guardian-framework 0.1.105 → 0.1.109

package/templates/pi/scripts/languages/python/check_runtime_reachability.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_runtime_reachability.sh — Python (ADR-009)
+#
+# Every module under src/<module>/application/ must be referenced from
+# production code OUTSIDE its own module and OUTSIDE tests. Candidates: the
+# file stem, its PascalCase class name, and the separator-stripped form
+# (case-insensitive).
+# Usage: bash check_runtime_reachability.sh [--root <dir>]
+# Exit:  0 all reachable ; 1 dead service(s)
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+[ -d src ] || { echo "runtime-reachability (python): no src/"; exit 0; }
+
+while IFS= read -r svc; do
+    [ -n "$svc" ] || continue
+    mod="$(echo "$svc" | sed 's|^src/||; s|/application/.*||')"
+    stem="$(basename "$svc" .py)"
+    pascal="$(echo "$stem" | python3 -c 'import sys; s=sys.stdin.read().strip(); print("".join(w.capitalize() for w in s.replace("-","_").split("_")))' 2>/dev/null || echo "$stem")"
+    compact="$(echo "$stem" | tr -d '_-')"
+    refs="$(grep -rliE "\b(${pascal}|${stem}|${compact})\b" src 2>/dev/null | grep -vE "/tests?/|test_.*\.py$|_test\.py$|/test/" | grep -v "^src/${mod}/" | grep -v "^${svc}$" | grep -cv '^$' || true)"
+    if [ "${refs:-0}" -eq 0 ]; then
+        echo "$svc: [runtime-reachability] application service has no production caller outside its module (tests-only callers don't count — ADR-009)"
+        VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+done < <(find src -path "*/application/*.py" -type f 2>/dev/null | grep -vE "/tests?/|test_.*\.py$|_test\.py$" || true)
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "runtime-wiring (python): ${VIOLATIONS} unwired service(s)" >&2; exit 1; fi
+echo "runtime-reachability (python): all application services reachable from production code"
+exit 0

package/templates/pi/scripts/languages/python/coverage.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# ============================================================================
+# coverage.sh — Python: real line coverage via coverage.py
+#
+# Runs the test suite under coverage.py and reports the TOTAL line coverage.
+# Uses pytest when available, unittest otherwise.
+#
+# Usage (normally via the .pi/scripts/coverage.sh dispatcher):
+#   bash coverage.sh            # measure coverage
+#   bash coverage.sh --gate     # fail if lines < COVERAGE_THRESHOLD
+#   bash coverage.sh --lcov     # also write coverage.xml (cobertura) artifact
+#
+# Env:
+#   COVERAGE_THRESHOLD  minimum line-coverage % (default: 60)
+# ============================================================================
+set -uo pipefail
+
+COVERAGE_THRESHOLD="${COVERAGE_THRESHOLD:-60}"
+GATE=0
+LCOV=0
+
+for arg in "$@"; do
+    case "$arg" in
+        --gate) GATE=1 ;;
+        --lcov) LCOV=1 ;;
+        *) echo "unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+# Walk up from CWD to the project root (pyproject.toml / setup.py /
+# setup.cfg / requirements.txt).
+ROOT="$(pwd)"
+while [ "$ROOT" != "/" ] \
+    && [ ! -f "$ROOT/pyproject.toml" ] \
+    && [ ! -f "$ROOT/setup.py" ] \
+    && [ ! -f "$ROOT/setup.cfg" ] \
+    && [ ! -f "$ROOT/requirements.txt" ]; do
+    ROOT="$(dirname "$ROOT")"
+done
+if [ ! -f "$ROOT/pyproject.toml" ] && [ ! -f "$ROOT/setup.py" ] \
+    && [ ! -f "$ROOT/setup.cfg" ] && [ ! -f "$ROOT/requirements.txt" ]; then
+    echo "✗ No Python project marker found in this directory tree" >&2
+    exit 1
+fi
+cd "$ROOT" || exit 1
+
+if ! python3 -m coverage --version >/dev/null 2>&1; then
+    echo "coverage.py not found — run .pi/scripts/install_coverage_tools.sh" >&2
+    exit 1
+fi
+
+echo "═══ Coverage (coverage.py) ═══"
+# Scope measurement to the project source (src/ layout when present, else
+# the project root) so site-packages / pytest internals are not counted.
+COV_SOURCE="src"
+[ -d "src" ] || COV_SOURCE="."
+if python3 -m pytest --version >/dev/null 2>&1; then
+    python3 -m coverage run --source="$COV_SOURCE" -m pytest -q >/dev/null 2>&1 || true
+else
+    python3 -m coverage run --source="$COV_SOURCE" -m unittest discover -s tests >/dev/null 2>&1 || true
+fi
+
+REPORT="$(python3 -m coverage report 2>&1 || true)"
+echo "$REPORT" | tail -20
+COVERAGE="$(echo "$REPORT" | awk '/^TOTAL/{print $NF}' | tr -d '%')"
+echo ""
+echo "Line coverage: ${COVERAGE:-unavailable}% (threshold: ${COVERAGE_THRESHOLD}%)"
+
+if [ -z "$COVERAGE" ]; then
+    echo "✗ Could not extract TOTAL coverage from coverage.py output" >&2
+    exit 1
+fi
+
+if [ "$LCOV" -eq 1 ]; then
+    python3 -m coverage xml -o coverage.xml >/dev/null 2>&1 \
+        && echo "cobertura artifact written: coverage.xml" \
+        || echo "⚠️  could not write coverage.xml" >&2
+fi
+
+if [ "$GATE" -eq 1 ]; then
+    if awk "BEGIN { exit !($COVERAGE >= $COVERAGE_THRESHOLD) }"; then
+        echo "✓ Coverage gate passed"
+    else
+        echo "✗ Coverage below threshold (${COVERAGE}% < ${COVERAGE_THRESHOLD}%)" >&2
+        exit 1
+    fi
+fi
+exit 0

