quality_gate 0.2.2 → 0.3.0

data/docs/releasing.md

@@ -27,7 +27,9 @@ gem archive. `bin/console` opens an interactive session with the gem loaded.
 
 ## Release checklist
 
-1. Update `lib/quality_gate/version.rb` and `CHANGELOG.md` for the intended release.
+1. Update `lib/quality_gate/version.rb` and add the matching `CHANGELOG.md` entry.
+   Treat these as one release record: keep the changelog heading, gemspec version,
+   and built artifact version synchronized.
 2. Run `bin/prepare_release` and review the generated documentation and package.
    Run `bundle exec quality_gate verify` to enforce the repository coverage budgets.
    On the initial commit, Undercover cannot compare against a parent commit, so
@@ -38,9 +40,19 @@ gem archive. `bin/console` opens an interactive session with the gem loaded.
    run normal verification, including diff coverage; no extra baseline commit is required.
 3. Confirm the archive includes runtime code, configuration, licensing, and public
    documentation, with no local paths, credentials, private logs, or internal plans.
-4. Commit the reviewed release in the public repository and tag the version.
-5. Publish the reviewed artifact with `gem push pkg/quality_gate-VERSION.gem`,
-   replacing `VERSION` with the actual release version. RubyGems MFA is required.
+4. Before publishing, confirm the version matches in
+   `lib/quality_gate/version.rb`, the `CHANGELOG.md` heading, the gemspec, and
+   the built gem filename. Review the source commit and confirm it contains the
+   intended source and changelog entry. Separately confirm the gem artifact was
+   built from that reviewed commit.
+5. Commit the reviewed source, create the matching version tag, then push the
+   reviewed branch and tag to the public repository. Confirm the remote branch
+   and tag point to the reviewed commit before creating the GitHub release.
+   Publish the artifact with `gem push pkg/quality_gate-VERSION.gem`, replacing
+   `VERSION` with the actual release version; RubyGems MFA is required. Create
+   the GitHub release from the pushed tag, using the changelog entry as its notes.
+6. After publication, confirm the RubyGems release version and the GitHub
+   release title, tag, and notes match the version and changelog entry.
 
 The Rakefile also loads Bundler's gem tasks. Its `release` task can publish and
 push Git changes; use it only when those actions are intended.

data/lib/generators/quality_gate/install/install_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../../../quality_gate/installation"
+require_relative "../../../quality_gate/ruby_profile"
 
 if defined?(Rails::Generators::Base)
   module QualityGate
@@ -32,15 +33,25 @@ if defined?(Rails::Generators::Base)
       class_option :skip_initializers, type: :boolean, default: false
       class_option :skip_coverage, type: :boolean, default: false
       class_option :agents, type: :boolean, default: false
+      class_option :codex, type: :boolean, default: false
+      class_option :test_framework, type: :string
+      class_option :test_helper, type: :string
+      class_option :test_command, type: :string
+      class_option :ci, type: :boolean, default: false
 
       # Rails discovers generator tasks from methods declared on this class.
       # Keep these forwarding methods so the shared module remains framework-neutral.
       # rubocop:disable Lint/UselessMethodDefinition
-      def create_settings_file = super
+      def create_settings_file
+        profile if behavior == :invoke
+        super
+      end
+
       def create_rules_file = super
       def create_initializers = super
       def inject_coverage = super
       def create_agent_integration = super
+      def create_ci_workflow = super
       def print_summary = super
       # rubocop:enable Lint/UselessMethodDefinition
 
@@ -55,11 +66,15 @@ if defined?(Rails::Generators::Base)
       end
 
       def template_for(name)
-        name
+        @profile ? @profile.template_for(name) : name
       end
 
       def test_helper_path
-        "test/test_helper.rb"
+        profile.test_helper
+      end
+
+      def profile
+        @profile ||= RailsProfile.new(destination_root:, options:)
       end
     end
   end

data/lib/generators/quality_gate/install/templates/agents_section.md.tt

@@ -1,7 +1,7 @@
 <!-- quality_gate agent contract — start -->
 ## Quality Gate agent contract
 
-Run `bundle exec quality_gate fast` after Ruby edits. Installed Claude Code hooks can run `bundle exec quality_gate verify` automatically at session end; other clients, including Codex, must run `bundle exec quality_gate verify` manually before you finish a change. Run `bundle exec quality_gate audit` before you merge security-sensitive work.
+Run `bundle exec quality_gate fast` after Ruby edits. Run `bundle exec quality_gate verify` before you finish a change, and `bundle exec quality_gate audit` before you merge security-sensitive work.
 
