guardian-framework 0.1.104 → 0.1.109

package/templates/pi/scripts/languages/java/check_model_judgment.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment_java.sh — ADR-008 Java model-judgment HARD GATES
+#
+# Deterministic, language-scoped checks (contract §5). Fuzzy smells (anemic
+# model, LSP base classes, Helper/Utils, primitive obsession) are NOT gated
+# here — they surface as architecture-validator review questions instead.
+#
+# Rules (stable ids):
+#   txn-placement        @Transactional outside the application layer
+#   dip-domain           domain/ imports jakarta/javax.persistence,
+#                        springframework or hibernate
+#   interface-ownership  (tactical modules) repository implementation in
+#                        infrastructure/ without a domain/-owned interface
+#   adapter-purity       (adapter modules) production java under domain/ or
+#                        application/ of a generic subdomain
+#
+# Usage:
+#   bash check_model_judgment_java.sh [--root <dir>]     (default: cwd)
+# Output: one 'file:line: [rule-id] message' per violation.
+# Exit:   0 all pass ; 1 violations found.
+# ============================================================================
+set -uo pipefail
+
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then
+    ROOT="$2"
+fi
+cd "$ROOT" || exit 1
+
+VIOLATIONS=0
+
+report() { # file line rule message
+    echo "$1:$2: [$3] $4"
+    VIOLATIONS=$((VIOLATIONS + 1))
+}
+
+is_prod_java() { # path
+    case "$1" in
+        */test/*|*/src/test/*) return 1 ;;
+        *Test.java|*Tests.java) return 1 ;;
+    esac
+    return 0
+}
+
+# ── Rule 2: DIP — domain imports framework types ─────────────────────────────
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    is_prod_java "$f" || continue
+    case "$f" in
+        */domain/*)
+            while IFS=: read -r ln rest; do
+                case "$rest" in
+                    *jakarta.persistence*|*javax.persistence*|*org.springframework*|*org.hibernate*)
+                        imp="$(echo "$rest" | sed 's/^[[:space:]]*import[[:space:]]*//; s/;//')"
+                        report "$f" "$ln" "dip-domain" "domain layer imports framework type: $imp"
+                        ;;
+                esac
+            done < <(grep -nE '^[[:space:]]*import[[:space:]]+' "$f" || true)
+            ;;
+    esac
+done < <(find src -type f -name "*.java" 2>/dev/null || true)
+
+# ── Rule 1: transactions only in the application layer ───────────────────────
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    is_prod_java "$f" || continue
+    case "$f" in
+        */application/*) continue ;;
+    esac
+    while IFS=: read -r ln rest; do
+        case "$rest" in
+            *@Transactional*)
+                report "$f" "$ln" "txn-placement" "@Transactional must live on application-layer services (transaction boundaries)"
+                ;;
+        esac
+    done < <(grep -nE '@Transactional' "$f" || true)
+done < <(find src -type f -name "*.java" 2>/dev/null || true)
+
+# ── Rules 3 & 4: module docs drive depth-aware checks ─────────────────────────
+if [ -d ".pi/architecture/modules" ]; then
+    for doc in .pi/architecture/modules/*.md; do
+        [ -f "$doc" ] || continue
+        doc_name="$(basename "$doc" .md)"
+        depth="$(grep -m1 '^\*\*Modeling Depth:\*\*' "$doc" | sed 's/.*\*\*Modeling Depth:\*\* *//' | cut -d' ' -f1 || true)"
+        docnorm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+
+        match_dir=""
+        while IFS= read -r d; do
+            [ -n "$d" ] || continue
+            norm="$(basename "$d" | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+            if [ "$norm" = "$docnorm" ]; then
+                match_dir="$d"
+                break
+            fi
+        done < <(find src -mindepth 1 -maxdepth 1 -type d 2>/dev/null || true)
+
+        [ -n "$match_dir" ] || continue
+
+        if [ "$depth" = "adapter" ]; then
+            # adapter-purity: no production java under domain/ or application/
+            for layer in domain application; do
+                while IFS= read -r f; do
+                    [ -n "$f" ] || continue
+                    is_prod_java "$f" || continue
+                    report "$f" "1" "adapter-purity" "generic subdomain '${doc_name}' must not contain ${layer}/ model code (ADR-008)"
+                done < <(find "$match_dir/$layer" -type f -name "*.java" 2>/dev/null || true)
+            done
+        elif [ "$depth" = "tactical" ]; then
+            # interface-ownership: infra repository implementations need a
+            # domain/-owned interface of the same simple name.
