cclaw-cli 7.7.1 → 8.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +211 -134
- package/dist/artifact-frontmatter.d.ts +51 -0
- package/dist/artifact-frontmatter.js +131 -0
- package/dist/artifact-paths.d.ts +7 -27
- package/dist/artifact-paths.js +20 -249
- package/dist/cancel.d.ts +16 -0
- package/dist/cancel.js +66 -0
- package/dist/cli.d.ts +2 -27
- package/dist/cli.js +107 -511
- package/dist/compound.d.ts +26 -0
- package/dist/compound.js +96 -0
- package/dist/config.d.ts +14 -51
- package/dist/config.js +23 -359
- package/dist/constants.d.ts +11 -18
- package/dist/constants.js +19 -106
- package/dist/content/antipatterns.d.ts +1 -0
- package/dist/content/antipatterns.js +109 -0
- package/dist/content/artifact-templates.d.ts +10 -0
- package/dist/content/artifact-templates.js +550 -0
- package/dist/content/cancel-command.d.ts +2 -2
- package/dist/content/cancel-command.js +25 -17
- package/dist/content/core-agents.d.ts +9 -233
- package/dist/content/core-agents.js +39 -768
- package/dist/content/decision-protocol.d.ts +1 -12
- package/dist/content/decision-protocol.js +27 -20
- package/dist/content/examples.d.ts +8 -42
- package/dist/content/examples.js +293 -425
- package/dist/content/idea-command.d.ts +2 -0
- package/dist/content/idea-command.js +38 -0
- package/dist/content/iron-laws.d.ts +4 -138
- package/dist/content/iron-laws.js +18 -197
- package/dist/content/meta-skill.d.ts +1 -3
- package/dist/content/meta-skill.js +57 -134
- package/dist/content/node-hooks.d.ts +12 -8
- package/dist/content/node-hooks.js +188 -838
- package/dist/content/recovery.d.ts +8 -0
- package/dist/content/recovery.js +179 -0
- package/dist/content/reference-patterns.d.ts +4 -13
- package/dist/content/reference-patterns.js +260 -389
- package/dist/content/research-playbooks.d.ts +8 -8
- package/dist/content/research-playbooks.js +108 -121
- package/dist/content/review-loop.d.ts +6 -192
- package/dist/content/review-loop.js +29 -731
- package/dist/content/skills.d.ts +8 -38
- package/dist/content/skills.js +681 -732
- package/dist/content/specialist-prompts/architect.d.ts +1 -0
- package/dist/content/specialist-prompts/architect.js +225 -0
- package/dist/content/specialist-prompts/brainstormer.d.ts +1 -0
- package/dist/content/specialist-prompts/brainstormer.js +168 -0
- package/dist/content/specialist-prompts/index.d.ts +2 -0
- package/dist/content/specialist-prompts/index.js +14 -0
- package/dist/content/specialist-prompts/planner.d.ts +1 -0
- package/dist/content/specialist-prompts/planner.js +182 -0
- package/dist/content/specialist-prompts/reviewer.d.ts +1 -0
- package/dist/content/specialist-prompts/reviewer.js +193 -0
- package/dist/content/specialist-prompts/security-reviewer.d.ts +1 -0
- package/dist/content/specialist-prompts/security-reviewer.js +133 -0
- package/dist/content/specialist-prompts/slice-builder.d.ts +1 -0
- package/dist/content/specialist-prompts/slice-builder.js +232 -0
- package/dist/content/stage-playbooks.d.ts +8 -0
- package/dist/content/stage-playbooks.js +404 -0
- package/dist/content/start-command.d.ts +2 -12
- package/dist/content/start-command.js +221 -207
- package/dist/flow-state.d.ts +21 -178
- package/dist/flow-state.js +67 -170
- package/dist/fs-utils.d.ts +6 -26
- package/dist/fs-utils.js +29 -162
- package/dist/gitignore.d.ts +2 -1
- package/dist/gitignore.js +51 -34
- package/dist/harness-detect.d.ts +10 -0
- package/dist/harness-detect.js +29 -0
- package/dist/harness-prompt.d.ts +26 -0
- package/dist/harness-prompt.js +142 -0
- package/dist/install.d.ts +35 -15
- package/dist/install.js +238 -1347
- package/dist/knowledge-store.d.ts +19 -163
- package/dist/knowledge-store.js +56 -590
- package/dist/logger.d.ts +8 -3
- package/dist/logger.js +13 -4
- package/dist/orchestrator-routing.d.ts +29 -0
- package/dist/orchestrator-routing.js +156 -0
- package/dist/run-persistence.d.ts +7 -118
- package/dist/run-persistence.js +29 -845
- package/dist/runtime/run-hook.entry.d.ts +1 -3
- package/dist/runtime/run-hook.entry.js +19 -4
- package/dist/runtime/run-hook.mjs +13 -1024
- package/dist/types.d.ts +25 -261
- package/dist/types.js +8 -36
- package/package.json +6 -3
- package/dist/artifact-linter/brainstorm.d.ts +0 -2
- package/dist/artifact-linter/brainstorm.js +0 -353
- package/dist/artifact-linter/design.d.ts +0 -18
- package/dist/artifact-linter/design.js +0 -444
- package/dist/artifact-linter/findings-dedup.d.ts +0 -56
- package/dist/artifact-linter/findings-dedup.js +0 -232
- package/dist/artifact-linter/plan.d.ts +0 -2
- package/dist/artifact-linter/plan.js +0 -826
- package/dist/artifact-linter/review-army.d.ts +0 -49
- package/dist/artifact-linter/review-army.js +0 -520
- package/dist/artifact-linter/review.d.ts +0 -2
- package/dist/artifact-linter/review.js +0 -113
- package/dist/artifact-linter/scope.d.ts +0 -2
- package/dist/artifact-linter/scope.js +0 -158
- package/dist/artifact-linter/shared.d.ts +0 -637
- package/dist/artifact-linter/shared.js +0 -2163
- package/dist/artifact-linter/ship.d.ts +0 -2
- package/dist/artifact-linter/ship.js +0 -250
- package/dist/artifact-linter/spec.d.ts +0 -2
- package/dist/artifact-linter/spec.js +0 -176
- package/dist/artifact-linter/tdd.d.ts +0 -118
- package/dist/artifact-linter/tdd.js +0 -1404
- package/dist/artifact-linter.d.ts +0 -15
- package/dist/artifact-linter.js +0 -517
- package/dist/codex-feature-flag.d.ts +0 -58
- package/dist/codex-feature-flag.js +0 -193
- package/dist/content/closeout-guidance.d.ts +0 -14
- package/dist/content/closeout-guidance.js +0 -44
- package/dist/content/diff-command.d.ts +0 -1
- package/dist/content/diff-command.js +0 -43
- package/dist/content/harness-doc.d.ts +0 -1
- package/dist/content/harness-doc.js +0 -65
- package/dist/content/hook-events.d.ts +0 -9
- package/dist/content/hook-events.js +0 -23
- package/dist/content/hook-manifest.d.ts +0 -81
- package/dist/content/hook-manifest.js +0 -156
- package/dist/content/hooks.d.ts +0 -11
- package/dist/content/hooks.js +0 -1972
- package/dist/content/idea.d.ts +0 -60
