guardian-framework 0.1.0

package/templates/pi/scripts/mr-validation.sh

@@ -0,0 +1,228 @@
+#!/usr/bin/env bash
+# ============================================================================
+# mr-validation.sh — Validate Merge Request / Pull Request (GitHub & GitLab)
+#
+# Run as: bash .pi/scripts/mr-validation.sh [pr-number]
+# Checks: CI status, architecture, security, integration
+# ============================================================================
+set -euo pipefail
+
+PR_NUMBER="${1:-}"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+ERRORS=()
+PASS_COUNT=0
+
+pass() { echo -e "${GREEN}✅ PASS${NC} $1"; PASS_COUNT=$((PASS_COUNT + 1)); }
+fail() { echo -e "${RED}❌ FAIL${NC} $1"; ERRORS+=("$1"); }
+warn() { echo -e "${YELLOW}⚠️  WARN${NC} $1"; }
+
+detect_platform() {
+	if [ -f "guardian-manifest.json" ]; then
+		local tool=$(jq -r '.repoTool // ""' guardian-manifest.json 2>/dev/null || echo "")
+		if [[ "$tool" == "glab" ]]; then echo "gitlab"; return; fi
+		if [[ "$tool" == "gh" ]]; then echo "github"; return; fi
+	fi
+	if [[ -n "${GIT_PLATFORM:-}" ]]; then
+		echo "$GIT_PLATFORM"
+	elif command -v gh &>/dev/null && gh auth status &>/dev/null 2>&1; then
+		echo "github"
+	elif command -v glab &>/dev/null && glab auth status &>/dev/null 2>&1; then
+		echo "gitlab"
+	else
+		echo "none"
+	fi
+}
+
+echo "============================================"
+echo "  MR Validation"
+echo "============================================"
+echo ""
+
+PLATFORM=$(detect_platform)
+
+if [[ "$PLATFORM" == "none" ]]; then
+	echo -e "${RED}❌ No git platform detected${NC}"
+	echo "  Install and authenticate gh (GitHub) or glab (GitLab) CLI."
+	exit 1
+fi
+
+# ---------------------------------------------------------------------------
+# Get MR/PR Number
+# ---------------------------------------------------------------------------
+if [ -z "$PR_NUMBER" ]; then
+	BRANCH_NAME=$(git branch --show-current)
+
+	case "$PLATFORM" in
+		github)
+			PR_NUMBER=$(gh pr view --json number -q '.number' 2>/dev/null || echo "")
+			;;
+		gitlab)
+			PR_NUMBER=$(glab mr list --source-branch "$BRANCH_NAME" --json 'iid' -q '.[0].iid' 2>/dev/null || echo "")
+			;;
+	esac
+
+	if [ -z "$PR_NUMBER" ]; then
+		echo -e "${RED}❌ MR/PR number required${NC}"
+		echo "Usage: mr-validation.sh [mr-number]"
+		echo "  Or run from the MR/PR branch"
+		exit 1
+	fi
+fi
+
+echo "Validating MR/PR #$PR_NUMBER on $PLATFORM..."
+
+# ---------------------------------------------------------------------------
+# Get MR/PR Status
+# ---------------------------------------------------------------------------
+case "$PLATFORM" in
+	github)
+		PR_INFO=$(gh pr view "$PR_NUMBER" --json title,state,mergeable,statusCheckRollup,headRefName 2>/dev/null || echo "{}")
+		PR_STATE=$(echo "$PR_INFO" | jq -r '.state // "unknown"')
+		PR_MERGEABLE=$(echo "$PR_INFO" | jq -r '.mergeable // "unknown"')
+		PR_BRANCH=$(echo "$PR_INFO" | jq -r '.headRefName // "unknown"')
+		echo "Title: $(echo "$PR_INFO" | jq -r '.title')"
+		;;
+	gitlab)
+		MR_INFO=$(glab mr view "$PR_NUMBER" --output json 2>/dev/null || echo "{}")
+		PR_STATE=$(echo "$MR_INFO" | jq -r '.state // "unknown"')
+		PR_MERGEABLE=$(echo "$MR_INFO" | jq -r '.merge_status // "unknown"')
+		PR_BRANCH=$(echo "$MR_INFO" | jq -r '.source_branch // "unknown"')
+		echo "Title: $(echo "$MR_INFO" | jq -r '.title')"
+		;;
+esac
+
+echo "State: $PR_STATE"
+echo "Branch: $PR_BRANCH"
+echo ""
+
+# ---------------------------------------------------------------------------
+# CI Status Check
+# ---------------------------------------------------------------------------
+echo "--- CI Status ---"
+
+case "$PLATFORM" in
