@hongmaple0820/scale-engine 0.48.0 → 0.50.1

package/dist/workflow/BoundaryEnforcement.js

@@ -0,0 +1,182 @@
+// SCALE Engine - P0+ Boundary & Constraint enforcement
+//
+// Two checks layered on top of the P0 six-element Spec contract:
+//
+//  1. Boundary enforcement — compares the files a task actually changed against
+//     the Spec's executional `boundaries` (allowed `files` globs + explicitly
+//     `forbidden` globs). Touching a forbidden path, or editing a file outside
+//     the declared allow-list, is reported as a violation.
+//
+//  2. Constraint coverage — checks each declared `constraint` (an invariant that
+//     must not regress) against the Spec's `verificationSurface`. A constraint
+//     with no surface guarding it is a silent-regression risk.
+//
+// Enforcement is profile-gated (mirrors G23's E1 escalation): under `default`
+// and `auto` both checks are advisory — violations are surfaced as warnings and
+// recorded as evidence but never flip `passed` or block ship. Under an enforced
+// profile (`full`/`ci`/`strict`), the same findings are blocking: any boundary
+// violation or unguarded constraint stops Task completion. The `enforced` flag
+// threaded into the evaluators only sets the report's `advisory` mode; the
+// detection logic is identical, so a re-verify under `default` cannot silence a
+// finding, only downgrade how it is reported.
+import { isEnforcedProfile } from './ProfileEnforcement.js';
+/**
+ * Profiles in which boundary/constraint findings hard-block Task completion
+ * (decision E1, shared with G23). `default`/`auto` stay advisory; a profile
+ * whose name is or ends with `full`/`ci`/`strict` enforces.
+ */
+export function isEnforcedBoundaryProfile(profileName) {
+    return isEnforcedProfile(profileName);
+}
+export { isEnforcedProfile };
+function norm(value) {
+    return value.replace(/\\/g, '/').trim().toLowerCase();
+}
+/**
+ * Translate a minimatch-style glob to an anchored, full-path RegExp.
+ * `**` matches across `/`, `*` matches within a segment, `?` matches one
+ * non-`/` char. All other regex metacharacters are escaped.
+ */
+function globToRegExp(glob) {
+    const body = glob
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&') // escape specials, leaving * and ?
+        .replace(/\*\*/g, '\u0000') // globstar placeholder
+        .replace(/\*/g, '[^/]*')
+        .replace(/\u0000/g, '.*')
+        .replace(/\?/g, '[^/]');
+    return new RegExp(`^${body}$`);
+}
+/**
+ * Does a (normalised) changed-file path match a boundary glob?
+ * Supports exact paths, bare directory prefixes (`src` ⇒ `src/**`) and globs.
+ */
+export function pathMatchesGlob(file, glob) {
+    const f = norm(file);
+    const g = norm(glob);
+    if (!f || !g)
+        return false;
+    if (f === g)
+        return true;
+    // Bare directory (no wildcards) acts as a recursive prefix.
+    if (!/[*?]/.test(g)) {
+        const dir = g.endsWith('/') ? g : `${g}/`;
+        if (f.startsWith(dir))
+            return true;
+    }
+    try {
+        return globToRegExp(g).test(f);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Compare the changed-file set against a Spec's executional boundaries.
+ * Returns `undefined` when there is nothing to enforce (no boundaries, or
+ * neither `files` nor `forbidden` declared).
+ */
+export function evaluateBoundaries(changedFiles, boundaries, enforced = false) {
+    if (!boundaries)
+        return undefined;
+    const allowed = (boundaries.files ?? []).map(norm).filter(Boolean);
+    const forbidden = (boundaries.forbidden ?? []).map(norm).filter(Boolean);
+    if (allowed.length === 0 && forbidden.length === 0)
+        return undefined;
+    const files = [...new Set((changedFiles ?? []).map(f => norm(f ?? '')).filter(Boolean))];
+    const violations = [];
+    for (const file of files) {
+        const hitForbidden = forbidden.find(glob => pathMatchesGlob(file, glob));
+        if (hitForbidden) {
+            violations.push({ file, kind: 'forbidden-touched', matchedGlob: hitForbidden });
+            continue;
+        }
+        if (allowed.length > 0 && !allowed.some(glob => pathMatchesGlob(file, glob))) {
+            violations.push({ file, kind: 'outside-allowed' });
+        }
+    }
+    return {
+        declaredAllowed: allowed.length,
+        declaredForbidden: forbidden.length,
+        changedFiles: files.length,
+        violations,
+        advisory: !enforced,
+    };
+}
+function significantTokens(value) {
+    return [
+        ...new Set(norm(value)
+            .split(/[^a-z0-9]+/)
+            .filter(token => token.length >= 4)),
+    ];
+}
+/**
+ * A constraint is "covered" when at least one of its significant tokens appears
+ * in some verificationSurface item — i.e. there is a declared check that could
+ * catch a regression of that invariant.