package/templates/pi/scripts/languages/python/install_coverage_tools.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# ============================================================================
+# install_coverage_tools.sh — Python: install coverage.py (+ pytest)
+#
+# Installs the real coverage tooling used by
+# .pi/scripts/languages/python/coverage.sh.
+# ============================================================================
+set -euo pipefail
+
+if python3 -m coverage --version >/dev/null 2>&1; then
+    echo "coverage.py already installed: $(python3 -m coverage --version | head -1)"
+else
+    echo "Installing coverage.py..."
+    python3 -m pip install coverage
+fi
+
+if ! python3 -m pytest --version >/dev/null 2>&1; then
+    echo "Installing pytest (optional, for test discovery)..."
+    python3 -m pip install pytest || true
+fi
+
+echo "coverage tooling ready."

package/templates/pi/scripts/languages/rust/check_model_judgment.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment.sh — Rust (ADR-008/009)
+# Deterministic hard gates:
+#   dip-domain           domain/ (crate/module) imports sqlx/diesel/web frameworks
+#   interface-ownership  (tactical) infra impl without a domain/-owned trait
+#   adapter-purity       (adapter modules) model code in generic subdomains
+# Usage: bash check_model_judgment.sh [--root <dir>]
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+report() { echo "$1:$2: [$3] $4"; VIOLATIONS=$((VIOLATIONS + 1)); }
+[ -d src ] || { echo "model-judgment (rust): no src/"; exit 0; }
+
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    case "$f" in */domain/*)
+        while IFS=: read -r ln rest; do
+            case "$rest" in
+                *sqlx*|*diesel*|*sea_orm*|*axum*|*actix*|*tokio-postgres*|*mongodb*|*redis*)
+                    report "$f" "$ln" "dip-domain" "domain imports framework/persistence crate: $(echo "$rest" | sed 's/^use //; s/;.*//')" ;;
+            esac
+        done < <(grep -nE "^use |^extern crate " "$f" || true) ;;
+    esac
+done < <(find src -type f -name "*.rs" 2>/dev/null | grep -vE "_test\.rs$|/tests?/" || true)
+
+if [ -d ".pi/architecture/modules" ]; then
+    for doc in .pi/architecture/modules/*.md; do
+        [ -f "$doc" ] || continue
+        doc_name="$(basename "$doc" .md)"
+        depth="$(grep -m1 '^\*\*Modeling Depth:\*\*' "$doc" | sed 's/.*\*\*Modeling Depth:\*\* *//' | cut -d' ' -f1 || true)"
+        docnorm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+        match_dir=""
+        while IFS= read -r d; do
+            norm="$(basename "$d" | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+            if [ "$norm" = "$docnorm" ]; then match_dir="$d"; break; fi
+        done < <(find src -mindepth 1 -maxdepth 1 -type d 2>/dev/null || true)
+        [ -n "$match_dir" ] || continue
+        if [ "$depth" = "adapter" ]; then
+            for layer in domain application; do
+                while IFS= read -r f; do [ -n "$f" ] || continue; report "$f" "1" "adapter-purity" "generic subdomain '${doc_name}' must not contain ${layer}/ model code (ADR-008)"; done < <(find "$match_dir/$layer" -type f -name "*.rs" 2>/dev/null || true)
+            done
+        elif [ "$depth" = "tactical" ]; then
+            while IFS= read -r impl; do
+                [ -n "$impl" ] || continue
+                simple="$(basename "$impl" .rs)"
+                stem="$(echo "$simple" | sed -E 's/_impl$//')"
+                if ! grep -rqiE "(pub )?trait ${stem}\\b|trait ${simple}\\b|${stem}" "$match_dir/domain" 2>/dev/null; then
+                    report "$impl" "1" "interface-ownership" "repository/adapter impl without a domain/-owned trait (${simple})"
+                fi
+            done < <(find "$match_dir/infrastructure" -type f \( -name "*repository*.rs" -o -name "*repo*.rs" -o -name "*gateway*.rs" \) 2>/dev/null || true)
+        fi
+    done
+fi
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "model-judgment (rust): ${VIOLATIONS} violation(s)" >&2; exit 1; fi
+echo "model-judgment (rust): all gates passed (dip-domain, interface-ownership, adapter-purity)"
+exit 0

package/templates/pi/scripts/languages/rust/check_runtime_reachability.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_runtime_reachability.sh — Rust (ADR-009)
+#
+# Every service struct under src/<module>/application/ must be referenced from
+# production code outside its own module and outside tests (tests dirs,
+# *_test.rs, and #[cfg(test)] units inside the same file do not count — we
+# require a reference from a different production file outside the module).
+#
+# Usage: bash check_runtime_reachability.sh [--root <dir>]
+# Exit:  0 all reachable ; 1 dead service(s)
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+
+VIOLATIONS=0
+[ -d src ] || { echo "runtime-reachability (rust): no src/"; exit 0; }
+
+while IFS= read -r svc; do
+    [ -n "$svc" ] || continue
+    mod="$(echo "$svc" | sed 's|^src/||; s|/application/.*||')"
+    stem="$(basename "$svc" .rs)"
+    # candidate type names: file stem in PascalCase and snake_case both
+    pascal="$(echo "$stem" | python3 -c 'import sys; s=sys.stdin.read().strip(); print("".join(w.capitalize() for w in s.split("_")) if s else "")' 2>/dev/null || echo "$stem")"
+    # production references: outside the module, excluding tests
+    refs="$(grep -rlE "\b(${pascal}|${stem})\b" src 2>/dev/null | grep -vE "/tests?/|_test\.rs$|/test/" | grep -v "^src/${mod}/" | grep -v "^${svc}$" | grep -cv '^$' || true)"
+    if [ "${refs:-0}" -eq 0 ]; then
+        echo "$svc: [runtime-reachability] application service has no production caller outside its module (tests-only callers don't count — ADR-009)"
+        VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+done < <(find src -path "*/application/*.rs" -type f 2>/dev/null || true)
+
+if [ "$VIOLATIONS" -gt 0 ]; then
+    echo "runtime-wiring (rust): ${VIOLATIONS} unwired service(s)" >&2
+    exit 1
+fi
+echo "runtime-reachability (rust): all application services reachable from production code"
+exit 0