+	github)
+		STATUS_CHECKS=$(echo "$PR_INFO" | jq -r '.statusCheckRollup[]?.status // "unknown"' 2>/dev/null || echo "unknown")
+		;;
+	gitlab)
+		STATUS_CHECKS=$(echo "$MR_INFO" | jq -r '.head_pipeline.status // "unknown"' 2>/dev/null || echo "unknown")
+		;;
+esac
+
+if [ "$STATUS_CHECKS" = "SUCCESS" ] || [ "$STATUS_CHECKS" = "success" ] || [ "$STATUS_CHECKS" = "passed" ]; then
+	pass "CI checks passed"
+elif [ "$STATUS_CHECKS" = "IN_PROGRESS" ] || [ "$STATUS_CHECKS" = "pending" ] || [ "$STATUS_CHECKS" = "running" ]; then
+	warn "CI checks in progress"
+	echo "  Wait for completion and re-run"
+else
+	fail "CI checks failed or unknown: $STATUS_CHECKS"
+fi
+
+# ---------------------------------------------------------------------------
+# Mergeable Check
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Mergeable Status ---"
+
+if [ "$PR_MERGEABLE" = "MERGEABLE" ] || [ "$PR_MERGEABLE" = "true" ] || [ "$PR_MERGEABLE" = "can_be_merged" ]; then
+	pass "MR/PR is mergeable"
+elif [ "$PR_MERGEABLE" = "CONFLICTING" ] || [ "$PR_MERGEABLE" = "false" ] || [ "$PR_MERGEABLE" = "cannot_be_merged" ]; then
+	fail "MR/PR has merge conflicts"
+	echo "  Resolve conflicts before merge"
+else
+	warn "Mergeable status unknown: $PR_MERGEABLE"
+fi
+
+# ---------------------------------------------------------------------------
+# Run Local Validators
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Local Validation ---"
+
+# Checkout MR/PR branch
+git checkout "$PR_BRANCH" 2>/dev/null || {
+	warn "Could not checkout branch $PR_BRANCH"
+}
+
+# Run validation scripts
+if [ -f ".pi/scripts/validate-ci.sh" ]; then
+	bash .pi/scripts/validate-ci.sh 2>&1 | tail -5
+fi
+
+if [ -f ".pi/scripts/validate-security.sh" ]; then
+	bash .pi/scripts/validate-security.sh 2>&1 | tail -5
+fi
+
+# ---------------------------------------------------------------------------
+# Architecture Check
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Architecture Check ---"
+
+case "$PLATFORM" in
+	github)
+		CHANGED_FILES=$(gh pr diff "$PR_NUMBER" --name-only 2>/dev/null || git diff --name-only "origin/main"..HEAD)
+		;;
+	gitlab)
+		CHANGED_FILES=$(glab mr diff "$PR_NUMBER" --name-only 2>/dev/null || git diff --name-only "origin/main"..HEAD)
+		;;
+esac
+
+for FILE in $CHANGED_FILES; do
+	if [ -f "$FILE" ] && [[ "$FILE" == *.rs ]]; then
+		NEW_FNS=$(git diff "origin/main"..HEAD -- "$FILE" | grep "^[+]pub fn\|^[+]pub async fn" || true)
+		if [ -n "$NEW_FNS" ]; then
+			echo -e "${BLUE}ℹ️  New public functions in $FILE:${NC}"
+			echo "$NEW_FNS" | head -5
+		fi
+	fi
+done
+
+# ---------------------------------------------------------------------------
+# Check for Tests
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- Test Coverage Check ---"
+
+TEST_FILES=$(echo "$CHANGED_FILES" | grep -E "test.*\.|\.test\.|tests/" || true)
+SRC_FILES=$(echo "$CHANGED_FILES" | grep -E "src/|lib/" | grep -v test || true)
+
+if [ -n "$SRC_FILES" ] && [ -z "$TEST_FILES" ]; then
+	warn "Source files changed but no test files"
+	echo "  Consider adding tests for:"
+	echo "$SRC_FILES" | head -5
+else
+	pass "Test coverage present"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo ""
+echo "============================================"
+echo "  Summary"
+echo "============================================"
+echo -e "  Passed:   ${GREEN}${PASS_COUNT}${NC}"
+echo -e "  Failed:   ${RED}${#ERRORS[@]}${NC}"
+echo ""
+
+if [ ${#ERRORS[@]} -gt 0 ]; then
+	echo "BLOCKERS:"
+	for err in "${ERRORS[@]}"; do
+		echo "  - $err"
+	done
+	echo ""
+	echo "Fix blockers before merging"
+	exit 1
+fi
+
+echo -e "${GREEN}MR validation passed. Ready for merge.${NC}"
+echo ""
+
+exit 0

