@cosmicdrift/kumiko-guards 0.309.0 → 0.311.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.309.0",
+  "version": "0.311.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -28,7 +28,7 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.309.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.311.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.311.0",
+    "type": "breaking",
+    "title": "test-timeouts is now always-enforcing, plus two new guards (test-template-drift, Real-Provider-Isolation)",
+    "detail": "test-timeouts drops its transitional baseline/ratchet — any sleep loop,\ntest.setTimeout/test.slow, or waitForTimeout finding fails the guard run\ndirectly, with no `.kumiko-test-timeouts-baseline.json` grandfathering\npre-existing violations.\nNew AST guard test-template-drift flags apps reimplementing the\nkumiko-testing e2e/screenshot template locally: a Playwright config that\nbuilds its own defineConfig(...) instead of calling defineAppE2eConfig(),\na literal deviceScaleFactor override anywhere (test.use, a project's use,\nor the config's own use block), a literal viewport override in a\nplaywright*.config.ts's own use or a project's use (a spec's own\ntest.use({ viewport }) is not flagged — it's the documented way to assert a\nlayout that only exists below the template's 1920px default; a\n`...devices[\"…\"]` spread stays allowed everywhere), or a direct\npage.screenshot(...) call instead of captureScreenshot.\nNew repo check Real-Provider-Isolation flags a CI workflow that references\nKUMIKO_REAL_PROVIDERS or invokes test:real/e2e:real, a package.json script\nother than test:real/e2e:real that leaks the real-provider env or a\n*.real. spec/test reference, and one of the template's own non-real bunfig\nfiles (bunfig.toml, bunfig.integration.toml, bunfig.dom.toml) missing the\n**/*.real.test.ts exclusion.",
+    "migration": "Fix or mark each test-timeouts finding: replace hand-rolled poll loops with\nthe shared `waitFor` from @cosmicdrift/kumiko-framework/testing, or add\n`// @timeout-exception: #<issue> <technical reason>` on the loop's own line\nor the line above for a genuine non-condition wait. Delete any committed\n`.kumiko-test-timeouts-baseline.json`.\nFor test-template-drift: switch a hand-rolled Playwright/screenshot config\nto defineAppE2eConfig(), drop config-level viewport/deviceScaleFactor\noverrides (the template already sets DESKTOP_VIEWPORT and renders\nscreenshot runs at SCREENSHOT_DEVICE_SCALE_FACTOR), and replace direct\npage.screenshot(...) calls with the template's captureScreenshot. Specs\nasserting a layout that only exists below 1920px set their own viewport via\ntest.use({ viewport }) — no exception marker needed. A deliberate exception\nfor anything else the guard flags (e.g. a handbook screenshot helper that\nneeds its own viewport-growth pass) is\n`// @template-drift-exception: #<issue> <technical reason>` on the line\nabove.\nFor Real-Provider-Isolation: remove any KUMIKO_REAL_PROVIDERS/test:real/\ne2e:real reference from CI workflows, move real-provider env/spec\nreferences out of scripts other than test:real/e2e:real, and regenerate\nbunfig.toml/bunfig.integration.toml/bunfig.dom.toml via\n`kumiko-testing bunfig` instead of hand-editing pathIgnorePatterns."
+  },
   {
     "version": "0.308.0",
     "type": "improvement",