+ */
+function constraintCovered(constraint, surfaces) {
+    const tokens = significantTokens(constraint);
+    if (tokens.length === 0)
+        return false;
+    return surfaces.some(surface => tokens.some(token => surface.includes(token)));
+}
+/**
+ * Check that every declared constraint is guarded by some verificationSurface
+ * item. Returns `undefined` when no constraints are declared.
+ */
+export function evaluateConstraints(constraints, verificationSurface, enforced = false) {
+    const declared = (constraints ?? []).map(c => c.trim()).filter(Boolean);
+    if (declared.length === 0)
+        return undefined;
+    const surfaces = (verificationSurface ?? []).map(norm).filter(Boolean);
+    const uncovered = declared.filter(constraint => !constraintCovered(constraint, surfaces));
+    return {
+        declared: declared.length,
+        covered: declared.length - uncovered.length,
+        uncovered,
+        advisory: !enforced,
+    };
+}
+/**
+ * Count the findings that block Task completion under an enforced profile:
+ * every boundary violation plus every unguarded constraint. Returns 0 when both
+ * reports are clean or undefined. The caller decides whether to act on the
+ * count based on the active profile (advisory reports are not blocked even when
+ * this count is non-zero).
+ */
+export function countBoundaryBlockers(boundary, constraint) {
+    return (boundary?.violations.length ?? 0) + (constraint?.uncovered.length ?? 0);
+}
+/** Render boundary warning lines (empty when there is nothing to warn about). */
+export function formatBoundaryWarnings(report) {
+    if (!report || report.violations.length === 0)
+        return [];
+    const tag = report.advisory ? '[WARN]' : '[BLOCKER]';
+    const mode = report.advisory ? 'advisory, not blocking' : 'blocking under enforced profile';
+    const lines = [
+        `${tag} boundary enforcement: ${report.violations.length} violation(s) (${mode})`,
+    ];
+    for (const v of report.violations) {
+        lines.push(v.kind === 'forbidden-touched'
+            ? `   [FORBIDDEN] ${v.file} (matched ${v.matchedGlob})`
+            : `   [OUTSIDE-ALLOWED] ${v.file}`);
+    }
+    lines.push('   Keep edits inside the Spec boundaries (or widen them in the Spec).');
+    return lines;
+}
+/** Render constraint-coverage warning lines (empty when fully covered). */
+export function formatConstraintWarnings(report) {
+    if (!report || report.uncovered.length === 0)
+        return [];
+    const tag = report.advisory ? '[WARN]' : '[BLOCKER]';
+    const mode = report.advisory ? 'advisory, not blocking' : 'blocking under enforced profile';
+    const lines = [
+        `${tag} constraint coverage: ${report.covered}/${report.declared} guarded by verificationSurface (${mode})`,
+    ];
+    for (const constraint of report.uncovered) {
+        lines.push(`   [UNGUARDED] ${constraint}`);
+    }
+    lines.push('   Add a verificationSurface item that would catch a regression of each constraint.');
+    return lines;
+}
+//# sourceMappingURL=BoundaryEnforcement.js.map

package/dist/workflow/BoundaryEnforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BoundaryEnforcement.js","sourceRoot":"","sources":["../../src/workflow/BoundaryEnforcement.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,iEAAiE;AACjE,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,gFAAgF;AAChF,8CAA8C;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AA6B3D;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAA+B;IACvE,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAA;AACvC,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,IAAI;SACd,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,mCAAmC;SACxE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,uBAAuB;SAClD,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;SACxB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACzB,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACxD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