@rigour-labs/core 6.6.5 → 6.7.0

package/dist/review/backtest.test.js

@@ -0,0 +1,129 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { ConfigSchema } from '../types/index.js';
+import { backtestPassed, formatBacktest, ledgerProblems, loadLedger, runBacktest, score, LEDGER_PATH } from './backtest.js';
+const item = (over = {}) => ({ gate: 'unused-export', file: 'src/lib/server/billing/invoices.ts', line: 40, text: 'Unused export `isRefund` is not imported anywhere', blocking: true, ...over });
+describe('a ledger point matches a finding', () => {
+    const caught = (row, finding) => score({ id: 'r', commit: 'abcdef0', base: 'main', points: [{ id: 'P', point: 'p', ...row }], must_not_flag: [] }, 'h', [finding], 0, undefined).points[0].caught;
+    it('by file, then by line window or text pattern, case-insensitively', () => {
+        expect(caught({ file: 'invoices', lines: [30, 50] }, item())).toBe(true);
+        expect(caught({ file: 'invoices', lines: [41, 50] }, item())).toBe(false);
+        expect(caught({ file: 'invoices', text: 'isrefund|twice' }, item())).toBe(true);
+        expect(caught({ file: 'invoices', lines: [41, 50], text: 'isRefund' }, item())).toBe(true); // either is enough
+        expect(caught({ file: 'receipts', text: 'isRefund' }, item())).toBe(false); // the file must match
+        expect(caught({ file: 'invoices', lines: [30, 50] }, item({ line: undefined }))).toBe(false); // a lineless finding cannot be placed in a window
+    });
+    it('rejects rows that can match nothing before any round runs', () => {
+        const ledger = { rounds: [{ id: 'r1', commit: 'abcdef0', base: 'main', points: [
+                        { id: 'A', point: 'p', file: 'x', lines: [1, 2] },
+                        { id: 'B', point: 'p', file: '', text: 'x' },
+                        { id: 'C', point: 'p', file: 'x' },
+                        { id: 'D', point: 'p', file: 'x', text: 'x', needs: 'a text pattern' },
+                        { id: 'E', point: 'p', file: '[', text: 'x' },
+                    ], must_not_flag: [{ file: 'x' }] }] };
+        expect(ledgerProblems(ledger)).toEqual([
+            'r1 B: no file pattern',
+            'r1 C: needs a line window or a text pattern',
+            'r1 D: needs a text pattern',
+            'r1 E: not a regular expression',
+            'r1 must_not_flag[0]: needs a line window or a text pattern',
+        ]);
+    });
+});
+describe('scoring a round', () => {
+    const round = {
+        id: 'r1', commit: 'abcdef0', base: 'main',
+        points: [
+            { id: 'P1', point: 'dead export', file: 'invoices', lines: [30, 50] },
+            { id: 'P2', point: 'copies the accumulator', file: 'totals', text: 'copied|quadratic' },
+            { id: 'P3', point: 'drops the currency', file: 'checkout', text: 'currency' },
+        ],
+        must_not_flag: [{ file: 'session', text: 'cookie' }],
+    };
+    it('counts a point as caught only by a blocking finding; an advisory match is noted and still missed', () => {
+        const items = [item(), item({ gate: 'quadratic-copy', file: 'src/totals.ts', line: 128, text: 'accumulator copied whole', blocking: false }), item({ gate: 'reviewer', file: 'src/hooks/session.ts', line: 53, text: 'the cookie is cleared' })];
+        const result = score(round, 'abcdef0123456', items, 1200, undefined);
+        expect(result.points).toEqual([
+            { id: 'P1', point: 'dead export', caught: true, noted: false, by: 'unused-export src/lib/server/billing/invoices.ts:40' },
+            { id: 'P2', point: 'copies the accumulator', caught: false, noted: true },
+            { id: 'P3', point: 'drops the currency', caught: false, noted: false },
+        ]);
+        expect(result.falseBlocks).toHaveLength(1);
+        expect(backtestPassed([result])).toBe(false);
+        expect(formatBacktest([result])).toContain('r1 at abcdef012: 1/3 caught, 1 false block(s), 3 finding(s), 1s; caught by unused-export 1');
+        expect(formatBacktest([result])).toContain('noted   P2 copies the accumulator (advisory only)');
+        expect(formatBacktest([result])).toContain('MISSED  P3');
+        expect(formatBacktest([result])).toContain('FALSE   reviewer src/hooks/session.ts:53');
+    });
+    it('passes only when every point is caught, nothing good is flagged and the reviewer answered', () => {