package/templates/pi/scripts/languages/rust/coverage.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# ============================================================================
+# coverage.sh — Rust: real line coverage via cargo-llvm-cov
+#
+# cargo-llvm-cov uses native LLVM instrumentation and works with incremental
+# compilation — ~3x faster than cargo-tarpaulin's full instrumented
+# recompilation. Produces the REAL workspace line-coverage number.
+#
+# Usage (normally via the .pi/scripts/coverage.sh dispatcher):
+#   bash coverage.sh            # measure workspace coverage
+#   bash coverage.sh --gate     # fail if lines < COVERAGE_THRESHOLD
+#   bash coverage.sh --lcov     # also write target/coverage.lcov artifact
+#
+# Env:
+#   COVERAGE_THRESHOLD  minimum line-coverage % (default: 60)
+# ============================================================================
+set -uo pipefail
+
+COVERAGE_THRESHOLD="${COVERAGE_THRESHOLD:-60}"
+GATE=0
+LCOV=0
+
+for arg in "$@"; do
+    case "$arg" in
+        --gate) GATE=1 ;;
+        --lcov) LCOV=1 ;;
+        *) echo "unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+# Walk up from CWD to the crate/workspace root (Cargo.toml).
+ROOT="$(pwd)"
+while [ "$ROOT" != "/" ] && [ ! -f "$ROOT/Cargo.toml" ]; do
+    ROOT="$(dirname "$ROOT")"
+done
+if [ ! -f "$ROOT/Cargo.toml" ]; then
+    echo "✗ No Cargo.toml found in this directory tree" >&2
+    exit 1
+fi
+cd "$ROOT" || exit 1
+
+if ! command -v cargo-llvm-cov >/dev/null 2>&1; then
+    echo "cargo-llvm-cov not found — run .pi/scripts/install_coverage_tools.sh" >&2
+    exit 1
+fi
+
+echo "═══ Workspace coverage (cargo llvm-cov) ═══"
+# --summary-only always prints the table we parse. When --lcov is also
+# requested, write the lcov artifact in a second (instrumentation-cached,
+# fast) pass — the tool suppresses the console summary in lcov-output mode.
+SUMMARY="$(cargo llvm-cov --workspace --summary-only)"
+if [ "$LCOV" -eq 1 ]; then
+    mkdir -p target
+    cargo llvm-cov --workspace --lcov --output-path target/coverage.lcov >/dev/null 2>&1 \
+        && echo "lcov artifact written: target/coverage.lcov" \
+        || echo "⚠️  could not write target/coverage.lcov" >&2
+fi
+
+# Print the per-file table + TOTAL row (summary tail), then extract the
+# TOTAL line-coverage percentage from the final line.
+echo "$SUMMARY" | tail -12
+COVERAGE="$(echo "$SUMMARY" | tail -1 | grep -oE '[0-9]+\.[0-9]+%' | head -1 | sed 's/%//')"
+echo ""
+echo "Line coverage: ${COVERAGE:-unavailable}% (threshold: ${COVERAGE_THRESHOLD}%)"
+
+if [ -z "$COVERAGE" ]; then
+    echo "✗ Could not extract coverage from cargo llvm-cov output" >&2
+    exit 1
+fi
+
+if [ "$GATE" -eq 1 ]; then
+    if awk "BEGIN { exit !($COVERAGE >= $COVERAGE_THRESHOLD) }"; then
+        echo "✓ Coverage gate passed"
+    else
+        echo "✗ Coverage below threshold (${COVERAGE}% < ${COVERAGE_THRESHOLD}%)" >&2
+        exit 1
+    fi
+fi
+exit 0

package/templates/pi/scripts/languages/rust/install_coverage_tools.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# ============================================================================
+# install_coverage_tools.sh — Rust: install cargo-llvm-cov
+#
+# cargo-llvm-cov needs the llvm-tools-preview rustup component. It is the
+# real coverage tool used by .pi/scripts/languages/rust/coverage.sh.
+# ============================================================================
+set -euo pipefail
+
+rustup component add llvm-tools-preview || echo "llvm-tools-preview unavailable on this toolchain"
+
+if command -v cargo-llvm-cov >/dev/null 2>&1; then
+    echo "cargo-llvm-cov already installed: $(cargo-llvm-cov --version)"
+    exit 0
+fi
+
+echo "Installing cargo-llvm-cov..."
+cargo install cargo-llvm-cov --locked
+
+echo "cargo-llvm-cov installed: $(cargo-llvm-cov --version)"

