guardian-framework 0.1.104 → 0.1.109

package/templates/pi/extensions/read-only-mode.ts

@@ -25,6 +25,8 @@ import {
 const COMMAND_NAME = "read-only";
 const STATUS_KEY = "read-only-mode";
 const WIDGET_KEY = "read-only-mode";
+let readOnlyActive = false;
+
 const READ_ONLY_TOOL_NAMES = ["read", "grep", "find", "ls"] as const;
 
 function getReadOnlyToolNames(pi: ExtensionAPI): string[] {
@@ -95,6 +97,7 @@ export default function (pi: ExtensionAPI) {
 	});
 
 	function enable(ctx: ExtensionContext): void {
+	readOnlyActive = true;
 		if (enabled) {
 			updateUi(pi, ctx, enabled);
 			ctx.ui.notify("Read-only mode is already enabled.", "info");
@@ -111,6 +114,7 @@ export default function (pi: ExtensionAPI) {
 	}
 
 	function disable(ctx: ExtensionContext): void {
+	readOnlyActive = false;
 		if (!enabled) {
 			updateUi(pi, ctx, enabled);
 			ctx.ui.notify("Read-only mode is already disabled.", "info");
@@ -130,7 +134,7 @@ export default function (pi: ExtensionAPI) {
 			switch (action) {
 				case "":
 				case "toggle":
-					toggle(ctx);
+					if (readOnlyActive) disable(ctx); else enable(ctx);
 					return;
 				case "on":
 				case "enable":

package/templates/pi/extensions/tsconfig.json

@@ -1,7 +1,11 @@
 {
 	"compilerOptions": {
-		"types": ["bun-types"],
+		"types": [
+			"bun-types"
+		],
 		"strict": true,
+		"noImplicitAny": false,
+		"strictNullChecks": false,
 		"target": "ES2022",
 		"module": "ESNext",
 		"moduleResolution": "bundler",
@@ -11,5 +15,8 @@
 		"isolatedModules": true,
 		"allowImportingTsExtensions": true
 	},
-	"include": ["**/*.ts"]
+	"include": [
+		"**/*.ts",
+		"**/*.d.ts"
+	]
 }

package/templates/pi/preflight_report.json

@@ -1,5 +1,5 @@
 {
-  "timestamp": "2026-07-20T15:54:07Z",
+  "timestamp": "2026-09-04T13:00:27Z",
   "mode": "all",
   "stages_run": [],
   "summary": {

package/templates/pi/prompts/ci-blueprint.md

@@ -72,7 +72,7 @@ Language-specific linting.
 | `unit_application` | `pytest tests/unit/application` | No |
 | `unit_contract` | `pytest tests/contract` | No |
 | `unit_verification` | `pytest tests/verification` | No |
-| `coverage_threshold_check` | `.pi/scripts/ci/check_coverage_thresholds.py` | No |
+| `coverage_gate` | `bash .pi/scripts/install_coverage_tools.sh && bash .pi/scripts/coverage.sh --gate --lcov` | No |
 
 ## Stage 6: Integration
 
@@ -119,7 +119,7 @@ Language-specific linting.
 | Rule | Jobs Using It |
 |------|---------------|
 | `rules_default` (MRs or main branch) | Most jobs |
-| `rules_sonar` (requires `$SONAR_TOKEN` + `$SONAR_HOST_URL`) | coverage_report, sonar_quality_gate |
+| `rules_sonar` (requires `$SONAR_TOKEN` + `$SONAR_HOST_URL`) | coverage_gate (uploads lcov artifact), sonar_quality_gate |
 | `rules_main_only` | `package_build` |
 | `rules_migration_changes` (migration file changes only) | `migration_verify` stage |
 

