@orkastery/cli 0.5.3 → 0.6.0

package/assets/references-en/testing-patterns.md

@@ -0,0 +1,51 @@
+# Testing Patterns
+
+What a suite must prove and how a green suite is earned honestly. Items are numbered
+only once across the whole file. Cite an item as `TEST 3`.
+
+**Sources:** `core/src/verify.ts` (baseline and re-run), `core/src/claims.ts`,
+[definition-of-done.md](definition-of-done.md), [code-review-axes.md](code-review-axes.md).
+
+```mermaid
+flowchart LR
+    B["baseline gravada<br/>antes do GO"] --> G["GO: implementacao<br/>slice por slice"]
+    G --> R["reexecucao no HEAD real"]
+    R --> D{"comparacao contra a baseline"}
+    D -->|"passava e falha"| RG["regressao:<br/>TEST 1, gate verify.regression"]
+    D -->|"ja falhava"| DV["divida pre-existente:<br/>declarada, nao imputada a thread"]
+    D -->|"tudo verde"| OK["suite verde ganha"]
+```
+
+## What the suite proves
+
+| # | Check | How it is proven |
+|---|---|---|
+| 1 | There is a baseline recorded before GO. Without it, a failure cannot tell a regression from pre-existing debt, and the thread takes the blame for a defect that was already there or, worse, hides what it broke itself. | `ork verify <thread> --baseline` before GO. |
+| 2 | Every GOAL success criterion has a command that proves it. A criterion that does not become a command is not a criterion, it is an adjective. | The thread's claims, with `--verificar`. |
+| 3 | In a fix request, there is a test that reproduces the defect and that failed before the fix. A fix whose defect was never reproduced cannot prove it fixed anything. | The new test, run against the commit before the fix. |
+| 4 | The failure path has a test, not only the happy path. A suite that only exercises success measures optimism. | Reading the suite against the PLAN edge cases. |
+| 5 | A new test fails when the implementation is reverted. A test that passes with and without the change does not test the change. | Revert locally and run, or mutate the central line and confirm the failure. |
+
+## How the green suite is earned
+
+| # | Check | How it is proven |
+|---|---|---|
+| 6 | The suite runs on the real HEAD, in the thread's working directory. A pass reported by an agent is not a pass. | `ork verify <thread>` re-runs the manifest commands and the claims, and stamps the real commit. |
+| 7 | No test was disabled, marked to skip or loosened to close the delivery. Skipping a test is a recorded scope change, never a silent course correction. | Diff over the test files, looking for removed tests, `skip` and relaxed assertions. |
+| 8 | No assertion was swapped for the value the code produces today without someone saying why the right value changed. Adjusting the expected to the observed is the most common way to turn a defect into a contract. | Diff of the assertions against the intent declared in the PLAN. |
+| 9 | A test does not depend on the network, on a paid credential or on the wall clock. A deterministic fixture is the standard; whatever needs the outside world stays out of the gate and is declared. | Run the suite offline. In `ork`, the `ork eval` canaries build a temporary git repository and do not touch the network. |
+| 10 | A test does not depend on another test or on the execution order. State shared between cases is a defect, even when the suite is green today. | Run the suspect case in shuffled order or in isolation. |
+
+## Count and coverage
+
+| # | Check | How it is proven |
+|---|---|---|
+| 11 | The reported test count is the one the command printed, pasted from the real output. A suite number typed from memory is not evidence. | The runner output in the delivery report. |
+| 12 | Coverage is reported with its source: `runtime_reported` when the tool measured it, `estimated` when someone estimated it and said so, `unavailable` when there is no tool. A gap is published as a gap, never as zero. | The metrics section of the report. |
+
+## Recommendations (not a gate on this machine)
+
+- Tool-measured coverage: this repository has no such tool installed, so coverage comes out
+  `unavailable` per `TEST 12`, and is not estimated for convenience.
+- Mutation testing to prove `TEST 5` automatically: out of reach for this machine; the proof
+  here is manual and declared as manual.

