azcodr 2.3.0 → 2.5.1

package/.agents/hooks.json

@@ -14,6 +14,21 @@
       }
     ]
   },
+  "architectural-guard": {
+    "enabled": false,
+    "PreToolUse": [
+      {
+        "matcher": "run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./.agents/scripts/agent_guard.js",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  },
   "post-tool-lint": {
     "enabled": false,
     "PostToolUse": [

package/.agents/hooks.json.example

@@ -14,6 +14,21 @@
       }
     ]
   },
+  "architectural-guard": {
+    "enabled": false,
+    "PreToolUse": [
+      {
+        "matcher": "run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./.agents/scripts/agent_guard.js",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  },
   "post-tool-lint": {
     "enabled": false,
     "PostToolUse": [

package/.agents/lib/agent-guard-command.js

@@ -0,0 +1,103 @@
+/**
+ * Command safety guard inspecting shell commands against a destructive denylist.
+ */
+export const DESTRUCTIVE_RULES = [
+    {
+        pattern: /\brm\s+(-[a-z-]*[rf][a-z-]*\s+)+(\/|\/\*|~|~\/\*|\$home|\$\{home\}|\.|\.\.|\.\/|[a-z]:\\|[a-z]:\/)/i,
+        reason: 'destructive rm targeting root, home, drive, or the current directory'
+    },
+    {
+        pattern: /(^|\s)rm\s+(-[a-z-]*\s+)*(\/|~|[a-z]:\\|[a-z]:\/)($|\s)/i,
+        reason: 'destructive rm targeting root or home'
+    },
+    {
+        pattern: /\brm\s+--recursive.*--force\s+(\/|~|\$home|\.)/i,
+        reason: 'destructive rm using long-form flags'
+    },
+    {
+        pattern: /\brm\s+.*--no-preserve-root/i,
+        reason: 'rm --no-preserve-root is forbidden under agent execution'
+    },
+    {
+        pattern: /\b(wipefs\s+-a|shred\s+-u|find\s+.*-delete)\b/i,
+        reason: 'irreversible disk or mass-delete operation'
+    },
+    {
+        pattern: /\bgit\s+push\s+.*(-f|--force|--mirror)\b/i,
+        reason: 'force-push or mirror-push can destroy remote history'
+    },
+    {
+        pattern: /\bgit\s+push\b.*--force-with-lease\b/i,
+        reason: 'force-push variant detected'
+    },
+    {
+        pattern: /\bgit\s+(reset\s+--hard|clean\s+-[a-z]*[fd])/i,
+        reason: 'destructive git worktree operation (reset --hard / clean)'
+    },
+    {
+        pattern: /\bgit\s+checkout\s+--\s+\./i,
+        reason: 'git checkout -- . discards all uncommitted work'
+    },
+    {
+        pattern: /\bgit\s+branch\s+-D\b/i,
+        reason: 'force branch delete'
+    },
+    {
+        pattern: /\b(drop\s+(database|schema|table)|truncate\s+(table\s+)?[a-z_])/i,
+        reason: 'destructive SQL DDL'
+    },
+    {
+        pattern: /\b(delete\s+from|update\s+[a-z_]+\s+set|alter\s+table)\b/i,
+        reason: 'destructive SQL DML'
+    },
+    {
+        pattern: /\b(grant\s+all|revoke\s+all)\b/i,
+        reason: 'privilege escalation in SQL'
+    },
+    {
+        pattern: /\b(mkfs|dd\s+if=|fdisk|parted\s+\/dev)\b/i,
+        reason: 'raw disk operation'
+    },
+    {
+        pattern: /(:[\s]*\([\s]*\)[\s]*\{|:[\s]*\|[\s]*:)/,
+        reason: 'fork bomb'
+    },
+    {
+        pattern: /\b(curl|wget)\s+.*\|\s*(sudo\s+)?(ba)?sh\b/i,
+        reason: 'piping download directly into shell execution'
+    },
+    {
+        pattern: /\b(base64\s+-d|base64\s+--decode)\s+.*\|/i,
+        reason: 'decoding encoded payload into a pipe'
+    },
+    {
+        pattern: /\b(npm|yarn|pnpm)\s+publish\b/i,
+        reason: 'package publish must run via release workflow, not ad-hoc tool call'
+    }
+];
+export function normalizeCommand(raw) {
+    return raw.replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim();
+}
+/**
+ * Checks a command string against the safety denylist.
+ *
+ * @param command - Raw shell command string.
+ * @returns Violation details if blocked, or clean outcome.
+ */
+export function inspectCommand(command) {
+    const normalized = normalizeCommand(command);
+    if (!normalized)
+        return { blocked: false };
+    for (const rule of DESTRUCTIVE_RULES) {
+        if (rule.pattern.test(normalized)) {
+            return {
+                blocked: true,
+                reason: rule.reason,
+                command: normalized.slice(0, 300)
+            };
+        }
+    }
+    return { blocked: false, command: normalized };
+}
+export default { DESTRUCTIVE_RULES, normalizeCommand, inspectCommand };
+//# sourceMappingURL=agent-guard-command.js.map