1B,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxB,4DAA4D;IAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAA;QACzC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;IACpC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAA0D,EAC1D,UAAsC,EACtC,QAAQ,GAAG,KAAK;IAEhB,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACjC,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAEpE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACxF,MAAM,UAAU,GAAwB,EAAE,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACxE,IAAI,YAAY,EAAE,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAA;YAC/E,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7E,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAED,OAAO;QACL,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,iBAAiB,EAAE,SAAS,CAAC,MAAM;QACnC,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,UAAU;QACV,QAAQ,EAAE,CAAC,QAAQ;KACpB,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO;QACL,GAAG,IAAI,GAAG,CACR,IAAI,CAAC,KAAK,CAAC;aACR,KAAK,CAAC,YAAY,CAAC;aACnB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CACtC;KACF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,UAAkB,EAAE,QAAkB;IAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAiC,EACjC,mBAAyC,EACzC,QAAQ,GAAG,KAAK;IAEhB,MAAM,QAAQ,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,QAAQ,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAA;IACzF,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM;QAC3C,SAAS;QACT,QAAQ,EAAE,CAAC,QAAQ;KACpB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAA+C,EAC/C,UAAgD;IAEhD,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,CAAA;AACjF,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,MAA6C;IAClF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACxD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAA;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,iCAAiC,CAAA;IAC3F,MAAM,KAAK,GAAG;QACZ,GAAG,GAAG,0BAA0B,MAAM,CAAC,UAAU,CAAC,MAAM,kBAAkB,IAAI,GAAG;KAClF,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,IAAI,KAAK,mBAAmB;YAC5B,CAAC,CAAC,kBAAkB,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,WAAW,GAAG;YACvD,CAAC,CAAC,wBAAwB,CAAC,CAAC,IAAI,EAAE,CACrC,CAAA;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAA;IACnF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB,CAAC,MAA4C;IACnF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAA;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,iCAAiC,CAAA;IAC3F,MAAM,KAAK,GAAG;QACZ,GAAG,GAAG,yBAAyB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,oCAAoC,IAAI,GAAG;KAC5G,CAAA;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAA;IAC5C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAA;IACjG,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/workflow/EcosystemReadinessGate.d.ts

@@ -0,0 +1,46 @@
+import { verifySetup, type SetupVerificationReport } from '../setup/SetupVerification.js';
+import { inspectWorkflowSkills, type SkillDoctorReport } from '../skills/SkillDoctor.js';
+import type { VerificationPolicy } from './VerificationProfile.js';
+export type EcosystemReadinessGateMode = 'off' | 'warn' | 'block';
+export type EcosystemReadinessSkillScope = 'required' | 'recommended' | 'all';
+export interface EcosystemReadinessGateReport {
+    mode: EcosystemReadinessGateMode;
+    checked: boolean;
+    ok: boolean;
+    blocked: boolean;
+    packIds: string[];
+    summary: {
+        blockingIssues: string[];
+        warningCount: number;
+        installedTools: number;
+        totalTools: number;
+        missingTools: string[];
+        installedWorkflowSkills: number;
+        totalWorkflowSkills: number;
+        missingWorkflowSkills: string[];
+        missingRequiredWorkflowSkills: string[];
+        missingRecommendedWorkflowSkills: string[];
+        missingOptionalWorkflowSkills: string[];
+        blockingMissingWorkflowSkills: string[];
+        skillScope: EcosystemReadinessSkillScope;
+    };
+    setup?: SetupVerificationReport;
