azcodr 2.4.0 → 2.5.1

package/.agents/hooks.json

@@ -14,6 +14,21 @@
       }
     ]
   },
+  "architectural-guard": {
+    "enabled": false,
+    "PreToolUse": [
+      {
+        "matcher": "run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./.agents/scripts/agent_guard.js",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  },
   "post-tool-lint": {
     "enabled": false,
     "PostToolUse": [

package/.agents/hooks.json.example

@@ -14,6 +14,21 @@
       }
     ]
   },
+  "architectural-guard": {
+    "enabled": false,
+    "PreToolUse": [
+      {
+        "matcher": "run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./.agents/scripts/agent_guard.js",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  },
   "post-tool-lint": {
     "enabled": false,
     "PostToolUse": [

package/.agents/lib/agent-guard-command.js

@@ -0,0 +1,103 @@
+/**
+ * Command safety guard inspecting shell commands against a destructive denylist.
+ */
+export const DESTRUCTIVE_RULES = [
+    {
+        pattern: /\brm\s+(-[a-z-]*[rf][a-z-]*\s+)+(\/|\/\*|~|~\/\*|\$home|\$\{home\}|\.|\.\.|\.\/|[a-z]:\\|[a-z]:\/)/i,
+        reason: 'destructive rm targeting root, home, drive, or the current directory'
+    },
+    {
+        pattern: /(^|\s)rm\s+(-[a-z-]*\s+)*(\/|~|[a-z]:\\|[a-z]:\/)($|\s)/i,
+        reason: 'destructive rm targeting root or home'
+    },
+    {
+        pattern: /\brm\s+--recursive.*--force\s+(\/|~|\$home|\.)/i,
+        reason: 'destructive rm using long-form flags'
+    },
+    {
+        pattern: /\brm\s+.*--no-preserve-root/i,
+        reason: 'rm --no-preserve-root is forbidden under agent execution'
+    },
+    {
+        pattern: /\b(wipefs\s+-a|shred\s+-u|find\s+.*-delete)\b/i,
+        reason: 'irreversible disk or mass-delete operation'
+    },
+    {
+        pattern: /\bgit\s+push\s+.*(-f|--force|--mirror)\b/i,
+        reason: 'force-push or mirror-push can destroy remote history'
+    },
+    {
+        pattern: /\bgit\s+push\b.*--force-with-lease\b/i,
+        reason: 'force-push variant detected'
+    },
+    {
+        pattern: /\bgit\s+(reset\s+--hard|clean\s+-[a-z]*[fd])/i,
+        reason: 'destructive git worktree operation (reset --hard / clean)'
+    },
+    {
+        pattern: /\bgit\s+checkout\s+--\s+\./i,
+        reason: 'git checkout -- . discards all uncommitted work'
+    },
+    {
+        pattern: /\bgit\s+branch\s+-D\b/i,
+        reason: 'force branch delete'
+    },
+    {
+        pattern: /\b(drop\s+(database|schema|table)|truncate\s+(table\s+)?[a-z_])/i,
+        reason: 'destructive SQL DDL'
+    },
+    {
+        pattern: /\b(delete\s+from|update\s+[a-z_]+\s+set|alter\s+table)\b/i,
+        reason: 'destructive SQL DML'
+    },
+    {
+        pattern: /\b(grant\s+all|revoke\s+all)\b/i,
+        reason: 'privilege escalation in SQL'
+    },
+    {
+        pattern: /\b(mkfs|dd\s+if=|fdisk|parted\s+\/dev)\b/i,
+        reason: 'raw disk operation'
+    },
+    {
+        pattern: /(:[\s]*\([\s]*\)[\s]*\{|:[\s]*\|[\s]*:)/,
+        reason: 'fork bomb'
+    },
+    {
+        pattern: /\b(curl|wget)\s+.*\|\s*(sudo\s+)?(ba)?sh\b/i,
+        reason: 'piping download directly into shell execution'
+    },
+    {
+        pattern: /\b(base64\s+-d|base64\s+--decode)\s+.*\|/i,
+        reason: 'decoding encoded payload into a pipe'
+    },
+    {
+        pattern: /\b(npm|yarn|pnpm)\s+publish\b/i,
+        reason: 'package publish must run via release workflow, not ad-hoc tool call'
+    }
+];
+export function normalizeCommand(raw) {
+    return raw.replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim();
+}
+/**
+ * Checks a command string against the safety denylist.
+ *
+ * @param command - Raw shell command string.
+ * @returns Violation details if blocked, or clean outcome.
+ */
+export function inspectCommand(command) {
+    const normalized = normalizeCommand(command);
+    if (!normalized)
+        return { blocked: false };
+    for (const rule of DESTRUCTIVE_RULES) {
+        if (rule.pattern.test(normalized)) {
+            return {
+                blocked: true,
+                reason: rule.reason,
+                command: normalized.slice(0, 300)
+            };
+        }
+    }
+    return { blocked: false, command: normalized };
+}
+export default { DESTRUCTIVE_RULES, normalizeCommand, inspectCommand };
+//# sourceMappingURL=agent-guard-command.js.map

package/.agents/lib/agent-guard-file.js

@@ -0,0 +1,77 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const DEFAULT_MAX_FILE_LINES = 300;
+export function countLines(text) {
+    if (!text)
+        return 0;
+    return text.split('\n').length;
+}
+export function readExistingLines(filePath) {
+    if (!fs.existsSync(filePath))
+        return 0;
+    try {
+        const content = fs.readFileSync(filePath, 'utf-8');
+        return countLines(content);
+    }
+    catch {
+        return 0;
+    }
+}
+function calculateProjectedLines(currentLines, input) {
+    if (input.incomingContent !== undefined) {
+        return countLines(input.incomingContent);
+    }
+    if (input.replacementContent !== undefined) {
+        const addedLines = countLines(input.replacementContent);
+        const removedLines = input.targetContent !== undefined ? countLines(input.targetContent) : 1;
+        return Math.max(0, currentLines + addedLines - removedLines);
+    }
+    return currentLines;
+}
+function evaluateLineThresholds(params) {
+    const { filePath, currentLines, projectedLines, maxLines } = params;
+    const base = { currentLines, projectedLines, maxLines };
+    const relPath = path.basename(filePath);
+    if (currentLines > maxLines) {
+        if (projectedLines >= currentLines) {
+            return {
+                ...base,
+                blocked: true,
+                reason: `Refactor-Before-Add violation: '${relPath}' currently has ${currentLines} lines (limit: ${maxLines}). Adding or maintaining lines in an overflowing file is blocked. Refactor into modular units under green tests first.`
+            };
+        }
+        return { ...base, blocked: false };
+    }
+    if (projectedLines > maxLines) {
+        return {
+            ...base,
+            blocked: true,
+            reason: `File line budget exceeded: '${relPath}' would grow to ${projectedLines} lines (limit: ${maxLines}). Decompose into modular components before appending more code.`
+        };
+    }
+    return { ...base, blocked: false };
+}
+/**
+ * Checks a proposed file write or edit against Refactor-Before-Add rules.
+ *
+ * @param input - File path and proposed content.
+ * @returns Decision result indicating whether the write is blocked.
+ */
+export function inspectFileWrite(input) {
+    const maxLines = input.maxLines ?? DEFAULT_MAX_FILE_LINES;
+    const currentLines = readExistingLines(input.filePath);
+    const projectedLines = calculateProjectedLines(currentLines, input);
+    return evaluateLineThresholds({
+        filePath: input.filePath,
+        currentLines,
+        projectedLines,
+        maxLines
+    });
+}
+export default {
+    DEFAULT_MAX_FILE_LINES,
+    countLines,
+    readExistingLines,
+    inspectFileWrite
+};
+//# sourceMappingURL=agent-guard-file.js.map