 Fix findings before you continue editing.
 
@@ -11,5 +11,16 @@ Fix findings before you continue editing.
 
 The default fast path keeps feedback tight with a 10-second RuboCop timeout. Verify and audit keep the broader suite work on the 120-second default timeout.
 
-If the automatic hook becomes unavailable, inspect `log/quality_gate_hooks.jsonl`, run `bundle install`, and reinstall the hook with `bin/rails generate quality_gate:install --agents`.
+<% if agent_option?(:agents) %>The Claude Code `PostToolUse` fast hook runs after native `Edit` and `Write` calls; Codex's optional patch fast hook runs after native `apply_patch` calls. Installed Claude Code hooks can run `bundle exec quality_gate verify` automatically at session end. If those hooks become unavailable, inspect `log/quality_gate_hooks.jsonl`, run `bundle install`, and reinstall them with `bin/rails generate quality_gate:install --agents`.
+<% end %><% if agent_option?(:codex) %>
+The optional Codex patch hook runs `quality_gate fast` after native `apply_patch` calls. It checks changed Ruby files and ERB files when Herb is configured; it does not run after shell writes or other tools. Findings appear as advisory context and never roll back the completed patch. If the gate or its tools are unavailable, Codex is asked to tell you and to run `bundle exec quality_gate fast` manually. Keep the direct manual gate and CI checks as enforcement evidence.
+
+The final Codex Stop hook still runs the full `verify` gate, including changes made by shell commands. Findings request one repair continuation; Codex reruns verification on the resumed Stop, and remaining findings are reported while allowing the turn to finish. Unavailable checks also allow the turn to finish. This full gate can add substantial latency at every Stop. The patch hook's native timeout is 30 seconds; the shipped fast RuboCop timeout is 10 seconds, and a longer project fast budget can exceed Codex's hook limit and require manual verification.
+
+Enable these project hooks only in a trusted project. In Codex, review `.codex/hooks/quality_gate_fast.rb`, `.codex/hooks/quality_gate_verify_stop.rb`, and both generated command definitions through `/hooks`, then explicitly trust them. Review both again after hook configuration changes. Quality Gate never changes Codex trust settings. Doctor can recognize installed files, but cannot confirm trust, activation, or live execution; Codex provides no execution history for Quality Gate to inspect.
+
+To refresh the generated Codex hooks after a Quality Gate upgrade, run `bin/rails generate quality_gate:install --codex` and review both commands in `/hooks` again. If the project moves, update both absolute commands in `.codex/hooks.json` and review them again. The installer upgrades only the exact previous Stop-only configuration generated for this same project root. Resolve customized configuration or a snapshot from another location manually using the proposal printed by the installer. To remove the integration, remove both Quality Gate hook entries and scripts; remove `.codex/hooks.json` only when it contains solely generated Quality Gate configuration. Remove only the Codex-specific instructions from `AGENTS.md` when it also contains Claude guidance, or remove the Quality Gate section when Codex is its only client.
+<% else %>
+Other clients, including Codex, must run `bundle exec quality_gate verify` manually before you finish a change. Codex can also use `bundle exec quality_gate fast` after edits for file-scoped feedback.
+<% end %>
 <!-- quality_gate agent contract — end -->

data/lib/generators/quality_gate/install/templates/codex_fast.rb.tt

@@ -0,0 +1,36 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "json"
+require "stringio"
+
+begin
+  root = File.expand_path("../..", __dir__)
+  Dir.chdir(root)
+  gemfile = File.join(root, "Gemfile")
+  ENV["BUNDLE_GEMFILE"] = gemfile
+  raise LoadError, "project Gemfile is missing" unless File.file?(gemfile)
+
+  original_stdout, original_stderr = $stdout, $stderr
+  $stdout = $stderr = StringIO.new
+  begin
+    require "bundler"
+    Bundler.setup
+  ensure
+    $stdout, $stderr = original_stdout, original_stderr
+  end
+  require "quality_gate"
+  require "quality_gate/codex_fast_hook"
+  input = JSON.parse(STDIN.read)
+  puts JSON.generate(QualityGate::CodexFastHook.new(dir: root).call(input))
+rescue StandardError, LoadError => error
+  message = "Quality Gate fast feedback unavailable (#{error.class}); " \
+            "run `bundle exec quality_gate fast` manually."
+  puts JSON.generate(
+    "systemMessage" => message,
+    "hookSpecificOutput" => {
+      "hookEventName" => "PostToolUse",
+      "additionalContext" => "Quality Gate fast feedback is unavailable. Run `bundle exec quality_gate fast` manually."
+    }
+  )
+end