package/.agents/lib/agent-guard-file.js

@@ -0,0 +1,77 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const DEFAULT_MAX_FILE_LINES = 300;
+export function countLines(text) {
+    if (!text)
+        return 0;
+    return text.split('\n').length;
+}
+export function readExistingLines(filePath) {
+    if (!fs.existsSync(filePath))
+        return 0;
+    try {
+        const content = fs.readFileSync(filePath, 'utf-8');
+        return countLines(content);
+    }
+    catch {
+        return 0;
+    }
+}
+function calculateProjectedLines(currentLines, input) {
+    if (input.incomingContent !== undefined) {
+        return countLines(input.incomingContent);
+    }
+    if (input.replacementContent !== undefined) {
+        const addedLines = countLines(input.replacementContent);
+        const removedLines = input.targetContent !== undefined ? countLines(input.targetContent) : 1;
+        return Math.max(0, currentLines + addedLines - removedLines);
+    }
+    return currentLines;
+}
+function evaluateLineThresholds(params) {
+    const { filePath, currentLines, projectedLines, maxLines } = params;
+    const base = { currentLines, projectedLines, maxLines };
+    const relPath = path.basename(filePath);
+    if (currentLines > maxLines) {
+        if (projectedLines >= currentLines) {
+            return {
+                ...base,
+                blocked: true,
+                reason: `Refactor-Before-Add violation: '${relPath}' currently has ${currentLines} lines (limit: ${maxLines}). Adding or maintaining lines in an overflowing file is blocked. Refactor into modular units under green tests first.`
+            };
+        }
+        return { ...base, blocked: false };
+    }
+    if (projectedLines > maxLines) {
+        return {
+            ...base,
+            blocked: true,
+            reason: `File line budget exceeded: '${relPath}' would grow to ${projectedLines} lines (limit: ${maxLines}). Decompose into modular components before appending more code.`
+        };
+    }
+    return { ...base, blocked: false };
+}
+/**
+ * Checks a proposed file write or edit against Refactor-Before-Add rules.
+ *
+ * @param input - File path and proposed content.
+ * @returns Decision result indicating whether the write is blocked.
+ */
+export function inspectFileWrite(input) {
+    const maxLines = input.maxLines ?? DEFAULT_MAX_FILE_LINES;
+    const currentLines = readExistingLines(input.filePath);
+    const projectedLines = calculateProjectedLines(currentLines, input);
+    return evaluateLineThresholds({
+        filePath: input.filePath,
+        currentLines,
+        projectedLines,
+        maxLines
+    });
+}
+export default {
+    DEFAULT_MAX_FILE_LINES,
+    countLines,
+    readExistingLines,
+    inspectFileWrite
+};
+//# sourceMappingURL=agent-guard-file.js.map