package/src/check-real-provider-isolation.ts

@@ -0,0 +1,158 @@
+#!/usr/bin/env bun
+/**
+ * Real-Provider-Isolation-Guard (stack-agnostisch, #3118).
+ *
+ * Real-provider specs (`*.real.test.ts`, `*.real.spec.ts`) hit live third-party
+ * services and must only ever run manually, opt-in, via `bun run test:real` /
+ * `bun run e2e:real` — never inside a default `bun test`/`playwright test`
+ * glob and never inside CI (an accidental `KUMIKO_REAL_PROVIDERS=1` in a
+ * workflow spends real quota/credentials on every push).
+ *
+ * Flags:
+ *   (a) any CI workflow (`.github/workflows/*.{yml,yaml}`) that references
+ *       KUMIKO_REAL_PROVIDERS, `test:real`, or `e2e:real` — CI must never run
+ *       real-provider tests, full stop, so any mention is a violation.
+ *   (b) one of the template's own non-`real` bunfig files (`bunfig.toml`,
+ *       `bunfig.integration.toml`, `bunfig.dom.toml` — see BUNFIG_FILES in
+ *       packages/testing/src/bunfig.ts) whose pathIgnorePatterns doesn't
+ *       exclude `**\/*.real.test.ts` — the default-glob discovery trap. A
+ *       repo-specific bunfig outside that set (e.g. a coverage-ratchet
+ *       config invoked with an explicit path filter, never a bare
+ *       `bun test`) is not the template's concern and is left alone.
+ *   (c) a package.json script other than `test:real`/`e2e:real` that sets
+ *       KUMIKO_REAL_PROVIDERS or references a `.real.` spec/test file.
+ *
+ * `bunfig.real.toml` itself, and the `test:real`/`e2e:real` scripts, are the
+ * accepted, designated home for all three signals — see
+ * packages/testing/src/scaffold.ts and packages/testing/src/bunfig.ts, which
+ * generate them. Apps that use kumiko-testing's scaffold never trip this;
+ * it catches a hand-rolled or drifted bunfig/CI setup.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { Glob } from "bun";
+import { type RepoCheck, reportResults, runRepoChecks } from "./_lib/guard-kit";
+import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
+import { scanLinesForPredicate, type TextLineFinding } from "./_lib/scan-lines";
+
+const REAL_PROVIDERS_ENV = "KUMIKO_REAL_PROVIDERS";
+const REAL_SCRIPT_NAMES: ReadonlySet<string> = new Set(["test:real", "e2e:real"]);
+const REAL_TEST_IGNORE_ENTRY = "**/*.real.test.ts";
+
+const CI_WORKFLOW_GLOB = ".github/workflows/*.{yml,yaml}";
+// Only the template's own generated bunfig files (BUNFIG_FILES in
+// packages/testing/src/bunfig.ts) minus the real variant itself — a
+// hand-rolled bunfig outside this set (coverage ratchet, CI-only tweaks)
+// isn't what the template owns and is never invoked as a bare `bun test`.
+const TEMPLATE_OWNED_NON_REAL_BUNFIGS: readonly string[] = [
+  "bunfig.toml",
+  "bunfig.integration.toml",
+  "bunfig.dom.toml",
+];
+
+function ciWorkflowViolation(line: string): boolean {
+  return (
+    line.includes(REAL_PROVIDERS_ENV) || /\btest:real\b/.test(line) || /\be2e:real\b/.test(line)
+  );
+}
+
+function scanCiWorkflows(root: RepoRoot, findings: TextLineFinding[]): number {
+  let scanned = 0;
+  for (const rel of new Glob(CI_WORKFLOW_GLOB).scanSync({ cwd: root.absPath })) {
+    scanned++;
+    scanLinesForPredicate(join(root.absPath, rel), rel, ciWorkflowViolation, findings);
+  }
+  return scanned;
+}
+
+// package.json scripts: a real-provider signal in any script OTHER than the