package/.agents/lib/agent-guard-tdd.js

@@ -0,0 +1,77 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export function isTestFile(filePath) {
+    const norm = filePath.replace(/\\/g, '/').toLowerCase();
+    if (/(^|\/)(tests?|__tests__)(\/|$)/i.test(norm)) {
+        return true;
+    }
+    return /\.(test|spec)\.[a-z0-9]+$/i.test(norm);
+}
+export function isNonCodeFile(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    const nonCodeExts = new Set(['.md', '.json', '.yml', '.yaml', '.txt', '.toml', '.lock', '.svg', '.png']);
+    return nonCodeExts.has(ext);
+}
+export function isProductionFile(filePath) {
+    if (isNonCodeFile(filePath))
+        return false;
+    if (isTestFile(filePath))
+        return false;
+    const norm = filePath.replace(/\\/g, '/').toLowerCase();
+    return norm.includes('src/') || norm.includes('lib/') || norm.includes('app/');
+}
+export function readTddState(stateFile) {
+    if (!fs.existsSync(stateFile)) {
+        return { lastFailingTestRecorded: false };
+    }
+    try {
+        const raw = fs.readFileSync(stateFile, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return { lastFailingTestRecorded: false };
+    }
+}
+export function writeTddState(stateFile, state) {
+    try {
+        const dir = path.dirname(stateFile);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf-8');
+    }
+    catch {
+        // Fail-safe write: do not crash agent if state cannot be persisted
+    }
+}
+/**
+ * Checks whether an edit to a file is allowed under RED-before-GREEN TDD rules.
+ *
+ * @param filePath - Path to file being edited.
+ * @param state - Current session TDD state.
+ * @param enforceTestFirst - Whether test-first enforcement is strictly enabled.
+ * @returns Decision result indicating whether edit is blocked.
+ */
+export function inspectTddRequirement(filePath, state, enforceTestFirst = false) {
+    const prod = isProductionFile(filePath);
+    if (!enforceTestFirst || !prod) {
+        return { blocked: false, isProductionFile: prod };
+    }
+    if (!state.lastFailingTestRecorded) {
+        const baseName = path.basename(filePath);
+        return {
+            blocked: true,
+            isProductionFile: true,
+            reason: `Test-First (RED-before-GREEN) requirement: Production file '${baseName}' cannot be edited before a failing test (RED) is recorded. Author a failing unit or acceptance test first, verify failure output, then edit production code.`
+        };
+    }
+    return { blocked: false, isProductionFile: true };
+}
+export default {
+    isTestFile,
+    isNonCodeFile,
+    isProductionFile,
+    readTddState,
+    writeTddState,
+    inspectTddRequirement
+};
+//# sourceMappingURL=agent-guard-tdd.js.map

package/.agents/lib/agent-guard.js

@@ -0,0 +1,80 @@
+import path from 'node:path';
+import { inspectCommand } from './agent-guard-command.js';
+import { inspectFileWrite } from './agent-guard-file.js';
+import { inspectTddRequirement, readTddState, writeTddState } from './agent-guard-tdd.js';
+function parseEnvelope(raw) {
+    try {
+        const trimmed = raw.trim();
+        if (!trimmed.startsWith('{'))
+            return null;
+        return JSON.parse(trimmed);
+    }
+    catch {
+        return null;
+    }
+}
+function extractKey(input, keys) {
+    for (const k of keys) {
+        if (typeof input[k] === 'string')
+            return input[k];
+    }
+    return undefined;
+}
+function extractFilePath(input) {
+    return extractKey(input, ['TargetFile', 'file_path', 'path', 'filePath']);
+}
+function extractCommand(input) {
+    return extractKey(input, ['CommandLine', 'command', 'cmd']);
+}
+function inspectPreCommand(cmd) {
+    const violation = inspectCommand(cmd);
+    if (violation.blocked) {
+        return { allowed: false, reason: violation.reason, source: 'command' };
+    }
+    return { allowed: true };
+}
+function inspectPreFile(filePath, input, options) {
+    const incoming = extractKey(input, ['CodeContent', 'content']);
+    const replacement = extractKey(input, ['ReplacementContent', 'replacement']);
+    const target = extractKey(input, ['TargetContent', 'target']);
+    const fileDecision = inspectFileWrite({
+        filePath,
+        incomingContent: incoming,
+        replacementContent: replacement,
+        targetContent: target,
+        maxLines: options.maxFileLines
+    });
+    if (fileDecision.blocked) {
+        return { allowed: false, reason: fileDecision.reason, source: 'file' };
+    }
+    const root = options.workspaceRoot ?? process.cwd();
+    const statePath = path.join(root, '.agents', '.session-state.json');
+    const state = readTddState(statePath);
+    const tddDecision = inspectTddRequirement(filePath, state, options.enforceTestFirst);
+    if (tddDecision.blocked) {
+        return { allowed: false, reason: tddDecision.reason, source: 'tdd' };
+    }
+    return { allowed: true };
+}
+/**
+ * Inspects a tool-use request before execution (PreToolUse hook).
+ *
+ * @param rawInput - Raw command string, JSON envelope, or argv slice.
+ * @param options - Guard configuration options.
+ * @returns Guard decision indicating whether tool execution is permitted.
+ */
+export function inspectPreTool(rawInput, options = {}) {
+    const env = parseEnvelope(rawInput);
+    if (env && env.tool_input) {
+        const cmd = extractCommand(env.tool_input);
+        if (cmd)
+            return inspectPreCommand(cmd);
+        const targetFile = extractFilePath(env.tool_input);
+        if (targetFile)
+            return inspectPreFile(targetFile, env.tool_input, options);
+    }
+    return inspectPreCommand(rawInput);
+}
+export { inspectCommand, inspectFileWrite, inspectTddRequirement, readTddState, writeTddState };
+export default { inspectPreTool, inspectCommand, inspectFileWrite, inspectTddRequirement };
+//# sourceMappingURL=agent-guard.js.map

package/.agents/scripts/agent_guard.js

@@ -14,10 +14,39 @@ import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const selfDir = path.dirname(fileURLToPath(import.meta.url));
-const guardModulePath = path.resolve(selfDir, '../../lib/agent-guard.js');
+
+// Resolution order (first existing file wins):
+//   1. AZCODR_GUARD_ENGINE override (tests, embedders).
+//   2. ../lib/agent-guard.js — vendored engine shipped inside `.agents/`
+//      (present in scaffolded projects; `.agents` is copied recursively).
+//   3. ../../lib/agent-guard.js — azcodr repo dev layout (fallback only).
+const guardCandidates = [
+  process.env.AZCODR_GUARD_ENGINE,
+  path.resolve(selfDir, '../lib/agent-guard.js'),
+  path.resolve(selfDir, '../../lib/agent-guard.js')
+].filter(Boolean);
 
 async function getGuardModule() {
-  return import(pathToFileURL(guardModulePath).href);
+  const tried = [];
+  for (const candidate of guardCandidates) {
+    if (!fs.existsSync(candidate)) {
+      tried.push(candidate);
+      continue;
+    }
+    try {
+      return await import(pathToFileURL(candidate).href);
+    } catch (err) {
+      tried.push(`${candidate} (unreadable: ${err.message})`);
+    }
+  }
+  // Fail CLOSED: a guard with no engine must be loud, never a silent allow.
+  // (Unparseable tool payloads still fail open inside inspectPreTool per
+  // ADR-005; a missing engine is a broken install, not an ambiguous input.)
+  console.error(
+    '🚨 Architectural Guard misconfigured: engine module not found, refusing to fail open. Tried:\n' +
+    tried.map((t) => `  - ${t}`).join('\n')
+  );
+  process.exit(2);
 }
 
 async function readStdin(timeoutMs = 1500) {
@@ -60,4 +89,7 @@ async function main() {
   process.exit(0);
 }
 
-main().catch(() => process.exit(0));
+main().catch((err) => {
+  console.error(`🚨 Architectural Guard crashed: ${err?.message || err}`);
+  process.exit(2);
+});

package/.agents/skills/clean-code-refactor/SKILL.md

@@ -51,6 +51,7 @@ Target concrete flaws:
 ### Step 5: Verify Continuous Green State
 - Run tests after every single atomic change. Use the workspace's own command — do not assume one exists. Verify with the package manifest first (`node -p "JSON.stringify(require('./package.json').scripts)"`); for this template that is `npm test`, with `npm run test:coverage` for the coverage gate.
 - Ensure coverage remains at **100.00%**.
+- Verify architectural boundaries: Run `npx azcodr boundaries` to guarantee the refactoring introduced 0 circular dependencies and 0 layer boundary breaches.
 
 ---
 

package/.agents/skills/lets-build/SKILL.md

@@ -100,7 +100,7 @@ Upon user confirmation:
    - *Extension:* `manifest.json`, `src/background/index.ts`, `src/content/index.ts`, `src/popup/index.html`.
    - *Game / Engine:* `src/core/`, `src/ecs/`, asset manifest, frame loop entrypoint.
    - *CLI:* `src/cmd/`, `src/core/`, CLI entrypoint with exit code handling.
-3. Generate build manifests (`Cargo.toml`, `package.json`, `go.mod`, `pyproject.toml`), deterministic linter configurations strictly enforcing the [Polyglot Fitness Function Standards](../../../docs/rules/clean_code.md#polyglot-fitness-function-standards), and boundary smoke test (`scripts/smoke_test.sh`).
+3. Generate build manifests (`Cargo.toml`, `package.json`, `go.mod`, `pyproject.toml`) for the recorded language, install the pinned linter from the emitted gate configuration (`eslint.config.js`, `ruff.toml`, `clippy.toml`, `.golangci.yml`, `checkstyle.xml`, `.editorconfig` CA block, `.clang-tidy` — written deterministically by `bootstrap_workspace.sh`, never invented). Node profiles arrive with `package.json` lint already rewired to `eslint .`; other profiles need the lint entry wired by hand. Prove the gate in Phase 5, and keep the boundary smoke test (`scripts/smoke_test.sh`).
 4. **Replace Starter README with Project-Specific README**:
    Generate a clean, project-specific `README.md` using [references/project_readme_template.md](./references/project_readme_template.md), completely replacing meta-template content with the project's actual name, mission, stack highlights, quickstart commands, and directory tree.
 
