fullstack-agentic-flow 2.0.0

package/payload/ai-agents/scripts/check-typed-boundaries.mjs

@@ -0,0 +1,329 @@
+#!/usr/bin/env node
+// @ts-check
+/**
+ * Rule T1 (canon/typed-data.md): no untyped array, map, `mixed`, or `any` in a
+ * signature that crosses a boundary. Diff-based: only added lines are judged,
+ * so enabling the rule never fails untouched history.
+ *
+ * Usage:
+ *   node .ai-agents/scripts/check-typed-boundaries.mjs --base origin/main   # CI
+ *   node .ai-agents/scripts/check-typed-boundaries.mjs --staged             # pre-commit
+ *
+ * Paths come from .ai-agents/rules.config.json → typedBoundaries.
+ * Suppress one line with a trailing comment:  typed-boundary-ok: <reason>
+ */
+import { execFileSync } from 'node:child_process';
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+import { matchesAny } from './lib/glob.mjs';
+import { loadRulesConfig } from './lib/config.mjs';
+
+/**
+ * @typedef {object} Violation
+ * @property {string} file
+ * @property {number} line
+ * @property {'T1'} rule
+ * @property {string} found
+ */
+
+/** @typedef {'php' | 'ts' | 'py'} Language */
+
+const SUPPRESSION = /typed-boundary-ok:\s*\S/;
+const HINT = 'use a named Data class or typed collection (see .ai-agents/canon/typed-data.md)';
+
+/**
+ * @param {string} path
+ * @returns {Language | null}
+ */
+export function languageOf(path) {
+  if (path.endsWith('.php')) return 'php';
+  if (/\.(ts|tsx|mts|cts)$/.test(path) && !path.endsWith('.d.ts')) return 'ts';
+  if (path.endsWith('.py')) return 'py';
+  return null;
+}
+
+/**
+ * @param {string} line
+ * @returns {boolean}
+ */
+function isCommentLine(line) {
+  return /^\s*(\/\/|\*|\/\*|#)/.test(line);
+}
+
+// ---------------------------------------------------------------- PHP
+
+/**
+ * Line ranges (1-based, inclusive) of named function/method signatures.
+ * @param {ReadonlyArray<string>} lines
+ * @returns {ReadonlyArray<{ start: number, end: number }>}
+ */
+function phpSignatures(lines) {
+  /** @type {Array<{ start: number, end: number }>} */
+  const ranges = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    const text = lines[i] ?? '';
+    const head = /\bfunction\s+&?[A-Za-z_]\w*\s*\(/.exec(text);
+    if (!head || isCommentLine(text)) continue;
+    let depth = 0;
+    let closed = false;
+    let end = i;
+    scan: for (let j = i; j < lines.length; j += 1) {
+      const segment = j === i ? text.slice(head.index) : (lines[j] ?? '');
+      for (const char of segment) {
+        if (char === '(') depth += 1;
+        else if (char === ')') {
+          depth -= 1;
+          if (depth === 0) closed = true;
+        } else if (closed && (char === '{' || char === ';')) {
+          end = j;
+          break scan;
+        }
+      }
+      end = j;
+    }
+    ranges.push({ start: i + 1, end: end + 1 });
+    i = end;
+  }
+  return ranges;
+}
+
+/**
+ * Nearest docblock text above a 1-based line, skipping blank and attribute lines.
+ * @param {ReadonlyArray<string>} lines
+ * @param {number} lineNumber
+ * @returns {string}
+ */
+function docblockAbove(lines, lineNumber) {
+  let index = lineNumber - 2;
+  while (index >= 0 && /^\s*(#\[.*\])?\s*$/.test(lines[index] ?? '')) index -= 1;
+  if (index < 0 || !/\*\/\s*$/.test(lines[index] ?? '')) return '';
+  /** @type {Array<string>} */
+  const block = [];
+  while (index >= 0) {
+    const current = lines[index] ?? '';
+    block.unshift(current);
+    if (current.includes('/**')) break;
+    index -= 1;
+  }
+  return block.join('\n');
+}
+
+/**
