@plainconceptsplatform/workflows 1.10.0 → 1.11.0

package/loops/templates/platform-template/.github/workflows/platform-template-sync.yml

@@ -0,0 +1,171 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/platform-template/.github/workflows/platform-template-sync.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "Platform: Template sync"
+
+# Brings the platform code of a family app up to the newest Kitchen-Sink template tag. Plain YAML,
+# no model: copier does the merge, and a person or the merge gate takes it from the pull request.
+#
+# Does nothing without .copier-answers.yml, the marker a repository gets when it adopts the
+# template. With it, `copier update` runs against the newest `v*` tag of the template named in
+# `_src_path`. No change means the app is current and the run ends there. Otherwise the result is
+# committed to `platform/sync-<tag>` and opened as a pull request titled with the tag. A file the
+# app had edited gets copier's inline conflict markers; scripts/check-platform-conformance.mjs
+# fails CI on them, so the merge gate repairs the pull request (`remediated`) like any red one.
+#
+# Kitchen-Sink is private, so the Platform App token (BOT_APP_ID / BOT_PRIVATE_KEY) reads it. The
+# same token pushes the branch and opens the pull request, because a push made with GITHUB_TOKEN
+# starts no workflow and CI would never run on the sync.
+on:
+  schedule:
+    - cron: "17 5 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: platform-template-sync
+  cancel-in-progress: false
+
+env:
+  # copier 9.19.1 needs Python 3.10 or newer on the runner.
+  COPIER_VERSION: "9.19.1"
+
+jobs:
+  sync:
+    name: Sync the platform template
+    runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Has this repository adopted the template?
+        id: marker
+        run: |
+          if [ -f .copier-answers.yml ]; then
+            echo "adopted=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "adopted=false" >> "$GITHUB_OUTPUT"
+            echo "No .copier-answers.yml: this repository has not adopted the platform template. Nothing to do."
+          fi
+
+      - name: Generate App token
+        id: app-token
+        if: steps.marker.outputs.adopted == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+
+      # uvx where uv is installed, then pipx, then a virtual environment from the runner's Python.
+      - name: Install copier
+        if: steps.marker.outputs.adopted == 'true'
+        run: |
+          set -euo pipefail
+          bin="$RUNNER_TEMP/copier-bin"
+          mkdir -p "$bin"
+          if command -v uvx >/dev/null 2>&1; then
+            run="uvx --from copier==$COPIER_VERSION copier"
+          elif command -v pipx >/dev/null 2>&1; then
+            run="pipx run --spec copier==$COPIER_VERSION copier"
+          else
+            python3 -m venv "$RUNNER_TEMP/copier-venv"
+            "$RUNNER_TEMP/copier-venv/bin/pip" install --quiet "copier==$COPIER_VERSION"
+            run="$RUNNER_TEMP/copier-venv/bin/copier"
+          fi
+          cat > "$bin/copier" <<EOF
+          #!/usr/bin/env bash
+          exec $run "\$@"
+          EOF
+          chmod +x "$bin/copier"
+          echo "$bin" >> "$GITHUB_PATH"
+          "$bin/copier" --version
+
+      # The token reaches git through process-scoped config only, never a file on the runner.
+      - name: Update from the template
+        id: update
+        if: steps.marker.outputs.adopted == 'true'
+        env:
+          GIT_CONFIG_COUNT: "1"
+          GIT_CONFIG_KEY_0: url.https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/.insteadOf
+          GIT_CONFIG_VALUE_0: https://github.com/