@@ -114,6 +114,7 @@ Upon user confirmation:
 2. Execute toolchain dependency checks, build commands, and health/smoke tests:
    - Compile code and verify zero compiler or lint errors.
    - Verify boundary verification smoke test (`scripts/smoke_test.sh`).
+   - **Prove enforcement is live:** enable the shipped hooks in `.agents/hooks.json` (`safety-guard`, `architectural-guard`), then deliberately attempt a blocked action (e.g. append lines to a file already over budget, or a denied command) and confirm the hook rejects it before re-disabling nothing — hooks stay enabled. A guard that has never blocked anything is a rumor, not a control.
 3. **Mandatory Handover to Domain Analysis (STOP & PIVOT):**
    - **`lets-build` IS NOW COMPLETE.** Do NOT proceed to write domain business entities, repositories, or application features.
    - Present the bootstrapped technical skeleton to the user.
@@ -160,7 +161,7 @@ Upon user confirmation:
 
 ## 4. Quality & Verification
 - **Testing Strategy:** Outside-In TDD with Nano-Cycles (Uncle Bob's 3 Laws)
-- **Code Health Gates:** 100.00% test coverage gate, zero lint errors
+- **Code Health Gates:** 100% coverage on all metrics + mutation kill gate on guards, zero lint errors
 - **DevSecOps:** <Semgrep / Trivy / Gitleaks / None>
 ```
 

package/.agents/skills/lets-build/scripts/bootstrap_workspace.sh

@@ -324,6 +324,165 @@ EOF
     ;;
 esac
 
+# ------------------------------------------------------------------------------
+# DETERMINISTIC TOOLCHAIN FILES. Directories alone enforce nothing: until this
+# section existed, every language produced zero gate configurations and the
+# starter `lint` script was an echo placeholder, so all enforcement was
+# agent-authored. Each profile below emits its pinned gate configuration with
+# values mirroring docs/rules/clean_code.md (300/30/10/3); the agent installs
+# the named tool and proves the gate in Phase 5. Files are created only when
+# absent, so re-runs never clobber agent-authored configs. Build manifests
+# (Cargo.toml, go.mod, csproj, ...) stay with the agent: they carry project
+# naming and version decisions no script may invent.
+# ------------------------------------------------------------------------------
+write_unless_exists() {
+  local target="$1"
+  if [[ -f "${target}" ]]; then
+    echo "   keeping existing ${target}"
+    return
+  fi
+  mkdir -p "$(dirname "${target}")"
+  cat > "${target}"
+}
+
+append_unless_present() {
+  local target="$1"
+  local marker="$2"
+  if [[ -f "${target}" ]] && grep -qF "${marker}" "${target}"; then
+    echo "   keeping existing ${target} gates"
+    return
+  fi
+  cat >> "${target}"
+}
+
+echo "6. Emitting deterministic toolchain configs for '${LANGUAGE}'..."
+case "${LANGUAGE}" in
+  typescript|javascript|deno|bun)
+    write_unless_exists "${WORKSPACE_ROOT}/eslint.config.js" << 'EOF'
+// Deterministic fitness functions (azcodr clean_code.md section 5).
+// Install the pinned tool, then prove the gate: npm run lint
+export default [
+  {
+    files: ['src/**/*.{js,ts}', 'tests/**/*.{js,ts}'],
+    rules: {
+      'max-lines': ['error', 300],
+      'max-lines-per-function': ['error', 30],
+      complexity: ['error', 10],
+      'max-params': ['error', 3]
+    }
+  }
+];
+EOF
+    ;;
+  python)
+    write_unless_exists "${WORKSPACE_ROOT}/ruff.toml" << 'EOF'
+# Deterministic fitness functions (azcodr clean_code.md section 5).
+# Install the pinned tool, then prove the gate: ruff check .
+[lint]
+select = ["E", "F", "C901", "PLR0912", "PLR0913", "PLR0915"]
+[lint.mccabe]
+max-complexity = 10
+[lint.pylint]
+max-args = 3
+max-statements = 30
+# NOTE: ruff has no file-length rule; the 300-line file cap is enforced by
+# the project's lint entry (see lets-build Phase 5 proof).
+EOF
+    ;;
+  rust)
+    write_unless_exists "${WORKSPACE_ROOT}/clippy.toml" << 'EOF'
+# Deterministic fitness functions (azcodr clean_code.md section 5).
+# Enforce with: cargo clippy -- -D clippy::too_many_lines -D clippy::cognitive_complexity -D clippy::too_many_arguments
+too-many-lines-threshold = 30
+cognitive-complexity-threshold = 10
+too-many-arguments-threshold = 3
+# NOTE: clippy has no file-length lint; the 300-line file cap is enforced by
+# the project's lint entry (see lets-build Phase 5 proof).
+EOF
+    ;;
+  go)
+    write_unless_exists "${WORKSPACE_ROOT}/.golangci.yml" << 'EOF'
+# Deterministic fitness functions (azcodr clean_code.md section 5).
+# Install the pinned tool, then prove the gate: golangci-lint run ./...
+linters:
+  enable: [funlen, gocyclo]
+linters-settings:
+  funlen:
+    lines: 30
+    statements: 25
+  gocyclo:
+    min-complexity: 10
+# NOTE: no golangci-native file-length check; the 300-line file cap is
+# enforced by the project's lint entry (see lets-build Phase 5 proof).
+EOF
+    ;;
+  java)
+    write_unless_exists "${WORKSPACE_ROOT}/checkstyle.xml" << 'EOF'
+<?xml version="1.0"?>
+<!-- Deterministic fitness functions (azcodr clean_code.md section 5). -->
+<!DOCTYPE module PUBLIC "-//Checkstyle//DTD Checkstyle Configuration 1.3//EN" "https://checkstyle.org/dtds/configuration_1_3.dtd">
+<module name="Checker">
+  <module name="FileLength">
+    <property name="max" value="300"/>
+  </module>
+  <module name="TreeWalker">
+    <module name="MethodLength">
+      <property name="max" value="30"/>
+    </module>
+    <module name="CyclomaticComplexity">
+      <property name="max" value="10"/>
+    </module>
+    <module name="ParameterNumber">
+      <property name="max" value="3"/>
+    </module>
+  </module>
+</module>
+EOF
+    ;;
+  csharp)
+    append_unless_present "${WORKSPACE_ROOT}/.editorconfig" "azcodr fitness functions" << 'EOF'
+
+# --- azcodr fitness functions (CA gates; exact numbers in lint entry) ---
+[*.cs]
+dotnet_diagnostic.CA1501.severity = error
+dotnet_diagnostic.CA1502.severity = error
+EOF
+    ;;
+  cpp|c)
+    write_unless_exists "${WORKSPACE_ROOT}/.clang-tidy" << 'EOF'
+# Deterministic fitness functions (azcodr clean_code.md section 5).
+Checks: 'readability-function-size,readability-function-cognitive-complexity'
+CheckOptions:
+  - { key: readability-function-size.LineThreshold, value: 30 }
+  - { key: readability-function-size.ParameterThreshold, value: 3 }
+  - { key: readability-function-cognitive-complexity.Threshold, value: 10 }
+# NOTE: clang-tidy has no file-length check; the 300-line file cap is
+# enforced by the project's lint entry (see lets-build Phase 5 proof).
+EOF
+    ;;
+  generic)
+    echo "   language undecided: no toolchain configs emitted (re-run with a language profile)"
+    ;;
+esac
+
+# For Node profiles the starter package.json ships a lint placeholder that
+# always succeeds. Point it at the emitted config so `npm run lint` fails
+# until the pinned eslint is installed (fail-closed) instead of echoing.
+# Only the placeholder is ever replaced; agent-wired entries are sacred.
+case "${LANGUAGE}" in
+  typescript|javascript|deno|bun)
+    STARTER_PKG="${WORKSPACE_ROOT}/package.json"
+    if [[ -f "${STARTER_PKG}" ]] && grep -q 'No linter configured yet' "${STARTER_PKG}"; then
+      if command -v node >/dev/null 2>&1; then
+        node -e 'const fs=require("fs");const p=process.argv[1];const j=JSON.parse(fs.readFileSync(p,"utf8"));j.scripts=j.scripts||{};j.scripts.lint="eslint .";fs.writeFileSync(p,JSON.stringify(j,null,2)+"\n");' "${STARTER_PKG}"
+        echo "   wired package.json lint -> eslint ."
+      else
+        echo "   node not found: leaving starter lint placeholder (agent wires it in Phase 4)"
+      fi
+    fi
+    ;;
+esac
+
 # ------------------------------------------------------------------------------
 # memory.md is an APPEND-ONLY LEDGER. It is never rewritten automatically.
 #

package/.agents/skills/relentless-questioner/SKILL.md

@@ -119,7 +119,7 @@ Synthesize the answers into an unambiguous **Feature Alignment Specification (FA
     When [Action]
     Then [Observable Outcome]
   ```
-- **Test Strategy:** [Contract / Integration / Unit tests required for 100% coverage]
+- **Test Strategy:** [Contract / Integration / Unit tests required; 100% on all metrics, assertion-free tests rejected]
 ```
 
 ---

package/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-> **azcodr: Enterprise Architecture & Agentic Engineering Starter Template**  
+> **azcodr: Architecture governance toolkit, with an optional starter**  
 > **Workspace Mission:** Problem-first, topology-aligned production architectures governed by strict systemic atomicity, 100% open-source standards, true incremental TDD nano-cycles, and zero speculative bloat.  
 > **Runtime & Tools:** Node.js (`>=22.8.0`), npm (`>=10.0.0`) | `npm test` (test runner), `npm run test:coverage` (coverage gate), `npm run lint`, `npm run validate`.
 > **Node floor rationale:** `>=22.8.0` satisfies Jest native ESM requirements (`--experimental-vm-modules`) and modern LTS security baselines. Node 18 (EOL 2025-04-30) and 20 (EOL 2026-04-30) no longer receive security patches.  
@@ -48,7 +48,7 @@ Progress all tasks systematically through the unified **Agent Cognitive & Agile
 2. INTERROGATE / DOMAIN     ──► Relentless questioning; Ubiquitous Language, Aggregate invariants & state machines.
 3. PLAN / OUTER TDD         ──► Minimal blast radius; failing Outer Acceptance Test (UI/API RED).
 4. EXECUTE / INNER TDD      ──► Incremental nano-cycles (Uncle Bob's 3 Laws: 1 micro-assertion RED ➔ MINIMAL pass GREEN ➔ REFACTOR).
-5. VERIFY / DoD & PROOF     ──► Outer test turns GREEN; boundary smoke tests & 100.00% test coverage.
+5. VERIFY / DoD & PROOF     ──► Outer test turns GREEN; boundary smoke tests & 100% coverage on all metrics + mutation gate.
 ```
 ---
 