package/templates/pi/scripts/check_model_judgment.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment.sh — ADR-008/009 dispatcher
+# Runs the language-scoped model-judgment hard gates (dip-domain,
+# interface-ownership, adapter-purity, transaction placement per language).
+# Usage: bash .pi/scripts/check_model_judgment.sh [--root <dir>]
+# ============================================================================
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+
+detect_language() {
+    if [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "package.json" ]; then echo "typescript"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then echo "python"
+    elif [ -f "pom.xml" ] || [ -f "build.gradle" ]; then echo "java"
+    else echo "unknown"; fi
+}
+LANG="$(detect_language)"
+SCRIPT="${SCRIPT_DIR}/languages/${LANG}/check_model_judgment.sh"
+if [ -f "$SCRIPT" ]; then
+    exec bash "$SCRIPT" --root "$ROOT"
+fi
+echo "model-judgment: no gate script for language '${LANG}'"
+exit 0

package/templates/pi/scripts/ci/check_judgment_contracts.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_judgment_contracts.sh — proofing for ADR-008 P1 (judgment-aware
+# modeling). Deterministic proof that each frozen contract (§1–§7 of
+# .pi/architecture/contracts/judgment-aware-modeling-p1.md) is implemented
+# in the framework sources.
+#
+# Checks:
+#   1. exploration prompt emits ADR-008 schema markers (src)
+#   2. validate-exploration-depth.sh exists + executable
+#   3. java model-judgment gate exists + executable
+#   4. module-doc scaffold emits 'Modeling Depth' header (src)
+#   5. java-spring codegen skill carries 'Judgment Tables (ADR-008)'
+#   6. architecture-validator skill carries Model Judgment Review R1-R4
+#   7. modeling contracts: ModuleComponent type carries the ADR-008 fields
+#   8. exploration.md template carries the Modeling Judgment section
+#
+# Exit 0 = all contracts proven; 1 = at least one missing.
+# ============================================================================
+set -uo pipefail
+
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+
+FAILED=0
+PASSED=0
+
+check() { # label, file-or-dir, grep pattern
+    local label="$1" path="$2" pattern="$3"
+    if [ -n "$path" ] && [ -e "$path" ] && grep -qE "$pattern" "$path" 2>/dev/null; then
+        echo "  PASS: $label"
+        PASSED=$((PASSED + 1))
+    else
+        echo "  FAIL: $label (missing: $path / $pattern)" >&2
+        FAILED=$((FAILED + 1))
+    fi
+}
+
+check_file() { # label file
+    if [ -f "$2" ] && [ -x "$2" ]; then
+        echo "  PASS: $1"
+        PASSED=$((PASSED + 1))
+    else
+        echo "  FAIL: $1 (not found/executable: $2)" >&2
+        FAILED=$((FAILED + 1))
+    fi
+}
+
+echo "Judgment contracts proofing (ADR-008 P1)"
+echo "----------------------------------------"
+
+# 1. exploration prompt schema markers
+check "exploration prompt: subdomainType/invariants/triage/contextMap/conflicts" \
+    "src/lib/domain-explorer.ts" 'subdomainType|"invariants"|"triage"|"contextMap"|"conflicts"'
+
+# 2. depth validator present + executable
+check_file "validate-exploration-depth.sh executable" ".pi/scripts/validate-exploration-depth.sh"
+check_file "validate-exploration-depth.sh (templates copy)" "templates/pi/scripts/validate-exploration-depth.sh"
+
+# 3. java model-judgment gate present + executable
+check_file "java model-judgment gate" ".pi/scripts/languages/java/check_model_judgment.sh"
+check_file "java model-judgment gate (templates copy)" "templates/pi/scripts/languages/java/check_model_judgment.sh"
+
+# 4. scaffold emits Modeling Depth header + invariants + depth note
+check "scaffold: Modeling Depth header" "src/lib/domain-explorer.ts" 'Modeling Depth'
+check "scaffold: depth note for service/adapter" "src/lib/domain-explorer.ts" 'Modeling Depth Note \(ADR-008\)'
+
+# 5. java-spring codegen skill: judgment tables
+check "java-spring skill: Judgment Tables (ADR-008)" \
+    ".pi/skills/java-spring-enterprise-codegen.md" 'Judgment Tables \(ADR-008\)'
+
+# 6. architecture-validator skill: R1-R4 review questions
+check "architecture-validator skill: Model Judgment Review" \
+    ".pi/skills/agents/architecture-validator.md" 'Model Judgment Review'
+
+# 7. ModuleComponent modeling-contract fields
+check "architect-lib types: modelingDepth/aggregateRoot/invariants/events" \
+    ".pi/extensions/architect-lib/types.ts" 'modelingDepth|aggregateRoot|invariants|publishes'
+check "generators: Modeling Contract emission" \
+    ".pi/extensions/architect-lib/generators.ts" 'Modeling Contract \(ADR-008\)'
+
+# 8. exploration.md template: Modeling Judgment section
+check "exploration.md template: Modeling Judgment section" \
+    "templates/pi/domain/exploration.md" 'Modeling Judgment \(ADR-008\)'
+
+echo ""
+echo "  Passed: $PASSED   Failed: $FAILED"
+if [ "$FAILED" -gt 0 ]; then
+    exit 1
+fi
+echo "All judgment contracts proven."
+exit 0