+    skillDoctor?: SkillDoctorReport;
+    warnings: string[];
+    recommendations: string[];
+}
+export interface EcosystemReadinessGateOptions {
+    projectDir: string;
+    scaleDir: string;
+    policy: VerificationPolicy;
+    checked?: boolean;
+    skipReason?: string;
+    deps?: {
+        verifySetup?: typeof verifySetup;
+        inspectWorkflowSkills?: typeof inspectWorkflowSkills;
+    };
+}
+export declare function evaluateEcosystemReadinessGate(options: EcosystemReadinessGateOptions): Promise<EcosystemReadinessGateReport>;
+export declare function normalizeEcosystemReadinessGateMode(value: unknown): EcosystemReadinessGateMode;
+export declare function normalizeEcosystemReadinessPacks(value: unknown): string[];
+export declare function normalizeEcosystemReadinessSkillScope(value: unknown): EcosystemReadinessSkillScope;

package/dist/workflow/EcosystemReadinessGate.js

@@ -0,0 +1,126 @@
+import { verifySetup } from '../setup/SetupVerification.js';
+import { inspectWorkflowSkills } from '../skills/SkillDoctor.js';
+const DEFAULT_ECOSYSTEM_PACKS = ['full'];
+const VALID_ECOSYSTEM_PACKS = new Set(['ui', 'memory', 'knowledge', 'external-cli', 'full']);
+export async function evaluateEcosystemReadinessGate(options) {
+    const mode = normalizeEcosystemReadinessGateMode(options.policy.ecosystemReadinessGate);
+    const packIds = normalizeEcosystemReadinessPacks(options.policy.ecosystemReadinessPacks);
+    const skillScope = normalizeEcosystemReadinessSkillScope(options.policy.ecosystemReadinessSkillScope);
+    if (mode === 'off' || options.checked === false) {
+        const reason = options.skipReason ?? (mode === 'off' ? 'ecosystem readiness gate is disabled by policy' : 'ecosystem readiness gate skipped for this preflight profile');
+        return {
+            mode,
+            checked: false,
+            ok: true,
+            blocked: false,
+            packIds,
+            summary: {
+                blockingIssues: [],
+                warningCount: 0,
+                installedTools: 0,
+                totalTools: 0,
+                missingTools: [],
+                installedWorkflowSkills: 0,
+                totalWorkflowSkills: 0,
+                missingWorkflowSkills: [],
+                missingRequiredWorkflowSkills: [],
+                missingRecommendedWorkflowSkills: [],
+                missingOptionalWorkflowSkills: [],
+                blockingMissingWorkflowSkills: [],
+                skillScope,
+            },
+            warnings: [reason],
+            recommendations: [],
+        };
+    }
+    const setup = await (options.deps?.verifySetup ?? verifySetup)({
+        projectDir: options.projectDir,
+        scaleDir: options.scaleDir,
+        packIds,
+    });
+    const skillDoctor = (options.deps?.inspectWorkflowSkills ?? inspectWorkflowSkills)({
+        projectDir: options.projectDir,
+        scaleDir: options.scaleDir,
+    });
+    const missingTools = setup.toolCapabilities.tools
+        .filter(tool => !tool.installed)
+        .map(tool => tool.id);
+    const missingWorkflowSkills = skillDoctor.skills
+        .filter(skill => skill.status === 'missing')
+        .map(skill => skill.id);
+    const missingRequiredWorkflowSkills = skillDoctor.missingByReadiness.required;
+    const missingRecommendedWorkflowSkills = skillDoctor.missingByReadiness.recommended;
+    const missingOptionalWorkflowSkills = skillDoctor.missingByReadiness.optional;
+    const blockingMissingWorkflowSkills = missingWorkflowSkillsForScope(skillDoctor, skillScope);
+    const workflowSkillsReadyForScope = blockingMissingWorkflowSkills.length === 0;
+    const blockingMissingWorkflowSkillSet = new Set(blockingMissingWorkflowSkills);
+    const nonBlockingMissingWorkflowSkills = missingWorkflowSkills
+        .filter(skill => !blockingMissingWorkflowSkillSet.has(skill));
+    const blockingIssues = [
+        ...setup.summary.blockingIssues,