+            while IFS= read -r impl; do
+                [ -n "$impl" ] || continue
+                simple="$(basename "$impl")"
+                # Candidate interface names: as-is, Impl-suffix stripped, and
+                # common impl prefixes (Jpa/Jdbc/Hibernate/Spring) stripped.
+                candidates="$simple
+$(echo "$simple" | sed -E 's/Impl\.java$/.java/')
+$(echo "$simple" | sed -E 's/^(Jpa|Jdbc|Hibernate|Spring)([A-Z].*\.java)$/\2/')"
+                domain_iface=""
+                while IFS= read -r cand; do
+                    [ -n "$cand" ] || continue
+                    if [ -f "$match_dir/domain/$cand" ]; then
+                        domain_iface="$match_dir/domain/$cand"
+                        break
+                    fi
+                done <<< "$candidates"
+                if [ ! -f "$domain_iface" ]; then
+                    report "$impl" "1" "interface-ownership" "repository implementation without a domain/-owned interface (interface-ownership)"
+                fi
+            done < <(find "$match_dir/infrastructure" -type f -name "*Repository*.java" 2>/dev/null || true)
+        fi
+    done
+fi
+
+if [ "$VIOLATIONS" -gt 0 ]; then
+    echo "model-judgment: ${VIOLATIONS} violation(s) found" >&2
+    exit 1
+fi
+
+echo "model-judgment (java): all gates passed (txn-placement, dip-domain, interface-ownership, adapter-purity)"
+exit 0

package/templates/pi/scripts/languages/java/check_runtime_reachability.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_runtime_reachability.sh — Java (ADR-009)
+#
+# Every application-layer class under src/<module>/application/ must be
+# referenced from production code OUTSIDE its own module and OUTSIDE tests.
+# Java file == public class: the candidate is the file stem.
+# Usage: bash check_runtime_reachability.sh [--root <dir>]
+# Exit:  0 all reachable ; 1 dead service(s)
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+[ -d src ] || { echo "runtime-reachability (java): no src/"; exit 0; }
+
+while IFS= read -r svc; do
+    [ -n "$svc" ] || continue
+    mod="$(echo "$svc" | sed 's|^src/||; s|/application/.*||')"
+    stem="$(basename "$svc" .java)"
+    refs="$(grep -rl "\b${stem}\b" src 2>/dev/null | grep -vE "src/test/|/tests?/|Test[s]?\.java$" | grep -v "^src/${mod}/" | grep -v "^${svc}$" | grep -cv '^$' || true)"
+    if [ "${refs:-0}" -eq 0 ]; then
+        echo "$svc: [runtime-reachability] application service has no production caller outside its module (tests-only callers don't count — ADR-009)"
+        VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+done < <(find src -path "*/application/*.java" -type f 2>/dev/null | grep -vE "Test[s]?\.java$" || true)
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "runtime-wiring (java): ${VIOLATIONS} unwired service(s)" >&2; exit 1; fi
+echo "runtime-reachability (java): all application services reachable from production code"
+exit 0

package/templates/pi/scripts/languages/java/coverage.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# ============================================================================
+# coverage.sh — Java: real line coverage via JaCoCo (maven/gradle)
+#
+# Runs tests and the JaCoCo report, then parses the TOTAL line-coverage
+# percentage from the generated HTML report.
+#
+# Usage (normally via the .pi/scripts/coverage.sh dispatcher):
+#   bash coverage.sh            # measure coverage
+#   bash coverage.sh --gate     # fail if lines < COVERAGE_THRESHOLD
+#   bash coverage.sh --lcov     # keep the jacoco.xml report artifact
+#
+# Env:
+#   COVERAGE_THRESHOLD  minimum line-coverage % (default: 60)
+# ============================================================================
+set -uo pipefail
+
+COVERAGE_THRESHOLD="${COVERAGE_THRESHOLD:-60}"
+GATE=0
+LCOV=0
+
+for arg in "$@"; do
+    case "$arg" in
+        --gate) GATE=1 ;;
+        --lcov) LCOV=1 ;;
+        *) echo "unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+# Walk up from CWD to the project root (pom.xml / build.gradle[.kts]).
