@gonrocca/nodd 0.1.0

package/src/change-acceptance.test.ts

@@ -0,0 +1,175 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { emptyCommitted, fold } from "./state.ts";
+import { observation } from "./observations.ts";
+import { emptyDoc, type FeatureDoc, type Task } from "./feature-doc.ts";
+import { acceptRewrite, declarationAfter, reopenTask } from "./change-acceptance.ts";
+
+function docWith(tasks: Task[]): FeatureDoc {
+  const doc = emptyDoc({ slug: "demo", title: "Demo" });
+  doc.tasks = tasks;
+  doc.progress = "- started";
+  return doc;
+}
+
+const checked = (id: string, title: string): Task => ({
+  id,
+  title,
+  checked: true,
+  evidence: { command: "npm test", outcome: "success" },
+  candidate: "1a2b3c4",
+});
+
+const open = (id: string, title: string): Task => ({ id, title, checked: false });
+
+// ---------------------------------------------------------------------------
+// Reason required (`routing.go:97`)
+// ---------------------------------------------------------------------------
+test("reopening a checked task without a reason is refused, naming the missing reason", () => {
+  const result = reopenTask(docWith([checked("T1", "First")]), "T1", "");
+  assert.equal(result.ok, false);
+  assert.ok(result.ok === false && /reason/i.test(result.problem), result.ok === false ? result.problem : "");
+});
+
+test("reopening with a reason succeeds and records it under Progress", () => {
+  const result = reopenTask(docWith([checked("T1", "First")]), "T1", "the check was run against stale code");
+  assert.equal(result.ok, true);
+  if (result.ok !== true) return;
+  assert.equal(result.doc.tasks[0].checked, false, "the task is reopened");
+  assert.match(result.doc.progress, /T1 reopened: the check was run against stale code/);
+  assert.match(result.doc.progress, /- started/, "the existing progress log is preserved");
+});
+
+test("reopening drops the previous evidence: it no longer describes the current code", () => {
+  const result = reopenTask(docWith([checked("T1", "First")]), "T1", "requirements changed");
+  assert.equal(result.ok, true);
+  if (result.ok !== true) return;
+  assert.ok(!("evidence" in result.doc.tasks[0]), "a reopened task carries no stale evidence");
+});
+
+test("reopening a task that is not checked, or does not exist, is refused", () => {
+  const notChecked = reopenTask(docWith([open("T1", "First")]), "T1", "a reason");
+  assert.equal(notChecked.ok, false);
+  const missing = reopenTask(docWith([checked("T1", "First")]), "T9", "a reason");
+  assert.equal(missing.ok, false);
+  assert.ok(missing.ok === false && missing.problem.includes("T9"));
+});
+
+// ---------------------------------------------------------------------------
+// Preserve valid completed and unrelated work (`routing.go:97`)
+// ---------------------------------------------------------------------------
+test("a rewrite dropping an unrelated completed task is refused, naming the lost task", () => {
+  const before = docWith([checked("T1", "First"), checked("T2", "Unrelated but done"), open("T3", "Third")]);
+  const after = docWith([checked("T1", "First"), open("T3", "Third")]);
+
+  const result = acceptRewrite(before, after);
+  assert.equal(result.ok, false);
+  assert.ok(result.ok === false && result.problem.includes("T2"), "the refusal names the task it would have lost");
+  assert.ok(result.ok === false && result.problem.includes("Unrelated but done"));
+});
+
+test("a rewrite that adds tasks and keeps every completed one is accepted", () => {
+  const before = docWith([checked("T1", "First"), open("T2", "Second")]);
+  const after = docWith([checked("T1", "First"), open("T2", "Second"), open("T3", "New from findings")]);
+
+  const result = acceptRewrite(before, after);
+  assert.equal(result.ok, true);
+  assert.equal(result.ok === true && result.doc.tasks.length, 3);
+});
+
+test("a rewrite may drop an open task: only completed work is protected", () => {
+  const before = docWith([checked("T1", "First"), open("T2", "Never started")]);
+  const after = docWith([checked("T1", "First")]);
+  assert.equal(acceptRewrite(before, after).ok, true);
+});
+
+test("a rewrite silently unchecking a completed task is refused", () => {
+  const before = docWith([checked("T1", "First")]);