+        const all = [item(), item({ gate: 'quadratic-copy', file: 'src/totals.ts', text: 'copied whole' }), item({ gate: 'reviewer', file: 'src/checkout.ts', text: 'drops the currency' })];
+        expect(backtestPassed([score(round, 'h', all, 1, undefined)])).toBe(true);
+        expect(backtestPassed([score(round, 'h', all, 1, 'the reviewer did not answer')])).toBe(false);
+    });
+});
+describe('rigour backtest on a repository', () => {
+    let repo;
+    const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' }).trim();
+    const write = (rel, body) => {
+        fs.mkdirSync(path.dirname(path.join(repo, rel)), { recursive: true });
+        fs.writeFileSync(path.join(repo, rel), body);
+    };
+    beforeEach(() => {
+        repo = fs.mkdtempSync(path.join(os.tmpdir(), 'backtest-'));
+        git('init', '-q', '-b', 'main');
+        git('config', 'user.email', 't@example.com');
+        git('config', 'user.name', 't');
+        git('config', 'commit.gpgsign', 'false');
+        write('src/app.ts', 'export const app = 1;\n');
+        git('add', '-A');
+        git('commit', '-qm', 'base');
+        git('checkout', '-qb', 'feature');
+        write('src/lib/util.ts', 'export function helper(): number {\n    return 1;\n}\n');
+        git('add', '-A');
+        git('commit', '-qm', 'add a helper nothing uses');
+    });
+    afterEach(() => {
+        try {
+            git('worktree', 'prune');
+        }
+        catch { /* the repository may be gone */ }
+        fs.rmSync(repo, { recursive: true, force: true });
+    });
+    it('reviews the reviewed commit in a worktree with the review hidden, scores it, and leaves the checkout alone', async () => {
+        const reviewed = git('rev-parse', 'HEAD');
+        const base = git('rev-parse', 'main');
+        git('checkout', '-q', 'main'); // the person runs it from wherever they are
+        write(LEDGER_PATH, JSON.stringify({ rounds: [{
+                    id: 'r1', commit: reviewed, base,
+                    points: [
+                        { id: 'R1-1', point: 'helper is never imported', file: 'util\\.ts', lines: [1, 3] },
+                        { id: 'R1-2', point: 'something no gate knows', file: 'util', text: 'quadratic' },
+                    ],
+                    must_not_flag: [{ file: 'app\\.ts', lines: [1, 1] }],
+                }] }));
+        const config = ConfigSchema.parse({ version: 1 });
+        const results = await runBacktest(repo, config, loadLedger(repo), { progress: () => undefined });
+        expect(results).toHaveLength(1);
+        expect(results[0].points).toMatchObject([{ id: 'R1-1', caught: true, by: 'unused-export src/lib/util.ts:1' }, { id: 'R1-2', caught: false, noted: false }]);
+        expect(results[0].falseBlocks).toEqual([]);
+        expect(results[0].head).toBe(reviewed);
+        expect(backtestPassed(results)).toBe(false);
+        expect(git('branch', '--show-current')).toBe('main');
+        expect(fs.existsSync(path.join(repo, 'src/lib/util.ts'))).toBe(false); // the checkout did not move
+        expect(fs.existsSync(path.join(repo, '.git/rigour-backtest', reviewed.slice(0, 12), 'src/lib/util.ts'))).toBe(true);
+        expect(fs.readdirSync(path.join(repo, '.rigour/backtest'))).toEqual([`r1-${reviewed.slice(0, 12)}.json`]);
+        // The worktree is reused on the next run.
+        const again = await runBacktest(repo, config, loadLedger(repo), { round: 'r1', progress: () => undefined });
+        expect(again[0].points[0].caught).toBe(true);
+    }, 60_000); // a real worktree and a typed review: over 10s on a Windows runner
+    it('names a round or a commit it cannot find', async () => {
+        const config = ConfigSchema.parse({ version: 1 });
+        const ledger = { rounds: [{ id: 'r1', commit: '0000000000000000000000000000000000000000', base: 'main', points: [{ id: 'P', point: 'p', file: 'x', text: 'x' }], must_not_flag: [] }] };
+        await expect(runBacktest(repo, config, ledger, { round: 'r9' })).rejects.toThrow('no round "r9"');
+        await expect(runBacktest(repo, config, ledger, { progress: () => undefined })).rejects.toThrow('is not in this repository');
+        expect(() => loadLedger(repo)).toThrow('no ledger');
+    }, 60_000); // a real worktree and a typed review: over 10s on a Windows runner
+});