- package/dist/content/idea.js +0 -416
- package/dist/content/language-policy.d.ts +0 -2
- package/dist/content/language-policy.js +0 -13
- package/dist/content/learnings.d.ts +0 -6
- package/dist/content/learnings.js +0 -141
- package/dist/content/observe.d.ts +0 -19
- package/dist/content/observe.js +0 -86
- package/dist/content/opencode-plugin.d.ts +0 -1
- package/dist/content/opencode-plugin.js +0 -635
- package/dist/content/review-prompts.d.ts +0 -1
- package/dist/content/review-prompts.js +0 -104
- package/dist/content/runtime-shared-snippets.d.ts +0 -8
- package/dist/content/runtime-shared-snippets.js +0 -80
- package/dist/content/session-hooks.d.ts +0 -7
- package/dist/content/session-hooks.js +0 -107
- package/dist/content/skills-elicitation.d.ts +0 -1
- package/dist/content/skills-elicitation.js +0 -167
- package/dist/content/stage-command.d.ts +0 -2
- package/dist/content/stage-command.js +0 -17
- package/dist/content/stage-schema.d.ts +0 -117
- package/dist/content/stage-schema.js +0 -955
- package/dist/content/stages/_lint-metadata/index.d.ts +0 -2
- package/dist/content/stages/_lint-metadata/index.js +0 -97
- package/dist/content/stages/brainstorm.d.ts +0 -2
- package/dist/content/stages/brainstorm.js +0 -184
- package/dist/content/stages/design.d.ts +0 -2
- package/dist/content/stages/design.js +0 -288
- package/dist/content/stages/index.d.ts +0 -8
- package/dist/content/stages/index.js +0 -11
- package/dist/content/stages/plan.d.ts +0 -2
- package/dist/content/stages/plan.js +0 -191
- package/dist/content/stages/review.d.ts +0 -2
- package/dist/content/stages/review.js +0 -240
- package/dist/content/stages/schema-types.d.ts +0 -203
- package/dist/content/stages/schema-types.js +0 -1
- package/dist/content/stages/scope.d.ts +0 -2
- package/dist/content/stages/scope.js +0 -254
- package/dist/content/stages/ship.d.ts +0 -2
- package/dist/content/stages/ship.js +0 -159
- package/dist/content/stages/spec.d.ts +0 -2
- package/dist/content/stages/spec.js +0 -170
- package/dist/content/stages/tdd.d.ts +0 -4
- package/dist/content/stages/tdd.js +0 -273
- package/dist/content/state-contracts.d.ts +0 -1
- package/dist/content/state-contracts.js +0 -63
- package/dist/content/status-command.d.ts +0 -4
- package/dist/content/status-command.js +0 -109
- package/dist/content/subagent-context-skills.d.ts +0 -4
- package/dist/content/subagent-context-skills.js +0 -279
- package/dist/content/subagents.d.ts +0 -3
- package/dist/content/subagents.js +0 -997
- package/dist/content/templates.d.ts +0 -26
- package/dist/content/templates.js +0 -1692
- package/dist/content/track-render-context.d.ts +0 -18
- package/dist/content/track-render-context.js +0 -53
- package/dist/content/tree-command.d.ts +0 -1
- package/dist/content/tree-command.js +0 -64
- package/dist/content/utility-skills.d.ts +0 -30
- package/dist/content/utility-skills.js +0 -160
- package/dist/content/view-command.d.ts +0 -2
- package/dist/content/view-command.js +0 -92
- package/dist/delegation.d.ts +0 -649
- package/dist/delegation.js +0 -1539
- package/dist/early-loop.d.ts +0 -70
- package/dist/early-loop.js +0 -302
- package/dist/execution-topology.d.ts +0 -44
- package/dist/execution-topology.js +0 -95
- package/dist/gate-evidence.d.ts +0 -85
- package/dist/gate-evidence.js +0 -631
- package/dist/harness-adapters.d.ts +0 -151
- package/dist/harness-adapters.js +0 -756
- package/dist/harness-selection.d.ts +0 -31
- package/dist/harness-selection.js +0 -214
- package/dist/hook-schema.d.ts +0 -6
- package/dist/hook-schema.js +0 -114
- package/dist/hook-schemas/claude-hooks.v1.json +0 -10
- package/dist/hook-schemas/codex-hooks.v1.json +0 -10
- package/dist/hook-schemas/cursor-hooks.v1.json +0 -13
- package/dist/init-detect.d.ts +0 -2
- package/dist/init-detect.js +0 -50
- package/dist/internal/advance-stage/advance.d.ts +0 -89
- package/dist/internal/advance-stage/advance.js +0 -655
- package/dist/internal/advance-stage/cancel-run.d.ts +0 -8
- package/dist/internal/advance-stage/cancel-run.js +0 -19
- package/dist/internal/advance-stage/flow-state-coercion.d.ts +0 -3
- package/dist/internal/advance-stage/flow-state-coercion.js +0 -81
- package/dist/internal/advance-stage/helpers.d.ts +0 -14
- package/dist/internal/advance-stage/helpers.js +0 -145
- package/dist/internal/advance-stage/hook.d.ts +0 -8
- package/dist/internal/advance-stage/hook.js +0 -40
- package/dist/internal/advance-stage/parsers.d.ts +0 -72
- package/dist/internal/advance-stage/parsers.js +0 -357
- package/dist/internal/advance-stage/proactive-delegation-trace.d.ts +0 -24
- package/dist/internal/advance-stage/proactive-delegation-trace.js +0 -56
- package/dist/internal/advance-stage/review-loop.d.ts +0 -16
- package/dist/internal/advance-stage/review-loop.js +0 -199
- package/dist/internal/advance-stage/rewind.d.ts +0 -14
- package/dist/internal/advance-stage/rewind.js +0 -108
- package/dist/internal/advance-stage/start-flow.d.ts +0 -13
- package/dist/internal/advance-stage/start-flow.js +0 -241
- package/dist/internal/advance-stage/verify.d.ts +0 -21
- package/dist/internal/advance-stage/verify.js +0 -185
- package/dist/internal/advance-stage.d.ts +0 -7
- package/dist/internal/advance-stage.js +0 -138
- package/dist/internal/cohesion-contract-stub.d.ts +0 -24
- package/dist/internal/cohesion-contract-stub.js +0 -148
- package/dist/internal/compound-readiness.d.ts +0 -23
- package/dist/internal/compound-readiness.js +0 -102
- package/dist/internal/detect-public-api-changes.d.ts +0 -5
- package/dist/internal/detect-public-api-changes.js +0 -45
- package/dist/internal/detect-supply-chain-changes.d.ts +0 -6
- package/dist/internal/detect-supply-chain-changes.js +0 -138
- package/dist/internal/early-loop-status.d.ts +0 -7
- package/dist/internal/early-loop-status.js +0 -93
- package/dist/internal/envelope-validate.d.ts +0 -7
- package/dist/internal/envelope-validate.js +0 -66
- package/dist/internal/flow-state-repair.d.ts +0 -20
- package/dist/internal/flow-state-repair.js +0 -104