+  const after = docWith([open("T1", "First")]);
+
+  const result = acceptRewrite(before, after);
+  assert.equal(result.ok, false);
+  assert.ok(result.ok === false && /reopenTask|reason/i.test(result.problem));
+});
+
+// ---------------------------------------------------------------------------
+// Findings never expand scope on their own (`routing.go:97`)
+// ---------------------------------------------------------------------------
+test("an observed subagent result never mutates the declared intent or route", () => {
+  let committed = fold(emptyCommitted(), observation({
+    toolCallId: "d1",
+    toolName: "nodd_declare",
+    input: { intent: "read-only", route: "inline", slug: "demo" },
+    isError: false,
+    resultText: "",
+    at: "2026-09-19T10:00:00.000Z",
+  }));
+  const declared = declarationAfter(committed);
+
+  committed = fold(committed, observation({
+    toolCallId: "s1",
+    toolName: "subagent",
+    input: { agent: "explorer", prompt: "map the code" },
+    isError: false,
+    resultText: "Findings: this needs a tracked route and writes to 6 files. Intent must become change.",
+    at: "2026-09-19T10:05:00.000Z",
+  }));
+
+  assert.deepEqual(declarationAfter(committed), declared, "findings alone authorize nothing");
+  assert.deepEqual(declared, {
+    intent: "read-only", route: "inline", slug: "demo", runner: null, tdd: "off", files: [],
+  });
+});
+
+test("only nodd_declare changes the declaration", () => {
+  let committed = fold(emptyCommitted(), observation({
+    toolCallId: "d1",
+    toolName: "nodd_declare",
+    input: { intent: "read-only", route: "inline", slug: "demo" },
+    isError: false, resultText: "", at: "2026-09-19T10:00:00.000Z",
+  }));
+  committed = fold(committed, observation({
+    toolCallId: "d2",
+    toolName: "nodd_declare",
+    input: { intent: "change", route: "tracked", slug: "demo" },
+    isError: false, resultText: "", at: "2026-09-19T10:06:00.000Z",
+  }));
+  assert.deepEqual(declarationAfter(committed), {
+    intent: "change", route: "tracked", slug: "demo", runner: null, tdd: "off", files: [],
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Checkboxes grant nothing (`routing.go:97`)
+// ---------------------------------------------------------------------------
+/** Comments explain the rules; only executable lines can break them. */
+function code(url: URL): string {
+  return readFileSync(url, "utf8")
+    .split("\n")
+    .filter((line) => !/^\s*(\/\/|\*|\/\*)/.test(line))
+    .join("\n");
+}
+
+test("no code path derives approval or evidence from a checkbox state", () => {
+  // This module reads `checked` to protect completed work, which is its job.
+  // What it may never do is turn that bit into approval or into evidence.
+  assert.ok(!/approv/i.test(code(new URL("./change-acceptance.ts", import.meta.url))), "approval is never derived here");
+
+  // The evidence gate keys on ledger records and committed observations only.
+  const evidence = code(new URL("./gates/evidence.ts", import.meta.url));
+  assert.ok(!/\bchecked\b/.test(evidence), "gate-evidence must not read checkbox state");
+  assert.ok(/commandResults/.test(evidence), "gate-evidence keys on observed command results");
+});
+
+test("a checkoff is not a receipt: acceptance never reads evidence off a checkbox", () => {
+  // Two docs identical except that one claims a success it never observed. The
+  // rewrite rules treat them the same, because `[x]` carries no authority.
+  const forged = docWith([{
+    id: "T1", title: "First", checked: true,
+    evidence: { command: "npm test", outcome: "success" }, candidate: "deadbee",
+  }]);
+  const result = acceptRewrite(forged, docWith([open("T1", "First")]));
+  assert.equal(result.ok, false, "the claim is preserved as a claim, never promoted to a receipt");
+  assert.ok(result.ok === false && /reason/i.test(result.problem));
+});

package/src/change-acceptance.ts

@@ -0,0 +1,98 @@
+// What happens to work already done when the plan changes.
+//
+// `routing.go:97`: accepted changes preserve valid completed and unrelated work;
+// add new or reopen invalidated tasks **with a reason**; findings alone never
+// authorize scope expansion; business scope changes still need the user;
+// checkboxes grant no approval and no receipt.
