guardian-framework 0.1.0

package/templates/pi/scripts/ci/stage_static_analysis.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Stage 4: Static Analysis
+#
+# Verifies:
+# - Type checking (mypy/tsc/cargo check/go vet)
+# - Import boundary checks
+# - Architecture sanity checks
+# - Settings/env collision checks
+
+set -euo pipefail
+
+FAIL=0
+PASS=0
+
+log_pass() { echo "  ✓ PASS: $1"; ((PASS++)); }
+log_fail() { echo "  ✗ FAIL: $1 — $2"; ((FAIL++)); }
+
+echo "  Running static analysis..."
+
+# Type checking
+echo "  Type checking..."
+if command -v mypy &>/dev/null && [[ -d "app" ]]; then
+    if mypy app --ignore-missing-imports 2>/dev/null; then
+        log_pass "mypy type check"
+    else
+        log_fail "mypy type check" "Type errors found"
+    fi
+elif command -v tsc &>/dev/null && [[ -f "tsconfig.json" ]]; then
+    if tsc --noEmit 2>/dev/null; then
+        log_pass "tsc type check"
+    else
+        log_fail "tsc type check" "Type errors found"
+    fi
+elif command -v cargo &>/dev/null && [[ -f "Cargo.toml" ]]; then
+    if cargo check 2>/dev/null; then
+        log_pass "cargo check"
+    else
+        log_fail "cargo check" "Compilation errors"
+    fi
+elif command -v go &>/dev/null && [[ -f "go.mod" ]]; then
+    if go vet ./... 2>/dev/null; then
+        log_pass "go vet"
+    else
+        log_fail "go vet" "Vet errors found"
+    fi
+else
+    echo "  No type checker found, skipping."
+fi
+
+# Import boundary checks
+echo "  Checking import boundaries..."
+if [[ -f ".pi/scripts/ci/check_import_boundaries.py" ]]; then
+    if python3 ".pi/scripts/ci/check_import_boundaries.py" 2>/dev/null; then
+        log_pass "import boundary check"
+    else
+        log_fail "import boundary check" "Boundary violations found"
+    fi
+else
+    # Basic check: no domain→infrastructure imports
+    violations=0
+    if [[ -d "app/domain" ]]; then
+        while IFS= read -r file; do
+            if grep -qE "from.*infrastructure|from.*api|import.*infrastructure" "$file" 2>/dev/null; then
+                ((violations++))
+                log_fail "import boundary" "$(basename "$file") imports from infrastructure/api"
+            fi
+        done < <(find app/domain -name "*.py" 2>/dev/null)
+    fi
+    if [[ $violations -eq 0 ]]; then
+        log_pass "import boundary check (no cross-layer violations)"
+    fi
+fi
+
+# Architecture sanity
+echo "  Running architecture sanity checks..."
+if [[ -f ".pi/scripts/ci/check_arch_sanity.py" ]]; then
+    if python3 ".pi/scripts/ci/check_arch_sanity.py" 2>/dev/null; then
+        log_pass "architecture sanity"
+    else
+        log_fail "architecture sanity" "Sanity checks failed"
+    fi
+else
+    log_pass "architecture sanity (no script found, skipping)"
+fi
+
+# Settings/env collision
+echo "  Checking settings/env collision..."
