asdlc-cli 0.1.0

package/assets/templates/AGENTS_SECTION.md

@@ -0,0 +1,57 @@
+[ANTI-DRIFT CONSTITUTION v3.1.1 — managed section]
+
+# Standing Orders — read fully before any task
+
+Invariant: **within each bounded context and contract version, every governed
+business concept has one approved DEFINITION (docs/BUSINESS_RULES.md);
+implementations declare the version and conformance profile they satisfy and either
+import the canonical module or prove conformance via that profile's contract tests
+(tests/contracts/).** Duplicated meaning is the disease; declared conforming
+implementations for genuinely different contexts are legitimate.
+
+Scope of Rules 1/2/4: shared or business-rule-bearing code — governed concepts, the
+shared homes in docs/ARCHITECTURE.md, and anything multiple entry points consume.
+Local glue and trivial private helpers: normal judgment.
+
+Rule 1 — Search before create; show the search. For shared/rule-bearing validators,
+components, services, types, constants, utils: search graph+grep+registry first and
+show it. Found → import, or conforming implementation with declared profile +
+contract tests where context requires (say why import wasn't possible). Not found →
+create in its docs/ARCHITECTURE.md home + register, same commit. Unshown search =
+incomplete task.
+
+Rule 2 — Undefined business terms, by risk. Blocking tier (money, authz/visibility/
+tenancy, privacy, irreversible, external, data-migration): ask first, always.
+Reversible: propose, proceed, record the assumption visibly. Incidental: judgment.
+Batch questions. Never silently pick a meaning for blocking-tier terms.
+
+Rule 3 — Homes and boundaries come from docs/ARCHITECTURE.md. Follow it; propose
+updates rather than deviating. Business logic stays out of routes/screens per that
+document; raw errors go through the shared error mapper.
+
+Rule 4 — Changing/removing anything shared = generated sweep. Present the consumer
+list as "all discovered consumers (method, blind spots)" — never claim unqualified
+completeness — update all, or propose a staged migration where same-commit is
+unsafe. Updating only the named file is a bug.
+
+Rule 5 — Tests from acceptance criteria / registry definitions, before
+implementing. Never derive tests from the implementation.
+
+Rule 6 — Checks before done; never touch them. Run `asdlc check` (functional tests,
+contract-profile tests, registry + waiver-expiry validation, duplication,
+architecture, patterns). Show output; green (legacy: zero NEW) or not done. Never
+raise thresholds, add ignores, edit baselines, or alter CI for green. False
+positive → draft a waiver (.asdlc/waivers.yml, all fields incl. fingerprint) and stop
+for approval. Gate configs, baselines, waivers, rules, this file, ARCHITECTURE.md,
+CI: GOVERN only — human approval with a pointer. A crashed check reports ERROR,
+never PASS.
+
+Rule 7 — Leave a trail. New shared module / changed definition / removed feature →
+registry same commit (definitions by hand; implementation/consumer lists change
+only via approved audit proposals).
+
+Rule 8 — End-of-task sibling sweep: search once for other occurrences of the
+touched pattern; list, don't fix unprompted.
+
+Rule 9 — Scope discipline: work in declared, reviewable chunks; keep coupled
+concepts atomic when separating them would itself create inconsistency.

package/assets/templates/ARCHITECTURE.md

@@ -0,0 +1,28 @@
+# Architecture
+
+<!-- Written from what THIS repo actually does — never prescribed by a tool.
+     Fill in the real homes; the boundaries you write here become enforceable
+     dependency-cruiser rules. User approves before gates enforce it. -->
+
+## Where things live in this repo
+
+| Concern | Home | Rule |
+| --- | --- | --- |
+| Business rules / domain logic | `src/lib/` (example) | Screens and routes import from here; never reimplement inline |
+| Shared UI components | `src/components/ui/` (example) | One component per concept; variants via props, not copies |
+| Data access | `src/lib/` or `src/services/` (example) | Routes/screens never query storage directly |
+| Shared types | `src/types/` (example) | One declaration per entity |
+| Constants / config | `src/lib/constants` (example) | No magic values in screens |
+| Error mapping | one shared error mapper | Raw provider/DB errors never reach a client response |
+
+## Boundary rules this structure implies
+
+<!-- These become .dependency-cruiser.cjs rules. Examples: -->
+- Views/components must not import from `src/app/api/` internals.
+- API routes must not import UI components.
+- Nothing imports from another module's private internals (`**/internal/**`).
+
+## Change rule
+
+Propose updates to this document rather than deviating from it. Changes are
+GOVERN operations: human approval with a pointer.

package/assets/templates/BUSINESS_RULES.md

@@ -0,0 +1,23 @@
+# Business Rules Registry
+
+[Definitions are HUMAN-AUTHORED — the source of truth for meaning.
+ Implementation/consumer lists change only via approved audit proposals.]
+
+<!-- Copy this section per governed concept. Delete this example once you have real entries. -->
+
+## Example: Lead Qualification
+- Id: lead.qualification
+- Bounded context: lead-management
+- Version: 1.0.0
+- Owner: <human/role>
+- Approval ref: <where this definition was approved>
+- Definition: <one unambiguous paragraph — authoritative. This sentence is the
+  thing every screen, route, import, and job must agree on. If it isn't written
+  here, every AI session will invent its own version.>
+- Risk tier: blocking | reversible | incidental
+- Contract tests: tests/contracts/lead-qualification.test.ts · Profiles: authoritative-server
+- Canonical implementation: <via audit proposals>
+- Conforming implementations: <via audit proposals; each with profile + constraint>
+- Consumers: <via audit proposals; method + confidence + blind spots>
+- Decisions/notes: <assumptions, staged-migration expiries, waiver refs>
+- Last audit sync: <date>

package/assets/templates/ci-github.yml

@@ -0,0 +1,36 @@
+name: asdlc
+# CI is the real wall — pre-commit hooks are skippable with --no-verify (playbook S1.4).
+# Never modify this workflow to make a failing check pass; that is a GOVERN operation.
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '0 3 1 * *' # monthly audit (playbook S3 Stage 4) — drift is fractal; keep looking
+jobs:
+  check:
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm ci
+      - run: npx asdlc check
+  audit:
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm ci
+      - run: npx asdlc audit
+      - uses: actions/upload-artifact@v4
+        with:
+          name: asdlc-audit-report
+          path: .asdlc/reports/
+      # The report is evidence for human review. Applying any of its proposals
+      # (baseline accept, waiver renewals) remains a GOVERN operation.