package/templates/pi/scripts/languages/rust/validate-tests.sh

@@ -97,13 +97,14 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# Coverage
+# Coverage (uses cargo-llvm-cov — native LLVM instrumentation, ~3x faster than tarpaulin)
 # ---------------------------------------------------------------------------
 echo ""
 echo "--- Coverage ---"
-if command -v cargo &>/dev/null && cargo tarpaulin --version &>/dev/null; then
-    TARP_OUT=$(cargo tarpaulin --out Html 2>&1 || true)
-    COVERAGE_PCT=$(echo "$TARP_OUT" | grep -oE '[0-9]+(\.[0-9]+)?%' | head -1 | tr -d '%' || echo "")
+if command -v cargo &>/dev/null && cargo llvm-cov --version &>/dev/null; then
+    LLCV_OUT=$(cargo llvm-cov --html --fail-under-lines 80 2>&1 || true)
+    LLCV_EXIT=$?
+    COVERAGE_PCT=$(echo "$LLCV_OUT" | grep -oE '[0-9]+(\.[0-9]+)?%' | head -1 | tr -d '%' || echo "")
     if [ -n "$COVERAGE_PCT" ]; then
         # Compare coverage against 80% threshold using awk
         MEETS_THRESHOLD=$(echo "$COVERAGE_PCT" | awk '{print ($1 >= 80) ? "yes" : "no"}')
@@ -112,8 +113,10 @@ if command -v cargo &>/dev/null && cargo tarpaulin --version &>/dev/null; then
         else
             fail "Code coverage: ${COVERAGE_PCT}% (< 80%)"
         fi
+    elif [ "$LLCV_EXIT" -eq 0 ]; then
+        pass "Code coverage meets 80% threshold"
     else
-        warn "Could not extract coverage percentage from tarpaulin output"
+        warn "Could not extract coverage percentage from llvm-cov output"
     fi
 elif command -v grcov &>/dev/null; then
     # Use grcov as fallback
@@ -124,7 +127,7 @@ elif command -v grcov &>/dev/null; then
         pass "grcov coverage report generated"
     fi
 else
-    warn "No coverage tools available (cargo-tarpaulin / grcov), skipping coverage check"
+    warn "No coverage tools available (cargo-llvm-cov / grcov), skipping coverage check"
 fi
 
