guardian-framework 0.1.105 → 0.1.109

package/templates/pi/extensions/ask-user-question.ts

@@ -182,7 +182,7 @@ async function askSingleChoice(
 		{ id: "other", label: otherLabel, value: "__other__", isOther: true },
 	];
 
-	return ctx.ui.custom<AskAnswer | null>(
+	return (ctx.ui as any).custom(
 		(tui: any, theme: any, _kb: any, done: (r: AskAnswer | null) => void) => {
 			let optionIndex = 0;
 			let editMode = false;
@@ -306,7 +306,7 @@ async function askMultiChoice(
 		{ id: "submit", label: "Submit", value: "__submit__", isSubmit: true },
 	];
 
-	return ctx.ui.custom<AskAnswer[] | null>(
+	return (ctx.ui as any).custom(
 		(tui: any, theme: any, _kb: any, done: (r: AskAnswer[] | null) => void) => {
 			let optionIndex = 0;
 			let editMode = false;

package/templates/pi/extensions/bash-guard.ts

@@ -65,7 +65,7 @@ function tokenizeCommand(cmd: string): { parts: string[]; ops: string[] } {
 		}
 
 		// Operators: |, ||, &&, ;, >, >>, <
-		if (ch === "|" || ch === ";" || ch === "<" || ch === ">") {
+		if (ch === "|" || ch === ";" || ch === "<" || ch === ">" || ch === "&") {
 			if (current.trim()) parts.push(current.trim());
 			current = "";
 
@@ -304,7 +304,7 @@ async function promptRunOrAbort(ctx: any, command: string, risk: Risk): Promise<
 		{ value: "abort", label: "Abort", description: "Block this command" },
 	];
 
-	const choice = await ctx.ui.custom<"run" | "abort">(
+	const choice = await (ctx.ui as any).custom(
 		(tui, theme, _kb, done) => {
 			const container = new Container();
 			container.addChild(

package/templates/pi/extensions/config-reload.ts

@@ -14,12 +14,12 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 
 type ExtensionAPI = {
-	on(event: string, handler: (event: unknown, ctx: unknown) => void | Promise<void>): void;
+	on(event: string, handler: (event: unknown, ctx: ReloadCtx) => void | Promise<void>): void;
 	registerCommand(
 		name: string,
 		options: {
 			description: string;
-			handler(args: string[], ctx: unknown): unknown | Promise<unknown>;
+			handler(args: string[], ctx: ReloadCtx): unknown | Promise<unknown>;
 		},
 	): void;
 };
@@ -35,11 +35,18 @@ function parseFrontMatter(text: string): string {
 	return text.slice(4, end);
 }
 
+type ReloadUi = {
+	notify(message: string, level?: string): void;
+	setStatus(key: string, message: string | null): void;
+	theme?: { fg(role: string, text: string): string };
+};
+type ReloadCtx = { ui?: ReloadUi };
+
 let lastKnownConfig = "";
 let watcher: fs.FSWatcher | undefined;
 let reloadCount = 0;
 
-function startWatching(ctx: unknown): void {
+function startWatching(ctx: ReloadCtx): void {
 	if (!fs.existsSync(CONFIG_FILE)) return;
 
 	lastKnownConfig = fs.readFileSync(CONFIG_FILE, "utf-8");
@@ -82,7 +89,7 @@ function stopWatching(): void {
 }
 
 export default function (pi: ExtensionAPI) {
-	pi.on("session_start", async (_event: unknown, ctx: unknown) => {
+	pi.on("session_start", async (_event: unknown, ctx: ReloadCtx) => {
 		stopWatching();
 		startWatching(ctx);
 	});
@@ -93,7 +100,7 @@ export default function (pi: ExtensionAPI) {
 
 	pi.registerCommand("reload-config", {
 		description: "Manually reload workflow config from AGENTS.md",
-		handler: async (_args: string[], ctx: unknown) => {
+		handler: async (_args: string[], ctx: ReloadCtx) => {
 			if (!fs.existsSync(CONFIG_FILE)) {
 				ctx?.ui?.notify("No .pi/agent/AGENTS.md found.", "warning");
 				return;

package/templates/pi/extensions/coordinator.ts

@@ -24,7 +24,7 @@ type ExtensionContext = {
 type ToolCallEvent = { toolName: string; toolCallId: string; input: { command: string } };
 
