@jjchill/probity-rules 0.1.0

package/dist/rules/ubiquitous-language.js

@@ -0,0 +1,140 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+/**
+ * Glossary drift protection for the `ubiquitous-language` skill.
+ *
+ * Glossary format convention (see GLOSSARY.template.md): a Markdown
+ * file where each term is a level-2 heading:
+ *
+ *   ## Parcel
+ *   A shipment registered for delivery to a recipient.
+ *
+ * One term per concept; the definition text is free-form. Terms are
+ * matched case-insensitively.
+ */
+const TERM_HEADING = /^##\s+(.+?)\s*$/gm;
+export function extractGlossaryTerms(content) {
+    return [...content.matchAll(TERM_HEADING)].map((m) => (m[1] ?? '').trim());
+}
+function escapeRegex(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * A term is "used" when it appears as a phrase in prose (case-
+ * insensitive, whitespace-tolerant) or as an identifier in code —
+ * PascalCase, camelCase, or snake_case concatenations of its words
+ * ("Delivery Window" → DeliveryWindow, deliveryWindow,
+ * delivery_window).
+ */
+export function termUsagePattern(term) {
+    const words = term.trim().split(/\s+/).map(escapeRegex);
+    const phrase = words.join('\\s+');
+    if (words.length === 1)
+        return new RegExp(`\\b${phrase}\\b`, 'i');
+    const capitalized = term
+        .trim()
+        .split(/\s+/)
+        .map((w) => w[0].toUpperCase() + w.slice(1).toLowerCase());
+    const pascal = escapeRegex(capitalized.join(''));
+    const camel = escapeRegex(capitalized[0].toLowerCase() + capitalized.slice(1).join(''));
+    const snake = words.map((w) => w.toLowerCase()).join('_');
+    return new RegExp(`\\b(?:${phrase}|${pascal}|${camel}|${snake})\\b`, 'i');
+}
+const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'build',
+    '.gradle',
+    'out',
+    'dist',
+    '.idea',
+]);
+function walk(dir, out = []) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (!SKIP_DIRS.has(entry.name))
+                walk(join(dir, entry.name), out);
+        }
+        else {
+            out.push(join(dir, entry.name));
+        }
+    }
+    return out;
+}
+const DEFAULT_SEARCH_PATTERN = /\.(kt|kts|swift|ts|js|py|java|feature|md)$/;
+/**
+ * Surfaces glossary drift at the moment it is created: when a write
+ * to the glossary removes or renames a term that specs, tests, or
+ * source code still use, the write is blocked with the list of files
+ * using the term — rename the usages in the same change (or record
+ * the old term's fate in the glossary entry) and re-apply. Removing
+ * a term nothing uses passes silently, as do additions and
+ * definition edits.
+ *
+ * The companion invariant — new spec/port vocabulary conforming to
+ * the glossary — is judged by `enforceAcceptanceLanguage` and
+ * `enforcePortsBoundary` when given `glossaryPath`.
+ *
+ * Applies to: write actions to the glossary file (scope via a
+ * `{ files, rules }` block on its path). Deterministic — no AI call.
+ *
+ * @param options.searchRoots — absolute paths to scan for usages
+ *   (repo root is fine; node_modules/build dirs are skipped).
+ * @param options.searchPattern — which files count as usage sites
+ *   (default: common source, spec, and doc extensions).
