@afokapu/atdd-bun 0.1.0

package/detectors/bun_security_hygiene_detector/checks/err_code_format.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.error-response-code-format  (security/hygiene family)
+//
+// PORTED VERBATIM. `"error_code": "VALUE"` must be UPPER_SNAKE_CASE. This is the
+// second of the two rules in these three families that is genuinely
+// language-neutral: the payload shape is JSON, so the pattern and the
+// UPPER_SNAKE_CASE test carry over from error_response.py unchanged.
+//
+// An error code is a machine key. Once a client branches on it, its spelling is
+// API surface, and an inconsistent one ("notFound" beside "NOT_FOUND") produces
+// two codes for one condition that no amount of testing will reconcile.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+
+const RULE = "coder.bun.error-response-code-format";
+
+// ERROR_CODE_VALUE_RE and UPPER_SNAKE_CASE_RE, transcribed from error_response.py.
+const ERROR_CODE_RE = /['"]error_?[Cc]ode['"]\s*:\s*['"]([^'"]+)['"]/g;
+const UPPER_SNAKE_RE = /^[A-Z][A-Z0-9_]+$/;
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    const text = readText(file);
+    if (!text) continue;
+    for (const m of text.matchAll(ERROR_CODE_RE)) {
+      if (UPPER_SNAKE_RE.test(m[1])) continue;
+      violations.push({
+        rule_id: RULE, file, ...locate(text, m.index),
+        evidence: `error code "${m[1]}" is not UPPER_SNAKE_CASE; the code is API surface once a client branches on it`,
+      });
+    }
+  }
+}
+process.stderr.write(`bun-security[error-code-format]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_security_hygiene_detector/checks/log_console.mjs