+// two designated ones is a leak (e.g. a "test" or "ci" script that pulls in
+// the real env or filters for a .real. spec by hand).
+function scriptLeaksRealProvider(name: string, command: string): string | undefined {
+  if (REAL_SCRIPT_NAMES.has(name)) return undefined;
+  if (command.includes(REAL_PROVIDERS_ENV)) {
+    return `script "${name}" sets ${REAL_PROVIDERS_ENV} outside test:real/e2e:real: ${command}`;
+  }
+  if (/\.real\.(test|spec)\.ts/.test(command)) {
+    return `script "${name}" references a *.real. spec/test outside test:real/e2e:real: ${command}`;
+  }
+  return undefined;
+}
+
+function scanPackageJsonScripts(root: RepoRoot, findings: TextLineFinding[]): number {
+  const path = join(root.absPath, "package.json");
+  let parsed: { scripts?: Record<string, string> };
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8")) as { scripts?: Record<string, string> };
+  } catch {
+    return 0;
+  }
+  const scripts = parsed.scripts ?? {};
+  let scanned = 0;
+  for (const [name, command] of Object.entries(scripts)) {
+    scanned++;
+    const message = scriptLeaksRealProvider(name, command);
+    if (message !== undefined) {
+      findings.push({ file: "package.json", line: 1, text: message });
+    }
+  }
+  return scanned;
+}
+
+// The generated bunfig template (packages/testing/src/bunfig.ts) is what app
+// and library repos consume via `kumiko-testing bunfig` — the framework repo
+// hand-maintains its own root bunfig*.toml files and doesn't run this
+// template on itself, so it's excluded here to avoid flagging a convention
+// it was never meant to follow.
+function bunfigMissingRealExclusion(root: RepoRoot, findings: TextLineFinding[]): number {
+  if (root.kind === "framework") return 0;
+  let scanned = 0;
+  for (const rel of TEMPLATE_OWNED_NON_REAL_BUNFIGS) {
+    const abs = join(root.absPath, rel);
+    let content: string;
+    try {
+      content = readFileSync(abs, "utf8");
+    } catch {
+      continue;
+    }
+    scanned++;
+    if (!content.includes(REAL_TEST_IGNORE_ENTRY)) {
+      findings.push({
+        file: rel,
+        line: 1,
+        text: `[test] pathIgnorePatterns is missing "${REAL_TEST_IGNORE_ENTRY}" — a default \`bun test\` would pick up real-provider specs`,
+      });
+    }
+  }
+  return scanned;
+}
+
+export const check: RepoCheck = {
+  name: "Real-Provider-Isolation Guard",
+  hint:
+    `Real-provider tests run only via \`bun run test:real\`/\`bun run e2e:real\`, ` +
+    `never in CI and never in a default test glob. Regenerate bunfig via ` +
+    `\`kumiko-testing bunfig\` instead of hand-editing pathIgnorePatterns.`,
+  async run(roots) {
+    if (roots.length === 0) {
+      return { violations: [], matchedFiles: 0, notApplicable: true };
+    }
+    const findings: TextLineFinding[] = [];
+    let matchedFiles = 0;
+    for (const root of roots) {
+      matchedFiles += scanCiWorkflows(root, findings);
+      matchedFiles += scanPackageJsonScripts(root, findings);
+      matchedFiles += bunfigMissingRealExclusion(root, findings);
+    }
+    return {
+      violations: findings.map((f) => ({ file: f.file, line: f.line, message: f.text })),
+      matchedFiles,
+      notApplicable: false,
+    };
+  },
+};
+
+if (import.meta.main) {
+  const failed = reportResults(await runRepoChecks([check], resolveRepoRoots()));
+  process.exit(failed > 0 ? 1 : 0);
+}