+if [[ -f ".env.example" && -f ".env" ]]; then
+    collisions=0
+    while IFS= read -r line; do
+        var_name=$(echo "$line" | cut -d= -f1)
+        if [[ -n "$var_name" && "$var_name" != \#* ]]; then
+            example_val=$(grep "^${var_name}=" ".env.example" 2>/dev/null | cut -d= -f2-)
+            actual_val=$(grep "^${var_name}=" ".env" 2>/dev/null | cut -d= -f2-)
+            if [[ "$example_val" == "$actual_val" && -n "$example_val" ]]; then
+                ((collisions++))
+                log_fail "env collision" "${var_name} in .env matches .env.example value"
+            fi
+        fi
+    done < <(grep -v "^#" ".env.example" 2>/dev/null | grep "=" || true)
+    if [[ $collisions -eq 0 ]]; then
+        log_pass "settings/env collision check (no collisions)"
+    fi
+else
+    log_pass "settings/env collision check (no .env files)"
+fi
+
+if [[ $FAIL -gt 0 ]]; then
+    echo "  Static analysis FAILED (${FAIL} failure(s))"
+    exit 1
+fi
+
+echo "  Static analysis passed (${PASS} check(s))"
+exit 0

package/templates/pi/scripts/ci/stage_unit.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# Stage 5: Unit Tests
+#
+# Verifies:
+# - Domain tests
+# - Application tests
+# - Contract tests
+# - Verification tests
+# - Coverage threshold check
+
+set -euo pipefail
+
+FAIL=0
+PASS=0
+COVERAGE_PCT=0
+
+log_pass() { echo "  ✓ PASS: $1"; ((PASS++)); }
+log_fail() { echo "  ✗ FAIL: $1 — $2"; ((FAIL++)); }
+
+echo "  Running unit tests..."
+
+if command -v pytest &>/dev/null; then
+    # Domain tests
+    if [[ -d "tests/unit/domain" ]]; then
+        if pytest tests/unit/domain -v 2>/dev/null; then
+            log_pass "unit: domain tests"
+        else
+            log_fail "unit: domain tests" "Domain test failures"
+        fi
+    else
+        log_pass "unit: domain tests (no domain tests found)"
+    fi
+
+    # Application tests
+    if [[ -d "tests/unit/application" ]]; then
+        if pytest tests/unit/application -v 2>/dev/null; then
+            log_pass "unit: application tests"
+        else
+            log_fail "unit: application tests" "Application test failures"
+        fi
+    else
+        log_pass "unit: application tests (no application tests found)"
+    fi
+
+    # Contract tests
+    if [[ -d "tests/contract" ]]; then
+        if pytest tests/contract -v 2>/dev/null; then
+            log_pass "unit: contract tests"
+        else
+            log_fail "unit: contract tests" "Contract test failures"
+        fi
+    else
+        log_pass "unit: contract tests (no contract tests found)"
+    fi
+
+    # Verification tests
+    if [[ -d "tests/verification" ]]; then
+        if pytest tests/verification -v 2>/dev/null; then
+            log_pass "unit: verification tests"
+        else
+            log_fail "unit: verification tests" "Verification test failures"
+        fi
+    else
+        log_pass "unit: verification tests (no verification tests found)"
+    fi
+
+    # Coverage threshold check
+    echo "  Checking coverage threshold..."
+    if [[ -f ".pi/scripts/ci/check_coverage_thresholds.py" ]]; then
+        if python3 ".pi/scripts/ci/check_coverage_thresholds.py" 2>/dev/null; then
+            log_pass "coverage threshold check"
+        else
+            log_fail "coverage threshold check" "Coverage below threshold"
+        fi
+    else
+        # Basic coverage check
+        coverage_file="coverage.xml"
+        if [[ -f "$coverage_file" ]]; then
+            COVERAGE_PCT=$(grep -oP 'line-rate="[^"]*"' "$coverage_file" 2>/dev/null | head -1 | cut -d'"' -f2 || echo "0")
+            threshold="${COVERAGE_THRESHOLD:-80}"
+            COVERAGE_INT=$(echo "$COVERAGE_PCT * 100" | bc 2>/dev/null || echo "0")
+            if [[ $COVERAGE_INT -ge $threshold ]]; then
+                log_pass "coverage threshold (${COVERAGE_PCT} >= ${threshold}%)"
+            else
+                log_fail "coverage threshold" "${COVERAGE_PCT} < ${threshold}%"
+            fi
+        else
+            log_pass "coverage threshold check (no coverage file found)"
+        fi
+    fi
+elif command -v bun &>/dev/null && [[ -f "package.json" ]]; then
+    if bun test 2>/dev/null; then
+        log_pass "unit: all tests (bun)"
+    else
+        log_fail "unit: all tests (bun)" "Test failures"
+    fi
+elif command -v cargo &>/dev/null && [[ -f "Cargo.toml" ]]; then
+    if cargo test 2>/dev/null; then
+        log_pass "unit: all tests (cargo)"
+    else
+        log_fail "unit: all tests (cargo)" "Test failures"
+    fi
+elif command -v go &>/dev/null && [[ -f "go.mod" ]]; then
+    if go test ./... 2>/dev/null; then
+        log_pass "unit: all tests (go)"
+    else
+        log_fail "unit: all tests (go)" "Test failures"
+    fi
+else
+    echo "  No test runner found, skipping unit tests."