@@ -0,0 +1,33 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.logging-console  (security/hygiene family)
+//
+// RE-REALIZED. The python-pytest sibling walks the AST for a bare `print(...)`
+// call. The Bun equivalent is `console.*`, and the reason it matters is stronger
+// here than in Python: a full-stack Bun server writes `console.log` straight to
+// stdout with no level, no timestamp and no request correlation, so production
+// logs become an unfilterable stream. Use a logger.
+//
+// Masked source is scanned, so `console.log` inside a comment or a string never
+// trips the rule.
+import { walk, readRoots, readExcludes, readText, emit, locate, maskLiteralsAndComments, SOURCE_EXT } from "../../../lib/scan.mjs";
+
+const RULE = "coder.bun.logging-console";
+const CONSOLE_RE = /\bconsole\s*\.\s*(log|info|warn|error|debug|trace|dir)\s*\(/g;
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    const text = readText(file);
+    if (!text) continue;
+    const masked = maskLiteralsAndComments(text);
+    for (const m of masked.matchAll(CONSOLE_RE)) {
+      violations.push({
+        rule_id: RULE, file, ...locate(text, m.index),
+        evidence: `console.${m[1]} writes an unlevelled, uncorrelated line to stdout; use the structured logger`,
+      });
+    }
+  }
+}
+process.stderr.write(`bun-security[logging-console]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_security_hygiene_detector/checks/log_structured.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.logging-structured  (security/hygiene family)
+//
+// RE-REALIZED. The python-pytest sibling finds `logger.info("...")` calls whose
+// only argument is a bare string — a log line carrying no queryable context. The
+// receiver names and log methods carry over; the argument shape does not, because
+// a JS logger takes a context OBJECT (`logger.info("msg", { orderId })`) where the
+// Python one takes `extra=`/kwargs.
+//
+// The obligation: a log line must carry structured context, or it cannot be
+// searched when it matters — which is at 3am, by someone who did not write it.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+
+const RULE = "coder.bun.logging-structured";
+
+// LOGGER_RECEIVER_NAMES + LOG_METHODS, transcribed from structured_logging.py and
+// widened with the JS-idiomatic `warn`/`trace`.
+const BARE_LOG_RE =
+  /\b(logger|log|_logger|_log|LOG)\s*\.\s*(debug|info|warn|warning|error|critical|exception|trace|log)\s*\(\s*(['"`])((?:[^'"`\\]|\\.)*)\3\s*\)/g;
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    const text = readText(file);
+    if (!text) continue;
+    for (const m of text.matchAll(BARE_LOG_RE)) {
+      violations.push({
+        rule_id: RULE, file, ...locate(text, m.index),
+        evidence: `${m[1]}.${m[2]} logs a bare string with no context object; add the fields this line would be searched by`,
+      });
+    }
+  }
+}
+process.stderr.write(`bun-security[logging-structured]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_security_hygiene_detector/checks/sec_hardcoded_secret.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.security-hardcoded-secret  (security/hygiene family)
+//
+// PORTED VERBATIM. The five secret patterns in the python-pytest sibling are the
+// only part of that detector that is language-neutral: an AWS key id, a PEM
+// header and an `assignment = "literal"` shape look the same in Python and in
+// TypeScript, so the regexes carry over unchanged and the numbers agree.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT, TEMPLATE_EXT } from "../../../lib/scan.mjs";
+
+const RULE = "coder.bun.security-hardcoded-secret";
+
+// Transcribed from SECRET_PATTERNS in security_patterns.py (name, regex, ignoreCase).
+const SECRET_PATTERNS = [
+  ["aws_access_key", /AKIA[0-9A-Z]{16}/g],
+  ["private_key_header", /-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----/g],
+  ["password_assignment", /(password|passwd|pwd)\s*=\s*["'][^"']{8,}["']/gi],
+  ["api_key_assignment", /(api_key|apikey|api_secret|secret_key)\s*=\s*["'][^"']{8,}["']/gi],
+  ["generic_token", /(token|auth_token|access_token)\s*=\s*["'][a-zA-Z0-9_\-]{20,}["']/gi],
+];
+
+// `.env.example`-style templates and lockfiles are documentation, not secrets.
+const DOC_LIKE = /(\.example|\.sample|\.template)\./;
+const EXTS = new Set([...SOURCE_EXT, ...TEMPLATE_EXT]);
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, EXTS)) {
+    if (DOC_LIKE.test(file)) continue;
+    const text = readText(file);
+    if (!text) continue;
+    for (const [name, re] of SECRET_PATTERNS) {
+      for (const m of text.matchAll(re)) {
+        violations.push({
+          rule_id: RULE, file, ...locate(text, m.index),
+          evidence: `hardcoded secret (${name}) committed to source; move it to the environment`,
+        });
+      }
+    }
+  }
+}
+process.stderr.write(`bun-security[hardcoded-secret]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_security_hygiene_detector/checks/sec_missing_auth.mjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.security-missing-auth  (security/hygiene family)
+//
+// RE-REALIZED, NOT PORTED. The python-pytest sibling looks for a FastAPI route
+// decorator (`@app.get(...)`) whose signature lacks `Depends(get_current_user)`.
+// Bun has no decorators and no dependency-injection container: routes are entries
+// in the `routes` object of `Bun.serve`, or branches of a `fetch` handler, and
+// authorisation is an ordinary function call at the top of the handler.
+//
+// So the DETECTION is entirely different while the OBLIGATION is unchanged: a
+// state-changing route must not be reachable without an authorisation check.
+//
+// SCOPE — mutating methods only. A public GET is a normal thing for an htmx app to
+// serve (it is how fragments load); a POST/PUT/PATCH/DELETE handler with no auth
+// call in its body is the shape that leaks writes.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+
+const RULE = "coder.bun.security-missing-auth";
+
+// A route entry keyed by method inside a Bun.serve `routes` object:
+//   "/orders": { POST: async (req) => { ... } }
+const ROUTE_METHOD_RE = /\b(POST|PUT|PATCH|DELETE)\s*:\s*(?:async\s*)?\(/g;
+// A method guard inside a fetch handler: `if (req.method === "POST")`.