+          GIT_AUTHOR_NAME: ${{ steps.app-token.outputs.app-slug }}[bot]
+          GIT_AUTHOR_EMAIL: ${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: ${{ steps.app-token.outputs.app-slug }}[bot]
+          GIT_COMMITTER_EMAIL: ${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com
+        run: |
+          set -euo pipefail
+          commit_of() { sed -n 's/^_commit:[[:space:]]*//p' .copier-answers.yml | tr -d "\"'" | head -n 1; }
+          before=$(commit_of)
+          copier update --trust --defaults --conflict inline
+          after=$(commit_of)
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "Already on the newest template ($before). Nothing to do."
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git add --all
+          conflicts=$(git grep --cached -l -E '^(<<<<<<<|>>>>>>>)( |$)' -- . || true)
+          {
+            echo "changed=true"
+            echo "before=$before"
+            echo "tag=$after"
+            echo "files<<EOF"
+            git diff --cached --name-status
+            echo "EOF"
+            echo "conflicts<<EOF"
+            [ -z "$conflicts" ] || printf '%s\n' "$conflicts"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Open the sync pull request
+        if: steps.update.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          BASE: ${{ github.event.repository.default_branch }}
+          BEFORE: ${{ steps.update.outputs.before }}
+          TAG: ${{ steps.update.outputs.tag }}
+          FILES: ${{ steps.update.outputs.files }}
+          CONFLICTS: ${{ steps.update.outputs.conflicts }}
+          GIT_CONFIG_COUNT: "1"
+          GIT_CONFIG_KEY_0: url.https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/.insteadOf
+          GIT_CONFIG_VALUE_0: https://github.com/
+          GIT_AUTHOR_NAME: ${{ steps.app-token.outputs.app-slug }}[bot]
+          GIT_AUTHOR_EMAIL: ${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: ${{ steps.app-token.outputs.app-slug }}[bot]
+          GIT_COMMITTER_EMAIL: ${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com
+        run: |
+          set -euo pipefail
+          branch="platform/sync-$TAG"
+          if [ -n "$(gh pr list --repo "$REPO" --head "$branch" --state open --json number --jq '.[].number')" ]; then
+            echo "A pull request for $TAG is already open on $branch. Nothing to do."
+            exit 0
+          fi
+          src=$(sed -n 's/^_src_path:[[:space:]]*//p' .copier-answers.yml | tr -d "\"'" | head -n 1)
+          web="${src#git+}"
+          web="${web%.git}"
+          git switch --create "$branch"
+          git commit --quiet --message "chore(platform): sync the platform template to $TAG"
+          git push --force "https://github.com/$REPO.git" "HEAD:refs/heads/$branch"
+          body="$RUNNER_TEMP/sync-body.md"
+          {
+            echo "Platform template sync from \`$BEFORE\` to [\`$TAG\`]($web/releases/tag/$TAG), made by \`copier update\`."
+            echo
+            if [ -n "$CONFLICTS" ]; then
+              echo "### Conflicts"
+              echo
+              echo "These files carry inline conflict markers where the app had edited platform code. CI fails on them until they are resolved."
+              echo
+              printf '%s\n' "$CONFLICTS" | awk '{ printf "- `%s`\n", $0 }'
+              echo
+            fi
+            echo "### Changed files"
+            echo
+            printf '%s\n' "$FILES" | awk -F '\t' '{ printf "- `%s` %s\n", $NF, $1 }'
+          } > "$body"
+          gh pr create --repo "$REPO" --base "$BASE" --head "$branch" \
+            --title "chore(platform): sync the platform template to $TAG" --body-file "$body"