+ * @param {string} typeText
+ * @returns {string | null}
+ */
+function untypedPhpType(typeText) {
+  const parts = typeText.replace(/^\?/, '').split(/[|&]/).map((part) => part.replace(/^\?/, '').toLowerCase());
+  return parts.find((part) => part === 'array' || part === 'mixed' || part === 'iterable') ?? null;
+}
+
+/**
+ * @param {string} file
+ * @param {ReadonlyArray<string>} lines
+ * @param {ReadonlySet<number>} added
+ * @returns {Array<Violation>}
+ */
+function phpViolations(file, lines, added) {
+  /** @type {Array<Violation>} */
+  const found = [];
+  for (const signature of phpSignatures(lines)) {
+    const docblock = docblockAbove(lines, signature.start);
+    for (let n = signature.start; n <= signature.end; n += 1) {
+      const text = lines[n - 1] ?? '';
+      if (!added.has(n) || SUPPRESSION.test(text) || isCommentLine(text)) continue;
+      const promoted = /\b(public|protected|private)\b/.test(text) && !/\bfunction\b/.test(text);
+
+      for (const match of text.matchAll(/([\w\\|?&]+)\s+(?:&\s*)?(?:\.\.\.)?\$(\w+)/g)) {
+        const typeText = match[1] ?? '';
+        const name = match[2] ?? '';
+        const bad = untypedPhpType(typeText);
+        if (!bad) continue;
+        const genericParam = new RegExp(`@param\\s+\\S*<[^\\n]*\\$${name}\\b`).test(docblock);
+        if (promoted && bad === 'array' && genericParam) continue;
+        found.push({ file, line: n, rule: 'T1', found: `${typeText} $${name}` });
+        break;
+      }
+      if (found.at(-1)?.line === n) continue;
+
+      const returns = /\)\s*:\s*([\w\\|?]+)/.exec(text);
+      const badReturn = returns ? untypedPhpType(returns[1] ?? '') : null;
+      if (returns && badReturn) {
+        found.push({ file, line: n, rule: 'T1', found: `returns ${returns[1]}` });
+      }
+    }
+  }
+  return found;
+}
+
+// ---------------------------------------------------------------- TypeScript
+
+/** @type {ReadonlyArray<RegExp>} */
+const TS_PATTERNS = [
+  /Record<\s*string\s*,\s*(unknown|any)\s*>/,
+  /Map<\s*string\s*,\s*(unknown|any)\s*>/,
+  /:\s*\{\s*\[\s*\w+\s*:\s*string\s*\]\s*:\s*(unknown|any)\b/,
+  /:\s*any\b/,
+  /\bany\[\]/,
+  /<\s*any\s*>/,
+  /\bas\s+any\b/,
+  /:\s*object\b/,
+];
+
+/**
+ * @param {string} file
+ * @param {ReadonlyArray<string>} lines
+ * @param {ReadonlySet<number>} added
+ * @returns {Array<Violation>}
+ */
+function tsViolations(file, lines, added) {
+  /** @type {Array<Violation>} */
+  const found = [];
+  lines.forEach((raw, index) => {
+    const n = index + 1;
+    if (!added.has(n) || isCommentLine(raw) || SUPPRESSION.test(raw)) return;
+    const text = raw.replace(/\s\/\/.*$/, '');
+    for (const pattern of TS_PATTERNS) {
+      const match = pattern.exec(text);
+      if (match) {
+        found.push({ file, line: n, rule: 'T1', found: match[0].trim() });
+        return;
+      }
+    }
+  });
+  return found;
+}
+
+// ---------------------------------------------------------------- Python
+
+/** @type {ReadonlyArray<RegExp>} */
+const PY_PATTERNS = [
+  /\b(dict|Dict|Mapping|MutableMapping)\[\s*str\s*,\s*(Any|object)\s*\]/,
+  /->\s*(dict|list|Any|object)\s*:/,
+  /:\s*(dict|list)\s*[,)=]/,
+  /:\s*Any\b/,
+];
+
+/**
+ * @param {string} file
+ * @param {ReadonlyArray<string>} lines
+ * @param {ReadonlySet<number>} added
+ * @returns {Array<Violation>}
+ */
+function pyViolations(file, lines, added) {
+  /** @type {Array<Violation>} */
+  const found = [];
+  lines.forEach((raw, index) => {
+    const n = index + 1;