 # ---------------------------------------------------------------------------

package/templates/pi/scripts/languages/typescript/check_model_judgment.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment.sh — TypeScript (ADR-008/009)
+# Deterministic hard gates, mirrors the Java four:
+#   dip-domain           domain/ imports framework/persistence types
+#   txn-placement        transaction/UnitOfWork boundaries outside application/
+#   interface-ownership  (tactical) infra adapters without a domain/-owned interface
+#   adapter-purity       (adapter modules) model code in generic subdomains
+# Usage: bash check_model_judgment.sh [--root <dir>]
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+
+VIOLATIONS=0
+report() { echo "$1:$2: [$3] $4"; VIOLATIONS=$((VIOLATIONS + 1)); }
+
+[ -d src ] || { echo "model-judgment (ts): no src/"; exit 0; }
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    case "$f" in */*test*/|*.test.ts|*.spec.ts) continue ;; esac
+    # dip-domain
+    case "$f" in */domain/*)
+        while IFS=: read -r ln rest; do
+            case "$rest" in
+                *typeorm*|*prisma*|*@nestjs*|*express*|*sequelize*)
+                    report "$f" "$ln" "dip-domain" "domain imports framework: $(echo "$rest" | sed 's/^import //; s/;//')" ;;
+            esac
+        done < <(grep -nE "^import |require\\(" "$f" || true) ;;
+    esac
+    # txn-placement: transaction/UnitOfWork usage outside application/
+    case "$f" in */application/*) ;; *)
+        if grep -qE "transaction|unitOfWork|beginTransaction|\.manager\.(save|transaction)" "$f" 2>/dev/null; then
+            report "$f" "1" "txn-placement" "transaction/UnitOfWork logic outside application layer"
+        fi ;;
+    esac
+done < <(find src -type f -name "*.ts" 2>/dev/null || true)
+
+# module-doc depth rules (same layout as Java)
+if [ -d ".pi/architecture/modules" ]; then
+    for doc in .pi/architecture/modules/*.md; do
+        [ -f "$doc" ] || continue
+        doc_name="$(basename "$doc" .md)"
+        depth="$(grep -m1 '^\*\*Modeling Depth:\*\*' "$doc" | sed 's/.*\*\*Modeling Depth:\*\* *//' | cut -d' ' -f1 || true)"
+        docnorm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+        match_dir=""
+        while IFS= read -r d; do
+            norm="$(basename "$d" | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+            if [ "$norm" = "$docnorm" ]; then match_dir="$d"; break; fi
+        done < <(find src -mindepth 1 -maxdepth 1 -type d 2>/dev/null || true)
+        [ -n "$match_dir" ] || continue
+        if [ "$depth" = "adapter" ]; then
+            for layer in domain application; do
+                while IFS= read -r f; do [ -n "$f" ] || continue; report "$f" "1" "adapter-purity" "generic subdomain '${doc_name}' must not contain ${layer}/ model code (ADR-008)"; done < <(find "$match_dir/$layer" -type f -name "*.ts" 2>/dev/null || true)
+            done
+        elif [ "$depth" = "tactical" ]; then
+            while IFS= read -r impl; do
+                [ -n "$impl" ] || continue
+                simple="$(basename "$impl" .ts)"