+ROOT="$(pwd)"
+while [ "$ROOT" != "/" ] \
+    && [ ! -f "$ROOT/pom.xml" ] \
+    && [ ! -f "$ROOT/build.gradle" ] \
+    && [ ! -f "$ROOT/build.gradle.kts" ]; do
+    ROOT="$(dirname "$ROOT")"
+done
+if [ ! -f "$ROOT/pom.xml" ] && [ ! -f "$ROOT/build.gradle" ] \
+    && [ ! -f "$ROOT/build.gradle.kts" ]; then
+    echo "✗ No Maven/Gradle build file found in this directory tree" >&2
+    exit 1
+fi
+cd "$ROOT" || exit 1
+
+REPORT_HTML=""
+COVERAGE=""
+
+echo "═══ Coverage (JaCoCo) ═══"
+if [ -f "pom.xml" ]; then
+    if ! grep -q "jacoco" pom.xml; then
+        echo "✗ JaCoCo not configured in pom.xml — add org.jacoco:jacoco-maven-plugin (with jacoco:report) to enable the coverage gate." >&2
+        exit 1
+    fi
+    if ! command -v mvn >/dev/null 2>&1; then
+        echo "✗ mvn not found on PATH" >&2
+        exit 1
+    fi
+    mvn test -q >/dev/null 2>&1 || true
+    mvn jacoco:report -q >/dev/null 2>&1 || true
+    REPORT_HTML="target/site/jacoco/index.html"
+    XML_ARTIFACT="target/site/jacoco/jacoco.xml"
+elif [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+    if ! grep -q "jacoco" build.gradle build.gradle.kts 2>/dev/null; then
+        echo "✗ JaCoCo not configured in the Gradle build — add the org.gradle.jacoco plugin to enable the coverage gate." >&2
+        exit 1
+    fi
+    if ! command -v gradle >/dev/null 2>&1; then
+        echo "✗ gradle not found on PATH" >&2
+        exit 1
+    fi
+    gradle test jacocoTestReport -q >/dev/null 2>&1 || true
+    REPORT_HTML="build/reports/jacoco/test/html/index.html"
+    XML_ARTIFACT="build/reports/jacoco/test/jacocoTestReport.xml"
+fi
+
+if [ -f "$REPORT_HTML" ]; then
+    COVERAGE="$(grep -oP 'Total.*?([0-9]+)%' "$REPORT_HTML" 2>/dev/null | grep -oP '[0-9]+' | head -1 || echo "")"
+fi
+echo ""
+echo "Line coverage: ${COVERAGE:-unavailable}% (threshold: ${COVERAGE_THRESHOLD}%)"
+
+if [ -z "$COVERAGE" ]; then
+    echo "✗ JaCoCo report not found / percentage not detected at ${REPORT_HTML}" >&2
+    exit 1
+fi
+
+if [ "$LCOV" -eq 1 ]; then
+    if [ -f "$XML_ARTIFACT" ]; then
+        echo "jacoco report artifact kept: $XML_ARTIFACT"
+    else
+        echo "⚠️  jacoco.xml artifact not found at ${XML_ARTIFACT}" >&2
+    fi
+fi
+
+if [ "$GATE" -eq 1 ]; then
+    if [ "$COVERAGE" -ge "$COVERAGE_THRESHOLD" ] 2>/dev/null; then
+        echo "✓ Coverage gate passed"
+    else
+        echo "✗ Coverage below threshold (${COVERAGE}% < ${COVERAGE_THRESHOLD}%)" >&2
+        exit 1
+    fi
+fi
+exit 0

package/templates/pi/scripts/languages/java/install_coverage_tools.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# ============================================================================
+# install_coverage_tools.sh — Java: JaCoCo is configured in the build, not
+# installed
+#
+# Enables/verifies the JaCoCo plugin for Maven or Gradle. The coverage gate
+# (.pi/scripts/languages/java/coverage.sh) reads its HTML/XML reports.