+ */
+export function surfaceGlossaryTermBreakage(options) {
+    const pattern = options.searchPattern ?? DEFAULT_SEARCH_PATTERN;
+    return async function surfaceGlossaryTermBreakage(action, ctx) {
+        if (action.kind !== 'write')
+            return { kind: 'pass' };
+        const before = await ctx?.readFile?.(action.path);
+        if (!before || before.kind !== 'present')
+            return { kind: 'pass' };
+        const beforeTerms = extractGlossaryTerms(before.content);
+        const afterTerms = new Set(extractGlossaryTerms(action.content).map((t) => t.toLowerCase()));
+        const removed = beforeTerms.filter((t) => !afterTerms.has(t.toLowerCase()));
+        if (removed.length === 0)
+            return { kind: 'pass' };
+        const glossaryPath = resolve(action.path);
+        const files = options.searchRoots
+            .flatMap((root) => walk(root))
+            .filter((file) => pattern.test(file) && resolve(file) !== glossaryPath);
+        const broken = [];
+        for (const term of removed) {
+            const usage = termUsagePattern(term);
+            const users = files.filter((file) => {
+                try {
+                    return usage.test(readFileSync(file, 'utf8'));
+                }
+                catch {
+                    return false;
+                }
+            });
+            if (users.length > 0) {
+                const shown = users.slice(0, 10).map((f) => `    ${f}`);
+                if (users.length > 10)
+                    shown.push(`    …and ${users.length - 10} more`);
+                broken.push(`"${term}" is still used by:\n${shown.join('\n')}`);
+            }
+        }
+        if (broken.length === 0)
+            return { kind: 'pass' };
+        return {
+            kind: 'violation',
+            reason: 'This edit removes or renames glossary term(s) that specs, ' +
+                'tests, or code still use. The glossary is the source of ' +
+                'truth: update the usages in the same change, then re-apply ' +
+                'this edit.\n' +
+                broken.join('\n'),
+        };
+    };
+}
+//# sourceMappingURL=ubiquitous-language.js.map

package/dist/rules/ubiquitous-language.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ubiquitous-language.js","sourceRoot":"","sources":["../../rules/ubiquitous-language.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAIzC;;;;;;;;;;;GAWG;AAEH,MAAM,YAAY,GAAG,mBAAmB,CAAA;AAExC,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,MAAM,CAAC,MAAM,MAAM,KAAK,EAAE,GAAG,CAAC,CAAA;IACjE,MAAM,WAAW,GAAG,IAAI;SACrB,IAAI,EAAE;SACN,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAChD,MAAM,KAAK,GAAG,WAAW,CACvB,WAAW,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAC9D,CAAA;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzD,OAAO,IAAI,MAAM,CAAC,SAAS,MAAM,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,MAAM,EAAE,GAAG,CAAC,CAAA;AAC3E,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,OAAO;IACP,SAAS;IACT,KAAK;IACL,MAAM;IACN,OAAO;CACR,CAAC,CAAA;AAEF,SAAS,IAAI,CAAC,GAAW,EAAE,MAAgB,EAAE;IAC3C,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;QAClE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,sBAAsB,GAAG,4CAA4C,CAAA;AAE3E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAG3C;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAA;IAC/D,OAAO,KAAK,UAAU,2BAA2B,CAC/C,MAAc,EACd,GAAiB;QAEjB,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACjE,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACxD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CACjE,CAAA;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACjD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW;aAC9B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC7B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,CAAA;QACzE,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;YACpC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;gBAClC,IAAI,CAAC;oBACH,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;gBAC/C,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC,CAAC,CAAA;YACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACvD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAA;gBACvE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QAChD,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EACJ,4DAA4D;gBAC5D,0DAA0D;gBAC1D,6DAA6D;gBAC7D,cAAc;gBACd,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;SACpB,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/scripts/scope-report.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=scope-report.d.ts.map

package/dist/scripts/scope-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-report.d.ts","sourceRoot":"","sources":["../../scripts/scope-report.ts"],"names":[],"mappings":""}

package/dist/scripts/scope-report.js

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+/**
+ * Scoping dry-run for a Probity config: shows which files each
+ * `{ files, rules }` block actually claims in YOUR repo, before the
+ * first agent session finds out the hard way.
+ *
+ * Wrong glob scoping is the template set's main failure mode, and it
+ * fails in two directions: over-scoping is loud (enforcePortsBoundary
+ * pointed at adapter files blocks work those files are supposed to
+ * do), but under-scoping is silent — a glob slightly too narrow for
+ * your layout means enforcement simply never fires, and nothing
+ * notices. This report surfaces both at setup time:
+ *
+ *   - DEAD SCOPE: a block whose globs match zero files
+ *   - core-purity rules claiming adapter/DI/UI-looking paths
+ *   - the acceptance-language rule claiming Robot/driver/DSL files
+ *
+ * Globs are resolved exactly as Probity resolves them — anchoring and
+ * picomatch semantics come from rules/scoping.ts, the same replica
+ * the workflow eval uses.