 type ExtensionAPI = {
-	on(event: string, handler: (event: unknown, ctx: ExtensionContext) => void | Promise<void>): void;
+	on(event: string, handler: (event: unknown, ctx: ExtensionContext) => unknown | Promise<unknown>): void;
 	registerTool(options: {
 		name: string;
 		label: string;
@@ -34,7 +34,7 @@ type ExtensionAPI = {
 			toolCallId: string,
 			params: Record<string, unknown>,
 			signal: AbortSignal,
-			onUpdate: (update: { type: string; message: string }) => void,
+			onUpdate: (update: { type?: string; message?: string; content?: unknown }) => void,
 			ctx: ExtensionContext,
 		): unknown | Promise<unknown>;
 	}): void;

package/templates/pi/extensions/curator.ts

@@ -252,7 +252,7 @@ class Curator {
 				: new Date(skill.createdAt).getTime();
 			const age = now - lastActivity;
 
-			if (age > archiveThreshold && skill.state !== "archived") {
+			if (age > archiveThreshold) {
 				if (!dryRun) {
 					this.archiveSkill(name);
 				}

package/templates/pi/extensions/domain-explorer.ts

@@ -464,6 +464,26 @@ export default function (pi: ExtensionAPI) {
 				addCheck("Glossary file", false, "Not found");
 			}
 
+			// 4b. ADR-008 modeling-depth rules (deterministic, over raw session JSON)
+			const depthRawPath = sessionPath.replace(/\.md$/, "") + ".raw.json";
+			const depthScript = path.join(ctx.cwd, ".pi", "scripts", "validate-exploration-depth.sh");
+			if (fs.existsSync(depthRawPath) && fs.existsSync(depthScript)) {
+				try {
+					const depthResult = await shellExec(ctx, "bash " + depthScript + " " + depthRawPath);
+					const lines = depthResult.stdout.trim().split("\n").filter((l) => l.trim() !== "");
+					const violations = lines.filter((l) => l.includes("[") && l.includes("] error:"));
+					addCheck(
+						"Modeling depth rules (ADR-008)",
+						depthResult.exitCode === 0,
+						violations.length > 0 ? violations.join(" | ") : lines.slice(-1)[0] || "",
+					);
+				} catch (err) {
+					addCheck("Modeling depth rules (ADR-008)", false, "Error: " + String(err));
+				}
+			} else {
+				addCheck("Modeling depth rules (ADR-008) - skipped", true, "no session raw.json");
+			}
+
 			// 4. Source code drift
 			const scriptPath = path.join(ctx.cwd, ".pi", "scripts", "validate-ubiquitous-language.sh");
 			if (fs.existsSync(scriptPath)) {
@@ -988,8 +1008,35 @@ export default function (pi: ExtensionAPI) {
 					"- Current ADR-001: `.pi/architecture/decisions/ADR-001-architecture-pattern.md`",
 					"- System diagram: `.pi/architecture/diagrams/system-context.md`",
 					"- Module stubs: `.pi/architecture/modules/` (" + moduleFiles.length + " files)",
+					"- ADR-008 modeling depth: `.pi/architecture/decisions/ADR-008-proportional-modeling-depth.md`",
+					"- Structured session JSON (depth fields): `.pi/domain/exploration/" + sessionId + ".raw.json`",
 					"",
-					"### STEP 1: Generate All ADRs",
+					"### STEP 0: ADR-008 Modeling Depth (read first, applies everywhere)",
+				"",
+				"Read the `**Modeling Depth:**` header of EVERY module doc plus the structured",
+				"session JSON (`.raw.json`). Enrich PROPORTIONALLY — never rewrite the depth header,",
+				"never delete an existing `Modeling Depth Note (ADR-008)` section, and never invent",
+				"modeling the exploration did not capture:",
+				"",
+				"- **tactical** (core subdomain): full DDD enrichment — aggregates as consistency",
+				"  boundaries with the exploration invariants (`rule` + illegalStatePrevented),",
+				"  behavior methods not setters, repository interface owned by the domain layer,",
+				"  value objects with entity-vs-VO justification, triaged domain events with payloads,",
+				"  and explicit domain / application / infrastructure service classification.",
+				"- **service** (supporting subdomain): enrich to a Service + Persistence Contract.",
+				"  Do NOT expand aggregates, value objects, domain events, or API surfaces beyond",
+				"  what the exploration captured.",
+				"- **adapter** (generic subdomain): enrich to an Interface + Anti-Corruption Layer —",
+				"  the narrow interface the domain consumes, the vendor/OSS choice, the ACL",
+				"  translation and its context-map edge. NO domain entities or aggregates.",
+				"",
+				"Language judgment: for Java/Spring modules apply the decision tables in the",
+				"`java-spring-enterprise-codegen` skill section 10 (entity-vs-VO, service classifier,",
+				"event triage, transaction placement — `@Transactional` only in application services).",
+				"Diagrams and section breadth follow each module's depth (full module-level diagram",
+				"set only for tactical; service = data-flow + sequence; adapter = ACL/integration).",
+				"",
+				"### STEP 1: Generate All ADRs",
 					"",
 					"**Do this first, before touching any module docs.** Module enrichment needs ADR references.",
 					"",
@@ -1035,8 +1082,8 @@ export default function (pi: ExtensionAPI) {
 					"1. **## Related ADRs** — Links to ADR files with descriptions of relevance",
 					"2. **## Diagrams** — Embed the 4 mermaid diagrams from Step 2",
 					"3. **## Acceptance Criteria** — Add a table row for each component: | # | Component | Criterion | Verify In | with specific, testable acceptance criteria",
-					"5. **## Components** — Expand each aggregate with " + lang + " stubs, methods, invariants keep `status:` and `depends:` markers",
-					"6. **Domain Events** — Table: Event, Description, Trigger, Payload, Published By",
+					"5. **## Components** — depth-aware: for tactical modules expand aggregates with " + lang + " stubs, methods, exploration invariants, VO justifications and a domain/-owned repository interface; for service/adapter modules keep only what the Modeling Depth Note permits (no invented aggregates/VOs). Always keep `status:` and `depends:` markers",
+					"6. **Domain Events** (tactical modules only) — Table: Event, Description, Trigger, Payload, Published By; include ADR-008 triage flags (domain expert cares / crosses boundary / audit trail)",
 					"7. **API Endpoints** — Table: Method, Path, Handler, Input, Output, Auth",
 					"8. **Ubiquitous Language** — Terms for this context from `.pi/domain/ubiquitous-language.md`",
 					"9. **Dependencies** — Depends On + Used By",