@@ -58,7 +58,7 @@ To prevent context bloat and keep prompt overhead minimal, detailed engineering
 
 | Domain | Rule Reference File | When to Consult |
 |---|---|---|
-| **TDD & Isolation** | [docs/rules/test_driven_development.md](./docs/rules/test_driven_development.md) | Outside-In TDD, Uncle Bob's 3 Laws, 100% coverage, test isolation & DB rollback. |
+| **TDD & Isolation** | [docs/rules/test_driven_development.md](./docs/rules/test_driven_development.md) | Outside-In TDD, Uncle Bob's 3 Laws, 100% coverage on all metrics + mutation gate, test isolation & DB rollback. |
 | **Clean Code** | [docs/rules/clean_code.md](./docs/rules/clean_code.md) | Naming, small functions, CQS, SLAP, DRY, DbC, zero side-effects. |
 | **Design Patterns** | [docs/rules/design_patterns.md](./docs/rules/design_patterns.md) | Adapter, Factory, Strategy, Result `<T, E>`, and GoF pattern catalog. |
 | **Type Safety** | [docs/rules/type_safety.md](./docs/rules/type_safety.md) | Compiler strictness, branded nominal types, type discriminators across polyglot languages. |

package/CONTRIBUTING.md

@@ -49,15 +49,21 @@ Before submitting any code changes, all 5 quality gates must pass with zero erro
    npm test
    npm run test:coverage
    ```
-   *Coverage gates enforced:*
+   *Coverage gates enforced (CI fails below 100% on any metric):*
    - **100% lines coverage**
-   - **97% functions coverage**
-   - **98% branches coverage**
+   - **100% functions coverage**
+   - **100% branches coverage**
+   - **100% statements coverage**
+   - Plus **100% mutant-kill on guards** (`npm run test:mutation`) and rejection of assertion-free tests.
 5. **Agentic Architecture Validation:**
    ```bash
    npm run validate
    ```
-   Validates root harness parity, progressive disclosure rules, skill formats, markdown links, and ADR ledger consistency.
+   Validates root harness parity, progressive disclosure rules, skill formats, markdown links, ADR ledger consistency, and toolchain gate presence.
+6. **Vendored Guard Sync:** after any change under `src/agent-guard*.ts` and `npm run build`, re-copy the four compiled engine files into `.agents/lib/` (byte-equality is enforced by `tests/agent-guard.test.ts`):
+   ```bash
+   node -e "const fs=require('fs');for(const f of['agent-guard.js','agent-guard-command.js','agent-guard-file.js','agent-guard-tdd.js'])fs.copyFileSync('lib/'+f,'.agents/lib/'+f)"
+   ```
 
 ---
 

package/README.md

@@ -1,10 +1,14 @@
-# azcodr: Enterprise Architecture & Agentic Engineering Starter Template
+# azcodr: Architecture governance toolkit, with an optional starter
 
 [![npm version](https://img.shields.io/npm/v/azcodr.svg?color=cb3837)](https://www.npmjs.com/package/azcodr)
 [![JSR Package](https://jsr.io/badges/@azcodr/azcodr)](https://jsr.io/@azcodr/azcodr)
 [![CI Status](https://github.com/prosubodh/azcodr/actions/workflows/ci.yml/badge.svg)](https://github.com/prosubodh/azcodr/actions/workflows/ci.yml)
-[![Coverage](https://img.shields.io/badge/coverage-100.00%25-brightgreen.svg)](https://github.com/prosubodh/azcodr)
-[![Mutation Score](https://img.shields.io/badge/mutants%20killed-100%25-brightgreen.svg)](https://github.com/prosubodh/azcodr)
+[![Coverage](https://img.shields.io/badge/coverage-100%25-brightgreen.svg)](https://github.com/prosubodh/azcodr/actions/workflows/ci.yml)
+[![Mutation Score](https://img.shields.io/badge/mutants%20killed-100%25-brightgreen.svg)](https://github.com/prosubodh/azcodr/blob/main/benchmark/RESULTS.md)
+[![Dependencies](https://img.shields.io/badge/dependencies-0-success.svg)](https://www.npmjs.com/package/azcodr)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
+
+> CI-enforced 100% gate (lines / branches / functions / statements) + 100% mutant kill on guards; the public report is the `coverage-report` artifact on every CI run.
 [![Dependencies](https://img.shields.io/badge/dependencies-0-success.svg)](https://www.npmjs.com/package/azcodr)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
 
@@ -127,7 +131,7 @@ The architecture enforces 28 cohesive, single-responsibility domain rules. Read
 
 | Domain | Rule Reference File | Key Focus & Invariants |
 |---|---|---|
-| **TDD & Isolation** | [`test_driven_development.md`](./docs/rules/test_driven_development.md) | Outside-In TDD, Uncle Bob's 3 Laws, 100% coverage, test isolation & DB rollback. |
+| **TDD & Isolation** | [`test_driven_development.md`](./docs/rules/test_driven_development.md) | Outside-In TDD, Uncle Bob's 3 Laws, 100% coverage on all metrics + mutation gate, test isolation & DB rollback. |
 | **Clean Code** | [`clean_code.md`](./docs/rules/clean_code.md) | Naming, small functions, CQS, SLAP, DRY, DbC, zero side-effects. |
 | **Design Patterns** | [`design_patterns.md`](./docs/rules/design_patterns.md) | Adapter, Factory, Strategy, Result `<T, E>`, and GoF pattern catalog. |
 | **Type Safety** | [`type_safety.md`](./docs/rules/type_safety.md) | Compiler strictness, branded nominal types, type discriminators across polyglot languages. |
@@ -171,10 +175,10 @@ The architecture enforces 28 cohesive, single-responsibility domain rules. Read
 
 ## 🚀 Starting a New Project with `/lets-build`
 
-This repository serves as an **enterprise architectural starter template**. When beginning a new software project:
+This repository serves as an **architecture governance toolkit, with an optional starter**. When beginning a new software project:
 
