[thekevinbot]

Final lane of the one-function-per-file ratchet campaign. internals/checks/src was the last source root with violations at the strictest threshold; this takes it to zero at max_lines = 1.

Fixes #1101

Scope note

The issue listed four violations, all in attestation_guard. Re-measuring on main found eight — platforms_mirror/gate.py and platforms_mirror/typescript_table.py carry four more that a threshold-12 pass left behind. All eight are fixed here, since the goal is zero for the root.

Holder choices

Every split keeps the module's named export in place and moves the private helpers out, one function per module with a colocated test — matching the convention the earlier platforms_mirror splits established (problems.py::problems, literal.py::literal, …).

File	Holder kept	Moved out	Why this holder
attestation_guard/gate.py	run	verdict → verdict.py	run is the composition root cli.py imports. Keeping it in place leaves its * keyword-only marker out of the diff, so the mutant that needed a dedicated assertion when #1052 landed is not re-litigated.
attestation_guard/git_ops.py	— (module removed)	deleted_files.py, commit_messages.py	Two peer exports, neither named for the module. Splitting both leaves no misnamed one-function module behind.
attestation_guard/report.py	report	deletion_annotation, near_miss_annotation	report owns the _ADVICE constant. Keeping it means no constant moves, avoiding the known "moved constant survives mutation" trap. restore_command is a 1-line body — invisible to the rule — and stays with report and _ADVICE.
platforms_mirror/gate.py	run	read → read.py	run is 22 lines of f-strings; moving it would put all of them in the diff for the mutation gate. Moving the 2-line read changes almost nothing.
platforms_mirror/typescript_table.py	typescript_table	requoted, without_comments (with _TOKENS), as_json	Same reason — typescript_table carries the three ParseError messages. _TOKENS moves with without_comments, its only caller; without_comments_test.py covers all five alternation branches so a mutated regex cannot survive.

Verification

just preflight --conventions .github/workflows/internals-checks-ci.yml — 0 failing pairs, 0 skipped (colocated-test, one-function-per-file, unit-lint, integration-lint, unit-coverage, mutation, e2e-verify, declared-deps, uv-sync).

unit mutation: 25 mutants, zero survivors. No exemptions added; the repo's exemption count stays at zero.

Violation count for internals/checks/src at max_lines = 1, measured with a /tmp copy of the config (no repo config was touched — the threshold change is a separate PR):

$ npx -y testing-conventions@0.0.111 unit one-function-per-file \
    --language python --config /tmp/copy.toml internals/checks/src
testing-conventions 0.0.111
$ echo $?
0

Also 0 on 0.0.115, which is npm latest as of this PR — it moved up from 0.0.111 mid-flight.

Manual run

$ dirsql-checks platforms-mirror
ok platforms-mirror: internals/distcheck/src/distcheck/node_flow/platforms.py mirrors
the shared fields of packages/ts/src/platforms.ts across 5 published target(s).

$ dirsql-checks attestation-guard --base-sha origin/main --head-sha HEAD
No e2e attestation receipts deleted.

The failure path was exercised directly with an injected deletion plus a misspelled bypass line; it emits the per-file annotation, the near-miss diagnostic, the restore command and the advice — byte-identical to the pre-split output.

E2E Verification

• Ran e2e suites locally for every affected SDK
• Python SDK e2e: N/A — no packages/python change
• TypeScript SDK e2e: N/A — no packages/ts change
• Rust core e2e (if applicable): N/A — no packages/rust change
• packages/python/e2e-attestations/<branch>.json receipt written if packages/python changed — N/A
• packages/ts/e2e-attestations/<branch>.json receipt written if packages/ts changed — N/A
• Command(s) run: just e2e-attest-internals-checks (uv run python -m pytest tests/e2e -x -q in internals/checks)
• Result summary: 28 passed. Receipt committed at internals/checks/e2e-attestations/claude-ofpf-attestation-guard-split-r7m2.json; git show --stat on that commit shows one file added and no sibling receipts deleted.

Changelog / Migrations

• Changelog fragment added under <root>/<pkg>/changelog.d/ — not required. internals/** is outside changelog-gate scope: changelog_gate/decide.py sets _ROOTS = ("packages", "plugins").
• Migration fragment added under <root>/<pkg>/migrations.d/ — not required; pure refactor, no public API and no behavior change.

PARITY.md is unaffected — no SDK public API is touched.