package/assets/templates/dependency-cruiser.starter.cjs

@@ -0,0 +1,23 @@
+/**
+ * STARTER boundary rules — only universally-safe checks are active.
+ * Real boundary rules must be derived from docs/ARCHITECTURE.md after human
+ * review (GOVERN): add `not-reachable-from`/`not-to` rules that encode the
+ * homes and boundaries that document approves. Do not let a tool prescribe
+ * your architecture.
+ */
+module.exports = {
+  forbidden: [
+    {
+      name: 'no-circular',
+      severity: 'error',
+      comment: 'Circular dependencies make consumer sweeps and staged migrations unreliable.',
+      from: {},
+      to: { circular: true },
+    },
+  ],
+  options: {
+    doNotFollow: { path: 'node_modules' },
+    exclude: { path: '\\.(test|spec)\\.[jt]sx?$' },
+    tsPreCompilationDeps: true,
+  },
+};

package/assets/templates/semgrep-example.yml

@@ -0,0 +1,16 @@
+# GOVERNED RATCHET — see playbook S3.4 rule lifecycle; agents draft, humans activate.
+# New rules on an existing repo always start advisory: draft → impact scan →
+# baseline approved existing matches → then block new matches only.
+#
+# This file ships DISABLED (note the .disabled suffix on install). To activate:
+# 1. Write the rule for a divergence class your audit actually found.
+# 2. Add one must-match and one must-not-match fixture beside it.
+# 3. Run the impact scan (asdlc audit), review matches with a human.
+# 4. Rename to .yml — from then on it gates new matches.
+rules:
+  - id: example-raw-error-to-client
+    languages: [ts]
+    severity: WARNING
+    message: Raw provider error returned to client — route it through the shared error mapper.
+    patterns:
+      - pattern: NextResponse.json({ error: $ERR.message }, ...)

package/assets/templates/waivers.yml

@@ -0,0 +1,18 @@
+# Every suppression lives here — inline ignores without a matching waiver fail the
+# registry gate. Agents DRAFT waivers with all fields; a human approves; the agent
+# records the pointer. Expiry ends suppression: the finding turns red until renewed
+# (GOVERN) or fixed.
+#
+# waivers:
+#   - id: W-0001
+#     gate: duplication            # duplication | boundaries | patterns | registry | contracts
+#     scope: src/example/file.ts
+#     fingerprint: "<16-hex fingerprint of the exact finding, from asdlc check output>"
+#     reason: "<why the policy is wrong here>"
+#     approved_by: "<human>"
+#     approval_ref: "<message/PR/decision note pointer>"
+#     approved_on: 2026-01-01
+#     expires_on: 2026-04-01       # permanence requires explicit justification
+#     compensating_control: "<what protects meanwhile>"
+#     retirement_condition: "<what ends this waiver>"
+waivers: []

package/bin/asdlc.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import('../dist/index.js');

package/dist/baseline.js

@@ -0,0 +1,33 @@
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { ASDLC_DIR } from './state.js';
+export function baselinePath(root) {
+    return join(root, ASDLC_DIR, 'baseline.json');
+}
+export function loadBaseline(root) {
+    const p = baselinePath(root);
+    if (!existsSync(p))
+        return new Set();
+    const doc = JSON.parse(readFileSync(p, 'utf8'));
+    return new Set(doc.accepted ?? []);
+}
+export function writeProposedBaseline(root, findings, file) {
+    const doc = { accepted: [...new Set(findings.map((f) => f.fingerprint))].sort() };
+    writeFileSync(file, JSON.stringify(doc, null, 2));
+}
+// Pure evaluation: given raw findings, decide the gate verdict.
+// Greenfield: any unwaived finding fails. Legacy: only NEW (unbaselined, unwaived) fails.
+export function evaluateGate(gate, findings, baseline, waived, mode) {
+    const unwaived = findings.filter((f) => !waived.has(f.fingerprint));
+    const newFindings = mode === 'legacy'
+        ? unwaived.filter((f) => !baseline.has(f.fingerprint))
+        : unwaived;
+    const waivedCount = findings.length - unwaived.length;
+    const baselinedCount = mode === 'legacy'
+        ? unwaived.length - newFindings.length
+        : 0;
+    const status = newFindings.length > 0
+        ? 'FAIL'
+        : findings.length > 0 ? 'PASS_WITH_FINDINGS' : 'PASS';
+    return { gate, status, findings, newFindings, baselined: baselinedCount, waived: waivedCount };
+}

package/dist/commands/audit.js

@@ -0,0 +1,30 @@
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import pc from 'picocolors';
+import { loadConfig } from '../config.js';
+import { runAllGates } from '../runner.js';
+import { renderMarkdownReport, renderResults } from '../report.js';
+import { writeProposedBaseline } from '../baseline.js';
+import { ASDLC_DIR, readState, writeState } from '../state.js';
+// "asdlc audit" — read-only diagnosis (S3 Stage 1 / Stage 4).
+// Writes only reports and a PROPOSED baseline under .asdlc/; applying anything
+// is a separate GOVERN operation with human approval (`asdlc baseline accept`).
+export async function auditCommand(root) {
+    const config = loadConfig(root);
+    const date = new Date().toISOString().slice(0, 10);
+    const results = await runAllGates(root, config);
+    const dir = join(root, ASDLC_DIR, 'reports', date);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, 'audit.md'), renderMarkdownReport(results, date));
+    const allFindings = results.flatMap((r) => r.findings);
+    const proposedPath = join(dir, 'proposed-baseline.json');
+    writeProposedBaseline(root, allFindings, proposedPath);
+    const state = readState(root);
+    if (state)
+        writeState(root, { ...state, last_audit: date });
+    console.log(renderResults(results, false));
+    console.log('');
+    console.log(pc.bold(`Audit written: ${join('.asdlc/reports', date, 'audit.md')}`));
+    console.log(`Proposed baseline (${allFindings.length} findings, PROPOSED_NOT_ACCEPTED): ${join('.asdlc/reports', date, 'proposed-baseline.json')}`);
+    console.log(pc.dim('Accepting it is a GOVERN operation: asdlc baseline accept --from <file> --approved-by <human> --approval-ref <pointer>'));
+}

