guardian-framework 0.1.104 → 0.1.109

package/templates/pi/scripts/languages/rust/check_runtime_reachability.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_runtime_reachability.sh — Rust (ADR-009)
+#
+# Every service struct under src/<module>/application/ must be referenced from
+# production code outside its own module and outside tests (tests dirs,
+# *_test.rs, and #[cfg(test)] units inside the same file do not count — we
+# require a reference from a different production file outside the module).
+#
+# Usage: bash check_runtime_reachability.sh [--root <dir>]
+# Exit:  0 all reachable ; 1 dead service(s)
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+
+VIOLATIONS=0
+[ -d src ] || { echo "runtime-reachability (rust): no src/"; exit 0; }
+
+while IFS= read -r svc; do
+    [ -n "$svc" ] || continue
+    mod="$(echo "$svc" | sed 's|^src/||; s|/application/.*||')"
+    stem="$(basename "$svc" .rs)"
+    # candidate type names: file stem in PascalCase and snake_case both
+    pascal="$(echo "$stem" | python3 -c 'import sys; s=sys.stdin.read().strip(); print("".join(w.capitalize() for w in s.split("_")) if s else "")' 2>/dev/null || echo "$stem")"
+    # production references: outside the module, excluding tests
+    refs="$(grep -rlE "\b(${pascal}|${stem})\b" src 2>/dev/null | grep -vE "/tests?/|_test\.rs$|/test/" | grep -v "^src/${mod}/" | grep -v "^${svc}$" | grep -cv '^$' || true)"
+    if [ "${refs:-0}" -eq 0 ]; then
+        echo "$svc: [runtime-reachability] application service has no production caller outside its module (tests-only callers don't count — ADR-009)"
+        VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+done < <(find src -path "*/application/*.rs" -type f 2>/dev/null || true)
+
+if [ "$VIOLATIONS" -gt 0 ]; then
+    echo "runtime-wiring (rust): ${VIOLATIONS} unwired service(s)" >&2
+    exit 1
+fi
+echo "runtime-reachability (rust): all application services reachable from production code"
+exit 0

package/templates/pi/scripts/languages/rust/coverage.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# ============================================================================
+# coverage.sh — Rust: real line coverage via cargo-llvm-cov
+#
+# cargo-llvm-cov uses native LLVM instrumentation and works with incremental
+# compilation — ~3x faster than cargo-tarpaulin's full instrumented
+# recompilation. Produces the REAL workspace line-coverage number.
+#
+# Usage (normally via the .pi/scripts/coverage.sh dispatcher):
+#   bash coverage.sh            # measure workspace coverage
+#   bash coverage.sh --gate     # fail if lines < COVERAGE_THRESHOLD
+#   bash coverage.sh --lcov     # also write target/coverage.lcov artifact
+#
+# Env:
+#   COVERAGE_THRESHOLD  minimum line-coverage % (default: 60)
+# ============================================================================
+set -uo pipefail
+
+COVERAGE_THRESHOLD="${COVERAGE_THRESHOLD:-60}"
+GATE=0
+LCOV=0
+
+for arg in "$@"; do
+    case "$arg" in
+        --gate) GATE=1 ;;
+        --lcov) LCOV=1 ;;
+        *) echo "unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+# Walk up from CWD to the crate/workspace root (Cargo.toml).
+ROOT="$(pwd)"
+while [ "$ROOT" != "/" ] && [ ! -f "$ROOT/Cargo.toml" ]; do
+    ROOT="$(dirname "$ROOT")"
+done
+if [ ! -f "$ROOT/Cargo.toml" ]; then
+    echo "✗ No Cargo.toml found in this directory tree" >&2
+    exit 1
+fi
+cd "$ROOT" || exit 1
+
+if ! command -v cargo-llvm-cov >/dev/null 2>&1; then
+    echo "cargo-llvm-cov not found — run .pi/scripts/install_coverage_tools.sh" >&2
+    exit 1
+fi
+
+echo "═══ Workspace coverage (cargo llvm-cov) ═══"
+# --summary-only always prints the table we parse. When --lcov is also
+# requested, write the lcov artifact in a second (instrumentation-cached,
+# fast) pass — the tool suppresses the console summary in lcov-output mode.
+SUMMARY="$(cargo llvm-cov --workspace --summary-only)"
+if [ "$LCOV" -eq 1 ]; then
+    mkdir -p target
+    cargo llvm-cov --workspace --lcov --output-path target/coverage.lcov >/dev/null 2>&1 \
+        && echo "lcov artifact written: target/coverage.lcov" \
+        || echo "⚠️  could not write target/coverage.lcov" >&2
+fi
+
+# Print the per-file table + TOTAL row (summary tail), then extract the
+# TOTAL line-coverage percentage from the final line.
+echo "$SUMMARY" | tail -12
+COVERAGE="$(echo "$SUMMARY" | tail -1 | grep -oE '[0-9]+\.[0-9]+%' | head -1 | sed 's/%//')"
+echo ""
+echo "Line coverage: ${COVERAGE:-unavailable}% (threshold: ${COVERAGE_THRESHOLD}%)"
+
+if [ -z "$COVERAGE" ]; then
+    echo "✗ Could not extract coverage from cargo llvm-cov output" >&2
+    exit 1
+fi
+
+if [ "$GATE" -eq 1 ]; then
+    if awk "BEGIN { exit !($COVERAGE >= $COVERAGE_THRESHOLD) }"; then
+        echo "✓ Coverage gate passed"
+    else
+        echo "✗ Coverage below threshold (${COVERAGE}% < ${COVERAGE_THRESHOLD}%)" >&2
+        exit 1
+    fi
+fi
+exit 0