 ### Step 1: Initialize Workspace with npx
-Pull and scaffold the complete enterprise architectural template into your project directory using `npx`:
+Pull and scaffold the complete architecture governance toolkit into your project directory using `npx`:
 ```bash
 npx azcodr my-new-project
 cd my-new-project

package/docs/generated-enforcement-analysis.md

@@ -0,0 +1,141 @@
+# Generated-Project Enforcement Analysis: What a Scaffolded Project Actually Gets
+
+> **Status:** evidence, not prose. Every claim below was produced by running the
+> scaffolder on 2026-10-08, not by reading the skills docs.
+> **Answers the plan's open question:** which linters does a non-TypeScript
+> project actually get — and whether the "executable architecture" promise holds
+> outside azcodr's own repo.
+
+---
+
+## Method
+
+1. Ran `scaffold({ force: true, noGit: true })` from compiled `lib/` into a clean
+   temp dir; inventoried every emitted file.
+2. Ran `bootstrap_workspace.sh . <topology> <language>` under Git Bash for
+   `backend+typescript`, `backend+python`, `cli+go`, `extension+typescript`,
+   `systems-library+c`; diffed the file lists.
+3. Executed the scaffolded project's `.agents/scripts/agent_guard.js` with a
+   must-block payload (`rm -rf /`), with the azcodr repo itself as control.
+
+## Finding 1: No deterministic linter in any generated project
+
+The scaffolded project contains exactly one toolchain-adjacent file:
+`.editorconfig`. Its `package.json` lint script is:
+
+```json
+"lint": "echo \"No linter configured yet. Run /lets-build to configure toolchain.\""
+```
+
+The polyglot fitness-function table (`docs/rules/clean_code.md`, § Polyglot
+Fitness Function Standards: ESLint / ruff / clippy / golangci-lint /
+Checkstyle / Roslyn) ships as **documentation only**. Phase 4 step 3 of
+`lets-build/SKILL.md` instructs the *agent* to "generate … deterministic
+linter configurations" — i.e. enforcement in a user's project is agent-authored
+and non-deterministic, exactly the gap the plan flagged. **A non-TypeScript
+project gets no linter at all unless the agent writes one.**
+
+## Finding 2: LANGUAGE does not change generated output
+
+`backend+typescript` and `backend+python` produce byte-identical file lists
+(18 files each: `.gitkeep` dirs, `tokens.json`, `smoke_test.sh`,
+`workspace-profile.env`). `LANGUAGE` is validated and recorded but never
+branches generation. Topology *does* scope directories (7–18 files by
+topology). So: topology-scoping is deterministic; language support is a
+recorded intention, not a generated artifact.
+
+## Finding 3: The shipped runtime guard is inert in generated projects (fail-open)
+
+`TEMPLATE_ITEMS` (`src/scaffold.ts`) ships `docs`, `.agents`, `scripts`,
+`.github` — but **not** `src/`, `lib/`, or `bin/`. Consequences, all verified:
+
+| Check | azcodr repo (control) | Scaffolded project |
+|---|---|---|
+| `.agents/scripts/agent_guard.js` vs `rm -rf /` payload | **BLOCKED** (exit 1) | **ALLOWED** (exit 0) |
+| `lib/agent-guard.js` present | yes | **missing** — the guard's dynamic import rejects, and `main().catch(() => process.exit(0))` fails open |
+| `.agents/hooks.json` references `agent_guard.js` | no | no |
+| All hook blocks in `hooks.json` | `enabled: false` | `enabled: false` (shipped copy) |
+
+The flagship "agent cannot skip" control therefore degrades, in a generated
+project, to: an unwired hook script, with its engine missing, configured off,
+that permits on error. The `boundaries` engine (`npx azcodr boundaries`)
+likewise does not ship — only `scripts/validate-cli.js` (config/ledger/link
+checks) is present.
+
+## What *does* transfer deterministically
+
+- 28 rule docs, 6 skills, `AGENTS.md` parity pointers, empty ADR ledger
+  (`data/memory.template`), `safety_guard.sh` + `verify_completion.sh` (present
+  but disabled in `hooks.json`), `smoke_test.sh` placeholder, topology-scoped
+  directories, `tokens.json` (backend/web only), `.azcodr/workspace-profile.env`.
+
+## Recommendations (product decisions, not taken here)
+
+1. **Either ship the engine or stop implying it ships.** Options: (a) add a
+   dependency on the published `azcodr` package + `lib/`- backed guard entry in
+   the starter `package.json`; (b) vendor a self-contained guard bundle into
+   `.agents/scripts/` with no `../../lib` import; (c) reword SKILL.md Phase 4
+   step 3 from "generate deterministic linter configurations" to an explicit
+   agent-authored checklist with verification (`npm run lint` must fail before
+   configs land, not echo).
+2. **Fail closed, and wire the hook.** `agent_guard.js`'s catch-all `exit(0)`
+   is the wrong default for a security boundary; and `hooks.json` should ship
+   with at least the safety guard enabled plus a setup step that proves the
+   harness honors it (harnesses ignore unknown/unenabled hooks silently).
+3. **Make LANGUAGE generative or say it isn't.** Either branch
+   `bootstrap_workspace.sh` per language (build manifests + pinned linter
+   configs per `clean_code.md` table) or change the skill wording to record the
+   language decision for the agent to implement in Phase 4.
+4. **Close the benchmark gap this reveals.** `benchmark/RESULTS.md` Arm B/C
+   assume working hooks + boundary engine; in a real scaffolded project neither
+   is present. A fourth arm — *raw scaffolded project, no agent-authored
+   additions* — would measure the actual out-of-box enforcement: expect 0/3
+   traps caught.
+
+---
+
+## Addendum (2026-10-08): findings fixed — verify, don't trust
+
+The three findings above are closed by the enforcement change set; each fix
+names the test that locks it:
+
+1. **No deterministic linter → per-language gate configs emitted.**
+   `bootstrap_workspace.sh` now writes the pinned config for the recorded
+   language (`eslint.config.js`, `ruff.toml`, `clippy.toml`, `.golangci.yml`,
+   `checkstyle.xml`, `.editorconfig` CA block, `.clang-tidy`; `generic` emits
+   none). Locked by `tests/bootstrap-toolchain.test.ts` (9 tests); presence is
+   re-checked on every `validate` run by the new phase 7
+   (`scripts/validate/toolchain.js`, 100% covered).
+2. **LANGUAGE decorative → generative for toolchain.**
+   `backend+typescript` and `backend+python` still share directory trees
+   (topology-scoping, by design) but now differ in emitted gate configs; the
+   profile feed (`readProfileLanguage`) drives the validator. The agent still
+   owns build manifests (naming decisions) plus tool install and the Phase 5
+   live-block proof (`lets-build/SKILL.md`).
+3. **Fail-open guard → vendored engine + fail-closed install.**
+   The guard engine ships inside `.agents/` (`.agents/lib/`, byte-locked to
+   `lib/` output by test), `agent_guard.js` resolves vendored-first, and a
+   missing engine exits 2 naming every path tried. Unparseable *payloads*
+   still fail open inside `inspectPreTool` per ADR-005 (ambiguous input, not a
+   broken install). `hooks.json` (+`.example`) wires an `architectural-guard`
+   PreToolUse entry. Locked by the three new `tests/agent-guard.test.ts` cases.
+4. **Benchmark assumes working hooks → Arm D measures the scaffold.**
+   `runArmD()` + `auditScaffoldEnforcement()` score a real scaffold before and
+   after bootstrap; `benchmark/RESULTS.md` §5 carries the scorecard.
+5. **Echo lint placeholder → rewired for Node profiles.** `bootstrap` points
+   the starter `lint` script at the emitted `eslint.config.js` (placeholder
+   only, never agent-wired entries; skipped when node is unavailable), so
+   `npm run lint` fails until the pinned tool lands instead of echoing
+   success.
+
+## Reproduce
+
+```bash
+# 1. Scaffold inventory
+node -e "const {scaffold}=require('./lib/scaffold.js'); scaffold({targetDir:'<tmp>',force:true,noGit:true})"
+# 2. Topology x language matrix (Git Bash)
+bash .agents/skills/lets-build/scripts/bootstrap_workspace.sh <tmp> backend python
+# 3. Guard fail-open proof
+echo '{"tool_name":"run_command","tool_input":{"command":"rm -rf /"}}' \
+  | node <scaffold>/.agents/scripts/agent_guard.js; echo "exit=$?"
+```

package/docs/rules/clean_code.md

@@ -57,13 +57,13 @@ Before writing production code for any new feature or user story, the agent must
 Prevent AI-generated code rot using automated fitness functions integrated into linting and continuous verification:
 - **File Length Gates**: Maximum 250–300 lines per file (ESLint `max-lines`).
 - **Function Length Gates**: Maximum 20–30 lines per function (ESLint `max-lines-per-function`).
-- **Dependency Direction Gates**: Enforce unidirectional import rules (e.g. `import/no-restricted-paths`, `dependency-cruiser`, `ArchUnit`) ensuring domain core never imports infrastructure or transport adapters.
+- **Dependency Direction & Boundary Gates**: Enforce unidirectional import rules and cycle prevention natively with Azcodr's zero-dependency boundary linter (`npx azcodr boundaries [dir]`) or polyglot equivalents (ArchUnit, dependency-cruiser) ensuring domain core never imports infrastructure or transport adapters, and circular dependencies are forbidden.
 - **Complexity Budgets**: Enforce cyclomatic complexity limits (maximum 10 per function).
 If an AI attempt to add code violates any fitness function, the build fails immediately, blocking completion until the architecture is refactored.
 
 ### Polyglot Fitness Function Standards
 
-When bootstrapping non-TypeScript projects via `/lets-build`, the agent must instantiate deterministic, automated fitness function gates matching these exact rules:
+When bootstrapping projects via `/lets-build`, `bootstrap_workspace.sh` emits the pinned gate configuration for the recorded language (never invented, never absent); the agent then installs the named tool, wires the project's lint entry to it, and proves the gate in Phase 5. Gates must match these exact rules:
 
 | Language | Linter / Static Tool | Max File Lines (300) | Max Function Lines (30) | Max Complexity (10) | Max Arguments (3) |
 |---|---|---|---|---|---|
@@ -73,3 +73,4 @@ When bootstrapping non-TypeScript projects via `/lets-build`, the agent must ins
 | **Go** | `golangci-lint` | `maintidx: 300` | `funlen: lines = 30` | `gocyclo: min-complexity = 10` | `funlen: statements = 25` |
 | **Java** | `Checkstyle` + `ArchUnit` | `FileLength: max 300` | `MethodLength: max 30` | `CyclomaticComplexity: max 10` | `ParameterNumber: max 3` |
 | **C# / .NET** | `.editorconfig` + Roslyn | `file_length = 300:error` | `method_length = 30:error` | `CA1502: Avoid excessive complexity <= 10` | `CA1501: max 3 params` |
+| **C / C++** | `clang-tidy` | project lint entry (no native check) | `readability-function-size LineThreshold = 30` | `readability-function-cognitive-complexity Threshold = 10` | `readability-function-size ParameterThreshold = 3` |

package/docs/rules/test_driven_development.md

@@ -1,6 +1,6 @@
 # Test-Driven Development (London School TDD) & Test Isolation Standards
 
-> **Core Mandate:** Drive all features through the non-negotiable 5-Phase Agile Domain Lifecycle (Outside-In Double-Loop TDD, Uncle Bob's 3 Laws), enforcing transactional database rollback per test, zero-sleep determinism, and non-negotiable 100.00% statement, branch, and function coverage gates.
+> **Core Mandate:** Drive all features through the non-negotiable 5-Phase Agile Domain Lifecycle (Outside-In Double-Loop TDD, Uncle Bob's 3 Laws), enforcing transactional database rollback per test, zero-sleep determinism, and CI-enforced 100% coverage on all metrics plus mutation floor (assertion-free tests rejected).
 
 ---
 
@@ -14,7 +14,7 @@ flowchart TD
     P2["Phase 2: Tactical Domain Analysis<br/>• Ubiquitous Language & Bounded Contexts<br/>• Aggregate Roots & Business Invariants"]
     P3["Phase 3: Outer Acceptance Test (RED)<br/>• Failing UI component or API route test<br/>• Verifies failure for expected reason"]
     P4["Phase 4: Inner TDD & Collaborator Discovery (RED-GREEN-REFACTOR)<br/>• Discovers Use Cases & Ports<br/>• Nano-cycles with Uncle Bob's 3 Laws"]
-    P5["Phase 5: Outer Verification & Proof (GREEN)<br/>• Outer test passes with zero regressions<br/>• 100.00% coverage & boundary smoke verification"]
+    P5["Phase 5: Outer Verification & Proof (GREEN)<br/>• Outer test passes with zero regressions<br/>• 100% coverage on all metrics + mutation gate & boundary smoke verification"]
 
     P1 --> P2 --> P3 --> P4 --> P5
 ```
@@ -125,10 +125,13 @@ sequenceDiagram
 