package/dist/commands/baseline.js

@@ -0,0 +1,26 @@
+import { copyFileSync, existsSync } from 'node:fs';
+import pc from 'picocolors';
+import { baselinePath } from '../baseline.js';
+import { readState, writeState } from '../state.js';
+// GOVERN: accepting a baseline requires a human approval pointer. An agent
+// cannot approve its own governance change (playbook S0) — the CLI enforces
+// the record-keeping; the human enforces the truth of it.
+export function baselineAcceptCommand(root, opts) {
+    if (!opts.from || !existsSync(opts.from)) {
+        console.error(pc.red('Provide --from <proposed-baseline.json> produced by `asdlc audit`.'));
+        process.exitCode = 1;
+        return;
+    }
+    if (!opts.approvedBy || !opts.approvalRef) {
+        console.error(pc.red('Baseline acceptance is a GOVERN operation: --approved-by <human> and --approval-ref <pointer to where approval was given> are required.'));
+        process.exitCode = 1;
+        return;
+    }
+    copyFileSync(opts.from, baselinePath(root));
+    const state = readState(root);
+    if (state) {
+        writeState(root, { ...state, baseline_revision: state.baseline_revision + 1 });
+    }
+    console.log(pc.green(`Baseline accepted (rev ${state ? state.baseline_revision + 1 : '?'}) — approved by ${opts.approvedBy}, ref: ${opts.approvalRef}`));
+    console.log('From here, only NEW findings gate. Burn the baseline down via audits.');
+}

package/dist/commands/check.js

@@ -0,0 +1,29 @@
+import pc from 'picocolors';
+import { readState } from '../state.js';
+import { loadConfig } from '../config.js';
+import { runAllGates, overallExitCode } from '../runner.js';
+import { renderResults } from '../report.js';
+// "asdlc check" — the gate wall. Green (legacy: zero NEW) or not done (S2.6).
+export async function checkCommand(root, opts) {
+    const state = readState(root);
+    if (!state) {
+        console.error(pc.red('No ASDLC install found (.asdlc/state.yml missing). Run `asdlc plan`, then `asdlc init`.'));
+        process.exitCode = 1;
+        return;
+    }
+    if (state.status === 'SUSPENDED') {
+        console.error(pc.yellow('Install is SUSPENDED; checks report but do not gate.'));
+    }
+    const config = loadConfig(root);
+    const results = await runAllGates(root, config);
+    console.log(renderResults(results, opts.verbose ?? false));
+    const code = overallExitCode(results);
+    console.log('');
+    if (code === 0) {
+        console.log(pc.green(`asdlc check: green (mode ${config.mode} — ${config.mode === 'legacy' ? 'zero NEW findings' : 'zero findings'})`));
+    }
+    else {
+        console.log(pc.red('asdlc check: RED. Never weaken a check to pass it — fix the finding, or draft a waiver in .asdlc/waivers.yml and stop for human approval.'));
+    }
+    process.exitCode = state.status === 'SUSPENDED' ? 0 : code;
+}

package/dist/commands/init.js

@@ -0,0 +1,88 @@
+import { mkdirSync, writeFileSync, existsSync, readFileSync, appendFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import pc from 'picocolors';
+import { detectStack } from '../detect.js';
+import { ASDLC_DIR, writeState } from '../state.js';
+import { defaultConfig } from '../config.js';
+import { stringify } from 'yaml';
+const ASSETS = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'assets');
+function writeIfAbsent(path, content) {
+    if (existsSync(path))
+        return false;
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, content);
+    return true;
+}
+const MARKER = '[ANTI-DRIFT CONSTITUTION v3.1.1 — managed section]';
+// "asdlc init" — scaffolds governance. Existing files are never overwritten;
+// AGENTS.md gets the managed section appended under a marker (playbook S1.2).
+export function initCommand(root, opts) {
+    const s = detectStack(root);
+    if (!s.gitRepo) {
+        console.error(pc.red('Refusing to install: not a git repository. Run `git init` first.'));
+        process.exitCode = 1;
+        return;
+    }
+    const mode = opts.mode ?? (s.fileCount > 60 ? 'legacy' : 'greenfield');
+    const created = [];
+    const skipped = [];
+    const track = (path, wrote) => (wrote ? created : skipped).push(path);
+    mkdirSync(join(root, ASDLC_DIR, 'semgrep'), { recursive: true });
+    mkdirSync(join(root, ASDLC_DIR, 'reports'), { recursive: true });
+    const config = { ...defaultConfig(), mode, source_dirs: s.sourceDirs.length > 0 ? s.sourceDirs : ['src'] };
+    track('.asdlc/config.yml', writeIfAbsent(join(root, ASDLC_DIR, 'config.yml'), stringify(config)));
+    track('.asdlc/waivers.yml', writeIfAbsent(join(root, ASDLC_DIR, 'waivers.yml'), readFileSync(join(ASSETS, 'templates', 'waivers.yml'), 'utf8')));
+    track('.asdlc/baseline.json', writeIfAbsent(join(root, ASDLC_DIR, 'baseline.json'), JSON.stringify({ accepted: [] }, null, 2)));
+    for (const [asset, dest] of [
+        ['BUSINESS_RULES.md', 'docs/BUSINESS_RULES.md'],
+        ['ARCHITECTURE.md', 'docs/ARCHITECTURE.md'],
+        ['semgrep-example.yml', '.asdlc/semgrep/example.yml.disabled'],
+        ['dependency-cruiser.starter.cjs', '.dependency-cruiser.cjs'],
+    ]) {
+        track(dest, writeIfAbsent(join(root, dest), readFileSync(join(ASSETS, 'templates', asset), 'utf8')));
+    }
+    // AGENTS.md: create, or merge by appending under the marker — keep all prior instructions.
+    const agentsPath = join(root, 'AGENTS.md');
+    const section = readFileSync(join(ASSETS, 'templates', 'AGENTS_SECTION.md'), 'utf8');
+    if (!existsSync(agentsPath)) {
+        writeFileSync(agentsPath, section);
+        created.push('AGENTS.md');
+    }
+    else if (!readFileSync(agentsPath, 'utf8').includes(MARKER)) {
+        appendFileSync(agentsPath, `\n\n${section}`);
+        created.push('AGENTS.md (managed section appended — review the diff)');
+    }
+    else {
+        skipped.push('AGENTS.md (managed section already present)');
+    }
+    // CI is the real wall — hooks are skippable (S1.4).
+    let ciWired = false;
+    if (s.ci.includes('GitHub Actions') || existsSync(join(root, '.github'))) {
+        ciWired = writeIfAbsent(join(root, '.github', 'workflows', 'asdlc.yml'), readFileSync(join(ASSETS, 'templates', 'ci-github.yml'), 'utf8'));
+        track('.github/workflows/asdlc.yml', ciWired);
+        if (!ciWired)
+            ciWired = true; // workflow already exists
+    }
+    // No CI = setup incomplete → status PARTIAL, reported in bold (S1.4).
+    const status = ciWired ? 'ACTIVE' : 'PARTIAL';
+    writeState(root, {
+        schema_version: 1, playbook_version: '3.1.1', status, mode,
+        config_revision: 1, baseline_revision: 1, last_audit: null,
+    });
+    created.push('.asdlc/state.yml');
+    console.log([
+        pc.bold(`ASDLC installed — status ${status === 'ACTIVE' ? pc.green(status) : pc.bold(pc.yellow(status))}, mode ${mode.toUpperCase()}`),
+        '',
+        'Created:', ...created.map((f) => `  + ${f}`),
+        ...(skipped.length > 0 ? ['Preserved (already existed):', ...skipped.map((f) => `  = ${f}`)] : []),
+        '',
+        status === 'PARTIAL'
+            ? pc.bold(pc.yellow('NO CI DETECTED — pre-commit hooks are skippable; setup is incomplete until a CI runs `asdlc check`.'))
+            : 'CI workflow in place. Merge nothing past a red check.',
+        '',
+        mode === 'legacy'
+            ? 'Legacy mode: run `asdlc audit` next to capture the proposed baseline, review it, then accept with `asdlc baseline accept`.'
+            : 'Greenfield: gates block from the first commit. Run `asdlc check`.',
+    ].join('\n'));
+}