package/templates/pi/scripts/languages/rust/install_coverage_tools.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# ============================================================================
+# install_coverage_tools.sh — Rust: install cargo-llvm-cov
+#
+# cargo-llvm-cov needs the llvm-tools-preview rustup component. It is the
+# real coverage tool used by .pi/scripts/languages/rust/coverage.sh.
+# ============================================================================
+set -euo pipefail
+
+rustup component add llvm-tools-preview || echo "llvm-tools-preview unavailable on this toolchain"
+
+if command -v cargo-llvm-cov >/dev/null 2>&1; then
+    echo "cargo-llvm-cov already installed: $(cargo-llvm-cov --version)"
+    exit 0
+fi
+
+echo "Installing cargo-llvm-cov..."
+cargo install cargo-llvm-cov --locked
+
+echo "cargo-llvm-cov installed: $(cargo-llvm-cov --version)"

package/templates/pi/scripts/languages/rust/validate-tests.sh

@@ -97,13 +97,14 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# Coverage
+# Coverage (uses cargo-llvm-cov — native LLVM instrumentation, ~3x faster than tarpaulin)
 # ---------------------------------------------------------------------------
 echo ""
 echo "--- Coverage ---"
-if command -v cargo &>/dev/null && cargo tarpaulin --version &>/dev/null; then
-    TARP_OUT=$(cargo tarpaulin --out Html 2>&1 || true)
-    COVERAGE_PCT=$(echo "$TARP_OUT" | grep -oE '[0-9]+(\.[0-9]+)?%' | head -1 | tr -d '%' || echo "")
+if command -v cargo &>/dev/null && cargo llvm-cov --version &>/dev/null; then
+    LLCV_OUT=$(cargo llvm-cov --html --fail-under-lines 80 2>&1 || true)
+    LLCV_EXIT=$?
+    COVERAGE_PCT=$(echo "$LLCV_OUT" | grep -oE '[0-9]+(\.[0-9]+)?%' | head -1 | tr -d '%' || echo "")
     if [ -n "$COVERAGE_PCT" ]; then
         # Compare coverage against 80% threshold using awk
         MEETS_THRESHOLD=$(echo "$COVERAGE_PCT" | awk '{print ($1 >= 80) ? "yes" : "no"}')
@@ -112,8 +113,10 @@ if command -v cargo &>/dev/null && cargo tarpaulin --version &>/dev/null; then
         else
             fail "Code coverage: ${COVERAGE_PCT}% (< 80%)"
         fi
+    elif [ "$LLCV_EXIT" -eq 0 ]; then
+        pass "Code coverage meets 80% threshold"
     else
-        warn "Could not extract coverage percentage from tarpaulin output"
+        warn "Could not extract coverage percentage from llvm-cov output"
     fi
 elif command -v grcov &>/dev/null; then
     # Use grcov as fallback
@@ -124,7 +127,7 @@ elif command -v grcov &>/dev/null; then
         pass "grcov coverage report generated"
     fi
 else
-    warn "No coverage tools available (cargo-tarpaulin / grcov), skipping coverage check"
+    warn "No coverage tools available (cargo-llvm-cov / grcov), skipping coverage check"
 fi
 