+fi
+
+if [[ $FAIL -gt 0 ]]; then
+    echo "  Unit test stage FAILED (${FAIL} failure(s))"
+    exit 1
+fi
+
+echo "  Unit test stage passed (${PASS} check(s))"
+exit 0

package/templates/pi/scripts/ci/validate_agent_output.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""Validate agent output schema compliance.
+
+Validates that agent-generated outputs conform to expected schemas per agent role.
+Checks required sections, contradiction patterns, and structural consistency.
+
+Usage:
+    python scripts/ci/validate_agent_output.py --input=output.md
+    python scripts/ci/validate_agent_output.py --input=output.md --schema=architecture-validator
+    python scripts/ci/validate_agent_output.py --input=output.md --json
+
+Exit codes:
+    0 - Output is valid
+    1 - Validation errors found
+    2 - Script error
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+
+
+SCHEMAS: dict[str, dict] = {
+    "architecture-validator": {
+        "required_sections": [
+            "## Decision",
+            "## Blocking findings",
+            "## Non-blocking recommendations",
+            "## Section reference verification",
+            "## Acceptance criteria verification",
+        ],
+        "contradiction_checks": [
+            {
+                "pattern1": r"## Decision\s*\n\s*-\s*`?pass`?",
+                "pattern2": r"## Non-blocking recommendations\s*\n\s*-",
+                "message": "Decision is 'pass' but recommendations exist (should be 'pass_with_recommendations')",
+            },
+        ],
+    },
+    "epic-plan": {
+        "required_sections": [
+            "## Stream classification",
+            "## Scope summary",
+            "## In scope",
+            "## Out of scope",
+            "## Impacted layers",
+            "## Risk classification",
+            "## Dependency graph",
+            "## Mandatory validators",
+            "## Mandatory CI gates",
+            "## Forbidden shortcuts",
+            "## First implementation issue recommendation",
+        ],
+        "contradiction_checks": [],
+    },
+    "issue-draft": {
+        "required_sections": [
+            "## Why",
+            "## Scope",
+            "## In scope",
+            "## Out of scope",
+            "## Dependencies",
+            "## Acceptance criteria",
+            "## Verification",
+            "## Canonical references",
+        ],
+        "contradiction_checks": [],
+    },
+    "implementation-report": {
+        "required_sections": [
+            "## Readiness check",
+            "## Acceptance criteria trace map",
+            "## Files changed",
+            "## Tests and CI impacts",
+            "## Toolchain validation",
+            "## Done / not done against acceptance criteria",
+        ],
+        "contradiction_checks": [],
+    },
+    "generic": {
+        "required_sections": ["## Summary"],
+        "contradiction_checks": [],
+    },
+}
+
+
+def extract_section(content: str, heading: str) -> str:
+    pattern = re.compile(rf"^{re.escape(heading)}\s*$", re.MULTILINE)
+    match = pattern.search(content)
+    if not match:
+        return ""
+    start = match.end()
+    next_heading = re.search(r"^##\s+", content[start:], re.MULTILINE)
+    end = start + next_heading.start() if next_heading else len(content)
+    return content[start:end].strip()
+
+
+def check_contradictions(content: str, checks: list[dict]) -> list[dict]:
+    results: list[dict] = []
+    for check in checks:
+        has_p1 = bool(re.search(check["pattern1"], content, re.MULTILINE))
+        has_p2 = bool(re.search(check["pattern2"], content, re.MULTILINE))
+        if has_p1 and has_p2:
+            results.append({
+                "check": "contradiction",