package/dist/commands/plan.js

@@ -0,0 +1,38 @@
+import pc from 'picocolors';
+import { detectStack } from '../detect.js';
+import { readState } from '../state.js';
+import { semgrepAvailable } from '../gates/patterns.js';
+// "asdlc plan" — read-only, always first (playbook S1.0). Mutates nothing.
+export function planCommand(root) {
+    const s = detectStack(root);
+    const state = readState(root);
+    const mode = s.fileCount > 60 ? 'legacy' : 'greenfield';
+    const lines = [
+        pc.bold('ASDLC plan (read-only — nothing has been changed)'),
+        '',
+        `Languages:        ${s.languages.join(', ') || 'none detected'}`,
+        `Package manager:  ${s.packageManager ?? 'none'}`,
+        `Test runner:      ${s.testRunner ?? 'none detected'}`,
+        `CI:               ${s.ci.join(', ') || pc.red('NONE — no CI means setup will be PARTIAL, not ACTIVE')}`,
+        `Agent files:      ${s.agentFiles.join(', ') || 'none'}`,
+        `Source dirs:      ${s.sourceDirs.join(', ') || 'none found'}`,
+        `Repo size:        ~${s.fileCount} files`,
+        `Git repository:   ${s.gitRepo ? 'yes' : pc.red('NO — install requires version control')}`,
+        s.uncommitted !== null && s.uncommitted > 0
+            ? pc.yellow(`Uncommitted:      ${s.uncommitted} changes — these will be preserved, commit them first if possible`)
+            : `Uncommitted:      ${s.uncommitted ?? 'n/a'}`,
+        `Existing install: ${state ? `${state.status} (playbook ${state.playbook_version})` : 'none'}`,
+        '',
+        pc.bold(`Proposed mode: ${mode.toUpperCase()}`),
+        mode === 'legacy'
+            ? '  All gates start baselined/advisory and ratchet to block-new-only (S1.3).'
+            : '  Gates block from day one.',
+        '',
+        'Proposed tools (new dev dependencies on install): jscpd, dependency-cruiser' +
+            (semgrepAvailable() ? '; semgrep found on PATH' : pc.dim('; semgrep NOT found — patterns gate will report ERROR until installed or disabled')),
+        '',
+        pc.bold('Next step: review the above, then run `asdlc init` to install.'),
+        'This tool grants itself no authority: init only proceeds because you, the human, run it.',
+    ];
+    console.log(lines.join('\n'));
+}

package/dist/commands/waiver.js

@@ -0,0 +1,54 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import pc from 'picocolors';
+import { ASDLC_DIR } from '../state.js';
+const GATES = ['duplication', 'boundaries', 'patterns', 'registry', 'contracts'];
+// "asdlc waiver draft" — the agent-side half of the waiver protocol: drafts an
+// entry with every field the agent can honestly fill, and leaves approved_by /
+// approval_ref EMPTY. An incomplete waiver is malformed, so the registry gate
+// flags it red until a human fills in the approval — "draft and stop for
+// approval" enforced by construction, not by convention.
+export function waiverDraftCommand(root, opts) {
+    if (!opts.fingerprint || !opts.gate || !opts.scope || !opts.reason) {
+        console.error(pc.red('Required: --fingerprint <16-hex from check output> --gate <gate> --scope <path> --reason "<why the policy is wrong here>"'));
+        process.exitCode = 1;
+        return;
+    }
+    if (!GATES.includes(opts.gate)) {
+        console.error(pc.red(`--gate must be one of: ${GATES.join(', ')}`));
+        process.exitCode = 1;
+        return;
+    }
+    const path = join(root, ASDLC_DIR, 'waivers.yml');
+    mkdirSync(dirname(path), { recursive: true });
+    const existing = existsSync(path) ? readFileSync(path, 'utf8') : 'waivers: []\n';
+    const ids = [...existing.matchAll(/id:\s*W-(\d+)/g)].map((m) => Number(m[1]));
+    const nextId = `W-${String((ids.length > 0 ? Math.max(...ids) : 0) + 1).padStart(4, '0')}`;
+    const days = Number(opts.expiresInDays ?? 90);
+    const expires = new Date(Date.now() + days * 86_400_000).toISOString().slice(0, 10);
+    const block = [
+        `  - id: ${nextId}`,
+        `    gate: ${opts.gate}`,
+        `    scope: ${opts.scope}`,
+        `    fingerprint: "${opts.fingerprint}"`,
+        `    reason: "${opts.reason.replace(/"/g, '\\"')}"`,
+        `    approved_by: ""            # HUMAN: fill in`,
+        `    approval_ref: ""           # HUMAN: pointer to where approval was given`,
+        `    approved_on: ""            # HUMAN: YYYY-MM-DD`,
+        `    expires_on: ${expires}`,
+        `    compensating_control: ""`,
+        `    retirement_condition: ""`,
+        '',
+    ].join('\n');
+    // String-level append preserves the file's instructional comments.
+    const updated = /waivers:\s*\[\]/.test(existing)
+        ? existing.replace(/waivers:\s*\[\]/, `waivers:\n${block}`)
+        : `${existing.trimEnd()}\n${block}`;
+    writeFileSync(path, updated);
+    console.log([
+        pc.green(`Draft waiver ${nextId} written to .asdlc/waivers.yml (expires ${expires}).`),
+        pc.bold(pc.yellow('It is NOT active: approved_by / approval_ref / approved_on are empty,')),
+        pc.yellow('so the registry gate will flag it as malformed until a human fills them in.'),
+        'This is the protocol: agents draft, humans approve, the approval leaves a pointer.',
+    ].join('\n'));
+}