+        ...(workflowSkillsReadyForScope ? [] : [`Missing ${skillScope} workflow skills: ${blockingMissingWorkflowSkills.join(', ')}`]),
+    ];
+    const ok = setup.ok && workflowSkillsReadyForScope;
+    const warnings = [
+        ...setup.warnings,
+        ...(setup.ok ? [] : [`Setup readiness is not OK for pack(s): ${packIds.join(', ')}`]),
+        ...(workflowSkillsReadyForScope ? [] : [`Workflow skill readiness is not OK for ${skillScope} scope: ${blockingMissingWorkflowSkills.join(', ')}`]),
+        ...(nonBlockingMissingWorkflowSkills.length === 0 ? [] : [`Non-blocking workflow skills missing: ${nonBlockingMissingWorkflowSkills.join(', ')}`]),
+    ];
+    return {
+        mode,
+        checked: true,
+        ok,
+        blocked: mode === 'block' && (!setup.ok || !workflowSkillsReadyForScope),
+        packIds,
+        summary: {
+            blockingIssues,
+            warningCount: warnings.length,
+            installedTools: setup.summary.installedTools,
+            totalTools: setup.summary.totalTools,
+            missingTools,
+            installedWorkflowSkills: skillDoctor.installed,
+            totalWorkflowSkills: skillDoctor.total,
+            missingWorkflowSkills,
+            missingRequiredWorkflowSkills,
+            missingRecommendedWorkflowSkills,
+            missingOptionalWorkflowSkills,
+            blockingMissingWorkflowSkills,
+            skillScope,
+        },
+        setup,
+        skillDoctor,
+        warnings,
+        recommendations: setup.recommendations,
+    };
+}
+export function normalizeEcosystemReadinessGateMode(value) {
+    if (value === 'off' || value === 'warn' || value === 'block')
+        return value;
+    return 'warn';
+}
+export function normalizeEcosystemReadinessPacks(value) {
+    if (!Array.isArray(value))
+        return [...DEFAULT_ECOSYSTEM_PACKS];
+    const packs = value
+        .map(item => String(item).trim())
+        .filter(item => VALID_ECOSYSTEM_PACKS.has(item));
+    return packs.length > 0 ? [...new Set(packs)] : [...DEFAULT_ECOSYSTEM_PACKS];
+}
+export function normalizeEcosystemReadinessSkillScope(value) {
+    if (value === 'required' || value === 'recommended' || value === 'all')
+        return value;
+    return 'required';
+}
+function missingWorkflowSkillsForScope(skillDoctor, scope) {
+    if (scope === 'all')
+        return skillDoctor.skills.filter(skill => skill.status === 'missing').map(skill => skill.id);
+    if (scope === 'recommended') {
+        return [
+            ...skillDoctor.missingByReadiness.required,
+            ...skillDoctor.missingByReadiness.recommended,
+        ];
+    }
+    return skillDoctor.missingByReadiness.required;
+}
+//# sourceMappingURL=EcosystemReadinessGate.js.map

package/dist/workflow/EcosystemReadinessGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EcosystemReadinessGate.js","sourceRoot":"","sources":["../../src/workflow/EcosystemReadinessGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAgC,MAAM,+BAA+B,CAAA;AACzF,OAAO,EAAE,qBAAqB,EAA0B,MAAM,0BAA0B,CAAA;AA6CxF,MAAM,uBAAuB,GAAG,CAAC,MAAM,CAAC,CAAA;AACxC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;AAE5F,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAsC;IAEtC,MAAM,IAAI,GAAG,mCAAmC,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAA;IACvF,MAAM,OAAO,GAAG,gCAAgC,CAAC,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAA;IACxF,MAAM,UAAU,GAAG,qCAAqC,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAA;IACrG,IAAI,IAAI,KAAK,KAAK,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,6DAA6D,CAAC,CAAA;QACxK,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,KAAK;YACd,OAAO;YACP,OAAO,EAAE;gBACP,cAAc,EAAE,EAAE;gBAClB,YAAY,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC;gBACjB,UAAU,EAAE,CAAC;gBACb,YAAY,EAAE,EAAE;gBAChB,uBAAuB,EAAE,CAAC;gBAC1B,mBAAmB,EAAE,CAAC;gBACtB,qBAAqB,EAAE,EAAE;gBACzB,6BAA6B,EAAE,EAAE;gBACjC,gCAAgC,EAAE,EAAE;gBACpC,6BAA6B,EAAE,EAAE;gBACjC,6BAA6B,EAAE,EAAE;gBACjC,UAAU;aACX;YACD,