+# ============================================================================
+set -euo pipefail
+
+if [ -f "pom.xml" ]; then
+    if grep -q "jacoco" pom.xml; then
+        echo "JaCoCo already configured in pom.xml."
+    else
+        echo "Adding org.jacoco:jacoco-maven-plugin to pom.xml requires an edit — add to <build><plugins>:"
+        cat <<'EOF'
+  <plugin>
+    <groupId>org.jacoco</groupId>
+    <artifactId>jacoco-maven-plugin</artifactId>
+    <version>0.8.12</version>
+    <executions><execution><goals><goal>prepare-agent</goal><goal>report</goal></goals></execution></executions>
+  </plugin>
+EOF
+        echo "✗ Not editing pom.xml automatically — apply the snippet above, then re-run." >&2
+        exit 1
+    fi
+elif [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+    if grep -q "jacoco" build.gradle build.gradle.kts 2>/dev/null; then
+        echo "JaCoCo already configured in the Gradle build."
+    else
+        echo "Add to build.gradle:  apply plugin: 'jacoco'   (then: gradle jacocoTestReport)" >&2
+        echo "✗ Not editing the Gradle build automatically — apply the plugin, then re-run." >&2
+        exit 1
+    fi
+else
+    echo "✗ No Maven/Gradle build file found" >&2
+    exit 1
+fi
+
+echo "JaCoCo coverage tooling ready."

package/templates/pi/scripts/languages/java/validate-architecture.sh

@@ -137,6 +137,26 @@ else
 fi
 
 # ---------------------------------------------------------------------------
+
+# ---------------------------------------------------------------------------
+# ADR-008 model-judgment hard gates (contract §5)
+# ---------------------------------------------------------------------------
+MJ_SCRIPT="$(dirname "$0")/check_model_judgment.sh"
+echo ""
+echo "--- Model Judgment (ADR-008) ---"
+if [ -f "$MJ_SCRIPT" ]; then
+    MJ_OUT="$(bash "$MJ_SCRIPT" --root "$(pwd)" 2>&1)" && MJ_EXIT=0 || MJ_EXIT=1
+    if [ "$MJ_EXIT" -eq 0 ]; then
+        pass "model-judgment hard gates (txn-placement, dip-domain, interface-ownership, adapter-purity)"
+    else
+        while IFS= read -r mj_line; do
+            [ -n "$mj_line" ] && fail "$mj_line"
+        done <<< "$MJ_OUT"
+    fi
+else
+    warn "check_model_judgment.sh not found — model-judgment gates skipped"
+fi
+
 # Summary
 # ---------------------------------------------------------------------------
 echo ""

package/templates/pi/scripts/languages/python/check_model_judgment.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment.sh — Python (ADR-008/009)
+# Deterministic hard gates:
+#   dip-domain           domain/ imports sqlalchemy/django/fastapi
+#   txn-placement        session.commit/transaction outside application/
+#   interface-ownership  (tactical) infra adapters without a domain Protocol/ABC
+#   adapter-purity       (adapter modules) model code in generic subdomains
+# Usage: bash check_model_judgment.sh [--root <dir>]
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+report() { echo "$1:$2: [$3] $4"; VIOLATIONS=$((VIOLATIONS + 1)); }
+[ -d src ] || { echo "model-judgment (python): no src/"; exit 0; }
+
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    case "$f" in */domain/*)
+        while IFS=: read -r ln rest; do
+            case "$rest" in
+                *sqlalchemy*|*django*|*fastapi*|*flask*|*peewee*|*tortoise*)
+                    report "$f" "$ln" "dip-domain" "domain imports framework/ORM: $rest" ;;
+            esac
+        done < <(grep -nE "^\s*(import|from) " "$f" || true) ;;
+    esac
+    case "$f" in */application/*) ;; *)
+        if grep -qE "\.session\.(commit|begin)|\.commit\(\)|begin_nested|\.atomic" "$f" 2>/dev/null; then
+            report "$f" "1" "txn-placement" "transaction/session handling outside application layer"
+        fi ;;
+    esac
+done < <(find src -type f -name "*.py" 2>/dev/null | grep -vE "/tests?/|test_.*\.py$|_test\.py$" || true)
+
+if [ -d ".pi/architecture/modules" ]; then
+    for doc in .pi/architecture/modules/*.md; do
+        [ -f "$doc" ] || continue