package/dist/config.js

@@ -0,0 +1,47 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+import { ASDLC_DIR } from './state.js';
+// Playbook S1.3 default excludes: node_modules, dist/build, tests, migrations,
+// generated, vendor, lockfiles. Tests are excluded from clone detection —
+// test boilerplate similarity is not business-rule drift.
+export const DEFAULT_EXCLUDES = [
+    '**/node_modules/**', '**/dist/**', '**/build/**', '**/.next/**',
+    '**/coverage/**', '**/vendor/**', '**/*.min.*', '**/generated/**',
+    '**/migrations/**', '**/*.lock', '**/package-lock.json', '**/.asdlc/**',
+    '**/*.test.*', '**/*.spec.*', '**/__tests__/**', '**/tests/**', '**/test/**',
+    '**/*.stories.*', '**/__mocks__/**', '**/fixtures/**',
+];
+export function defaultConfig() {
+    return {
+        mode: 'legacy',
+        gates: {
+            duplication: { enabled: true },
+            boundaries: { enabled: true },
+            patterns: { enabled: true },
+            registry: { enabled: true },
+            contracts: { enabled: false },
+        },
+        source_dirs: ['src'],
+        min_tokens: 60,
+        exclude: DEFAULT_EXCLUDES,
+        registry_path: 'docs/BUSINESS_RULES.md',
+        architecture_path: 'docs/ARCHITECTURE.md',
+        contracts_command: null,
+        semgrep_rules_dir: '.asdlc/semgrep',
+    };
+}
+export function loadConfig(root) {
+    const p = join(root, ASDLC_DIR, 'config.yml');
+    const base = defaultConfig();
+    if (!existsSync(p))
+        return base;
+    const raw = (parse(readFileSync(p, 'utf8')) ?? {});
+    return {
+        ...base,
+        ...raw,
+        gates: { ...base.gates, ...(raw.gates ?? {}) },
+        exclude: raw.exclude ?? base.exclude,
+        source_dirs: raw.source_dirs ?? base.source_dirs,
+    };
+}

package/dist/detect.js

@@ -0,0 +1,61 @@
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+export function detectStack(root) {
+    const has = (p) => existsSync(join(root, p));
+    const pkg = has('package.json')
+        ? JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')) : null;
+    const deps = { ...(pkg?.dependencies ?? {}), ...(pkg?.devDependencies ?? {}) };
+    const languages = [];
+    if (pkg)
+        languages.push(has('tsconfig.json') ? 'TypeScript' : 'JavaScript');
+    if (has('pyproject.toml') || has('requirements.txt'))
+        languages.push('Python');
+    if (has('go.mod'))
+        languages.push('Go');
+    if (has('Cargo.toml'))
+        languages.push('Rust');
+    const packageManager = has('pnpm-lock.yaml') ? 'pnpm' :
+        has('yarn.lock') ? 'yarn' :
+            has('package-lock.json') ? 'npm' :
+                has('bun.lockb') || has('bun.lock') ? 'bun' : null;
+    const testRunner = deps['vitest'] ? 'vitest' :
+        deps['jest'] ? 'jest' :
+            deps['mocha'] ? 'mocha' :
+                has('pytest.ini') || has('pyproject.toml') ? null : null;
+    const ci = [];
+    if (has('.github/workflows'))
+        ci.push('GitHub Actions');
+    if (has('.gitlab-ci.yml'))
+        ci.push('GitLab CI');
+    if (has('.circleci'))
+        ci.push('CircleCI');
+    const agentFiles = ['AGENTS.md', 'CLAUDE.md', '.cursorrules', 'CODEOWNERS', '.github/CODEOWNERS']
+        .filter(has);
+    const sourceDirs = ['src', 'app', 'lib', 'packages'].filter((d) => has(d));
+    let fileCount = 0;
+    const count = (dir, depth) => {
+        if (depth > 6)
+            return;
+        for (const e of readdirSync(dir, { withFileTypes: true })) {
+            if (e.name === 'node_modules' || e.name.startsWith('.'))
+                continue;
+            if (e.isDirectory())
+                count(join(dir, e.name), depth + 1);
+            else
+                fileCount += 1;
+        }
+    };
+    try {
+        count(root, 0);
+    }
+    catch { /* unreadable areas don't crash detection */ }
+    const gitRepo = has('.git');
+    let uncommitted = null;
+    if (gitRepo) {
+        const res = spawnSync('git', ['status', '--porcelain'], { cwd: root, encoding: 'utf8' });
+        if (res.status === 0)
+            uncommitted = res.stdout.split('\n').filter(Boolean).length;
+    }
+    return { languages, packageManager, testRunner, ci, agentFiles, sourceDirs, fileCount, uncommitted, gitRepo };
+}

package/dist/fingerprint.js

@@ -0,0 +1,27 @@
+import { createHash } from 'node:crypto';
+// Fingerprints are gate:rule:path:symbol — deliberately line-independent so
+// edits elsewhere in a file don't churn baselines or waivers (playbook S1.3).
+export function fingerprint(gate, rule, path, symbol) {
+    const key = [gate, rule, normalizePath(path), symbol].join(':');
+    return createHash('sha256').update(key).digest('hex').slice(0, 16);
+}
+export function normalizePath(p) {
+    return p.replace(/\\/g, '/').replace(/^\.\//, '');
+}
+// Whitespace-normalized content hash: stable when code moves, changes when the
+// code itself changes — used to keep distinct matches from sharing a fingerprint.
+export function contentHash(text) {
+    return createHash('sha256').update(text.replace(/\s+/g, ' ').trim()).digest('hex').slice(0, 8);
+}
+// Deterministic disambiguation for otherwise-identical findings: first
+// occurrence keeps the base symbol, repeats get #1, #2, … so a NEW identical
+// match can never hide behind a baselined or waived one.
+export function occurrence(counts, base) {
+    const n = counts.get(base) ?? 0;
+    counts.set(base, n + 1);
+    return n === 0 ? base : `${base}#${n}`;
+}
+export function makeFinding(gate, rule, path, symbol, message) {
+    return { gate, rule, path: normalizePath(path), symbol, message,
+        fingerprint: fingerprint(gate, rule, path, symbol) };
+}

