guardian-framework 0.1.0

package/templates/pi/validators/default.toml

@@ -0,0 +1,209 @@
+# GuardianCLI Default TOML Validators
+#
+# Declarative validation rules with inline tests.
+# Pipeline stages: strip_ansi → replace → match_output → strip/keep_lines → truncate → head/tail → max_lines → on_empty
+#
+# Usage: guardian validate --filter <name>
+# Verify:  guardian validate --verify
+
+schema_version = 1
+
+# ── CI Validator ────────────────────────────────────────────────────────────
+
+[filters.ci-build]
+command = "build"
+description = "Filter build output to show errors and warnings only"
+strip_ansi = true
+keep_lines_matching = ["error", "warning", "Error", "Warning", "FAILED", "failed", "^Build failed"]
+max_lines = 50
+on_empty = "✅ Build passed with no errors or warnings"
+
+[[tests.ci-build]]
+name = "strips successful build noise"
+input = """
+Compiling my-project v0.1.0
+   Compiling serde v1.0.197
+   Compiling tokio v1.36.0
+    Finished dev [unoptimized + debuginfo] target(s) in 12.34s
+"""
+expected = "✅ Build passed with no errors or warnings"
+
+[[tests.ci-build]]
+name = "keeps errors"
+input = """
+Compiling my-project v0.1.0
+error[E0425]: cannot find function `foo` in this scope
+  --> src/main.rs:10:5
+   |
+10 |     foo();
+   |     ^^^ not found in this scope
+    Finished dev [unoptimized + debuginfo] target(s) in 0.50s
+"""
+expected = """
+error[E0425]: cannot find function `foo` in this scope
+  --> src/main.rs:10:5
+   |
+10 |     foo();
+   |     ^^^ not found in this scope
+"""
+
+# ── Test Validator ──────────────────────────────────────────────────────────
+
+[filters.test-results]
+command = "test"
+description = "Show only test failures, hide passing tests"
+strip_ansi = true
+keep_lines_matching = ["FAILED", "failed", "error", "panic", "Error", "AssertionError", "test.*FAILED", "✗", "×", "Summary:.*failed", "^Running.*test"]
+replace = [
+  { pattern = "^test (.+) \\.\\.\\. ok$", replacement = "" },
+  { pattern = "^\\s+$", replacement = "" }
+]
+max_lines = 100
+on_empty = "✅ All tests passed"
+
+[[tests.test-results]]
+name = "hides passing tests, shows failures"
+input = """
+running 15 tests
+test utils::test_parse ... ok
+test utils::test_format ... ok
+test auth::test_login ... FAILED
+test auth::test_logout ... ok
+test auth::test_refresh ... FAILED
+test db::test_connect ... ok
+
+failures:
+
+---- auth::test_login stdout ----
+thread 'auth::test_login' panicked at 'assertion failed'
+
+---- auth::test_refresh stdout ----
+thread 'auth::test_refresh' panicked at 'timeout'
+
+failures:
+    auth::test_login
+    auth::test_refresh
+
+test result: FAILED. 13 passed; 2 failed; 0 ignored
+"""
+expected = """
+test auth::test_login ... FAILED
+test auth::test_refresh ... FAILED
+
+failures:
+
+---- auth::test_login stdout ----
+thread 'auth::test_login' panicked at 'assertion failed'
+
+---- auth::test_refresh stdout ----
+thread 'auth::test_refresh' panicked at 'timeout'
+
+failures:
+    auth::test_login
+    auth::test_refresh
+
+test result: FAILED. 13 passed; 2 failed; 0 ignored
+"""
+
+# ── Security Validator ──────────────────────────────────────────────────────