package/templates/pi/extensions/filechanges.ts

@@ -493,7 +493,7 @@ export default function (pi: ExtensionAPI) {
 					})),
 				];
 
-				const picked = await ctx.ui.custom<string | null>(
+				const picked = await (ctx.ui as any).custom(
 					(tui, theme, _kb, done) => {
 						const container = new Container();
 						container.addChild(new DynamicBorder((s) => theme.fg("accent", s)));
@@ -546,7 +546,7 @@ export default function (pi: ExtensionAPI) {
 				}
 
 				const md = `\`\`\`diff\n${t.diff.trimEnd() || "(no diff)"}\n\`\`\``;
-				await ctx.ui.custom<void>(
+				await (ctx.ui as any).custom(
 					(tui, theme, _kb, done) => {
 						const container = new Container();
 						container.addChild(new DynamicBorder((s) => theme.fg("accent", s)));

package/templates/pi/extensions/goal-loop.ts

@@ -285,9 +285,9 @@ class GoalManager {
 
 	clear(): void {
 		if (!this.state) return;
-		this.state.status = "cleared";
-		saveGoalState(this.cwd, this.state);
-		this.state = null;
+		this._state.status = "cleared";
+		saveGoalState(this.cwd, this._state);
+		this._state = null;
 	}
 
 	addSubgoal(textIn: string): string {

package/templates/pi/extensions/hooks.ts

@@ -52,7 +52,7 @@ type ExtensionContext = {
 };
 
 type ExtensionAPI = {
-	on(event: string, handler: (event: unknown, ctx: ExtensionContext) => void | Promise<void>): void;
+	on(event: string, handler: (event: unknown, ctx: ExtensionContext) => unknown | Promise<unknown>): void;
 	registerTool(options: {
 		name: string;
 		label: string;