package/.agents/lib/agent-guard-tdd.js

@@ -0,0 +1,77 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export function isTestFile(filePath) {
+    const norm = filePath.replace(/\\/g, '/').toLowerCase();
+    if (/(^|\/)(tests?|__tests__)(\/|$)/i.test(norm)) {
+        return true;
+    }
+    return /\.(test|spec)\.[a-z0-9]+$/i.test(norm);
+}
+export function isNonCodeFile(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    const nonCodeExts = new Set(['.md', '.json', '.yml', '.yaml', '.txt', '.toml', '.lock', '.svg', '.png']);
+    return nonCodeExts.has(ext);
+}
+export function isProductionFile(filePath) {
+    if (isNonCodeFile(filePath))
+        return false;
+    if (isTestFile(filePath))
+        return false;
+    const norm = filePath.replace(/\\/g, '/').toLowerCase();
+    return norm.includes('src/') || norm.includes('lib/') || norm.includes('app/');
+}
+export function readTddState(stateFile) {
+    if (!fs.existsSync(stateFile)) {
+        return { lastFailingTestRecorded: false };
+    }
+    try {
+        const raw = fs.readFileSync(stateFile, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return { lastFailingTestRecorded: false };
+    }
+}
+export function writeTddState(stateFile, state) {
+    try {
+        const dir = path.dirname(stateFile);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf-8');
+    }
+    catch {
+        // Fail-safe write: do not crash agent if state cannot be persisted
+    }
+}
+/**
+ * Checks whether an edit to a file is allowed under RED-before-GREEN TDD rules.
+ *
+ * @param filePath - Path to file being edited.
+ * @param state - Current session TDD state.
+ * @param enforceTestFirst - Whether test-first enforcement is strictly enabled.
+ * @returns Decision result indicating whether edit is blocked.
+ */
+export function inspectTddRequirement(filePath, state, enforceTestFirst = false) {
+    const prod = isProductionFile(filePath);
+    if (!enforceTestFirst || !prod) {
+        return { blocked: false, isProductionFile: prod };
+    }
+    if (!state.lastFailingTestRecorded) {
+        const baseName = path.basename(filePath);
+        return {
+            blocked: true,
+            isProductionFile: true,
+            reason: `Test-First (RED-before-GREEN) requirement: Production file '${baseName}' cannot be edited before a failing test (RED) is recorded. Author a failing unit or acceptance test first, verify failure output, then edit production code.`
+        };
+    }
+    return { blocked: false, isProductionFile: true };
+}
+export default {
+    isTestFile,
+    isNonCodeFile,
+    isProductionFile,
+    readTddState,
+    writeTddState,
+    inspectTddRequirement
+};
+//# sourceMappingURL=agent-guard-tdd.js.map