+        doc_name="$(basename "$doc" .md)"
+        depth="$(grep -m1 '^\*\*Modeling Depth:\*\*' "$doc" | sed 's/.*\*\*Modeling Depth:\*\* *//' | cut -d' ' -f1 || true)"
+        docnorm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+        match_dir=""
+        while IFS= read -r d; do
+            norm="$(basename "$d" | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+            if [ "$norm" = "$docnorm" ]; then match_dir="$d"; break; fi
+        done < <(find src -mindepth 1 -maxdepth 1 -type d 2>/dev/null || true)
+        [ -n "$match_dir" ] || continue
+        if [ "$depth" = "adapter" ]; then
+            for layer in domain application; do
+                while IFS= read -r f; do [ -n "$f" ] || continue; report "$f" "1" "adapter-purity" "generic subdomain '${doc_name}' must not contain ${layer}/ model code (ADR-008)"; done < <(find "$match_dir/$layer" -type f -name "*.py" 2>/dev/null || true)
+            done
+        elif [ "$depth" = "tactical" ]; then
+            while IFS= read -r impl; do
+                [ -n "$impl" ] || continue
+                simple="$(basename "$impl" .py)"
+                stem="$(echo "$simple" | sed -E 's/_impl$//;s/Impl$//')"
+                if ! grep -rqiE "class ${stem}|class ${simple}|Protocol|ABC" "$match_dir/domain" 2>/dev/null; then
+                    report "$impl" "1" "interface-ownership" "adapter without a domain/-owned Protocol/ABC (${simple})"
+                fi
+            done < <(find "$match_dir/infrastructure" -type f -name "*.py" 2>/dev/null || true)
+        fi
+    done
+fi
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "model-judgment (python): ${VIOLATIONS} violation(s)" >&2; exit 1; fi
+echo "model-judgment (python): all gates passed (dip-domain, txn-placement, interface-ownership, adapter-purity)"
+exit 0

package/templates/pi/scripts/languages/python/check_runtime_reachability.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_runtime_reachability.sh — Python (ADR-009)
+#
+# Every module under src/<module>/application/ must be referenced from
+# production code OUTSIDE its own module and OUTSIDE tests. Candidates: the
+# file stem, its PascalCase class name, and the separator-stripped form
+# (case-insensitive).
+# Usage: bash check_runtime_reachability.sh [--root <dir>]
+# Exit:  0 all reachable ; 1 dead service(s)
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+[ -d src ] || { echo "runtime-reachability (python): no src/"; exit 0; }
+
+while IFS= read -r svc; do
+    [ -n "$svc" ] || continue
+    mod="$(echo "$svc" | sed 's|^src/||; s|/application/.*||')"
+    stem="$(basename "$svc" .py)"
+    pascal="$(echo "$stem" | python3 -c 'import sys; s=sys.stdin.read().strip(); print("".join(w.capitalize() for w in s.replace("-","_").split("_")))' 2>/dev/null || echo "$stem")"
+    compact="$(echo "$stem" | tr -d '_-')"
+    refs="$(grep -rliE "\b(${pascal}|${stem}|${compact})\b" src 2>/dev/null | grep -vE "/tests?/|test_.*\.py$|_test\.py$|/test/" | grep -v "^src/${mod}/" | grep -v "^${svc}$" | grep -cv '^$' || true)"
+    if [ "${refs:-0}" -eq 0 ]; then
+        echo "$svc: [runtime-reachability] application service has no production caller outside its module (tests-only callers don't count — ADR-009)"
+        VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+done < <(find src -path "*/application/*.py" -type f 2>/dev/null | grep -vE "/tests?/|test_.*\.py$|_test\.py$" || true)
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "runtime-wiring (python): ${VIOLATIONS} unwired service(s)" >&2; exit 1; fi
+echo "runtime-reachability (python): all application services reachable from production code"
+exit 0

package/templates/pi/scripts/languages/python/coverage.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# ============================================================================
+# coverage.sh — Python: real line coverage via coverage.py
+#
+# Runs the test suite under coverage.py and reports the TOTAL line coverage.