- package/dist/internal/plan-split-waves.d.ts +0 -190
- package/dist/internal/plan-split-waves.js +0 -764
- package/dist/internal/runtime-integrity.d.ts +0 -7
- package/dist/internal/runtime-integrity.js +0 -268
- package/dist/internal/slice-commit.d.ts +0 -7
- package/dist/internal/slice-commit.js +0 -619
- package/dist/internal/tdd-loop-status.d.ts +0 -14
- package/dist/internal/tdd-loop-status.js +0 -68
- package/dist/internal/tdd-red-evidence.d.ts +0 -7
- package/dist/internal/tdd-red-evidence.js +0 -153
- package/dist/internal/waiver-grant.d.ts +0 -62
- package/dist/internal/waiver-grant.js +0 -294
- package/dist/internal/wave-status.d.ts +0 -74
- package/dist/internal/wave-status.js +0 -506
- package/dist/managed-resources.d.ts +0 -53
- package/dist/managed-resources.js +0 -313
- package/dist/policy.d.ts +0 -10
- package/dist/policy.js +0 -167
- package/dist/retro-gate.d.ts +0 -9
- package/dist/retro-gate.js +0 -47
- package/dist/run-archive.d.ts +0 -61
- package/dist/run-archive.js +0 -391
- package/dist/runs.d.ts +0 -2
- package/dist/runs.js +0 -2
- package/dist/stack-detection.d.ts +0 -116
- package/dist/stack-detection.js +0 -489
- package/dist/streaming/event-stream.d.ts +0 -31
- package/dist/streaming/event-stream.js +0 -114
- package/dist/tdd-cycle.d.ts +0 -107
- package/dist/tdd-cycle.js +0 -289
- package/dist/tdd-verification-evidence.d.ts +0 -17
- package/dist/tdd-verification-evidence.js +0 -122
- package/dist/track-heuristics.d.ts +0 -27
- package/dist/track-heuristics.js +0 -154
- package/dist/util/slice-id.d.ts +0 -58
- package/dist/util/slice-id.js +0 -89
- package/dist/worktree-manager.d.ts +0 -20
- package/dist/worktree-manager.js +0 -108
|
@@ -1,49 +0,0 @@
|
|
|
1
|
-
export declare function validateReviewArmy(projectRoot: string): Promise<{
|
|
2
|
-
valid: boolean;
|
|
3
|
-
errors: string[];
|
|
4
|
-
}>;
|
|
5
|
-
export interface ReviewVerdictConsistencyResult {
|
|
6
|
-
ok: boolean;
|
|
7
|
-
errors: string[];
|
|
8
|
-
finalVerdict: "APPROVED" | "APPROVED_WITH_CONCERNS" | "BLOCKED" | "UNKNOWN";
|
|
9
|
-
openCriticalCount: number;
|
|
10
|
-
shipBlockerCount: number;
|
|
11
|
-
}
|
|
12
|
-
export interface ReviewSecurityNoChangeAttestationResult {
|
|
13
|
-
ok: boolean;
|
|
14
|
-
errors: string[];
|
|
15
|
-
hasSecurityFinding: boolean;
|
|
16
|
-
hasNoChangeAttestation: boolean;
|
|
17
|
-
}
|
|
18
|
-
/**
|
|
19
|
-
* Ensure the narrative verdict in 07-review.md is consistent with the
|
|
20
|
-
* structured review-army reconciliation. A review cannot declare
|
|
21
|
-
* APPROVED while open Critical findings or shipBlockers remain.
|
|
22
|
-
*/
|
|
23
|
-
export declare function checkReviewVerdictConsistency(projectRoot: string): Promise<ReviewVerdictConsistencyResult>;
|
|
24
|
-
export interface ReviewTddDuplicationConflict {
|
|
25
|
-
findingId: string;
|
|
26
|
-
tddSeverity: string | null;
|
|
27
|
-
reviewSeverity: string | null;
|
|
28
|
-
tddDisposition: string | null;
|
|
29
|
-
reviewDisposition: string | null;
|
|
30
|
-
}
|
|
31
|
-
export interface ReviewTddDuplicationResult {
|
|
32
|
-
ok: boolean;
|
|
33
|
-
errors: string[];
|
|
34
|
-
conflicts: ReviewTddDuplicationConflict[];
|
|
35
|
-
tddArtifactExists: boolean;
|
|
36
|
-
reviewArtifactExists: boolean;
|
|
37
|
-
}
|
|
38
|
-
/**
|
|
39
|
-
* Cross-artifact duplication guard.
|
|
40
|
-
*
|
|
41
|
-
* When the same finding ID (`F-NN`) appears in both
|
|
42
|
-
* `06-tdd.md > Per-Slice Review` and `07-review-army.json`, the
|
|
43
|
-
* severity and disposition MUST match. Per-slice tdd reviews own
|
|
44
|
-
* single-slice findings; review cites them, never re-classifies.
|
|
45
|
-
*
|
|
46
|
-
* If neither artifact uses `F-NN` IDs, the check is a no-op.
|
|
47
|
-
*/
|
|
48
|
-
export declare function checkReviewTddNoCrossArtifactDuplication(projectRoot: string): Promise<ReviewTddDuplicationResult>;
|
|
49
|
-
export declare function checkReviewSecurityNoChangeAttestation(projectRoot: string): Promise<ReviewSecurityNoChangeAttestationResult>;
|
|
@@ -1,520 +0,0 @@
|
|
|
1
|
-
import fs from "node:fs/promises";
|
|
2
|
-
import path from "node:path";
|
|
3
|
-
import { RUNTIME_ROOT } from "../constants.js";
|
|
4
|
-
import { exists } from "../fs-utils.js";
|
|
5
|
-
import { extractH2Sections, sectionBodyByName } from "./shared.js";
|
|
6
|
-
async function resolveNamedArtifactPath(projectRoot, fileName) {
|
|
7
|
-
const relPath = path.join(RUNTIME_ROOT, "artifacts", fileName);
|
|
8
|
-
const absPath = path.join(projectRoot, relPath);
|
|
9
|
-
return { absPath, relPath };
|
|
10
|
-
}
|
|
11
|
-
function isNonEmptyString(v) {
|
|
12
|
-
return typeof v === "string" && v.length > 0;
|
|
13
|
-
}
|
|
14
|
-
function isFiniteNumber(v) {
|
|
15
|
-
return typeof v === "number" && Number.isFinite(v);
|
|
16
|
-
}
|
|
17
|
-
function isNonNegativeInteger(v) {
|
|
18
|
-
return Number.isInteger(v) && v >= 0;
|
|
19
|
-
}
|
|
20
|
-
function isStringArray(v) {
|
|
21
|
-
return Array.isArray(v) && v.every((item) => typeof item === "string");
|
|
22
|
-
}
|
|
23
|
-
export async function validateReviewArmy(projectRoot) {
|
|
24
|
-
const errors = [];
|
|
25
|
-
const { absPath, relPath } = await resolveNamedArtifactPath(projectRoot, "07-review-army.json");
|
|
26
|
-
if (!(await exists(absPath))) {
|
|
27
|
-
return { valid: false, errors: [`Missing file: ${relPath}`] };
|
|
28
|
-
}
|
|
29
|
-
let parsed;
|
|
30
|
-
try {
|
|
31
|
-
parsed = JSON.parse(await fs.readFile(absPath, "utf8"));
|
|
32
|
-
}
|
|
33
|
-
catch (e) {
|
|
34
|
-
const msg = e instanceof Error ? e.message : String(e);
|
|
35
|
-
return { valid: false, errors: [`Invalid JSON: ${msg}`] };
|
|
36
|
-
}
|
|
37
|
-
if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
|
|
38
|
-
return { valid: false, errors: ["Root value must be a JSON object."] };
|
|
39
|
-
}
|
|
40
|
-
const root = parsed;
|
|
41
|
-
if (!("version" in root) || !isFiniteNumber(root.version) || root.version < 1) {
|
|
42
|
-
errors.push('Field "version" must be a finite number >= 1.');