package/.agents/lib/agent-guard.js

@@ -0,0 +1,80 @@
+import path from 'node:path';
+import { inspectCommand } from './agent-guard-command.js';
+import { inspectFileWrite } from './agent-guard-file.js';
+import { inspectTddRequirement, readTddState, writeTddState } from './agent-guard-tdd.js';
+function parseEnvelope(raw) {
+    try {
+        const trimmed = raw.trim();
+        if (!trimmed.startsWith('{'))
+            return null;
+        return JSON.parse(trimmed);
+    }
+    catch {
+        return null;
+    }
+}
+function extractKey(input, keys) {
+    for (const k of keys) {
+        if (typeof input[k] === 'string')
+            return input[k];
+    }
+    return undefined;
+}
+function extractFilePath(input) {
+    return extractKey(input, ['TargetFile', 'file_path', 'path', 'filePath']);
+}
+function extractCommand(input) {
+    return extractKey(input, ['CommandLine', 'command', 'cmd']);
+}
+function inspectPreCommand(cmd) {
+    const violation = inspectCommand(cmd);
+    if (violation.blocked) {
+        return { allowed: false, reason: violation.reason, source: 'command' };
+    }
+    return { allowed: true };
+}
+function inspectPreFile(filePath, input, options) {
+    const incoming = extractKey(input, ['CodeContent', 'content']);
+    const replacement = extractKey(input, ['ReplacementContent', 'replacement']);
+    const target = extractKey(input, ['TargetContent', 'target']);
+    const fileDecision = inspectFileWrite({
+        filePath,
+        incomingContent: incoming,
+        replacementContent: replacement,
+        targetContent: target,
+        maxLines: options.maxFileLines
+    });
+    if (fileDecision.blocked) {
+        return { allowed: false, reason: fileDecision.reason, source: 'file' };
+    }
+    const root = options.workspaceRoot ?? process.cwd();
+    const statePath = path.join(root, '.agents', '.session-state.json');
+    const state = readTddState(statePath);
+    const tddDecision = inspectTddRequirement(filePath, state, options.enforceTestFirst);
+    if (tddDecision.blocked) {
+        return { allowed: false, reason: tddDecision.reason, source: 'tdd' };
+    }
+    return { allowed: true };
+}
+/**
+ * Inspects a tool-use request before execution (PreToolUse hook).
+ *
+ * @param rawInput - Raw command string, JSON envelope, or argv slice.
+ * @param options - Guard configuration options.
+ * @returns Guard decision indicating whether tool execution is permitted.
+ */
+export function inspectPreTool(rawInput, options = {}) {
+    const env = parseEnvelope(rawInput);
+    if (env && env.tool_input) {
+        const cmd = extractCommand(env.tool_input);
+        if (cmd)
+            return inspectPreCommand(cmd);
+        const targetFile = extractFilePath(env.tool_input);
+        if (targetFile)
+            return inspectPreFile(targetFile, env.tool_input, options);
+    }
+    return inspectPreCommand(rawInput);
+}
+export { inspectCommand, inspectFileWrite, inspectTddRequirement, readTddState, writeTddState };
+export default { inspectPreTool, inspectCommand, inspectFileWrite, inspectTddRequirement };
+//# sourceMappingURL=agent-guard.js.map

package/.agents/scripts/agent_guard.js

@@ -14,10 +14,39 @@ import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const selfDir = path.dirname(fileURLToPath(import.meta.url));
-const guardModulePath = path.resolve(selfDir, '../../lib/agent-guard.js');
+
+// Resolution order (first existing file wins):
+//   1. AZCODR_GUARD_ENGINE override (tests, embedders).
+//   2. ../lib/agent-guard.js — vendored engine shipped inside `.agents/`
+//      (present in scaffolded projects; `.agents` is copied recursively).
+//   3. ../../lib/agent-guard.js — azcodr repo dev layout (fallback only).
+const guardCandidates = [
+  process.env.AZCODR_GUARD_ENGINE,
+  path.resolve(selfDir, '../lib/agent-guard.js'),
+  path.resolve(selfDir, '../../lib/agent-guard.js')
+].filter(Boolean);
 
 async function getGuardModule() {
-  return import(pathToFileURL(guardModulePath).href);
+  const tried = [];
+  for (const candidate of guardCandidates) {
+    if (!fs.existsSync(candidate)) {
+      tried.push(candidate);
+      continue;
+    }
+    try {
+      return await import(pathToFileURL(candidate).href);
+    } catch (err) {
+      tried.push(`${candidate} (unreadable: ${err.message})`);
+    }
+  }
+  // Fail CLOSED: a guard with no engine must be loud, never a silent allow.
+  // (Unparseable tool payloads still fail open inside inspectPreTool per
+  // ADR-005; a missing engine is a broken install, not an ambiguous input.)
+  console.error(
+    '🚨 Architectural Guard misconfigured: engine module not found, refusing to fail open. Tried:\n' +
+    tried.map((t) => `  - ${t}`).join('\n')
+  );
+  process.exit(2);
 }
 
 async function readStdin(timeoutMs = 1500) {
@@ -60,4 +89,7 @@ async function main() {
   process.exit(0);
 }
 
-main().catch(() => process.exit(0));
+main().catch((err) => {
+  console.error(`🚨 Architectural Guard crashed: ${err?.message || err}`);
+  process.exit(2);
+});

package/.agents/skills/clean-code-refactor/SKILL.md

@@ -51,6 +51,7 @@ Target concrete flaws:
 ### Step 5: Verify Continuous Green State
 - Run tests after every single atomic change. Use the workspace's own command — do not assume one exists. Verify with the package manifest first (`node -p "JSON.stringify(require('./package.json').scripts)"`); for this template that is `npm test`, with `npm run test:coverage` for the coverage gate.
 - Ensure coverage remains at **100.00%**.
+- Verify architectural boundaries: Run `npx azcodr boundaries` to guarantee the refactoring introduced 0 circular dependencies and 0 layer boundary breaches.
 