package/templates/pi/scripts/validate-architecture-readiness.sh

@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# Architecture Readiness Validator
+#
+# Validates that the epic slice is architecturally complete before closing.
+# Checks: runbook, DR plan, docs update, canonical refs synced, observability.
+#
+# Usage: bash .pi/scripts/validate-architecture-readiness.sh
+#
+# Exit codes:
+#   0 — All readiness checks passed
+#   1 — One or more readiness checks failed
+
+set -euo pipefail
+
+PI_DIR=".pi"
+ARCH_DIR="${PI_DIR}/architecture"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+PASS=0
+FAIL=0
+
+log_pass() { echo -e "  ${GREEN}✓ PASS${NC} $1"; ((PASS++)); }
+log_fail() { echo -e "  ${RED}✗ FAIL${NC} $1 — $2"; ((FAIL++)); }
+log_skip() { echo -e "  ${YELLOW}⊘ SKIP${NC} $1 — $2"; ((PASS++)); }
+
+echo "═══ Architecture Readiness Checks ═══"
+echo ""
+
+# 1. Runbook readiness
+echo "Checking runbook readiness..."
+if [[ -f "docs/runbook.md" || -f "docs/RUNBOOK.md" || -f "RUNBOOK.md" ]]; then
+    # Check runbook has required sections
+    RUNBOOK=$(find . -name "runbook.md" -o -name "RUNBOOK.md" 2>/dev/null | head -1)
+    if grep -qiE "(incident|escalation|rollback|recovery|on.call)" "$RUNBOOK" 2>/dev/null; then
+        log_pass "Runbook readiness (runbook exists with incident/rollback sections)"
+    else
+        log_fail "Runbook readiness" "Runbook exists but missing incident/rollback sections"
+    fi
+else
+    log_fail "Architecture readiness" "No runbook.md found. Create docs/runbook.md with incident procedures."
+fi
+
+# 2. DR plan
+echo "Checking DR plan..."
+if [[ -f "docs/dr-plan.md" || -f "docs/disaster-recovery.md" || -f "docs/DR.md" ]]; then
+    DR_FILE=$(find . -name "dr-plan.md" -o -name "disaster-recovery.md" -o -name "DR.md" 2>/dev/null | head -1)
+    if grep -qiE "(rto|rpo|backup|restore|failover|recovery)" "$DR_FILE" 2>/dev/null; then
+        log_pass "DR plan readiness (DR plan exists with RTO/RPO sections)"
+    else
+        log_fail "DR plan readiness" "DR plan exists but missing RTO/RPO/recovery sections"
+    fi
+else
+    log_fail "Architecture readiness" "No dr-plan.md found. Create docs/dr-plan.md with RTO/RPO targets."
+fi
+
+# 3. Docs updated
+echo "Checking documentation sync..."
+if command -v git &>/dev/null; then
+    # Check if any architecture module was recently updated
+    recently_updated=false
+    if [[ -d "$ARCH_DIR/modules" ]]; then
+        for module_file in "${ARCH_DIR}"/modules/*.md; do
+            [[ -f "$module_file" ]] || continue
+            if git log -1 --since="1 day ago" -- "$module_file" 2>/dev/null | grep -q .; then
+                recently_updated=true
+                break
+            fi
+        done
+    fi
+    if [[ "$recently_updated" == "true" ]]; then
+        log_pass "Documentation sync (architecture docs recently updated)"
+    else
+        log_skip "Documentation sync" "Architecture docs not recently updated (may be fine for small slices)"
+    fi
+else
+    log_pass "Documentation sync (git not available, skipping)"
+fi
+
+# 4. Canonical refs synced
+echo "Checking canonical references..."
