@dzhechkov/harness-cli 0.3.230 → 0.3.232

package/README.md

@@ -501,6 +501,7 @@ dz discrimination-check --test <f[,f]> [--base <ref>] [--name <filter>] [--runne
 dz sign --init --out <path>  |  --pack <dir> --key <path>   # --init: generate the Ed25519 keypair (private OUTSIDE the repo, prints the public key for keys/dz.pub); else sign a pack's manifest + CycloneDX SBOM
 dz sbom --pack <dir> [--out <file>]   # emit the CycloneDX 1.5 SBOM for a pack standalone (file-level bill of materials); print to stdout or write to a file
 dz guard check --op <publish|teach|consolidate|reindex> [--text <s>] [--json] [--force <reason>]   # declarative constraint layer before self-mutating ops: HARD violation → block (exit 1), SOFT → warn; zero-config defaults, .dz/guard.json to customise; dz guard --init | dz guard log (append-only audit). dz publish runs it automatically (--no-guard "<reason>" = logged escape hatch)
+dz feature-adr-setup --guards [--loc-cap <n>] [--apply]   # P3: scaffold DETERMINISTIC guard tests into the project — guards.config.json + a zero-dependency check.mjs runner (LOC cap, secret scan, frozen-file sha256 pins, waivers-with-reasons); wire `node architecture/guards/check.mjs` into CI
 dz publish           [--filter <name>] [--bump-only] [--claim-check <off|warn|error>]   (dry-run by default; pass --yes/--confirm to go live; claim-check gate defaults to warn — surfaces README claim findings, never blocks)
 dz auto-canonicalize --source <github-url> --pack <skills-pack>
 dz sync-upstream     [--package <dir>] [--list] [--all]
@@ -1604,7 +1605,7 @@ invariants: HARD rules **block** the operation, SOFT rules warn. Zero config nee
 cover the known rakes; `.dz/guard.json` (via `dz guard --init`) exists only if you want to tune a severity
 or disable a rule.
 ```bash
-dz guard check --op publish        # no-workspace-star · no-skill-drift · no-secrets · readme-consistency
+dz guard check --op publish        # no-workspace-star · no-skill-drift · no-secrets · readme-consistency · readme-first
 dz guard check --op teach --text "the fix: export sk-abc..."   # → BLOCK (exit 1): looks like a credential
 dz guard log                       # append-only audit: every verdict + every forced override
 ```
@@ -1619,6 +1620,27 @@ visible, never silent. Calibrated against false gates: in a pnpm workspace, `wor
 *correct* (pnpm rewrites it at publish), so the rule resolves each workspace dep to the version it would
 ship as and blocks only a dep that would ship raw.
 
+### `dz feature-adr-setup --guards` — when a project rule should be a TEST, not a reviewer's memory
+
+A 700-line cap enforced by reviewer judgment catches one file and misses its sibling in the same change;
+`wc -l` catches both, always (the cost-of-detection ladder). `--guards` scaffolds a deterministic guard set
+into the TARGET project — no framework, no dependency, any stack with Node:
+```bash
+dz feature-adr-setup --guards            # preview (existing files are never clobbered)
+dz feature-adr-setup --guards --apply    # writes architecture/guards/{guards.config.json,check.mjs}
+node architecture/guards/check.mjs       # run locally / wire into CI or the test command
+```
+```
+guards: ✗ 1 violation(s)
+  [loc-cap] src/huge.ts — 801 lines > cap 700
+```
+Three deterministic rules, each with a **waiver mechanism that requires a reason** (a waiver without one is
+itself a violation — a conscious exception is recorded, not silently allowed): **loc-cap** (god-object
+guard, `--loc-cap <n>` tunes, default 700), **secret-scan** (the same high-signal credential shapes as
+`dz guard`), **frozen-files** (sha256 pins for files that must not change silently). The config is data —
+edit caps/paths/waivers in `guards.config.json`; the project-critic role should then *not* re-flag these
+rules, only waivers without a reason.
+
 ### Semantic recall (vector tier)
 
