refactor(cut-criteria): single Python script, drop base64 (#386)

Makefile

@@ -223,25 +223,16 @@ deprecation-check:  ## Enforce the deprecation policy at docs/DEPRECATION.md (v1
 	@bash scripts/deprecation-check.sh
 
 cut-criteria-status:  ## Compute the live status of every v1.0-rc1 cut criterion from docs/cut-criteria.yaml. Prints `id\tstatus\ttitle` per row; read-only, never gates.
-	@bash scripts/cut-criteria-status.sh
+	@python3 scripts/cut_criteria.py status
 
 cut-criteria-render:  ## Regenerate docs/v1-rc1-cut-criteria.md from docs/cut-criteria.yaml. Source of truth is the YAML; the markdown is rendered.
-	@bash scripts/cut-criteria-render.sh
+	@python3 scripts/cut_criteria.py render
 
 cut-criteria-check:  ## Drift gate: rendered docs/v1-rc1-cut-criteria.md must match what `make cut-criteria-render` would produce against the current docs/cut-criteria.yaml. Catches PRs that ship a criterion's artifact without re-rendering.
-	@# Render to a tempfile and diff against the on-disk copy. Both
+	@# Renders in-process and diffs against the on-disk copy. Both
 	@# the YAML source and the live repo state feed the render: a PR
 	@# that updates either without re-rendering trips this gate.
-	@tmp=$$(mktemp); \
-	bash scripts/cut-criteria-render.sh docs/cut-criteria.yaml "$$tmp" >/dev/null; \
-	if ! diff -u docs/v1-rc1-cut-criteria.md "$$tmp"; then \
-	  rm -f "$$tmp"; \
-	  echo ""; \
-	  echo "cut-criteria-check: docs/v1-rc1-cut-criteria.md is out of sync with docs/cut-criteria.yaml."; \
-	  echo "Run \`make cut-criteria-render\` and commit the result."; \
-	  exit 1; \
-	fi; \
-	rm -f "$$tmp"
+	@python3 scripts/cut_criteria.py check
 
 verify: check license-check generate-fixtures-check build-tags nccl-fr-rce-gate register-lint actionlint zizmor doc-check deprecation-check no-autoupdate-check  ## Pre-push gate. Medium (<30s); CI handles heavy gates (test, coverage, govulncheck, fuzz, build).
 

docs/cut-criteria.yaml

@@ -5,7 +5,7 @@
 # `docs/v1-rc1-cut-criteria.md`. CI fails any PR that lands a feature
 # without re-rendering, so the markdown can never drift from this spec.
 #
-# Status (☑ / ⧗ / ☐) is COMPUTED, not stored. `scripts/cut-criteria-status.sh`
+# Status (☑ / ⧗ / ☐) is COMPUTED, not stored. `scripts/cut_criteria.py status`
 # runs each criterion's `rubric_check.artifact_exists` (and optional
 # `rubric_check.gate_script`) against the live repo state and renders
 # the result inline. The per-PR ☐→☑ flip dance is gone: a PR that ships

docs/cut-criteria.yaml.md

@@ -56,7 +56,7 @@ Inspirations:
 
 ## Status computation
 
-`scripts/cut-criteria-status.sh` runs each criterion's `rubric_check`
+`scripts/cut_criteria.py status` runs each criterion's `rubric_check`
 against the live repo. The decision table is:
 
 | artifact_exists | gate_script         | computed status |
@@ -100,8 +100,8 @@ but forgets to re-render the markdown will fail CI.
 |-------------------------------------------------|-----------------------------------|
 | Rubric, citation, narrative, ownership          | `docs/cut-criteria.yaml`          |
 | Status (☐ / ⧗ / ☑)                            | Don't — it's computed.            |
-| Static framing prose (intro, legend, out-of-scope, drift policy) | `scripts/cut-criteria-render.sh` |
-| Status decision table / glyph bytes             | `scripts/cut-criteria-status.sh`  |
+| Static framing prose (intro, legend, out-of-scope, drift policy) | `scripts/cut_criteria.py` (`render()`) |
+| Status decision table / glyph bytes             | `scripts/cut_criteria.py` (`status_for()`) |
 | Rendered markdown                               | Never. Run `make cut-criteria-render`. |
 
 ## Adding a new criterion
@@ -114,9 +114,13 @@ but forgets to re-render the markdown will fail CI.
    `rubric_check.gate_script` so the status walks `☐ → ⧗ → ☑`.
 3. Run `make cut-criteria-render` and commit both files.
 
-## Why bash + YAML, not Go
+## Why Python + YAML, not Go
 
-The render path is a 200-line problem with no performance budget. Bash
-+ `python3 -c yaml.safe_load` is portable, requires no build step, and
-makes the rubric checks themselves first-class shell — operators can
-copy a single line out of the YAML and run it locally.
+The render path is a 300-line problem with no performance budget.
+`python3` + `PyYAML` is portable, requires no build step, and makes the
+rubric checks themselves first-class shell — operators can copy a
+single block out of the YAML and run it locally. A single Python
+module (`scripts/cut_criteria.py`) carries `status`, `render`, `check`,
+and `test` subcommands, replacing the earlier three-script bash setup
+whose base64-over-TSV plumbing existed only to survive embedded
+newlines through a shell pipeline.

docs/v1-rc1-cut-criteria.md

@@ -26,7 +26,7 @@ gate matrix that mirrors the criteria below.
 - ⧗ in progress — actively being developed (PR open or branch landed against rubric)
 - ☑ shipped — merged on `main` and the falsifiable rubric is provably satisfied
 
-Status is COMPUTED by `scripts/cut-criteria-status.sh` against the live
+Status is COMPUTED by `scripts/cut_criteria.py status` against the live
 repo state at render time; never hand-edited in this file.
 
 ---