+# Uses pytest when available, unittest otherwise.
+#
+# Usage (normally via the .pi/scripts/coverage.sh dispatcher):
+#   bash coverage.sh            # measure coverage
+#   bash coverage.sh --gate     # fail if lines < COVERAGE_THRESHOLD
+#   bash coverage.sh --lcov     # also write coverage.xml (cobertura) artifact
+#
+# Env:
+#   COVERAGE_THRESHOLD  minimum line-coverage % (default: 60)
+# ============================================================================
+set -uo pipefail
+
+COVERAGE_THRESHOLD="${COVERAGE_THRESHOLD:-60}"
+GATE=0
+LCOV=0
+
+for arg in "$@"; do
+    case "$arg" in
+        --gate) GATE=1 ;;
+        --lcov) LCOV=1 ;;
+        *) echo "unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+# Walk up from CWD to the project root (pyproject.toml / setup.py /
+# setup.cfg / requirements.txt).
+ROOT="$(pwd)"
+while [ "$ROOT" != "/" ] \
+    && [ ! -f "$ROOT/pyproject.toml" ] \
+    && [ ! -f "$ROOT/setup.py" ] \
+    && [ ! -f "$ROOT/setup.cfg" ] \
+    && [ ! -f "$ROOT/requirements.txt" ]; do
+    ROOT="$(dirname "$ROOT")"
+done
+if [ ! -f "$ROOT/pyproject.toml" ] && [ ! -f "$ROOT/setup.py" ] \
+    && [ ! -f "$ROOT/setup.cfg" ] && [ ! -f "$ROOT/requirements.txt" ]; then
+    echo "✗ No Python project marker found in this directory tree" >&2
+    exit 1
+fi
+cd "$ROOT" || exit 1
+
+if ! python3 -m coverage --version >/dev/null 2>&1; then
+    echo "coverage.py not found — run .pi/scripts/install_coverage_tools.sh" >&2
+    exit 1
+fi
+
+echo "═══ Coverage (coverage.py) ═══"
+# Scope measurement to the project source (src/ layout when present, else
+# the project root) so site-packages / pytest internals are not counted.
+COV_SOURCE="src"
+[ -d "src" ] || COV_SOURCE="."
+if python3 -m pytest --version >/dev/null 2>&1; then
+    python3 -m coverage run --source="$COV_SOURCE" -m pytest -q >/dev/null 2>&1 || true
+else
+    python3 -m coverage run --source="$COV_SOURCE" -m unittest discover -s tests >/dev/null 2>&1 || true
+fi
+
+REPORT="$(python3 -m coverage report 2>&1 || true)"
+echo "$REPORT" | tail -20
+COVERAGE="$(echo "$REPORT" | awk '/^TOTAL/{print $NF}' | tr -d '%')"
+echo ""
+echo "Line coverage: ${COVERAGE:-unavailable}% (threshold: ${COVERAGE_THRESHOLD}%)"
+
+if [ -z "$COVERAGE" ]; then
+    echo "✗ Could not extract TOTAL coverage from coverage.py output" >&2
+    exit 1
+fi
+
+if [ "$LCOV" -eq 1 ]; then
+    python3 -m coverage xml -o coverage.xml >/dev/null 2>&1 \
+        && echo "cobertura artifact written: coverage.xml" \
+        || echo "⚠️  could not write coverage.xml" >&2
+fi
+
+if [ "$GATE" -eq 1 ]; then
+    if awk "BEGIN { exit !($COVERAGE >= $COVERAGE_THRESHOLD) }"; then
+        echo "✓ Coverage gate passed"
+    else
+        echo "✗ Coverage below threshold (${COVERAGE}% < ${COVERAGE_THRESHOLD}%)" >&2
+        exit 1
+    fi
+fi
+exit 0

package/templates/pi/scripts/languages/python/install_coverage_tools.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# ============================================================================
+# install_coverage_tools.sh — Python: install coverage.py (+ pytest)
+#
+# Installs the real coverage tooling used by
+# .pi/scripts/languages/python/coverage.sh.