package/templates/pi/extensions/pi-env.d.ts

@@ -0,0 +1,96 @@
+// Ambient declarations for the pi runtime SDK. The host provides these at
+// runtime with real types; not vendored here. Auto-generated names from
+// actual imports across the extension sources so tsc type-checks cleanly.
+
+declare module "@mariozechner/pi-coding-agent" {
+	export const DynamicBorder: any;
+	export type DynamicBorder = any;
+	export const ExtensionAPI: any;
+	export type ExtensionAPI = any;
+	export const ExtensionCommandContext: any;
+	export type ExtensionCommandContext = any;
+	export const ExtensionContext: any;
+	export type ExtensionContext = any;
+	export const createFindTool: any;
+	export type createFindTool = any;
+	export const createGrepTool: any;
+	export type createGrepTool = any;
+	export const createLsTool: any;
+	export type createLsTool = any;
+	export const createReadTool: any;
+	export type createReadTool = any;
+	export const getMarkdownTheme: any;
+	export type getMarkdownTheme = any;
+	export const isEditToolResult: any;
+	export type isEditToolResult = any;
+	export const isToolCallEventType: any;
+	export type isToolCallEventType = any;
+	export const isWriteToolResult: any;
+	export type isWriteToolResult = any;
+}
+
+declare module "@mariozechner/pi-tui" {
+	export const Container: any;
+	export type Container = any;
+	export const Editor: any;
+	export type Editor = any;
+	export const EditorTheme: any;
+	export type EditorTheme = any;
+	export const Key: any;
+	export type Key = any;
+	export const Markdown: any;
+	export type Markdown = any;
+	export const SelectItem: any;
+	export type SelectItem = any;
+	export const SelectList: any;
+	export type SelectList = any;
+	export const Text: any;
+	export type Text = any;
+	export const matchesKey: any;
+	export type matchesKey = any;
+	export const truncateToWidth: any;
+	export type truncateToWidth = any;
+	export const wrapTextWithAnsi: any;
+	export type wrapTextWithAnsi = any;
+}
+
+declare module "@earendil-works/pi-coding-agent" {
+	export const ExecResult: any;
+	export type ExecResult = any;
+	export const ExtensionAPI: any;
+	export type ExtensionAPI = any;
+	export const ExtensionContext: any;
+	export type ExtensionContext = any;
+}
+
+declare module "typebox" {
+	export const Type: any;
+	export type Type = any;
+	export const Static: any;
+	export type Static = any;
+	export const TObject: any;
+	export type TObject = any;
+	export const TSchema: any;
+	export type TSchema = any;
+	export const TProperties: any;
+	export type TProperties = any;
+	export const TString: any;
+	export type TString = any;
+	export const TArray: any;
+	export type TArray = any;
+	export const TOptional: any;
+	export type TOptional = any;
+	export const TBoolean: any;
+	export type TBoolean = any;
+	export const TNumber: any;
+	export type TNumber = any;
+	export const TUnion: any;
+	export type TUnion = any;
+	export const TLiteral: any;
+	export type TLiteral = any;
+	export const TRecord: any;
+	export type TRecord = any;
+	export const TAny: any;
+	export type TAny = any;
+}
+declare module "@sinclair/typebox" { export const Type: any; export type Static = any; }

package/templates/pi/extensions/pipeline.ts

@@ -256,7 +256,7 @@ class PipelineManager {
 	 * Reload pipeline state from disk, discarding any cached in-memory state.
 	 * Use this when another extension (e.g., architect) may have written state directly.
 	 */
-	private reloadFromDisk(): void {
+	reloadFromDisk(): void {
 		this.state = loadPipelineState(this.cwd);
 	}
 

package/templates/pi/extensions/project-scaffolder.ts

@@ -227,7 +227,7 @@ export default function (pi: ExtensionAPI) {
 						dryRun ? "Mode: **Dry Run** (no files written)" : "Mode: **Live**",
 						"",
 						"```",
-						result.trim(),
+						String(result).trim(),
 						"```",
 						"",
 						dryRun

package/templates/pi/extensions/read-only-mode.ts

@@ -25,6 +25,8 @@ import {
 const COMMAND_NAME = "read-only";
 const STATUS_KEY = "read-only-mode";
 const WIDGET_KEY = "read-only-mode";
+let readOnlyActive = false;
+
 const READ_ONLY_TOOL_NAMES = ["read", "grep", "find", "ls"] as const;
 
