[thekevinbot]

Fixes #1223 (part 2: one glob rule on every surface).

[[table]] glob and [dirsql] ignore compiled with globset defaults, so * and ? crossed /; path-tables already compiled with literal_separator(true). All three Glob::new sites in packages/rust/src/matcher.rs (table globs, the ignore set, the <dir>/** ignore-dir set) now go through one GlobBuilder::new(p).literal_separator(true).build(). ** is unchanged, so the built-in **/node_modules/** / **/.git/** skips and any **/*.ext glob behave as before. A {name} placeholder matches exactly one segment.

No other Glob::new site exists: vtab.rs, parsed_vtab.rs and vtab_scaffold.rs already route through scanner::compile_glob.

Breaking: a config that relied on * crossing / must write ** (migration fragments per package). Parity: the matcher is shared core, so all three SDKs change together; no drift, PARITY.md unchanged.

Tests

• matcher.rs: one test per config-glob and ignore row of the measured table (*, folder, folder/*, folder/**, **/*.md, **/*, ignore folder/*, ignore *), the default ignores at every depth, the <dir>/*/** ignore-dir case, ? not crossing /, and a {name} placeholder matching one segment only.
• tests/from_config.rs: nested fixture (root.json, folder/a.json, folder/sub/b.json) -- glob = "*.json" ingests root.json only; ignore = ["folder/*"] + glob = "**/*.json" yields folder/sub/b.json and root.json.
• Red commit ea63e69 pushed first; CI Unit tests / Integration tests failed on exactly those assertions (7 matcher + 2 from_config) before the implementation was pushed.

Hand-check

cargo build --release --features cli, run from a 7-file fixture (root.md, root.txt, folder/a.md, folder/a.txt, folder/sub/b.md, folder/sub/b.txt, sibling/c.md) with the config outside the tree, SELECT count(*) FROM t -c cfg.toml:

config	rows	before (#1223 table)
glob = "*"	2	7
glob = "folder"	0	0
glob = "folder/*"	2	4
glob = "folder/**"	4	4
glob = "**/*.md"	4	4
glob = "**/*"	7	7
ignore = ["folder/*"] + glob = "**/*"	5	3
ignore = ["folder/*"] + FROM './'	5	3
ignore = ["*"] + glob = "**/*"	5	0
ignore = ["*"] + FROM './'	5	0
glob = "{name}/*.md"	2 (folder/a.md, sibling/c.md)	--

Changelog / Migrations

• Changelog fragment added under <root>/<pkg>/changelog.d/ for each changed package: packages/rust, packages/python, packages/ts (2026-10-03-one-glob-rule-for-config-globs.md)
• Migration fragment added under <root>/<pkg>/migrations.d/ for each of the three packages (the * -> ** rewrite)

E2E Verification

• Ran e2e suites locally for every affected SDK
• Python SDK e2e: pass (40 passed, 2 xfailed)
• TypeScript SDK e2e: pass (6 files, 18 tests)
• Rust core e2e (if applicable): pass (cargo test --workspace --features cli, 0 failures)
• packages/python/e2e-attestations/claude-1223-config-glob-rule.json receipt written (just e2e-attest-python)
• packages/ts/e2e-attestations/claude-1223-config-glob-rule.json receipt written (just e2e-attest-ts)
• Command(s) run: cargo test --workspace --features cli; cargo build --release --features cli; cd packages/python && uv run maturin develop --release; cd packages/ts && pnpm build; just e2e-attest-python; just e2e-attest-ts; just preflight
• Result summary: all green locally; just preflight reported only the two e2e-verify receipt gates failing before attestation, clean after.