 ---
 
-## 7. Mandatory 100.00% Test Coverage Thresholds
+## 7. Mandatory 100% Coverage on All Metrics + Mutation Floor (No Assertion-Free Tests)
 
-- **Strict Coverage Thresholds**: Maintain line, function, branch, and statement test coverage at **100.00%** across all backend domain logic, adapters, contracts, and frontend suites. Strictly enforce 100% threshold failure gates in CI pipelines (`scripts/test_coverage.js`).
-- **Exhaustive Status Codes & Error Branches**: Explicitly test all HTTP/gRPC response codes:
+- **Strict 100% thresholds:** CI fails unless line, function, branch, AND statement coverage are all 100% (`jest.config.js`: lines 100 / functions 100 / branches 100 / statements 100). Generated projects must hold the same 100% bar in their own stack via the per-language gates in `docs/rules/clean_code.md`. Lowering any metric requires an ADR.
+- **Mutation floor on guards:** line coverage alone proves little. Behavioral guards (`agent-guard-*`, `boundaries.ts`, protected-target checks) must hold a 100% mutant-kill gate (`npm run test:mutation`, `benchmark/mutation-test.js`). A green suite that lets a `blocked: true → false` or `return cycles → return []` mutant survive is a failure, even at 100% lines.
+- **Assertion-density check:** agents asked to hit a line number write assertion-free tests to cover lines. Reject that explicitly: every new behavioral test must contain at least one behavior-asserting expectation (no `expect(true).toBe(true)`, no tests without assertions). Prefer `benchmark/evaluate.js --strict-tests` style checks (assertions per test ≥ 1, critical paths ≥ 2) over raising the line percentage.
+- **What this repo enforces vs what users get:** this repo's exact thresholds live in `jest.config.js` (100% lines, branches, functions, statements) and are locked by `tests/coverage-config.test.ts`. Generated polyglot projects get the equivalent per-language fitness gates in `docs/rules/clean_code.md` (ESLint / ruff / clippy / golangci-lint / Checkstyle / Roslyn) at the same 100% bar — the tooling differs by stack, the bar must not.
+- **Exhaustive status codes & error branches:** explicitly test all HTTP/gRPC response codes:
   - Success: `200 OK`, `201 Created`, `204 No Content`
   - Client Errors: `400 Bad Request`, `401 Unauthorized`, `403 Forbidden`, `404 Not Found`, `409 Conflict`, `422 Unprocessable Entity`, `429 Too Many Requests`
   - Server Failures: `500 Internal Server Error`, `503 Service Unavailable`

package/lib/index.d.ts

@@ -1,6 +1,6 @@
 /**
  * @module @azcodr/azcodr
- * Enterprise Architecture & Agentic Engineering Starter Template.
+ * Architecture governance toolkit, with an optional starter.
  *
  * Provides problem-first, topology-aligned project scaffolding with strict systemic atomicity,
  * filesystem scope guards, git worktree initialization, and multi-agent harness parity.

package/lib/index.js

@@ -1,6 +1,6 @@
 /**
  * @module @azcodr/azcodr
- * Enterprise Architecture & Agentic Engineering Starter Template.
+ * Architecture governance toolkit, with an optional starter.
  *
  * Provides problem-first, topology-aligned project scaffolding with strict systemic atomicity,
  * filesystem scope guards, git worktree initialization, and multi-agent harness parity.

package/lib/scaffold.js

@@ -126,7 +126,7 @@ function starterPackageJson(resolvedTarget) {
         version: '0.1.0',
         type: 'module',
         private: true,
-        description: 'Scaffolded with azcodr enterprise architecture template',
+        description: 'Scaffolded with the azcodr architecture governance toolkit',
         scripts: {
             test: 'node --test',
             'test:coverage': 'jest --coverage',