+                "status": "fail",
+                "message": check["message"],
+            })
+        else:
+            results.append({
+                "check": f"contradiction: {check['message'][:40]}",
+                "status": "pass",
+            })
+    return results
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Validate agent output schema compliance")
+    parser.add_argument("--input", required=True, help="Path to agent output markdown")
+    parser.add_argument("--schema", default="generic", help="Schema to validate against")
+    parser.add_argument("--json", action="store_true", help="Emit JSON output")
+    args = parser.parse_args()
+
+    input_path = Path(args.input)
+    if not input_path.exists():
+        print(f"Error: Input file not found: {args.input}", file=sys.stderr)
+        return 2
+
+    content = input_path.read_text(encoding="utf-8")
+    schema = SCHEMAS.get(args.schema, SCHEMAS["generic"])
+    all_checks: list[dict] = []
+
+    # Check required sections
+    for section in schema["required_sections"]:
+        if section in content:
+            all_checks.append({"check": f"section:{section}", "status": "pass"})
+        else:
+            all_checks.append({
+                "check": f"section:{section}",
+                "status": "fail",
+                "message": f"Missing required section: {section}",
+            })
+
+    # Check contradictions
+    contradiction_results = check_contradictions(content, schema["contradiction_checks"])
+    all_checks.extend(contradiction_results)
+
+    # Summary
+    passed = sum(1 for c in all_checks if c["status"] == "pass")
+    failed = sum(1 for c in all_checks if c["status"] == "fail")
+
+    if args.json:
+        output = {
+            "input": str(input_path),
+            "schema": args.schema,
+            "timestamp": __import__("datetime").datetime.utcnow().isoformat() + "Z",
+            "summary": {"total": len(all_checks), "passed": passed, "failed": failed},
+            "checks": all_checks,
+            "status": "pass" if failed == 0 else "fail",
+        }
+        print(json.dumps(output, indent=2))
+    else:
+        print(f"\nAgent Output Validation ({args.schema}): {args.input}")
+        print(f"{'='*50}")
+        for check in all_checks:
+            icon = "PASS" if check["status"] == "pass" else "FAIL"
+            print(f"  [{icon}] {check['check']}")
+            if check["status"] == "fail" and "message" in check:
+                print(f"         {check['message']}")
+        print(f"\nSummary: {passed} passed, {failed} failed, {len(all_checks)} total")
+        print(f"Result: {'VALID' if failed == 0 else 'INVALID'}")
+
+    return 0 if failed == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/templates/pi/scripts/ci/validate_agent_output.sh

@@ -0,0 +1,243 @@
+#!/usr/bin/env bash
+# Guardian — Agent Output Validator
+#
+# Validates agent-generated output for schema compliance, consistency, and completeness.
+#
+# Usage:
+#   bash validate_agent_output.sh --input=output.md --schema=architecture-validator
+#   bash validate_agent_output.sh --input=output.md --json
+#   bash validate_agent_output.sh --input=output.md --no-coverage
+
+set -euo pipefail
+
+INPUT=""
+SCHEMA="generic"
+JSON=false
+NO_COVERAGE=false
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+CHECKS_PASSED=0
+CHECKS_FAILED=0
+RESULTS=()
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --input) INPUT="$2"; shift 2 ;;
+        --schema) SCHEMA="$2"; shift 2 ;;
+        --json) JSON=true; shift ;;
+        --no-coverage) NO_COVERAGE=true; shift ;;
+        *) shift ;;
+    esac
+done
+
+if [[ -z "$INPUT" || ! -f "$INPUT" ]]; then
