!shapeOk) {
+ console.error(` SKIP BAD-SKU-SHAPE ${it.dw_sku} (not a valid original line code — TK-11054 guard; never mint a DW-vendor code)`);
+ if (out) out.write(JSON.stringify({ dw: it.dw_sku, action: 'SKIP_BAD_SKU_SHAPE' }) + '\n');
+ err++; continue;
}
try {
const r = await fetch(`${REST}/products.json`, { method: 'POST', headers: H, body: JSON.stringify(pl) });
diff --git a/momentum-feed/assign-sku.mjs b/momentum-feed/assign-sku.mjs
index 39f9fdf..7fe6382 100644
--- a/momentum-feed/assign-sku.mjs
+++ b/momentum-feed/assign-sku.mjs
@@ -87,6 +87,15 @@ async function main() {
// collision guard: fail loud if the opaque transform ever collides (raise HW_HASH_LEN)
const codes = plan.map(p => p.dw_sku);
if (new Set(codes).size !== codes.length) throw new Error('opaque-SKU hash collision → raise HW_HASH_LEN; aborting');
+ // ── SKU SHAPE-GUARD (TK-11054) ─────────────────────────────────────────
+ // Belt-and-suspenders on the STAGING minter. This path mints the forward-fix
+ // HW-<opaque hash> scheme (NOT the DWHD- sequential — that's frozen). Assert
+ // fail-loud that NOTHING it writes is a fabricated DW-vendor code or a bare
+ // Momentum supplier number, which are the two shapes the canary flags. Uses
+ // the same FABRICATED/BARE regexes as the canary + hollywood-create.mjs.
+ const FABRICATED = /^DW[A-Z]{1,4}\d?-\d/i, BARE_NUMBER = /^\d{5,}$/;
+ const bad = plan.filter(p => FABRICATED.test(p.dw_sku) || BARE_NUMBER.test(p.dw_sku));
+ if (bad.length) throw new Error(`SKU shape-guard: ${bad.length} planned code(s) are fabricated/bare-number (e.g. ${bad.slice(0,3).map(b=>b.dw_sku).join(', ')}) — refusing to mint. Real identity = HW-<hash> / original line code.`);
console.log(`assign-sku (forward-fix ${PL_PREFIX}-<opaque hash>): ${plan.length} colorways / ${patterns.length} patterns. SKIPPED ${noNumber.length} with no momentum_sku. Raw number stays in manufacturer_sku only.`);
console.log(' samples:'); plan.slice(0, 4).forEach(p => console.log(` ${p.dw_sku} ${p.cat} "${p.pattern}" / ${p.color} → ${p.city}`));
← 8226908 TK-10679 Phase2: read-only remap dry-run + tier scorer (0 re
·
back to Hollywood Import
·
TK-11415: label the Momentum Meilisearch literal as a vendor 8d08f31 →