package/dist/gates/boundaries.js

@@ -0,0 +1,29 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { makeFinding } from '../fingerprint.js';
+// G2 — architecture boundaries via dependency-cruiser's programmatic API.
+// Rules come from the repo's own .dependency-cruiser.cjs (written by `asdlc init`
+// from ARCHITECTURE.md review — never invented by the tool). No rules file means
+// the gate cannot express an opinion: the caller reports SKIPPED, not PASS.
+export async function runBoundariesGate(root, config) {
+    const ruleFile = ['.dependency-cruiser.cjs', '.dependency-cruiser.js', '.dependency-cruiser.json']
+        .map((f) => join(root, f))
+        .find((f) => existsSync(f));
+    if (!ruleFile)
+        return 'UNCONFIGURED';
+    const { cruise } = await import('dependency-cruiser');
+    const extract = await import('dependency-cruiser/config-utl/extract-depcruise-config');
+    const ruleSet = await (extract.default ?? extract)(ruleFile);
+    const dirs = config.source_dirs.filter((d) => existsSync(join(root, d)));
+    const prevCwd = process.cwd();
+    process.chdir(root);
+    try {
+        const result = await cruise(dirs, { ruleSet, validate: true, outputType: 'json' });
+        const output = typeof result.output === 'string' ? JSON.parse(result.output) : result.output;
+        const violations = (output.summary?.violations ?? []);
+        return violations.map((v) => makeFinding('boundaries', v.rule.name, v.from, v.to, `${v.rule.name}: ${v.from} → ${v.to}`));
+    }
+    finally {
+        process.chdir(prevCwd);
+    }
+}

package/dist/gates/contracts.js

@@ -0,0 +1,29 @@
+import { spawnSync } from 'node:child_process';
+import { makeFinding } from '../fingerprint.js';
+// Tokenize a command string without a shell: whitespace-split with double/single
+// quote grouping. No metacharacter interpretation — config cannot smuggle
+// `;`/`&&`/backticks into a shell (defense-in-depth; config is GOVERN-owned).
+export function tokenizeCommand(command) {
+    const tokens = command.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+    return tokens.map((t) => t.replace(/^(["'])(.*)\1$/, '$2'));
+}
+// G5 — contract-profile suites. ASDLC does not own test semantics; it runs the
+// repo's configured contract command (e.g. "npm test -- tests/contracts") and
+// translates a failure into a finding. Unconfigured → SKIPPED, never PASS.
+export function runContractsGate(root, config) {
+    if (!config.contracts_command)
+        return 'UNCONFIGURED';
+    const [cmd, ...args] = tokenizeCommand(config.contracts_command);
+    if (!cmd)
+        return 'UNCONFIGURED';
+    const res = spawnSync(cmd, args, {
+        cwd: root, shell: false, encoding: 'utf8', timeout: 900_000,
+    });
+    if (res.error || res.status === null) {
+        throw new Error(`contract suite could not run: ${res.error?.message ?? res.stderr?.slice(0, 400)}`);
+    }
+    if (res.status !== 0) {
+        return [makeFinding('contracts', 'contract-suite-failed', 'tests/contracts', '-', `Contract command exited ${res.status}. Tail: ${(res.stdout + res.stderr).slice(-500)}`)];
+    }
+    return [];
+}

package/dist/gates/duplication.js

@@ -0,0 +1,55 @@
+import { spawnSync } from 'node:child_process';
+import { readFileSync, mkdtempSync, existsSync, rmSync } from 'node:fs';
+import { join, dirname, basename } from 'node:path';
+import { tmpdir } from 'node:os';
+import { createRequire } from 'node:module';
+import { makeFinding, contentHash, occurrence } from '../fingerprint.js';
+// jscpd's exports map blocks package.json resolution and its ESM entry is
+// broken on Node >= 22, so locate the package root by walking up from the
+// resolved entry (path-separator agnostic) and drive the stable CLI binary.
+function resolveJscpdBin() {
+    const require = createRequire(import.meta.url);
+    let dir = dirname(require.resolve('jscpd'));
+    while (basename(dir) !== 'jscpd' && dirname(dir) !== dir)
+        dir = dirname(dir);
+    const bin = join(dir, 'bin', 'jscpd');
+    if (basename(dir) !== 'jscpd' || !existsSync(bin)) {
+        throw new Error(`jscpd binary not found (searched from ${dir})`);
+    }
+    return bin;
+}
+// G1 — clone detection via jscpd (open-source, wrapped not rewritten).
+// Returns findings or throws; the caller maps a throw to ERROR, never PASS.
+export function runDuplicationGate(root, config) {
+    const bin = resolveJscpdBin();
+    const out = mkdtempSync(join(tmpdir(), 'asdlc-jscpd-'));
+    try {
+        const args = [
+            bin,
+            ...config.source_dirs.filter((d) => existsSync(join(root, d))),
+            '--reporters', 'json',
+            '--output', out,
+            '--min-tokens', String(config.min_tokens),
+            '--silent',
+            '--ignore', config.exclude.join(','),
+        ];
+        const res = spawnSync(process.execPath, args, { cwd: root, encoding: 'utf8', timeout: 300_000 });
+        const reportPath = join(out, 'jscpd-report.json');
+        if (!existsSync(reportPath)) {
+            throw new Error(`jscpd produced no report (exit ${res.status}): ${res.stderr?.slice(0, 400)}`);
+        }
+        const report = JSON.parse(readFileSync(reportPath, 'utf8'));
+        // Distinct clone groups between the same file pair must not share a
+        // fingerprint (a new clone would pass as baselined): identity includes a
+        // hash of the cloned fragment, with deterministic #n suffixes as backstop.
+        const counts = new Map();
+        return (report.duplicates ?? []).map((d) => {
+            const [a, b] = [d.firstFile.name, d.secondFile.name].sort();
+            const frag = contentHash(d.fragment ?? `${d.lines}:${d.tokens}`);
+            return makeFinding('duplication', 'clone', a, occurrence(counts, `${b}@${frag}`), `${d.lines}-line clone shared with ${b}`);
+        });
+    }
+    finally {
+        rmSync(out, { recursive: true, force: true });
+    }
+}