+//
+// Three of those are mechanical and live here:
+//
+//   - **Preserve.** A rewrite that would lose a completed task is refused,
+//     naming it. Losing finished work silently is the worst possible outcome of
+//     a "helpful" replan, and it is invisible in a diff of a generated file.
+//   - **Reason required.** Reopening a `[x]` needs a reason, which lands in
+//     `## Progress`. An unexplained reopen is indistinguishable from erasing an
+//     inconvenient result.
+//   - **Findings authorize nothing.** The declaration comes from `nodd_declare`
+//     observations and from nothing else, so a `subagent` result that says "this
+//     really needs a tracked route" cannot make it one. That is the observable
+//     half of "findings alone never authorize scope expansion".
+//
+// Whether a change is a *business*-scope change stays prose: the mechanism is
+// only that intent and route move exclusively through an explicit declaration.
+
+import type { Committed, Declaration } from "./state.ts";
+import type { FeatureDoc, Task } from "./feature-doc.ts";
+
+export type Acceptance =
+  | { ok: true; doc: FeatureDoc }
+  | { ok: false; problem: string };
+
+/**
+ * The declared intent and route, from observed `nodd_declare` calls only.
+ * The reducer already enforces this; the function exists so the rule has a name
+ * and a test, rather than being an emergent property nobody is watching.
+ */
+export function declarationAfter(committed: Committed): Declaration | null {
+  return committed.declaration;
+}
+
+function describe(task: Task): string {
+  return `${task.id} (${task.title})`;
+}
+
+/** Reopen a checked task. A reason is required and is recorded under Progress. */
+export function reopenTask(doc: FeatureDoc, id: string, reason: string): Acceptance {
+  const index = doc.tasks.findIndex((task) => task.id === id);
+  if (index < 0) return { ok: false, problem: `${id} is not in the feature document` };
+
+  const task = doc.tasks[index];
+  if (!task.checked) return { ok: false, problem: `${id} is not checked, so there is nothing to reopen` };
+
+  if (reason.trim() === "") {
+    return {
+      ok: false,
+      problem: `reopening ${describe(task)} requires a reason: an unexplained reopen is indistinguishable from erasing a result`,
+    };
+  }
+
+  const tasks = [...doc.tasks];
+  // The old evidence described the old code. Keeping it on a reopened task would
+  // let a stale success get re-checked without anything being observed again.
+  tasks[index] = { id: task.id, title: task.title, checked: false };
+
+  const progress = [doc.progress.trim(), `- ${id} reopened: ${reason.trim()}`]
+    .filter((part) => part !== "")
+    .join("\n");
+
+  return { ok: true, doc: { ...doc, tasks, progress } };
+}
+
+/**
+ * Accept a proposed replacement document. Completed tasks must survive it, and
+ * they must survive it still completed — silently unchecking one is a reopen
+ * wearing a rewrite's clothes, and reopens need a reason.