package/dist/review/baseline.js

@@ -39,7 +39,8 @@ export async function baseFindings(cwd, config, commit, files) {
         const modules = path.join(cwd, 'node_modules');
         if (fs.existsSync(modules))
             fs.symlinkSync(modules, path.join(dir, 'node_modules'), 'junction');
-        const report = await new GateRunner(config).run(dir, await normalizeScopePatterns(dir, files), undefined, { record: false });
+        // The team's commands find nothing to compare per finding (they report no file), so the base copy never runs them.
+        const report = await new GateRunner({ ...config, commands: {} }).run(dir, await normalizeScopePatterns(dir, files), undefined, { record: false });
         return { failures: report.failures, added };
     }
     finally {

package/dist/review/dead-code.test.js

@@ -35,6 +35,14 @@ describe('unused exports', () => {
         expect(failures.map(f => [f.files?.[0], f.line, f.id])).toEqual([['src/app.ts', 4, 'unused-export']]);
         expect(failures[0].details).toContain('`lonely`');
     });
+    it('does not count a test as a consumer: an export only its tests import is dead in production', () => {
+        write('src/app.ts', 'export function start() {}\n\nexport function onlyTested() { return 1; }\nexport function used() { return 2; }\n');
+        write('src/app.test.ts', "import { onlyTested, used } from './app';\nonlyTested();\nused();\n");
+        write('tests/helpers.ts', "import { onlyTested } from '../src/app';\nonlyTested();\n");
+        write('src/use.ts', "import { used } from './app';\nused();\n");
+        const names = unusedExportFailures(repo, diffFromGit(repo), config()).map(f => f.details.match(/`([^`]+)`/)[1]);
+        expect(names).toEqual(['onlyTested']);
+    });
     it('reports a re-export nothing imports, without counting the module it comes from as a use', () => {
         write('src/types.ts', 'export type Row = { id: string };\nexport type Used = { n: number };\n');
         write('src/index.ts', "import { start } from './app';\nstart();\nexport type { Row, Used } from './types';\n");
@@ -43,6 +51,13 @@ describe('unused exports', () => {
         expect(names).toContainEqual(['src/index.ts', 'Row']);
         expect(names).not.toContainEqual(['src/index.ts', 'Used']);
     });
+    it('never reports a type-test file as orphaned: tsd runs test-d/ and *.test-d.ts by itself', () => {
+        write('test-d/types.ts', "import { start } from '../src/app';\nstart();\n");
+        write('src/app.test-d.ts', "import { start } from './app';\nstart();\n");
+        const orphans = orphanFileFailures(repo, diffFromGit(repo), config()).map(f => f.files?.[0]);
+        expect(orphans).not.toContain('test-d/types.ts');
+        expect(orphans).not.toContain('src/app.test-d.ts');
+    });
     it('skips what a framework calls by name, and names the team allows', () => {
         write('src/routes/+page.server.ts', 'export const load = () => ({});\nexport const helper = 1;\n');
         write('src/plugin.ts', 'export const register = () => {};\n');

package/dist/review/fix-scope.d.ts

@@ -0,0 +1,21 @@
+import { type Exec } from './reviewer/exec.js';
+export interface FixScope {
+    pr: number;
+    review: {
+        id: number;
+        login: string;
+        submittedAt: string;
+        commit: string;
+    };
+    cited: string[];
+    changed: string[];
+    extra: string[];
+}
+export declare function fixScope(cwd: string, options: {
+    pr: number | undefined;
+    review: number | undefined;
+    githubAccount: string | undefined;
+}, exec?: Exec): Promise<{
+    scope?: FixScope;
+    error?: string;
+}>;