 # ---------------------------------------------------------------------------

package/templates/pi/scripts/languages/typescript/check_model_judgment.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment.sh — TypeScript (ADR-008/009)
+# Deterministic hard gates, mirrors the Java four:
+#   dip-domain           domain/ imports framework/persistence types
+#   txn-placement        transaction/UnitOfWork boundaries outside application/
+#   interface-ownership  (tactical) infra adapters without a domain/-owned interface
+#   adapter-purity       (adapter modules) model code in generic subdomains
+# Usage: bash check_model_judgment.sh [--root <dir>]
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+
+VIOLATIONS=0
+report() { echo "$1:$2: [$3] $4"; VIOLATIONS=$((VIOLATIONS + 1)); }
+
+[ -d src ] || { echo "model-judgment (ts): no src/"; exit 0; }
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    case "$f" in */*test*/|*.test.ts|*.spec.ts) continue ;; esac
+    # dip-domain
+    case "$f" in */domain/*)
+        while IFS=: read -r ln rest; do
+            case "$rest" in
+                *typeorm*|*prisma*|*@nestjs*|*express*|*sequelize*)
+                    report "$f" "$ln" "dip-domain" "domain imports framework: $(echo "$rest" | sed 's/^import //; s/;//')" ;;
+            esac
+        done < <(grep -nE "^import |require\\(" "$f" || true) ;;
+    esac
+    # txn-placement: transaction/UnitOfWork usage outside application/
+    case "$f" in */application/*) ;; *)
+        if grep -qE "transaction|unitOfWork|beginTransaction|\.manager\.(save|transaction)" "$f" 2>/dev/null; then
+            report "$f" "1" "txn-placement" "transaction/UnitOfWork logic outside application layer"
+        fi ;;
+    esac
+done < <(find src -type f -name "*.ts" 2>/dev/null || true)
+
+# module-doc depth rules (same layout as Java)
+if [ -d ".pi/architecture/modules" ]; then
+    for doc in .pi/architecture/modules/*.md; do
+        [ -f "$doc" ] || continue
+        doc_name="$(basename "$doc" .md)"
+        depth="$(grep -m1 '^\*\*Modeling Depth:\*\*' "$doc" | sed 's/.*\*\*Modeling Depth:\*\* *//' | cut -d' ' -f1 || true)"
+        docnorm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+        match_dir=""
+        while IFS= read -r d; do
+            norm="$(basename "$d" | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+            if [ "$norm" = "$docnorm" ]; then match_dir="$d"; break; fi
+        done < <(find src -mindepth 1 -maxdepth 1 -type d 2>/dev/null || true)
+        [ -n "$match_dir" ] || continue
+        if [ "$depth" = "adapter" ]; then
+            for layer in domain application; do
+                while IFS= read -r f; do [ -n "$f" ] || continue; report "$f" "1" "adapter-purity" "generic subdomain '${doc_name}' must not contain ${layer}/ model code (ADR-008)"; done < <(find "$match_dir/$layer" -type f -name "*.ts" 2>/dev/null || true)
+            done
+        elif [ "$depth" = "tactical" ]; then
+            while IFS= read -r impl; do
+                [ -n "$impl" ] || continue
+                simple="$(basename "$impl" .ts)"
+                cands="$simple
+$(echo "$simple" | sed -E 's/Impl$//')"
+                found=""
+                while IFS= read -r cand; do
+                    [ -n "$cand" ] || continue
+                    if grep -rqiE "interface ${cand}\\b|abstract class ${cand}\\b|${cand}" "$match_dir/domain" 2>/dev/null; then found=1; break; fi
+                done <<< "$cands"
+                # separator-stripped fallback: invoice-repository <-> InvoiceRepository
+                if [ -z "$found" ]; then
+                    compact="$(printf '%s' "$simple" | tr -d '_-')"
+                    if [ -n "$compact" ] && grep -rqil "$compact" "$match_dir/domain" 2>/dev/null; then found=1; fi
+                fi
+                if [ -z "$found" ]; then report "$impl" "1" "interface-ownership" "adapter without a domain/-owned interface (${simple})"; fi
+            done < <(find "$match_dir/infrastructure" -type f \( -iname "*repository*.ts" -o -iname "*gateway*.ts" -o -iname "*service*.ts" \) 2>/dev/null || true)
+        fi
+    done
+fi
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "model-judgment (ts): ${VIOLATIONS} violation(s)" >&2; exit 1; fi
+echo "model-judgment (ts): all gates passed (dip-domain, txn-placement, interface-ownership, adapter-purity)"
+exit 0