 `dz recall` is **hybrid** when the vector tier is available and **exactly the old lexical command** when it is not — enabling it never changes behavior for projects that skip it.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiPH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AA66JD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4I5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiPH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AA48JD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4I5E"}

package/dist/cli.js

@@ -3999,6 +3999,25 @@ function gatherGuardFacts(op, root, text, storeCap) {
         }
         catch { /* skip */ }
         facts['counts'] = gatherReadmeCounts(root);
+        // readme-first: from the WORKING-TREE diff (publishes happen pre-commit here), per package: does the
+        // change set contain its package.json (the version-bump signal) without its README.md?
+        try {
+            const status = execSync('git status --porcelain -- "packages/@dzhechkov/"', { cwd: root, encoding: 'utf-8' });
+            const perPack = new Map();
+            for (const line of status.split('\n')) {
+                const m = line.match(/packages\/@dzhechkov\/([^/]+)\/(.+)$/);
+                if (!m || !m[1] || !m[2])
+                    continue;
+                const e = perPack.get(m[1]) ?? { pkgJson: false, readme: false };
+                if (m[2] === 'package.json')
+                    e.pkgJson = true;
+                if (m[2] === 'README.md')
+                    e.readme = true;
+                perPack.set(m[1], e);
+            }
+            facts['readmeFirst'] = [...perPack.entries()].map(([name, e]) => ({ name: '@dzhechkov/' + name, versionBumped: e.pkgJson, readmeChanged: e.readme }));
+        }
+        catch { /* not a git repo — rule skips */ }
     }
     if (op === 'consolidate') {
         try {
@@ -4493,11 +4512,21 @@ async function cmdRetro(options, flags, cwd, write) {
 function cmdFeatureAdrSetup(options, flags, cwd, write) {
     let repoRoot = cwd;
     try {
-        repoRoot = execSync('git rev-parse --show-toplevel', { cwd, encoding: 'utf-8' }).trim() || cwd;
+        repoRoot = execSync('git rev-parse --show-toplevel', { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() || cwd;
     }
     catch { /* not git */ }
+    // P3 (fa-improvements): --guards scaffolds the deterministic guard set (guards.config.json + the
+    // zero-dependency check.mjs runner) — usable standalone (`dz feature-adr-setup --guards --apply`) or
+    // together with --from-spec. --loc-cap <n> tunes the LOC cap (default 700).
+    const wantGuards = flags.has('guards');
+    const locCapRaw = options.get('loc-cap');
+    const locCap = locCapRaw !== undefined ? Number(locCapRaw) : undefined;
+    if (locCapRaw !== undefined && (!Number.isFinite(locCap) || locCap <= 0)) {
+        write('dz feature-adr-setup: --loc-cap must be a positive finite number');
+        return 1;
+    }
     const specPath = options.get('from-spec');
-    if (specPath === undefined) {
+    if (specPath === undefined && !wantGuards) {
         // default + --plan: the read-only "which documents, and where?" answer.
         const plan = buildSetupPlan(scanForSetup(repoRoot));
         if (flags.has('json')) {
@@ -4519,15 +4548,22 @@ function cmdFeatureAdrSetup(options, flags, cwd, write) {
             write('  → the `configure-feature-adr` skill walks you through the missing docs; or pass a filled spec with --from-spec.');
         return 0;
     }
-    // --from-spec: scaffold (preview, or --apply to write).
+    // --from-spec and/or --guards: scaffold (preview, or --apply to write).
     let spec;
-    try {
-        spec = JSON.parse(readFileSync(resolve(cwd, specPath), 'utf-8'));
+    if (specPath !== undefined) {
+        try {
+            spec = JSON.parse(readFileSync(resolve(cwd, specPath), 'utf-8'));
+        }
+        catch (e) {
+            write(`dz feature-adr-setup: cannot read spec ${specPath}: ${e instanceof Error ? e.message : String(e)}`);
+            return 1;
+        }
     }
-    catch (e) {
-        write(`dz feature-adr-setup: cannot read spec ${specPath}: ${e instanceof Error ? e.message : String(e)}`);
-        return 1;
+    else {
+        spec = {}; // --guards standalone: scaffold just the guard set
     }
+    if (wantGuards)
+        spec = { ...spec, guards: locCap !== undefined ? { locCap } : true };
     const result = scaffoldFromSpec(spec, readExistingForScaffold(repoRoot));
     if (flags.has('json') && !flags.has('apply')) {
         write(JSON.stringify(result, null, 2));