package/assets/security-scan/defaults/.golangci.yml

@@ -0,0 +1,2 @@
+# golangci-lint default linters; project rules go in .ork-security/.golangci.yml
+version: "2"

package/assets/security-scan/defaults/eslint.config.mjs

@@ -0,0 +1,11 @@
+// Default quality config: typescript-eslint recommendedTypeChecked with the project's tsconfig (container cwd = repo root)
+import tseslint from 'typescript-eslint';
+
+export default tseslint.config(
+  { ignores: ['**/node_modules/**', '**/dist/**', '**/build/**', '**/coverage/**'] },
+  {
+    files: ['**/*.ts', '**/*.tsx', '**/*.mts', '**/*.cts'],
+    extends: [tseslint.configs.recommendedTypeChecked],
+    languageOptions: { parserOptions: { projectService: true, tsconfigRootDir: process.cwd() } },
+  },
+);

package/assets/security-scan/defaults/gitleaks.toml

@@ -0,0 +1,3 @@
+# Extends the gitleaks default ruleset; project rules go in .ork-security/gitleaks.toml
+[extend]
+useDefault = true

package/assets/security-scan/defaults/ruff.toml

@@ -0,0 +1 @@
+# Ruff default rules; project rules go in .ork-security/ruff.toml

package/assets/security-scan/tools-agil.json

@@ -0,0 +1,87 @@
+[
+  {
+    "name": "osv-scanner",
+    "category": "dependency",
+    "stacks": "all",
+    "image": "ghcr.io/google/osv-scanner@sha256:fca9be4446310094be881b63f6862879282647f121ad3326e91dd90afbf8ef50",
+    "version": "2.2.3",
+    "native": {
+      "bin": "osv-scanner",
+      "versionArgs": [
+        "--version"
+      ],
+      "versionPattern": "\\b2\\.2\\.\\d+\\b"
+    },
+    "network": "default",
+    "baseMode": "worktree",
+    "timeoutMs": 300000,
+    "severityMap": {
+      "CRITICAL": "critical",
+      "HIGH": "high",
+      "MODERATE": "medium",
+      "MEDIUM": "medium",
+      "LOW": "low"
+    },
+    "args": [
+      "sh",
+      "-c",
+      "bin=$(command -v osv-scanner || echo /osv-scanner); \"$bin\" scan source --recursive --format json --output \"$1\" \"$2\"; rc=$?; if [ $rc -eq 128 ]; then printf '{\"results\":[]}\\n' > \"$1\"; exit 0; fi; [ $rc -le 1 ] || exit $rc",
+      "sh",
+      "{out}/osv-scanner.json",
+      "{src}"
+    ],
+    "env": {
+      "HOME": "/tmp"
+    },
+    "expect": {
+      "files": [
+        "osv-scanner.json"
+      ],
+      "shape": "object",
+      "requireKey": [
+        "results"
+      ]
+    }
+  },
+  {
+    "name": "oxlint",
+    "category": "quality",
+    "stacks": [
+      "js"
+    ],
+    "image": "node@sha256:6f08a523443ddedf52941874c203475b0ad503e859ad70cb26ab8be9a517dbd5",
+    "version": "1.89.0",
+    "network": "default",
+    "baseMode": "worktree",
+    "timeoutMs": 300000,
+    "severityMap": {
+      "error": "medium",
+      "warning": "low"
+    },
+    "install": [
+      "oxlint@1.89.0"
+    ],
+    "args": [
+      "sh",
+      "-c",
+      "mkdir -p /tmp/ox && npm install --prefix /tmp/ox --ignore-scripts --no-audit --no-fund --no-save {install} >&2 && cd \"$2\" && /tmp/ox/node_modules/.bin/oxlint --format json . > /tmp/ox/saida.txt; rc=$?; [ $rc -le 1 ] || exit $rc; node -e 'const fs=require(\"fs\");const t=fs.readFileSync(\"/tmp/ox/saida.txt\",\"utf8\");const i=t.indexOf(\"{\");if(i<0)process.exit(3);const j=JSON.parse(t.slice(i));if(!Array.isArray(j.diagnostics))process.exit(3);fs.writeFileSync(process.argv[1],JSON.stringify(j))' \"$1\" || exit 3",
+      "sh",
+      "{out}/oxlint.json",
+      "{stackDir}"
+    ],
+    "env": {
+      "HOME": "/tmp",
+      "npm_config_cache": "/tmp/npm-cache",
+      "npm_config_update_notifier": "false"
+    },
+    "expect": {
+      "files": [
+        "oxlint.json"
+      ],
+      "shape": "object",
+      "requireKey": [
+        "diagnostics"
+      ]
+    }
+  }
+]