package/templates/pi/scripts/languages/typescript/check_runtime_reachability.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_runtime_reachability.sh — TypeScript (ADR-009)
+#
+# Every service file under src/<module>/application/ must be referenced from
+# production code outside its own module and outside tests. References inside
+# the service's own module or in *.test.ts / __tests__ do not count.
+#
+# Usage: bash check_runtime_reachability.sh [--root <dir>]
+# Exit:  0 all reachable ; 1 dead service(s)
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+
+VIOLATIONS=0
+[ -d src ] || { echo "runtime-reachability (ts): no src/"; exit 0; }
+
+while IFS= read -r svc; do
+    [ -n "$svc" ] || continue
+    case "$svc" in
+        */*test*/|*.test.ts|*.spec.ts) continue ;;
+    esac
+    mod="$(echo "$svc" | sed 's|^src/||; s|/application/.*||')"
+    name="$(basename "$svc" .ts)"
+    # production references: whole src, excluding tests and the service's own module
+    refs="$(grep -rl "\b${name}\b" src 2>/dev/null | grep -vE "/__tests__/|\.(test|spec)\.ts$|/tests?/|^src/${mod}/" | grep -v "^src/${mod}/" | grep -cv '^$' || true)"
+    # also drop the file itself from any residual (own-module exclusion above already does)
+    if [ "${refs:-0}" -eq 0 ]; then
+        echo "$svc: [runtime-reachability] application service has no production caller outside its module (tests-only callers don't count — ADR-009)"
+        VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+done < <(find src -path "*/application/*.ts" -type f 2>/dev/null || true)
+
+if [ "$VIOLATIONS" -gt 0 ]; then
+    echo "runtime-wiring (ts): ${VIOLATIONS} unwired service(s)" >&2
+    exit 1
+fi
+echo "runtime-reachability (ts): all application services reachable from production code"
+exit 0