 function getReadOnlyToolNames(pi: ExtensionAPI): string[] {
@@ -95,6 +97,7 @@ export default function (pi: ExtensionAPI) {
 	});
 
 	function enable(ctx: ExtensionContext): void {
+	readOnlyActive = true;
 		if (enabled) {
 			updateUi(pi, ctx, enabled);
 			ctx.ui.notify("Read-only mode is already enabled.", "info");
@@ -111,6 +114,7 @@ export default function (pi: ExtensionAPI) {
 	}
 
 	function disable(ctx: ExtensionContext): void {
+	readOnlyActive = false;
 		if (!enabled) {
 			updateUi(pi, ctx, enabled);
 			ctx.ui.notify("Read-only mode is already disabled.", "info");
@@ -130,7 +134,7 @@ export default function (pi: ExtensionAPI) {
 			switch (action) {
 				case "":
 				case "toggle":
-					toggle(ctx);
+					if (readOnlyActive) disable(ctx); else enable(ctx);
 					return;
 				case "on":
 				case "enable":

package/templates/pi/extensions/tsconfig.json

@@ -1,7 +1,11 @@
 {
 	"compilerOptions": {
-		"types": ["bun-types"],
+		"types": [
+			"bun-types"
+		],
 		"strict": true,
+		"noImplicitAny": false,
+		"strictNullChecks": false,
 		"target": "ES2022",
 		"module": "ESNext",
 		"moduleResolution": "bundler",
@@ -11,5 +15,8 @@
 		"isolatedModules": true,
 		"allowImportingTsExtensions": true
 	},
-	"include": ["**/*.ts"]
+	"include": [
+		"**/*.ts",
+		"**/*.d.ts"
+	]
 }

package/templates/pi/preflight_report.json

@@ -1,5 +1,5 @@
 {
-  "timestamp": "2026-07-20T16:02:31Z",
+  "timestamp": "2026-09-04T13:00:27Z",
   "mode": "all",
   "stages_run": [],
   "summary": {

package/templates/pi/prompts/ci-blueprint.md

@@ -72,7 +72,7 @@ Language-specific linting.
 | `unit_application` | `pytest tests/unit/application` | No |
 | `unit_contract` | `pytest tests/contract` | No |
 | `unit_verification` | `pytest tests/verification` | No |
-| `coverage_threshold_check` | `.pi/scripts/ci/check_coverage_thresholds.py` | No |
+| `coverage_gate` | `bash .pi/scripts/install_coverage_tools.sh && bash .pi/scripts/coverage.sh --gate --lcov` | No |
 
 ## Stage 6: Integration
 
@@ -119,7 +119,7 @@ Language-specific linting.
 | Rule | Jobs Using It |
 |------|---------------|
 | `rules_default` (MRs or main branch) | Most jobs |
-| `rules_sonar` (requires `$SONAR_TOKEN` + `$SONAR_HOST_URL`) | coverage_report, sonar_quality_gate |
+| `rules_sonar` (requires `$SONAR_TOKEN` + `$SONAR_HOST_URL`) | coverage_gate (uploads lcov artifact), sonar_quality_gate |
 | `rules_main_only` | `package_build` |
 | `rules_migration_changes` (migration file changes only) | `migration_verify` stage |
 

package/templates/pi/scripts/check_model_judgment.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment.sh — ADR-008/009 dispatcher
+# Runs the language-scoped model-judgment hard gates (dip-domain,
+# interface-ownership, adapter-purity, transaction placement per language).
+# Usage: bash .pi/scripts/check_model_judgment.sh [--root <dir>]
+# ============================================================================
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+
+detect_language() {
+    if [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "package.json" ]; then echo "typescript"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then echo "python"
+    elif [ -f "pom.xml" ] || [ -f "build.gradle" ]; then echo "java"
+    else echo "unknown"; fi
+}
+LANG="$(detect_language)"
+SCRIPT="${SCRIPT_DIR}/languages/${LANG}/check_model_judgment.sh"
+if [ -f "$SCRIPT" ]; then
+    exec bash "$SCRIPT" --root "$ROOT"
+fi
+echo "model-judgment: no gate script for language '${LANG}'"
+exit 0