package/src/guard-test-template-drift.ts

@@ -0,0 +1,239 @@
+#!/usr/bin/env bun
+/**
+ * Guard: apps must not locally reimplement the e2e/screenshot template that
+ * `@cosmicdrift/kumiko-testing` already owns (#3118). Flags, in Playwright
+ * configs and e2e/screenshot specs/helpers:
+ *   (a) a `playwright*.config.ts` that imports `defineConfig` from
+ *       `@playwright/test` directly instead of `defineAppE2eConfig` from
+ *       `@cosmicdrift/kumiko-testing/e2e` — a hand-rolled config drifts from
+ *       the template's timeouts/retries/workers/real-provider wiring.
+ *   (b) a literal `deviceScaleFactor: <n>` property anywhere (`test.use(...)`,
+ *       a project's `use`, or a config's own `use`), or a literal
+ *       `viewport: {…}` property in a `playwright*.config.ts`'s own `use` or
+ *       a project's `use` — instead of the template's `DESKTOP_VIEWPORT` /
+ *       `SCREENSHOT_DEVICE_SCALE_FACTOR`. A spec's own `test.use({ viewport })`
+ *       is not flagged — the 0.310.0 changeset documents it as the way to
+ *       assert a layout that only exists below the template's 1920px
+ *       default. A `...devices["…"]` spread is not a property assignment and
+ *       is never flagged — device-matrix projects (phone/tablet passes via
+ *       `runMatrix`) stay allowed.
+ *   (c) a direct `page.screenshot(...)` call — the template's
+ *       `captureScreenshot` (fit: viewport/fullPage/content) is the one path
+ *       apps should call.
+ *
+ * `packages/testing/**` (the template's own implementation) and
+ * `samples/recipes/**` are never scanned.
+ *
+ * Opt-out on the finding's own line or the line above:
+ * `// @template-drift-exception: #<issue> <technical reason>`.
+ *
+ * Usage (framework dev checkout):
+ *   bun guards/guard-test-template-drift.ts
+ * Consumer (via the published `kumiko-guards` CLI):
+ *   kumiko-guards guards --guard=test-template-drift
+ */
+import { Node, type SourceFile, SyntaxKind } from "ts-morph";
+import {
+  type AstGuard,
+  type GuardOutcome,
+  type GuardViolation,
+  isLocalFinding,
+  relFromRepoRoot,
+  runStandalone,
+  type ScanSpec,
+} from "./_lib/guard-kit";
+import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
+
+const SCAN: ScanSpec = {
+  scope: "tests",
+  extensions: ["ts", "tsx"],
+  kinds: ["framework", "app", "library"],
+  frameworkWithin: ["samples/apps/*/playwright*.config.ts", "samples/apps/*/e2e/**/*.{ts,tsx}"],
+  // frameworkWithin only narrows what's already collected here — the
+  // samples/apps globs must be listed in extraGlobs too, or nothing under
+  // samples/apps ever reaches the framework-kind scan in the first place.
+  extraGlobs: [
+    "playwright*.config.ts",
+    "e2e/**/*.{ts,tsx}",
+    "packages/*/e2e/**/*.{ts,tsx}",
+    "packages/*/src/e2e/**/*.{ts,tsx}",
+    "samples/apps/*/playwright*.config.ts",
+    "samples/apps/*/e2e/**/*.{ts,tsx}",
+  ],
+};
+
+const TESTING_DIR = "/packages/testing/";
+const RECIPES_DIR = "/samples/recipes/";
+const EXCEPTION_TAG = "@template-drift-exception";
+const COMPLETE_EXCEPTION = /@template-drift-exception:\s*#\d+\s+\S/;
+
+const CONFIG_FILENAME = /(?:^|\/)playwright[^/]*\.config\.tsx?$/;
+const DEFINE_APP_E2E_CONFIG = "defineAppE2eConfig";
+const DEFINE_APP_E2E_CONFIG_MODULE = "@cosmicdrift/kumiko-testing/e2e";
+const RAW_DEFINE_CONFIG_MODULE = "@playwright/test";
+
+const TEMPLATE_OWNED_KEYS: ReadonlySet<string> = new Set(["viewport", "deviceScaleFactor"]);
+
+export interface Finding {