package/templates/pi/scripts/languages/typescript/coverage.sh

@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# ============================================================================
+# coverage.sh — TypeScript/JavaScript: real line coverage via the project's
+# coverage-enabled test runner
+#
+# Runs the test suite with coverage enabled, using the first runner that is
+# actually installed: vitest → jest → bun test --coverage → c8. All of them
+# emit a text table with an "All files" summary row; the "% Lines" column is
+# parsed from it (header-driven — istanbul-style tables have 5 percentage
+# columns, bun's has 2). No heuristic grep counting.
+#
+# Usage (normally via the .pi/scripts/coverage.sh dispatcher):
+#   bash coverage.sh            # measure coverage
+#   bash coverage.sh --gate     # fail if lines < COVERAGE_THRESHOLD
+#   bash coverage.sh --lcov     # report an existing lcov artifact, if any
+#
+# Env:
+#   COVERAGE_THRESHOLD  minimum line-coverage % (default: 60)
+# ============================================================================
+set -uo pipefail
+
+COVERAGE_THRESHOLD="${COVERAGE_THRESHOLD:-60}"
+GATE=0
+LCOV=0
+
+for arg in "$@"; do
+    case "$arg" in
+        --gate) GATE=1 ;;
+        --lcov) LCOV=1 ;;
+        *) echo "unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+# Walk up from CWD to the project root (package.json).
+ROOT="$(pwd)"
+while [ "$ROOT" != "/" ] && [ ! -f "$ROOT/package.json" ]; do
+    ROOT="$(dirname "$ROOT")"
+done
+if [ ! -f "$ROOT/package.json" ]; then
+    echo "✗ No package.json found in this directory tree" >&2
+    exit 1
+fi
+cd "$ROOT" || exit 1
+
+OUT_FILE="$(mktemp)"
+trap 'rm -f "$OUT_FILE"' EXIT
+
+run_and_capture() {
+    # shellcheck disable=SC2015
+    "$@" >"$OUT_FILE" 2>&1 || true
+}
+
+echo "═══ Coverage (real test-runner coverage) ═══"
+RUN=""
+if [ -x "node_modules/.bin/vitest" ]; then
+    echo "  runner: vitest"
+    run_and_capture node_modules/.bin/vitest run --coverage
+    RUN="vitest"
+elif command -v vitest >/dev/null 2>&1; then
+    echo "  runner: vitest (PATH)"
+    run_and_capture vitest run --coverage
+    RUN="vitest"
+elif [ -x "node_modules/.bin/jest" ]; then
+    echo "  runner: jest"
+    run_and_capture node_modules/.bin/jest --coverage
+    RUN="jest"
+elif command -v jest >/dev/null 2>&1; then
+    echo "  runner: jest (PATH)"
+    run_and_capture jest --coverage
+    RUN="jest"
+elif command -v bun >/dev/null 2>&1; then
+    echo "  runner: bun test --coverage"
+    run_and_capture bun test --coverage
+    RUN="bun"
+elif [ -x "node_modules/.bin/c8" ]; then
+    # c8 (istanbul) wraps the project's own test command.
+    echo "  runner: c8 (npm test)"
+    run_and_capture node_modules/.bin/c8 --reporter=text npm test
+    RUN="c8"
+else
+    echo "✗ No coverage-enabled test runner found (vitest/jest/bun/c8)" >&2
+    echo "  run .pi/scripts/install_coverage_tools.sh for guidance" >&2
+    exit 1
+fi
+
+# Parse the "% Lines" column of the "All files" row from the runner's text
+# table. Header-driven: locate the "% Lines" column in the header row, then
+# read it from the "All files" summary row (istanbul-style tables list
+# % Stmts, % Branch, % Funcs, % Lines; bun lists % Funcs, % Lines).
+COVERAGE="$(python3 - "$OUT_FILE" <<'PY'
+import sys, re
+with open(sys.argv[1], encoding="utf-8", errors="replace") as fh:
+    lines = [ln.strip() for ln in fh]
+
+header = next((ln for ln in lines if ln.startswith("File") and "%" in ln), None)
+allrow = next((ln for ln in lines if ln.startswith("All files")), None)
+if not header or not allrow:
+    m = re.search(r"([0-9]+(?:\.[0-9]+)?)%", lines[-1] if lines else "")
+    print(m.group(1) if m else "")
+    raise SystemExit
+
+cols = [c.strip() for c in header.split("|")]
+idx = next(
+    (i for i, c in enumerate(cols) if c.replace("%", "").strip().lower() == "lines"),
+    None,
+)
+if idx is None:
+    idx = next((i for i, c in enumerate(cols) if c.startswith("%")), 1) + 1
+
+cells = [c.strip() for c in allrow.split("|")]
+if idx is not None and idx < len(cells):
+    val = cells[idx].replace("%", "").strip()
+    if val.replace(".", "", 1).isdigit():
+        print(val)
+        raise SystemExit
+m = re.search(r"([0-9]+(?:\.[0-9]+)?)%", allrow)
+print(m.group(1) if m else "")
+PY
+)"
+
+tail -8 "$OUT_FILE"
+echo ""
+echo "Line coverage: ${COVERAGE:-unavailable}% (threshold: ${COVERAGE_THRESHOLD}%, runner: ${RUN})"
+
+if [ -z "$COVERAGE" ]; then
+    echo "✗ Could not extract an 'All files' line-coverage percentage from ${RUN} output." >&2
+    echo "  Ensure the runner is configured to emit a text coverage summary" >&2
+    echo "  (vitest: coverage.reporter includes 'text'; jest: coverageReporters includes 'text')." >&2
+    exit 1
+fi
+
+if [ "$LCOV" -eq 1 ]; then
+    LCOV_FOUND=""
+    for cand in "coverage/lcov.info" "lcov.info"; do
+        if [ -f "$cand" ]; then
+            echo "lcov artifact found: $cand"
+            LCOV_FOUND=1
+            break
+        fi
+    done
+    if [ -z "$LCOV_FOUND" ]; then
+        echo "⚠️  no lcov.info artifact found — configure your runner's lcov reporter" >&2
+    fi
+fi
+
+if [ "$GATE" -eq 1 ]; then
+    if awk "BEGIN { exit !($COVERAGE >= $COVERAGE_THRESHOLD) }"; then
+        echo "✓ Coverage gate passed"
+    else
+        echo "✗ Coverage below threshold (${COVERAGE}% < ${COVERAGE_THRESHOLD}%)" >&2
+        exit 1
+    fi
+fi
+exit 0