package/dist/gates/registry.js

@@ -0,0 +1,41 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { makeFinding } from '../fingerprint.js';
+import { loadWaivers } from '../waivers.js';
+// G4 — registry + waiver validation.
+// The registry (docs/BUSINESS_RULES.md) is human-authored markdown; this gate
+// checks structure and referential integrity, never meaning:
+//  - registry file exists and has at least one concept section
+//  - every `backtick/path` reference under a concept resolves in the repo
+//  - waivers are well-formed; expired waivers surface as findings (suppression ended)
+export function runRegistryGate(root, config) {
+    const findings = [];
+    const regPath = join(root, config.registry_path);
+    if (!existsSync(regPath)) {
+        findings.push(makeFinding('registry', 'registry-missing', config.registry_path, '-', `Registry not found at ${config.registry_path}`));
+    }
+    else {
+        const text = readFileSync(regPath, 'utf8');
+        const concepts = text.match(/^##\s+.+$/gm) ?? [];
+        if (concepts.length === 0) {
+            findings.push(makeFinding('registry', 'registry-empty', config.registry_path, '-', 'Registry has no concept sections (## <Concept>)'));
+        }
+        const pathRefs = [...text.matchAll(/`((?:src|tests|docs|supabase|packages|lib|app)\/[^`\s]+)`/g)]
+            .map((m) => m[1]);
+        for (const ref of new Set(pathRefs)) {
+            const bare = ref.split(':')[0];
+            if (!existsSync(join(root, bare))) {
+                findings.push(makeFinding('registry', 'dangling-path', config.registry_path, bare, `Registry references ${bare}, which does not exist`));
+            }
+        }
+    }
+    const waivers = loadWaivers(root);
+    for (const m of waivers.malformed) {
+        const id = m.entry?.id ?? 'unknown';
+        findings.push(makeFinding('registry', 'waiver-malformed', '.asdlc/waivers.yml', id, `Waiver ${id} missing required fields: ${m.missing.join(', ')}`));
+    }
+    for (const w of waivers.expired) {
+        findings.push(makeFinding('registry', 'waiver-expired', '.asdlc/waivers.yml', w.id, `Waiver ${w.id} expired ${w.expires_on}; its finding is no longer suppressed`));
+    }
+    return findings;
+}

package/dist/index.js

@@ -0,0 +1,43 @@
+import { Command } from 'commander';
+import { planCommand } from './commands/plan.js';
+import { initCommand } from './commands/init.js';
+import { checkCommand } from './commands/check.js';
+import { auditCommand } from './commands/audit.js';
+import { baselineAcceptCommand } from './commands/baseline.js';
+import { waiverDraftCommand } from './commands/waiver.js';
+const program = new Command();
+program
+    .name('asdlc')
+    .description('ASDLC — anti-drift governance for AI-built codebases (Anti-Drift Playbook v3.1.1)')
+    .version('0.1.0');
+program.command('plan')
+    .description('Read-only: detect the stack and propose an install plan. Changes nothing.')
+    .action(() => planCommand(process.cwd()));
+program.command('init')
+    .description('Install governance: .asdlc/, registry templates, AGENTS.md section, CI workflow.')
+    .option('--mode <mode>', 'greenfield | legacy (default: auto-detect)')
+    .action((opts) => initCommand(process.cwd(), { mode: opts.mode }));
+program.command('check')
+    .description('Run all gates. Exit 0 only when green (legacy: zero NEW findings). ERROR never passes.')
+    .option('-v, --verbose', 'show all new findings')
+    .action((opts) => checkCommand(process.cwd(), opts));
+program.command('audit')
+    .description('Read-only diagnosis: full gate sweep, markdown report, PROPOSED baseline.')
+    .action(() => auditCommand(process.cwd()));
+const baseline = program.command('baseline').description('Baseline governance (GOVERN operations).');
+baseline.command('accept')
+    .description('Accept a proposed baseline. Requires a human approval pointer.')
+    .option('--from <file>', 'proposed-baseline.json from an audit')
+    .option('--approved-by <human>', 'the approving human')
+    .option('--approval-ref <ref>', 'pointer to where approval was given (message/PR/decision note)')
+    .action((opts) => baselineAcceptCommand(process.cwd(), opts));
+const waiver = program.command('waiver').description('Waiver protocol: agents draft, humans approve.');
+waiver.command('draft')
+    .description('Draft a waiver for a finding. It stays inactive (and flagged) until a human fills the approval fields.')
+    .option('--fingerprint <fp>', 'the 16-hex fingerprint from check output')
+    .option('--gate <gate>', 'duplication | boundaries | patterns | registry | contracts')
+    .option('--scope <path>', 'file or area the finding is in')
+    .option('--reason <text>', 'why the policy is wrong here')
+    .option('--expires-in-days <n>', 'days until expiry (default 90)')
+    .action((opts) => waiverDraftCommand(process.cwd(), opts));
+program.parseAsync(process.argv);

package/dist/report.js

@@ -0,0 +1,47 @@
+import pc from 'picocolors';
+const ICON = {
+    PASS: pc.green('PASS'),
+    PASS_WITH_FINDINGS: pc.yellow('PASS*'),
+    FAIL: pc.red('FAIL'),
+    ERROR: pc.red('ERROR'),
+    SKIPPED: pc.dim('SKIP'),
+};
+export function renderResults(results, verbose) {
+    const lines = [];
+    for (const r of results) {
+        const counts = r.findings.length > 0 || r.baselined > 0 || r.waived > 0
+            ? pc.dim(` (${r.newFindings.length} new, ${r.baselined} baselined, ${r.waived} waived)`)
+            : '';
+        lines.push(`${ICON[r.status].padEnd(14)} ${r.gate}${counts}${r.error ? pc.red(` — ${r.error}`) : ''}${r.detail ? pc.dim(` — ${r.detail}`) : ''}`);
+        const shown = verbose ? r.newFindings : r.newFindings.slice(0, 10);
+        for (const f of shown) {
+            lines.push(pc.dim(`    [${f.fingerprint}] ${f.rule}: ${f.path} — ${f.message}`));
+        }
+        if (!verbose && r.newFindings.length > 10) {
+            lines.push(pc.dim(`    … ${r.newFindings.length - 10} more (use --verbose)`));
+        }
+    }
+    return lines.join('\n');
+}
+export function renderMarkdownReport(results, date) {
+    const rows = results.map((r) => `| ${r.gate} | ${r.status} | ${r.findings.length} | ${r.newFindings.length} | ${r.baselined} | ${r.waived} |${r.error ?? r.detail ?? ''}|`);
+    const details = results.flatMap((r) => r.newFindings.map((f) => `- \`${f.fingerprint}\` **${r.gate}/${f.rule}** ${f.path} — ${f.message}`));
+    return [
+        `# ASDLC audit — ${date}`,
+        '',
+        'Raw scanner results are evidence for review, not proof of a product defect.',
+        '',
+        '| Gate | Status | Findings | New | Baselined | Waived | Note |',
+        '| --- | --- | ---: | ---: | ---: | ---: | --- |',
+        ...rows,
+        '',
+        '## New findings',
+        ...(details.length > 0 ? details : ['None.']),
+        '',
+        '## Blind spots (standing)',
+        '- Clone detection finds textual similarity, not semantic equivalence.',
+        '- Boundary checks prove only what the approved rules express.',
+        '- Import-orphan analysis cannot see business orphans (imported but unconsumed).',
+        '- Consumer discovery is evidence, not completeness.',
+    ].join('\n');
+}