package/templates/pi/scripts/ci/run_preflight.sh

@@ -255,10 +255,10 @@ run_stage_lint() {
                     log_fail "biome check" "lint errors found" "$(( $(date +%s) - t ))"
                 fi
                 t=$(date +%s)
-                if biome format --check . >/dev/null 2>&1; then
-                    log_pass "biome format --check" "$(( $(date +%s) - t ))"
+                if biome ci . >/dev/null 2>&1; then
+                    log_pass "biome ci" "$(( $(date +%s) - t ))"
                 else
-                    log_fail "biome format --check" "format errors found" "$(( $(date +%s) - t ))"
+                    log_fail "biome ci" "format errors found" "$(( $(date +%s) - t ))"
                 fi
             else
                 log_skip "biome" "not installed"

package/templates/pi/scripts/ci/run_stage.sh

@@ -76,7 +76,7 @@ case "$STAGE" in
             ruff check . && ruff format --check .
         elif [[ -f "package.json" ]]; then
             echo "TypeScript project detected"
-            biome check . && biome format --check .
+            biome check . && biome ci .
         elif [[ -f "Cargo.toml" ]]; then
             echo "Rust project detected"
             cargo clippy -- -D warnings && cargo fmt --check

package/templates/pi/scripts/ci/stage_lint.sh

@@ -72,7 +72,7 @@ case "$LANG" in
             else
                 log_fail "biome lint" "Lint errors found"
             fi
-            if biome format . --check 2>/dev/null; then
+            if biome ci . 2>/dev/null; then
                 log_pass "biome format check"
             else
                 log_fail "biome format check" "Format errors found"

package/templates/pi/scripts/coverage.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# ============================================================================
+# coverage.sh — Real project coverage measurement + gate (dispatcher)
+#
+# Runs the project's REAL coverage tool for the detected language and reports
+# line coverage. This is the honest replacement for the old per-module
+# heuristic `*_coverage.sh` checks (coverage-theater — they counted test
+# functions via grep, never a real percentage).
+#
+# Delegates to languages/<lang>/coverage.sh. Real coverage tool per language:
+#   rust        — cargo llvm-cov (workspace line coverage, lcov artifact)
+#   python      — coverage.py (pytest/unittest)
+#   typescript  — vitest / jest / bun test --coverage (istanbul text)
+#   go          — go test -coverprofile + go tool cover
+#   java        — JaCoCo (maven/gradle)
+#
+# Usage:
+#   bash .pi/scripts/coverage.sh            # measure + print summary
+#   bash .pi/scripts/coverage.sh --gate     # exit 1 if lines < COVERAGE_THRESHOLD
+#   bash .pi/scripts/coverage.sh --lcov     # also emit the tool's report artifact
+#
+# Env:
+#   COVERAGE_THRESHOLD  minimum line-coverage % (default: 60 — a conservative
+#                       floor; set it to the threshold your CI actually enforces)
+#
+# Exit codes:
+#   0 — measured and (with --gate) meets threshold, or language not applicable
+#   1 — coverage tool missing / below threshold / could not measure (honest
+#       fail — never fake-pass)
+#   2 — unknown argument
+# ============================================================================
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+detect_language() {
+    if [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "poetry.lock" ] || [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then echo "python"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "package.json" ]; then echo "typescript"
+    elif [ -f "pom.xml" ] || [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then echo "java"
+    else echo "unknown"; fi
+}
+
+LANG="$(detect_language)"
+
+if [ "$LANG" = "unknown" ]; then
+    echo "⚠️  No project language detected — no real coverage gate applies." >&2
+    exit 0
+fi
+
+LANG_SCRIPT="${SCRIPT_DIR}/languages/${LANG}/coverage.sh"
+if [ ! -f "$LANG_SCRIPT" ]; then
+    echo "⚠️  No coverage gate script for '${LANG}' yet (${LANG_SCRIPT})." >&2
+    exit 0
+fi
+
+exec bash "$LANG_SCRIPT" "$@"