data/lib/generators/quality_gate/install/templates/codex_hooks.json.tt

@@ -0,0 +1 @@
+<%= JSON.pretty_generate("hooks" => {"PostToolUse" => [{"matcher" => "^apply_patch$", "hooks" => [{"type" => "command", "command" => Shellwords.join(["ruby", File.expand_path(File.join(destination_root, ".codex/hooks/quality_gate_fast.rb"))]), "timeout" => 30}]}], "Stop" => [{"hooks" => [{"type" => "command", "command" => Shellwords.join(["ruby", File.expand_path(File.join(destination_root, ".codex/hooks/quality_gate_verify_stop.rb"))]), "timeout" => 600}]}]}) %>

data/lib/generators/quality_gate/install/templates/codex_verify_stop.rb.tt

@@ -0,0 +1,28 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "json"
+require "stringio"
+
+begin
+  root = File.expand_path("../..", __dir__)
+  Dir.chdir(root)
+  gemfile = File.join(root, "Gemfile")
+  ENV["BUNDLE_GEMFILE"] = gemfile
+  raise LoadError, "project Gemfile is missing" unless File.file?(gemfile)
+
+  original_stdout, original_stderr = $stdout, $stderr
+  $stdout = $stderr = StringIO.new
+  begin
+    require "bundler"
+    Bundler.setup
+  ensure
+    $stdout, $stderr = original_stdout, original_stderr
+  end
+  require "quality_gate"
+  require "quality_gate/codex_stop_hook"
+  input = JSON.parse(STDIN.read)
+  puts JSON.generate(QualityGate::CodexStopHook.new(dir: root).call(input))
+rescue StandardError, LoadError => error
+  puts JSON.generate("systemMessage" => "Quality Gate verification unavailable (#{error.class}); check the project bundle and run `bundle exec quality_gate verify --format json` manually.")
+end

data/lib/generators/quality_gate/install/templates/quality_gate.yml.tt

@@ -15,6 +15,8 @@
 #   audit:
 #     - brakeman
 #     - bundler_audit
+#   deep:
+#     - rubycritic
 #
 # # Command overrides by gate. Empty mappings use adapter defaults.
 # commands:
@@ -24,6 +26,7 @@
 #       - bin/rails
 #       - test
 #   audit: {}
+#   deep: {}
 #
 # # Command timeouts in seconds. Adapter-specific values override the default.
 # timeouts:
@@ -40,3 +43,6 @@
 #
 # # Explicit RuboCop config path; blank uses host config when present, otherwise the shipped config.
 # rubocop_config:
+
+# # Optional warning/info baseline for the fast and verify gates; leave empty to disable.
+# baseline: {}

data/lib/generators/quality_gate/install/templates/quality_gate_fast.rb.tt

@@ -4,6 +4,7 @@
 require "json"
 require "open3"
 require "time"
+require "yaml"
 
 begin
   require "fiddle/import"
@@ -71,9 +72,21 @@ def outcome_for(exit_status, findings)
   "findings" if exit_status == 1 && findings.any?
 end
 
-def initial_outcome(file)
+def herb_configured?(project_root)
+  path = File.join(project_root, ".quality_gate.yml")
+  return false unless File.file?(path)
+
+  document = YAML.safe_load(File.read(path))
+  gate_adapters = document.fetch("adapters", nil) if document.is_a?(Hash)
+  adapters = gate_adapters.fetch("fast", nil) if gate_adapters.is_a?(Hash)
+  adapters.is_a?(Array) && adapters.include?("herb")
+rescue Psych::Exception, SystemCallError
+  false
+end
+
+def initial_outcome(file, project_root)
   return "no_file" unless file
-  return "skipped" unless file.end_with?(".rb")
+  return "skipped" unless file.end_with?(".rb") || (file.end_with?(".erb") && herb_configured?(project_root))
   return "deleted" unless File.file?(file)
 