package/loops/templates/platform-template/scripts/check-platform-conformance.mjs

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+// Managed by @plainconceptsplatform/workflows. Source: loops/templates/platform-template/scripts/check-platform-conformance.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
+// The .platform/manifest paths change only in a template sync (a pull request that moves `_commit` in
+// .copier-answers.yml) or under an unexpired .platform/exceptions.yml entry. Conflict markers in a
+// manifest file and expired exceptions fail too. Offline; without .copier-answers.yml it passes silently.
+//
+// Usage: node scripts/check-platform-conformance.mjs [--base <git ref>]   (no --base: markers and exceptions only)
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const ANSWERS = '.copier-answers.yml';
+const MANIFEST = '.platform/manifest';
+const EXCEPTIONS = '.platform/exceptions.yml';
+const CONFLICT_MARKER = /^(?:<{7}|>{7})(?: |$)/m;
+
+// gitwildmatch, the .gitignore syntax: a pattern with no inner slash matches at any depth, `**`
+// crosses directories, and a match on a directory covers everything below it.
+export function globToRegExp(glob) {
+  let pattern = glob.endsWith('/') ? `${glob}**` : glob;
+  const anchored = pattern.replace(/\/\*\*$/, '').includes('/');
+  pattern = pattern.replace(/^\//, '');
+  let re = '';
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i];
+    if (c === '*' && pattern[i + 1] === '*') {
+      const slash = pattern[i + 2] === '/';
+      re += slash ? '(?:.*/)?' : '.*';
+      i += slash ? 2 : 1;
+    } else if (c === '*') re += '[^/]*';
+    else if (c === '?') re += '[^/]';
+    else if (c === '[') {
+      const end = pattern.indexOf(']', i + 1);
+      if (end === -1) re += '\\[';
+      else {
+        re += `[${pattern.slice(i + 1, end).replace(/^!/, '^').replace(/\\/g, '\\\\')}]`;
+        i = end;
+      }
+    } else re += c.replace(/[.+^${}()|\\]/g, '\\$&');
+  }
+  // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp — the glob comes from the committed manifest and every metacharacter outside a class is escaped
+  return new RegExp(`^${anchored ? '' : '(?:.*/)?'}${re}(?:/.*)?$`);
+}
+
+export function parseManifest(text) {
+  return text
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line !== '' && !line.startsWith('#'))
+    .map((line) => {
+      const negate = line.startsWith('!');
+      const glob = negate ? line.slice(1) : line;
+      return { glob, negate, regex: globToRegExp(glob) };
+    });
+}
+
+// The last pattern that matches decides, as in .gitignore.
+export function inManifest(patterns, path) {
+  let matched = false;
+  for (const { negate, regex } of patterns) if (regex.test(path)) matched = !negate;
+  return matched;
+}
+
+const unquote = (value) => {
+  const v = value.trim();
+  const quoted = v.match(/^"(.*)"$|^'(.*)'$/);
+  if (quoted) return quoted[1] ?? quoted[2];
+  return v.replace(/\s+#.*$/, '');
+};
+
+// The subset of YAML .platform/exceptions.yml uses: one `exceptions:` list of flat mappings.
+export function parseExceptions(text) {
+  const entries = [];
+  const problems = [];
+  let inList = false;
+  text.split(/\r?\n/).forEach((raw, index) => {
+    const line = raw.replace(/\s+$/, '');
+    if (line.trim() === '' || line.trim().startsWith('#')) return;
+    const at = `${EXCEPTIONS}:${index + 1}`;
+    const top = line.match(/^exceptions:\s*(\[\s*\])?\s*(?:#.*)?$/);
+    if (top) {
+      inList = !top[1];
+      return;
+    }
+    const item = line.match(/^\s*-\s+([A-Za-z_]+):(.*)$/);
+    const field = line.match(/^\s+([A-Za-z_]+):(.*)$/);
+    if (inList && item) entries.push({ line: index + 1, [item[1]]: unquote(item[2]) });
+    else if (inList && field && entries.length > 0) entries.at(-1)[field[1]] = unquote(field[2]);
+    else problems.push(`${at}: cannot read "${line.trim()}"; expected exceptions: [{ path, reason, issue, expires }]`);
+  });
+  for (const entry of entries) {
+    const at = `${EXCEPTIONS}:${entry.line}`;