|
|
43
|
-
}
|
|
44
|
-
if (!isNonEmptyString(root.generatedAt)) {
|
|
45
|
-
errors.push('Field "generatedAt" must be a non-empty string.');
|
|
46
|
-
}
|
|
47
|
-
if (!("scope" in root) || root.scope === null || typeof root.scope !== "object" || Array.isArray(root.scope)) {
|
|
48
|
-
errors.push('Field "scope" must be an object.');
|
|
49
|
-
}
|
|
50
|
-
else {
|
|
51
|
-
const scope = root.scope;
|
|
52
|
-
if (!isNonEmptyString(scope.base)) {
|
|
53
|
-
errors.push("scope.base must be a non-empty string.");
|
|
54
|
-
}
|
|
55
|
-
if (!isNonEmptyString(scope.head)) {
|
|
56
|
-
errors.push("scope.head must be a non-empty string.");
|
|
57
|
-
}
|
|
58
|
-
if (!isStringArray(scope.files)) {
|
|
59
|
-
errors.push("scope.files must be an array of strings.");
|
|
60
|
-
}
|
|
61
|
-
}
|
|
62
|
-
const severitySet = new Set(["Critical", "Important", "Suggestion"]);
|
|
63
|
-
const statusSet = new Set(["open", "accepted", "resolved"]);
|
|
64
|
-
const sourceSet = new Set([
|
|
65
|
-
"spec",
|
|
66
|
-
"correctness",
|
|
67
|
-
"security",
|
|
68
|
-
"performance",
|
|
69
|
-
"architecture",
|
|
70
|
-
"external-safety"
|
|
71
|
-
]);
|
|
72
|
-
const findingIds = new Set();
|
|
73
|
-
const openCriticalIds = new Set();
|
|
74
|
-
if (!Array.isArray(root.findings)) {
|
|
75
|
-
errors.push('Field "findings" must be an array.');
|
|
76
|
-
}
|
|
77
|
-
else {
|
|
78
|
-
root.findings.forEach((f, i) => {
|
|
79
|
-
if (f === null || typeof f !== "object" || Array.isArray(f)) {
|
|
80
|
-
errors.push(`findings[${i}] must be an object.`);
|
|
81
|
-
return;
|
|
82
|
-
}
|
|
83
|
-
const o = f;
|
|
84
|
-
if (!isNonEmptyString(o.id)) {
|
|
85
|
-
errors.push(`findings[${i}].id must be a non-empty string.`);
|
|
86
|
-
}
|
|
87
|
-
else if (findingIds.has(o.id)) {
|
|
88
|
-
errors.push(`findings[${i}].id must be unique.`);
|
|
89
|
-
}
|
|
90
|
-
else {
|
|
91
|
-
findingIds.add(o.id);
|
|
92
|
-
}
|
|
93
|
-
if (!isNonEmptyString(o.severity) || !severitySet.has(o.severity)) {
|
|
94
|
-
errors.push(`findings[${i}].severity must be one of: Critical, Important, Suggestion.`);
|
|
95
|
-
}
|
|
96
|
-
if (!isNonEmptyString(o.status) || !statusSet.has(o.status)) {
|
|
97
|
-
errors.push(`findings[${i}].status must be one of: open, accepted, resolved.`);
|
|
98
|
-
}
|
|
99
|
-
if (!isNonEmptyString(o.fingerprint)) {
|
|
100
|
-
errors.push(`findings[${i}].fingerprint must be a non-empty string.`);
|
|
101
|
-
}
|
|
102
|
-
if (!isFiniteNumber(o.confidence) || o.confidence < 1 || o.confidence > 10) {
|
|
103
|
-
errors.push(`findings[${i}].confidence must be a number in [1,10].`);
|
|
104
|
-
}
|
|
105
|
-
if (!isStringArray(o.reportedBy) || o.reportedBy.length === 0) {
|
|
106
|
-
errors.push(`findings[${i}].reportedBy must be a non-empty string array.`);
|
|
107
|
-
}
|
|
108
|
-
if (o.sources !== undefined) {
|
|
109
|
-
if (!isStringArray(o.sources) || o.sources.length === 0) {
|
|
110
|
-
errors.push(`findings[${i}].sources must be a non-empty string array when present.`);
|
|
111
|
-
}
|
|
112
|
-
else {
|
|
113
|
-
const invalidSources = o.sources.filter((source) => !sourceSet.has(source));
|
|
114
|
-
if (invalidSources.length > 0) {
|
|
115
|
-
errors.push(`findings[${i}].sources contains unknown values: ${invalidSources.join(", ")}.`);
|
|
116
|
-
}
|
|
117
|
-
}
|
|
118
|
-
}
|
|
119
|
-
if (o.location === undefined || o.location === null) {
|
|
120
|
-
errors.push(`findings[${i}].location is required and must be an object with file + line.`);
|
|
121
|
-
}
|
|
122
|
-
else if (typeof o.location !== "object" || Array.isArray(o.location)) {
|
|
123
|
-
errors.push(`findings[${i}].location must be an object with file + line.`);
|
|
124
|
-
}
|
|
125
|
-
else {
|
|
126
|
-
const loc = o.location;
|
|
127
|
-
if (!isNonEmptyString(loc.file)) {
|
|
128
|
-
errors.push(`findings[${i}].location.file must be a non-empty string.`);
|
|
129
|
-
}
|
|
130
|
-
if (!isFiniteNumber(loc.line) || loc.line < 1) {
|
|
131
|
-
errors.push(`findings[${i}].location.line must be a positive number.`);
|
|
132
|
-
}
|
|
133
|
-
}
|
|
134
|
-
if (o.recommendation !== undefined && !isNonEmptyString(o.recommendation)) {
|
|
135
|
-
errors.push(`findings[${i}].recommendation must be a non-empty string when present.`);
|
|
136
|
-
}
|
|
137
|
-
if (o.severity === "Critical" && o.status === "open" && !isNonEmptyString(o.recommendation)) {
|
|
138
|
-
errors.push(`findings[${i}] open Critical finding must include recommendation.`);
|
|
139
|
-
}
|
|
140
|
-
if (o.id && o.severity === "Critical" && o.status === "open" && typeof o.id === "string") {
|
|
141
|
-
openCriticalIds.add(o.id);
|
|
142
|
-
}
|
|
143
|
-
});
|
|
144
|
-
}
|
|
145
|
-
if (!("reconciliation" in root) || root.reconciliation === null || typeof root.reconciliation !== "object") {
|
|
146
|
-
errors.push('Field "reconciliation" must be an object.');
|
|
147
|
-
}
|
|
148
|
-
else {
|
|
149
|
-
const rec = root.reconciliation;
|
|
150
|
-
if (!isNonNegativeInteger(rec.duplicatesCollapsed)) {
|
|
151
|
-
errors.push("reconciliation.duplicatesCollapsed must be a non-negative integer.");
|
|
152
|
-
}
|
|
153
|
-
if (!Array.isArray(rec.conflicts)) {
|
|
154
|
-
errors.push("reconciliation.conflicts must be an array.");
|
|
155
|
-
}
|
|
156
|
-
else {
|
|
157
|
-
rec.conflicts.forEach((c, ci) => {
|
|
158
|
-
if (c === null || typeof c !== "object" || Array.isArray(c)) {
|
|
159
|
-
errors.push(`reconciliation.conflicts[${ci}] must be an object.`);
|
|
160
|
-
return;
|
|
161
|
-
}
|
|
162
|
-
const co = c;
|
|
163
|
-
if (!isNonEmptyString(co.findingId)) {
|
|
164
|
-
errors.push(`reconciliation.conflicts[${ci}].findingId must be a non-empty string.`);
|
|
165
|
-
}
|
|
166
|
-
else if (!findingIds.has(co.findingId)) {
|
|
167
|
-
errors.push(`reconciliation.conflicts[${ci}].findingId references unknown finding "${co.findingId}".`);
|
|
168
|
-
}
|
|
169
|
-
if (!isNonEmptyString(co.description)) {
|
|
170
|
-
errors.push(`reconciliation.conflicts[${ci}].description must be a non-empty string.`);