 ---
 

package/.agents/skills/lets-build/SKILL.md

@@ -100,7 +100,7 @@ Upon user confirmation:
    - *Extension:* `manifest.json`, `src/background/index.ts`, `src/content/index.ts`, `src/popup/index.html`.
    - *Game / Engine:* `src/core/`, `src/ecs/`, asset manifest, frame loop entrypoint.
    - *CLI:* `src/cmd/`, `src/core/`, CLI entrypoint with exit code handling.
-3. Generate build manifests (`Cargo.toml`, `package.json`, `go.mod`, `pyproject.toml`), deterministic linter configurations strictly enforcing the [Polyglot Fitness Function Standards](../../../docs/rules/clean_code.md#polyglot-fitness-function-standards), and boundary smoke test (`scripts/smoke_test.sh`).
+3. Generate build manifests (`Cargo.toml`, `package.json`, `go.mod`, `pyproject.toml`) for the recorded language, install the pinned linter from the emitted gate configuration (`eslint.config.js`, `ruff.toml`, `clippy.toml`, `.golangci.yml`, `checkstyle.xml`, `.editorconfig` CA block, `.clang-tidy` — written deterministically by `bootstrap_workspace.sh`, never invented). Node profiles arrive with `package.json` lint already rewired to `eslint .`; other profiles need the lint entry wired by hand. Prove the gate in Phase 5, and keep the boundary smoke test (`scripts/smoke_test.sh`).
 4. **Replace Starter README with Project-Specific README**:
    Generate a clean, project-specific `README.md` using [references/project_readme_template.md](./references/project_readme_template.md), completely replacing meta-template content with the project's actual name, mission, stack highlights, quickstart commands, and directory tree.
 
@@ -114,6 +114,7 @@ Upon user confirmation:
 2. Execute toolchain dependency checks, build commands, and health/smoke tests:
    - Compile code and verify zero compiler or lint errors.
    - Verify boundary verification smoke test (`scripts/smoke_test.sh`).
+   - **Prove enforcement is live:** enable the shipped hooks in `.agents/hooks.json` (`safety-guard`, `architectural-guard`), then deliberately attempt a blocked action (e.g. append lines to a file already over budget, or a denied command) and confirm the hook rejects it before re-disabling nothing — hooks stay enabled. A guard that has never blocked anything is a rumor, not a control.
 3. **Mandatory Handover to Domain Analysis (STOP & PIVOT):**
    - **`lets-build` IS NOW COMPLETE.** Do NOT proceed to write domain business entities, repositories, or application features.
    - Present the bootstrapped technical skeleton to the user.
@@ -160,7 +161,7 @@ Upon user confirmation:
 
