Check committed file sizes

docs/cli.md

@@ -91,6 +91,12 @@ after workspace-file inspection. Filesystem replacements use the
 `local-replacements` identity and include the declaration path, source line,
 and target; versioned replacements are permitted. Committed module symlinks are
 resolved within the candidate, regardless of `GOWORK`.
+When `validation.file_size` is a non-null object, the command checks each
+committed blob after module-distribution checks. An omitted or null object
+disables the check; an empty object enables the 1,000,000 decimal-byte default.
+Oversized files use the `file-size` identity and report their path and measured
+size against the limit. See the [configuration reference](config.md) for
+literal exclusions and the current-candidate scope.
 
 The optional profile field `expected_push_url` applies only to `publish`. A
 nonempty value must exactly match the effective push URL resolved by Git;

docs/config.md

@@ -79,6 +79,22 @@ For example:
 }
 ```
 
+When `validation.file_size` is an object, ReleaseKit compares each committed
+blob's size with `limit_bytes`. The limit uses decimal bytes and rejects only
+sizes strictly greater than the limit. An omitted or null object disables the
+check; `{}` enables it with a default of 1,000,000 bytes. A missing or null
+`limit_bytes` selects that default, zero is a valid limit, and negative limits
+are invalid.
+
+`validation.file_size.exclusions` contains literal repository-relative file or
+directory paths. Directory exclusions include committed descendants, using path
+boundaries (`assets` does not exclude `assets-old`). Ordinary relative path
+normalization applies; metacharacters are literal and unmatched paths have no
+effect. The check measures regular and symlink blobs, including small binaries;
+symlink size is the committed link text. Gitlinks have no measured size. Only
+the captured candidate is checked, one offending file is reported at a time,
+and historical or aggregate repository size is not measured.
+
 The `delivery` object contains `base_url`, `owner`, `repository`, and optional
 `token_env`. Its values are required when running `deliver`, but credentials are
 not required for `check`, `publish`, or `build`. `token_env` names the
@@ -111,6 +127,9 @@ validation parses committed `go.mod` files after workspace inspection and report
 filesystem replacements as `local-replacements`, with path, directive line, and
 target. Versioned replacements are permitted; parse and inspection failures
 preserve their causes.
+When `validation.file_size` is selected, shared validation checks committed
+blob sizes after module-distribution checks and reports the first oversized
+path with the `file-size` identity and measured and limit byte counts.
 Configured `checks` commands run afterward, once each in order, as additional
 product checks. Artifact builds selected by the separate `build` setting run
 after shared validation and product checks.

docs/consumers/check.md

@@ -54,6 +54,14 @@ path, line, and target as `local-replacements`; versioned replacements are
 permitted. Committed module symlinks are resolved within the candidate. Parse
 and inspection errors retain their causes, and the rule applies even when
 `GOWORK=off`. Its zero value disables the check.
+Set `Validation.FileSize` to check each committed blob against a byte limit.
+Nil disables the check; an empty object enables the default of 1,000,000
+decimal bytes. `LimitBytes` is strict greater-than, accepts zero, and rejects
+negative values. `Exclusions` contains literal repository-relative files or
+directories; excluded directories include descendants. Symlink blobs are
+measured by link-text bytes, and gitlinks are omitted. The check applies to the
+captured candidate and reports one oversized file with its measurement as
+`file-size`; it does not measure historical or aggregate size.
 ReleaseKit calls `AdditionalChecks` once after shared validation when supplied.
 It does not download a different toolchain automatically. If race prerequisites
 are unavailable, the `go-test` check fails rather than being skipped; a selected

docs/consumers/publish.md

@@ -69,6 +69,14 @@ permitted. Committed module symlinks are resolved within the candidate, and
 parse or inspection errors retain their causes. This check is independent of
 `GOWORK`; its zero value disables it, and a failure stops publication before
 product checks or tag creation.
+Set `Validation.FileSize` to check each committed blob against a byte limit.
+Nil disables the check; an empty object enables the default of 1,000,000
+decimal bytes. `LimitBytes` uses strict greater-than, accepts zero, and rejects
+negative values. `Exclusions` contains literal repository-relative files or
+directories, including committed descendants of excluded directories. Symlink
+blob size is its link text; gitlinks are omitted. This check measures only the
+captured candidate and reports one oversized file with its measurement as
+`file-size`; it stops publication before product checks or tag creation.
 
 If `Build` selects targets, ReleaseKit verifies them after the standard suite
 and additional checks, before creating the tag. The operation then rechecks the

docs/internal/overview.md

@@ -46,7 +46,7 @@ these implemented packages:
 | `internal/tempdir` | Disposable system temporary storage outside source worktrees. |
 | `internal/process` | Cancellable child-process execution with per-command environment overlays and removals. |
 | `internal/preparation` | Coordination for expected-commit tag checkout and Go module dependency preparation. |
-| `internal/validation` | Shared Go validation with optional race, full-vet, and static package-compilation target selections, formatting, workspace-file and filesystem-replacement checks, structured failures, and lazy committed-file access for captured candidates; `internal/candidate` retains capture, callback sequencing, and local-state rechecks. |
+| `internal/validation` | Shared Go validation with optional race, full-vet, and static package-compilation target selections, formatting, workspace-file and filesystem-replacement checks, per-blob size limits, structured failures, and lazy committed-file access for captured candidates; `internal/candidate` retains capture, callback sequencing, and local-state rechecks. |
 | `internal/publish` | Publication guards, one validation run, annotated tag creation, push, and recovery state. |
 | `internal/runtimeinfo` | Private version lookup used by the runtime facade. |
 | `internal/versioncontract` | Shared stable-version rules and linker-symbol identity. |

docs/internal/validation.md

@@ -37,6 +37,10 @@ with an inspection cause when their selected contents are unavailable. A
 replacement with no parsed version is reported with its go.mod path, line,
 directive, and target; versioned replacements are allowed. It runs after the
 workspace-file check using the same candidate inventory.
+The optional file-size check uses each blob's captured Git size, including
+symlink link-text bytes, and skips entries without a blob size such as gitlinks.
+It applies normalized literal file/directory exclusions with path-boundary
+matching, then returns the first oversized path with `FileSizeMeasurement`.
 `CandidateTree` gets metadata and bytes from Git objects, reads blob bytes
 lazily, and resolves destinations without consulting the worktree or
 neighboring files.

docs/roadmap/implementation.md

@@ -386,6 +386,13 @@ The rule applies to candidate contents even when testing disables workspace use.
 
 ## Stage 8: Inspect individual committed file sizes
 
+**Completion:** Complete. `Validation.FileSize` and `validation.file_size` enable
+a per-blob decimal-byte limit with a 1,000,000-byte default, strict greater-than
+comparison, and literal repository-relative file/directory exclusions. The check
+uses captured blob sizes, counts symlink link text, omits gitlinks, and reports
+one oversized file with its measurement. Nil disables the check, and historical
+or aggregate repository size is outside its scope.
+
 **Outcome:** Optional limits and intentional path exceptions are operational.
 
 1. Add `FileSizeValidationSpec`, `ValidationSpec.FileSize`, and matching JSON