+if [[ -f "${PI_DIR}/scripts/validate-canonical.sh" ]]; then
+    if bash "${PI_DIR}/scripts/validate-canonical.sh" >/dev/null 2>&1; then
+        log_pass "Canonical references (validate-canonical.sh passed)"
+    else
+        log_fail "Canonical references" "validate-canonical.sh failed — some files lack canonical refs"
+    fi
+else
+    log_skip "Canonical references" "validate-canonical.sh not found"
+fi
+
+# 5. Observability readiness
+echo "Checking observability readiness..."
+HAS_TRACING=false
+HAS_METRICS=false
+HAS_LOGGING=false
+
+for f in $(find . -name "*.py" -o -name "*.ts" -o -name "*.rs" -o -name "*.go" 2>/dev/null | head -30); do
+    grep -qiE "(opentelemetry|jaeger|zipkin|tracing\.)" "$f" 2>/dev/null && HAS_TRACING=true
+    grep -qiE "(prometheus|datadog|metrics\.|counter|histogram)" "$f" 2>/dev/null && HAS_METRICS=true
+    grep -qiE "(structured.log|json.log|log\.info|log\.error|logger\.)" "$f" 2>/dev/null && HAS_LOGGING=true
+done
+
+if [[ "$HAS_TRACING" == "true" ]]; then
+    log_pass "Observability: tracing detected"
+else
+    log_skip "Observability: tracing" "No tracing framework detected"
+fi
+
+if [[ "$HAS_METRICS" == "true" ]]; then
+    log_pass "Observability: metrics detected"
+else
+    log_skip "Observability: metrics" "No metrics framework detected"
+fi
+
+if [[ "$HAS_LOGGING" == "true" ]]; then
+    log_pass "Observability: structured logging detected"
+else
+    log_skip "Observability: logging" "No structured logging detected"
+fi
+
+# 6. Architecture conformance (re-run to verify)
+echo "Re-running architecture conformance..."
+if [[ -f "${PI_DIR}/scripts/ci/check_architecture_conformance.sh" ]]; then
+    if bash "${PI_DIR}/scripts/ci/check_architecture_conformance.sh" >/dev/null 2>&1; then
+        log_pass "Architecture conformance (all checks pass)"
+    else
+        log_fail "Architecture conformance" "Some conformance checks failed — fix before closing epic"
+    fi
+else
+    log_skip "Architecture conformance" "check_architecture_conformance.sh not found"
+fi
+
+# ── Summary ──
+
+echo ""
+echo "═══ Architecture Readiness Summary ═══"
+echo -e "  ${GREEN}Pass: ${PASS}${NC}"
+echo -e "  ${RED}Fail: ${FAIL}${NC}"
+echo "  Total: $((PASS + FAIL))"
+
+if [[ $FAIL -gt 0 ]]; then
+    echo ""
+    echo -e "${RED}✗ Architecture readiness FAILED. Fix the issues above before closing the epic.${NC}"
+    exit 1
+fi
+
+echo ""
+echo -e "${GREEN}✓ Architecture readiness complete. Epic can be closed.${NC}"
+exit 0

package/templates/pi/scripts/validate-architecture.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# validate-architecture.sh — Dispatcher
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+detect_language() {
+    if [ -f "poetry.lock" ] || [ -f "pyproject.toml" ]; then echo "python"
+    elif [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "package.json" ]; then echo "typescript"
+    else echo "unknown"; fi
+}
+
+LANG=$(detect_language)
+LANG_SCRIPT="${SCRIPT_DIR}/languages/${LANG}/validate-architecture.sh"
+
+if [ -f "$LANG_SCRIPT" ]; then
+    exec bash "$LANG_SCRIPT" "$@"
+else
+    echo "No architecture validator for language: $LANG"
+    exit 0
+fi