package/templates/pi/scripts/ci/check_judgment_contracts.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_judgment_contracts.sh — proofing for ADR-008 P1 (judgment-aware
+# modeling). Deterministic proof that each frozen contract (§1–§7 of
+# .pi/architecture/contracts/judgment-aware-modeling-p1.md) is implemented
+# in the framework sources.
+#
+# Checks:
+#   1. exploration prompt emits ADR-008 schema markers (src)
+#   2. validate-exploration-depth.sh exists + executable
+#   3. java model-judgment gate exists + executable
+#   4. module-doc scaffold emits 'Modeling Depth' header (src)
+#   5. java-spring codegen skill carries 'Judgment Tables (ADR-008)'
+#   6. architecture-validator skill carries Model Judgment Review R1-R4
+#   7. modeling contracts: ModuleComponent type carries the ADR-008 fields
+#   8. exploration.md template carries the Modeling Judgment section
+#
+# Exit 0 = all contracts proven; 1 = at least one missing.
+# ============================================================================
+set -uo pipefail
+
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+
+FAILED=0
+PASSED=0
+
+check() { # label, file-or-dir, grep pattern
+    local label="$1" path="$2" pattern="$3"
+    if [ -n "$path" ] && [ -e "$path" ] && grep -qE "$pattern" "$path" 2>/dev/null; then
+        echo "  PASS: $label"
+        PASSED=$((PASSED + 1))
+    else
+        echo "  FAIL: $label (missing: $path / $pattern)" >&2
+        FAILED=$((FAILED + 1))
+    fi
+}
+
+check_file() { # label file
+    if [ -f "$2" ] && [ -x "$2" ]; then
+        echo "  PASS: $1"
+        PASSED=$((PASSED + 1))
+    else
+        echo "  FAIL: $1 (not found/executable: $2)" >&2
+        FAILED=$((FAILED + 1))
+    fi
+}
+
+echo "Judgment contracts proofing (ADR-008 P1)"
+echo "----------------------------------------"
+
+# 1. exploration prompt schema markers
+check "exploration prompt: subdomainType/invariants/triage/contextMap/conflicts" \
+    "src/lib/domain-explorer.ts" 'subdomainType|"invariants"|"triage"|"contextMap"|"conflicts"'
+
+# 2. depth validator present + executable
+check_file "validate-exploration-depth.sh executable" ".pi/scripts/validate-exploration-depth.sh"
+check_file "validate-exploration-depth.sh (templates copy)" "templates/pi/scripts/validate-exploration-depth.sh"
+
+# 3. java model-judgment gate present + executable
+check_file "java model-judgment gate" ".pi/scripts/languages/java/check_model_judgment.sh"
+check_file "java model-judgment gate (templates copy)" "templates/pi/scripts/languages/java/check_model_judgment.sh"
+
+# 4. scaffold emits Modeling Depth header + invariants + depth note
+check "scaffold: Modeling Depth header" "src/lib/domain-explorer.ts" 'Modeling Depth'
+check "scaffold: depth note for service/adapter" "src/lib/domain-explorer.ts" 'Modeling Depth Note \(ADR-008\)'
+
+# 5. java-spring codegen skill: judgment tables
+check "java-spring skill: Judgment Tables (ADR-008)" \
+    ".pi/skills/java-spring-enterprise-codegen.md" 'Judgment Tables \(ADR-008\)'
+
+# 6. architecture-validator skill: R1-R4 review questions
+check "architecture-validator skill: Model Judgment Review" \
+    ".pi/skills/agents/architecture-validator.md" 'Model Judgment Review'
+
+# 7. ModuleComponent modeling-contract fields
+check "architect-lib types: modelingDepth/aggregateRoot/invariants/events" \
+    ".pi/extensions/architect-lib/types.ts" 'modelingDepth|aggregateRoot|invariants|publishes'
+check "generators: Modeling Contract emission" \
+    ".pi/extensions/architect-lib/generators.ts" 'Modeling Contract \(ADR-008\)'
+
+# 8. exploration.md template: Modeling Judgment section
+check "exploration.md template: Modeling Judgment section" \
+    "templates/pi/domain/exploration.md" 'Modeling Judgment \(ADR-008\)'
+
+echo ""
+echo "  Passed: $PASSED   Failed: $FAILED"
+if [ "$FAILED" -gt 0 ]; then
+    exit 1
+fi
+echo "All judgment contracts proven."
+exit 0