+                cands="$simple
+$(echo "$simple" | sed -E 's/Impl$//')"
+                found=""
+                while IFS= read -r cand; do
+                    [ -n "$cand" ] || continue
+                    if grep -rqiE "interface ${cand}\\b|abstract class ${cand}\\b|${cand}" "$match_dir/domain" 2>/dev/null; then found=1; break; fi
+                done <<< "$cands"
+                # separator-stripped fallback: invoice-repository <-> InvoiceRepository
+                if [ -z "$found" ]; then
+                    compact="$(printf '%s' "$simple" | tr -d '_-')"
+                    if [ -n "$compact" ] && grep -rqil "$compact" "$match_dir/domain" 2>/dev/null; then found=1; fi
+                fi
+                if [ -z "$found" ]; then report "$impl" "1" "interface-ownership" "adapter without a domain/-owned interface (${simple})"; fi
+            done < <(find "$match_dir/infrastructure" -type f \( -iname "*repository*.ts" -o -iname "*gateway*.ts" -o -iname "*service*.ts" \) 2>/dev/null || true)
+        fi
+    done
+fi
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "model-judgment (ts): ${VIOLATIONS} violation(s)" >&2; exit 1; fi
+echo "model-judgment (ts): all gates passed (dip-domain, txn-placement, interface-ownership, adapter-purity)"
+exit 0

package/templates/pi/scripts/languages/typescript/check_runtime_reachability.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_runtime_reachability.sh — TypeScript (ADR-009)
+#
+# Every service file under src/<module>/application/ must be referenced from
+# production code outside its own module and outside tests. References inside
+# the service's own module or in *.test.ts / __tests__ do not count.
+#
+# Usage: bash check_runtime_reachability.sh [--root <dir>]
+# Exit:  0 all reachable ; 1 dead service(s)
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+
+VIOLATIONS=0
+[ -d src ] || { echo "runtime-reachability (ts): no src/"; exit 0; }
+
+while IFS= read -r svc; do
+    [ -n "$svc" ] || continue
+    case "$svc" in
+        */*test*/|*.test.ts|*.spec.ts) continue ;;
+    esac
+    mod="$(echo "$svc" | sed 's|^src/||; s|/application/.*||')"
+    name="$(basename "$svc" .ts)"
+    # production references: whole src, excluding tests and the service's own module
+    refs="$(grep -rl "\b${name}\b" src 2>/dev/null | grep -vE "/__tests__/|\.(test|spec)\.ts$|/tests?/|^src/${mod}/" | grep -v "^src/${mod}/" | grep -cv '^$' || true)"
+    # also drop the file itself from any residual (own-module exclusion above already does)
+    if [ "${refs:-0}" -eq 0 ]; then
+        echo "$svc: [runtime-reachability] application service has no production caller outside its module (tests-only callers don't count — ADR-009)"
+        VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+done < <(find src -path "*/application/*.ts" -type f 2>/dev/null || true)
+
+if [ "$VIOLATIONS" -gt 0 ]; then
+    echo "runtime-wiring (ts): ${VIOLATIONS} unwired service(s)" >&2
+    exit 1
+fi
+echo "runtime-reachability (ts): all application services reachable from production code"
+exit 0