+    const missing = ['path', 'reason', 'issue', 'expires'].filter((key) => !entry[key]);
+    if (missing.length > 0) problems.push(`${at}: exception without ${missing.join(', ')}`);
+    else if (!/^\d{4}-\d{2}-\d{2}$/.test(entry.expires) || Number.isNaN(Date.parse(entry.expires))) {
+      problems.push(`${at}: expires must be a date (YYYY-MM-DD), got "${entry.expires}"`);
+    }
+  }
+  const valid = entries.filter((entry) => entry.path && entry.reason && entry.issue && !Number.isNaN(Date.parse(entry.expires)));
+  return { exceptions: valid.map((entry) => ({ ...entry, regex: globToRegExp(entry.path) })), problems };
+}
+
+const templateCommit = (answers) => answers?.match(/^_commit:\s*(.+?)\s*$/m)?.[1]?.replace(/^["']|["']$/g, '');
+
+function git(root, args) {
+  return execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+}
+
+function gitShow(root, ref, path) {
+  try {
+    return git(root, ['show', `${ref}:${path}`]);
+  } catch {
+    return undefined;
+  }
+}
+
+export function checkConformance(root, { base, today = new Date().toISOString().slice(0, 10) } = {}) {
+  const read = (path) => (existsSync(join(root, path)) ? readFileSync(join(root, path), 'utf8') : undefined);
+  const answers = read(ANSWERS);
+  if (answers === undefined) return { adopted: false, failures: [], notes: [] };
+
+  const failures = [];
+  const notes = [];
+  const manifestText = read(MANIFEST);
+  if (manifestText === undefined) return { adopted: true, failures: [`${ANSWERS} exists but ${MANIFEST} does not`], notes };
+  const patterns = parseManifest(manifestText);
+
+  const { exceptions, problems } = parseExceptions(read(EXCEPTIONS) ?? '');
+  failures.push(...problems);
+  const live = exceptions.filter((entry) => entry.expires >= today);
+  for (const entry of exceptions.filter((e) => e.expires < today)) {
+    failures.push(`${EXCEPTIONS}:${entry.line}: the exception for ${entry.path} expired on ${entry.expires} (${entry.issue}); converge the code or renew it`);
+  }
+
+  const tracked = git(root, ['ls-files', '-z']).split('\0').filter(Boolean);
+  for (const file of tracked.filter((path) => inManifest(patterns, path))) {
+    const text = read(file);
+    if (text !== undefined && !text.includes('\0') && CONFLICT_MARKER.test(text)) {
+      failures.push(`${file}: unresolved template-sync conflict markers`);
+    }
+  }
+
+  if (base !== undefined) {
+    const changed = git(root, ['diff', '--name-only', '--no-renames', `${base}...HEAD`]).split('\n').filter(Boolean);
+    const platform = changed.filter((path) => inManifest(patterns, path));
+    const before = templateCommit(gitShow(root, base, ANSWERS));
+    const after = templateCommit(answers);
+    if (before !== after) {
+      notes.push(`template sync ${before ?? '(adoption)'} -> ${after}: ${platform.length} platform file(s) may change`);
+    } else {
+      for (const path of platform) {
+        const covered = live.find((entry) => entry.regex.test(path));
+        if (covered) notes.push(`${path}: allowed by the exception until ${covered.expires} (${covered.issue})`);
+        else failures.push(`${path}: platform file changed outside a template sync; change it in Kitchen-Sink, or add an exception to ${EXCEPTIONS}`);
+      }
+    }
+  }
+  return { adopted: true, failures, notes };
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const args = process.argv.slice(2);
+  const baseIndex = args.indexOf('--base');
+  const base = baseIndex === -1 ? undefined : args[baseIndex + 1];
+  if (baseIndex !== -1 && !base) {
+    console.error('usage: node scripts/check-platform-conformance.mjs [--base <git ref>]');
+    process.exit(2);
+  }
+  const root = fileURLToPath(new URL('..', import.meta.url));
+  const { adopted, failures, notes } = checkConformance(root, { base });
+  if (!adopted) process.exit(0);
+  for (const note of notes) console.log(`· ${note}`);
+  for (const failure of failures) console.error(`✗ ${failure}`);
+  if (failures.length === 0) console.log('✓ platform files match the template');
+  process.exit(failures.length === 0 ? 0 : 1);
+}