package/dist/review/fix-scope.js

@@ -0,0 +1,94 @@
+/**
+ * A fix round's scope: the files the branch's own commits changed since the review they answer,
+ * less the files that review cited. A fix round changes what the review asked for and nothing
+ * else, so every extra file is either a point the reviewer never made or work for a follow-up.
+ *
+ * Cited means: the path of an inline comment of that review round (every review a person
+ * submitted on the same commit), or a tracked file the review text names (`src/a.ts:12`,
+ * `a.ts`, a blob link), when the name points at exactly one file. A test of a cited file is in
+ * scope when it sits beside it (or in its `__tests__`). Merges are left out (a merge from main brings main's files, not the round's), and so is
+ * a file the round changed and then put back.
+ */
+import path from 'path';
+import { defaultExec, githubEnv, parseJsonArrays } from './reviewer/exec.js';
+import { findPullRequest, ghFor, isHuman } from './reviewer/inputs.js';
+import { isTestFile } from './test-files.js';
+const GIT_TIMEOUT_MS = 60_000;
+export async function fixScope(cwd, options, exec = defaultExec) {
+    const git = async (args) => exec('git', args, { cwd, timeoutMs: GIT_TIMEOUT_MS });
+    const branch = (await git(['rev-parse', '--abbrev-ref', 'HEAD'])).stdout.trim();
+    const head = (await git(['rev-parse', 'HEAD'])).stdout.trim();
+    if (!head)
+        return { error: 'not a git repository' };
+    const gh = ghFor(cwd, exec, await githubEnv(cwd, options.githubAccount, exec));
+    const found = await findPullRequest(gh, branch, head, options.pr);
+    if (!found.pr)
+        return { error: found.error ?? `no pull request for ${branch}: name one with --scope <number>` };
+    const pr = found.pr;
+    const reviews = await gh(['api', `repos/{owner}/{repo}/pulls/${pr.number}/reviews`, '--paginate']);
+    const comments = await gh(['api', `repos/{owner}/{repo}/pulls/${pr.number}/comments`, '--paginate']);
+    if (reviews.exitCode !== 0 || comments.exitCode !== 0)
+        return { error: `could not read the reviews of pull request ${pr.number}: ${(reviews.stderr || comments.stderr).trim().slice(0, 200)}` };
+    const human = parseJsonArrays(reviews.stdout).filter((r) => isHuman(r, pr.author) && r.commit_id);
+    const target = options.review !== undefined ? human.find((r) => r.id === options.review) : human.at(-1);
+    if (!target)
+        return { error: options.review !== undefined ? `no review ${options.review} by a person on pull request ${pr.number}` : `pull request ${pr.number} has no review by a person yet` };
+    if ((await git(['merge-base', '--is-ancestor', target.commit_id, 'HEAD'])).exitCode !== 0) {
+        return { error: `the reviewed commit ${String(target.commit_id).slice(0, 9)} is not behind HEAD: fetch it, or the branch was rewritten since the review` };
+    }
+    const round = human.filter((r) => r.commit_id === target.commit_id);
+    const roundIds = new Set(round.map((r) => r.id));
+    const inline = parseJsonArrays(comments.stdout).filter((c) => isHuman(c, pr.author) && roundIds.has(c.pull_request_review_id));
+    const tracked = trackedIndex((await git(['ls-files'])).stdout.split('\n').filter(Boolean));
+    const cited = new Set(inline.map((c) => String(c.path)));
+    for (const text of [...round.map((r) => r.body), ...inline.map((c) => c.body)])
+        for (const file of mentioned(String(text ?? ''), tracked))
+            cited.add(file);
+    const changed = await changedByTheRound(git, target.commit_id);
+    const covered = (file) => cited.has(file) || (isTestFile(file) && [...cited].some(c => subject(c) === subject(file)));
+    return {
+        scope: {
+            pr: pr.number,
+            review: { id: target.id, login: target.user.login, submittedAt: String(target.submitted_at ?? ''), commit: target.commit_id },
+            cited: [...cited].sort(),
+            changed,
+            extra: changed.filter(file => !covered(file)),
+        },
+    };
+}
+/** Files the branch's own commits (not its merges) changed since `commit`, and that still differ from it. */
+async function changedByTheRound(git, commit) {
+    const own = new Set((await git(['log', '--first-parent', '--no-merges', '--name-only', '--format=', `${commit}..HEAD`])).stdout.split('\n').filter(Boolean));
+    const differ = (await git(['diff', '--name-only', commit, 'HEAD'])).stdout.split('\n').filter(Boolean);
+    return differ.filter(file => own.has(file)).sort();
+}
+/** Tracked files by base name, built once for every review text. */
+function trackedIndex(files) {
+    const index = new Map();
+    for (const file of files) {
+        const base = path.posix.basename(file);
+        const same = index.get(base);
+        if (same)
+            same.push(file);
+        else
+            index.set(base, [file]);
+    }
+    return index;
+}
+/** Tracked files a review's text names, by path, path suffix or blob link, when the name is unambiguous. */
+function mentioned(text, tracked) {
+    const found = new Set();
+    for (const raw of text.match(/[\w@$./-]+\.[A-Za-z][\w]*/g) ?? []) {
+        const name = raw.replace(/^.*\/blob\/[^/]+\//, '').replace(/^\.\//, '');
+        const matches = (tracked.get(path.posix.basename(name)) ?? []).filter(file => file === name || file.endsWith(`/${name}`));
+        const exact = matches.find(file => file === name);
+        if (exact || matches.length === 1)
+            found.add(exact ?? matches[0]);
+    }
+    return [...found];
+}
+/** What a file is about: `src/a.ts`, `src/a.test.ts` and `src/__tests__/a.spec.ts` are all `src/a`. */
+function subject(file) {
+    const dir = path.posix.dirname(file).replace(/\/(__tests__|tests?)$/, '');
+    return path.posix.join(dir, path.posix.basename(file).replace(/\.(test|spec|test-d)(?=\.)/, '').replace(/\.[^.]+$/, ''));
+}

package/dist/review/fix-scope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review/fix-scope.test.js