+  file: string;
+  line: number;
+  message: string;
+}
+
+function relFile(sf: SourceFile, roots: readonly RepoRoot[]): string {
+  return relFromRepoRoot(sf.getFilePath(), roots);
+}
+
+function exceptionNote(node: Node): "allowed" | "incomplete" | "none" {
+  const lines = node.getSourceFile().getFullText().split("\n");
+  const line = node.getStartLineNumber();
+  const nearby = [lines[line - 1] ?? "", lines[line - 2] ?? ""];
+  if (nearby.some((text) => COMPLETE_EXCEPTION.test(text))) return "allowed";
+  return nearby.some((text) => text.includes(EXCEPTION_TAG)) ? "incomplete" : "none";
+}
+
+function withExceptionNote(node: Node, message: string): string | undefined {
+  const note = exceptionNote(node);
+  if (note === "allowed") return undefined;
+  return note === "incomplete"
+    ? `${message} [incomplete ${EXCEPTION_TAG} marker: needs "#<issue> <technical reason>"]`
+    : message;
+}
+
+function importsFrom(sf: SourceFile, moduleSuffix: string): boolean {
+  return sf
+    .getImportDeclarations()
+    .some((imp) => imp.getModuleSpecifierValue().endsWith(moduleSuffix));
+}
+
+function callsDefineAppE2eConfig(sf: SourceFile): boolean {
+  return sf
+    .getDescendantsOfKind(SyntaxKind.CallExpression)
+    .some((call) => call.getExpression().getText() === DEFINE_APP_E2E_CONFIG);
+}
+
+// A raw `defineConfig` import next to a missing `defineAppE2eConfig` call is
+// the hand-rolled-config signal — a file that never imports Playwright's
+// `defineConfig` at all (e.g. a fixture/helper next to the config) isn't one.
+function ownConfigFinding(sf: SourceFile): Finding | undefined {
+  if (!CONFIG_FILENAME.test(sf.getFilePath())) return undefined;
+  if (!importsFrom(sf, RAW_DEFINE_CONFIG_MODULE)) return undefined;
+  if (importsFrom(sf, DEFINE_APP_E2E_CONFIG_MODULE) && callsDefineAppE2eConfig(sf))
+    return undefined;
+  const message = withExceptionNote(
+    sf,
+    `Playwright config builds its own defineConfig(...) instead of defineAppE2eConfig() — timeouts, retries, workers and the real-provider spec split drift from the template.`,
+  );
+  return message === undefined ? undefined : { file: "", line: 1, message };
+}
+
+// A `viewport`/`deviceScaleFactor` key is only a Playwright config/test.use
+// override — the drift this guard cares about — when the object literal that
+// holds it is a `test.use(...)` argument or the value of a `use:` property
+// (a config's own use block, or a project's use block). The same key names
+// are also legitimate on unrelated app-owned option objects (e.g. runMatrix's
+// `Scenario.viewport`, a GIF-recorder's per-clip viewport), which must not be
+// flagged.
+function isPlaywrightUseObject(node: Node): boolean {
+  const parent = node.getParent();
+  if (parent === undefined) return false;
+  if (Node.isCallExpression(parent)) {
+    const callee = parent.getExpression().getText();
+    return callee === "test.use" || callee.endsWith(".use");
+  }
+  if (Node.isPropertyAssignment(parent)) return parent.getName() === "use";
+  return false;
+}
+
+function templateOwnedKeyFindings(sf: SourceFile): Finding[] {
+  const findings: Finding[] = [];
+  const isConfigFile = CONFIG_FILENAME.test(sf.getFilePath());
+  for (const prop of sf.getDescendantsOfKind(SyntaxKind.PropertyAssignment)) {
+    const name = prop.getName();
+    if (!TEMPLATE_OWNED_KEYS.has(name)) continue;
+    // viewport is only drift in the config's own use/project use — a spec's