+ *
+ * Usage (from your project root, next to your probity.config.ts):
+ *
+ *   npx probity-scope-report [--config probity.config.ts]
+ *                             [--root .] [--strict]
+ *
+ * --config defaults to probity.config.{ts,mts,js,mjs} found in
+ * --root; --root defaults to the current working directory. --strict
+ * exits 1 when any warning fires (for CI); otherwise warnings are
+ * advisory and the exit code is 0.
+ *
+ * The config is loaded via jiti — the same TypeScript loader Probity
+ * itself uses — rather than a bare dynamic `import()` of a .ts file,
+ * so this works whether the consumer's config is .ts, .mts, .js, or
+ * .mjs, with no separate build step for the config itself.
+ */
+import { existsSync, readdirSync } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+import { createJiti } from 'jiti';
+import { anchorGlob, buildMatcher, isRuleBlock } from '../rules/scoping.js';
+const jiti = createJiti(import.meta.url);
+const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'build',
+    '.gradle',
+    'out',
+    'dist',
+    '.idea',
+]);
+const SAMPLE_LIMIT = 6;
+// Paths a core-purity rule should normally NOT claim (adapters, DI,
+// UI, platform source sets) and a spec-language rule should normally
+// NOT claim (layer-2 drivers). Heuristics: a hit is a warning to
+// review, not proof of misconfiguration.
+const CORE_RULES = /PortsBoundary|forbidNewAmbientEffects|forbidContentPattern/;
+const ADAPTERISH_SEGMENT = /^(adapter|adapters|infra|infrastructure|ui|di)$/;
+const LANGUAGE_RULES = /AcceptanceLanguage/;
+const DRIVERISH_FILE = /(Robot|Driver|Dsl)\.\w+$|[/\\](drivers?|dsl)[/\\]/;
+function parseArgs(argv) {
+    const out = { strict: false };
+    for (let i = 0; i < argv.length; i++) {
+        if (argv[i] === '--config')
+            out.config = argv[++i];
+        else if (argv[i] === '--root')
+            out.root = argv[++i];
+        else if (argv[i] === '--strict')
+            out.strict = true;
+        else {
+            console.error(`Unknown argument: ${argv[i]}`);
+            process.exit(2);
+        }
+    }
+    return out;
+}
+function findConfig(dir) {
+    for (const ext of ['ts', 'mts', 'js', 'mjs']) {
+        const candidate = join(dir, `probity.config.${ext}`);
+        if (existsSync(candidate))
+            return candidate;
+    }
+    console.error(`No probity.config.{ts,mts,js,mjs} in ${dir} — pass --config.`);
+    process.exit(2);
+}
+function walk(dir, out = []) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (!SKIP_DIRS.has(entry.name))
+                walk(join(dir, entry.name), out);
+        }
+        else {
+            out.push(join(dir, entry.name).replace(/\\/g, '/'));
+        }
+    }
+    return out;
+}
+function ruleNames(block) {
+    return block.rules.map((rule) => rule.name || '(unnamed)').join(', ');
+}
+const args = parseArgs(process.argv.slice(2));
+const root = resolve(args.root ?? process.cwd());
+const configPath = resolve(args.config ?? findConfig(root));
+const configDir = dirname(configPath);
+const config = await jiti.import(configPath, { default: true });
+const tree = walk(root);
+console.log(`Scope report for ${configPath}`);
+console.log(`Repo root: ${root} (${tree.length} files scanned)\n`);
+const warnings = [];
+const claimed = new Set();
+let flatRules = 0;
+for (const [index, entry] of config.rules.entries()) {
+    if (!isRuleBlock(entry)) {
+        flatRules++;
+        continue;
+    }
+    const label = `block ${index + 1} [${ruleNames(entry)}]`;
+    if (!entry.files) {
+        console.log(`${label}\n  files: (none) — applies to every write\n`);
+        continue;
+    }
+    // Anchor against the config's directory, exactly as loadConfig does.