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,eAAe,EAAE,EAAE;SACpB,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,IAAI,WAAW,CAAC,CAAC;QAC7D,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO;KACR,CAAC,CAAA;IACF,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,qBAAqB,IAAI,qBAAqB,CAAC,CAAC;QACjF,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,gBAAgB,CAAC,KAAK;SAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;SAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACvB,MAAM,qBAAqB,GAAG,WAAW,CAAC,MAAM;SAC7C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;SAC3C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACzB,MAAM,6BAA6B,GAAG,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAA;IAC7E,MAAM,gCAAgC,GAAG,WAAW,CAAC,kBAAkB,CAAC,WAAW,CAAA;IACnF,MAAM,6BAA6B,GAAG,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAA;IAC7E,MAAM,6BAA6B,GAAG,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IAC5F,MAAM,2BAA2B,GAAG,6BAA6B,CAAC,MAAM,KAAK,CAAC,CAAA;IAC9E,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC,6BAA6B,CAAC,CAAA;IAC9E,MAAM,gCAAgC,GAAG,qBAAqB;SAC3D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,+BAA+B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/D,MAAM,cAAc,GAAG;QACrB,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc;QAC/B,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,UAAU,qBAAqB,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;KAC/H,CAAA;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,2BAA2B,CAAA;IAClD,MAAM,QAAQ,GAAG;QACf,GAAG,KAAK,CAAC,QAAQ;QACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrF,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,0CAA0C,UAAU,WAAW,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnJ,GAAG,CAAC,gCAAgC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,yCAAyC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;KACnJ,CAAA;IAED,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,IAAI;QACb,EAAE;QACF,OAAO,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,2BAA2B,CAAC;QACxE,OAAO;QACP,OAAO,EAAE;YACP,cAAc;YACd,YAAY,EAAE,QAAQ,CAAC,MAAM;YAC7B,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;YAC5C,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;YACpC,YAAY;YACZ,uBAAuB,EAAE,WAAW,CAAC,SAAS;YAC9C,mBAAmB,EAAE,WAAW,CAAC,KAAK;YACtC,qBAAqB;YACrB,6BAA6B;YAC7B,gCAAgC;YAChC,6BAA6B;YAC7B,6BAA6B;YAC7B,UAAU;SACX;QACD,KAAK;QACL,WAAW;QACX,QAAQ;QACR,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAAc;IAChE,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1E,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,uBAAuB,CAAC,CAAA;IAC9D,MAAM,KAAK,GAAG,KAAK;SAChB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAClD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,UAAU,qCAAqC,CAAC,KAAc;IAClE,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IACpF,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,6BAA6B,CACpC,WAA8B,EAC9B,KAAmC;IAEnC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACjH,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC5B,OAAO;YACL,GAAG,WAAW,CAAC,kBAAkB,CAAC,QAAQ;YAC1C,GAAG,WAAW,CAAC,kBAAkB,CAAC,WAAW;SAC9C,CAAA;IACH,CAAC;IACD,OAAO,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAA;AAChD,CAAC"}

package/dist/workflow/EngineeringStandards.js

@@ -1,5 +1,6 @@
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { createAstConfirmer } from '../guardrails/ast/confirmers.js';
 const DEFAULT_SOURCE_DIRECTORIES = ['src', 'app', 'packages', 'services', 'cmd', 'internal', 'pkg'];
 const DEFAULT_IGNORED_DIRECTORIES = [
     '.git',
@@ -379,6 +380,11 @@ function scanFile(projectDir, absolutePath, policy, frameworks) {
     const content = readFileSync(absolutePath, 'utf-8');
     const lines = content.split(/\r?\n/);
     const findings = [];
+    // AST confirmation layer (P1.1): parse once per file so the regex pre-filter
+    // hits below can be confirmed against the real AST. null = parse failed, in
+    // which case every confirmer falls back to the raw regex result.