+    echo "Error: --input <file> is required"
+    exit 1
+fi
+
+CONTENT=$(cat "$INPUT")
+
+# ── Validation Functions ──
+
+check_section_present() {
+    local section="$1"
+    if echo "$CONTENT" | grep -qi "$section"; then
+        RESULTS+=("{\"check\": \"$section\", \"status\": \"pass\"}")
+        ((CHECKS_PASSED++))
+        if [[ "$JSON" == "false" ]]; then
+            echo -e "  ${GREEN}✓${NC} Section present: $section"
+        fi
+    else
+        RESULTS+=("{\"check\": \"$section\", \"status\": \"fail\", \"message\": \"Section '$section' not found\"}")
+        ((CHECKS_FAILED++))
+        if [[ "$JSON" == "false" ]]; then
+            echo -e "  ${RED}✗${NC} Missing section: $section"
+        fi
+    fi
+}
+
+check_no_contradictions() {
+    # Check for common contradiction patterns
+    local contradictions=0
+
+    # Check for "must not" followed by "must" about the same topic
+    while IFS= read -r line; do
+        topic=$(echo "$line" | grep -oP '^\s*[-*]\s+\*\*[^*]+\*\*' | head -1 || echo "")
+        if [[ -n "$topic" ]]; then
+            # Count must/must not for this topic
+            must_count=$(echo "$CONTENT" | grep -ci "${topic}.*must " || echo 0)
+            must_not_count=$(echo "$CONTENT" | grep -ci "${topic}.*must not\|${topic}.*must not " || echo 0)
+            if [[ $must_count -gt 0 && $must_not_count -gt 0 ]]; then
+                ((contradictions++))
+            fi
+        fi
+    done < <(echo "$CONTENT" | grep -E "^\s*[-*]\s+\*\*" || true)
+
+    if [[ $contradictions -eq 0 ]]; then
+        RESULTS+=("{\"check\": \"no_contradictions\", \"status\": \"pass\"}")
+        ((CHECKS_PASSED++))
+        if [[ "$JSON" == "false" ]]; then
+            echo -e "  ${GREEN}✓${NC} No internal contradictions"
+        fi
+    else
+        RESULTS+=("{\"check\": \"no_contradictions\", \"status\": \"fail\", \"message\": \"Found $contradictions contradictions\"}")
+        ((CHECKS_FAILED++))
+        if [[ "$JSON" == "false" ]]; then
+            echo -e "  ${RED}✗${NC} Found $contradictions contradictions"
+        fi
+    fi
+}
+
+check_decision_consistency() {
+    # Check that all decisions have supporting evidence
+    local decisions=$(echo "$CONTENT" | grep -ci "decision\|recommendation\|conclusion" || echo 0)
+    local evidence=$(echo "$CONTENT" | grep -ci "evidence\|because\|reason\|rationale\|justification" || echo 0)
+
+    if [[ $decisions -eq 0 ]] || [[ $evidence -gt 0 ]]; then
+        RESULTS+=("{\"check\": \"decision_consistency\", \"status\": \"pass\"}")
+        ((CHECKS_PASSED++))
+        if [[ "$JSON" == "false" ]]; then
+            echo -e "  ${GREEN}✓${NC} Decision consistency"
+        fi
+    else
+        RESULTS+=("{\"check\": \"decision_consistency\", \"status\": \"fail\", \"message\": \"Decisions without supporting evidence\"}")
+        ((CHECKS_FAILED++))
+        if [[ "$JSON" == "false" ]]; then
+            echo -e "  ${RED}✗${NC} Decisions without supporting evidence"
+        fi
+    fi
+}
+
+check_acceptance_criteria() {
+    # Check that acceptance criteria are present and evaluable
+    local has_criteria=$(echo "$CONTENT" | grep -ci "acceptance criteria\|criteria\|must\|should\|required" || echo 0)
+    local has_checklist=$(echo "$CONTENT" | grep -c "\- \[ \]" || echo 0)
+
+    if [[ $has_criteria -gt 0 ]]; then
+        RESULTS+=("{\"check\": \"acceptance_criteria\", \"status\": \"pass\"}")
+        ((CHECKS_PASSED++))
+        if [[ "$JSON" == "false" ]]; then
+            echo -e "  ${GREEN}✓${NC} Acceptance criteria present"
+        fi
+    else
+        RESULTS+=("{\"check\": \"acceptance_criteria\", \"status\": \"fail\", \"message\": \"No acceptance criteria found\"}")
+        ((CHECKS_FAILED++))