+    const globs = entry.files.map((glob) => anchorGlob(glob, configDir));
+    const matched = tree.filter(buildMatcher(globs));
+    matched.forEach((file) => claimed.add(file));
+    console.log(label);
+    // Per-glob counts are informational: a template can legitimately
+    // carry globs for layouts a given repo doesn't use (e.g. classic
+    // src/main alongside KMP source sets) — only a whole-block zero is
+    // a warning.
+    for (const glob of entry.files) {
+        const count = glob.startsWith('!')
+            ? null
+            : tree.filter(buildMatcher([anchorGlob(glob, configDir)])).length;
+        console.log(`  ${glob}${count === null ? '' : `  (${count})`}`);
+    }
+    console.log(`  → ${matched.length} file(s)`);
+    for (const file of matched.slice(0, SAMPLE_LIMIT))
+        console.log(`      ${relative(root, file)}`);
+    if (matched.length > SAMPLE_LIMIT)
+        console.log(`      …and ${matched.length - SAMPLE_LIMIT} more`);
+    console.log('');
+    if (matched.length === 0) {
+        warnings.push(`DEAD SCOPE: ${label} matches no files — these rules will never fire. ` +
+            'Adjust the globs to your layout (this is the silent failure mode).');
+    }
+    if (CORE_RULES.test(ruleNames(entry))) {
+        const suspicious = matched.filter((file) => relative(root, file).split(/[/\\]/).some((segment) => ADAPTERISH_SEGMENT.test(segment)));
+        if (suspicious.length > 0) {
+            warnings.push(`${label} claims ${suspicious.length} adapter/DI/UI-looking file(s), e.g. ` +
+                `${relative(root, suspicious[0])} — core-purity rules pointed at adapters ` +
+                'block work those files are supposed to do. Exclude them (negation globs) ' +
+                'or confirm these paths really are core.');
+        }
+    }
+    if (LANGUAGE_RULES.test(ruleNames(entry))) {
+        const suspicious = matched.filter((file) => DRIVERISH_FILE.test(file));
+        if (suspicious.length > 0) {
+            warnings.push(`${label} claims ${suspicious.length} driver/DSL-looking file(s), e.g. ` +
+                `${relative(root, suspicious[0])} — layer-2 drivers are supposed to contain ` +
+                'the mechanics the Language Test blocks. Exclude them (e.g. !**/*Robot.kt).');
+        }
+    }
+}
+if (flatRules > 0) {
+    console.log(`${flatRules} flat rule(s) apply to every action (no files scope).\n`);
+}
+console.log(`${claimed.size}/${tree.length} files are claimed by at least one files-scoped block.\n`);
+if (warnings.length === 0) {
+    console.log('No scoping warnings.');
+}
+else {
+    console.log(`${warnings.length} warning(s):\n`);
+    for (const warning of warnings)
+        console.log(`  ⚠ ${warning}\n`);
+}
+process.exit(args.strict && warnings.length > 0 ? 1 : 0);
+//# sourceMappingURL=scope-report.js.map

package/dist/scripts/scope-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-report.js","sourceRoot":"","sources":["../../scripts/scope-report.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAIjC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAE3E,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,OAAO;IACP,SAAS;IACT,KAAK;IACL,MAAM;IACN,OAAO;CACR,CAAC,CAAA;AACF,MAAM,YAAY,GAAG,CAAC,CAAA;AAEtB,oEAAoE;AACpE,qEAAqE;AACrE,iEAAiE;AACjE,yCAAyC;AACzC,MAAM,UAAU,GAAG,4DAA4D,CAAA;AAC/E,MAAM,kBAAkB,GAAG,iDAAiD,CAAA;AAC5E,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAC3C,MAAM,cAAc,GAAG,mDAAmD,CAAA;AAE1E,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAwD,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAClF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;aAC7C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;aAC9C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAA;aAC7C,CAAC;YACJ,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,GAAG,EAAE,CAAC,CAAA;QACpD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;IAC7C,