+# ============================================================================
+set -euo pipefail
+
+if python3 -m coverage --version >/dev/null 2>&1; then
+    echo "coverage.py already installed: $(python3 -m coverage --version | head -1)"
+else
+    echo "Installing coverage.py..."
+    python3 -m pip install coverage
+fi
+
+if ! python3 -m pytest --version >/dev/null 2>&1; then
+    echo "Installing pytest (optional, for test discovery)..."
+    python3 -m pip install pytest || true
+fi
+
+echo "coverage tooling ready."

package/templates/pi/scripts/languages/rust/check_model_judgment.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment.sh — Rust (ADR-008/009)
+# Deterministic hard gates:
+#   dip-domain           domain/ (crate/module) imports sqlx/diesel/web frameworks
+#   interface-ownership  (tactical) infra impl without a domain/-owned trait
+#   adapter-purity       (adapter modules) model code in generic subdomains
+# Usage: bash check_model_judgment.sh [--root <dir>]
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+report() { echo "$1:$2: [$3] $4"; VIOLATIONS=$((VIOLATIONS + 1)); }
+[ -d src ] || { echo "model-judgment (rust): no src/"; exit 0; }
+
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    case "$f" in */domain/*)
+        while IFS=: read -r ln rest; do
+            case "$rest" in
+                *sqlx*|*diesel*|*sea_orm*|*axum*|*actix*|*tokio-postgres*|*mongodb*|*redis*)
+                    report "$f" "$ln" "dip-domain" "domain imports framework/persistence crate: $(echo "$rest" | sed 's/^use //; s/;.*//')" ;;
+            esac
+        done < <(grep -nE "^use |^extern crate " "$f" || true) ;;
+    esac
+done < <(find src -type f -name "*.rs" 2>/dev/null | grep -vE "_test\.rs$|/tests?/" || true)
+
+if [ -d ".pi/architecture/modules" ]; then
+    for doc in .pi/architecture/modules/*.md; do
+        [ -f "$doc" ] || continue
+        doc_name="$(basename "$doc" .md)"
+        depth="$(grep -m1 '^\*\*Modeling Depth:\*\*' "$doc" | sed 's/.*\*\*Modeling Depth:\*\* *//' | cut -d' ' -f1 || true)"
+        docnorm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+        match_dir=""
+        while IFS= read -r d; do
+            norm="$(basename "$d" | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+            if [ "$norm" = "$docnorm" ]; then match_dir="$d"; break; fi
+        done < <(find src -mindepth 1 -maxdepth 1 -type d 2>/dev/null || true)
+        [ -n "$match_dir" ] || continue
+        if [ "$depth" = "adapter" ]; then
+            for layer in domain application; do
+                while IFS= read -r f; do [ -n "$f" ] || continue; report "$f" "1" "adapter-purity" "generic subdomain '${doc_name}' must not contain ${layer}/ model code (ADR-008)"; done < <(find "$match_dir/$layer" -type f -name "*.rs" 2>/dev/null || true)
+            done
+        elif [ "$depth" = "tactical" ]; then
+            while IFS= read -r impl; do
+                [ -n "$impl" ] || continue
+                simple="$(basename "$impl" .rs)"
+                stem="$(echo "$simple" | sed -E 's/_impl$//')"
+                if ! grep -rqiE "(pub )?trait ${stem}\\b|trait ${simple}\\b|${stem}" "$match_dir/domain" 2>/dev/null; then
+                    report "$impl" "1" "interface-ownership" "repository/adapter impl without a domain/-owned trait (${simple})"
+                fi
+            done < <(find "$match_dir/infrastructure" -type f \( -name "*repository*.rs" -o -name "*repo*.rs" -o -name "*gateway*.rs" \) 2>/dev/null || true)
+        fi
+    done
+fi
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "model-judgment (rust): ${VIOLATIONS} violation(s)" >&2; exit 1; fi
+echo "model-judgment (rust): all gates passed (dip-domain, interface-ownership, adapter-purity)"
+exit 0