package/templates/pi/scripts/ci/run_preflight.sh

@@ -255,10 +255,10 @@ run_stage_lint() {
                     log_fail "biome check" "lint errors found" "$(( $(date +%s) - t ))"
                 fi
                 t=$(date +%s)
-                if biome format --check . >/dev/null 2>&1; then
-                    log_pass "biome format --check" "$(( $(date +%s) - t ))"
+                if biome ci . >/dev/null 2>&1; then
+                    log_pass "biome ci" "$(( $(date +%s) - t ))"
                 else
-                    log_fail "biome format --check" "format errors found" "$(( $(date +%s) - t ))"
+                    log_fail "biome ci" "format errors found" "$(( $(date +%s) - t ))"
                 fi
             else
                 log_skip "biome" "not installed"

package/templates/pi/scripts/ci/run_stage.sh

@@ -76,7 +76,7 @@ case "$STAGE" in
             ruff check . && ruff format --check .
         elif [[ -f "package.json" ]]; then
             echo "TypeScript project detected"
-            biome check . && biome format --check .
+            biome check . && biome ci .
         elif [[ -f "Cargo.toml" ]]; then
             echo "Rust project detected"
             cargo clippy -- -D warnings && cargo fmt --check

package/templates/pi/scripts/ci/stage_lint.sh

@@ -72,7 +72,7 @@ case "$LANG" in
             else
                 log_fail "biome lint" "Lint errors found"
             fi
-            if biome format . --check 2>/dev/null; then
+            if biome ci . 2>/dev/null; then
                 log_pass "biome format check"
             else
                 log_fail "biome format check" "Format errors found"

package/templates/pi/scripts/coverage.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# ============================================================================
+# coverage.sh — Real project coverage measurement + gate (dispatcher)
+#
+# Runs the project's REAL coverage tool for the detected language and reports
+# line coverage. This is the honest replacement for the old per-module
+# heuristic `*_coverage.sh` checks (coverage-theater — they counted test
+# functions via grep, never a real percentage).
+#
+# Delegates to languages/<lang>/coverage.sh. Real coverage tool per language:
+#   rust        — cargo llvm-cov (workspace line coverage, lcov artifact)
+#   python      — coverage.py (pytest/unittest)
+#   typescript  — vitest / jest / bun test --coverage (istanbul text)
+#   go          — go test -coverprofile + go tool cover
+#   java        — JaCoCo (maven/gradle)
+#
+# Usage:
+#   bash .pi/scripts/coverage.sh            # measure + print summary
+#   bash .pi/scripts/coverage.sh --gate     # exit 1 if lines < COVERAGE_THRESHOLD
+#   bash .pi/scripts/coverage.sh --lcov     # also emit the tool's report artifact
+#
+# Env:
+#   COVERAGE_THRESHOLD  minimum line-coverage % (default: 60 — a conservative
+#                       floor; set it to the threshold your CI actually enforces)
+#
+# Exit codes:
+#   0 — measured and (with --gate) meets threshold, or language not applicable
+#   1 — coverage tool missing / below threshold / could not measure (honest
+#       fail — never fake-pass)
+#   2 — unknown argument
+# ============================================================================
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+detect_language() {
+    if [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "poetry.lock" ] || [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then echo "python"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "package.json" ]; then echo "typescript"
+    elif [ -f "pom.xml" ] || [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then echo "java"
+    else echo "unknown"; fi
+}
+
+LANG="$(detect_language)"
+
+if [ "$LANG" = "unknown" ]; then
+    echo "⚠️  No project language detected — no real coverage gate applies." >&2
+    exit 0
+fi
+
+LANG_SCRIPT="${SCRIPT_DIR}/languages/${LANG}/coverage.sh"
+if [ ! -f "$LANG_SCRIPT" ]; then
+    echo "⚠️  No coverage gate script for '${LANG}' yet (${LANG_SCRIPT})." >&2
+    exit 0
+fi
+
+exec bash "$LANG_SCRIPT" "$@"