+const METHOD_GUARD_RE = /req(?:uest)?\.method\s*===?\s*["'](POST|PUT|PATCH|DELETE)["']/g;
+
+// Any recognisable authorisation step. Deliberately broad: the rule asks whether
+// the author thought about auth at all, not whether they used one blessed helper.
+const AUTH_CALL_RE =
+  /\b(requireAuth|requireUser|requireSession|authorize|authorise|authenticate|assertAuth|getCurrentUser|getSession|verifyToken|checkPermission|can|guard)\s*\(/;
+
+// Take the handler body following `from`, by brace matching, so the auth check is
+// looked for in THIS handler rather than anywhere in the file.
+function bodyAfter(text, from) {
+  const open = text.indexOf("{", from);
+  if (open === -1) return "";
+  let depth = 0;
+  for (let i = open; i < text.length; i++) {
+    if (text[i] === "{") depth++;
+    else if (text[i] === "}") { depth--; if (depth === 0) return text.slice(open, i + 1); }
+  }
+  return text.slice(open);
+}
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    const text = readText(file);
+    if (!text) continue;
+    for (const re of [ROUTE_METHOD_RE, METHOD_GUARD_RE]) {
+      for (const m of text.matchAll(re)) {
+        const body = bodyAfter(text, m.index + m[0].length);
+        if (AUTH_CALL_RE.test(body)) continue;
+        violations.push({
+          rule_id: RULE, file, ...locate(text, m.index),
+          evidence: `${m[1]} handler performs no authorisation check; a state-changing route must not be reachable unauthenticated`,
+        });
+      }
+    }
+  }
+}
+process.stderr.write(`bun-security[missing-auth]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_security_hygiene_detector/checks/sec_sql_injection.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.security-sql-injection  (security/hygiene family)
+//
+// RE-REALIZED, NOT PORTED. The python-pytest sibling walks a Python AST for
+// `execute` / `executemany` / `raw` / `execute_sql` calls — its own manifest says
+// "SCOPE: python stack only". None of those sinks exist here. Bun's SQL surface is
+// `Bun.sql`, `bun:sqlite` (`db.query` / `db.run` / `db.exec` / `db.prepare`) and
+// the postgres/mysql clients, and the injection shape is a TEMPLATE LITERAL with
+// `${}` interpolation reaching one of them.
+//
+// The obligation is identical — never build SQL by concatenating untrusted data.
+// The detector could not be more different, which is exactly why a stack extension
+// is a package and not a translation.
+//
+// NOTE the one genuine subtlety: Bun's `Bun.sql` tagged template is SAFE by
+// construction — `sql`SELECT ... WHERE id = ${id}`` parameterises the value rather
+// than splicing it. So a tagged template is never flagged; only a template literal
+// passed as an ARGUMENT to a sink, where no parameterisation happens.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+
+const RULE = "coder.bun.security-sql-injection";
+
+const SQL_KEYWORDS = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE)\b/i;
+// A sink call whose first argument opens a template literal: `db.query(`...`)`.
+const SINK_TEMPLATE_RE =
+  /\b(?:query|run|exec|execute|prepare|unsafe)\s*\(\s*`([^`]*)`/g;
+// String concatenation into a sink: `db.query("SELECT ... " + userInput)`.
+const SINK_CONCAT_RE =
+  /\b(?:query|run|exec|execute|prepare|unsafe)\s*\(\s*(['"])([^'"]*)\1\s*\+/g;
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    const text = readText(file);
+    if (!text) continue;
+
+    for (const m of text.matchAll(SINK_TEMPLATE_RE)) {
+      const body = m[1];
+      if (!SQL_KEYWORDS.test(body) || !body.includes("${")) continue;
+      violations.push({
+        rule_id: RULE, file, ...locate(text, m.index),
+        evidence: "SQL built by interpolating into a template literal passed to a query sink; use a parameterised query or the Bun.sql tagged template",
+      });
+    }
+    for (const m of text.matchAll(SINK_CONCAT_RE)) {
+      if (!SQL_KEYWORDS.test(m[2])) continue;
+      violations.push({
+        rule_id: RULE, file, ...locate(text, m.index),
+        evidence: "SQL built by string concatenation passed to a query sink; use a parameterised query",
+      });
+    }
+  }
+}
+process.stderr.write(`bun-security[sql-injection]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_security_hygiene_detector/detect.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env bun
+// FAMILY validator: bun_security_hygiene_detector
+// Runs each member check (checks/*.mjs) VERBATIM as a subprocess and merges their
+// RAW v1.1 reports into one — ONE implementation realizing a family of rule_ids
+// (the Core pattern; see frontend.workspace.runtime's families).
+//
+// Members are spawned with `process.execPath`, which under this provider IS the
+// bun binary, so a member may be authored as .mjs OR .ts with no build step.
+// Files whose name begins with `_` are skipped: they are shared helpers, not
+// checks. (The node-runtime families have no such convention because each of
+// their checks re-implements its own walker; this provider factors the walk into
+// lib/scan.mjs instead.)
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync, mkdtempSync, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const reportPath = process.env.ATDD_VIOLATIONS_REPORT;
+if (!reportPath) {
+  process.stderr.write("family: ATDD_VIOLATIONS_REPORT not set\n");
+  process.exit(2);
+}
+const checks = readdirSync(join(here, "checks"))
+  .filter((f) => (f.endsWith(".mjs") || f.endsWith(".ts")) && !f.startsWith("_"))
+  .sort();
+const td = mkdtempSync(join(tmpdir(), "atdd-bun-fam-"));
+const out = [];
+for (const c of checks) {
+  const rep = join(td, c + ".json");
+  try {
+    execFileSync(process.execPath, [join(here, "checks", c)], {
+      env: { ...process.env, ATDD_VIOLATIONS_REPORT: rep },
+      stdio: ["ignore", "ignore", "inherit"],
+    });
+  } catch {
+    /* a member may exit non-zero; still try to read its report */
+  }
+  try {
+    out.push(...JSON.parse(readFileSync(rep, "utf8")).violations);
+  } catch {}
+}
+writeFileSync(reportPath, JSON.stringify({ violations: out }, null, 2), "utf8");
+process.stderr.write("family bun_security_hygiene_detector: " + out.length + " violation(s)\n");
+process.exit(0);