@@ -0,0 +1,104 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { fixScope as scopeWith } from './fix-scope.js';
+let repo;
+let reviewed;
+const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' }).trim();
+const write = (rel, body) => {
+    fs.mkdirSync(path.dirname(path.join(repo, rel)), { recursive: true });
+    fs.writeFileSync(path.join(repo, rel), body);
+};
+const commit = (message) => {
+    git('add', '-A');
+    git('commit', '-qm', message);
+};
+const PR = { number: 42, state: 'OPEN', isDraft: false, author: { login: 'author' }, body: '' };
+const user = (login, type = 'User') => ({ login, type });
+let reviews;
+let comments;
+/** Real git; gh answers from `reviews` and `comments`. */
+const exec = async (command, args, options) => {
+    if (command === 'git') {
+        try {
+            return { exitCode: 0, stdout: execFileSync('git', args, { cwd: options.cwd, encoding: 'utf8', stdio: 'pipe' }), stderr: '' };
+        }
+        catch (error) {
+            return { exitCode: 1, stdout: '', stderr: String(error.message) };
+        }
+    }
+    if (args[0] === 'pr')
+        return { exitCode: 0, stdout: JSON.stringify(PR), stderr: '' };
+    if (args[1]?.endsWith('/reviews'))
+        return { exitCode: 0, stdout: JSON.stringify(reviews), stderr: '' };
+    if (args[1]?.endsWith('/comments'))
+        return { exitCode: 0, stdout: JSON.stringify(comments), stderr: '' };
+    return { exitCode: 1, stdout: '', stderr: 'unexpected gh call' };
+};
+beforeEach(() => {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'fix-scope-'));
+    git('init', '-q', '-b', 'main');
+    git('config', 'user.email', 't@example.com');
+    git('config', 'user.name', 't');
+    git('config', 'commit.gpgsign', 'false');
+    for (const file of ['src/job.ts', 'src/job.test.ts', 'src/util.ts', 'src/deep/thing.ts', 'src/other.ts', 'src/temp.ts', 'src/mainside.ts', 'lib/util.ts'])
+        write(file, 'export const x = 1;\n');
+    commit('base');
+    git('checkout', '-qb', 'feature');
+    write('src/job.ts', 'export const x = 2;\n');
+    commit('the change under review');
+    reviewed = git('rev-parse', 'HEAD');
+    reviews = [
+        { id: 1, user: user('ci-bot', 'Bot'), body: 'see src/other.ts', submitted_at: '2026-10-01', commit_id: reviewed },
+        { id: 2, user: user('author'), body: 'I will also tidy src/other.ts', submitted_at: '2026-10-02', commit_id: reviewed },
+        { id: 3, user: user('senior'), body: 'Bound the window in `src/util.ts:4`. The scan in https://github.com/o/r/blob/abc123/src/deep/thing.ts#L3 is quadratic.', submitted_at: '2026-10-03', commit_id: reviewed },
+        { id: 4, user: user('second'), body: '', submitted_at: '2026-10-03', commit_id: reviewed },
+    ];
+    comments = [
+        { id: 9, pull_request_review_id: 4, user: user('second'), path: 'src/job.ts', body: 'Lock before the first read.' },
+        { id: 10, pull_request_review_id: 2, user: user('author'), path: 'src/temp.ts', body: 'my own note' },
+    ];
+});
+afterEach(() => { fs.rmSync(repo, { recursive: true, force: true }); });
+const fixScope = (cwd, named, run) => scopeWith(cwd, { pr: undefined, review: named.review, githubAccount: undefined }, run);
+describe('the scope of a fix round', () => {
+    it('lists the files the round changed that no point of the review cited', async () => {
+        for (const file of ['src/job.ts', 'src/job.test.ts', 'src/util.ts', 'src/deep/thing.ts', 'src/other.ts'])
+            write(file, 'export const x = 3;\n');
+        commit('fix round');
+        write('src/temp.ts', 'export const x = 9;\n');
+        commit('try something');
+        write('src/temp.ts', 'export const x = 1;\n');
+        commit('put it back');
+        git('checkout', '-q', 'main');
+        write('src/mainside.ts', 'export const x = 4;\n');
+        commit('main moves on');
+        git('checkout', '-q', 'feature');
+        git('merge', '-q', '--no-edit', 'main');
+        const { scope, error } = await fixScope(repo, {}, exec);
+        expect(error).toBeUndefined();
+        expect(scope).toMatchObject({ pr: 42, review: { id: 4, login: 'second', commit: reviewed } });
+        expect(scope.cited).toEqual(['src/deep/thing.ts', 'src/job.ts', 'src/util.ts']);
+        expect(scope.changed).toEqual(['src/deep/thing.ts', 'src/job.test.ts', 'src/job.ts', 'src/other.ts', 'src/util.ts']);
+        expect(scope.extra).toEqual(['src/other.ts']);
+    });
+    it('takes a named review as the round, and an ambiguous file name cites nothing', async () => {
+        write('src/job.ts', 'export const x = 3;\n');
+        commit('first fix round');
+        reviews.push({ id: 5, user: user('senior'), body: 'and util.ts too', submitted_at: '2026-10-04', commit_id: git('rev-parse', 'HEAD') });
+        write('src/util.ts', 'export const x = 3;\n');
+        commit('second fix round');
+        const named = await fixScope(repo, { review: 5 }, exec);
+        expect(named.scope.cited).toEqual([]);
+        expect(named.scope.extra).toEqual(['src/util.ts']);
+    });
+    it('says why it cannot answer', async () => {
+        expect((await fixScope(repo, { review: 99 }, exec)).error).toBe('no review 99 by a person on pull request 42');
+        reviews = reviews.filter((r) => r.user.type === 'Bot');
+        expect((await fixScope(repo, {}, exec)).error).toBe('pull request 42 has no review by a person yet');
+        reviews = [{ id: 3, user: user('senior'), body: 'x', submitted_at: '2026-10-03', commit_id: 'f'.repeat(40) }];
+        expect((await fixScope(repo, {}, exec)).error).toMatch(/^the reviewed commit fffffffff is not behind HEAD/);
+    });
+});