   "unavailable"
@@ -208,7 +221,7 @@ project_root = Dir.pwd unless project_root.is_a?(String) && !project_root.empty?
 tool_input = input["tool_input"]
 file = tool_input["file_path"] if tool_input.is_a?(Hash)
 file = nil unless file.is_a?(String) && !file.empty?
-outcome = initial_outcome(file)
+outcome = initial_outcome(file, project_root)
 attempt_was_made = outcome == "unavailable"
 exit_code = 0
 feedback = nil

data/lib/generators/quality_gate/install/templates/quality_gate_workflow.yml.tt

@@ -0,0 +1,28 @@
+name: Quality Gate
+# Customize the Ruby version, matrix, services, and environment for your application.
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  quality-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "<%= RUBY_VERSION %>"
+          bundler-cache: true
+      - name: Fast checks
+        run: bundle exec quality_gate fast
+      - name: Verify checks
+        run: bundle exec quality_gate verify
+      - name: Security audit
+        run: bundle exec quality_gate audit

data/lib/generators/quality_gate/install/templates/rails_quality_gate.yml.tt

@@ -0,0 +1,45 @@
+# # Output format: "text", "json", or "markdown".
+# format: text
+#
+# # Optional file paths passed to RuboCop and Reek; empty means the project scope.
+# files: []
+#
+# # Rails adapters run by each gate, in order.
+# adapters:
+#   fast:
+#     - rubocop
+#   verify:
+#     - reek
+#     - test_suite
+<% if @profile.coverage? %>#     - undercover
+<% end %>#   audit:
+#     - brakeman
+#     - bundler_audit
+#
+# The installer-selected test command runs during verify with coverage enabled.
+commands:
+  verify:
+    test_suite:
+<% @profile.test_command.each do |argument| %>      - <%= JSON.generate(argument) %>
+<% end %>
+#
+# # Command timeouts in seconds.
+# timeouts:
+#   default: 120
+#   rubocop: 10
+#   test_suite: 120
+#   undercover: 120
+#
+# # Aggregate SimpleCov budgets. Leave the entire mapping commented to disable coverage budgeting.
+# coverage:
+#
+# # Git ref or commit for Undercover; blank selects the comparison point automatically.
+# compare_point:
+#
+# # Explicit RuboCop config path; blank uses host config when present, otherwise the shipped config.
+# rubocop_config:
+
+# # Optional warning/info baseline for fast and verify; omitted means disabled.
+# baseline:
+#   fast: config/quality_gate-fast-baseline.json
+#   verify: config/quality_gate-verify-baseline.json

data/lib/generators/quality_gate/install/templates/ruby_agents_section.md.tt

@@ -1,7 +1,7 @@
 <!-- quality_gate agent contract — start -->
 ## Quality Gate agent contract
 
-Run `bundle exec quality_gate fast` after Ruby edits. Installed Claude Code hooks can run `bundle exec quality_gate verify` automatically at session end; other clients, including Codex, must run `bundle exec quality_gate verify` manually before you finish a change. Run `bundle exec quality_gate audit` before you merge security-sensitive work.
+Run `bundle exec quality_gate fast` after Ruby edits. Run `bundle exec quality_gate verify` before you finish a change, and `bundle exec quality_gate audit` before you merge security-sensitive work.
 
 Fix findings before you continue editing.
 
@@ -11,5 +11,16 @@ Fix findings before you continue editing.
 
 The default fast path keeps feedback tight with a 10-second RuboCop timeout. Verify and audit keep the broader suite work on the 120-second default timeout.
 