package/loops/templates/quality-gates/.jscpd.json

@@ -0,0 +1,36 @@
+{
+  "path": [
+    "apps/api/src",
+    "apps/web/src"
+  ],
+  "format": [
+    "csharp",
+    "typescript",
+    "tsx"
+  ],
+  "minLines": 10,
+  "minTokens": 70,
+  "maxLines": 100000,
+  "maxSize": "5mb",
+  "mode": "mild",
+  "reporters": [
+    "json"
+  ],
+  "output": "jscpd-report",
+  "absolute": true,
+  "gitignore": false,
+  "silent": true,
+  "noTips": true,
+  "ignore": [
+    "**/obj/**",
+    "**/bin/**",
+    "**/node_modules/**",
+    "**/*.g.cs",
+    "**/*.designer.cs",
+    "**/*.Designer.cs",
+    "**/Migrations/**",
+    "**/*.test.ts",
+    "**/*.test.tsx",
+    "**/__tests__/**"
+  ]
+}

package/loops/templates/quality-gates/.jscpd.json.md

@@ -0,0 +1,7 @@
+# Ownership: .jscpd.json
+
+Managed by @plainconceptsplatform/workflows. Source: loops/templates/quality-gates/.jscpd.json. Update with `workflows update --force`; consumer edits may be overwritten.
+
+JSON (RFC 8259) does not permit comments, so the ownership header of `.jscpd.json` is documented here. The file is the duplication scope every app of the platform family shares: the jscpd report, the duplication gate (`scripts/check-duplication.mjs`) and the hygiene facet all read it, so they measure one file set.
+
+An app that needs a different scope takes the file over by removing the header paragraph above; `workflows update` then leaves both files alone. Its per-file backlog stays in the app's own `scripts/duplication-baseline.json`, which the package never installs.

package/loops/templates/quality-gates/.semgrep/platform-hygiene.yml

@@ -0,0 +1,88 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/quality-gates/.semgrep/platform-hygiene.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+# Hygiene rules (practice 11, code hygiene) shared by the platform family, run by the blocking
+# Semgrep scan in .github/workflows/app-ci.yml via `--config .semgrep/`. Their findings also feed
+# the `engineering-excellence-hygiene` facet (swallowed-exception counts). Shape from
+# PlainConceptsPlatform/Atlas .semgrep/atlas-hygiene.yml, rule ids neutral so every app shares them.
+#
+# A `catch` with an empty body turns a failure into silence. These rules flag an
+# empty body whatever it catches: a bare `catch`, `catch (Exception)`, or a narrow
+# type. A comment inside the braces is not handling and does not exempt it.
+#
+# One shape is exempt by design: `catch (OperationCanceledException) when
+# (<token>.IsCancellationRequested) { }`, the hosted-service shutdown idiom. It
+# swallows exactly the cancellation its own caller requested, and nothing else; an
+# unfiltered cancellation catch also hides an HttpClient timeout, so it is flagged.
+#
+# Where swallowing is genuinely correct, say why where a reviewer reads it, on the
+# line the finding starts (the `try`) or the line above it:
+#
+#   // nosemgrep: platform-hygiene-csharp-empty-catch — <why swallowing is correct here>
+#
+# The facet counts these justifications, so the backlog of swallowed exceptions stays
+# visible even while the gate is green. Test code is out of scope: a test that
+# expects a throw has its own idioms.
+# See Foundations ai/ENGINEERING.md.
+rules:
+  - id: platform-hygiene-csharp-empty-catch
+    languages: [csharp]
+    severity: ERROR
+    message: >-
+      Empty catch block: the exception is swallowed without logging, rethrowing or a
+      fallback. Handle it, or justify it on the `try` line with
+      `// nosemgrep: platform-hygiene-csharp-empty-catch — <reason>`.
+    metadata:
+      category: hygiene
+    paths:
+      # Product code only: .opencode/plugins and the managed .github actions belong to the
+      # agent-harness and agentic-workflows packages.
+      include:
+        - "/apps/"
+      exclude:
+        - "**/tests/**"
+        - "**/obj/**"
+        - "**/Migrations/**"
+    pattern-either:
+      # Catch-all: never exempt, even next to a filtered cancellation catch.
+      - pattern: try { ... } catch { }
+      - pattern: try { ... } catch { } finally { ... }
+      - pattern: try { ... } catch (Exception) { }
+      - pattern: try { ... } catch (Exception $E) { }
+      - pattern: try { ... } catch (System.Exception) { }
+      - pattern: try { ... } catch (System.Exception $E) { }
+      - pattern: try { ... } catch (Exception) { } finally { ... }
+      - pattern: try { ... } catch (Exception $E) { } finally { ... }
+      - patterns:
+          - pattern-either:
+              - pattern: try { ... } catch ($T) { }
+              - pattern: try { ... } catch ($T $E) { }
+              - pattern: try { ... } catch ($T) { } finally { ... }
+              - pattern: try { ... } catch ($T $E) { } finally { ... }
+          # Semgrep's C# grammar drops the `when` filter, so the exemption is textual.
+          - pattern-not-regex: catch\s*\(\s*OperationCanceledException(\s+\w+)?\s*\)\s*when\s*\(\s*[\w.]*IsCancellationRequested\s*\)\s*\{[^}]*\}
+
+  - id: platform-hygiene-ts-empty-catch
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      Empty catch block: the error is swallowed without logging, rethrowing or a
+      fallback. Handle it, or justify it on the `try` line with
+      `// nosemgrep: platform-hygiene-ts-empty-catch — <reason>`.
+    metadata:
+      category: hygiene
+    paths:
+      include:
+        - "/apps/"
+      exclude:
+        - "**/*.test.ts"
+        - "**/*.test.tsx"
+        - "**/*.test.mjs"
+        - "**/*.spec.ts"
+        - "**/__tests__/**"
+        - "**/e2e/**"
+        - "**/node_modules/**"
+        - "**/dist/**"
+    pattern-either:
+      - pattern: try { ... } catch { }
+      - pattern: try { ... } catch ($E) { }
+      - pattern: try { ... } catch { } finally { ... }
+      - pattern: try { ... } catch ($E) { } finally { ... }