+
+[filters.security-scan]
+command = "security"
+description = "Filter security scan output to show only findings"
+strip_ansi = true
+keep_lines_matching = ["CRITICAL", "HIGH", "MEDIUM", "vulnerability", "CVE-", "finding", "⚠", "failed", "FAILED"]
+max_lines = 80
+on_empty = "✅ No security issues found"
+
+[[tests.security-scan]]
+name = "shows only findings"
+input = """
+Scanning dependencies...
+Found 234 packages
+Checking for known vulnerabilities...
+
+CVE-2024-1234 [CRITICAL] lodash < 4.17.21
+  Prototype pollution in lodash
+  Fixed in: 4.17.21
+
+CVE-2024-5678 [HIGH] express < 4.18.2
+  Open redirect vulnerability
+  Fixed in: 4.18.2
+
+All other packages are up to date.
+Scan complete: 2 vulnerabilities found
+"""
+expected = """
+CVE-2024-1234 [CRITICAL] lodash < 4.17.21
+  Prototype pollution in lodash
+  Fixed in: 4.17.21
+
+CVE-2024-5678 [HIGH] express < 4.18.2
+  Open redirect vulnerability
+  Fixed in: 4.18.2
+
+Scan complete: 2 vulnerabilities found
+"""
+
+# ── Lint Validator ──────────────────────────────────────────────────────────
+
+[filters.lint-output]
+command = "lint"
+description = "Group lint issues by file and rule"
+strip_ansi = true
+replace = [
+  { pattern = "^\\s+$", replacement = "" }
+]
+keep_lines_matching = ["error", "warning", "Error", "Warning", "✗", ":", "found", "issue", "unused", "unused-import"]
+max_lines = 60
+on_empty = "✅ No lint issues found"
+
+# ── Architecture Validator ──────────────────────────────────────────────────
+
+[filters.architecture-check]
+command = "architecture"
+description = "Filter architecture validation output"
+strip_ansi = true
+keep_lines_matching = ["FAIL", "WARN", "VIOLATION", "missing", "error", "Error", "❌", "⚠"]
+max_lines = 40
+on_empty = "✅ Architecture validation passed"
+
+# ── Integration Validator ───────────────────────────────────────────────────
+
+[filters.integration-check]
+command = "integration"
+description = "Filter integration test output"
+strip_ansi = true
+keep_lines_matching = ["FAILED", "error", "timeout", "connection refused", "assertion", "panic", "Error", "failed"]
+max_lines = 80
+on_empty = "✅ All integration tests passed"
+
+# ── Git Status Validator ────────────────────────────────────────────────────
+
+[filters.git-status]
+command = "git-status"
+description = "Compact git status output"
+strip_ansi = true
+replace = [
+  { pattern = "^On branch (.+)$", replacement = "branch: $1" },
+  { pattern = "^nothing to commit, working tree clean$", replacement = "✅ clean" }
+]
+max_lines = 20
+
+# ── Docker Validator ────────────────────────────────────────────────────────
+
+[filters.docker-ps]
+command = "docker-ps"
+description = "Compact docker ps output"
+strip_ansi = true
+head_lines = 1
+truncate_lines_at = 120
+max_lines = 30
+
+# ── Ubiquitous Language Validator ────────────────────────────────────────────
+
+[filters.ubiquitous-language]
+command = "validate-ubiquitous-language"
+description = "Detect code drift from .pi/domain/ubiquitous-language.md glossary"
+strip_ansi = false
+keep_lines_matching = ["FAIL", "WARN", "Drift:", "alias", "canonical"]