+    const ext = extname(absolutePath);
+    const astConfirmer = createAstConfirmer(content, { jsx: ext === '.tsx' || ext === '.jsx' });
     if (lines.length > policy.maxFileLines) {
         findings.push({
             severity: 'warn',
@@ -394,15 +400,15 @@ function scanFile(projectDir, absolutePath, policy, frameworks) {
         const line = lines[index];
         const startedInsideTemplateLiteral = insideTemplateLiteral;
         insideTemplateLiteral = updateTemplateLiteralState(line, insideTemplateLiteral);
-        if (startedInsideTemplateLiteral || isNonExecutablePatternLine(line))
+        if (startedInsideTemplateLiteral || isNonExecutablePatternLine(line) || isSecurityRuleDefinitionLine(path, line))
             continue;
         const lineNumber = index + 1;
-        findings.push(...scanLine(path, line, lineNumber, policy, frameworks));
+        findings.push(...scanLine(path, line, lineNumber, policy, frameworks, astConfirmer));
     }
-    findings.push(...findEmptyCatchBlocks(path, lines));
+    findings.push(...findEmptyCatchBlocks(path, lines, astConfirmer));
     return dedupeFindings(findings);
 }
-function scanLine(path, line, lineNumber, policy, frameworks) {
+function scanLine(path, line, lineNumber, policy, frameworks, ast) {
     const findings = [];
     const sensitiveMatcher = sensitiveFieldPattern(policy);
     const evidence = line.trim().slice(0, 160);
@@ -467,7 +473,7 @@ function scanLine(path, line, lineNumber, policy, frameworks) {
             fix: 'Use text rendering or sanitize trusted HTML with an approved sanitizer.',
         });
     }
-    if (/\beval\s*\(|new\s+Function\s*\(/.test(line)) {
+    if (/\beval\s*\(|new\s+Function\s*\(/.test(line) && (!ast || ast.hasUnsafeCodeExecution(lineNumber))) {
         findings.push({
             severity: 'fail',
             category: 'security',
@@ -479,7 +485,7 @@ function scanLine(path, line, lineNumber, policy, frameworks) {
             fix: 'Replace eval or Function with a typed parser, dispatch table, or safe interpreter.',
         });
     }
-    if (/^\s*(?:\/\/|\/\*)\s*@ts-ignore\b/.test(line)) {
+    if (/^\s*(?:\/\/|\/\*)\s*@ts-ignore\b/.test(line) && (!ast || ast.hasTsIgnore(lineNumber))) {
         findings.push({
             severity: 'fail',
             category: 'code-quality',
@@ -491,7 +497,7 @@ function scanLine(path, line, lineNumber, policy, frameworks) {
             fix: 'Fix the type boundary or use a narrow typed adapter with a documented reason.',
         });
     }
-    if (/\bas\s+any\b|:\s*any\b|<any\b|Array<any>|Promise<any>|Record<[^>]+,\s*any>/.test(line)) {
+    if (/\bas\s+any\b|:\s*any\b|<any\b|Array<any>|Promise<any>|Record<[^>]+,\s*any>/.test(line) && (!ast || ast.hasAnyType(lineNumber))) {
         findings.push({
             severity: 'warn',
             category: 'code-quality',
@@ -529,12 +535,16 @@ function scanLine(path, line, lineNumber, policy, frameworks) {
     }
     return findings;
 }
-function findEmptyCatchBlocks(path, lines) {
+function findEmptyCatchBlocks(path, lines, ast) {
     const findings = [];
+    // AST confirmation: only emit when the catch block genuinely has zero
+    // statements. Falls back to the regex result when the file did not parse.
+    const confirm = (line) => !ast || ast.hasEmptyCatch(line);
     for (let index = 0; index < lines.length; index += 1) {
         const line = lines[index];
         if (/catch\s*(?:\([^)]*\))?\s*\{\s*(?:\/\*.*?\*\/|\/\/.*)?\s*\}/.test(line)) {
-            findings.push(emptyCatchFinding(path, index + 1, line));
+            if (confirm(index + 1))
+                findings.push(emptyCatchFinding(path, index + 1, line));
             continue;
         }
         if (!/catch\s*(?:\([^)]*\))?\s*\{\s*$/.test(line))
@@ -543,7 +553,7 @@ function findEmptyCatchBlocks(path, lines) {
             const trimmed = next.trim();
             if (trimmed === '' || trimmed.startsWith('//') || trimmed.startsWith('/*') || trimmed.startsWith('*'))