package/lib/scaffold.js.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../src/scaffold.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,WAAW;IACX,WAAW;IACX,WAAW;IACX,MAAM;IACN,SAAS;IACT,SAAS;IACT,SAAS;IACT,YAAY;IACZ,eAAe;IACf,SAAS;CACV,CAAC;AA2CF,SAAS,kBAAkB,CAAC,cAAsB,EAAE,gBAAwB;IAC1E,IAAI,cAAc,KAAK,gBAAgB;QAAE,OAAO;IAChD,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,GAAG,WAAW,CAAC,oBAAoB,KAAK,cAAc,EAAE,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,cAAsB,EACtB,WAAmB,EACnB,cAAuB;IAEvB,IAAI,cAAc;QAAE,OAAO;IAC3B,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC;QAAE,OAAO;IAChE,MAAM,IAAI,aAAa,CACrB,uBAAuB,EACvB,GAAG,WAAW,CAAC,qBAAqB,KAAK,cAAc,IAAI;QAC3D,oGAAoG,CACrG,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,cAAsB,EAAE,KAAc;IAClE,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK;QAAE,OAAO;IAC1C,MAAM,IAAI,aAAa,CACrB,oBAAoB,EACpB,GAAG,WAAW,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM,iBAAiB,cAAc,KAAK;QACxF,0CAA0C,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,UAAiC,EAAE;IACnF,MAAM,EAAE,WAAW,GAAG,cAAc,EAAE,EAAE,KAAK,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,cAAc,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1G,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnD,kBAAkB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACrD,qBAAqB,CAAC,cAAc,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,oBAAoB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,mBAAmB,CAAC,gBAAwB,EAAE,IAAY;IACjE,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACtE,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,GAAG,aAAa,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,cAAsB,EAAE,gBAAwB,EAAE,MAAe;IAC1F,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACjD,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACxC,YAAY,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,QAAQ,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAsB,EAAE,MAAe;IAClE,MAAM,KAAK,GAAgC;QACzC,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1B,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1B,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1B,CAAC,cAAc,EAAE,WAAW,CAAC;QAC7B,CAAC,gBAAgB,EAAE,WAAW,CAAC;KAChC,CAAC;IACF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,KAAK,EAAE,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,YAAY,QAAQ,OAAO,cAAc,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAsB,EAAE,MAAe;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,sBAAsB,CAAC;QACrB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,yBAAyB;QACnC,cAAc,EAAE,cAAc;QAC9B,MAAM;KACP,CAAC,CAAC;IACH,OAAO,CAAC,0DAA0D,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CAAC,cAAsB;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC;IAClE,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE;YACP,IAAI,EAAE,aAAa;YACnB,eAAe,EAAE,iBAAiB;YAClC,IAAI,EAAE,0EAA0E;YAChF,QAAQ,EAAE,8BAA8B;SACzC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,cAAsB,EAAE,MAAe;IACvE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAC9D,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB,EAAE,MAAe;IAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,cAAsB,cAAc,EAAE,EACtC,UAA+B,EAAE;IAEjC,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,cAAc,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC5E,OAAO,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,UAA2B,EAAE;IACpD,MAAM,EACJ,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,EACzB,KAAK,GAAG,KAAK,EACb,KAAK,GAAG,KAAK,EACb,WAAW,GAAG,cAAc,EAAE,EAC9B,MAAM,GAAG,KAAK,EACf,GAAG,OAAO,CAAC;IACZ,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,cAAc,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,IAAI,cAAc;QAAE,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,OAAO,EACL,aAAa,EAAE,sBAAsB,EAAE,yBAAyB,EAChE,qBAAqB,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAC3D,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAC5D,CAAC;AAIF,eAAe;IACb,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa;IACrD,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB;IACxE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM;IACpD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB;CAC5E,CAAC"}
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../src/scaffold.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,WAAW;IACX,WAAW;IACX,WAAW;IACX,MAAM;IACN,SAAS;IACT,SAAS;IACT,SAAS;IACT,YAAY;IACZ,eAAe;IACf,SAAS;CACV,CAAC;AA2CF,SAAS,kBAAkB,CAAC,cAAsB,EAAE,gBAAwB;IAC1E,IAAI,cAAc,KAAK,gBAAgB;QAAE,OAAO;IAChD,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,GAAG,WAAW,CAAC,oBAAoB,KAAK,cAAc,EAAE,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,cAAsB,EACtB,WAAmB,EACnB,cAAuB;IAEvB,IAAI,cAAc;QAAE,OAAO;IAC3B,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,CAAC;QAAE,OAAO;IAChE,MAAM,IAAI,aAAa,CACrB,uBAAuB,EACvB,GAAG,WAAW,CAAC,qBAAqB,KAAK,cAAc,IAAI;QAC3D,oGAAoG,CACrG,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,cAAsB,EAAE,KAAc;IAClE,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK;QAAE,OAAO;IAC1C,MAAM,IAAI,aAAa,CACrB,oBAAoB,EACpB,GAAG,WAAW,CAAC,kBAAkB,KAAK,OAAO,CAAC,MAAM,iBAAiB,cAAc,KAAK;QACxF,0CAA0C,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,UAAiC,EAAE;IACnF,MAAM,EAAE,WAAW,GAAG,cAAc,EAAE,EAAE,KAAK,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,cAAc,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1G,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnD,kBAAkB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACrD,qBAAqB,CAAC,cAAc,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,oBAAoB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,mBAAmB,CAAC,gBAAwB,EAAE,IAAY;IACjE,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACtE,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,GAAG,aAAa,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,cAAsB,EAAE,gBAAwB,EAAE,MAAe;IAC1F,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACjD,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACxC,YAAY,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,QAAQ,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAsB,EAAE,MAAe;IAClE,MAAM,KAAK,GAAgC;QACzC,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1B,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1B,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1B,CAAC,cAAc,EAAE,WAAW,CAAC;QAC7B,CAAC,gBAAgB,EAAE,WAAW,CAAC;KAChC,CAAC;IACF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,KAAK,EAAE,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,YAAY,QAAQ,OAAO,cAAc,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAsB,EAAE,MAAe;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,sBAAsB,CAAC;QACrB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,yBAAyB;QACnC,cAAc,EAAE,cAAc;QAC9B,MAAM;KACP,CAAC,CAAC;IACH,OAAO,CAAC,0DAA0D,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CAAC,cAAsB;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC;IAClE,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE;YACP,IAAI,EAAE,aAAa;YACnB,eAAe,EAAE,iBAAiB;YAClC,IAAI,EAAE,0EAA0E;YAChF,QAAQ,EAAE,8BAA8B;SACzC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,cAAsB,EAAE,MAAe;IACvE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAC9D,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB,EAAE,MAAe;IAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,cAAsB,cAAc,EAAE,EACtC,UAA+B,EAAE;IAEjC,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,cAAc,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC5E,OAAO,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,UAA2B,EAAE;IACpD,MAAM,EACJ,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,EACzB,KAAK,GAAG,KAAK,EACb,KAAK,GAAG,KAAK,EACb,WAAW,GAAG,cAAc,EAAE,EAC9B,MAAM,GAAG,KAAK,EACf,GAAG,OAAO,CAAC;IACZ,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,cAAc,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,IAAI,cAAc;QAAE,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,OAAO,EACL,aAAa,EAAE,sBAAsB,EAAE,yBAAyB,EAChE,qBAAqB,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAC3D,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAC5D,CAAC;AAIF,eAAe;IACb,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa;IACrD,sBAAsB,EAAE,yBAAyB,EAAE,qBAAqB;IACxE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM;IACpD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB;CAC5E,CAAC"}

package/memory.md

@@ -35,6 +35,8 @@
 | [ADR-016](./memory.md#adr-016-standalone-architectural-validator-agent-runtime-hooks-boundary-engine--empirical-benchmark) | Standalone Architectural Validator, Agent Runtime Hooks, Boundary Engine & Empirical Benchmark | 2026-10-08 | ACCEPTED | [`agentic_configuration.md`](./docs/rules/agentic_configuration.md) |
 | [ADR-017](./memory.md#adr-017-continuous-mutation-and-benchmark-ci-gates-oss-governance-and-reference-example) | Continuous Mutation & Benchmark CI Gates, OSS Governance & Reference Example | 2026-10-08 | ACCEPTED | [`devops_ci_cd.md`](./docs/rules/devops_ci_cd.md) |
 | [ADR-018](./memory.md#adr-018-first-class-architectural-boundary-and-cycle-inspection-cli-subcommand) | First-Class Architectural Boundary and Cycle Inspection CLI Subcommand | 2026-10-08 | ACCEPTED | [`clean_code.md`](./docs/rules/clean_code.md) |
+| [ADR-019](./memory.md#adr-019-honest-claims-100-percent-all-metrics-gate-and-benchmark-limits-on-the-record) | Honest claims, 100% all-metrics gate, and benchmark limits on the record | 2026-10-08 | ACCEPTED | [`test_driven_development.md`](./docs/rules/test_driven_development.md) |
+| [ADR-020](./memory.md#adr-020-generated-projects-get-deterministic-enforcement) | Generated projects get deterministic enforcement | 2026-10-08 | ACCEPTED | [`clean_code.md`](./docs/rules/clean_code.md) |
 
 ---
 
@@ -96,6 +98,20 @@
 - **Consequences:** ✅ Every PR and push automatically verifies 100% mutation resistance and benchmark assertions. ✅ Full open-source governance compliance achieved (`SECURITY.md`, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`). ✅ Concrete, working reference example proves downstream architectural boundaries and Clean Code limits. ✅ 100.00% lines, functions, statements, and branches coverage maintained across all 40 test suites and 489 tests.
 - **Enforced In:** `.github/workflows/ci.yml`, `benchmark/mutation-test.js`, `CODE_OF_CONDUCT.md`, `examples/clean-architecture-todo/`, `tests/example-project.test.ts`, `README.md`, `package.json`
 