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,wCAAwC,GAAG,mBAAmB,CAAC,CAAA;IAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,MAAgB,EAAE;IAC3C,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;QAClE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,KAAgB;IACjC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;AAChD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;AAErC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAS,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AACvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;AAEvB,OAAO,CAAC,GAAG,CAAC,oBAAoB,UAAU,EAAE,CAAC,CAAA;AAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,KAAK,IAAI,CAAC,MAAM,mBAAmB,CAAC,CAAA;AAElE,MAAM,QAAQ,GAAa,EAAE,CAAA;AAC7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;AACjC,IAAI,SAAS,GAAG,CAAC,CAAA;AAEjB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IACpD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,SAAS,EAAE,CAAA;QACX,SAAQ;IACV,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,KAAK,GAAG,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,GAAG,CAAA;IACxD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAA;QACnE,SAAQ;IACV,CAAC;IACD,qEAAqE;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;IAChD,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAE5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAClB,iEAAiE;IACjE,iEAAiE;IACjE,mEAAmE;IACnE,aAAa;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAChC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QACnE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,UAAU,CAAC,CAAA;IAC5C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/F,IAAI,OAAO,CAAC,MAAM,GAAG,YAAY;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,MAAM,GAAG,YAAY,OAAO,CAAC,CAAA;IAClG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,eAAe,KAAK,mDAAmD;YACrE,oEAAoE,CACvE,CAAA;IACH,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACzC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACxF,CAAA;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,WAAW,UAAU,CAAC,MAAM,uCAAuC;gBACzE,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,2CAA2C;gBAC5E,2EAA2E;gBAC3E,yCAAyC,CAC5C,CAAA;QACH,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACtE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,WAAW,UAAU,CAAC,MAAM,oCAAoC;gBACtE,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,6CAA6C;gBAC9E,4EAA4E,CAC/E,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;IAClB,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,yDAAyD,CAAC,CAAA;AACpF,CAAC;AACD,OAAO,CAAC,GAAG,CACT,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,0DAA0D,CACzF,CAAA;AAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;AACrC,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAA;IAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,IAAI,CAAC,CAAA;AACjE,CAAC;AACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA"}

package/kiro/README.md

@@ -0,0 +1,20 @@
+# Kiro CLI enforcement assets
+
+Run this framework under **Kiro CLI** with the same Probity guardrail the
+Claude Code integration gets. Probity has no native Kiro vendor, so these
+files translate between Kiro's hook contract and Probity's `claude-code`
+contract.
+
+| File | Role |
+|------|------|
+| `probity-kiro.sh` | preToolUse shim (event translation + deny→exit 2) |
+| `probity-kiro-translate.py` | `event` / `reason` translation helpers |
+| `kiro-transcript-to-claude.py` | Kiro session JSONL → Anthropic JSONL (for history rules) |
+| `skill-activation-forced-eval.sh` | userPromptSubmit skill-activation hook |
+| `kiro-agent.template.json` | agent config template (skills + both hooks) |
+
+**Setup:** see [`docs/kiro-setup.md`](../../../docs/kiro-setup.md).
+
+These are copy-in artifacts (like the `probity.config.*.ts` presets): install
+them into a project's `.kiro/`. This directory is the single source of truth —
+fix Kiro-integration issues here, then re-copy.