+    if (!added.has(n) || /^\s*#/.test(raw) || SUPPRESSION.test(raw)) return;
+    const text = raw.replace(/\s#.*$/, '');
+    for (const pattern of PY_PATTERNS) {
+      const match = pattern.exec(text);
+      if (match) {
+        found.push({ file, line: n, rule: 'T1', found: match[0].trim() });
+        return;
+      }
+    }
+  });
+  return found;
+}
+
+// ---------------------------------------------------------------- API
+
+/**
+ * @param {string} file       repository-relative path
+ * @param {string} content    full file content
+ * @param {ReadonlySet<number>} added  1-based line numbers added in the diff
+ * @returns {Array<Violation>}
+ */
+export function findViolations(file, content, added) {
+  const language = languageOf(file);
+  if (language === null) return [];
+  const lines = content.split('\n');
+  switch (language) {
+    case 'php':
+      return phpViolations(file, lines, added);
+    case 'ts':
+      return tsViolations(file, lines, added);
+    case 'py':
+      return pyViolations(file, lines, added);
+  }
+}
+
+/**
+ * Added line numbers per file, from `git diff -U0` output.
+ * @param {string} diff
+ * @returns {Map<string, Set<number>>}
+ */
+export function parseAddedLines(diff) {
+  /** @type {Map<string, Set<number>>} */
+  const result = new Map();
+  /** @type {string | null} */
+  let file = null;
+  let next = 0;
+  for (const line of diff.split('\n')) {
+    if (line.startsWith('+++ ')) {
+      const target = line.slice(4).trim();
+      file = target === '/dev/null' ? null : target.replace(/^b\//, '');
+      continue;
+    }
+    if (line.startsWith('--- ') || line.startsWith('diff --git')) continue;
+    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hunk) {
+      next = Number(hunk[1]);
+      continue;
+    }
+    if (file === null) continue;
+    if (line.startsWith('+')) {
+      const lines = result.get(file) ?? new Set();
+      lines.add(next);
+      result.set(file, lines);
+      next += 1;
+    } else if (line.startsWith(' ')) {
+      next += 1;
+    }
+  }
+  return result;
+}
+
+/**
+ * @param {ReadonlyArray<string>} argv
+ * @returns {number} exit code
+ */
+export function main(argv) {
+  const root = process.cwd();
+  const config = loadRulesConfig(root).typedBoundaries;
+  if (config.paths.length === 0) {
+    console.log('T1 typed-boundaries: not configured (typedBoundaries.paths is empty) — skipping.');
+    return 0;
+  }
+  const baseIndex = argv.indexOf('--base');
+  const range = argv.includes('--staged')
+    ? ['--cached']
+    : [`${baseIndex >= 0 ? argv[baseIndex + 1] ?? 'origin/main' : 'origin/main'}...HEAD`];
+  const diff = execFileSync('git', ['diff', '-U0', '--no-color', '--diff-filter=AMR', ...range], {
+    encoding: 'utf8',
+    maxBuffer: 64 * 1024 * 1024,
+  });
+
+  /** @type {Array<Violation>} */
+  const violations = [];
+  for (const [file, added] of parseAddedLines(diff)) {
+    if (!matchesAny(file, config.paths) || matchesAny(file, config.allow)) continue;
+    const full = join(root, file);
+    if (!existsSync(full)) continue;
+    violations.push(...findViolations(file, readFileSync(full, 'utf8'), added));
+  }
+
+  for (const v of violations) {
+    console.log(`${v.rule} ${v.file}:${v.line} — ${v.found} — ${HINT}`);
+  }
+  console.log(`T1 typed-boundaries: ${violations.length} violation(s).`);
+  return violations.length === 0 ? 0 : 1;
+}
+
+const invoked = process.argv[1];
+if (invoked !== undefined && import.meta.url === pathToFileURL(invoked).href) {
+  process.exit(main(process.argv.slice(2)));
+}