+#### ADR-020: Generated Projects Get Deterministic Enforcement
+- **Date:** 2026-10-08 | **Status:** ACCEPTED
+- **Context:** The generated-enforcement analysis (`docs/generated-enforcement-analysis.md`) proved three defects by execution: (1) zero deterministic linter configs in any generated project (starter `lint` is an echo placeholder), (2) LANGUAGE recorded but never generative, (3) the shipped `agent_guard.js` crashed on its missing `../../lib` engine and its catch-all `exit(0)` silently allowed everything — including `rm -rf /` — in scaffolded projects.
+- **Decision:** (1) Vendor the closed guard-engine set (`agent-guard{,-command,-file,-tdd}.js`) into `.agents/lib/` (byte-locked to `lib/` output by test; re-copy after every build per `CONTRIBUTING.md`); the hook resolves vendored-first, repo-layout second, `AZCODR_GUARD_ENGINE` override first. (2) Fail CLOSED (exit 2, naming every path tried) only when the engine itself cannot load — a broken install, not an ambiguous input; unparseable tool payloads still fail open inside `inspectPreTool` per ADR-005. (3) `bootstrap_workspace.sh` emits the pinned per-language gate config (11 profiles; `generic` emits none; create-if-absent so re-runs never clobber); build manifests stay agent-authored (naming decisions), and the agent installs the tool plus proves the gate with a live block in Phase 5. (4) `hooks.json` (+`.example`) wires an `architectural-guard` PreToolUse entry, disabled by default like all hooks — auto-enabling Stop/lint hooks in a dependency-less fresh scaffold would brick agent loops. (5) New validator phase 7 checks gate-config presence from `.azcodr/workspace-profile.env`, skipping cleanly without a profile (this repo unaffected). (6) Benchmark Arm D (`runArmD` + `auditScaffoldEnforcement`) scores a real scaffold before/after bootstrap; agent-layer state (tool installed, lint wired, hooks on) is reported, never gating.
+- **Consequences:** ✅ Same `rm -rf /` payload now BLOCKED from vendored layout; missing engine exits 2 instead of allowing. ✅ Every recorded language produces its gate config; `validate` fails when one is deleted. ✅ 100% coverage holds on the new `scripts/validate/toolchain.js`. ⚠️ Hooks still require harness opt-in; tool installation still requires network at agent time — both recorded openly in `benchmark/RESULTS.md` §5–8.
+- **Enforced In:** `.agents/lib/`, `.agents/scripts/agent_guard.js`, `.agents/hooks.json`, `.agents/skills/lets-build/scripts/bootstrap_workspace.sh`, `scripts/validate/toolchain.js`, `benchmark/evaluate.js`, `benchmark/run-benchmark.js`, `tests/agent-guard.test.ts`, `tests/bootstrap-toolchain.test.ts`, `tests/validate-toolchain.test.ts`, `tests/benchmark.test.ts`
+
+#### ADR-019: Honest Claims, 100% All-Metrics Gate, and Benchmark Limits on the Record
+- **Date:** 2026-10-08 | **Status:** ACCEPTED
+- **Context:** An outside consolidated review found the engineering real but several claims ahead of evidence: "Enterprise starter" positioning vs a governance toolkit, coverage badges without a linked report, and a benchmark that proved drift reduction on synthetic fixtures while reading as a live-agent trial. Separately, the Jest gate enforced 100% lines but only 97% functions / 98% branches even though actual coverage measured 100/100/100/100.
+- **Decision:** (1) Reposition wording to "Architecture governance toolkit, with an optional starter" (`package.json`, `jsr.json`, `AGENTS.md`, `README.md`, `src/index.ts`). (2) Raise the Jest gate to 100% lines, functions, branches, AND statements, locked by `tests/coverage-config.test.ts`; badges link to the CI workflow and the `coverage-report` artifact; docs keep the 100% bar AND the mutation floor plus assertion-density rejection so the number cannot be gamed with assertion-free tests. (3) Harden the benchmark honestly instead of inflating it: `evaluate.js` adds a test-quality proxy and marks cost metrics as manual-only, `run-benchmark.js` writes timestamped JSON transcripts to `benchmark/results/` and prints limitations, `RESULTS.md` gains "Where Azcodr Loses" and "Threats to validity" sections.
+- **Consequences:** ✅ Claims match evidence; the gate is stricter than reality required (no new tests needed — 503 already pass at 100%). ✅ Every benchmark citation now ships with a transcript and a limits section. ⚠️ Synthetic single-run limits remain (no multi-model variance, no token/review-minute measurement) — recorded openly rather than fixed.
+- **Enforced In:** `jest.config.js`, `tests/coverage-config.test.ts`, `benchmark/evaluate.js`, `benchmark/run-benchmark.js`, `benchmark/RESULTS.md`, `README.md`, `CONTRIBUTING.md`, `docs/rules/test_driven_development.md`
+
 #### ADR-018: First-Class Architectural Boundary and Cycle Inspection CLI Subcommand
 - **Date:** 2026-10-08 | **Status:** ACCEPTED
 - **Context:** Following the implementation of the zero-dependency boundary and cycle engine (`src/boundaries.ts`, ADR-016), inspecting dependency cycles and Clean Architecture layer breaches required either running the empirical benchmark or importing the internal TypeScript engine programmatically. Users and CI pipelines lacked a direct, dedicated CLI entry point (`npx azcodr boundaries [dir]`) to run boundary and circular dependency inspections as a standalone architectural linter.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "azcodr",
-  "version": "2.4.0",
-  "description": "Enterprise Architecture & Agentic Engineering Starter Template",
+  "version": "2.5.1",
+  "description": "Architecture governance toolkit with topology-scoped scaffolding for AI-assisted development (early release)",
   "type": "module",
   "bin": {
     "azcodr": "bin/azcodr.js"

package/scripts/validate/toolchain.js

@@ -0,0 +1,60 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const TOOLCHAIN_FILES = {
+  typescript: ['eslint.config.js'],
+  javascript: ['eslint.config.js'],
+  deno: ['eslint.config.js'],
+  bun: ['eslint.config.js'],
+  python: ['ruff.toml'],
+  rust: ['clippy.toml'],
+  go: ['.golangci.yml'],
+  java: ['checkstyle.xml'],
+  csharp: ['.editorconfig'],
+  cpp: ['.clang-tidy'],
+  c: ['.clang-tidy'],
+  generic: []
+};
+
+export function readProfileLanguage(workspaceRoot) {
+  const profile = path.join(workspaceRoot, '.azcodr', 'workspace-profile.env');
+  if (!fs.existsSync(profile)) return null;
+  const match = /^language=(.+)$/m.exec(fs.readFileSync(profile, 'utf-8'));
+  return match ? match[1].trim() : null;
+}
+
+export function expectedToolchainFiles(language) {
+  if (!language) return [];
+  return TOOLCHAIN_FILES[language] || [];
+}
+
+function reportMissing(ctx, language, expected) {
+  let missing = 0;
+  for (const name of expected) {
+    if (!fs.existsSync(path.join(ctx.workspaceRoot, name))) {
+      ctx.fail(`Missing toolchain gate '${name}' for language '${language}'; re-run bootstrap or restore the config.`);
+      missing += 1;
+    }
+  }
+  return missing;
+}
+
+export function phaseToolchain(ctx) {
+  ctx.log('');
+  ctx.heading('7. Checking Toolchain Enforcement...');
+  const language = readProfileLanguage(ctx.workspaceRoot);
+  if (language === null) {
+    ctx.pass('No workspace profile; toolchain check skipped.');
+    return;
+  }
+  const expected = expectedToolchainFiles(language);
+  if (expected.length === 0) {
+    ctx.pass(`Language '${language}' declares no toolchain configs; nothing to enforce.`);
+    return;
+  }
+  if (reportMissing(ctx, language, expected) === 0) {
+    ctx.pass(`Toolchain gates present for language '${language}' (${expected.join(', ')}).`);
+  }
+}
+
+export default { TOOLCHAIN_FILES, readProfileLanguage, expectedToolchainFiles, phaseToolchain };

package/scripts/validate.js

@@ -11,6 +11,7 @@ import { phaseRootConfig } from './validate/root.js';
 import { phaseRules } from './validate/rules.js';
 import { phaseSkills } from './validate/skills.js';
 import { phaseLinks } from './validate/links.js';
+import { phaseToolchain, readProfileLanguage, expectedToolchainFiles, TOOLCHAIN_FILES } from './validate/toolchain.js';
 
 /**
  * NOTE: this module is a library. It never self-executes, so importing it from
@@ -105,6 +106,7 @@ function runValidation(workspaceRoot, reporter = createReporter()) {
   phaseLinks(ctx);
   phaseMemory(ctx);
   phaseLedger(ctx);
+  phaseToolchain(ctx);
   reportSummary(counts, reporter);
   return {
     errors: counts.errors,
@@ -138,7 +140,11 @@ export {
   createLowercaseParityLink,
   stripHtmlComments,
   stripFencedCode,
-  walkMarkdown
+  walkMarkdown,
+  phaseToolchain,
+  readProfileLanguage,
+  expectedToolchainFiles,
+  TOOLCHAIN_FILES
 };
 
 export default {
@@ -154,5 +160,9 @@ export default {
   createLowercaseParityLink,
   stripHtmlComments,
   stripFencedCode,
-  walkMarkdown
+  walkMarkdown,
+  phaseToolchain,
+  readProfileLanguage,
+  expectedToolchainFiles,
+  TOOLCHAIN_FILES
 };

package/src/index.ts

@@ -1,6 +1,6 @@
 /**
  * @module @azcodr/azcodr
- * Enterprise Architecture & Agentic Engineering Starter Template.
+ * Architecture governance toolkit, with an optional starter.
  *
  * Provides problem-first, topology-aligned project scaffolding with strict systemic atomicity,
  * filesystem scope guards, git worktree initialization, and multi-agent harness parity.

package/src/scaffold.ts

@@ -184,7 +184,7 @@ function starterPackageJson(resolvedTarget: string): Record<string, unknown> {
     version: '0.1.0',
     type: 'module',
     private: true,
-    description: 'Scaffolded with azcodr enterprise architecture template',
+    description: 'Scaffolded with the azcodr architecture governance toolkit',
     scripts: {
       test: 'node --test',
       'test:coverage': 'jest --coverage',