-To reinstall the Ruby profile's agent integration, run `bundle exec quality_gate init --profile ruby --agents`.
+<% if agent_option?(:agents) %>The Claude Code `PostToolUse` fast hook runs after native `Edit` and `Write` calls; Codex's optional patch fast hook runs after native `apply_patch` calls. Installed Claude Code hooks can run `bundle exec quality_gate verify` automatically at session end. If those hooks become unavailable, inspect `log/quality_gate_hooks.jsonl`, run `bundle install`, and reinstall them with `bundle exec quality_gate init --profile ruby --agents`.
+<% end %><% if agent_option?(:codex) %>
+The optional Codex patch hook runs `quality_gate fast` after native `apply_patch` calls. It checks changed Ruby files and ERB files when Herb is configured; it does not run after shell writes or other tools. Findings appear as advisory context and never roll back the completed patch. If the gate or its tools are unavailable, Codex is asked to tell you and to run `bundle exec quality_gate fast` manually. Keep the direct manual gate and CI checks as enforcement evidence.
+
+The final Codex Stop hook still runs the full `verify` gate, including changes made by shell commands. Findings request one repair continuation; Codex reruns verification on the resumed Stop, and remaining findings are reported while allowing the turn to finish. Unavailable checks also allow the turn to finish. This full gate can add substantial latency at every Stop. The patch hook's native timeout is 30 seconds; the shipped fast RuboCop timeout is 10 seconds, and a longer project fast budget can exceed Codex's hook limit and require manual verification.
+
+Enable these project hooks only in a trusted project. In Codex, review `.codex/hooks/quality_gate_fast.rb`, `.codex/hooks/quality_gate_verify_stop.rb`, and both generated command definitions through `/hooks`, then explicitly trust them. Review both again after hook configuration changes. Quality Gate never changes Codex trust settings. Doctor can recognize installed files, but cannot confirm trust, activation, or live execution; Codex provides no execution history for Quality Gate to inspect.
+
+To refresh the generated Codex hooks after a Quality Gate upgrade, run `bundle exec quality_gate init --profile ruby --codex` and review both commands in `/hooks` again. If the project moves, update both absolute commands in `.codex/hooks.json` and review them again. The installer upgrades only the exact previous Stop-only configuration generated for this same project root. Resolve customized configuration or a snapshot from another location manually using the proposal printed by the installer. To remove the integration, remove both Quality Gate hook entries and scripts; remove `.codex/hooks.json` only when it contains solely generated Quality Gate configuration. Remove only the Codex-specific instructions from `AGENTS.md` when it also contains Claude guidance, or remove the Quality Gate section when Codex is its only client.
+<% else %>
+Other clients, including Codex, must run `bundle exec quality_gate verify` manually before you finish a change. Codex can also use `bundle exec quality_gate fast` after edits for file-scoped feedback.
+<% end %>
 <!-- quality_gate agent contract — end -->

data/lib/generators/quality_gate/install/templates/ruby_quality_gate.yml.tt

@@ -38,3 +38,8 @@ timeouts:
 
 # # Explicit RuboCop config path; blank uses host config when present, otherwise the shipped config.
 # rubocop_config:
+
+# # Optional warning/info baseline for fast and verify; omitted means disabled.
+# baseline:
+#   fast: config/quality_gate-fast-baseline.json
+#   verify: config/quality_gate-verify-baseline.json

data/lib/generators/quality_gate/install/templates/simplecov.rb.tt

@@ -6,5 +6,6 @@ if ENV['COVERAGE'] == '1'
   SimpleCov.start do
     enable_coverage :branch
     add_filter '/test/'
+    add_filter '/spec/'
   end
 end

data/lib/quality_gate/adapters/bundler_audit.rb

@@ -9,8 +9,9 @@ module QualityGate
     # rubocop:disable Metrics/ClassLength
     class BundlerAudit < Adapter
       class InvalidReport < StandardError; end
+      class InvalidProcessStatus < StandardError; end
       class UnavailableDatabase < StandardError; end
-      private_constant :InvalidReport, :UnavailableDatabase
+      private_constant :InvalidReport, :InvalidProcessStatus, :UnavailableDatabase
 
       LOCK_FILE = "Gemfile.lock".freeze # rubocop:disable Style/RedundantFreeze
       FALLBACK_WARNING = "bundler_audit: advisory database update failed; using cached database"
@@ -43,7 +44,9 @@ module QualityGate
       def updated_findings(tool, argv, deadline, timeout_seconds)
         stderr = +""
         stdout, stderr, status = capture(argv, remaining_timeout(deadline, timeout_seconds))
+        validate_normal_completion!(status)
         findings = parse_and_validate(stdout, tool)
+        validate_status_findings!(status, findings)
         return findings if local_database?
 
         unavailable_database_failure(tool, stderr)
@@ -51,6 +54,8 @@ module QualityGate
         return [failure_finding(tool, e, stderr)] if status&.success?
 
         fallback_findings(tool, e, stderr, deadline, timeout_seconds)
+      rescue InvalidProcessStatus => e
+        [failure_finding(tool, e, stderr)]
       rescue TimeoutError, SystemCallError, IOError, ThreadError => e
         fallback_findings(tool, e, stderr, deadline, timeout_seconds)
       end
@@ -69,10 +74,12 @@ module QualityGate
 
       def cached_findings(tool, deadline, timeout_seconds)
         cached_stderr = +""
-        stdout, cached_stderr, = capture(cached_command, remaining_timeout(deadline, timeout_seconds))
+        stdout, cached_stderr, status = capture(cached_command, remaining_timeout(deadline, timeout_seconds))
+        validate_normal_completion!(status)
         findings = parse_and_validate(stdout, tool)
+        validate_status_findings!(status, findings)
         emit_fallback_warning(tool, findings, cached_stderr)
-      rescue ParseError, TimeoutError, SystemCallError, IOError, ThreadError => e
+      rescue ParseError, InvalidProcessStatus, TimeoutError, SystemCallError, IOError, ThreadError => e
         [failure_finding(tool, e, cached_stderr)]
       end
 