package/detectors/bun_security_hygiene_detector/fixtures/clean/server.ts

@@ -0,0 +1,24 @@
+// Purpose: the compliant reference for this family.
+import { logger } from "./logger";
+import { requireUser } from "./auth";
+
+const apiKey = process.env.API_KEY;          // from the environment, never source
+
+Bun.serve({
+  routes: {
+    "/orders": {
+      POST: async (req) => {
+        const user = await requireUser(req);  // authorisation before any write
+        // Parameterised query: Bun.sql's tagged template binds the value.
+        const rows = await sql`SELECT * FROM orders WHERE owner = ${user.id}`;
+        logger.info("orders listed", { userId: user.id, count: rows.length });
+        return Response.json({ rows });
+      },
+    },
+  },
+});
+
+export function failure() {
+  // Structured error payload with an UPPER_SNAKE_CASE machine key.
+  return Response.json({ "error_code": "ORDER_NOT_FOUND" }, { status: 404 });
+}

package/detectors/bun_security_hygiene_detector/fixtures/dirty/db.ts

@@ -0,0 +1,6 @@
+export async function findOrder(db, id) {
+  return db.query(`SELECT * FROM orders WHERE id = ${id}`);
+}
+export async function findUser(db, name) {
+  return db.query("SELECT * FROM users WHERE name = " + name);
+}

package/detectors/bun_security_hygiene_detector/fixtures/dirty/errors.ts

@@ -0,0 +1,6 @@
+export function notFound() {
+  return new Response("order not found", { status: 404 });
+}
+export function payload() {
+  return Response.json({ "error_code": "orderNotFound" }, { status: 404 });
+}

package/detectors/bun_security_hygiene_detector/fixtures/dirty/logging.ts

@@ -0,0 +1,4 @@
+export function handle(order) {
+  console.log("processing", order.id);
+  logger.info("order processed");
+}

package/detectors/bun_security_hygiene_detector/fixtures/dirty/routes.ts

@@ -0,0 +1,10 @@
+Bun.serve({
+  routes: {
+    "/orders": {
+      POST: async (req) => {
+        const body = await req.json();
+        return Response.json({ ok: true });
+      },
+    },
+  },
+});

package/detectors/bun_security_hygiene_detector/fixtures/dirty/secrets.ts

@@ -0,0 +1,3 @@
+export const awsKey = "AKIAIOSFODNN7EXAMPLE";
+export const password = "hunter2-not-a-good-one";
+export const api_key = "sk_live_0123456789abcdef";