|
|
171
|
-
}
|
|
172
|
-
});
|
|
173
|
-
}
|
|
174
|
-
if (!isStringArray(rec.multiSpecialistConfirmed)) {
|
|
175
|
-
errors.push("reconciliation.multiSpecialistConfirmed must be an array of finding ids.");
|
|
176
|
-
}
|
|
177
|
-
else {
|
|
178
|
-
for (const msId of rec.multiSpecialistConfirmed) {
|
|
179
|
-
if (!findingIds.has(msId)) {
|
|
180
|
-
errors.push(`reconciliation.multiSpecialistConfirmed references unknown finding id "${msId}".`);
|
|
181
|
-
continue;
|
|
182
|
-
}
|
|
183
|
-
if (Array.isArray(root.findings)) {
|
|
184
|
-
const finding = root.findings.find((f) => {
|
|
185
|
-
return f && typeof f === "object" && !Array.isArray(f) && f.id === msId;
|
|
186
|
-
});
|
|
187
|
-
if (finding && typeof finding === "object" && !Array.isArray(finding)) {
|
|
188
|
-
const reportedBy = finding.reportedBy;
|
|
189
|
-
const count = Array.isArray(reportedBy)
|
|
190
|
-
? new Set(reportedBy.filter((v) => typeof v === "string")).size
|
|
191
|
-
: 0;
|
|
192
|
-
if (count < 2) {
|
|
193
|
-
errors.push(`reconciliation.multiSpecialistConfirmed entry "${msId}" must be confirmed by at least 2 distinct reviewers (found ${count}).`);
|
|
194
|
-
}
|
|
195
|
-
}
|
|
196
|
-
}
|
|
197
|
-
}
|
|
198
|
-
}
|
|
199
|
-
if (!isStringArray(rec.shipBlockers)) {
|
|
200
|
-
errors.push("reconciliation.shipBlockers must be an array of finding ids.");
|
|
201
|
-
}
|
|
202
|
-
else {
|
|
203
|
-
const blockers = new Set(rec.shipBlockers);
|
|
204
|
-
for (const id of rec.shipBlockers) {
|
|
205
|
-
if (!findingIds.has(id)) {
|
|
206
|
-
errors.push(`reconciliation.shipBlockers references unknown finding id "${id}".`);
|
|
207
|
-
}
|
|
208
|
-
}
|
|
209
|
-
for (const criticalId of openCriticalIds) {
|
|
210
|
-
if (!blockers.has(criticalId)) {
|
|
211
|
-
errors.push(`reconciliation.shipBlockers must include open Critical finding "${criticalId}".`);
|
|
212
|
-
}
|
|
213
|
-
}
|
|
214
|
-
}
|
|
215
|
-
if (isStringArray(rec.multiSpecialistConfirmed)) {
|
|
216
|
-
for (const id of rec.multiSpecialistConfirmed) {
|
|
217
|
-
if (!findingIds.has(id)) {
|
|
218
|
-
errors.push(`reconciliation.multiSpecialistConfirmed references unknown finding id "${id}".`);
|
|
219
|
-
}
|
|
220
|
-
}
|
|
221
|
-
}
|
|
222
|
-
if (rec.layerCoverage !== undefined) {
|
|
223
|
-
if (rec.layerCoverage === null || typeof rec.layerCoverage !== "object" || Array.isArray(rec.layerCoverage)) {
|
|
224
|
-
errors.push("reconciliation.layerCoverage must be an object when present.");
|
|
225
|
-
}
|
|
226
|
-
else {
|
|
227
|
-
const coverage = rec.layerCoverage;
|
|
228
|
-
for (const source of sourceSet) {
|
|
229
|
-
if (coverage[source] !== undefined && typeof coverage[source] !== "boolean") {
|
|
230
|
-
errors.push(`reconciliation.layerCoverage.${source} must be boolean when present.`);
|
|
231
|
-
}
|
|
232
|
-
}
|
|
233
|
-
}
|
|
234
|
-
}
|
|
235
|
-
}
|
|
236
|
-
return { valid: errors.length === 0, errors };
|
|
237
|
-
}
|
|
238
|
-
/**
|
|
239
|
-
* Ensure the narrative verdict in 07-review.md is consistent with the
|
|
240
|
-
* structured review-army reconciliation. A review cannot declare
|
|
241
|
-
* APPROVED while open Critical findings or shipBlockers remain.
|
|
242
|
-
*/
|
|
243
|
-
export async function checkReviewVerdictConsistency(projectRoot) {
|
|
244
|
-
const errors = [];
|
|
245
|
-
const reviewMdPath = path.join(projectRoot, RUNTIME_ROOT, "artifacts", "07-review.md");
|
|
246
|
-
const armyJsonPath = path.join(projectRoot, RUNTIME_ROOT, "artifacts", "07-review-army.json");
|
|
247
|
-
let finalVerdict = "UNKNOWN";
|
|
248
|
-
if (await exists(reviewMdPath)) {
|
|
249
|
-
const raw = await fs.readFile(reviewMdPath, "utf8");
|
|
250
|
-
const sections = extractH2Sections(raw);
|
|
251
|
-
const verdictBody = sectionBodyByName(sections, "Final Verdict");
|
|
252
|
-
if (verdictBody) {
|
|
253
|
-
const chosen = [];
|
|
254
|
-
for (const token of ["APPROVED_WITH_CONCERNS", "APPROVED", "BLOCKED"]) {
|
|
255
|
-
const regex = new RegExp(`\\b${token}\\b`, "u");
|
|
256
|
-
if (regex.test(verdictBody)) {
|
|
257
|
-
// APPROVED would match inside APPROVED_WITH_CONCERNS; prefer the longer match first.
|
|
258
|
-
if (token === "APPROVED" && /\bAPPROVED_WITH_CONCERNS\b/u.test(verdictBody))
|
|
259
|
-
continue;
|
|
260
|
-
chosen.push(token);
|
|
261
|
-
}
|
|
262
|
-
}
|
|
263
|
-
if (chosen.length === 1) {
|
|
264
|
-
finalVerdict = chosen[0];
|
|
265
|
-
}
|
|
266
|
-
else if (chosen.length > 1) {
|
|
267
|
-
errors.push(`Final Verdict section lists multiple verdict tokens (${chosen.join(", ")}). Select exactly one.`);
|
|
268
|
-
}
|
|
269
|
-
else {
|
|
270
|
-
errors.push('Final Verdict section does not select APPROVED, APPROVED_WITH_CONCERNS, or BLOCKED.');
|
|
271
|
-
}
|
|
272
|
-
}
|
|
273
|
-
else {
|
|
274
|
-
errors.push('07-review.md is missing the "## Final Verdict" section.');
|
|
275
|
-
}
|
|
276
|
-
}
|
|
277
|
-
let openCriticalCount = 0;
|
|
278
|
-
let shipBlockerCount = 0;
|
|
279
|
-
if (await exists(armyJsonPath)) {
|
|
280
|
-
try {
|
|
281
|
-
const raw = await fs.readFile(armyJsonPath, "utf8");
|
|
282
|
-
const parsed = JSON.parse(raw);
|
|
283
|
-
const findings = Array.isArray(parsed.findings) ? parsed.findings : [];
|
|
284
|
-
for (const f of findings) {
|
|
285
|
-
if (!f || typeof f !== "object" || Array.isArray(f))
|
|
286
|
-
continue;
|
|
287
|
-
const o = f;
|
|
288
|
-
if (o.severity === "Critical" && o.status === "open") {
|
|
289
|
-
openCriticalCount++;
|
|
290
|
-
}
|
|
291
|
-
}
|
|
292
|
-
const rec = parsed.reconciliation && typeof parsed.reconciliation === "object" && !Array.isArray(parsed.reconciliation)
|
|
293
|
-
? parsed.reconciliation
|
|
294
|
-
: null;
|
|
295
|
-
if (rec && Array.isArray(rec.shipBlockers)) {
|
|
296
|
-
shipBlockerCount = rec.shipBlockers.filter((v) => typeof v === "string").length;
|
|
297
|
-
}
|
|
298
|
-
}
|
|
299
|
-
catch {
|
|
300
|
-
// JSON validity is the concern of validateReviewArmy; skip silently here.