package/templates/pi/scripts/install_coverage_tools.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# ============================================================================
+# install_coverage_tools.sh — Install the project's real coverage tooling
+# (dispatcher)
+#
+# Delegates to languages/<lang>/install_coverage_tools.sh based on the
+# detected language. Run this before `.pi/scripts/coverage.sh --gate` in CI
+# or on a fresh checkout.
+#
+# Usage:
+#   bash .pi/scripts/install_coverage_tools.sh
+#
+# Exit codes:
+#   0 — tooling available / installed / not required
+#   1 — install failed
+# ============================================================================
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+detect_language() {
+    if [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "poetry.lock" ] || [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then echo "python"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "package.json" ]; then echo "typescript"
+    elif [ -f "pom.xml" ] || [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then echo "java"
+    else echo "unknown"; fi
+}
+
+LANG="$(detect_language)"
+
+if [ "$LANG" = "unknown" ]; then
+    echo "⚠️  No project language detected — nothing to install." >&2
+    exit 0
+fi
+
+LANG_SCRIPT="${SCRIPT_DIR}/languages/${LANG}/install_coverage_tools.sh"
+if [ ! -f "$LANG_SCRIPT" ]; then
+    echo "⚠️  No coverage installer for '${LANG}' yet (${LANG_SCRIPT})." >&2
+    exit 0
+fi
+
+exec bash "$LANG_SCRIPT" "$@"