package/loops/templates/quality-gates/.zap/rules.tsv

@@ -0,0 +1,26 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/quality-gates/.zap/rules.tsv. Update with `workflows update --force`; consumer edits may be overwritten.
+# ZAP baseline triage for .github/workflows/security-dast.yml.
+#
+# Format, tab-separated:	<rule-id>	<WARN|IGNORE|FAIL>	<justification>
+#
+# Each entry is a reviewed decision about one rule, and the justification column is mandatory.
+# An IGNORE that a fix would remove names the issue tracking that fix. Never add an IGNORE just
+# to turn the job green: fix the finding, or record here why the rule does not apply to the app.
+# An app that needs a triage line of its own takes this file over: remove the header line above.
+#
+# Shared by the platform family. 10020, 10021, 10035, 10038, 10063, 90004 and 10015 are fixed at
+# source by the platform security headers (Api/Security/SecurityHeaders.cs), and 90003 by
+# self-hosting Geist Mono, so none of them appears here. See Foundations ai/ENGINEERING.md.
+#
+# OUTOFSCOPE lines take a URL regex as the third column instead of a justification, so the
+# justification sits in the comment above each one.
+#
+# An anonymous / answers only with a 302 to the Entra sign-in. ZAP follows it and files
+# login.microsoftonline.com's page, headers and cookies (esctx, fpc, x-ms-gateway-slice) under
+# the app's /, so the header and cookie rules fire on a page the app does not serve. The app's own
+# headers on that redirect come from the same middleware as /login, which stays in scope.
+*	OUTOFSCOPE	^https://[^/]+/$
+10049	IGNORE	Non-Storable / Storable Content: informational, describes caching semantics, not a defect. The shell and API are no-store on purpose; hashed _next/static assets are immutable on purpose.
+10109	IGNORE	Modern Web Application: informational, ZAP noting the target is a JavaScript SPA, which is why the scan uses the AJAX spider.
+10112	IGNORE	Session Management Response Identified: informational, ZAP recognising the App Service ARRAffinity cookie as a session token. Not a finding.
+10055	IGNORE	CSP analysis: style-src carries 'unsafe-inline' because Radix UI and React inline style attributes need it; script-src does not use unsafe-inline: the build emits per-script SHA-256 hashes (scripts/extract-csp-hashes.mjs). The rest of the policy is pinned by SecurityHeadersTests.