+ */
+export function acceptRewrite(before: FeatureDoc, after: FeatureDoc): Acceptance {
+  const proposed = new Map(after.tasks.map((task) => [task.id, task]));
+
+  for (const task of before.tasks) {
+    if (!task.checked) continue;
+
+    const replacement = proposed.get(task.id);
+    if (!replacement) {
+      return {
+        ok: false,
+        problem: `this rewrite would drop the completed task ${describe(task)}; valid completed work is preserved`,
+      };
+    }
+    if (!replacement.checked) {
+      return {
+        ok: false,
+        problem: `this rewrite would uncheck the completed task ${describe(task)}; use reopenTask with a reason instead`,
+      };
+    }
+  }
+
+  return { ok: true, doc: after };
+}

package/src/config.test.ts

@@ -0,0 +1,61 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { DEFAULT_CONFIG, mergeConfig, noddConfigPath, parseConfig } from "./config.ts";
+
+test("the config path is ~/.pi/nodd.json and nothing else", () => {
+  assert.equal(noddConfigPath(), join(homedir(), ".pi", "nodd.json"));
+});
+
+test("absent, empty and malformed input all degrade to defaults", () => {
+  for (const input of [undefined, "", "   ", "{{{", "[]", "null"]) {
+    const parsed = parseConfig(input);
+    assert.deepEqual(parsed.config, DEFAULT_CONFIG, `input ${JSON.stringify(input)}`);
+  }
+  assert.deepEqual(parseConfig(undefined).defects, []);
+  assert.equal(parseConfig("{{{").defects.length, 1);
+});
+
+test("a partial config keeps its own values and fills the rest", () => {
+  const { config, defects } = parseConfig(JSON.stringify({ models: { implement: "a/b" } }));
+  assert.deepEqual(defects, []);
+  assert.equal(config.models.implement, "a/b");
+  assert.deepEqual(config.profiles, {});
+  assert.equal(config.activeProfile, null);
+});
+
+test("merge preserves an unknown key byte-for-byte", () => {
+  const existing = { keepMe: { deep: [1, "two", { three: true }] }, models: { implement: "a/b" } };
+  const merged = mergeConfig(existing, { models: { implement: "c/d" } });
+  assert.deepEqual(merged.keepMe, existing.keepMe);
+  assert.equal(JSON.stringify(merged.keepMe), JSON.stringify(existing.keepMe));
+  assert.deepEqual(merged.models, { implement: "c/d" });
+});
+
+test("merge writes only the named section", () => {
+  const merged = mergeConfig({ models: { implement: "a/b" } }, { gates: { track: { enabled: false } } });
+  assert.deepEqual(merged.models, { implement: "a/b" });
+  assert.deepEqual(merged.gates, { track: { enabled: false } });
+});
+
+test("no NODD source file mentions zero.json", () => {
+  const root = dirname(dirname(fileURLToPath(import.meta.url)));
+  const walk = (dir: string, out: string[] = []): string[] => {
+    if (!existsSync(dir)) return out;
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry);
+      if (statSync(full).isDirectory()) walk(full, out);
+      else out.push(full);
+    }
+    return out;
+  };
+  // Assembled at runtime so this assertion does not match its own source.
+  const forbidden = `zero${"."}json`;
+  for (const file of [...walk(join(root, "src")), ...walk(join(root, "extensions"))]) {
+    if (file.endsWith("config.test.ts")) continue;
+    assert.ok(!readFileSync(file, "utf8").includes(forbidden), `${file} mentions forge's config file`);
+  }
+});

package/src/config.ts

@@ -0,0 +1,103 @@
+// NODD's configuration lives in `~/.pi/nodd.json` and nowhere else. Forge's own
+// config file is never read and never written: the two products share a home
+// directory, not a schema. A test asserts no NODD source file even names it.
+//
+// This module is pure: it parses text and merges objects. Reading and writing
+// the file is the extensions' job.
+
+import { homedir } from "node:os";
+import { join } from "node:path";
+import type { ConfigurableSlot } from "./manifest.ts";
+
+export type GateFlag = { enabled: boolean };
+
+export type NoddConfig = {
+  /** slot -> `provider/model` (or a bare model id pi can resolve). */
+  models: Partial<Record<ConfigurableSlot, string>>;
+  /** profile name -> a full slot assignment set. */
+  profiles: Record<string, Partial<Record<ConfigurableSlot, string>>>;
+  activeProfile: string | null;
+  /** gate id -> flag. Absent means "nobody chose"; the default applies. */
+  gates: Record<string, GateFlag>;
+};
+
+export const DEFAULT_CONFIG: NoddConfig = Object.freeze({
+  models: {},
+  profiles: {},
+  activeProfile: null,
+  gates: {},
+});
+
+export function noddConfigPath(home: string = homedir()): string {
+  return join(home, ".pi", "nodd.json");
+}
+
+function asObject(value: unknown): Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+function asStringMap(value: unknown): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, raw] of Object.entries(asObject(value))) {
+    if (typeof raw === "string") out[key] = raw;
+  }
+  return out;
+}
+
+export type ParsedConfig = { config: NoddConfig; defects: string[] };
+
+/**
+ * Tolerant read. An absent file, an empty file and `{{{` all produce the
+ * documented defaults — a broken config must never take a session down. A parse
+ * failure is reported as a defect so the user can see it; missing sections are
+ * not defects, they are just unset.