@@ -85,6 +92,24 @@ module QualityGate
         raise TimeoutError, "timeout after #{timeout_seconds} seconds"
       end
 
+      def validate_normal_completion!(status)
+        return if status&.exited? && [0, 1].include?(status.exitstatus)
+
+        invalid_process_status!("process did not exit normally with status 0 or 1")
+      end
+
+      def validate_status_findings!(status, findings)
+        clean_status = status.exitstatus.zero?
+        return if clean_status == findings.empty?
+
+        expected = clean_status ? "no vulnerability findings" : "vulnerability findings"
+        invalid_process_status!("exit status #{status.exitstatus} conflicts with #{expected}")
+      end
+
+      def invalid_process_status!(reason)
+        raise InvalidProcessStatus, reason
+      end
+
       def unavailable_database_failure(tool, stderr)
         error = UnavailableDatabase.new("no usable advisory database is available")
         [failure_finding(tool, error, stderr)]

data/lib/quality_gate/adapters/database_consistency.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "rbconfig"
+require_relative "database_consistency_report"
+
+module QualityGate
+  module Adapters
+    # Runs the optional project-wide database consistency bridge.
+    class DatabaseConsistency < Adapter
+      TOOL_NAME = "database_consistency"
+      BRIDGE_PATH = File.expand_path("../database_consistency_runner.rb", __dir__).freeze
+
+      def name = TOOL_NAME
+
+      def command
+        prefix = config.fetch(:commands).fetch(:audit).fetch(:database_consistency, nil)
+        return [RbConfig.ruby, BRIDGE_PATH] unless prefix
+
+        prefix + [BRIDGE_PATH]
+      end
+
+      def parse(stdout)
+        DatabaseConsistencyReport.new(stdout).findings
+      end
+
+      def call = capture_findings
+
+      private
+
+      def capture_findings
+        stderr = +""
+        execute(stderr).tap { validate_findings!(_1, expected_tool: name) }
+      rescue StandardError => e
+        [failure_finding(name, e, stderr)]
+      end
+
+      def execute(stderr)
+        stdout, captured_stderr, status = capture(validated_command, resolved_timeout(name))
+        stderr.replace(captured_stderr)
+        validate_process_status!(status)
+        parse(stdout)
+      end
+
+      def validate_process_status!(status)
+        return if status&.exited? && status.exitstatus.zero?
+
+        raise ParseError.new(tool: name, reason: "process did not exit normally with status 0")
+      end
+    end
+  end
+end

data/lib/quality_gate/adapters/database_consistency_report.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "json"
+require "rubygems"
+require_relative "database_consistency_report_item"
+
+module QualityGate
+  module Adapters
+    # Validates the bridge envelope and converts reports into findings.
+    class DatabaseConsistencyReport
+      VERSION = 1
+      VERSION_REQUIREMENT = Gem::Requirement.new("~> 3.0.14")
+
+      def initialize(json)
+        @envelope = JSON.parse(json)
+      rescue JSON::ParserError => e
+        raise ParseError.new(tool: "database_consistency", reason: e.message)
+      end
+
+      def findings
+        validate_envelope!
+        reports.filter_map { DatabaseConsistencyReportItem.new(_1).finding }
+      end
+
+      private
+
+      def validate_envelope!
+        invalid!("envelope must be an object") unless @envelope.is_a?(Hash)
+        validate_version!
+        validate_analyzer_version!
+        invalid!("reports must be an array") unless reports.is_a?(Array)
+      end
+
+      def validate_version!
+        value = @envelope.fetch("version", nil)
+        invalid!("version must be integer 1") unless value.instance_of?(Integer) && value == VERSION
+      end
+
+      def validate_analyzer_version!
+        value = @envelope.fetch("analyzer_version", nil)
+        return if supported_version?(value)
+
+        invalid!("analyzer_version must be a supported version")
+      end
+
+      def supported_version?(value)
+        value.is_a?(String) && VERSION_REQUIREMENT.satisfied_by?(Gem::Version.new(value))
+      rescue ArgumentError
+        false
+      end
+
+      def reports = @envelope.fetch("reports", nil)
+
+      def invalid!(reason)
+        raise ParseError.new(tool: "database_consistency", reason: reason)
+      end
+    end
+
+    private_constant :DatabaseConsistencyReport
+  end
+end