package/templates/pi/scripts/languages/go/check_model_judgment.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment.sh — Go (ADR-008/009)
+# Deterministic hard gates:
+#   dip-domain           domain/ imports gorm/sqlx/gin/echo
+#   txn-placement        sql.Tx / BeginTx outside application/
+#   interface-ownership  (tactical) infra adapters without a domain interface
+#   adapter-purity       (adapter modules) model code in generic subdomains
+# Usage: bash check_model_judgment.sh [--root <dir>]
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+report() { echo "$1:$2: [$3] $4"; VIOLATIONS=$((VIOLATIONS + 1)); }
+[ -d src ] || { echo "model-judgment (go): no src/"; exit 0; }
+
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    case "$f" in */domain/*)
+        while IFS=: read -r ln rest; do
+            case "$rest" in
+                *gorm.io*|*database/sql*|*sqlx*|*gin-gonic*|*labstack*|*uptrace/bun*)
+                    report "$f" "$ln" "dip-domain" "domain imports persistence/web framework: $rest" ;;
+            esac
+        done < <(grep -nE '^\s*("|_ "|import )' "$f" | grep -E 'gorm|sqlx|database/sql|gin-gonic|labstack|bun' || true) ;;
+    esac
+    case "$f" in */application/*) ;; *)
+        if grep -qE "sql\.Tx|BeginTx|\.Commit\(\)" "$f" 2>/dev/null; then
+            report "$f" "1" "txn-placement" "transaction handling outside application layer"
+        fi ;;
+    esac
+done < <(find src -type f -name "*.go" 2>/dev/null | grep -vE "_test\.go$|/tests?/" || true)
+
+if [ -d ".pi/architecture/modules" ]; then
+    for doc in .pi/architecture/modules/*.md; do
+        [ -f "$doc" ] || continue
+        doc_name="$(basename "$doc" .md)"
+        depth="$(grep -m1 '^\*\*Modeling Depth:\*\*' "$doc" | sed 's/.*\*\*Modeling Depth:\*\* *//' | cut -d' ' -f1 || true)"
+        docnorm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+        match_dir=""
+        while IFS= read -r d; do
+            norm="$(basename "$d" | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+            if [ "$norm" = "$docnorm" ]; then match_dir="$d"; break; fi
+        done < <(find src -mindepth 1 -maxdepth 1 -type d 2>/dev/null || true)
+        [ -n "$match_dir" ] || continue
+        if [ "$depth" = "adapter" ]; then
+            for layer in domain application; do
+                while IFS= read -r f; do [ -n "$f" ] || continue; report "$f" "1" "adapter-purity" "generic subdomain '${doc_name}' must not contain ${layer}/ model code (ADR-008)"; done < <(find "$match_dir/$layer" -type f -name "*.go" 2>/dev/null || true)
+            done
+        elif [ "$depth" = "tactical" ]; then
+            while IFS= read -r impl; do
+                [ -n "$impl" ] || continue
+                simple="$(basename "$impl" .go)"
+                stem="$(echo "$simple" | sed -E 's/Impl$//;s/impl$//')"
+                if ! grep -rqiE "type ${stem} interface|type ${simple} interface|${stem}" "$match_dir/domain" 2>/dev/null; then
+                    compact="$(printf '%s' "$simple" | tr -d '_-')"
+                    if [ -z "$compact" ] || ! grep -rqil "$compact" "$match_dir/domain" 2>/dev/null; then
+                        report "$impl" "1" "interface-ownership" "adapter without a domain/-owned interface (${simple})"
+                    fi
+                fi
+            done < <(find "$match_dir/infrastructure" -type f -name "*.go" 2>/dev/null || true)
+        fi
+    done
+fi
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "model-judgment (go): ${VIOLATIONS} violation(s)" >&2; exit 1; fi
+echo "model-judgment (go): all gates passed (dip-domain, txn-placement, interface-ownership, adapter-purity)"
+exit 0

package/templates/pi/scripts/languages/go/check_runtime_reachability.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_runtime_reachability.sh — Go (ADR-009)
+#
+# Every service file under src/<module>/application/ must be referenced from
+# production code OUTSIDE its own module and OUTSIDE tests. Candidates: the
+# file stem (snake), its PascalCase type name, and the separator-stripped
+# form (case-insensitive).
+# Usage: bash check_runtime_reachability.sh [--root <dir>]
+# Exit:  0 all reachable ; 1 dead service(s)
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+[ -d src ] || { echo "runtime-reachability (go): no src/"; exit 0; }
+
+while IFS= read -r svc; do
+    [ -n "$svc" ] || continue
+    mod="$(echo "$svc" | sed 's|^src/||; s|/application/.*||')"
+    stem="$(basename "$svc" .go)"
+    pascal="$(echo "$stem" | python3 -c 'import sys; s=sys.stdin.read().strip(); print("".join(w.capitalize() for w in s.split("_")) if s else "")' 2>/dev/null || echo "$stem")"
+    compact="$(echo "$stem" | tr -d '_-')"
+    refs="$(grep -rliE "\b(${pascal}|${stem}|${compact})\b" src 2>/dev/null | grep -vE "_test\.go$|/tests?/|/test/" | grep -v "^src/${mod}/" | grep -v "^${svc}$" | grep -cv '^$' || true)"
+    if [ "${refs:-0}" -eq 0 ]; then
+        echo "$svc: [runtime-reachability] application service has no production caller outside its module (tests-only callers don't count — ADR-009)"
+        VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+done < <(find src -path "*/application/*.go" -type f 2>/dev/null | grep -vE "_test\.go$" || true)
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "runtime-wiring (go): ${VIOLATIONS} unwired service(s)" >&2; exit 1; fi
+echo "runtime-reachability (go): all application services reachable from production code"
+exit 0