package/detectors/bun_tester_discipline_detector/atdd.implementation.yaml

@@ -0,0 +1,46 @@
+schema_version: 1.1.0
+kind: implementation
+subtype: validator
+implementation_id: bun_tester_discipline_detector
+targets_workspace: atdd.workspace.bun
+contract_version: 1.1.0
+# TESTER-persona discipline for the Bun + htmx stack. Scans TEST FILES ONLY; the
+# coder families in this provider scan source. That split is the persona boundary.
+#
+# Fifteen rules, matching convex.extension.tester.base — the most complete tester
+# realization in the hub — rule for rule where the obligation applies to this stack.
+emits_rule_ids:
+- tester.bun.acceptance-binding-declared
+- tester.bun.acceptance-covers-tag-well-formed
+- tester.bun.test-imports-bun-test
+- tester.bun.test-no-self-skip
+- tester.bun.test-phase-declared
+- tester.bun.red-behavioral-assertion
+- tester.bun.red-fails-first
+- tester.bun.routing-runtime-family
+- tester.bun.security-auth
+- tester.bun.security-input
+- tester.bun.smoke-no-collaborator-substitution
+- tester.bun.smoke-observable-assertion
+- tester.bun.telemetry-emit
+- tester.bun.test-carries-urn-identity
+- tester.bun.test-isolation-no-live-state
+- tester.bun.acceptance-resolves-to-declared
+entrypoint: detect.mjs
+report: detect.mjs
+realizes_convention:
+- tester.bun.acceptance-binding-declared
+- tester.bun.acceptance-covers-tag-well-formed
+- tester.bun.test-imports-bun-test
+- tester.bun.test-no-self-skip
+- tester.bun.test-phase-declared
+- tester.bun.red-behavioral-assertion
+- tester.bun.red-fails-first
+- tester.bun.routing-runtime-family
+- tester.bun.security-auth
+- tester.bun.security-input
+- tester.bun.smoke-no-collaborator-substitution
+- tester.bun.smoke-observable-assertion
+- tester.bun.telemetry-emit
+- tester.bun.test-carries-urn-identity
+- tester.bun.test-isolation-no-live-state

package/detectors/bun_tester_discipline_detector/checks/_map.json

@@ -0,0 +1,18 @@
+{
+  "t_urn_identity": "tester.bun.test-carries-urn-identity",
+  "t_acceptance_binding": "tester.bun.acceptance-binding-declared",
+  "t_test_phase_declared": "tester.bun.test-phase-declared",
+  "t_acceptance_covers_tag": "tester.bun.acceptance-covers-tag-well-formed",
+  "t_red_behavioral": "tester.bun.red-behavioral-assertion",
+  "t_smoke_observable": "tester.bun.smoke-observable-assertion",
+  "t_smoke_no_substitution": "tester.bun.smoke-no-collaborator-substitution",
+  "t_test_no_self_skip": "tester.bun.test-no-self-skip",
+  "t_isolation_no_live_state": "tester.bun.test-isolation-no-live-state",
+  "t_red_fails_first": "tester.bun.red-fails-first",
+  "t_routing_runtime": "tester.bun.routing-runtime-family",
+  "t_security_auth": "tester.bun.security-auth",
+  "t_security_input": "tester.bun.security-input",
+  "t_telemetry_emit": "tester.bun.telemetry-emit",
+  "t_test_imports_bun_test": "tester.bun.test-imports-bun-test",
+  "t_acceptance_resolves": "tester.bun.acceptance-resolves-to-declared"
+}

package/detectors/bun_tester_discipline_detector/checks/t_acceptance_binding.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env bun
+// Member check: tester.bun.acceptance-binding-declared  (tester discipline family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of violation count. Scans TEST FILES ONLY — source files are
+// the coder extension's business. Shared parsing lives in ../test_header.mjs.
+import { runCheck } from "../test_header.mjs";
+
+runCheck("tester.bun.acceptance-binding-declared", (H) => {
+  if (!H.urn) return null;            // owned by test-carries-urn-identity
+  // A journey/E2E test binds to a Train instead of an Acceptance; either satisfies
+  // the obligation, and exactly this is why the rule reads the header rather than
+  // assuming every test maps to one acceptance.
+  if (H.acceptance || H.train) return null;
+  return { line: H.urn.no,
+    evidence: "test declares no `// Acceptance:` (or `// Train:`) binding, so the coverage gate cannot attribute it",
+    source_line: H.urn.raw };
+});

package/detectors/bun_tester_discipline_detector/checks/t_acceptance_covers_tag.mjs