|
|
301
|
-
}
|
|
302
|
-
}
|
|
303
|
-
if (finalVerdict === "APPROVED" && (openCriticalCount > 0 || shipBlockerCount > 0)) {
|
|
304
|
-
errors.push(`Final Verdict is APPROVED but review-army has ${openCriticalCount} open Critical finding(s) and ${shipBlockerCount} shipBlocker(s). Use BLOCKED or APPROVED_WITH_CONCERNS.`);
|
|
305
|
-
}
|
|
306
|
-
// APPROVED_WITH_CONCERNS is intended for Important/Suggestion findings
|
|
307
|
-
// the author has accepted. An *open* Critical finding or an active
|
|
308
|
-
// shipBlocker must route through BLOCKED (review_verdict_blocked gate)
|
|
309
|
-
// rather than pass as a concession — previously this slipped through.
|
|
310
|
-
if (finalVerdict === "APPROVED_WITH_CONCERNS" &&
|
|
311
|
-
(openCriticalCount > 0 || shipBlockerCount > 0)) {
|
|
312
|
-
errors.push(`Final Verdict is APPROVED_WITH_CONCERNS but review-army has ${openCriticalCount} open Critical finding(s) and ${shipBlockerCount} shipBlocker(s). Resolve them or use BLOCKED.`);
|
|
313
|
-
}
|
|
314
|
-
return {
|
|
315
|
-
ok: errors.length === 0,
|
|
316
|
-
errors,
|
|
317
|
-
finalVerdict,
|
|
318
|
-
openCriticalCount,
|
|
319
|
-
shipBlockerCount
|
|
320
|
-
};
|
|
321
|
-
}
|
|
322
|
-
const FINDING_ID_PATTERN = /\bF-\d+\b/giu;
|
|
323
|
-
const SEVERITY_TOKENS = ["Critical", "Important", "Suggestion"];
|
|
324
|
-
const DISPOSITION_TOKENS = ["open", "accepted", "resolved", "deferred", "won't-fix", "wont-fix"];
|
|
325
|
-
function findFirstToken(text, tokens) {
|
|
326
|
-
for (const token of tokens) {
|
|
327
|
-
const escaped = token.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
|
|
328
|
-
const regex = new RegExp(`\\b${escaped}\\b`, "iu");
|
|
329
|
-
if (regex.test(text))
|
|
330
|
-
return token;
|
|
331
|
-
}
|
|
332
|
-
return null;
|
|
333
|
-
}
|
|
334
|
-
function normalizeDisposition(value) {
|
|
335
|
-
if (value === null)
|
|
336
|
-
return null;
|
|
337
|
-
const lower = value.toLowerCase();
|
|
338
|
-
if (lower === "wont-fix" || lower === "won't-fix")
|
|
339
|
-
return "won't-fix";
|
|
340
|
-
return lower;
|
|
341
|
-
}
|
|
342
|
-
function extractTddPerSliceFindings(perSliceBody) {
|
|
343
|
-
const rows = new Map();
|
|
344
|
-
const lines = perSliceBody.split(/\r?\n/u);
|
|
345
|
-
for (const line of lines) {
|
|
346
|
-
const ids = line.match(FINDING_ID_PATTERN);
|
|
347
|
-
if (!ids || ids.length === 0)
|
|
348
|
-
continue;
|
|
349
|
-
const severity = findFirstToken(line, SEVERITY_TOKENS);
|
|
350
|
-
const disposition = normalizeDisposition(findFirstToken(line, DISPOSITION_TOKENS));
|
|
351
|
-
for (const rawId of ids) {
|
|
352
|
-
const id = rawId.toUpperCase();
|
|
353
|
-
if (rows.has(id))
|
|
354
|
-
continue;
|
|
355
|
-
rows.set(id, { id, severity, disposition });
|
|
356
|
-
}
|
|
357
|
-
}
|
|
358
|
-
return rows;
|
|
359
|
-
}
|
|
360
|
-
/**
|
|
361
|
-
* Cross-artifact duplication guard.
|
|
362
|
-
*
|
|
363
|
-
* When the same finding ID (`F-NN`) appears in both
|
|
364
|
-
* `06-tdd.md > Per-Slice Review` and `07-review-army.json`, the
|
|
365
|
-
* severity and disposition MUST match. Per-slice tdd reviews own
|
|
366
|
-
* single-slice findings; review cites them, never re-classifies.
|
|
367
|
-
*
|
|
368
|
-
* If neither artifact uses `F-NN` IDs, the check is a no-op.