+    // own test.use({ viewport }) is the documented way (0.310.0 changeset) to
+    // assert a layout that only exists below the template's 1920px default.
+    // deviceScaleFactor has no such legitimate per-spec override, so it stays
+    // flagged everywhere.
+    if (name === "viewport" && !isConfigFile) continue;
+    const objectLiteral = prop.getParent();
+    if (!Node.isObjectLiteralExpression(objectLiteral)) continue;
+    if (!isPlaywrightUseObject(objectLiteral)) continue;
+    const message = withExceptionNote(
+      prop,
+      `Literal "${name}" — use the template's DESKTOP_VIEWPORT/SCREENSHOT_DEVICE_SCALE_FACTOR (defineAppE2eConfig) instead of overriding it locally.`,
+    );
+    if (message !== undefined)
+      findings.push({ file: "", line: prop.getStartLineNumber(), message });
+  }
+  return findings;
+}
+
+function isPageScreenshotCall(call: Node): boolean {
+  if (!Node.isCallExpression(call)) return false;
+  const callee = call.getExpression();
+  if (!Node.isPropertyAccessExpression(callee)) return false;
+  if (callee.getName() !== "screenshot") return false;
+  return /(?:^|\.)page$/i.test(callee.getExpression().getText());
+}
+
+function pageScreenshotFindings(sf: SourceFile): Finding[] {
+  const findings: Finding[] = [];
+  for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    if (!isPageScreenshotCall(call)) continue;
+    const message = withExceptionNote(
+      call,
+      `Direct page.screenshot(...) call — use the template's captureScreenshot (fit: viewport/fullPage/content) instead of a local reimplementation.`,
+    );
+    if (message !== undefined)
+      findings.push({ file: "", line: call.getStartLineNumber(), message });
+  }
+  return findings;
+}
+
+export function scanTemplateDrift(
+  sf: SourceFile,
+  roots: readonly RepoRoot[] = resolveRepoRoots(),
+): Finding[] {
+  const path = sf.getFilePath();
+  if (path.includes(TESTING_DIR) || path.includes(RECIPES_DIR)) return [];
+  const file = relFile(sf, roots);
+  const findings: Finding[] = [];
+  const own = ownConfigFinding(sf);
+  if (own !== undefined) findings.push({ ...own, file });
+  for (const f of [...templateOwnedKeyFindings(sf), ...pageScreenshotFindings(sf)]) {
+    findings.push({ ...f, file });
+  }
+  return findings.sort((a, b) => a.line - b.line);
+}
+
+const REMEDIATION = `Mark a deliberate exception with \`// ${EXCEPTION_TAG}: #<issue> <technical reason>\`.`;
+
+const HINT =
+  "Apps consume the e2e/screenshot template through defineAppE2eConfig, not a hand-rolled Playwright config or a local viewport/DPR/screenshot reimplementation. See https://github.com/CosmicDriftGameStudio/kumiko-framework/blob/main/docs/guides/testing-standard.md.";
+
+function analyse(files: readonly SourceFile[], roots: readonly RepoRoot[]): GuardOutcome {
+  const findings: Finding[] = [];
+  for (const sf of files) {
+    for (const finding of scanTemplateDrift(sf, roots)) {
+      findings.push(finding);
+      console.warn(
+        `  [test-template-drift WARN] ${finding.file}:${finding.line}  ${finding.message}`,
+      );
+    }
+  }
+  const violations: GuardViolation[] = findings
+    .filter(isLocalFinding)
+    .map((f) => ({ file: f.file, line: f.line, message: `${f.message} ${REMEDIATION}` }));
+  return { violations };
+}
+
+export const guard: AstGuard = {
+  name: "test-template-drift",
+  scan: SCAN,
+  hint: HINT,
+  run: (files, roots = resolveRepoRoots()) => analyse(files, roots),
+};
+
+if (import.meta.main) runStandalone(guard);