package/payload/ai-agents/scripts/lib/config.mjs

@@ -0,0 +1,63 @@
+// @ts-check
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * @typedef {object} TypedBoundariesConfig
+ * @property {ReadonlyArray<string>} paths  Globs the T1 check applies to
+ * @property {ReadonlyArray<string>} allow  Globs exempt from the check
+ */
+
+/**
+ * @typedef {object} TestWithChangeConfig
+ * @property {ReadonlyArray<string>} sourcePaths
+ * @property {ReadonlyArray<string>} testPaths
+ * @property {string} exemptionTag
+ */
+
+/**
+ * @typedef {object} RulesConfig
+ * @property {TypedBoundariesConfig} typedBoundaries
+ * @property {TestWithChangeConfig} testWithChange
+ */
+
+/**
+ * @param {unknown} value
+ * @param {string} field
+ * @returns {ReadonlyArray<string>}
+ */
+function stringList(value, field) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
+    throw new Error(`rules.config.json: ${field} must be a list of strings`);
+  }
+  return /** @type {ReadonlyArray<string>} */ (value);
+}
+
+/**
+ * Parse edge for rules.config.json (typed-data T5): read, validate, return a named shape.
+ * @param {string} repoRoot
+ * @returns {RulesConfig}
+ */
+export function loadRulesConfig(repoRoot) {
+  const path = join(repoRoot, '.ai-agents', 'rules.config.json');
+  if (!existsSync(path)) {
+    throw new Error(`Missing ${path}. Run the installer, then /bootstrap to configure it.`);
+  }
+  /** @type {{ typedBoundaries?: { paths?: unknown, allow?: unknown }, testWithChange?: { sourcePaths?: unknown, testPaths?: unknown, exemptionTag?: unknown } }} */
+  const raw = JSON.parse(readFileSync(path, 'utf8'));
+  const tag = raw.testWithChange?.exemptionTag ?? 'no-test';
+  if (typeof tag !== 'string') {
+    throw new Error('rules.config.json: testWithChange.exemptionTag must be a string');
+  }
+  return {
+    typedBoundaries: {
+      paths: stringList(raw.typedBoundaries?.paths ?? [], 'typedBoundaries.paths'),
+      allow: stringList(raw.typedBoundaries?.allow ?? [], 'typedBoundaries.allow'),
+    },
+    testWithChange: {
+      sourcePaths: stringList(raw.testWithChange?.sourcePaths ?? [], 'testWithChange.sourcePaths'),
+      testPaths: stringList(raw.testWithChange?.testPaths ?? [], 'testWithChange.testPaths'),
+      exemptionTag: tag,
+    },
+  };
+}

package/payload/ai-agents/scripts/lib/glob.mjs

@@ -0,0 +1,40 @@
+// @ts-check
+/**
+ * Minimal glob matching for rule configuration. Supports `**` (any depth,
+ * including zero directories), `*` (within one path segment), and `?`.
+ * Paths are always forward-slash, repository-relative.
+ */
+
+/**
+ * @param {string} glob
+ * @returns {RegExp}
+ */
+export function globToRegExp(glob) {
+  let pattern = '';
+  for (let i = 0; i < glob.length; i += 1) {
+    const char = glob.charAt(i);
+    if (char === '*') {
+      if (glob.charAt(i + 1) === '*') {
+        const followedBySlash = glob.charAt(i + 2) === '/';
+        pattern += followedBySlash ? '(?:.*/)?' : '.*';
+        i += followedBySlash ? 2 : 1;
+      } else {
+        pattern += '[^/]*';
+      }
+    } else if (char === '?') {
+      pattern += '[^/]';
+    } else {
+      pattern += char.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    }
+  }
+  return new RegExp(`^${pattern}$`);
+}
+
+/**
+ * @param {string} path
+ * @param {ReadonlyArray<string>} globs
+ * @returns {boolean}
+ */
+export function matchesAny(path, globs) {
+  return globs.some((glob) => globToRegExp(glob).test(path));
+}