package/templates/pi/scripts/languages/typescript/install_coverage_tools.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# ============================================================================
+# install_coverage_tools.sh — TypeScript/JavaScript: install a real coverage
+# tool
+#
+# The coverage gate (languages/typescript/coverage.sh) prefers the runner
+# your project already uses (vitest → jest → bun → c8). This script installs
+# whatever is missing for that chain:
+#   - vitest coverage needs the matching provider package
+#   - jest coverage is built-in (text reporter via config)
+#   - bun test --coverage is built into the Bun runtime (no install)
+#   - c8 is a universal fallback that wraps `npm test`
+#
+# Run this inside the project root (where package.json lives).
+# ============================================================================
+set -euo pipefail
+
+if [ ! -f "package.json" ]; then
+    echo "✗ No package.json found in the current directory" >&2
+    exit 1
+fi
+
+if grep -q '"vitest"' package.json; then
+    if grep -q 'coverage-v8\|coverage-istanbul' package.json; then
+        echo "vitest + coverage provider present."
+    else
+        echo "vitest detected — installing @vitest/coverage-v8 (required for vitest --coverage)..."
+        npm install --save-dev @vitest/coverage-v8 \
+            || { echo "✗ install failed — run: npm install --save-dev @vitest/coverage-v8" >&2; exit 1; }
+    fi
+elif grep -q '"jest"' package.json; then
+    echo "jest detected — enable 'coverageReporters': ['text', 'lcov'] in jest config for the coverage gate."
+elif command -v bun >/dev/null 2>&1; then
+    echo "bun detected — 'bun test --coverage' is built in; no install needed."
+else
+    echo "No vitest/jest/bun detected — installing c8 as a universal coverage runner..."
+    npm install --save-dev c8 \
+        || { echo "✗ install failed — run: npm install --save-dev c8" >&2; exit 1; }
+fi
+
+echo "TypeScript coverage tooling ready."

package/templates/pi/scripts/languages/typescript/validate-canonical.sh

@@ -46,11 +46,15 @@ echo "--- Module-to-Implementation Mapping ---"
 if [ -d ".pi/architecture/modules" ]; then
     MAPPED=0
     UNMAPPED=0
+    # Modules are mapped by canonical reference headers in source files
+    # (// Canonical: .pi/architecture/modules/<module>.md) — with a filename
+    # heuristic fallback for repos that name directories after modules.
+    REFERRED=$(grep -rEho '\.pi/architecture/modules/[a-z0-9-]+\.md' "$SRC_DIR" --include="*.ts" 2>/dev/null | sort -u) || true
     for module_doc in .pi/architecture/modules/*.md; do
         [ -f "$module_doc" ] || continue
         MODULE_NAME=$(basename "$module_doc" .md)
-        # Look for matching TS files (by convention: module name maps to src/<module>/ or similar)
-        if find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) 2>/dev/null | grep -qi "$MODULE_NAME" 2>/dev/null; then
+        if echo "$REFERRED" | grep -q "$MODULE_NAME\.md" 2>/dev/null \
+           || find "$SRC_DIR" -type f \( -name "*.ts" -o -name "*.tsx" \) 2>/dev/null | grep -qi "$MODULE_NAME" 2>/dev/null; then
             MAPPED=$((MAPPED + 1))
         else
             UNMAPPED=$((UNMAPPED + 1))