|
|
369
|
-
*/
|
|
370
|
-
export async function checkReviewTddNoCrossArtifactDuplication(projectRoot) {
|
|
371
|
-
const tddPath = path.join(projectRoot, RUNTIME_ROOT, "artifacts", "06-tdd.md");
|
|
372
|
-
const armyPath = path.join(projectRoot, RUNTIME_ROOT, "artifacts", "07-review-army.json");
|
|
373
|
-
const tddArtifactExists = await exists(tddPath);
|
|
374
|
-
const reviewArtifactExists = await exists(armyPath);
|
|
375
|
-
if (!tddArtifactExists || !reviewArtifactExists) {
|
|
376
|
-
return {
|
|
377
|
-
ok: true,
|
|
378
|
-
errors: [],
|
|
379
|
-
conflicts: [],
|
|
380
|
-
tddArtifactExists,
|
|
381
|
-
reviewArtifactExists
|
|
382
|
-
};
|
|
383
|
-
}
|
|
384
|
-
const tddRaw = await fs.readFile(tddPath, "utf8");
|
|
385
|
-
const tddSections = extractH2Sections(tddRaw);
|
|
386
|
-
const perSliceBody = sectionBodyByName(tddSections, "Per-Slice Review");
|
|
387
|
-
if (!perSliceBody) {
|
|
388
|
-
return {
|
|
389
|
-
ok: true,
|
|
390
|
-
errors: [],
|
|
391
|
-
conflicts: [],
|
|
392
|
-
tddArtifactExists,
|
|
393
|
-
reviewArtifactExists
|
|
394
|
-
};
|
|
395
|
-
}
|
|
396
|
-
const tddFindings = extractTddPerSliceFindings(perSliceBody);
|
|
397
|
-
if (tddFindings.size === 0) {
|
|
398
|
-
return {
|
|
399
|
-
ok: true,
|
|
400
|
-
errors: [],
|
|
401
|
-
conflicts: [],
|
|
402
|
-
tddArtifactExists,
|
|
403
|
-
reviewArtifactExists
|
|
404
|
-
};
|
|
405
|
-
}
|
|
406
|
-
let parsed;
|
|
407
|
-
try {
|
|
408
|
-
parsed = JSON.parse(await fs.readFile(armyPath, "utf8"));
|
|
409
|
-
}
|
|
410
|
-
catch {
|
|
411
|
-
return {
|
|
412
|
-
ok: true,
|
|
413
|
-
errors: [],
|
|
414
|
-
conflicts: [],
|
|
415
|
-
tddArtifactExists,
|
|
416
|
-
reviewArtifactExists
|
|
417
|
-
};
|
|
418
|
-
}
|
|
419
|
-
if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
|
|
420
|
-
return {
|
|
421
|
-
ok: true,
|
|
422
|
-
errors: [],
|
|
423
|
-
conflicts: [],
|
|
424
|
-
tddArtifactExists,
|
|
425
|
-
reviewArtifactExists
|
|
426
|
-
};
|
|
427
|
-
}
|
|
428
|
-
const root = parsed;
|
|
429
|
-
const findings = Array.isArray(root.findings) ? root.findings : [];
|
|
430
|
-
const conflicts = [];
|
|
431
|
-
for (const f of findings) {
|
|
432
|
-
if (!f || typeof f !== "object" || Array.isArray(f))
|
|
433
|
-
continue;
|
|
434
|
-
const o = f;
|
|
435
|
-
if (typeof o.id !== "string")
|
|
436
|
-
continue;
|
|
437
|
-
const id = o.id.toUpperCase();
|
|
438
|
-
const tddRow = tddFindings.get(id);
|
|
439
|
-
if (!tddRow)
|
|
440
|
-
continue;
|
|
441
|
-
const reviewSeverity = typeof o.severity === "string" ? o.severity : null;
|
|
442
|
-
const reviewDisposition = normalizeDisposition(typeof o.status === "string" ? o.status : null);
|
|
443
|
-
const severityMismatch = tddRow.severity !== null &&
|
|
444
|
-
reviewSeverity !== null &&
|
|
445
|
-
tddRow.severity.toLowerCase() !== reviewSeverity.toLowerCase();
|
|
446
|
-
const dispositionMismatch = tddRow.disposition !== null &&
|
|
447
|
-
reviewDisposition !== null &&
|
|
448
|
-
tddRow.disposition !== reviewDisposition;
|
|
449
|
-
if (severityMismatch || dispositionMismatch) {
|
|
450
|
-
conflicts.push({
|
|
451
|
-
findingId: id,
|
|
452
|
-
tddSeverity: tddRow.severity,
|
|
453
|
-
reviewSeverity,
|
|
454
|
-
tddDisposition: tddRow.disposition,
|
|
455
|
-
reviewDisposition
|
|
456
|
-
});
|
|
457
|
-
}
|
|
458
|
-
}
|
|
459
|
-
const errors = conflicts.map((c) => {
|
|
460
|
-
const parts = [];
|
|
461
|
-
if (c.tddSeverity !== null && c.reviewSeverity !== null && c.tddSeverity.toLowerCase() !== c.reviewSeverity.toLowerCase()) {
|
|
462
|
-
parts.push(`severity tdd=${c.tddSeverity} vs review-army=${c.reviewSeverity}`);
|
|
463
|
-
}
|
|
464
|
-
if (c.tddDisposition !== null && c.reviewDisposition !== null && c.tddDisposition !== c.reviewDisposition) {
|
|
465
|
-
parts.push(`disposition tdd=${c.tddDisposition} vs review-army=${c.reviewDisposition}`);
|
|
466
|
-
}
|
|
467
|
-
return `Finding ${c.findingId} appears in both 06-tdd.md > Per-Slice Review and 07-review-army.json with mismatched ${parts.join(" and ")}. Review must cite, not re-classify.`;
|
|
468
|
-
});
|
|
469
|
-
return {
|
|
470
|
-
ok: errors.length === 0,
|
|
471
|
-
errors,
|
|
472
|
-
conflicts,
|
|
473
|
-
tddArtifactExists,
|
|
474
|
-
reviewArtifactExists
|
|
475
|
-
};
|
|
476
|
-
}
|
|
477
|
-
export async function checkReviewSecurityNoChangeAttestation(projectRoot) {
|
|
478
|
-
const reviewMdPath = path.join(projectRoot, RUNTIME_ROOT, "artifacts", "07-review.md");
|
|
479
|
-
if (!(await exists(reviewMdPath))) {
|
|
480
|
-
return {
|
|
481
|
-
ok: true,
|
|
482
|
-
errors: [],
|
|
483
|
-
hasSecurityFinding: false,
|
|
484
|
-
hasNoChangeAttestation: false
|
|
485
|
-
};
|
|
486
|
-
}
|
|
487
|
-
const errors = [];
|
|
488
|
-
const raw = await fs.readFile(reviewMdPath, "utf8");
|
|
489
|
-
const sections = extractH2Sections(raw);
|
|
490
|
-
const securityBody = sectionBodyByName(sections, "Layer 2 Security")
|
|
491
|
-
?? sectionBodyByName(sections, "Layer 2b: Security")
|
|
492
|
-
?? sectionBodyByName(sections, "Layer 2 Findings");
|
|
493
|
-
if (!securityBody) {
|
|
494
|
-
errors.push('07-review.md is missing a Layer 2 security section.');
|
|
495
|
-
return {
|
|
496
|
-
ok: false,
|
|
497
|
-
errors,
|
|
498
|
-
hasSecurityFinding: false,
|
|
499
|
-
hasNoChangeAttestation: false
|
|
500
|
-
};
|
|
501
|
-
}
|
|
502
|
-
const securityTableRowPattern = /^\|\s*[^|\n]+\|\s*[^|\n]+\|\s*security\s*\|\s*[^|\n]+\|\s*[^|\n]+\|/imu;
|
|
503
|
-
const securityBulletPattern = /^[*-]\s+.*\b(?:security|auth|injection|secret|credential|permission)\b/imu;
|
|
504
|
-
const hasSecurityFinding = securityTableRowPattern.test(securityBody) || securityBulletPattern.test(securityBody);
|
|
505
|
-
const attestationMatch = /\b(NO_CHANGE_ATTESTATION|NO_SECURITY_IMPACT)\b\s*:\s*(.*)/iu.exec(securityBody);
|
|
506
|
-
const attestationToken = attestationMatch?.[1] ?? "NO_CHANGE_ATTESTATION";
|
|
507
|
-
const hasNoChangeAttestation = Boolean(attestationMatch && attestationMatch[2]?.trim().length > 0);
|
|
508
|
-
if (attestationMatch && attestationMatch[2]?.trim().length === 0) {
|
|
509
|
-
errors.push(`${attestationToken} must include a non-empty rationale.`);
|
|
510
|
-
}
|
|
511
|
-
if (!hasSecurityFinding && !hasNoChangeAttestation) {
|
|
512
|
-
errors.push("Layer 2 security evidence missing: include at least one security finding or `NO_CHANGE_ATTESTATION: <reason>` / `NO_SECURITY_IMPACT: <reason>`.");
|
|
513
|
-
}
|
|
514
|
-
return {
|
|
515
|
-
ok: errors.length === 0,
|
|
516
|
-
errors,
|
|
517
|
-
hasSecurityFinding,
|
|
518
|
-
hasNoChangeAttestation
|
|
519
|
-
};
|
|
520
|
-
}
|
|
@@ -1,113 +0,0 @@
|
|
|
1
|
-
import { evaluateInvestigationTrace, markdownFieldRegex, sectionBodyByName } from "./shared.js";
|
|
2
|
-
import { checkReviewTddNoCrossArtifactDuplication } from "./review-army.js";
|
|
3
|
-
export async function lintReviewStage(ctx) {
|
|
4
|
-
const { projectRoot, track, raw, absFile, sections, findings, parsedFrontmatter, brainstormShortCircuitBody, brainstormShortCircuitActivated, staleDiagramAuditEnabled, isTrivialOverride } = ctx;
|
|
5
|
-
evaluateInvestigationTrace(ctx, "Changed-File Coverage");
|
|
6
|
-
// Universal Layer 2.7 structural checks (superpowers requesting + receiving).