package/src/guard-test-timeouts.ts

@@ -16,25 +16,19 @@
  * without an issue number or a reason does not count and is called out in
  * the message.
  *
- * `samples/recipes/**` is not touched. `.kumiko-test-timeouts-baseline.json`
- * in the repo root pins the frozen count per file (transition ratchet); over
- * baseline fails, at or under passes. Without the file the guard is
- * warning-only (bootstrap: `--write-baseline` once).
+ * `samples/recipes/**` is not touched. No baseline, no ratchet: any finding
+ * fails. #3118's transition period (a `.kumiko-test-timeouts-baseline.json`
+ * grandfathering pre-existing sleep loops) is over — every consumer must fix
+ * or mark the cause, not accumulate a pinned count.
  *
  * Usage (framework dev checkout):
- *   bun guards/guard-test-timeouts.ts                  # compare to baseline
- *   bun guards/guard-test-timeouts.ts --write-baseline # freeze current
- *   bun guards/guard-test-timeouts.ts --no-baseline    # skip comparison
+ *   bun guards/guard-test-timeouts.ts
  * Consumer (via the published `kumiko-guards` CLI):
- *   kumiko-guards guards --write-baseline --guard=test-timeouts
+ *   kumiko-guards guards --guard=test-timeouts
  */
-import * as path from "node:path";
 import { type CallExpression, Node, type SourceFile, SyntaxKind } from "ts-morph";
 import {
   type AstGuard,
-  baselineRatchet,
-  buildSharedProject,
-  filesForGuard,
   type GuardOutcome,
   type GuardViolation,
   isLocalFinding,
@@ -44,8 +38,6 @@ import {
 } from "./_lib/guard-kit";
 import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
 
-const ROOT = process.cwd();
-
 // Playwright dirs sit outside every manifest's sourceRoots/testGlobs, and
 // scenario helpers next to the specs (not just *.spec.ts) carry the timeouts too.
 const SCAN: ScanSpec = {
@@ -181,30 +173,12 @@ export function scanTimeouts(
   return findings.sort((a, b) => a.line - b.line);
 }
 
-const BASELINE_FILE = ".kumiko-test-timeouts-baseline.json";
-const timeoutsBaseline = baselineRatchet({
-  file: path.join(ROOT, BASELINE_FILE),
-  formatVersion: 1,
-  unit: "test timeout workaround(s)",
-});
-
 const REMEDIATION = `Wait for a condition (\`waitFor\`, \`expect.poll\`) instead of raising timeouts or sleeping, or mark the line with \`// ${EXCEPTION_TAG}: #<issue> <technical reason>\`.`;
 
 const HINT =
-  "Diagnose in this order: (1) reproduce a single run (`--repeat-each`, single file), (2) check shared state and missing isolation (one tenant per flow), (3) wait for a condition, not for time (`waitFor`, `expect.poll`), (4) check the seed, (5) only then change the central template via an issue — never per app. See https://github.com/CosmicDriftGameStudio/kumiko-framework/blob/main/docs/guides/test-failures.md. After a deliberate change: `kumiko-guards guards --write-baseline --guard=test-timeouts`.";
+  "Diagnose in this order: (1) reproduce a single run (`--repeat-each`, single file), (2) check shared state and missing isolation (one tenant per flow), (3) wait for a condition, not for time (`waitFor`, `expect.poll`), (4) check the seed, (5) only then change the central template via an issue — never per app. See https://github.com/CosmicDriftGameStudio/kumiko-framework/blob/main/docs/guides/test-failures.md.";
 