@@ -0,0 +1,25 @@
+#!/usr/bin/env bun
+// Member check: tester.bun.acceptance-covers-tag-well-formed  (tester discipline family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of violation count. Scans TEST FILES ONLY — source files are
+// the coder extension's business. Shared parsing lives in ../test_header.mjs.
+import { runCheck } from "../test_header.mjs";
+
+import { testCases } from "../test_header.mjs";
+
+runCheck("tester.bun.acceptance-covers-tag-well-formed", (H, file, text) => {
+  const out = [];
+  for (const c of testCases(text)) {
+    for (const tag of c.covers) {
+      // The two-level model (#1783): a file header binds the FILE, a @covers tag
+      // binds one `it()`. A malformed tag binds nothing while looking like it does.
+      if (/^acc:[a-z][a-z0-9-]*:[A-Za-z0-9-]+$/.test(tag)) continue;
+      out.push({ line: c.line,
+        evidence: `@covers tag "${tag}" is not a well-formed acc:{wagon}:{ACCEPTANCE-ID} URN`,
+        source_line: c.text });
+    }
+  }
+  return out;
+});

package/detectors/bun_tester_discipline_detector/checks/t_acceptance_resolves.mjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env bun
+// Member check: tester.bun.acceptance-resolves-to-declared  (tester discipline family)
+//
+// A test's `// Acceptance:` / `// WMBT:` header must name something the PLAN actually
+// declares. Its sibling t_acceptance_binding only asks whether a header is PRESENT,
+// which a test satisfies by naming anything at all: a suite bound to
+// `acc:does-not-exist:E999-NEVER-DECLARED` passed every gated rule in this workspace.
+// That is the recurring defect in this hub — a NAME accepted where a CLAIM is required.
+//
+// Core owns the SHAPE of these artifacts (wmbt.schema.json, acceptance.schema.json) and
+// validates them where they live. It cannot know whether a Bun test file resolves into
+// them, because finding the reference means reading Bun test headers. The shape is
+// core's; the binding is this extension's. That division is why the rule lives here.
+//
+// NOT_APPLICABLE, not FAIL, when the consumer declares no acceptances at all: a repo
+// with no plan/ has nothing to resolve against, and reporting there would fire on every
+// unplanned project rather than on a broken reference.
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} to ATDD_VIOLATIONS_REPORT, exits 0.
+import { readFileSync, writeFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { DEFAULT_EXCLUDES, parseJsonEnv, walkTests, parseHeader } from "../test_header.mjs";
+
+const RULE = "tester.bun.acceptance-resolves-to-declared";
+
+const read = (p) => { try { return readFileSync(p, "utf8"); } catch { return ""; } };
+
+function planFiles(dir, excludes) {
+  const out = [];
+  (function rec(d) {
+    let entries;
+    try { entries = readdirSync(d).sort(); } catch { return; }
+    for (const name of entries) {
+      if (excludes.includes(name)) continue;
+      const full = join(d, name);
+      let st;
+      try { st = statSync(full); } catch { continue; }
+      if (st.isDirectory()) rec(full);
+      else if (/\.ya?ml$/.test(name)) out.push(full);
+    }
+  })(dir);
+  return out;
+}
+
+// Every acceptance / WMBT URN the plan declares. Read as TOKENS rather than parsed
+// structurally on purpose: acceptances live under several keys across wagon, feature
+// and WMBT documents, and a reference is resolvable if the plan states that URN
+// anywhere. Over-accepting here is safe — the failure this rule exists to catch is a
+// reference to something the plan never mentions at all.
+function declaredUrns(croot, excludes) {
+  const urns = new Set();
+  for (const f of planFiles(join(croot, "plan"), excludes)) {
+    for (const m of read(f).matchAll(/\b((?:acc|wmbt):[a-z0-9][\w.-]*(?::[\w.-]+)?)/gi)) {
+      urns.add(m[1]);
+    }
+  }
+  return urns;
+}
+
+function consumerRoots(root, excludes) {
+  const roots = [];
+  (function rec(d) {
+    let st;
+    try { st = statSync(d); } catch { return; }
+    if (!st.isDirectory()) return;
+    try { if (statSync(join(d, "plan")).isDirectory()) { roots.push(d); return; } } catch {}
+    let entries;
+    try { entries = readdirSync(d).sort(); } catch { return; }
+    for (const n of entries) if (!excludes.includes(n)) rec(join(d, n));
+  })(root);
+  return roots;
+}
+
+const reportPath = process.env.ATDD_VIOLATIONS_REPORT;
+if (!reportPath) {
+  process.stderr.write("tester-check: ATDD_VIOLATIONS_REPORT not set\n");
+  process.exit(2);
+}
+const excludes = [...DEFAULT_EXCLUDES, ...parseJsonEnv("ATDD_SCAN_EXCLUDES", [])];
+const violations = [];
+
+for (const root of parseJsonEnv("ATDD_SCAN_ROOTS", [])) {
+  for (const croot of consumerRoots(root, excludes)) {
+    const declared = declaredUrns(croot, excludes);
+    if (!declared.size) continue;          // nothing declared: nothing to resolve against
+    for (const file of walkTests(croot, excludes)) {
+      const H = parseHeader(read(file));
+      for (const [label, field] of [["Acceptance", "acceptance"], ["WMBT", "wmbt"]]) {
+        const ref = H[field];
+        if (!ref || !ref.value) continue;
+        if (declared.has(ref.value)) continue;
+        violations.push({
+          rule_id: RULE, file, line: ref.no, col: 1,
+          evidence:
+            `\`// ${label}: ${ref.value}\` names nothing the plan declares; the test is bound ` +
+            `to an artifact that does not exist, so the coverage gate attributes it to nothing`,
+          source_line: ref.raw ?? "",
+        });
+      }
+    }
+  }
+}
+writeFileSync(reportPath, JSON.stringify({ violations }, null, 2), "utf8");
+process.stderr.write(`bun-tester[acceptance-resolves]: ${violations.length} violation(s)\n`);
+process.exit(0);