|
|
7
|
-
const frameBody = sectionBodyByName(sections, "Pre-Critic Self-Review");
|
|
8
|
-
if (frameBody !== null) {
|
|
9
|
-
const required = [
|
|
10
|
-
"Build/lint/type-check/tests passed locally",
|
|
11
|
-
"Diff matches spec/plan (no scope creep)",
|
|
12
|
-
"Evidence (commands + result):",
|
|
13
|
-
"Goal:",
|
|
14
|
-
"Approach:",
|
|
15
|
-
"Risk areas:",
|
|
16
|
-
"Verification done:",
|
|
17
|
-
"Open questions"
|
|
18
|
-
];
|
|
19
|
-
const missing = required.filter((token) => {
|
|
20
|
-
const escaped = token
|
|
21
|
-
.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")
|
|
22
|
-
.replace(/\\:/gu, "\\s*:");
|
|
23
|
-
return !new RegExp(escaped, "iu").test(frameBody);
|
|
24
|
-
});
|
|
25
|
-
findings.push({
|
|
26
|
-
section: "Pre-Critic Self-Review Coverage",
|
|
27
|
-
required: true,
|
|
28
|
-
rule: "Pre-Critic Self-Review must include key self-check lines plus Goal, Approach, Risk areas, Verification done, and Open questions.",
|
|
29
|
-
found: missing.length === 0,
|
|
30
|
-
details: missing.length === 0
|
|
31
|
-
? "Pre-Critic Self-Review covers all required fields."
|
|
32
|
-
: `Pre-Critic Self-Review is missing field(s): ${missing.join(", ")}.`
|
|
33
|
-
});
|
|
34
|
-
}
|
|
35
|
-
const criticBody = sectionBodyByName(sections, "Critic Subagent Dispatch");
|
|
36
|
-
if (criticBody !== null) {
|
|
37
|
-
const required = [
|
|
38
|
-
"Critic agent definition path",
|
|
39
|
-
"Dispatch surface",
|
|
40
|
-
"Frame sent",
|
|
41
|
-
"Critic returned"
|
|
42
|
-
];
|
|
43
|
-
const missing = required.filter((token) => !criticBody.includes(token));
|
|
44
|
-
findings.push({
|
|
45
|
-
section: "Critic Subagent Dispatch Shape",
|
|
46
|
-
required: true,
|
|
47
|
-
rule: "Critic Subagent Dispatch must declare agent definition path, dispatch surface, frame sent, and critic-returned summary.",
|
|
48
|
-
found: missing.length === 0,
|
|
49
|
-
details: missing.length === 0
|
|
50
|
-
? "Critic dispatch metadata complete."
|
|
51
|
-
: `Critic Subagent Dispatch is missing field(s): ${missing.join(", ")}.`
|
|
52
|
-
});
|
|
53
|
-
}
|
|
54
|
-
const receivingBody = sectionBodyByName(sections, "Receiving Posture");
|
|
55
|
-
if (receivingBody !== null) {
|
|
56
|
-
const ack = /no performative agreement/iu.test(receivingBody);
|
|
57
|
-
findings.push({
|
|
58
|
-
section: "Receiving Posture Anti-Sycophancy",
|
|
59
|
-
required: true,
|
|
60
|
-
rule: "Receiving Posture must affirm `No performative agreement (forbidden openers acknowledged)`.",
|
|
61
|
-
found: ack,
|
|
62
|
-
details: ack
|
|
63
|
-
? "Receiving posture acknowledged anti-sycophancy."
|
|
64
|
-
: "Receiving Posture is missing the anti-sycophancy acknowledgement line."
|
|
65
|
-
});
|
|
66
|
-
}
|
|
67
|
-
const dupResult = await checkReviewTddNoCrossArtifactDuplication(projectRoot);
|
|
68
|
-
findings.push({
|
|
69
|
-
section: "review.no_cross_artifact_duplication",
|
|
70
|
-
required: true,
|
|
71
|
-
rule: "[P1] review.no_cross_artifact_duplication — when a finding ID appears in both `06-tdd.md > Per-Slice Review` and `07-review-army.json`, severity and disposition must match (review cites tdd; never re-classifies).",
|
|
72
|
-
found: dupResult.ok,
|
|
73
|
-
details: dupResult.ok
|
|
74
|
-
? dupResult.tddArtifactExists && dupResult.reviewArtifactExists
|
|
75
|
-
? "No cross-artifact severity/disposition conflicts between tdd Per-Slice Review and review-army findings."
|
|
76
|
-
: "Skipped: tdd Per-Slice Review or review-army artifact not present."
|
|
77
|
-
: dupResult.errors.join(" ")
|
|
78
|
-
});
|
|
79
|
-
const lensCoverageBody = sectionBodyByName(sections, "Lens Coverage");
|
|
80
|
-
if (lensCoverageBody === null) {
|
|
81
|
-
findings.push({
|
|
82
|
-
section: "reviewer.lens_coverage_missing",
|
|
83
|
-
required: true,
|
|
84
|
-
rule: "[P1] reviewer.lens_coverage_missing — review artifact must include `## Lens Coverage` with Performance/Compatibility/Observability/Security lines.",
|
|
85
|
-
found: false,
|
|
86
|
-
details: "No ## heading matching required section \"Lens Coverage\"."
|
|
87
|
-
});
|
|
88
|
-
}
|
|
89
|
-
else {
|
|
90
|
-
const performance = markdownFieldRegex("Performance", "NO_IMPACT|FOUND_\\d+").test(lensCoverageBody);
|
|
91
|
-
const compatibility = markdownFieldRegex("Compatibility", "NO_IMPACT|FOUND_\\d+").test(lensCoverageBody);
|
|
92
|
-
const observability = markdownFieldRegex("Observability", "NO_IMPACT|FOUND_\\d+").test(lensCoverageBody);
|
|
93
|
-
const security = markdownFieldRegex("Security", "routed\\s+to\\s+security-reviewer").test(lensCoverageBody);
|
|
94
|
-
const missing = [];
|
|
95
|
-
if (!performance)
|
|
96
|
-
missing.push("Performance");
|
|
97
|
-
if (!compatibility)
|
|
98
|
-
missing.push("Compatibility");
|
|
99
|
-
if (!observability)
|
|
100
|
-
missing.push("Observability");
|
|
101
|
-
if (!security)
|
|
102
|
-
missing.push("Security");
|
|
103
|
-
findings.push({
|
|
104
|
-
section: "reviewer.lens_coverage_missing",
|
|
105
|
-
required: true,
|
|
106
|
-
rule: "[P1] reviewer.lens_coverage_missing — `Lens Coverage` must include Performance/Compatibility/Observability (`NO_IMPACT` or `FOUND_<n>`) and Security routing line.",
|
|
107
|
-
found: missing.length === 0,
|
|
108
|
-
details: missing.length === 0
|
|
109
|
-
? "Lens Coverage includes all required reviewer lens lines."
|
|
110
|
-
: `Lens Coverage missing or malformed line(s): ${missing.join(", ")}.`
|
|
111
|
-
});
|
|
112
|
-
}
|
|
113
|
-
}
|