 ## 4. Quality & Verification
 - **Testing Strategy:** Outside-In TDD with Nano-Cycles (Uncle Bob's 3 Laws)
-- **Code Health Gates:** 100.00% test coverage gate, zero lint errors
+- **Code Health Gates:** 100% coverage on all metrics + mutation kill gate on guards, zero lint errors
 - **DevSecOps:** <Semgrep / Trivy / Gitleaks / None>
 ```
 

package/.agents/skills/lets-build/scripts/bootstrap_workspace.sh

@@ -324,6 +324,165 @@ EOF
     ;;
 esac
 
+# ------------------------------------------------------------------------------
+# DETERMINISTIC TOOLCHAIN FILES. Directories alone enforce nothing: until this
+# section existed, every language produced zero gate configurations and the
+# starter `lint` script was an echo placeholder, so all enforcement was
+# agent-authored. Each profile below emits its pinned gate configuration with
+# values mirroring docs/rules/clean_code.md (300/30/10/3); the agent installs
+# the named tool and proves the gate in Phase 5. Files are created only when
+# absent, so re-runs never clobber agent-authored configs. Build manifests
+# (Cargo.toml, go.mod, csproj, ...) stay with the agent: they carry project
+# naming and version decisions no script may invent.
+# ------------------------------------------------------------------------------
+write_unless_exists() {
+  local target="$1"
+  if [[ -f "${target}" ]]; then
+    echo "   keeping existing ${target}"
+    return
+  fi
+  mkdir -p "$(dirname "${target}")"
+  cat > "${target}"
+}
+
+append_unless_present() {
+  local target="$1"
+  local marker="$2"
+  if [[ -f "${target}" ]] && grep -qF "${marker}" "${target}"; then
+    echo "   keeping existing ${target} gates"
+    return
+  fi
+  cat >> "${target}"
+}
+
+echo "6. Emitting deterministic toolchain configs for '${LANGUAGE}'..."
+case "${LANGUAGE}" in
+  typescript|javascript|deno|bun)
+    write_unless_exists "${WORKSPACE_ROOT}/eslint.config.js" << 'EOF'
+// Deterministic fitness functions (azcodr clean_code.md section 5).
+// Install the pinned tool, then prove the gate: npm run lint
+export default [
+  {
+    files: ['src/**/*.{js,ts}', 'tests/**/*.{js,ts}'],
+    rules: {
+      'max-lines': ['error', 300],
+      'max-lines-per-function': ['error', 30],
+      complexity: ['error', 10],
+      'max-params': ['error', 3]
+    }
+  }
+];
+EOF
+    ;;
+  python)
+    write_unless_exists "${WORKSPACE_ROOT}/ruff.toml" << 'EOF'
+# Deterministic fitness functions (azcodr clean_code.md section 5).
+# Install the pinned tool, then prove the gate: ruff check .
+[lint]
+select = ["E", "F", "C901", "PLR0912", "PLR0913", "PLR0915"]
+[lint.mccabe]
+max-complexity = 10
+[lint.pylint]
+max-args = 3
+max-statements = 30
+# NOTE: ruff has no file-length rule; the 300-line file cap is enforced by
+# the project's lint entry (see lets-build Phase 5 proof).
+EOF
+    ;;
+  rust)
+    write_unless_exists "${WORKSPACE_ROOT}/clippy.toml" << 'EOF'
+# Deterministic fitness functions (azcodr clean_code.md section 5).
+# Enforce with: cargo clippy -- -D clippy::too_many_lines -D clippy::cognitive_complexity -D clippy::too_many_arguments
+too-many-lines-threshold = 30
+cognitive-complexity-threshold = 10
+too-many-arguments-threshold = 3
+# NOTE: clippy has no file-length lint; the 300-line file cap is enforced by
+# the project's lint entry (see lets-build Phase 5 proof).
+EOF
+    ;;
+  go)
+    write_unless_exists "${WORKSPACE_ROOT}/.golangci.yml" << 'EOF'
+# Deterministic fitness functions (azcodr clean_code.md section 5).
+# Install the pinned tool, then prove the gate: golangci-lint run ./...
+linters:
+  enable: [funlen, gocyclo]
+linters-settings:
+  funlen:
+    lines: 30
+    statements: 25
+  gocyclo:
+    min-complexity: 10
+# NOTE: no golangci-native file-length check; the 300-line file cap is
+# enforced by the project's lint entry (see lets-build Phase 5 proof).
+EOF
+    ;;
+  java)
+    write_unless_exists "${WORKSPACE_ROOT}/checkstyle.xml" << 'EOF'
+<?xml version="1.0"?>