package/payload/ai-agents/state/README.md

@@ -0,0 +1,108 @@
+# State
+
+Files here are written by agents and read by other agents. They hold the
+**current** feature only. Before the branch merges, agent 09a archives them to
+`.ai-agents/archive/{slug}/` and resets this directory, so the reset travels
+with the feature instead of waiting for someone to do it afterwards.
+
+This directory is why the pipeline survives losing its conversation. The state is
+on disk, not in anyone's context window — you can close the session mid-feature,
+come back next week, run `/resume`, and pick up exactly where you stopped.
+
+## Files
+
+| File | Written by | Read by |
+|------|-----------|---------|
+| `current-feature.md` | 01 intake | 01b, 02a, 02b, 02c, 02d, 03a, 03b, 06, 07, 08, 09a |
+| `impact.md` | 01b impact (predict, then verify) | 02a, 02b, 02c, 03a, 04a, 04b, 06, 07, 08, 09a |
+| `tdd-log.md` | 00a, 00b, 04a, 04b | Gate 2 reviewer, 06, 09a |
+| `current-plan.md` | 02a (deps), 03a (backend tasks), 03b (UI tasks) | 04a, 04b |
+| `contract-backend.md` | 02b | 02d, 03a, 04a, 06, 07, 08, 09a |
+| `contract-ui.md` | 02c | 02d, 03b, 04b, 06, 08, 09a |
+| `contract-seam.md` | 02d | 03a, 03b, **04a, 04b**, 06, 07 |
+| `current-stage.md` | every agent | every agent |
+| `decisions-log.md` | 04a, 04b | 09a |
+| `scaffold-decisions.md` | 00a scaffold | 00 bootstrap |
+
+Outside `state/`:
+
+| Path | Written by | Read by |
+|------|-----------|---------|
+| `contracts/{slug}/` | 02d (`export` mode), `/seam import` | 02d, 03b, 04b, CI job 10 — survives release |
+| `.ai-agents/changes/{slug}.md` | 09a `/finalize` | 09b `/release` — the feature's own release note |
+| `.ai-agents/observations/` | task-observer | 09 changelog (retrospective) |
+| `.ai-agents/pipeline.config.json` | installer | every agent (topology, runtimes, tools) |
+
+`scaffold-decisions.md` only exists on repositories that started empty. It
+records which stack decisions were actively chosen and which were merely
+defaulted, so bootstrap can carry the defaulted ones into the context marked as
+weakly held rather than enshrining an unexamined default as convention.
+
+`contract-seam.md` is the frozen seam. Both implementers build against it, and it
+outranks either contract where they differ. When it needs to change, it changes
+here and both tracks are told — never on one side only.
+
+When idle, only `current-stage.md` exists, reading `Stage: idle`.
+
+## Stages
+
+| Stage | Meaning | Next |
+|-------|---------|------|
+| *(empty repo)* | Nothing to document yet | `/scaffold` |
+| `scaffolded` | Vertical slice built, Gate A open | Review the slice, then `/bootstrap` |
+| *(no architecture context)* | Repo has code but is not set up | `/bootstrap` |
+| `bootstrapped` | Context written, Gate B open | Review it, then `/intake` |
+| `idle` | Nothing in progress | `/intake` |
+| `intake-complete` | Gate 0 open | `approve` / `edit` / `split` |
+| `gate-0-approved` | Ready to measure impact | `/impact` |
+| `impact-assessed` | Risk class set | `/contract` |
+| `contracts-complete` | 02a, 02b, 02c, 02d all done — Gate 1 open | Review seam first, then `approve` |
+| `gate-1-approved` | Ready to sequence | `/sequence` |
+| `sequence-complete` | Both tracks sequenced | `/implement` |
+| `backend-task-{n}-committed` | Gate 2 open | Review diff, push |
+| `ui-task-{n}-committed` | Gate 2 open | Review diff, push |
+| `{track}-task-{n}-ci-failed` | CI failed | Fix, or `/implement --retry-task {track} {n}` |
+| `{track}-task-{n}-merged` | Task merged | `/implement` for the next available |
+| *(all tasks committed)* | Implementation done | `/impact --verify` |
+| `impact-verified` | Actual impact measured | `/qa` and `/security` (and `/perf`, mandatory at L2+) |
+| `review-complete` | Gate 3 open | `approve-merge` / `block` |
+| `gate-3-approved` | Reviews passed | `/finalize` — note, archive, state reset |
+| `finalized` | Branch is finished | Push and merge; then `/intake`. Nothing runs against merged code |
+| `idle` | Reset by `/finalize` | `/intake` |
+
+Individual agent completions are appended as lines rather than replacing the
+stage, so parallel agents do not overwrite each other:
+
+```markdown
+**02b backend-contract**: complete at 2026-08-18T09:14:22Z
+**02c ui-contract**: complete at 2026-08-18T09:19:08Z
+```
+
+The overall stage advances only when every agent in that step has finished.
+
+## Flags
+
+Appended by agents and surfaced by `/status` and `/resume`:
+
+```markdown
+**Critical security findings**: 2 — MERGE BLOCKED
+**Critical performance findings**: 1 — degrades at 500k rows
+**Escalated decisions**: 1 — unresolved in contract-seam.md
+**Risk class**: L2
+**Required**: /perf mandatory; characterisation tests first
+**Escapes**: 2 — must be covered or accepted before merge
+```
+
+## Editing by hand
+
+You can edit these files between agent runs — to correct a wrong assumption in a
+contract, or to reorder tasks. The next agent picks up your edits.
+
+Two things to know:
+
+- Editing `contract-backend.md` or `contract-ui.md` after the seam is frozen
+  makes them disagree with `contract-seam.md`. If the change touches the API,
+  re-run `/contract` so 02d re-freezes it.
+- Do not edit application source to match a state file edit. Re-run the
+  appropriate agent instead — the point of the pipeline is that the code follows
+  from the documents.