package/templates/pi/validators/spring.toml

@@ -0,0 +1,142 @@
+# Guardian Spring Boot TOML Validators
+#
+# Declarative validation rules for Spring Boot convention enforcement.
+# Pipeline stages: strip_ansi → replace → match_output → strip/keep_lines → truncate → head/tail → max_lines → on_empty
+#
+# Package ring conventions (shared with validate-annotations.sh and validate-spring-architecture.sh):
+#   domain/ → zero external dependencies
+#   application/ → domain/ only
+#   infrastructure/ → domain/ + application/
+#   web/ → application/ only
+
+schema_version = 1
+
+# ── @Transactional Coverage ─────────────────────────────────────────────────
+
+[filters.transactional-coverage]
+command = "validate-annotations"
+description = "Detect @Service classes missing @Transactional on public methods"
+strip_ansi = true
+keep_lines_matching = ["Service class without @Transactional", "Missing @Transactional", "FAIL"]
+max_lines = 20
+on_empty = "✅ All @Service classes have @Transactional annotations"
+
+[[tests.transactional-coverage]]
+name = "passes when all services have @Transactional"
+input = """
+[PASS] All @Service classes have @Transactional annotations
+"""
+expected = "✅ All @Service classes have @Transactional annotations"
+
+[[tests.transactional-coverage]]
+name = "flags missing @Transactional"
+input = """
+[WARN] Service class without @Transactional: src/main/java/com/myapp/service/BadService.java (3 public methods, 0 @Transactional)
+"""
+expected = "src/main/java/com/myapp/service/BadService.java"
+
+# ── @PostConstruct Placement ────────────────────────────────────────────────
+
+[filters.postconstruct-placement]
+command = "validate-annotations"
+description = "Detect @PostConstruct in controller classes (should be in service/config/component)"
+strip_ansi = true
+keep_lines_matching = ["@PostConstruct found in controller", "FAIL"]
+max_lines = 10
+on_empty = "✅ No @PostConstruct in controller classes"
+
+[[tests.postconstruct-placement]]
+name = "passes when @PostConstruct is in valid packages"
+input = """
+[PASS] No @PostConstruct found in controller classes
+"""
+expected = "✅ No @PostConstruct in controller classes"
+
+[[tests.postconstruct-placement]]
+name = "flags @PostConstruct in controllers"
+input = """
+[FAIL] @PostConstruct found in controller: src/main/java/com/myapp/web/BadController.java
+"""
+expected = "BadController.java"
+
+# ── Field Injection Detection ──────────────────────────────────────────────
+
+[filters.field-injection]
+command = "validate-annotations"
+description = "Detect field-level @Autowired (prefer constructor injection)"
+strip_ansi = true
+keep_lines_matching = ["@Autowired", "field-level", "field injection", "WARN", "FAIL"]
+max_lines = 20
+on_empty = "✅ No field-level @Autowired found (constructor injection used)"
+
+[[tests.field-injection]]
+name = "passes with constructor injection"
+input = """
+[PASS] No field-level @Autowired found (constructor injection used)
+"""
+expected = "✅ No field-level @Autowired found (constructor injection used)"
+
+[[tests.field-injection]]
+name = "flags field injection"
+input = """
+[FAIL] Field-level @Autowired found (5 occurrences) — prefer constructor injection
+"""
+expected = "Field-level @Autowired found"
+
+# ── Layering: Web → Infrastructure ─────────────────────────────────────────
+
+[filters.layering-web-infrastructure]
+command = "validate-annotations"
+description = "Detect web layer importing repository/infrastructure directly"
+strip_ansi = true
+keep_lines_matching = ["imports repository/infrastructure", "imports infrastructure/repository", "FAIL"]
+max_lines = 20
+on_empty = "✅ Web layer has no direct repository imports (correct layering)"
+
+[[tests.layering-web-infrastructure]]
+name = "passes with clean layering"
+input = """
+[PASS] Web layer has no direct repository imports (correct layering)
+"""
+expected = "✅ Web layer has no direct repository imports (correct layering)"
+
+[[tests.layering-web-infrastructure]]
+name = "flags direct repository import"
+input = """
+[FAIL] Web layer imports repository/infrastructure directly: src/main/java/com/myapp/web/UserController.java
+"""
+expected = "UserController.java"
+
+# ── Domain Layer Purity ────────────────────────────────────────────────────
+
+[filters.domain-layer-purity]
+command = "validate-spring-architecture"
+description = "Ensure domain layer has no external dependencies (no imports from other layers)"
+strip_ansi = true
+keep_lines_matching = ["Domain layer import from", "Domain ring", "FAIL"]
+max_lines = 20
+on_empty = "✅ Domain ring has no external dependencies (clean)"
+
+[[tests.domain-layer-purity]]
+name = "passes with clean domain"
+input = """
+[PASS] Domain ring has no external dependencies (clean)
+"""
+expected = "✅ Domain ring has no external dependencies (clean)"
+
+# ── Application Layer Purity ───────────────────────────────────────────────
+
+[filters.application-layer-purity]
+command = "validate-spring-architecture"
+description = "Ensure application layer only imports from domain layer"
+strip_ansi = true
+keep_lines_matching = ["Application layer imports from", "imports.*infrastructure", "imports.*repository", "FAIL"]
+max_lines = 20
+on_empty = "✅ Application ring only depends on domain (clean)"
+
+[[tests.application-layer-purity]]
+name = "passes with clean application layer"
+input = """
+[PASS] Application ring only depends on domain (clean)
+"""
+expected = "✅ Application ring only depends on domain (clean)"