package/dist/review/lint-overlay.d.ts

@@ -0,0 +1,21 @@
+export interface OverlayMessage {
+    file: string;
+    line: number;
+    column: number;
+    rule: string;
+    message: string;
+}
+/** Why the overlay cannot run here, or undefined when it can. */
+export declare function overlayUnavailable(cwd: string): string | undefined;
+/**
+ * Writes the overlay config to a scratch directory and returns its path. It is an ES module that
+ * imports the repository's config by absolute path, so it is never written into the repository.
+ */
+export declare function writeOverlayConfig(cwd: string): string;
+/** ESLint's JSON report, kept to messages on changed lines; the rest is counted. */
+export declare function onChangedLines(json: string, cwd: string, changedLines: Record<string, Set<number>>): {
+    blocking: OverlayMessage[];
+    preexisting: number;
+} | {
+    error: string;
+};

package/dist/review/lint-overlay.js

@@ -0,0 +1,89 @@
+/**
+ * Type-checked lint rules the repository does not enable yet, on changed lines only. They are the
+ * mechanical dead-code classes a person keeps finding after lint is green: a condition that can
+ * never be true once the types say so, a `?.` on a member every host supplies, a redundant
+ * comparison, a promise nobody awaits. The overlay loads the repository's own flat config first,
+ * so nothing it enforces is lost, and uses its own `typescript-eslint` (never a download). A
+ * message on a line the change did not touch is the team's backlog: counted, not blocking.
+ */
+import fs from 'fs';
+import { createRequire } from 'module';
+import os from 'os';
+import path from 'path';
+import { pathToFileURL } from 'url';
+const CONFIG_FILES = ['eslint.config.js', 'eslint.config.mjs', 'eslint.config.cjs', 'eslint.config.ts', 'eslint.config.mts'];
+const TYPED_RULES = {
+    '@typescript-eslint/no-unnecessary-condition': 'error',
+    '@typescript-eslint/no-unnecessary-boolean-literal-compare': 'error',
+    '@typescript-eslint/no-unnecessary-type-assertion': 'error',
+    '@typescript-eslint/no-redundant-type-constituents': 'error',
+    '@typescript-eslint/prefer-optional-chain': 'error',
+    '@typescript-eslint/switch-exhaustiveness-check': 'error',
+    '@typescript-eslint/no-floating-promises': 'error',
+    '@typescript-eslint/no-misused-promises': 'error',
+};
+/** Why the overlay cannot run here, or undefined when it can. */
+export function overlayUnavailable(cwd) {
+    if (!CONFIG_FILES.some(name => fs.existsSync(path.join(cwd, name))))
+        return 'no eslint.config.* in this repository';
+    try {
+        createRequire(path.join(cwd, 'package.json')).resolve('typescript-eslint');
+    }
+    catch {
+        return 'typescript-eslint is not installed';
+    }
+    return undefined;
+}
+/**
+ * Writes the overlay config to a scratch directory and returns its path. It is an ES module that
+ * imports the repository's config by absolute path, so it is never written into the repository.
+ */
+export function writeOverlayConfig(cwd) {
+    const base = CONFIG_FILES.find(name => fs.existsSync(path.join(cwd, name)));
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rigour-lint-overlay-'));
+    const file = path.join(dir, 'eslint.overlay.config.mjs');
+    fs.writeFileSync(file, `import path from 'node:path';
+import { createRequire } from 'node:module';
+const repo = ${JSON.stringify(cwd)};
+const require = createRequire(path.join(repo, 'package.json'));
+const base = (await import(${JSON.stringify(pathToFileURL(path.join(cwd, base)).href)})).default;
+const ts = require('typescript-eslint');
+const typed = ${JSON.stringify(TYPED_RULES, null, 4)};
+export default [
+    ...base,
+    {
+        files: ['**/*.ts', '**/*.mts', '**/*.cts', '**/*.js', '**/*.mjs', '**/*.svelte.ts', '**/*.svelte.js'],
+        ignores: ['**/*.d.ts'],
+        languageOptions: { parser: ts.parser, parserOptions: { projectService: { allowDefaultProject: ['*.mjs', 'scripts/*.mjs'] }, tsconfigRootDir: repo } },
+        rules: typed,
+    },
+    { files: ['**/*.svelte'], rules: typed },
+    // A test fake deliberately covers cases the types call impossible.
+    { files: ['**/*.test.ts', '**/*.spec.ts', '**/*.test-d.ts', '**/*.svelte.test.ts', 'tests/**', 'test/**', 'test-d/**', '**/__tests__/**', '**/__mocks__/**'], rules: { '@typescript-eslint/no-unnecessary-condition': 'off', '@typescript-eslint/no-floating-promises': 'off' } },
+];
+`);
+    return file;
+}
+/** ESLint's JSON report, kept to messages on changed lines; the rest is counted. */
+export function onChangedLines(json, cwd, changedLines) {
+    let results;
+    try {
+        results = JSON.parse(json);
+    }
+    catch {
+        return { error: `eslint printed no JSON: ${json.trim().slice(0, 200)}` };
+    }
+    const blocking = [];
+    let preexisting = 0;
+    for (const result of results) {
+        const file = path.relative(cwd, result.filePath).split(path.sep).join('/');
+        const lines = changedLines[file];
+        for (const message of result.messages) {
+            if (lines?.has(message.line))
+                blocking.push({ file, line: message.line, column: message.column, rule: message.ruleId ?? 'error', message: message.message });
+            else
+                preexisting++;
+        }
+    }
+    return { blocking, preexisting };
+}