package/detectors/bun_tester_discipline_detector/checks/t_isolation_no_live_state.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env bun
+// Member check: tester.bun.test-isolation-no-live-state  (tester discipline family)
+//
+// A test must not write to state the developer or CI shares. Core's sibling
+// (`tester.test-isolation.no-polluting-patterns`) detects Python bare-mode-init
+// patterns; the Bun shapes are different, so this is a re-realization: mutating
+// `process.env` at module scope, and filesystem writes to a path that is not
+// derived from a temp directory or the test's own directory.
+//
+// This is the `strict` rule of the family, matching core, because a polluting test
+// does not fail loudly — it makes a DIFFERENT test fail later, somewhere else, and
+// costs a day to trace.
+import { runCheck } from "../test_header.mjs";
+
+const RULE = "tester.bun.test-isolation-no-live-state";
+const ENV_MUTATION = /^\s*process\.env\s*\.\s*[A-Za-z_][\w]*\s*=(?!=)/;
+const FS_WRITE = /\b(?:writeFileSync|appendFileSync|mkdirSync|rmSync|unlinkSync|rmdirSync|cpSync|renameSync)\s*\(\s*(['"`])([^'"`]*)\1/g;
+// A path that is scoped to the test: a temp dir, the test's own directory, or an
+// obviously disposable fixture root.
+const SCOPED = /tmpdir|tmp\/|\/tmp|import\.meta\.dir|__fixtures__|\.tmp/i;
+
+runCheck(RULE, (H, file, text) => {
+  const out = [];
+  text.split(/\r?\n/).forEach((line, i) => {
+    if (ENV_MUTATION.test(line)) {
+      out.push({ line: i + 1,
+        evidence: "test mutates process.env, leaking configuration into every test that runs after it",
+        source_line: line.trim() });
+    }
+    FS_WRITE.lastIndex = 0;
+    let m;
+    while ((m = FS_WRITE.exec(line)) !== null) {
+      if (SCOPED.test(m[2])) continue;
+      out.push({ line: i + 1,
+        evidence: `test writes to the literal path "${m[2]}" outside a temp directory; scope it to tmpdir() or import.meta.dir`,
+        source_line: line.trim() });
+    }
+  });
+  return out;
+});