+<!-- Deterministic fitness functions (azcodr clean_code.md section 5). -->
+<!DOCTYPE module PUBLIC "-//Checkstyle//DTD Checkstyle Configuration 1.3//EN" "https://checkstyle.org/dtds/configuration_1_3.dtd">
+<module name="Checker">
+  <module name="FileLength">
+    <property name="max" value="300"/>
+  </module>
+  <module name="TreeWalker">
+    <module name="MethodLength">
+      <property name="max" value="30"/>
+    </module>
+    <module name="CyclomaticComplexity">
+      <property name="max" value="10"/>
+    </module>
+    <module name="ParameterNumber">
+      <property name="max" value="3"/>
+    </module>
+  </module>
+</module>
+EOF
+    ;;
+  csharp)
+    append_unless_present "${WORKSPACE_ROOT}/.editorconfig" "azcodr fitness functions" << 'EOF'
+
+# --- azcodr fitness functions (CA gates; exact numbers in lint entry) ---
+[*.cs]
+dotnet_diagnostic.CA1501.severity = error
+dotnet_diagnostic.CA1502.severity = error
+EOF
+    ;;
+  cpp|c)
+    write_unless_exists "${WORKSPACE_ROOT}/.clang-tidy" << 'EOF'
+# Deterministic fitness functions (azcodr clean_code.md section 5).
+Checks: 'readability-function-size,readability-function-cognitive-complexity'
+CheckOptions:
+  - { key: readability-function-size.LineThreshold, value: 30 }
+  - { key: readability-function-size.ParameterThreshold, value: 3 }
+  - { key: readability-function-cognitive-complexity.Threshold, value: 10 }
+# NOTE: clang-tidy has no file-length check; the 300-line file cap is
+# enforced by the project's lint entry (see lets-build Phase 5 proof).
+EOF
+    ;;
+  generic)
+    echo "   language undecided: no toolchain configs emitted (re-run with a language profile)"
+    ;;
+esac
+
+# For Node profiles the starter package.json ships a lint placeholder that
+# always succeeds. Point it at the emitted config so `npm run lint` fails
+# until the pinned eslint is installed (fail-closed) instead of echoing.
+# Only the placeholder is ever replaced; agent-wired entries are sacred.
+case "${LANGUAGE}" in
+  typescript|javascript|deno|bun)
+    STARTER_PKG="${WORKSPACE_ROOT}/package.json"
+    if [[ -f "${STARTER_PKG}" ]] && grep -q 'No linter configured yet' "${STARTER_PKG}"; then
+      if command -v node >/dev/null 2>&1; then
+        node -e 'const fs=require("fs");const p=process.argv[1];const j=JSON.parse(fs.readFileSync(p,"utf8"));j.scripts=j.scripts||{};j.scripts.lint="eslint .";fs.writeFileSync(p,JSON.stringify(j,null,2)+"\n");' "${STARTER_PKG}"
+        echo "   wired package.json lint -> eslint ."
+      else
+        echo "   node not found: leaving starter lint placeholder (agent wires it in Phase 4)"
+      fi
+    fi
+    ;;
+esac
+
 # ------------------------------------------------------------------------------
 # memory.md is an APPEND-ONLY LEDGER. It is never rewritten automatically.
 #

package/.agents/skills/relentless-questioner/SKILL.md

@@ -119,7 +119,7 @@ Synthesize the answers into an unambiguous **Feature Alignment Specification (FA
     When [Action]
     Then [Observable Outcome]
   ```
-- **Test Strategy:** [Contract / Integration / Unit tests required for 100% coverage]
+- **Test Strategy:** [Contract / Integration / Unit tests required; 100% on all metrics, assertion-free tests rejected]
 ```
 
 ---

package/.github/workflows/ci.yml

@@ -54,6 +54,13 @@ jobs:
           node --version
           npm --version
 
+      - name: Verify TypeScript Compilation & lib/ Parity
+        shell: bash
+        run: |
+          npm run build
+          git diff --exit-code lib/
+          npm run typecheck
+
       - name: Run Syntax & Lint Checks
         run: npm run lint
 
@@ -84,6 +91,12 @@ jobs:
       - name: Verify Coverage Gates
         run: npm run test:coverage
 
+      - name: Verify Mutation Score Gate (100% Mutant Kill)
+        run: npm run test:mutation
+
+      - name: Verify Empirical Drift Benchmark
+        run: node benchmark/run-benchmark.js
+
       - name: Upload Coverage Report
         uses: actions/upload-artifact@v4
         if: always()