package/templates/pi/workpad.md

@@ -0,0 +1,53 @@
+# Workpad
+
+> **Purpose:** Persistent progress tracker for agent sessions. Updated in-place throughout execution.
+> **Pattern:** Single file per session/issue. Do not create duplicate workpads.
+
+## Context
+
+```text
+<hostname>:<abs-path>@<short-sha>
+```
+
+- **Issue:** [issue-id or session identifier]
+- **Scope:** [simple/moderate/complex/critical]
+- **Started:** [timestamp]
+
+## Plan
+
+- [ ] 1\. Parent task
+  - [ ] 1.1 Child task
+  - [ ] 1.2 Child task
+- [ ] 2\. Parent task
+
+## Acceptance Criteria
+
+- [ ] Criterion 1
+- [ ] Criterion 2
+- [ ] Criterion 3
+
+## Validation
+
+- [ ] Targeted test: `[command]`
+- [ ] Build: `[command]`
+- [ ] Lint: `[command]`
+
+## Architecture Review
+
+- [ ] ADRs reviewed: [list relevant ADRs]
+- [ ] Module boundaries respected
+- [ ] Cross-module dependencies documented
+
+## Notes
+
+- [Progress notes with timestamps]
+
+## Cross-Module Dependencies
+
+| Dependency | Module | Status | Notes |
+|-----------|--------|--------|-------|
+| [contract] | [name] | ✅ Ready / ⏳ Pending / ❌ Blocked | [details] |
+
+## Confusions
+
+- [Only include when something was confusing during execution]

package/templates/project/java/Dockerfile

@@ -0,0 +1,14 @@
+# Stage 1: Build with Maven
+FROM maven:3.9-eclipse-temurin-21 AS build
+WORKDIR /app
+COPY pom.xml .
+RUN mvn dependency:go-offline -q
+COPY src/ src/
+RUN mvn package -q -DskipTests
+
+# Stage 2: Run
+FROM eclipse-temurin:21-jre
+WORKDIR /app
+COPY --from=build /app/target/{{PROJECTNAME}}-*.jar app.jar
+EXPOSE 8080
+ENTRYPOINT ["java", "-jar", "app.jar"]

package/templates/project/java/README.md

@@ -0,0 +1,40 @@
+# {{PROJECTNAME}}
+
+> Generated by Guardian Framework
+> Language: Java (Spring Boot) | Build Tool: {{BUILD_TOOL}}
+
+## Modules
+
+{{#MODULES}}
+- {{.}}
+{{/MODULES}}
+
+## Architecture
+
+Clean Architecture with decomposed interface sub-layers:
+- `domain/` — Enterprise business rules
+- `application/` — Application business rules
+- `infrastructure/` — External concerns (DB, messaging, etc.)
+- `interfaces/http/` — REST endpoints, DTOs
+- `interfaces/messaging/` — Event publishers/subscribers
+
+## Getting Started
+
+```bash
+# Build
+{{BUILD_COMMAND}}
+
+# Test
+{{TEST_COMMAND}}
+
+# Run
+mvn spring-boot:run
+```
+
+## CI Pipeline
+
+This project uses Guardian's hardening pipeline. Run locally:
+
+```bash
+bash .pi/scripts/ci/run_hardening_stages.sh
+```