package/templates/pi/scripts/validate-canonical.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# validate-canonical.sh — Dispatcher
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+detect_language() {
+    if [ -f "poetry.lock" ] || [ -f "pyproject.toml" ]; then echo "python"
+    elif [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "package.json" ]; then echo "typescript"
+    else echo "unknown"; fi
+}
+
+LANG=$(detect_language)
+LANG_SCRIPT="${SCRIPT_DIR}/languages/${LANG}/validate-canonical.sh"
+
+if [ -f "$LANG_SCRIPT" ]; then
+    exec bash "$LANG_SCRIPT" "$@"
+else
+    echo "No canonical validator for language: $LANG"
+    exit 0
+fi

package/templates/pi/scripts/validate-ci.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# ============================================================================
+# validate-ci.sh — Dispatcher
+#
+# Detects the project language and delegates to the language-specific script.
+# Language-specific scripts live in: .pi/scripts/languages/<lang>/validate-ci.sh
+# ============================================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+detect_language() {
+    if [ -f "poetry.lock" ]; then
+        echo "python"
+    elif [ -f "pyproject.toml" ]; then
+        echo "python"
+    elif [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then
+        echo "rust"
+    elif [ -f "go.mod" ]; then
+        echo "go"
+    elif [ -f "package.json" ]; then
+        echo "typescript"
+    else
+        echo "unknown"
+    fi
+}
+
+LANG=$(detect_language)
+LANG_SCRIPT="${SCRIPT_DIR}/languages/${LANG}/validate-ci.sh"
+
+if [ -f "$LANG_SCRIPT" ]; then
+    exec bash "$LANG_SCRIPT" "$@"
+else
+    echo "No CI validator for language: $LANG"
+    echo "Create: $LANG_SCRIPT"
+    exit 0
+fi

package/templates/pi/scripts/validate-integration.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# validate-integration.sh — Dispatcher
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+detect_language() {
+    if [ -f "poetry.lock" ] || [ -f "pyproject.toml" ]; then echo "python"
+    elif [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "package.json" ]; then echo "typescript"
+    else echo "unknown"; fi
+}
+
+LANG=$(detect_language)
+LANG_SCRIPT="${SCRIPT_DIR}/languages/${LANG}/validate-integration.sh"
+
+if [ -f "$LANG_SCRIPT" ]; then
+    exec bash "$LANG_SCRIPT" "$@"
+else
+    echo "No integration validator for language: $LANG"
+    exit 0
+fi

package/templates/pi/scripts/validate-operations.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# validate-operations.sh — Dispatcher
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+detect_language() {
+    if [ -f "poetry.lock" ] || [ -f "pyproject.toml" ]; then echo "python"
+    elif [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "package.json" ]; then echo "typescript"
+    else echo "unknown"; fi
+}
+
+LANG=$(detect_language)
+LANG_SCRIPT="${SCRIPT_DIR}/languages/${LANG}/validate-operations.sh"
+
+if [ -f "$LANG_SCRIPT" ]; then
+    exec bash "$LANG_SCRIPT" "$@"
+else
+    echo "No operations validator for language: $LANG"
+    exit 0
+fi

package/templates/pi/scripts/validate-security.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# validate-security.sh — Dispatcher
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+detect_language() {
+    if [ -f "poetry.lock" ] || [ -f "pyproject.toml" ]; then echo "python"
+    elif [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "package.json" ]; then echo "typescript"
+    else echo "unknown"; fi
+}
+
+LANG=$(detect_language)
+LANG_SCRIPT="${SCRIPT_DIR}/languages/${LANG}/validate-security.sh"
+
+if [ -f "$LANG_SCRIPT" ]; then
+    exec bash "$LANG_SCRIPT" "$@"
+else
+    echo "No security validator for language: $LANG"
+    exit 0
+fi

package/templates/pi/scripts/validate-tests.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# validate-tests.sh — Dispatcher
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+detect_language() {
+    if [ -f "poetry.lock" ] || [ -f "pyproject.toml" ]; then echo "python"
+    elif [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "package.json" ]; then echo "typescript"
+    else echo "unknown"; fi
+}
+
+LANG=$(detect_language)
+LANG_SCRIPT="${SCRIPT_DIR}/languages/${LANG}/validate-tests.sh"
+
+if [ -f "$LANG_SCRIPT" ]; then
+    exec bash "$LANG_SCRIPT" "$@"
+else
+    echo "No test validator for language: $LANG"
+    exit 0
+fi