package/dist/runner.js

@@ -0,0 +1,50 @@
+import { loadBaseline, evaluateGate } from './baseline.js';
+import { loadWaivers, activeWaiverFingerprints } from './waivers.js';
+import { runDuplicationGate } from './gates/duplication.js';
+import { runBoundariesGate } from './gates/boundaries.js';
+import { runPatternsGate } from './gates/patterns.js';
+import { runRegistryGate } from './gates/registry.js';
+import { runContractsGate } from './gates/contracts.js';
+export async function runAllGates(root, config, overrides) {
+    const baseline = loadBaseline(root);
+    const waivers = activeWaiverFingerprints(loadWaivers(root));
+    const collectors = {
+        duplication: async () => runDuplicationGate(root, config),
+        boundaries: () => runBoundariesGate(root, config),
+        patterns: async () => runPatternsGate(root, config),
+        registry: async () => runRegistryGate(root, config),
+        contracts: async () => runContractsGate(root, config),
+        ...overrides,
+    };
+    const results = [];
+    for (const gate of Object.keys(collectors)) {
+        if (!config.gates[gate]?.enabled) {
+            results.push({ gate, status: 'SKIPPED', findings: [], newFindings: [],
+                baselined: 0, waived: 0, detail: 'disabled in .asdlc/config.yml' });
+            continue;
+        }
+        try {
+            const out = await collectors[gate]();
+            if (out === 'UNCONFIGURED') {
+                results.push({ gate, status: 'SKIPPED', findings: [], newFindings: [],
+                    baselined: 0, waived: 0, detail: 'not configured — SKIPPED is not PASS' });
+            }
+            else if (out === 'TOOL_MISSING') {
+                // Enabled but tool absent: the check cannot run, so it reports ERROR, never PASS.
+                results.push({ gate, status: 'ERROR', findings: [], newFindings: [],
+                    baselined: 0, waived: 0, error: 'scanner not installed (e.g. semgrep missing from PATH)' });
+            }
+            else {
+                results.push(evaluateGate(gate, out, baseline, waivers, config.mode));
+            }
+        }
+        catch (err) {
+            results.push({ gate, status: 'ERROR', findings: [], newFindings: [],
+                baselined: 0, waived: 0, error: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    return results;
+}
+export function overallExitCode(results) {
+    return results.some((r) => r.status === 'FAIL' || r.status === 'ERROR') ? 1 : 0;
+}

package/dist/state.js

@@ -0,0 +1,29 @@
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse, stringify } from 'yaml';
+export const ASDLC_DIR = '.asdlc';
+export function statePath(root) {
+    return join(root, ASDLC_DIR, 'state.yml');
+}
+export function readState(root) {
+    const p = statePath(root);
+    if (!existsSync(p))
+        return null;
+    const raw = parse(readFileSync(p, 'utf8'));
+    if (!raw || typeof raw !== 'object')
+        return null;
+    // Marker presence alone is not installation (S0): an unreadable or
+    // incomplete state file is PARTIAL, never assumed ACTIVE.
+    return {
+        schema_version: raw.schema_version ?? 1,
+        playbook_version: raw.playbook_version ?? '3.1.1',
+        status: raw.status ?? 'PARTIAL',
+        mode: raw.mode ?? 'legacy',
+        config_revision: raw.config_revision ?? 1,
+        baseline_revision: raw.baseline_revision ?? 1,
+        last_audit: raw.last_audit ?? null,
+    };
+}
+export function writeState(root, state) {
+    writeFileSync(statePath(root), stringify(state));
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/dist/waivers.js

@@ -0,0 +1,32 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+import { ASDLC_DIR } from './state.js';
+const REQUIRED = [
+    'id', 'gate', 'scope', 'fingerprint', 'reason',
+    'approved_by', 'approval_ref', 'approved_on', 'expires_on',
+];
+export function loadWaivers(root, today = new Date()) {
+    const p = join(root, ASDLC_DIR, 'waivers.yml');
+    const result = { valid: [], expired: [], malformed: [] };
+    if (!existsSync(p))
+        return result;
+    const doc = parse(readFileSync(p, 'utf8'));
+    for (const entry of doc?.waivers ?? []) {
+        const w = entry;
+        const missing = REQUIRED.filter((k) => !w[k] || String(w[k]).trim() === '');
+        if (missing.length > 0) {
+            result.malformed.push({ entry, missing });
+            continue;
+        }
+        // Expiry ends suppression: the finding turns red until renewed or fixed (SW).
+        if (new Date(w.expires_on) < today)
+            result.expired.push(w);
+        else
+            result.valid.push(w);
+    }
+    return result;
+}
+export function activeWaiverFingerprints(check) {
+    return new Set(check.valid.map((w) => w.fingerprint));
+}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "asdlc-cli",
+  "version": "0.1.0",
+  "description": "ASDLC — the anti-drift governance layer for AI-built codebases. Implements the Anti-Drift Playbook v3.1.1 protocol: plan, init, check, audit.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "repository": { "type": "git", "url": "git+https://github.com/chennurivarun/asdlc.git", "directory": "packages/cli" },
+  "homepage": "https://github.com/chennurivarun/asdlc#readme",
+  "bugs": { "url": "https://github.com/chennurivarun/asdlc/issues" },
+  "keywords": ["ai", "coding-agents", "code-quality", "governance", "drift", "duplication", "architecture", "ci", "claude-code", "cursor", "sdlc"],
+  "bin": { "asdlc": "./bin/asdlc.js" },
+  "files": ["dist", "bin", "assets"],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsx src/index.ts",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "engines": { "node": ">=20" },
+  "dependencies": {
+    "commander": "^12.1.0",
+    "dependency-cruiser": "^16.10.0",
+    "jscpd": "^4.0.5",
+    "picocolors": "^1.1.1",
+    "yaml": "^2.6.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vitest": "^2.1.0"
+  }
+}