+        if [[ "$JSON" == "false" ]]; then
+            echo -e "  ${RED}✗${NC} No acceptance criteria found"
+        fi
+    fi
+}
+
+check_canonical_references() {
+    local has_refs=$(echo "$CONTENT" | grep -c "Canonical Reference\|canonical.*reference\|\.pi/architecture" || echo 0)
+
+    if [[ $has_refs -gt 0 ]]; then
+        RESULTS+=("{\"check\": \"canonical_references\", \"status\": \"pass\"}")
+        ((CHECKS_PASSED++))
+        if [[ "$JSON" == "false" ]]; then
+            echo -e "  ${GREEN}✓${NC} Canonical references present"
+        fi
+    else
+        RESULTS+=("{\"check\": \"canonical_references\", \"status\": \"fail\", \"message\": \"No canonical references found\"}")
+        ((CHECKS_FAILED++))
+        if [[ "$JSON" == "false" ]]; then
+            echo -e "  ${RED}✗${NC} No canonical references found"
+        fi
+    fi
+}
+
+# ── Schema-Specific Checks ──
+
+case "$SCHEMA" in
+    architecture-validator)
+        check_section_present "## Summary"
+        check_section_present "## Findings"
+        check_section_present "## Recommendations"
+        check_section_present "## Acceptance Criteria"
+        check_section_present "## Canonical References"
+        check_no_contradictions
+        check_decision_consistency
+        check_acceptance_criteria
+        check_canonical_references
+        ;;
+
+    epic-plan)
+        check_section_present "## Why"
+        check_section_present "## Target Outcome"
+        check_section_present "## Scope"
+        check_section_present "## In Scope"
+        check_section_present "## Out of Scope"
+        check_section_present "## Impacted Layers"
+        check_section_present "## Architecture Constraints"
+        check_section_present "## Dependency Map"
+        check_section_present "## Canonical References"
+        check_acceptance_criteria
+        check_canonical_references
+        ;;
+
+    issue-draft)
+        check_section_present "## Intent"
+        check_section_present "## Scope"
+        check_section_present "## In Scope"
+        check_section_present "## Out of Scope"
+        check_section_present "## Dependencies"
+        check_section_present "## Acceptance Criteria"
+        check_section_present "## Canonical References"
+        check_acceptance_criteria
+        check_canonical_references
+        ;;
+
+    *)
+        # Generic validation
+        check_section_present "## Summary"
+        check_no_contradictions
+        check_decision_consistency
+        check_acceptance_criteria
+        ;;
+esac
+
+# ── Summary ──
+
+TOTAL=$((CHECKS_PASSED + CHECKS_FAILED))
+
+if [[ "$JSON" == "true" ]]; then
+    RESULTS_JSON=$(printf '%s\n' "${RESULTS[@]}" | jq -s .)
+    cat << EOF
+{
+  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+  "input": "$INPUT",
+  "schema": "$SCHEMA",
+  "summary": {
+    "total": $TOTAL,
+    "passed": $CHECKS_PASSED,
+    "failed": $CHECKS_FAILED
+  },
+  "checks": ${RESULTS_JSON},
+  "status": "$([ $CHECKS_FAILED -gt 0 ] && echo "fail" || echo "pass")"
+}
+EOF
+else
+    echo ""
+    echo "================================"
+    echo "AGENT OUTPUT VALIDATION SUMMARY"
+    echo "================================"
+    echo "Input:       $INPUT"
+    echo "Schema:      $SCHEMA"
+    echo "Total checks: $TOTAL"
+    echo -e "Passed:      ${GREEN}${CHECKS_PASSED}${NC}"
+    echo -e "Failed:      ${RED}${CHECKS_FAILED}${NC}"
+    echo "================================"
+
+    if [[ $CHECKS_FAILED -eq 0 ]]; then
+        echo -e "${GREEN}✅ Agent output validation passed${NC}"
+    else
+        echo -e "${RED}❌ Agent output validation failed (${CHECKS_FAILED} check(s))${NC}"
+    fi
+fi
+
+exit $([ $CHECKS_FAILED -gt 0 ] && echo 1 || echo 0)