+ */
+export function parseConfig(text: string | undefined): ParsedConfig {
+  if (text === undefined || text.trim() === "") {
+    return { config: { ...DEFAULT_CONFIG }, defects: [] };
+  }
+
+  let raw: unknown;
+  try {
+    raw = JSON.parse(text);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { config: { ...DEFAULT_CONFIG }, defects: [`nodd.json is not valid JSON: ${message}`] };
+  }
+
+  const root = asObject(raw);
+  const profiles: NoddConfig["profiles"] = {};
+  for (const [name, value] of Object.entries(asObject(root.profiles))) {
+    profiles[name] = asStringMap(value) as NoddConfig["profiles"][string];
+  }
+
+  const gates: NoddConfig["gates"] = {};
+  for (const [id, value] of Object.entries(asObject(root.gates))) {
+    const enabled = asObject(value).enabled;
+    if (typeof enabled === "boolean") gates[id] = { enabled };
+  }
+
+  return {
+    config: {
+      models: asStringMap(root.models) as NoddConfig["models"],
+      profiles,
+      activeProfile: typeof root.activeProfile === "string" ? root.activeProfile : null,
+      gates,
+    },
+    defects: [],
+  };
+}
+
+/**
+ * Merge a patch into the raw parsed JSON, section by section. Unknown top-level
+ * keys survive untouched: NODD is a guest in a file the user owns, and losing a
+ * key nobody asked us to manage would be a silent data loss.
+ */
+export function mergeConfig(
+  existing: Record<string, unknown>,
+  patch: Record<string, unknown>,
+): Record<string, unknown> {
+  return { ...existing, ...patch };
+}

package/src/delivery.test.ts

@@ -0,0 +1,156 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { emptyDoc, parseFeatureDoc, renderFeatureDoc } from "./feature-doc.ts";
+import {
+  GENERATED_PATHS,
+  countAuthoredLines,
+  crossedForecast,
+  defaultDelivery,
+  isChain,
+  isStrategy,
+  type Delivery,
+} from "./delivery.ts";
+
+const full: Delivery = {
+  strategy: "auto-chain",
+  chain: "feature-branch-chain",
+  forecast: 400,
+  running: 612,
+  boundaries: [
+    { base: "origin/main", head: "1a2b3c4" },
+    { base: "1a2b3c4", head: "5d6e7f8" },
+  ],
+};
+
+test("the Delivery section round-trips with all five fields", () => {
+  const doc = emptyDoc({ slug: "demo", title: "Demo" });
+  doc.delivery = full;
+
+  const parsed = parseFeatureDoc(renderFeatureDoc(doc));
+  assert.deepEqual(parsed.defects, []);
+  assert.deepEqual(parsed.doc.delivery, full);
+});
+
+test("an unknown running count round-trips as unknown, never as a number", () => {
+  const doc = emptyDoc({ slug: "demo", title: "Demo" });
+  doc.delivery = { ...defaultDelivery(), running: "unknown" };
+  const parsed = parseFeatureDoc(renderFeatureDoc(doc));
+  assert.equal(parsed.doc.delivery.running, "unknown");
+});
+
+test("the default strategy is ask-on-risk and both choices are cached in the doc", () => {
+  const delivery = defaultDelivery();
+  assert.equal(delivery.strategy, "ask-on-risk");
+  assert.equal(delivery.chain, "stacked-to-main");
+  assert.deepEqual(delivery.boundaries, []);
+});
+
+test("invalid strategy and chain values are rejected", () => {
+  for (const good of ["ask-on-risk", "auto-chain", "single-pr", "exception-ok"]) {
+    assert.equal(isStrategy(good), true, good);
+  }
+  for (const bad of ["yolo", "", "ASK-ON-RISK", "ask on risk"]) {
+    assert.equal(isStrategy(bad), false, bad);
+  }
+  assert.equal(isChain("stacked-to-main"), true);
+  assert.equal(isChain("feature-branch-chain"), true);
+  assert.equal(isChain("octopus"), false);
+});
+
+// ---------------------------------------------------------------------------
+// The running count is measured from observed git output, never estimated.