-export function baselineCounts(findings: readonly Finding[]): Record<string, number> {
-  const counts: Record<string, number> = {};
-  for (const finding of findings.filter(isLocalFinding)) {
-    counts[finding.file] = (counts[finding.file] ?? 0) + 1;
-  }
-  return counts;
-}
-
-function scan(
-  files: readonly SourceFile[],
-  roots: readonly RepoRoot[] = resolveRepoRoots(),
-): Finding[] {
+function analyse(files: readonly SourceFile[], roots: readonly RepoRoot[]): GuardOutcome {
   const findings: Finding[] = [];
   for (const sf of files) {
     for (const finding of scanTimeouts(sf, roots)) {
@@ -212,29 +186,9 @@ function scan(
       console.warn(`  [test-timeouts WARN] ${finding.file}:${finding.line}  ${finding.message}`);
     }
   }
-  return findings;
-}
-
-function analyse(
-  files: readonly SourceFile[],
-  roots: readonly RepoRoot[],
-  compareBaseline: boolean,
-): GuardOutcome {
-  const findings = scan(files, roots);
-  if (!compareBaseline) {
-    console.log("  Baseline comparison skipped (--no-baseline).");
-    return { violations: [] };
-  }
-  const local = findings.filter(isLocalFinding);
-  const violations: GuardViolation[] = timeoutsBaseline.check(
-    baselineCounts(findings),
-    REMEDIATION,
-    {
-      formatDriftRemediation:
-        "Run `kumiko-guards guards --write-baseline --guard=test-timeouts` once.",
-      resolveLine: (file) => local.find((f) => f.file === file)?.line ?? 1,
-    },
-  );
+  const violations: GuardViolation[] = findings
+    .filter(isLocalFinding)
+    .map((f) => ({ file: f.file, line: f.line, message: `${f.message} ${REMEDIATION}` }));
   return { violations };
 }
 
@@ -242,24 +196,7 @@ export const guard: AstGuard = {
   name: "test-timeouts",
   scan: SCAN,
   hint: HINT,
-  run: (files, roots = resolveRepoRoots()) => analyse(files, roots, true),
-  writeBaseline: (files) => timeoutsBaseline.write(baselineCounts(scan(files))),
+  run: (files, roots = resolveRepoRoots()) => analyse(files, roots),
 };
 
-// Flags are read only here, never in run() — the shared runner drives every
-// guard with the same argv, and a --write-baseline meant for another guard
-// must not silently refreeze this one.
-if (import.meta.main) {
-  const args = process.argv.slice(2);
-  if (args.includes("--write-baseline")) {
-    const project = buildSharedProject([guard]);
-    guard.writeBaseline?.(filesForGuard(project, guard));
-    process.exit(0);
-  }
-  if (args.includes("--no-baseline")) {
-    const project = buildSharedProject([guard]);
-    analyse(filesForGuard(project, guard), resolveRepoRoots(), false);
-    process.exit(0);
-  }
-  runStandalone(guard);
-}
+if (import.meta.main) runStandalone(guard);

package/src/run-guards.ts

@@ -49,6 +49,7 @@ import { guard as sectionFieldsRaw } from "./guard-section-fields-raw";
 import { guard as silentSkip } from "./guard-silent-skip";
 import { guard as tableDdl } from "./guard-table-ddl";
 import { guard as tenantEscalation } from "./guard-tenant-escalation";
+import { guard as testTemplateDrift } from "./guard-test-template-drift";
 import { guard as testTimeouts } from "./guard-test-timeouts";
 import { guard as textFieldStance } from "./guard-text-field-stance";
 import { guard as unsafeJsonParse } from "./guard-unsafe-json-parse";
@@ -90,6 +91,7 @@ export const GUARDS = [
   appFeatureStructure,
   libTestCoverage,
   testTimeouts,
+  testTemplateDrift,
 ];
 
 export const GUARD_FLAGS = [

package/src/run-repo-checks.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { cliFlagsError, printGuardKitBanner, reportResults, runRepoChecks } from "./_lib/guard-kit";
+import { check as realProviderIsolation } from "./check-real-provider-isolation";
 // Standalone-`main()` guards ported as RepoCheck — run in-process, no
 // per-guard subprocess/project.
 import { check as runtimeIsolation } from "./check-runtime-isolation";
@@ -24,6 +25,7 @@ export const REPO_CHECKS = [
   testStackDrift,
   runtimeIsolation,
   upgradeState,
+  realProviderIsolation,
 ];
 
 // No flags today — the array stays so an unknown flag still fails loud