package/dist/review/orphan-files.js

@@ -16,9 +16,10 @@ import micromatch from 'micromatch';
 import { addedFiles } from './migration-order.js';
 import { sourceStem } from './package-layout.js';
 import { ownOutputs } from './unused-exports.js';
+import { isTestFile } from './test-files.js';
 const GIT_TIMEOUT_MS = 10_000;
 const CODE = /\.(ts|tsx|js|jsx|mjs|cjs|svelte)$/;
-const FOUND_BY_RUNNER = /(^|\/)\+[^/]+$|(^|\/)hooks(\.server|\.client)?\.(ts|js)$|^netlify\/functions\/|^src\/params\/|\.(test|spec|e2e)\.[a-z]+$|\.d\.ts$|^(tests?|e2e|__tests__|migrations|supabase)\/|\.config\.[a-z]+$|^\./;
+const FOUND_BY_RUNNER = /(^|\/)\+[^/]+$|(^|\/)hooks(\.server|\.client)?\.(ts|js)$|^netlify\/functions\/|^src\/params\/|\.d\.ts$|^(migrations|supabase)\/|\.config\.[a-z]+$|^\./;
 /** Files that can run or import another: code, package.json, CI and config. */
 const REFERRER = /\.(ts|tsx|js|jsx|mjs|cjs|svelte|json|ya?ml|toml|sh)$/;
 /** Lockfiles and generated bundles name no source file and can be megabytes. */
@@ -32,7 +33,7 @@ export function orphanFileFailures(cwd, diff, config) {
     const settings = config.gates.orphan_files;
     if (!settings?.enabled)
         return [];
-    const added = addedFiles(diff).filter(file => CODE.test(file) && !FOUND_BY_RUNNER.test(file) && !BUILD_OUTPUT.test(file) && !micromatch.isMatch(file, settings.allow));
+    const added = addedFiles(diff).filter(file => CODE.test(file) && !FOUND_BY_RUNNER.test(file) && !isTestFile(file) && !BUILD_OUTPUT.test(file) && !micromatch.isMatch(file, settings.allow));
     if (added.length === 0)
         return [];
     const excluded = ownOutputs(config);

package/dist/review/partial-wiring.js

@@ -8,8 +8,10 @@
 import { spawnSync } from 'child_process';
 import fs from 'fs';
 import path from 'path';
+import { isTestFile } from './test-files.js';
 const MOUNTING = /\.(svelte|tsx|jsx)$/;
-const SKIPPED = /\.(test|spec|stories)\.|(^|\/)(__tests__|tests?)\//;
+/** Tests and stories mount components to exercise them, not to wire behaviour. */
+const skipped = (file) => isTestFile(file) || /\.stories\./.test(file);
 const GIT_TIMEOUT_MS = 10_000;
 export function partialWiringFailures(cwd, changedLines, config) {
     if (!config.gates.change_sweep?.enabled)
@@ -17,7 +19,7 @@ export function partialWiringFailures(cwd, changedLines, config) {
     const failures = [];
     const seen = new Set();
     for (const [file, lines] of Object.entries(changedLines)) {
-        if (!MOUNTING.test(file) || SKIPPED.test(file) || lines.size === 0)
+        if (!MOUNTING.test(file) || skipped(file) || lines.size === 0)
             continue;
         for (const mount of mountsIn(cwd, file)) {
             for (const { prop, line } of addedProps(cwd, mount, lines)) {
@@ -75,7 +77,7 @@ function mountsOf(cwd, component) {
     if (cached)
         return cached;
     const grep = spawnSync('git', ['grep', '--untracked', '-l', '-F', '-e', `<${component}`], { cwd, encoding: 'utf8', timeout: GIT_TIMEOUT_MS });
-    const files = grep.status === 0 ? grep.stdout.split('\n').filter(f => f && MOUNTING.test(f) && !SKIPPED.test(f)) : [];
+    const files = grep.status === 0 ? grep.stdout.split('\n').filter(f => f && MOUNTING.test(f) && !skipped(f)) : [];
     const mounts = files.flatMap(file => mountsIn(cwd, file).filter(m => m.component === component));
     mountCache.set(key, mounts);
     return mounts;