package/payload/ai-agents/state/current-stage.md

@@ -0,0 +1,10 @@
+# Current Stage
+
+**Stage**: idle
+**Next action**: Depends on what is in this repository.
+
+- **Empty, or only framework default output** → `/scaffold`. There is nothing for
+  `/bootstrap` to read yet, and a context written from intentions rather than
+  code produces exemplars nobody should imitate.
+- **Has real code, no `architecture-context.md`** → `/bootstrap`.
+- **Context exists and is filled in** → `/intake` to start a feature.

package/payload/ai-agents/templates/README.md

@@ -0,0 +1,22 @@
+# Templates
+
+Starter files agent 00 (`/bootstrap`) adapts to the project, and reference
+material the implementers read for pattern rather than copy verbatim.
+
+Bootstrap writes the CI configuration directly to the path recorded in
+architecture context §3, wiring up whichever of the jobs in
+`agents/05-ci-validator.md` apply to the project's tooling.
+
+Add templates here as the team identifies patterns worth standardising — a
+module skeleton, a screen skeleton, a test harness. Anything here should be
+something a human would otherwise copy-paste and then edit.
+
+## CI templates
+
+- `ci/gitlab-ci.rules.yml` — include from `.gitlab-ci.yml`
+- `ci/github-actions.rules.yml` — copy into `.github/workflows/`
+
+Both run the T1 typed-boundaries and TDD-1 test-with-change checks on merge
+requests, plus the impeccable design detector as a non-blocking job. `/bootstrap`
+wires the one that matches §3 and adds the repo's own lint, type-check, test,
+and build jobs.

package/payload/ai-agents/templates/ci/github-actions.rules.yml

@@ -0,0 +1,35 @@
+# Pipeline rule jobs for GitHub Actions — copy to .github/workflows/pipeline-rules.yml.
+# /bootstrap adjusts it to the repository (see agents/05-ci-validator.md).
+name: pipeline-rules
+on:
+  pull_request:
+
+jobs:
+  rules:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: T1 typed boundaries
+        run: node .ai-agents/scripts/check-typed-boundaries.mjs --base "origin/${{ github.base_ref }}"
+      - name: TDD-1 test with change
+        run: node .ai-agents/scripts/check-test-with-change.mjs --base "origin/${{ github.base_ref }}"
+
+  design:
+    runs-on: ubuntu-latest
+    continue-on-error: true   # non-blocking until promoted (05-ci-validator §9)
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: impeccable detect on changed UI files
+        run: |
+          CHANGED=$(git diff --name-only "origin/${{ github.base_ref }}"...HEAD -- '*.vue' '*.tsx' '*.jsx' '*.svelte' '*.blade.php' '*.css' | tr '\n' ' ')
+          if [ -n "$CHANGED" ]; then npx --yes impeccable detect $CHANGED; else echo "No UI files changed."; fi

package/payload/ai-agents/templates/ci/gitlab-ci.rules.yml

@@ -0,0 +1,30 @@
+# Pipeline rule jobs for GitLab CI — include from .gitlab-ci.yml:
+#   include:
+#     - local: .ai-agents/templates/ci/gitlab-ci.rules.yml
+# /bootstrap adjusts stages, images, and which jobs apply (see agents/05-ci-validator.md).
+
+.pipeline-rules-base:
+  stage: test
+  image: node:22-alpine
+  before_script:
+    - apk add --no-cache git
+    - git fetch --no-tags origin "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+
+rules:typed-boundaries:
+  extends: .pipeline-rules-base
+  script:
+    - node .ai-agents/scripts/check-typed-boundaries.mjs --base "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
+
+rules:test-with-change:
+  extends: .pipeline-rules-base
+  script:
+    - node .ai-agents/scripts/check-test-with-change.mjs --base "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
+
+design:impeccable-detect:
+  extends: .pipeline-rules-base
+  allow_failure: true   # non-blocking until promoted (05-ci-validator §9)
+  script:
+    - CHANGED=$(git diff --name-only "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"...HEAD -- '*.vue' '*.tsx' '*.jsx' '*.svelte' '*.blade.php' '*.css' | tr '\n' ' ')
+    - if [ -n "$CHANGED" ]; then npx --yes impeccable detect $CHANGED; else echo "No UI files changed."; fi