                 continue;
-            if (/^}\s*[),;]?$/.test(trimmed))
+            if (/^}\s*[),;]?$/.test(trimmed) && confirm(index + 1))
                 findings.push(emptyCatchFinding(path, index + 1, line));
             break;
         }
@@ -944,7 +954,14 @@ function sensitiveFieldPattern(policy) {
     return new RegExp(`\\b(?:${fields})\\b`, 'i');
 }
 function isLogCall(line) {
-    return /\b(?:console\.(?:log|debug|info|warn|error)|logger\.(?:trace|debug|info|warn|error|fatal)|log(?:ger)?\.(?:trace|debug|info|warn|error|fatal)|log[A-Za-z0-9_]*\s*\()\b/.test(line);
+    for (const match of line.matchAll(/\b(?:console\.(?:log|debug|info|warn|error)|logger\.(?:trace|debug|info|warn|error|fatal)|log(?:ger)?\.(?:trace|debug|info|warn|error|fatal)|log[A-Za-z0-9_]*\s*\()/g)) {
+        if (match.index !== undefined &&
+            !isInsideQuotedString(line, match.index) &&
+            !isInsideRegexLiteral(line, match.index)) {
+            return true;
+        }
+    }
+    return false;
 }
 function isAdHocOutputCall(line) {
     for (const match of line.matchAll(/\bconsole\.(?:log|debug|info|warn|error)\s*\(|\bfmt\.Print(?:f|ln)?\s*\(|\bprint(?:ln)?\s*\(|\bSystem\.out\.print(?:ln)?\s*\(|\bConsole\.Write(?:Line)?\s*\(|\bprintln!\s*\(/g)) {
@@ -961,7 +978,16 @@ function isHardcodedSecret(line, policy) {
     const match = new RegExp(`\\b\\w*(?:${fields})\\w*\\b\\s*[:=]\\s*(['"\`])([^'"\`]{12,})\\1`, 'i').exec(line);
     if (!match)
         return false;
-    return !/\b(example|sample|placeholder|changeme|replace-me|dummy|test-value)\b/i.test(match[2]);
+    return !isAllowedSecretLiteralReference(match[2]);
+}
+function isAllowedSecretLiteralReference(value) {
+    if (/\b(example|sample|placeholder|changeme|replace-me|dummy|test-value)\b/i.test(value))
+        return true;
+    if (/\b(?:process\.env|import\.meta\.env|Deno\.env|getenv)\b/.test(value))
+        return true;
+    if (value.includes('${'))
+        return true;
+    return /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/.test(value);
 }
 function isRawSqlConstruction(line) {
     return /\b(?:query|execute|exec|raw|rawQuery)\s*\(/i.test(line) &&
@@ -994,6 +1020,35 @@ function isNonExecutablePatternLine(line) {
         /^pattern:\s*\/.*\/[dgimsuy]*,?$/.test(trimmed) ||
         /\(\s*\/.*\/[dgimsuy]*\.(?:test|exec)\(/.test(trimmed);
 }
+function isSecurityRuleDefinitionLine(path, line) {
+    if (!isSecurityRuleSource(path))
+        return false;
+    const trimmed = line.trim();
+    if (/^id:\s*['"`][^'"`]+['"`],?$/.test(trimmed))
+        return true;
+    if (/^\{?\s*pattern:\s*\/.*\/[dgimsuy]*,?/.test(trimmed))
+        return true;
+    if (/^patterns:\s*\[/.test(trimmed))
+        return true;
+    if (/^\/.*\/[dgimsuy]*,?(?:\s*\/\/.*)?$/.test(trimmed))
+        return true;
+    if (/^(?:const|let|var)\s+\w*pattern\w*\s*=\s*\/.*\/[dgimsuy]*/i.test(trimmed))
+        return true;
+    if (/^(?:name|title|description|recommendation|remediation):\s*['"`].*(?:dangerouslySetInnerHTML|innerHTML|document\.write|eval\(|new Function|curl pipe|shell:\s*true)/i.test(trimmed))
+        return true;
+    return /^(?:if\s*\(|return\s+)?\/?.*(?:dangerouslySetInnerHTML|innerHTML|document\.write|eval\(|new Function|curl pipe|shell:\s*true).*\/[dgimsuy]*\.test\(/i.test(trimmed) ||
+        /^(?:\/\/|\/\*\*?|\*)\s*.*(?:dangerouslySetInnerHTML|innerHTML|document\.write|eval\(|new Function|curl pipe|shell:\s*true)/i.test(trimmed);
+}
+function isSecurityRuleSource(path) {
+    return [
+        'src/guardrails/advancedDetectors.ts',
+        'src/guardrails/ast/confirmers.ts',
+        'src/guardrails/OWASPDetector.ts',
+        'src/workflow/gates/GateSystem.ts',
+        'src/workflow/ReviewAnalyzer.ts',
+        'src/workflow/SecurityAudit.ts',
+    ].some(ruleSource => path.endsWith(ruleSource));
+}
 function updateTemplateLiteralState(line, currentlyInside) {
     let inside = currentlyInside;
     let escaped = false;