package/kiro/kiro-agent.template.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://json.schemastore.org/kiro-agent.json",
+  "name": "REPLACE_WITH_AGENT_NAME",
+  "description": "REPLACE: Workspace agent that surfaces the agent-skills library (via the .kiro/skills symlink) and enforces this project's Probity rules on every write/shell through the Kiro preToolUse shim.",
+  "prompt": "You are the default agent for this workspace. Treat AGENTS.md as the highest-priority context after the user's direct instructions. Honor the mandatory skill-activation sequence injected on every user prompt before implementing. Probity enforces this project's spec-first / test-first workflow mechanically as a preToolUse hook.",
+  "tools": [
+    "*"
+  ],
+  "toolsSettings": {
+    "read": {
+      "allowedPaths": [
+        "./**"
+      ]
+    },
+    "write": {
+      "allowedPaths": [
+        "./**"
+      ]
+    }
+  },
+  "resources": [
+    "file://AGENTS.md",
+    "file://docs/GLOSSARY.md",
+    "skill://.kiro/skills/**/SKILL.md"
+  ],
+  "hooks": {
+    "userPromptSubmit": [
+      {
+        "command": "bash \"$( (git rev-parse --show-toplevel 2>/dev/null || echo \"$PWD\") )/.kiro/hooks/skill-activation-forced-eval.sh\""
+      }
+    ],
+    "preToolUse": [
+      {
+        "matcher": "write",
+        "command": "bash \"$( (git rev-parse --show-toplevel 2>/dev/null || echo \"$PWD\") )/.kiro/hooks/probity-kiro.sh\"",
+        "timeout_ms": 120000
+      },
+      {
+        "matcher": "shell",
+        "command": "bash \"$( (git rev-parse --show-toplevel 2>/dev/null || echo \"$PWD\") )/.kiro/hooks/probity-kiro.sh\"",
+        "timeout_ms": 120000
+      }
+    ]
+  }
+}

package/kiro/kiro-transcript-to-claude.py

@@ -0,0 +1,183 @@
+#!/usr/bin/env python3
+"""
+Kiro session transcript -> Anthropic (Claude Code) transcript transducer.
+
+Probity's claude-code vendor reconstructs conversation history from a
+JSONL transcript in Anthropic's persisted message shape (see
+node_modules/@nizos/probity/dist/vendors/claude-code/transcript.js):
+
+    {"type":"assistant","message":{"content":[
+        {"type":"tool_use","id":<id>,"name":<ClaudeToolName>,"input":{...}}]}}
+    {"type":"user","message":{"content":[
+        {"type":"tool_result","tool_use_id":<id>,"content":<string|blocks>}]}}
+    {"type":"user","message":{"content":[{"type":"text","text":<prompt>}]}}
+
+Kiro persists a different, versioned event stream at
+~/.kiro/sessions/cli/<KIRO_SESSION_ID>.jsonl:
+
+    {"kind":"Prompt","data":{"content":[{"kind":"text","data":<str>}]}}
+    {"kind":"AssistantMessage","data":{"content":[
+        {"kind":"toolUse","data":{"toolUseId","name","input"}},
+        {"kind":"text","data":<str>}, {"kind":"thinking",...}]}}
+    {"kind":"ToolResults","data":{"content":[
+        {"kind":"toolResult","data":{"toolUseId","content":[{"kind":"text","data"}],"status"}}]}}
+
+This script maps the former onto the latter so Probity's history-based
+rules (the commit green-gate `requireGreenTestRun`, the TDD RED-before-GREEN
+judge, characterization/probe resolution) can see prior tool calls and their
+output when running under Kiro.
+
+Tool-name mapping matters: Probity's history `toCanonical` only treats a
+Claude `Bash` action as a shell command and `Write`/`Edit` as a file write.
+So Kiro's `shell` must become `Bash` (or the green-gate never sees the
+`xcodebuild ... test` output), and Kiro's `write` becomes `Write`/`Edit`.
+
+Reads Kiro JSONL from argv[1] (or stdin) and writes Claude JSONL to stdout.
+Malformed lines are skipped, mirroring Probity's own tolerant reader.
+"""
+import json
+import sys
+
+
+def _text_blocks(content):
+    """Join the payloads of a Kiro content array into one string.
+
+    Text blocks (`kind == "text"`) carry prompts and assistant prose. Tool
+    RESULTS, however, are persisted as `kind == "json"` blocks — the shell
+    tool's {exit_status, stdout, stderr} object, write confirmations, etc.
+    The history-based rules match on command OUTPUT (the green-gate looks for
+    a passing test run; the characterization gate looks for the marked test
+    failing), so those json payloads must be serialized in rather than
+    dropped — otherwise every command's output is invisible under Kiro and
+    the gates can never see a test run at all.