+// ---------------------------------------------------------------------------
+test("a normal diffstat counts additions plus deletions", () => {
+  const output = [
+    " src/a.ts     | 10 ++++++++--",
+    " src/b.ts     |  4 ++++",
+    " 2 files changed, 12 insertions(+), 2 deletions(-)",
+  ].join("\n");
+  assert.equal(countAuthoredLines(output), 14);
+});
+
+test("generated paths are excluded from the count", () => {
+  const output = [
+    " src/a.ts          | 10 ++++++++--",
+    " package-lock.json | 900 +++++++++++++++++",
+    " dist/bundle.js    | 500 +++++++++++",
+    " 3 files changed, 1408 insertions(+), 2 deletions(-)",
+  ].join("\n");
+  // Only src/a.ts survives the exclusion list: 8 added + 2 removed.
+  assert.equal(countAuthoredLines(output), 10);
+  assert.ok(GENERATED_PATHS.length > 0, "the exclusion list is documented, not implicit");
+});
+
+test("unparseable output leaves the count unknown, never guessed", () => {
+  assert.equal(countAuthoredLines("fatal: not a git repository"), "unknown");
+  assert.equal(countAuthoredLines(""), "unknown");
+  assert.equal(countAuthoredLines("everything is fine"), "unknown");
+});
+
+test("a diffstat of only generated files counts zero authored lines, not unknown", () => {
+  const output = [
+    " package-lock.json | 900 +++++++++++++++++",
+    " 1 file changed, 900 insertions(+)",
+  ].join("\n");
+  assert.equal(countAuthoredLines(output), 0, "parsed and measured as zero authored: that is a measurement");
+});
+
+// ---------------------------------------------------------------------------
+// The crossing NEVER blocks. `routing.go:95` calls the figure a planning
+// heuristic; turning it into a gate would violate the clause it comes from.
+// ---------------------------------------------------------------------------
+test("crossing the forecast is reported for the prompt and is not a decision", () => {
+  assert.equal(crossedForecast({ ...full, running: 612, forecast: 400 }), true);
+  assert.equal(crossedForecast({ ...full, running: 120, forecast: 400 }), false);
+  assert.equal(crossedForecast({ ...full, running: "unknown" }), false, "unknown never claims a crossing");
+});
+
+test("a write at 600 running lines is allowed: no gate consults a line count", () => {
+  const root = dirname(fileURLToPath(import.meta.url));
+  const gateFiles = readdirSync(join(root, "gates")).filter((f) => f.endsWith(".ts") && !f.endsWith(".test.ts"));
+  assert.ok(gateFiles.length >= 6, "the scan must actually cover the gates");
+
+  for (const file of gateFiles) {
+    const source = readFileSync(join(root, "gates", file), "utf8");
+    assert.ok(!/from "\.\.\/delivery\.ts"/.test(source), `${file} must not import the delivery module`);
+    // The structural guarantee: no gate can reach a count, a size or a
+    // forecast, so the heuristic cannot become a block by accident.
+    assert.ok(
+      !/countAuthoredLines|crossedForecast|\.running\b|\bforecast\b|lineCount|byteSize/.test(source),
+      `${file} must not read a line count`,
+    );
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Execution is out of scope: `/zero-branch` and `/zero-pr` already do it.
+// ---------------------------------------------------------------------------
+test("no NODD code path pushes, opens a PR or merges", () => {
+  const root = dirname(dirname(fileURLToPath(import.meta.url)));
+  const files: string[] = [];
+  const walk = (dir: string) => {
+    if (!existsSync(dir)) return;
+    for (const entry of readdirSync(dir)) {
+      const fullPath = join(dir, entry);
+      if (statSync(fullPath).isDirectory()) walk(fullPath);
+      else if (fullPath.endsWith(".ts")) files.push(fullPath);
+    }
+  };
+  walk(join(root, "src"));
+  walk(join(root, "extensions"));
+
+  const forbidden = [/git\s+push/, /gh\s+pr\s+create/, /git\s+merge/];
+  for (const file of files) {
+    // Comments may name what NODD refuses to do; executable lines may not.
+    const code = readFileSync(file, "utf8")
+      .split("\n")
+      .filter((line) => !/^\s*(\/\/|\*|\/\*)/.test(line))
+      .join("\n");
+    for (const pattern of forbidden) {
+      assert.ok(!pattern.test(code), `${file} must not invoke ${pattern}`);
+    }
+  }
+});