package/templates/pi/scripts/languages/go/coverage.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# ============================================================================
+# coverage.sh — Go: real line coverage via `go test -coverprofile`
+#
+# Runs the full test suite with a coverage profile and reports total line
+# coverage from `go tool cover -func`.
+#
+# Usage (normally via the .pi/scripts/coverage.sh dispatcher):
+#   bash coverage.sh            # measure coverage
+#   bash coverage.sh --gate     # fail if lines < COVERAGE_THRESHOLD
+#   bash coverage.sh --lcov     # keep coverage.out profile artifact
+#
+# Env:
+#   COVERAGE_THRESHOLD  minimum line-coverage % (default: 60)
+# ============================================================================
+set -uo pipefail
+
+COVERAGE_THRESHOLD="${COVERAGE_THRESHOLD:-60}"
+GATE=0
+LCOV=0
+
+for arg in "$@"; do
+    case "$arg" in
+        --gate) GATE=1 ;;
+        --lcov) LCOV=1 ;;
+        *) echo "unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+# Walk up from CWD to the module root (go.mod).
+ROOT="$(pwd)"
+while [ "$ROOT" != "/" ] && [ ! -f "$ROOT/go.mod" ]; do
+    ROOT="$(dirname "$ROOT")"
+done
+if [ ! -f "$ROOT/go.mod" ]; then
+    echo "✗ No go.mod found in this directory tree" >&2
+    exit 1
+fi
+cd "$ROOT" || exit 1
+
+if ! command -v go >/dev/null 2>&1; then
+    echo "✗ go toolchain not found on PATH" >&2
+    exit 1
+fi
+
+echo "═══ Coverage (go test -coverprofile) ═══"
+go test -coverprofile=coverage.out ./... 2>&1 | tail -10
+
+if [ ! -f "coverage.out" ]; then
+    echo "✗ No coverage profile generated (go test -coverprofile failed)" >&2
+    exit 1
+fi
+
+FUNC_OUT="$(go tool cover -func=coverage.out 2>/dev/null || true)"
+COVERAGE="$(echo "$FUNC_OUT" | awk '/^total:/{print $NF}' | tr -d '%')"
+echo ""
+echo "Line coverage: ${COVERAGE:-unavailable}% (threshold: ${COVERAGE_THRESHOLD}%)"
+
+if [ -z "$COVERAGE" ]; then
+    echo "✗ Could not extract total coverage from coverage profile" >&2
+    exit 1
+fi
+
+if [ "$LCOV" -eq 1 ]; then
+    echo "coverage profile artifact kept: coverage.out"
+else
+    rm -f coverage.out
+fi
+
+if [ "$GATE" -eq 1 ]; then
+    if awk "BEGIN { exit !($COVERAGE >= $COVERAGE_THRESHOLD) }"; then
+        echo "✓ Coverage gate passed"
+    else
+        echo "✗ Coverage below threshold (${COVERAGE}% < ${COVERAGE_THRESHOLD}%)" >&2
+        exit 1
+    fi
+fi
+exit 0

package/templates/pi/scripts/languages/go/install_coverage_tools.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# ============================================================================
+# install_coverage_tools.sh — Go: no extra install required
+#
+# `go test -coverprofile` is built into the Go toolchain. This script exists
+# so the language dispatcher is uniform; it only verifies the toolchain is
+# present.
+# ============================================================================
+set -euo pipefail
+
+if command -v go >/dev/null 2>&1; then
+    echo "Go coverage tooling is built-in (go version $(go version | awk '{print $3}'))."
+    exit 0
+fi
+
+echo "✗ go toolchain not found — install Go (https://go.dev/dl/) to use the coverage gate." >&2
+exit 1