package/dist/review/query-patterns.js

@@ -14,11 +14,12 @@
  *
  * Read from the syntax tree, so a comment or string never matches.
  */
+import { isTestFile } from './test-files.js';
 import fs from 'fs';
 import path from 'path';
 import ts from 'typescript';
 const CODE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
-const SKIPPED = /\.(test|spec)\.|\.d\.ts$|(^|\/)(__tests__|tests?|e2e)\//;
+const DECLARATIONS = /\.d\.ts$/;
 const TIME_COLUMN = /(_at|_on|At|On|date|Date|time|Time|timestamp|Timestamp)$|^(at|since|until|created|updated)$/;
 const LOWER = new Set(['gt', 'gte']);
 const UPPER = new Set(['lt', 'lte']);
@@ -27,7 +28,7 @@ export function queryPatternFailures(cwd, changedLines, config) {
         return [];
     const failures = [];
     for (const [file, lines] of Object.entries(changedLines)) {
-        if (!CODE.test(file) || SKIPPED.test(file) || lines.size === 0)
+        if (!CODE.test(file) || DECLARATIONS.test(file) || isTestFile(file) || lines.size === 0)
             continue;
         let text;
         try {

package/dist/review/quiet.d.ts

@@ -1,6 +1,12 @@
 import type { Failure } from '../types/index.js';
 export declare const DISMISSED_FILE: string;
 export declare function isProven(failure: Failure): boolean;
+/**
+ * What a change must fix: a proven finding, a critical one, or a high one the semantic engine
+ * verified or a security gate found. The one rule behind the review's verdict, the stop hook and
+ * the push gate, so the three never disagree about the same finding.
+ */
+export declare function mustFix(failure: Failure): boolean;
 /** The same finding across runs and pushes: gate, file and message, never the line (lines move). */
 export declare function findingKey(failure: Failure): string;
 export interface QuietSplit {

package/dist/review/quiet.js

@@ -20,11 +20,21 @@ import fs from 'fs';
 import path from 'path';
 import { checkId, isMuted, readOutcomes, recordOutcome, reportedCheck } from './check-outcomes.js';
 import { readStateFile } from './trusted-state.js';
-const PROVEN_GATES = new Set(['semantic-bugs', 'hallucinated-imports', 'security-patterns', 'deep-analysis', 'diff-tests', 'unused-export', 'orphan-file', 'offset-paging', 'unbounded-window', 'duplicate-function', 'partial-fix', 'partial-wiring']);
+const PROVEN_GATES = new Set(['semantic-bugs', 'hallucinated-imports', 'security-patterns', 'deep-analysis', 'diff-tests', 'unused-export', 'orphan-file', 'offset-paging', 'unbounded-window', 'duplicate-function', 'partial-fix', 'partial-wiring', 'migration-order',
+    'duplicate-null-filter', 'nullable-filtered-column', 'optional-always-supplied', 'write-only-property', 'typed-checks-unavailable']);
 export const DISMISSED_FILE = path.join('.rigour', 'dismissed.json');
 export function isProven(failure) {
     return PROVEN_GATES.has(failure.id);
 }
+/**
+ * What a change must fix: a proven finding, a critical one, or a high one the semantic engine
+ * verified or a security gate found. The one rule behind the review's verdict, the stop hook and
+ * the push gate, so the three never disagree about the same finding.
+ */
+export function mustFix(failure) {
+    const severity = failure.severity ?? 'medium';
+    return isProven(failure) || severity === 'critical' || (severity === 'high' && (failure.verified === true || failure.provenance === 'security'));
+}
 /** The same finding across runs and pushes: gate, file and message, never the line (lines move). */
 export function findingKey(failure) {
     return crypto.createHash('sha256').update(`${failure.id}\u0000${failure.files?.[0] ?? ''}\u0000${failure.details}`).digest('hex').slice(0, 16);
@@ -39,7 +49,7 @@ export function quietSplit(cwd, findings, includeHeuristics = false, trustedRef)
             split.dismissed++;
             split.dismissedByGate[finding.id] = (split.dismissedByGate[finding.id] ?? 0) + 1;
         }
-        else if (includeHeuristics || isProven(finding))
+        else if (includeHeuristics || mustFix(finding))
             split.speaking.push(finding);
         else if (isMuted(outcomes[checkId(finding)]))
             split.muted++;