package/loops/templates/quality-gates/scripts/check-complexity.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+// Managed by @plainconceptsplatform/workflows. Source: loops/templates/quality-gates/scripts/check-complexity.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
+
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { CC_MAX, CRAP_MAX, buildBaseline, evaluate, pruneBaseline } from './lib/complexity-gate.mjs';
+import { apiMethods, scoreMethods, webMethods } from './lib/engineering-excellence.mjs';
+
+const DEFAULT_BASELINE = fileURLToPath(new URL('./complexity-baseline.json', import.meta.url));
+const REPO_ROOT = fileURLToPath(new URL('..', import.meta.url));
+
+const args = process.argv.slice(2);
+const opt = (name) => {
+  const i = args.indexOf(`--${name}`);
+  return i === -1 ? undefined : args[i + 1];
+};
+const flag = (name) => args.includes(`--${name}`);
+
+const api = opt('api');
+const webFinal = opt('web-final');
+const eslint = opt('eslint');
+if (!api || !webFinal || !eslint) {
+  console.error('usage: node scripts/check-complexity.mjs --api <Cobertura.xml> --web-final <coverage-final.json> --eslint <eslint.json> [--baseline <file>] [--prune | --write-baseline]');
+  process.exit(2);
+}
+const baselineFile = opt('baseline') ?? DEFAULT_BASELINE;
+
+const methods = scoreMethods([
+  ...apiMethods(readFileSync(api, 'utf8')),
+  ...webMethods(JSON.parse(readFileSync(eslint, 'utf8')), JSON.parse(readFileSync(webFinal, 'utf8'))),
+]);
+
+const writeJson = (file, obj) => writeFileSync(file, `${JSON.stringify(obj, null, 2)}\n`);
+
+if (flag('write-baseline')) {
+  const b = buildBaseline(methods);
+  writeJson(baselineFile, b);
+  console.log(`· wrote ${Object.keys(b).length} baseline entries to ${baselineFile}`);
+  process.exit(0);
+}
+
+const baseline = existsSync(baselineFile) ? JSON.parse(readFileSync(baselineFile, 'utf8')) : {};
+
+if (flag('prune')) {
+  const pruned = pruneBaseline(baseline, methods);
+  writeJson(baselineFile, pruned);
+  console.log(`· baseline ${Object.keys(baseline).length} -> ${Object.keys(pruned).length} entries`);
+  process.exit(0);
+}
+
+const sourceCache = new Map();
+const readSource = (file) => {
+  if (!sourceCache.has(file)) {
+    const path = `${REPO_ROOT}${file}`;
+    sourceCache.set(file, existsSync(path) ? readFileSync(path, 'utf8').split('\n') : null);
+  }
+  return sourceCache.get(file);
+};
+
+const { violations, justified, baselined, fixed } = evaluate(methods, baseline, readSource);
+const pct = (r) => `${(r * 100).toFixed(0)}%`;
+const WHY = {
+  new: 'not in the baseline',
+  'cc-increased': 'complexity rose above its baseline',
+  'crap-increased': 'CRAP rose above its baseline (coverage dropped or complexity rose)',
+};
+
+console.log(`### Complexity gate (CC ≤ ${CC_MAX}, CRAP ≤ ${CRAP_MAX})`);
+console.log('');
+console.log(`${methods.length} methods · ${baselined} baselined backlog · ${justified.length} justified · ${violations.length} violations`);
+if (justified.length) {
+  console.log('', 'Justified (`complexity-justified:`):', '');
+  for (const j of justified) console.log(`- \`${j.file}:${j.line}\` ${j.method} — CC ${j.cc}, CRAP ${j.crap} — ${j.reason} (#${j.issue})`);
+}
+if (fixed.length) {
+  console.log('', `${fixed.length} baseline entries no longer violate — run \`node scripts/check-complexity.mjs ... --prune\` to ratchet the baseline down.`);
+}
+if (violations.length) {
+  console.log('', 'Violations — simplify the method, or test it until CRAP ≤ 30:', '');
+  for (const v of violations.sort((a, b) => b.crap - a.crap)) {
+    const base = v.baseline ? ` (baseline CC ${v.baseline.cc}, CRAP ${v.baseline.crap})` : '';
+    console.log(`- ✗ \`${v.file}:${v.line}\` ${v.method} — CC ${v.cc}, coverage ${pct(v.coverage)}, CRAP ${v.crap}: ${WHY[v.why]}${base}`);
+  }
+  process.exit(1);
+}
+console.log('', '✓ no method above the thresholds outside the baseline');