+    """
+    out = []
+    for item in content or []:
+        if not isinstance(item, dict):
+            continue
+        kind = item.get("kind")
+        data = item.get("data")
+        if kind == "text":
+            if isinstance(data, str):
+                out.append(data)
+        elif kind == "json":
+            if isinstance(data, str):
+                out.append(data)
+            else:
+                try:
+                    out.append(json.dumps(data))
+                except (TypeError, ValueError):
+                    pass
+    return "\n".join(out)
+
+
+def _map_tool(name, tool_input):
+    """Map a Kiro tool name+input to a Claude (tool_name, input) pair.
+
+    Only the shapes Probity's history reader interprets need to be exact:
+      - shell   -> Bash  {command}
+      - write   -> Write {file_path, content} / Edit {file_path, new_string}
+    Everything else is passed through under its own name and read by
+    Probity as an inert `other` action (no rule matches it).
+    """
+    tool_input = tool_input if isinstance(tool_input, dict) else {}
+    if name in ("shell", "execute_bash", "execute_cmd"):
+        return "Bash", {"command": tool_input.get("command", "")}
+    if name in ("write", "fs_write", "fsWrite"):
+        op = tool_input.get("command")
+        path = tool_input.get("path", "")
+        if op == "strReplace":
+            return "Edit", {
+                "file_path": path,
+                "old_string": tool_input.get("oldStr", ""),
+                "new_string": tool_input.get("newStr", ""),
+                "replace_all": bool(tool_input.get("replaceAll", False)),
+            }
+        # create / insert / append: the introduced text is `content`.
+        return "Write", {
+            "file_path": path,
+            "content": tool_input.get("content", ""),
+        }
+    return name or "Unknown", tool_input
+
+
+def transduce_line(raw, emit):
+    line = raw.strip()
+    if not line:
+        return
+    try:
+        entry = json.loads(line)
+    except (ValueError, TypeError):
+        return
+    if not isinstance(entry, dict):
+        return
+    kind = entry.get("kind")
+    data = entry.get("data") or {}
+    content = data.get("content") if isinstance(data, dict) else None
+
+    if kind == "Prompt":
+        text = _text_blocks(content)
+        if text:
+            emit({"type": "user",
+                  "message": {"content": [{"type": "text", "text": text}]}})
+        return
+
+    if kind == "AssistantMessage":
+        blocks = []
+        for item in content or []:
+            if not isinstance(item, dict):
+                continue
+            ikind = item.get("kind")
+            idata = item.get("data") or {}
+            if ikind == "toolUse" and isinstance(idata, dict):
+                cname, cinput = _map_tool(idata.get("name"), idata.get("input"))
+                blocks.append({
+                    "type": "tool_use",
+                    "id": idata.get("toolUseId", ""),
+                    "name": cname,
+                    "input": cinput,
+                })
+            elif ikind == "text" and isinstance(idata, str):
+                blocks.append({"type": "text", "text": idata})
+        if blocks:
+            emit({"type": "assistant", "message": {"content": blocks}})
+        return
+
+    if kind == "ToolResults":
+        for item in content or []:
+            if not isinstance(item, dict) or item.get("kind") != "toolResult":
+                continue
+            idata = item.get("data") or {}
+            if not isinstance(idata, dict):
+                continue
+            emit({
+                "type": "user",
+                "message": {"content": [{
+                    "type": "tool_result",
+                    "tool_use_id": idata.get("toolUseId", ""),
+                    "content": _text_blocks(idata.get("content")),
+                }]},
+            })
+        return
+    # Unknown top-level kinds are ignored.
+
+
+def main(argv):
+    src = open(argv[1], "r", encoding="utf-8") if len(argv) > 1 else sys.stdin
+    out = sys.stdout
+
+    def emit(obj):
+        out.write(json.dumps(obj))
+        out.write("\n")
+
+    try:
+        for raw in src:
+            transduce_line(raw, emit)
+    finally:
+        if src is not sys.stdin:
+            src.close()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))