package/templates/pi/scripts/languages/typescript/validate-ci.sh

@@ -152,13 +152,13 @@ echo ""
 echo "--- Format ---"
 if [ -f "biome.json" ]; then
     if command -v biome &>/dev/null; then
-        if biome format . --check 2>/dev/null; then
+        if biome ci . 2>/dev/null; then
             pass "Format check passed (biome format)"
         else
             fail "Format check failed (biome format)"
         fi
     elif command -v npx &>/dev/null; then
-        if npx biome format . --check 2>/dev/null; then
+        if npx biome ci . 2>/dev/null; then
             pass "Format check passed (npx biome format)"
         else
             fail "Format check failed (npx biome format)"

package/templates/pi/scripts/validate-architecture-readiness.sh

@@ -26,6 +26,7 @@ FAIL=0
 log_pass() { echo -e "  ${GREEN}✓ PASS${NC} $1"; PASS=$((PASS + 1)); }
 log_fail() { echo -e "  ${RED}✗ FAIL${NC} $1 — $2"; FAIL=$((FAIL + 1)); }
 log_skip() { echo -e "  ${YELLOW}⊘ SKIP${NC} $1 — $2"; PASS=$((PASS + 1)); }
+log_warn() { echo -e "  ${YELLOW}⚠ WARN${NC} $1 — $2"; }
 
 echo "═══ Architecture Readiness Checks ═══"
 echo ""
@@ -134,6 +135,34 @@ else
     log_skip "Architecture conformance" "check_architecture_conformance.sh not found"
 fi
 
+
+# ── 7. ADR-009: runtime wiring gates ──
+# a) ADR-acceptance: an IMPLEMENTED module that documents runtime integration
+#    must not leave its referenced feature ADR Proposed.
+echo "Checking ADR-acceptance + legacy-removal (ADR-009)..."
+ADR_GATE_FAIL=0
+for doc in .pi/architecture/modules/*.md; do
+    [ -f "$doc" ] || continue
+    if ! grep -q "status: implemented" "$doc"; then continue; fi
+    if ! grep -qE "^##{2,3}.*Integration|^#{2,3}.*Dispatch" "$doc"; then continue; fi
+    refs=$(grep -oE "ADR-[0-9]{3}" "$doc" | sort -u | tr "\n" " ")
+    for adr in $refs; do
+        adrfile=$(ls .pi/architecture/decisions/${adr}-*.md 2>/dev/null | head -1)
+        [ -n "$adrfile" ] || continue
+        if grep -q "\*\*Status:\*\* Proposed" "$adrfile" || grep -qE "^\*\*Status:\*\* *Proposed" "$adrfile"; then
+            log_fail "ADR-acceptance (ADR-009)" "${doc##*/} is implemented + documents runtime integration but ${adr} is still Proposed — wire it and Accept the ADR"
+            ADR_GATE_FAIL=1
+        fi
+    done
+    # b) legacy-removal warning (declared migration rule / legacy note)
+    if grep -qE "legacy .*still|still uses|GAP-.*migration" "$doc"; then
+        log_warn "legacy-removal (ADR-009)" "${doc##*/} declares a legacy path/migration rule — verify it is removed or delegating (validate-runtime-wiring.sh)"
+    fi
+done
+if [ $ADR_GATE_FAIL -eq 0 ]; then
+    log_pass "ADR-acceptance (ADR-009)" "no implemented module left a runtime-integration ADR Proposed"
+fi
+
 # ── Summary ──
 
 echo ""