package/templates/project/java/pom.xml

@@ -0,0 +1,132 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>3.2.0</version>
+        <relativePath/>
+    </parent>
+
+    <groupId>{{GROUP}}</groupId>
+    <artifactId>{{PROJECTNAME}}</artifactId>
+    <version>{{VERSION}}</version>
+    <name>{{PROJECTNAME}}</name>
+    <description>Project generated by Guardian Framework</description>
+
+    <properties>
+        <java.version>21</java.version>
+    </properties>
+
+    <dependencies>
+        <!-- Web / REST -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+
+        <!-- Validation -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-validation</artifactId>
+        </dependency>
+
+        <!-- Actuator / Health checks -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
+
+        <!-- Messaging (if interfaces/messaging layer selected) -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-amqp</artifactId>
+        </dependency>
+
+        <!-- Database -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-data-jpa</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.postgresql</groupId>
+            <artifactId>postgresql</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+
+        <!-- Observability -->
+        <dependency>
+            <groupId>io.micrometer</groupId>
+            <artifactId>micrometer-tracing-bridge-brave</artifactId>
+        </dependency>
+
+        <!-- Test -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <!-- Test runner -->
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+            </plugin>
+
+            <!-- Coverage -->
+            <plugin>
+                <groupId>org.jacoco</groupId>
+                <artifactId>jacoco-maven-plugin</artifactId>
+                <version>0.8.11</version>
+                <executions>
+                    <execution>
+                        <goals><goal>prepare-agent</goal></goals>
+                    </execution>
+                    <execution>
+                        <id>report</id>
+                        <phase>verify</phase>
+                        <goals><goal>report</goal></goals>
+                    </execution>
+                </executions>
+            </plugin>
+
+            <!-- Lint -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-checkstyle-plugin</artifactId>
+                <version>3.3.1</version>
+                <configuration>
+                    <failOnViolation>true</failOnViolation>
+                </configuration>
+            </plugin>
+
+            <!-- Security audit -->
+            <plugin>
+                <groupId>org.owasp</groupId>
+                <artifactId>dependency-check-maven</artifactId>
+                <version>9.0.9</version>
+                <configuration>
+                    <failBuildOnCVSS>7</failBuildOnCVSS>
+                </configuration>
+            </plugin>
+
+            <!-- Format -->
+            <plugin>
+                <groupId>com.diffplug.spotless</groupId>
+                <artifactId>spotless-maven-plugin</artifactId>
+                <version>2.43.0</version>
+                <configuration>
+                    <java>
+                        <palantirJavaFormat/>
+                    </java>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>

package/templates/project/typescript/Dockerfile

@@ -0,0 +1,15 @@
+# Stage 1: Build
+FROM oven/bun:1 AS build
+WORKDIR /app
+COPY package.json bun.lock .
+RUN bun install --frozen-lockfile
+COPY . .
+RUN bun run build
+
+# Stage 2: Run
+FROM oven/bun:1-slim
+WORKDIR /app
+COPY --from=build /app/dist ./dist
+COPY --from=build /app/node_modules ./node_modules
+EXPOSE 3000
+ENTRYPOINT ["bun", "run", "./dist/index.js"]

package/templates/project/typescript/README.md

@@ -0,0 +1,29 @@
+# {{PROJECTNAME}}
+
+> Generated by Guardian Framework
+> Language: TypeScript (Bun)
+
+## Architecture
+
+Clean Architecture with decomposed interface sub-layers:
+- `domain/` — Enterprise business rules
+- `application/` — Application business rules
+- `infrastructure/` — External concerns (DB, APIs, etc.)
+- `interfaces/http/` — REST API routes (Hono)
+- `interfaces/graphql/` — GraphQL resolvers (Yoga)
+
+## Getting Started
+
+```bash
+# Install
+bun install
+
+# Dev
+bun run dev
+
+# Test
+bun test
+
+# Lint
+bun run lint
+```

package/templates/project/typescript/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "{{PROJECTNAME}}",
+  "version": "{{VERSION}}",
+  "type": "module",
+  "scripts": {
+    "build": "bun build ./src/index.ts --outdir ./dist",
+    "test": "bun test",
+    "lint": "biome check .",
+    "format": "biome format . --write",
+    "format:check": "biome format . --check",
+    "audit": "bun audit"
+  },
+  "dependencies": {
+    "hono": "^4.0.0",
+    "graphql-yoga": "^5.0.0",
+    "zod": "^3.22.0"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "vitest": "^1.0.0",
+    "@biomejs/biome": "^1.5.0"
+  }
+}

package/templates/project/typescript/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ES2022",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "exactOptionalPropertyTypes": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["node_modules", "dist"]
+}